Hierarchical Identity-based Encryption Scheme Research Articles

Tightly secure (H)IBE in the random oracle model

We present an adaptively secure identity-based encryption (IBE) scheme with constant sized parameters and constant security loss in multi-instance multi-ciphertext (MIMC) setting in prime-order groups, in the random oracle model. We then further construct an adaptively secure hierarchical identity-based encryption (HIBE) scheme with shorter sized parameters and constant security loss in the MIMC setting in prime-order groups, in the random oracle model.At the core of our technique, we observe that the pseudorandomness property of the random oracle matches the conditions of Left Subgroup Indistinguishability (LS) and Right Subgroup Indistinguishability (RS) in dual system groups (DSG) well, so that we can transform the queried secret keys and the challenge ciphertexts for once. We construct our IBE scheme from Agrawal and Chase's work (CCS 2017) and construct our HIBE scheme from Boneh et al.'s work (Eurocrypt 2005). As a byproduct of our IBE scheme, we construct a new DSG instantiation from Chen et al.'s work (Eurocrypt 2015) under bi-MDDH assumption.

Anonymous hierarchical identity-based encryption with delegated traceability for cloud-based data sharing systems

Cloud-based data sharing systems (DSS) have become prevalent due to their ample storage and convenient access control. To protect sensitive data privacy in DSS, anonymous identity-based encryption (IBE) is a promising approach, enabling encryption using a recipient’s identity as a public key, while preventing identity and data leaks out of ciphertexts. As complete anonymity risks abuse and illegal usage, Blazy et al. introduced the notion called anonymous IBE with traceable identities (AIBET) at ARES’19, allowing users with tracing keys to identify recipients from ciphertexts. Unfortunately, existing AIBET schemes lack tracing key delegation and only consider security in weaker models (i.e., selective-identity attacks and chosen-plaintext attacks), posing risks of inconvenience and user privacy leaks. In this paper, we introduce a novel notion called anonymous hierarchical identity-based encryption with delegated traceability (AHIBEDT) for DSS. We formalize its syntax and define security notions in stronger models (i.e., adaptive-identity attacks and chosen-ciphertext attacks). In addition, we demonstrate that a concrete AHIBEDT scheme can be simply obtained from a hierarchical IBE scheme and a one-time signature scheme. The comparison results indicate that, despite a substantial increase in communication and computational costs, our approach achieves better security and functionality.

A direct construction of continuous leakage-resilient (H)IBE scheme with CCA security from dual system encryption

Continuous leakage resilient semantically secure Identity-based Encryption (IBE) schemes created with dual system encryption technique were presented by Lewko et al. at TCC 2011 and Yuen et al. at Eurocrypt 2012, respectively. It has been a research challenge to achieve the security against chosen-ciphertext attacks (CCA). The previous attempts toward the CCA security rely on q-type assumptions, which are referred as non-static assumptions causing loose reduction in security proofs. In this paper, we provide a complete solution to the problem and show how to construct the continuous leakage-resilient IBE with weaker CCA security based on the dual system encryption technique, where the adversary is allowed to make continuous leakage queries. We are able to prove its security with static assumptions in the standard model. As a feature of our scheme, we allow leakage of multiple keys, i.e., leakage of the master secret key and the private key of user. Our scheme also enjoys better computational performance, since the round leakage parameter is independent of the plaintext space and has a constant size. Furthermore, our scheme can be easily extended to give the weaker CCA secure continuous leakage-resilient hierarchical identity-based encryption scheme with a short ciphertext length.

Algorithms for the Generalized NTRU Equations and their Storage Analysis

In LATTE, a lattice based hierarchical identity-based encryption (HIBE) scheme, each hierarchical level user delegates a trapdoor basis to the next level by solving a generalized NTRU equation of level ℓ ≥ 3. For ℓ = 2, Howgrave-Graham, Pipher, Silverman, and Whyte presented an algorithm using resultant and Pornin and Prest presented an algorithm using a field norm with complexity analysis. Even though their ideas of solving NTRU equations can be conceptually extended for ℓ ≥ 3, no explicit algorithmic extensions with the storage analysis are known so far. In this paper, we interpret the generalized NTRU equation as the determinant of a matrix. By using the mathematical properties of the determinant, we show that how to construct algorithms for solving the generalized NTRU equation either using resultant or a field norm for any ℓ ≥ 3. We also obtain an upper bound of the size of solutions by using the properties of the determinant. From our analysis, the storage requirement of the algorithm using resultant is O(ℓ2n2 logB) and that of the algorithm using a field norm is O(ℓ2n logB), where B is an upper bound of the coefficients of the input polynomials of the generalized NTRU equations. We present examples of our algorithms for ℓ = 3 and the average storage requirements for ℓ = 3; 4.

A generic construction for revocable identity-based encryption with subset difference methods.

To deal with dynamically changing user's credentials in identity-based encryption (IBE), providing an efficient key revocation method is a very important issue. Recently, Ma and Lin proposed a generic method of designing a revocable IBE (RIBE) scheme that uses the complete subtree (CS) method by combining IBE and hierarchical IBE (HIBE) schemes. In this paper, we propose a new generic method for designing an RIBE scheme that uses the subset difference (SD) method instead of using the CS method. In order to use the SD method, we generically design an RIBE scheme by combining IBE, identity-based revocation (IBR), and two-level HIBE schemes. If the underlying IBE, IBR, and HIBE schemes are adaptively (or selectively) secure, then our RIBE scheme is also adaptively (or selectively) secure. In addition, we show that the layered SD (LSD) method can be applied to our RIBE scheme and a chosen-ciphertext secure RIBE scheme also can be designed generically.

Tightly Secure Hierarchical Identity-Based Encryption

We construct the first tightly secure hierarchical identity-based encryption (HIBE) scheme basedon standard assumptions, which solves an open problem from Blazy, Kiltz, and Pan (CRYPTO 2014).At the core of our constructions is a novel randomization technique that enables us to randomizeuser secret keys for identities with flexible length.The security reductions of previous HIBEs lose at least a factor of Q, which is the number ofuser secret key queries. Different to that, the security loss of our schemes is only dependent onthe security parameter. Our schemes are adaptively secure based on the Matrix Diffie-Hellmanassumption, which is a generalization of standard Diffie-Hellman assumptions such as k-Linear. Wehave two tightly secure constructions, one with constant ciphertext size, and the other with tightersecurity at the cost of linear ciphertext size. Among other things, our schemes imply the first tightlysecure identity-based signature scheme by a variant of the Naor transformation.

A unified framework of identity-based sequential aggregate signatures from 2-level HIBE schemes

Identity-based sequential aggregate signature (IBSAS for short) schemes, introduced by Boldyreva et al. [CCS 2007], allow a large quantity of signers to generate one signature sequentially, in which these messages as well as their order can be attested by employing their identities. In such a scheme, storage space and bandwidth overhead can be reduced. To our best knowledge, though many concrete IBSAS schemes have been constructed in literature, none of them is constructed under a standard computational hardness assumption and unforgeable under the standard model. The problem of how to construct such schemes is still open. Latterly, Gentry et al. [PKC 2018] proposed a unified construction of SAS (i.e., abbreviated form of sequential aggregate signature) schemes by employing trapdoor permutation and ideal ciphers. Motivated by the above problem and hints, here we study how to construct IBSAS schemes in a new unified perspective. By employing 2-level HIBE (i.e., abbreviated form of hierarchical identity-based encryption) schemes, we present unified construction of IBSAS schemes and give a rigorous proof of their unforgeability. The unified construction is then instantiated to get a concrete IBSAS scheme, which has existential unforgeability under the standard model using a standard computational hardness assumption (i.e., the CDH assumption). An extra fruit is that it can be used to construct an existentially unforgeable IBSAS scheme using the Learning with Errors problem, which is constructed under a lattice hardness assumption for the first time. In the end, we show a detailed performance comparison among our schemes and previous ones.

Public key encryption with equality test in the standard model

Public key encryption with equality test (PKEET) is a cryptosystem that allows a tester who has trapdoors issued by one or more users Ui to perform equality tests on ciphertexts encrypted using public key(s) of Ui. Since this feature has a lot of practical applications including search on encrypted data, several PKEET schemes have been proposed so far. However, to the best of our knowledge, all the existing proposals are proven secure only under the hardness of number-theoretic problems and/or the random oracle heuristics.In this paper, we show that this primitive can be achieved not only generically from well-established other primitives but also even without relying on the random oracle heuristics. More precisely, our generic construction for PKEET employs a two-level hierarchical identity-based encryption scheme, which is selectively secure against chosen plaintext attacks, a strongly unforgeable one-time signature scheme and a cryptographic hash function. Our generic approach toward PKEET has several advantages over all the previous works; it directly leads the first standard model construction and also directly implies the first lattice-based construction. Finally, we show how to extend our approach to the identity-based setting.

Leakage-Resilient Hierarchical Identity-Based Encryption with Recipient Anonymity

As a promising public key cryptographic primitive, hierarchical identity-based encryption (HIBE) introduces key delegation mechanisms into identity-based encryption. However, key leakage and recipient anonymity issues have not been adequately addressed in HIBE. Hence, direct applications of traditional HIBE schemes will violate data security and abuse users’ privacy in practice. In this paper, we propose an anonymous unbounded hierarchical identity-based encryption scheme, which achieves bounded leakage resilience and the hierarchy depth is not limited. Our security proofs based on the dual system encryption technique show that the proposed scheme is capable of resisting key leakage and it realizes recipient anonymity in the standard model. In addition, leakage resilience analysis indicates that our scheme allows the leakage rate of approximate 1/3 no matter the hierarchy depth of identities. Finally, performance comparisons show the practicability of our scheme. In particular, the secret key of our construction is of a fixed-length.

Implementation of Algorithms for Identity Based Encryption and Decryption

Identity-based cryptosystems were introduced to overcome one of the main problems in public key encryption, the generation of public and private keys. In the identity-based cryptosystem, an identifier such as an e-mail address of a user can be used to generate public and private keys by a trusted third party. The trusted third party uses a system-wide master secret to provide private keys to a user. Identity-based cryptosystems can be constructed using the idea of pairings. This article discusses four different identity-based cryptosystems: the Boneh-Franklin scheme, the Cock's scheme, the Authenticated IBE scheme and the Hierarchical IBE scheme. This article also discusses the security notions considered for the identity-based cryptosystem. The security notions considered are: one-wayness, indistinguishability, semantic security and non-malleability. An architecture consisting of a public parameter server and private key generator for the implementation of the identity-based cryptosystems is also discussed.

Analysis of hierarchical identity based encryption schemes and its applicability to computing environments

Hierarchical Identity Based Encryption (HIBE) enhances the scalability of Identity based encryption scheme, by sharing the workload of the root Private Key Generator (PKG) among multiple lower-level PKGs, facilitating intermediate key escrows and private key delegation. Owing to its structure, HIBE can be deployed to provide access control in cloud, pervasive computing systems, wireless sensor networks and Massively Multiplayer Online Role-Playing Games (MMORPGs). Additionally, HIBE can be used to perform search on encrypted data, forward secure encryption, fully private communication, limited delegation and damage control. This paper evaluates different approaches in the construction of HIBE protocols to determine practical frameworks. Specific criterions like cryptographic proof models, tightness of the reduction, recipient anonymity, hardness assumptions, bounded depth, revocability, types of pairing and ciphertext indistinguishability properties, were used as benchmarks for assessing each scheme. The efficiency in terms of storage and computation overhead, was estimated to identify suitable protocols for securing different computing environments. The future prospective applications of HIBE protocols were also investigated.

Efficient revocable hierarchical identity-based encryption using cryptographic accumulators

Hierarchical identity-based encryption is an important extension from IBE and has found many applications in the network world. Private key revocation is a crucial requirement for any public key system. In this paper, we propose a novel revocation method for the hierarchical identity-based encryption. Existing revocable hierarchical identity-based encryption schemes have several disadvantages: the key update size increases logarithmically with the number of users in the system, the public information of key update received by each user is different and always related to the level of the identity hierarchy and the security proof of the revocable scheme is very complex. In our scheme, cryptographic accumulators are used to compress hierarchical levels and revoked users’ information into constant values. So we achieve almost constant size of private key update which is irrelevant with the user number in the system. Because of the compression of hierarchical information we can use simple dual system encryption techniques to prove our scheme to be fully secure under several common assumptions without resorting to complex nested dual system encryption techniques.

Anonymous hierarchical identity-based encryption with bounded leakage resilience and its application

Hierarchical identity-based encryption can be used to protect the sensitive data in cloud system. However, as the traditional security model does not capture side-channel attacks, many hierarchical identity-based encryption schemes do not resist this kind of attack, which can exploit various forms of unintended information leakage. Inspired by these, leakage-resilience cryptography formalises some models of side-channel attacks. In this paper, we consider the memory leakage resilience in anonymous hierarchical identity-based encryption schemes. By applying Lewko et al.'s tools, we construct a master key leakage-resilient anonymous hierarchical identity-based encryption scheme based on dual system encryption techniques. As an interesting application of our scheme, we consider security for public-key encryption with multi-keyword ranked search (PEMKRS) in the presence of secret key leakage in the trapdoor generation algorithm, and provide a generic construction of leakage-resilient secure PEMKRS from a master key leakage-resilient anonymous hierarchical identity-based encryption scheme.

Anonymous hierarchical identity-based encryption with bounded leakage resilience and its application

Hierarchical identity-based encryption can be used to protect the sensitive data in cloud system. However, as the traditional security model does not capture side-channel attacks, many hierarchical identity-based encryption schemes do not resist this kind of attack, which can exploit various forms of unintended information leakage. Inspired by these, leakage-resilience cryptography formalises some models of side-channel attacks. In this paper, we consider the memory leakage resilience in anonymous hierarchical identity-based encryption schemes. By applying Lewko et al.'s tools, we construct a master key leakage-resilient anonymous hierarchical identity-based encryption scheme based on dual system encryption techniques. As an interesting application of our scheme, we consider security for public-key encryption with multi-keyword ranked search (PEMKRS) in the presence of secret key leakage in the trapdoor generation algorithm, and provide a generic construction of leakage-resilient secure PEMKRS from a master key leakage-resilient anonymous hierarchical identity-based encryption scheme.

Revocable hierarchical identity-based encryption over lattice for pay-TV systems

In case the subscriber's certificate may be expired or revealed, a revocable mechanism is needed in a dynamic pay-TV system. Considering the hierarchical structure in this system, a revocable hierarchical identity-based encryption (RHIBE) scheme is a better choice than other schemes. But the well-known RHIBE schemes are constructed on the bilinear pairings. In this paper, two efficient and practical schemes are issued on lattice. Our first scheme is secure against adaptive identity-time attacks in the random oracle (RO) model and the second is against selective identity-time attacks in standard model. The security of both schemes is reduced to the learning with errors (LWE) assumption. In particular, the proposed scheme's basis delegation algorithms are run in the fixed dimension and the ciphertexts are shorter than existing schemes. Both schemes are much more efficient than the known works in terms of computation cost and storage cost.

CCA-secure revocable identity-based encryption schemes with decryption key exposure resistance

Key revocation functionality is important for identity-based encryption (IBE) to manage users dynamically. Revocable IBE (RIBE) realises such revocation functionality with scalability. In PKC 2013, Seo and Emura first considered decryption key exposure resistance (DKER) as a new realistic threat, and proposed the first RIBE scheme with DKER. Their RIBE scheme is adaptively secure against chosen plaintext attacks (CPA), and there is no concrete RIBE scheme adaptively secure against chosen ciphertext attacks (CCA) even without DKER so far. In this paper, we first propose three constructions of adaptively CCA-secure RIBE schemes with DKER. The first and second schemes are based on an existing transformation, which is called a BCHK transformation, that a CPA-secure hierarchical IBE scheme can be transformed into a CCA-secure scheme. The third scheme is constructed via the KEM/DEM framework. Specifically, we newly propose a revocable identity-based key encapsulation mechanism (RIB-KEM), and we show a generic construction of a CCA-secure RIBE scheme from the RIB-KEM and a data encapsulation mechanism (DEM). The third scheme is more efficient than the first and second ones in terms of the ciphertext size.

Efficient hierarchical identity based encryption scheme in the standard model over lattices

Using lattice basis delegation in a fixed dimension, we propose an efficient lattice-based hierarchical identity based encryption (HIBE) scheme in the standard model whose public key size is only (dm 2 + mn) log q bits and whose message-ciphertext expansion factor is only log q, where d is the maximum hierarchical depth and (n, m, q) are public parameters. In our construction, a novel public key assignment rule is used to averagely assign one random and public matrix to two identity bits, which implies that d random public matrices are enough to build the proposed HIBE scheme in the standard model, compared with the case in which 2d such public matrices are needed in the scheme proposed at Crypto 2010 whose public key size is (2dm 2 + mn +m) log q. To reduce the message-ciphertext expansion factor of the proposed scheme to log q, the encryption algorithm of this scheme is built based on Gentry’s encryption scheme, by which m 2 bits of plaintext are encrypted into m 2 log q bits of ciphertext by a one time encryption operation. Hence, the presented scheme has some advantages with respect to not only the public key size but also the message-ciphertext expansion factor. Based on the hardness of the learning with errors problem, we demonstrate that the scheme is secure under selective identity and chosen plaintext attacks.

Survey on Identity based and Hierarchical Identity based Encryption Schemes

this paper, we present a comprehensive picture and the state of the art of Identity Based Cryptography (IBC) and their security implications with applications. First, we introduce the basic concepts of security and principles of cryptography and then move into identity-based cryptography, an overview of its development process and research progress. We explain identity-based encryption (IBE) schemes and identity-based signature (IBS) schemes and their security analysis. Later, we discuss the hierarchical identity-based encryption (HIBE) present in standard model as well as in random oracle model. We also discuss Revocable Identity Based Encryption (RIBE) schemes from the view point of security models and constructions.

Hierarchical ID-based Encryption with Minimized Key Escrow

Identity-based cryptography is a public key cryptosystem in which any arbitrary string such as identity, email address of user can be used as a public key and the corresponding private key is generated by a private key generator (PKG) and given to the user through a secure channel[1][2]. It has advantage in key distribution, but also has drawback of key escrow that PKG knows user’s private key. If multiple PKGs with independent certification domain are used and users belong to different PKGs, it was considered that expanding certification using only ID-based cryptography is difficult between two users who belong to different PKG domains. Gentry and Silverberg[3] presented a hierarchical identity based cryptography which successfully expands certification among multiple PKGs structured in hierarchical manner, thus lots of extended researches followed from it [4-10]. But this scheme has a drawback that all ancestor PKGs of a user can decrypt any message sent to the user even though they do not have the private key of the user, which is very undesirable feature. In this paper we modify Gentry and Silverberg’s hierarchical identity based encryption (HIBE) scheme and present a new HIBE scheme which minimize the key escrow property 접수일(2015년10월27일), 심사의뢰일(2015년10월28일), 심사완료일(1차:2015년11월02일, 2차:2015년11월28일) 게재확정일(2015년12월07일), 게재일(2015년12월31일) 312-702 충청남도 금산군 추부면 마전리 중부대학교 정보보호학과. email: sultan@jbm.ac.kr 키에스크로를 최소화한 계층적 아이디기반 암호 Copyright c 2015 SERSC 546 that only user and the end PKG who issued private key to the user can decrypt message.

Compact Anonymous Hierarchical Identity-Based Encryption with Constant Size Private Keys: TABLE 1.

We present a new construction of anonymous hierarchical identity-based encryption (HIBE) over prime order groups. The distinct feature of our proposed scheme is that both private key and ciphertext have a constant size, which has never been achieved in all other existing anonymous HIBE schemes. Moreover, we utilized a double exponent technique to generate the ciphertext in order to provide anonymity. This simple and efficient method allows us to construct a more compact anonymous HIBE in prime order groups. Under the decisional bilinear |$n+1$|-Diffie–Hellman exponent assumption and linear assumption, we show that the proposed scheme is secure and anonymous against chosen plaintext attacks in the standard model.