Decisional Diffie-Hellman Assumption Research Articles

Efficient Maliciously Secure Oblivious Exponentiations

Oblivious Pseudorandom Functions (OPRFs) allow a client to evaluate a pseudorandom function (PRF) on her secret input based on a key that is held by a server. In the process, the client only learns the PRF output but not the key, while the server neither learns the input nor the output of the client. The arguably most popular OPRF is due to Naor, Pinkas and Reingold (Eurocrypt 2009). It is based on an Oblivious Exponentiation by the server, with passive security under the Decisional Diffie-Hellman assumption. In this work, we strengthen the security guarantees of the NPR OPRF by protecting it against active attacks of the server. We have implemented our solution and report on the performance. Our main result is a new batch OPRF protocol which is secure against maliciously corrupted servers, but is essentially as efficient as the semi-honest solution. More precisely, the computation (and communication) overhead is a multiplicative factor o ( 1 ) as the batch size increases. The obvious solution using zero-knowledge proofs would have a constant factor overhead at best, which can be too expensive for certain deployments. Our protocol relies on a novel version of the DDH problem, which we call the Oblivious Exponentiation Problem (OEP), and we give evidence for its hardness in the Generic Group model. We also present a variant of our maliciously secure protocol that does not rely on the OEP but nevertheless only has overhead o ( 1 ) over the known semi-honest protocol. Moreover, we show that our techniques can also be used to efficiently protect threshold blind BLS signing and threshold ElGamal decryption against malicious attackers.

Capybara and Tsubaki: Verifiable Random Functions from Group Actions and Isogenies

In this work, we introduce two post-quantum Verifiable Random Function (VRF) constructions based on abelian group actions and isogeny group actions with a twist. The former relies on the standard group action Decisional Diffie-Hellman (GA-DDH) assumption. VRFs serve as cryptographic tools allowing users to generate pseudorandom outputs along with publicly verifiable proofs. Moreover, the residual pseudorandomness of VRFs ensures the pseudorandomness of unrevealed inputs, even when multiple outputs and proofs are disclosed. Our work aims at addressing the growing demand for post-quantum VRFs, as existing constructions based on elliptic curve cryptography (ECC) or classical DDH-type assumptions are vulnerable to quantum threats. In our contributions, our two VRF constructions, rooted in number-theoretic pseudorandom functions, are both simple and secure over the random oracle model. We introduce a new proof system for the factorization of group actions and set elements, serving as the proofs for our VRFs. The first proposal is based on the standard GA-DDH problem, and for its security proof, we introduce the (group action) master Decisional Diffie-Hellman problem over group actions, proving its equivalence to the standard GA-DDH problem. In the second construction, we leverage quadratic twists to enhance efficiency, reducing the key size and the proof sizes, expanding input size. The scheme is based on the square GA-DDH problem. Moreover, we employ advanced techniques from the isogeny literature to optimize the proof size to 39KB and 34KB using CSIDH-512 without compromising VRF notions. The schemes feature fast evaluations but exhibit slower proof generation. To the best of our knowledge, these constructions represent the first two provably secure VRFs based on isogenies.

Provable Security for the Onion Routing and Mix Network Packet Format Sphinx

Onion routing and mix networks are fundamental concepts to provide users with anonymous access to the Internet. Various corresponding solutions rely on the Sphinx packet format. However, flaws in Sphinx's underlying proof strategy were found recently. It is thus currently unclear which guarantees Sphinx actually provides, and, even worse, there is no suitable proof strategy available. In this paper, we restore the security foundation for all these works by building an analytical framework for Sphinx. We discover that the previously-used Decisional Diffie-Hellman (DDH) assumption is insufficient for a security proof and show that the Gap Diffie-Hellman (GDH) assumption is required instead. We apply it to prove that a slightly adapted version of the Sphinx packet format is secure under the GDH assumption. We are thus, to the best of our knowledge, the first to provide a detailed, in-depth security proof for Sphinx that holds. Our adaptations to Sphinx are necessary, as we demonstrate with an attack on sender privacy that would otherwise be possible in Sphinx's adversary model.

Robustly reusable fuzzy extractor from isogeny

Robustly reusable Fuzzy Extractor (rrFE) allows multiple extractions from the same fuzzy source in a reproducible way. The reusability of rrFE asks the pseudo-randomness of the extracted keys, while robustness of rrFE makes sure that active attacks can be detected during the reproduction of the extracted key. With rrFE, we are able to produce cryptographic keys for our cryptosystems from fuzzy sources, like biometrics, physical unclonable functions, etc. There are rrFE schemes from the DDH, LWE and LPN assumptions. However there is no rrFE scheme from isogeny-based assumptions up to now.In this paper, we construct the first rrFE from isogeny. To obtain such an rrFE, we propose a new framework for constructing rrFE with a core technical tool, named Enhanced Effective Group Action (EEGA). EEGA is built upon the basic Effective Group Action (EGA), and is equipped with a sampling algorithm and a derivation algorithm. With such an EEGA, the same random input can be derived to produce different pseudo-random and unpredictable outputs. The EEGA, together with other routine building blocks like secure sketch and extractor, leverages an FE to achieve reusability and robustness. We construct EEGA based on CSI-FiSh, which admits the first rrFE scheme from isogeny. Besides, we also propose another two EEGA instantiations from the DDH assumption, and this provides another approach to DDH-based rrFE, which may be of independent interest.

Group encryption: Full dynamicity, message filtering and code-based instantiation

Group encryption (GE), introduced by Kiayias, Tsiounis and Yung (Asiacrypt'07), is the encryption analogue of group signatures. It allows to send verifiably encrypted messages satisfying certain requirements to certified members of a group, while keeping the anonymity of the receivers. Similar to the tracing mechanism in group signatures, the receiver of any ciphertext can be identified by an opening authority - should the needs arise. The primitive of GE is motivated by a number of interesting privacy-preserving applications, including the filtering of encrypted emails sent to certified members of an organization.This paper aims to improve the state-of-affairs of GE systems. Our first contribution is the formalization of fully dynamic group encryption (FDGE) - a GE system simultaneously supporting dynamic user enrolments and user revocations. The latter functionality for GE has not been considered so far. As a second contribution, we realize the message filtering feature for GE based on a list of t-bit keywords and 2 commonly used policies: “permissive” - accept the message if it contains at least one of the keywords as a substring; “prohibitive” - accept the message if all of its t-bit substrings are at Hamming distance at least d from all keywords, for d≥1. This feature so far has not been substantially addressed in existing instantiations of GE based on DCR, DDH, pairing-based and lattice-based assumptions. Our third contribution is the first instantiation of GE under code-based assumptions. The scheme is more efficient than the lattice-based construction of Libert et al. (Asiacrypt'16) - which, prior to our work, is the only known instantiation of GE under post-quantum assumptions. Our scheme supports the 2 suggested policies for message filtering, and in the random oracle model, it satisfies the stringent security notions for FDGE that we put forward.

Low Communication-Cost PSI Protocol for Unbalanced Two-Party Private Sets

Two-party private set intersection (PSI) plays a pivotal role in secure two-party computation protocols. The communication cost in a PSI protocol is normally influenced by the sizes of the participating parties. However, for parties with unbalanced sets, the communication costs of existing protocols mainly depend on the size of the larger set, leading to high communication cost. In this paper, we propose a low communication-cost PSI protocol designed specifically for unbalanced two-party private sets, aiming to enhance the efficiency of communication. For each item in the smaller set, the receiver queries whether it belongs to the larger set, such that the communication cost depends solely on the smaller set. The queries are implemented by private information retrieval which is constructed with trapdoor hash function. Our investigation indicates that in each instance of invoking the trapdoor hash function, the receiver is required to transmit both a hash key and an encoding key to the sender, thus incurring significant communication cost. In order to address this concern, we propose the utilization of a seed hash key, a seed encoding key, and a Latin square. By employing these components, the sender can autonomously generate all the necessary hash keys and encoding keys, obviating the multiple transmissions of such keys. The proposed protocol is provably secure against a semihonest adversary under the Decisional Diffie–Hellman assumption. Through implementation demonstration, we showcase that when the sizes of the two sets are 28 and 214, the communication cost of our protocol is only 3.3% of the state-of-the-art protocol and under 100 Kbps bandwidth, we achieve 1.46x speedup compared to the state-of-the-art protocol. Our source code is available on GitHub: https://github.com/TAN-OpenLab/Unbanlanced-PSI.

Algebraic Restriction Codes and Their Applications

Consider the following problem: You have a device that is supposed to compute a linear combination of its inputs, which are taken from some finite field. However, the device may be faulty and compute arbitrary functions of its inputs. Is it possible to encode the inputs in such a way that only linear functions can be evaluated over the encodings? I.e., learning an arbitrary function of the encodings will not reveal more information about the inputs than a linear combination. In this work, we introduce the notion of algebraic restriction codes (AR codes), which constrain adversaries who might compute any function to computing a linear function. Our main result is an information-theoretic construction AR codes that restrict any class of function with a bounded number of output bits to linear functions. Our construction relies on a seed which is not provided to the adversary. While interesting and natural on its own, we show an application of this notion in cryptography. In particular, we show that AR codes lead to the first construction of rate-1 oblivious transfer with statistical sender security from the Decisional Diffie–Hellman assumption, and the first-ever construction that makes black-box use of cryptography. Previously, such protocols were known only from the LWE assumption, using non-black-box cryptographic techniques. We expect our new notion of AR codes to find further applications, e.g., in the context of non-malleability, in the future.

A quantum resistant multi-user signcryption scheme featuring key invisibility for Internet of Things

With the advent of ubiquitous computing, multiple heterogeneous devices have evolved with increased connectivity, yielding the Internet of Things (IoT). For establishing secure communication, IoT has effectively become a primary security concern. The massive connectivity of the resource-constrained devices in IoT and enormous data on the air have made information vulnerable to several types of attacks. Although several resource-intensive cryptographic algorithms have been proposed to combat this security threat, signcryption has been identified as a sound solution for such an application.In this work, we propose an isogeny-based signcryption scheme by integrating HyPKE, an isogeny-based encryption scheme with an isogeny-based signature SeaSign based on Fiat Shamir with aborts. Apart from confidentiality and authenticity requirements, our scheme also achieves ciphertext anonymity and key invisibility, unlike the existing signcryption schemes in the post-quantum world. More positively, our security model considers insider attacks, supports multi-users setting and offers non-repudiation. Our work also studies the key privacy notion of the isogeny-based encryption scheme Hashed-PKE, which can be of independent interest in designing several anonymous channels or privacy-preserving protocols. More precisely, we showed Hashed-PKE achieves indistinguishability of keys against chosen-plaintext attack. This leads to the indistinguishability of keys against chosen-ciphertext attack security of HyPKE, a hybrid encryption scheme that is obtained by applying the Fujisaki Okamoto transformation to Hashed-PKE. We have proved our result in the standard model assuming the hardness of the Commutative Supersingular Decisional Diffie–Hellman assumption.

Fine-grained flexible access control: ciphertext policy attribute based encryption for arithmetic circuits

Applying access structure to encrypted sensitive data is one of the challenges in communication networks and cloud computing. Various methods have been proposed to achieve this goal, one of which is attribute-based encryption (ABE). In ABE schemes, the access structure, a.k.a policy, can be applied to the key or ciphertext. Thus, if the policy is applied to the key, the ABE scheme is called the key policy attribute-based encryption (KP-ABE), and if it is applied to the ciphertext, the scheme is called the ciphertext policy attribute-based encryption (CP-ABE). Since in the KP-ABE, the policy is selected once by a trusted entity and is fixed then, they are not suitable for applications where the policy needs to change repeatedly. This problem is solved in CP-ABE, where the policy is selected by the sender and can be changed for each message encryption. Furthermore, it is desired in the ABE schemes that a strong fine-grained access control can be realized. While most of the existing access structures are of Boolean type, an arithmetic access structure can support a stronger fine-grained access structure. We present the first CP-ABE scheme with an arithmetic circuit access policy based on the multilinear maps. First, we outline a basic design and then two improved versions of this scheme, with or without the property of hidden attributes, are introduced. We also define the concept of hidden result attribute based encryption (HR-ABE) which means that the result of the arithmetic function will not be revealed to the users. We define a new hardness assumption, called the \((k-1)\)-distance decisional Diffie–Hellman assumption, which is at least as hard as the k-multilinear decisional Diffie–Hellman assumption. Under this assumption, we prove the adaptive security of the proposed scheme.

Hidden Issuer Anonymous Credential

Identity Management Systems (IMS) allow users to prove characteristics about themselves to multiple service providers. IMS evolved from impractical, site-by-site authentication, to versatile, privacyenhancing Self Sovereign Identity (SSI) Frameworks. SSI frameworks often use Anonymous Credential schemes to provide user privacy, and more precisely unlinkability between uses of these credentials. However, these schemes imply the disclosure of the identity of the Issuer of a given credential to any service provider. This can lead to information leaks. We deal with this problem by introducing a new Anonymous Credential scheme that allows a user to hide the Issuer of a credential, while being able to convince the service providers that they can trust the credential, in the absence of a trusted setup. We prove this new scheme secure under the Computational Diffie Hellman assumption, and Decisional Diffie Hellman assumption, in the Random Oracle Model. We show that this scheme is efficient enough to be used with laptops, and to be integrated into SSI frameworks or any other IMS.

Public-key encryption scheme with optimal continuous leakage resilience

In real-world applications, adversaries can launch leakage attacks, such as side-channel attacks, to obtain some information of the secret states (e.g. secret key, random value, etc.) in cryptographic protocols, compromising their security. Moreover, adversaries can obtain more leakage information by performing leakage attacks continuously, and the leakage attacks can be performed at any time by the adversary. Therefore, when designing public-key encryption (PKE) schemes, one should consider the continuous leakage setting. And it is desirable that the designed schemes can resist the leakage attacks. In this paper, to achieve better continuous leakage resilience, a novel construction of continuous leakage-resilient PKE scheme is proposed. The chosen-ciphertext attacks security of our proposed scheme can be proved based on the hardness of the decisional Diffie-Hellman assumption. Our construction tolerates a large key leakage rate, which is one of the best among existing PKE schemes. Moreover, the level of leakage resilience can be adjusted based on the specific requirements in real-world applications. The analyses demonstrate that our proposal also enjoys low computational overheads, outperforming the existing leakage-resilient PKE schemes.

RMA-CPABE : A multi-authority CPABE scheme with reduced ciphertext size for IoT devices

Internet of Things (IoT) generates a massive amount of data, which can be prone to huge data and privacy leaks unless given a proper access control. Ciphertext-policy attribute-based encryption (CP-ABE) is a well-known cryptographic mechanism that provides confidentiality and fine-grained access to stored data. In CP-ABE, a single trusted authority primarily handles attribute management and its revocation. However, in an environment like IoT, due to its heterogeneous nature, the attributes from multiple domains are evidently inherited by IoT devices and hence develop a need for a multi-authority scheme. Therefore, this paper proposes a novel multi-authority CP-ABE scheme with reduced-size ciphertext (RMA-CPABE) to provide secure access in fog-enabled IoT applications with attributes from multiple domains. This scheme considers the resource-constrained nature of IoT devices and reduces the ciphertext size in the sense that the ciphertext size does not increase linearly with the number of attributes; instead, it increases linearly with the number of multi-domain attribute authorities involved in the policy building. RMA-CPABE supports highly required functionalities like attribute update and outsourced decryption to reduce the computation load on the end devices. Further, the proposed scheme is the first to eliminate the most expensive ciphertext update operation during attribute revocation and addition, which is the biggest drawback of most of the existing schemes. The end-user in RMA-CPABE requires holding only a constant size key to access the ciphertexts securely. The security analysis proves that the proposed scheme is secure against Chosen-Ciphertext Attack (CCA) under multiple augmented Multi-Sequence of Exponents Decisional Diffie Hellman (maMSE-DDH) assumptions. The performance analysis shows that RMA-CPABE is suitable for IoT applications.

Sender anonymity: Applying ring signature in gateway-based blockchain for IoT is not enough

Over the last decade, there has been extensive research into the security and privacy of blockchain technology, from the use of ring signatures to ring confidential transactions. Although existing cryptographic methods perform well on traditional blockchain architectures, they do not provide complete privacy in a hierarchical blockchain architecture for Internet of Things (IoT) devices. The blockchain technology is centered at the gateway layer in the hierarchical blockchain architecture, which can easily reveal the transaction sender using network traffic information, thereby violating the sender’s anonymity. Furthermore, the gateway can perform eclipse attacks against transaction senders on a case-by-case basis. To this end, this paper proposes a novel security and privacy blockchain protocol that is better suited to the hierarchical blockchain architecture and thus more appropriate for the IoT environment. Specifically, it leverages the relationship among IoT devices at the perception layer of the hierarchical blockchain architecture for IoT, and constructs an overlay social IoT network by exploiting devices’ multi-agent capabilities. Furthermore, circuit establishment based on multilayered encryption is applied to conceal the transaction propagation path through the overlay social IoT. Theoretical analysis shows that our novel protocol is flexible, evades a malicious gateway, and is secure under the decisional Diffie-Hellman assumption.

Accountable Monero System with Privacy Protection

Monero is one of the prominent cryptocurrencies bringing robust privacy safeguard levels. However, for Monero lacking accountability, it is easy to use anonymity and privacy for committing the crime without the leakage of identity. And some exchanges are not very receptive to Monero. The purpose of this study is to balance privacy and accountability in Monero. Specifically, we studied the way to provide accountability while keeping privacy. We develop an accountable Monero model. Our model isolates three kinds of roles, users, the trusted registration authority, and a trusted regulator. Accountability enables the trusted regulator to reveal the signer’s identity. Only the trusted regulator can trace users’ public keys as needed. We give a construction for the accountable Monero system by combining CryptoNote protocol with ElGamal encryption. Our instantiation is with a marginal influence on efficiency. The security of our scheme is based on the discrete logarithm and decisional Diffie–Hellman assumption.

Improving Practical UC-Secure Commitments based on the DDH Assumption

At Eurocrypt 2011, Lindell presented practical static and adaptively UC-secure commitment schemes based on the DDH assumption. Later, Blazy et al. (at ACNS 2013) improved the efficiency of the Lindell's commitment schemes. In this paper, we present static and adaptively UC-secure commitment schemes based on the same assumption and further improve the communication and computational complexity, as well as the size of the common reference string.

A CCA-PKE Secure-Cryptosystem Resilient to Randomness Reset and Secret-Key Leakage

In recent years, several new notions of security have begun receiving consideration for public-key cryptosystems, beyond the standard of security against adaptive chosen ciphertext attack (CCA2). Among these are security against randomness reset attacks, in which the randomness used in encryption is forcibly set to some previous value, and against constant secret-key leakage attacks, wherein the constant factor of a secret key’s bits is leaked. In terms of formal security definitions, cast as attack games between a challenger and an adversary, a joint combination of these attacks means that the adversary has access to additional encryption queries under a randomness of his own choosing along with secret-key leakage queries. This implies that both the encryption and decryption processes of a cryptosystem are being tampered under this security notion. In this paper, we attempt to address this problem of a joint combination of randomness and secret-key leakage attacks through two cryptosystems that incorporate hash proof system and randomness extractor primitives. The first cryptosystem relies on the random oracle model and is secure against a class of adversaries, called non-reversing adversaries. We remove the random oracle oracle assumption and the non-reversing adversary requirement in our second cryptosystem, which is a standard model that relies on a proposed primitive called LM lossy functions. These functions allow up to M lossy branches in the collection to substantially lose information, allowing the cryptosystem to use this loss of information for several encryption and challenge queries. For each cryptosystem, we present detailed security proofs using the game-hopping procedure. In addition, we present a concrete instantation of LM lossy functions in the end of the paper—which relies on the DDH assumption.

An Efficient Open Vote Network for Multiple Candidates

In 2010, Hao et al. proposed an efficient decentralized voting protocol known as Open Vote Network (OV-Net), which does not require a trusted third party to count the votes or a private channel to protect ballot secrecy. In the last decade, various studies have been conducted to solve some limitations of the OV-Net, such as fairness and robustness. However, an unresolved problem exists in the OV-Net (and its variants), which is its limited scalability for multiple candidates. The computational cost for tallying, which increases exponentially with the number of candidates, causes the scalability problem. Therefore, in this study, we solve this problem by proposing a variant of the OV-Net for multiple candidates and showing that the computational cost of tallying increases linearly with the number of candidates. Regarding security, we prove that our variant satisfies the ballot secrecy and dispute-freeness in formal security models, based on the decision Diffie-Hellman assumption and non-interactive zero-knowledge properties, respectively. Moreover, regarding the efficiency, we compare the performance of the traditional and proposed OV-Net from the theoretical standpoint and present experimental results to show that the proposed OV-Net variant is considerably more efficient than the traditional OV-Net as the numbers of voters and candidates increase.

Achieving One-Round Password-Based Authenticated Key Exchange over Lattices

<i>Password-based authenticated key exchange</i> (<inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq1-2939836.gif"/></alternatives></inline-formula>) protocol, a widely used authentication mechanism to realize secure communication, allows protocol participants to establish a high-entropy session key by pre-sharing a low-entropy password. An open challenge in <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq2-2939836.gif"/></alternatives></inline-formula> is how to design a quantum-resistant round-optimal <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq3-2939836.gif"/></alternatives></inline-formula>. To solve this challenge, lattice-based cryptography is a promising candidate for post-quantum cryptography. In addition, Katz and Vaikuntanathan (ASIACRYPT&#x2019;09) design the first <i>three-round</i> <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq4-2939836.gif"/></alternatives></inline-formula> protocol by leveraging the smooth projective hash function (<inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq5-2939836.gif"/></alternatives></inline-formula>) over lattices. Subsequently, Zhang and Yu (AISACRYPT&#x2019;17) optimized Katz-Vaikuntanathan&#x2019;s approximate <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq6-2939836.gif"/></alternatives></inline-formula> via a splittable public key encryption. They then constructed a <i>two-round</i> <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq7-2939836.gif"/></alternatives></inline-formula> by using the simulation-sound non-interactive zero-knowledge (NIZK) proofs, but how to construct a lattice-based simulation-sound NIZK remains an open research question. In other words, how to design a one-round <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq8-2939836.gif"/></alternatives></inline-formula> via an efficient lattice-based <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq9-2939836.gif"/></alternatives></inline-formula> still remains a challenge. In this work, we attempt to fill this gap by proposing a lattice-based <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq10-2939836.gif"/></alternatives></inline-formula> with adaptive smoothness. We then obtain a <i>one-round</i> <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq11-2939836.gif"/></alternatives></inline-formula> protocol over lattices with rigorous security analysis by integrating the proposed <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq12-2939836.gif"/></alternatives></inline-formula> into the one-round framework proposed by Katz and Vaikuntananthan (TCC&#x2019;11). Furthermore, we explore the possibilities of achieving two-round <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq13-2939836.gif"/></alternatives></inline-formula> and universal composable (UC) security from our <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq14-2939836.gif"/></alternatives></inline-formula>, and show the potential application of our <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq15-2939836.gif"/></alternatives></inline-formula> in Internet of Things (IoTs) where communication cost is the main consideration.

Tightly CCA-secure inner product functional encryption scheme

Inner product functional encryption (IPFE) is a modern public key paradigm where the master key can derive a secret key sky for a vector y, which can then be used to decrypt a ciphertext of x to get the inner product 〈x,y〉 as output. In ASIACRYPT 2019, Tomida proposed the first tightly secure IPFE scheme in the multi-user and multi-challenge setting based on the matrix decisional Diffie-Hellman (MDDH) assumption. However, the construction achieves CPA security only. Up to now, there is no IPFE scheme with tight CCA security available.In this paper, we construct the first tightly CCA-secure IPFE scheme in the multi-user and multi-challenge setting. The security reduction to the MDDH assumption (including SXDH, k-LIN, etc.) loses only a factor O(log⁡λ) with λ the security parameter. Moreover, our scheme enjoys full compactness. To support inner product function of dimension m, our SXDH-based IPFE has (m2+8m+14) and (3m+14) group elements in the master public key and ciphertext respectively. This is comparable to the tightly CPA-secure IPFE proposed by Tomida based on the DDH assumption, whose master public key and ciphertext contain (m2+2) and 3m group elements, respectively.Furthermore, we construct the first IPFE with both tight CCA-security and function-hiding property, based on our CCA-secure IPFE. The tight function-hiding CCA security is obtained by adapting the techniques in Lin (CRYPTO 2017) and Gay (PKC 2020) to the multi-user and multi-challenge setting.

Mercurial Signatures for Variable-Length Messages

Abstract Mercurial signatures are a useful building block for privacy-preserving schemes, such as anonymous credentials, delegatable anonymous credentials, and related applications. They allow a signature σ on a message m under a public key pk to be transformed into a signature σ′ on an equivalent message m′ under an equivalent public key pk′ for an appropriate notion of equivalence. For example, pk and pk′ may be unlinkable pseudonyms of the same user, and m and m′ may be unlinkable pseudonyms of a user to whom some capability is delegated. The only previously known construction of mercurial signatures suffers a severe limitation: in order to sign messages of length ℓ, the signer’s public key must also be of length ℓ. In this paper, we eliminate this restriction and provide an interactive signing protocol that admits messages of any length. We prove our scheme existentially unforgeable under chosen open message attacks (EUF-CoMA) under a variant of the asymmetric bilinear decisional Diffie-Hellman assumption (ABDDH).