Decisional Diffie-Hellman Research Articles

Capybara and Tsubaki: Verifiable Random Functions from Group Actions and Isogenies

In this work, we introduce two post-quantum Verifiable Random Function (VRF) constructions based on abelian group actions and isogeny group actions with a twist. The former relies on the standard group action Decisional Diffie-Hellman (GA-DDH) assumption. VRFs serve as cryptographic tools allowing users to generate pseudorandom outputs along with publicly verifiable proofs. Moreover, the residual pseudorandomness of VRFs ensures the pseudorandomness of unrevealed inputs, even when multiple outputs and proofs are disclosed. Our work aims at addressing the growing demand for post-quantum VRFs, as existing constructions based on elliptic curve cryptography (ECC) or classical DDH-type assumptions are vulnerable to quantum threats. In our contributions, our two VRF constructions, rooted in number-theoretic pseudorandom functions, are both simple and secure over the random oracle model. We introduce a new proof system for the factorization of group actions and set elements, serving as the proofs for our VRFs. The first proposal is based on the standard GA-DDH problem, and for its security proof, we introduce the (group action) master Decisional Diffie-Hellman problem over group actions, proving its equivalence to the standard GA-DDH problem. In the second construction, we leverage quadratic twists to enhance efficiency, reducing the key size and the proof sizes, expanding input size. The scheme is based on the square GA-DDH problem. Moreover, we employ advanced techniques from the isogeny literature to optimize the proof size to 39KB and 34KB using CSIDH-512 without compromising VRF notions. The schemes feature fast evaluations but exhibit slower proof generation. To the best of our knowledge, these constructions represent the first two provably secure VRFs based on isogenies.

Efficient Maliciously Secure Oblivious Exponentiations

Oblivious Pseudorandom Functions (OPRFs) allow a client to evaluate a pseudorandom function (PRF) on her secret input based on a key that is held by a server. In the process, the client only learns the PRF output but not the key, while the server neither learns the input nor the output of the client. The arguably most popular OPRF is due to Naor, Pinkas and Reingold (Eurocrypt 2009). It is based on an Oblivious Exponentiation by the server, with passive security under the Decisional Diffie-Hellman assumption. In this work, we strengthen the security guarantees of the NPR OPRF by protecting it against active attacks of the server. We have implemented our solution and report on the performance. Our main result is a new batch OPRF protocol which is secure against maliciously corrupted servers, but is essentially as efficient as the semi-honest solution. More precisely, the computation (and communication) overhead is a multiplicative factor o ( 1 ) as the batch size increases. The obvious solution using zero-knowledge proofs would have a constant factor overhead at best, which can be too expensive for certain deployments. Our protocol relies on a novel version of the DDH problem, which we call the Oblivious Exponentiation Problem (OEP), and we give evidence for its hardness in the Generic Group model. We also present a variant of our maliciously secure protocol that does not rely on the OEP but nevertheless only has overhead o ( 1 ) over the known semi-honest protocol. Moreover, we show that our techniques can also be used to efficiently protect threshold blind BLS signing and threshold ElGamal decryption against malicious attackers.

Provable Security for the Onion Routing and Mix Network Packet Format Sphinx

Onion routing and mix networks are fundamental concepts to provide users with anonymous access to the Internet. Various corresponding solutions rely on the Sphinx packet format. However, flaws in Sphinx's underlying proof strategy were found recently. It is thus currently unclear which guarantees Sphinx actually provides, and, even worse, there is no suitable proof strategy available. In this paper, we restore the security foundation for all these works by building an analytical framework for Sphinx. We discover that the previously-used Decisional Diffie-Hellman (DDH) assumption is insufficient for a security proof and show that the Gap Diffie-Hellman (GDH) assumption is required instead. We apply it to prove that a slightly adapted version of the Sphinx packet format is secure under the GDH assumption. We are thus, to the best of our knowledge, the first to provide a detailed, in-depth security proof for Sphinx that holds. Our adaptations to Sphinx are necessary, as we demonstrate with an attack on sender privacy that would otherwise be possible in Sphinx's adversary model.

Mjolnir: Breaking the Glass in a Publicly Verifiable Yet Private Manner

This paper formally investigates the problem of unauthorized yet required access to electronically protected information, a.k.a. Break-the-Glass (BtG) access. Reflecting on the rising deployment of such protocols in the current digitized healthcare system, we present Mjolnir1, a blockchain-based BtG framework that offers accountability of unauthorized accesses by healthcare practitioners, dependable right of notification to patients, and privacy of healthcare records accesses. Mjolnir is a smart contract-based protocol which provides undisputed public verifiability of the identity of BtG access entities while maintaining their anonymity except from concerned individual patients, hence protecting the patients’ privacy. We employ an application specific non-interactive cryptographic zero knowledge proof system which ensures that the signing entity (healthcare practitioner) belongs to a given authorized group and that the anonymity of their identity is only revocable by a given opening entity (patient). The security of our system relies on the hardness of the discrete logarithm and decisional Diffie-Hellman problems in elliptic curve groups, and the utilized proof system requires no trusted setup. We formally define and prove the security goals of Mjolnir, provide a proof of concept blockchain implementation on Ethereum, and report on performance experiments and comparisons with other generic zero knowledge proof systems.

Identity-based ring signature scheme with multi-designated verifiers

As far as we know, there is only one ring signature scheme with multi-designated verifiers in the literature and the scheme is based on the bilinear pairings which need to consume a lot of computation and under the traditional public key infrastructure (PKI). In order to improve computational efficiency and solve the problem of certificate management in PKI, in this paper, we propose the first identity-based ring signature scheme with multi-designated verifiers without pairings. We prove that our novel scheme's unforgeability, anonymity in the random oracle model and indistinguishability in the standard model under the intractability assumption of discrete logarithm problem and decisional Diffie-Hellman problem, and we prove that our novel scheme's non-transferability in the standard model. We compare the new scheme with a previous scheme in terms of computation and communication at last. The results show that our new scheme is more efficient than the previous scheme and is more suitable for the multi-user setting.

Public-key encryption scheme with optimal continuous leakage resilience

In real-world applications, adversaries can launch leakage attacks, such as side-channel attacks, to obtain some information of the secret states (e.g. secret key, random value, etc.) in cryptographic protocols, compromising their security. Moreover, adversaries can obtain more leakage information by performing leakage attacks continuously, and the leakage attacks can be performed at any time by the adversary. Therefore, when designing public-key encryption (PKE) schemes, one should consider the continuous leakage setting. And it is desirable that the designed schemes can resist the leakage attacks. In this paper, to achieve better continuous leakage resilience, a novel construction of continuous leakage-resilient PKE scheme is proposed. The chosen-ciphertext attacks security of our proposed scheme can be proved based on the hardness of the decisional Diffie-Hellman assumption. Our construction tolerates a large key leakage rate, which is one of the best among existing PKE schemes. Moreover, the level of leakage resilience can be adjusted based on the specific requirements in real-world applications. The analyses demonstrate that our proposal also enjoys low computational overheads, outperforming the existing leakage-resilient PKE schemes.

Sender anonymity: Applying ring signature in gateway-based blockchain for IoT is not enough

Over the last decade, there has been extensive research into the security and privacy of blockchain technology, from the use of ring signatures to ring confidential transactions. Although existing cryptographic methods perform well on traditional blockchain architectures, they do not provide complete privacy in a hierarchical blockchain architecture for Internet of Things (IoT) devices. The blockchain technology is centered at the gateway layer in the hierarchical blockchain architecture, which can easily reveal the transaction sender using network traffic information, thereby violating the sender’s anonymity. Furthermore, the gateway can perform eclipse attacks against transaction senders on a case-by-case basis. To this end, this paper proposes a novel security and privacy blockchain protocol that is better suited to the hierarchical blockchain architecture and thus more appropriate for the IoT environment. Specifically, it leverages the relationship among IoT devices at the perception layer of the hierarchical blockchain architecture for IoT, and constructs an overlay social IoT network by exploiting devices’ multi-agent capabilities. Furthermore, circuit establishment based on multilayered encryption is applied to conceal the transaction propagation path through the overlay social IoT. Theoretical analysis shows that our novel protocol is flexible, evades a malicious gateway, and is secure under the decisional Diffie-Hellman assumption.

A tighter proof for CCA secure inner product functional encryption: Genericity meets efficiency

Inner product functional encryption (IPFE) is a primitive which produces, from a master secret key, decryption keys skk associated to vectors k over some specified base ring. Decrypting an encryption of vector m with skk only reveals 〈k,m〉. Benhamouda et al. [7] provided a generic construction for CCA-secure IPFE from projective hash functions (PHFs), unfortunately their security reduction suffers an exponential loss. Their only instantiation capable of decrypting inner products of large sizes, which relies on the decisional composite residuosity (DCR) assumption, is impractical due to the large size of ciphertexts, decryption keys, and the prohibitive speed of the scheme. Our core contribution is a new approach to proving CCA security. Our constructions maintain the genericity of [7], while our security proof relaxes the requirements on the underlying PHFs and gains in reduction tightness. We instantiate these constructions from the DCR assumption, an assumption in class groups (HSMCL) and the decision Diffie Hellman (DDH) assumption. Our CCA-secure constructions from DCR and HSMCL are the first such schemes to efficiently decrypt inner products of large size, improving by multiple orders of magnitude upon the work of [7]. A single-core C implementation of these schemes shows that, for a 112 bit security, and 100-dimensional vectors, their DCR-based scheme takes 1 h 20 min to encrypt, and over 5 min to decrypt, whereas our slowest scheme takes 5.2 s to encrypt and 0.5 s to decrypt. Similarly a ciphertext for their scheme is of 283 MB; those of our HSMCL-based scheme are of 30 kB.

An Efficient Open Vote Network for Multiple Candidates

In 2010, Hao et al. proposed an efficient decentralized voting protocol known as Open Vote Network (OV-Net), which does not require a trusted third party to count the votes or a private channel to protect ballot secrecy. In the last decade, various studies have been conducted to solve some limitations of the OV-Net, such as fairness and robustness. However, an unresolved problem exists in the OV-Net (and its variants), which is its limited scalability for multiple candidates. The computational cost for tallying, which increases exponentially with the number of candidates, causes the scalability problem. Therefore, in this study, we solve this problem by proposing a variant of the OV-Net for multiple candidates and showing that the computational cost of tallying increases linearly with the number of candidates. Regarding security, we prove that our variant satisfies the ballot secrecy and dispute-freeness in formal security models, based on the decision Diffie-Hellman assumption and non-interactive zero-knowledge properties, respectively. Moreover, regarding the efficiency, we compare the performance of the traditional and proposed OV-Net from the theoretical standpoint and present experimental results to show that the proposed OV-Net variant is considerably more efficient than the traditional OV-Net as the numbers of voters and candidates increase.

Tightly CCA-secure inner product functional encryption scheme

Inner product functional encryption (IPFE) is a modern public key paradigm where the master key can derive a secret key sky for a vector y, which can then be used to decrypt a ciphertext of x to get the inner product 〈x,y〉 as output. In ASIACRYPT 2019, Tomida proposed the first tightly secure IPFE scheme in the multi-user and multi-challenge setting based on the matrix decisional Diffie-Hellman (MDDH) assumption. However, the construction achieves CPA security only. Up to now, there is no IPFE scheme with tight CCA security available.In this paper, we construct the first tightly CCA-secure IPFE scheme in the multi-user and multi-challenge setting. The security reduction to the MDDH assumption (including SXDH, k-LIN, etc.) loses only a factor O(log⁡λ) with λ the security parameter. Moreover, our scheme enjoys full compactness. To support inner product function of dimension m, our SXDH-based IPFE has (m2+8m+14) and (3m+14) group elements in the master public key and ciphertext respectively. This is comparable to the tightly CPA-secure IPFE proposed by Tomida based on the DDH assumption, whose master public key and ciphertext contain (m2+2) and 3m group elements, respectively.Furthermore, we construct the first IPFE with both tight CCA-security and function-hiding property, based on our CCA-secure IPFE. The tight function-hiding CCA security is obtained by adapting the techniques in Lin (CRYPTO 2017) and Gay (PKC 2020) to the multi-user and multi-challenge setting.

Mercurial Signatures for Variable-Length Messages

Abstract Mercurial signatures are a useful building block for privacy-preserving schemes, such as anonymous credentials, delegatable anonymous credentials, and related applications. They allow a signature σ on a message m under a public key pk to be transformed into a signature σ′ on an equivalent message m′ under an equivalent public key pk′ for an appropriate notion of equivalence. For example, pk and pk′ may be unlinkable pseudonyms of the same user, and m and m′ may be unlinkable pseudonyms of a user to whom some capability is delegated. The only previously known construction of mercurial signatures suffers a severe limitation: in order to sign messages of length ℓ, the signer’s public key must also be of length ℓ. In this paper, we eliminate this restriction and provide an interactive signing protocol that admits messages of any length. We prove our scheme existentially unforgeable under chosen open message attacks (EUF-CoMA) under a variant of the asymmetric bilinear decisional Diffie-Hellman assumption (ABDDH).

ECK-Secure Authenticated Key Exchange against Auxiliary Input Leakage

Abstract Authenticated key exchange protocols are quite important primitives for practical applications, since they enable two parties to generate a shared high entropy secret key. In this paper we mainly focus on the authenticated key exchange (AKE) against auxiliary input leakage. As the major contribution of this work, we present a generic framework for the construction of AKE protocols that are secure against auxiliary input leakage. An instantiation based on the generalized decisional Diffie-Hellman (GDDH) assumption in the standard model is also given to demonstrate the feasibility of our proposed framework. We also give a comparison among the existing leakage resilient AKE protocols with auxiliary inputs.

On the Quantum versus Classical Learnability of Discrete Distributions

Here we study the comparative power of classical and quantum learners for generative modelling within the Probably Approximately Correct (PAC) framework. More specifically we consider the following task: Given samples from some unknown discrete probability distribution, output with high probability an efficient algorithm for generating new samples from a good approximation of the original distribution. Our primary result is the explicit construction of a class of discrete probability distributions which, under the decisional Diffie-Hellman assumption, is provably not efficiently PAC learnable by a classical generative modelling algorithm, but for which we construct an efficient quantum learner. This class of distributions therefore provides a concrete example of a generative modelling problem for which quantum learners exhibit a provable advantage over classical learning algorithms. In addition, we discuss techniques for proving classical generative modelling hardness results, as well as the relationship between the PAC learnability of Boolean functions and the PAC learnability of discrete probability distributions.

Impossibility on the Schnorr Signature from the One-More DL Assumption in the Non-Programmable Random Oracle Model

The Schnorr signature is one of the representative signature schemes and its security was widely discussed. In the random oracle model (ROM), it is provable from the DL assumption, whereas there is negative circumstantial evidence in the standard model. Fleischhacker, Jager, and Schröder showed that the tight security of the Schnorr signature is unprovable from a strong cryptographic assumption, such as the One-More DL (OM-DL) assumption and the computational and decisional Diffie-Hellman assumption, in the ROM via a generic reduction as long as the underlying cryptographic assumption holds. However, it remains open whether or not the impossibility of the provable security of the Schnorr signature from a strong assumption via a non-tight and reasonable reduction. In this paper, we show that the security of the Schnorr signature is unprovable from the OM-DL assumption in the non-programmable ROM as long as the OM-DL assumption holds. Our impossibility result is proven via a non-tight Turing reduction.

Mutual heterogeneous signcryption schemes with different system parameters for 5G network slicings

The fifth-generation (5G) network has attracted extensive attention in both industry and academia in the last few years. Network slicing is an important technique for 5G networks to carry out diversity of networks and applications. In order to ensure the information security in network communication, cryptosystem will be deployed in 5G network slicings, so proposing a secure heterogeneous scheme for communication between different 5G network slicings is necessary, in which different 5G network slicings may use different cryptosystems and cryptographic system parameters. In this article, generic model and security model of heterogeneous signcryption with different system parameters (DSPHS) are defined. We propose two DSPHS schemes between certificateless cryptography (CLC) and public key infrastructure (PKI), and in random oracle model (ROM) we prove that our schemes are secure under the discrete logarithm problem (DLP) and decisional Diffie-Hellman Problem (DDHP). Compared with the existing schemes through performance analysis, our advantages lie in using different cryptographic system parameters in different cryptosystems, requiring less computation cost and energy consumption, satisfying known temporary session key security (KTSKS) and message anonymity.

SecAuth-SaaS: a hierarchical certificateless aggregate signature for secure collaborative SaaS authentication in cloud computing

Collaborative cloud business models enable a new dimension of business by giving option to the third party software vendors to deploy their software in the cloud for offering software as a service (SaaS) to the users. However, the secure provisioning of resources requires scalable architecture with efficient authentication for configuring the collaborative software services in the cloud. In this paper, we propose a novel hierarchical certificateless aggregate signature to provide a scalable authentication model for SaaS in cloud computing. Our proposed scheme is secure under the adaptive chosen-message attack in the random oracle model with the hardness assumption of Computational Diffie–Hellman (CDH) problem and Decisional Diffie–Hellman (DDH) problem. Furthermore, our proposed scheme is highly efficient regarding low overhead on computation and communication cost.

Continuous leakage-resilient certificate-based signcryption scheme and application in cloud computing

Leakage of private information, e.g. the secret keys, has become a serious threat to the security of computing systems. It has become a common requirement that real-world security applications should withstand various leakage attacks, such as side-channel attacks, cold-boot attacks, etc. For example, the above leakage attacks are very common in cloud computing nowadays. Hence, we need a novel method to protect the security of data storage and authorization even if a certain amount of leakage information with respect to the secret state can be obtained by any adversary. In order to achieve the above goal, in this paper, we introduce a continuous leakage-resilient certificate-based signcryption (CBS) scheme, and we prove that our proposed scheme achieves the chosen-ciphertext attacks (CCA) security based on the discrete logarithm assumption and the decisional Diffie-Hellman assumption. Our proposed scheme not only has the ability to resist the continuous leakage attacks, but also enjoys very low computational overheads. Moreover, two concrete continuous leakage-resilient data storage and authorization protocols are generated from the above continuous leakage-resilient CBS scheme: one has a single key generation center and the other generates the keys in a distributed form. Therefore, our protocols with continuous leakage resilience are particularly suitable for data storage and authorization in cloud computing system.

A lightweight and provable secure identity-based generalized proxy signcryption (IBGPS) scheme for Industrial Internet of Things (IIoT)

Recently, the Industrial Internet of Things (IIoT) has become increasingly important for applications in the industry. IIoT has essentially become a prime security focus for implementing secure communication. Among the available cryptographic tools, identity-based signcryption provide a sound solution to fulfill the security requirement of IIoT. On the other hand a generalized proxy signcryption can work adaptively as proxy signature and proxy signcryption using a single algorithm. In order to accomplish effective and on-time communication whenever the manager of the company went out for a usual business trip or an IIoT device which has lack of resources, then it must need to delegate her/his signcryption rights to their subordinates (proxy agents/device). For this purpose, to make the delegation procedure more efficient and reliable, we proposed a lightweight identity-based generalized proxy signcryption (IBGPS) scheme for IIoT. The IBGPS scheme is provably secure in terms of indistinguishability against adaptive chosen ciphertext attack (IND − IBGPS − CCA) and existential unforgeable against a possible adaptive chosen message attack (EUF − IBGPS − CMA) under Hyperelliptic Curve Decisional Diffie-Hellman problem (HEDHP) and Hyperelliptic Curve Discrete Logarithm problem (HECDLP) in the random oracle model. Furthermore the performance evaluation in terms of computation and communication costs shows that the IBGPS scheme is more effective than the existing schemes.

STE-AMM: Secret Twist Encryption Standard Access Mechanism Model in Cloud Environment

The advent of the cloud computing has provided the opportunity for various organizations and enterprises to store the data effectively at low cost. With the advancement, the cloud environment manages to have mutli-users to access the data in the cloud based on their request. The requests and the activities of users are monitored and controlled by the group manager based on the roles of them. However due to the dynamic nature of the multi -user clouds result in challenges for ensuring the security of the cloud. Additionally, the revocation of existing users often results in increased overheads. A novel framework of Secret Twisted Encryption based access mechanism model (STE-AMM) is proposed to resolve these issues with two modules. The Square Decisional Diffie-Hellman (SDDH) technique is employed to generate the digital signature for users and used to govern the user in group module. The secret keys to secure the data is generated with the STE algorithm which is the improved Advanced Encryption Standard (AES) and used in the data module. The proposed STE-AMM framework is implemented and evaluated with the metrics of time and cost. The obtained results showed that the performance of the proposed framework is effective than the existing models for securing the data in the cloud. The proposed framework may be enhanced with random size for signature and security key.

Exploring Dynamic Task Loading in SGX-based Distributed Computing

Nowadays, data privacy is one of the most critical concerns in cloud computing, and many privacy-preserving distributed computing systems based on the trusted execution environment (e.g., Intel SGX) have been proposed to protect the user's privacy during cloud-outsourced computation. However, these SGX-based solutions are vulnerable to some traffic analyses, and loading all tasks into the enclave introduces much overhead for frequent EPC-paging. In this paper, we propose a T-SGX framework, which keeps the confidentiality of a distributed job and guarantees the system efficiency by allowing dynamically loading an enclave shared object for the task under processing. In T-SGX, all these objects are secretly shared and stored in a verifiably distributed share management system (SMS) outside the TCB. To mitigate the exposure of sensitive information, we present an efficient oblivious transfer (OT) protocol under the Decisional Diffie-Hellman (DDH) assumption for obliviously transmitting desired shares. Detailed security analysis demonstrates that the proposed T-SGX achieves the goal of secure distributed computing without privacy leakage to unauthorized parties. Finally, we benchmark the framework in six real-world applications, and the experimental results show that T-SGX significantly outperforms a state-of-the-art solution, with 11.9%-29.7% less overhead performing an SGX-based application.