Identity-based Encryption Scheme Research Articles

A Compact Multi-Identity Fully Homomorphic Encryption Scheme Without Fresh Ciphertexts

The lattice-based multi-identity fully homomorphic encryption scheme combines the quantum security of lattice cryptography with the advantage of identity-based encryption. However, existing schemes face challenges such as large key sizes, inefficient ciphertext expansion processes, and reliance on outdated trapdoor designs, limiting their compactness and practicality. In this study, we propose a novel Compact Multi-Identity Fully Homomorphic Encryption Scheme (WZ-MIBFHE) that eliminates the need for fresh ciphertexts during expansion. First, we construct a compact identity-based encryption scheme by combining the YJW23 trapdoor and ABB10 under the standard model, proving its IND-sID-CPA security. The scheme is then adapted to ensure correctness and security when integrated with the decomposition method for ciphertext expansion. This adaptation also utilizes approximation errors to reduce overall noise. Finally, we expand the modified IBE scheme’s ciphertext using the decomposition method to construct the WZ-MIBFHE scheme. Compared to existing methods, WZ-MIBFHE reduces the lattice dimension to nlogq+logbq, improves public and private key sizes, and significantly lowers ciphertext expansion rates by removing the need for fresh ciphertexts. These improvements enhance both the compactness and efficiency of the scheme, making it a promising solution for multi-identity homomorphic encryption.

Tightly secure (H)IBE in the random oracle model

Tightly secure (H)IBE in the random oracle model

Quantum safe lightweight encryption scheme for secure data sharing in Internet of Nano Things

Quantum safe lightweight encryption scheme for secure data sharing in Internet of Nano Things

A lattice-based efficient certificateless public key encryption for big data security in clouds

A lattice-based efficient certificateless public key encryption for big data security in clouds

Identity-Based Encryption with (Almost) Tight Security in the Multi-instance, Multi-ciphertext Setting

We construct an identity-based encryption (IBE) scheme that is tightly secure in a very strong sense. Specifically, we consider a setting with many instances of the scheme and many encryptions per instance. In this setting, we reduce the security of our scheme to a variant of a simple assumption used for a similar purpose by Chen and Wee (CRYPTO 2013, Springer, 2013). The security loss of our reduction is O(k)\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extbf{O} (k)$$\\end{document} (where k\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$k $$\\end{document} is the security parameter). Our scheme is the first IBE scheme to achieve this strong flavor of tightness under a simple assumption. Technically, our scheme is a variation of the IBE scheme by Chen and Wee. However, in order to “lift” their results to the multi-instance, multi-ciphertext case, we need to develop new ideas. In particular, while we build on (and extend) their high-level proof strategy, we deviate significantly in the low-level proof steps.

A lattice-based forward secure IBE scheme for Internet of things

A lattice-based forward secure IBE scheme for Internet of things

Anonymous hierarchical identity-based encryption with delegated traceability for cloud-based data sharing systems

Anonymous hierarchical identity-based encryption with delegated traceability for cloud-based data sharing systems

FABRIC: Fast and Secure Unbounded Cross-System Encrypted Data Sharing in Cloud Computing

Existing proxy re-encryption (PRE) schemes to secure cloud data sharing raise challenges such as supporting the heterogeneous system efficiently and achieving the unbounded feature. To address this problem, we proposed a fast and secure unbounded cross-domain proxy re-encryption scheme, named FABRIC, which enables the delegator to authorize the semi-trusted cloud server to convert one ciphertext of an identity-based encryption (IBE) scheme to another ciphertext of an attribute-based encryption (ABE) scheme. As the first scheme to achieve the feature mentioned above, FABRIC not only enjoys constant computation overhead in the encryption, decryption, and re-encryption phases when the quantity of attributes increases, but is also unbounded such that the new attributes or roles could be adopted into the system anytime. Furthermore, FABRIC achieves adaptive security under the decisional linear assumption (DLIN). Eventually, detailed theoretical and experimental analysis proved that FABRIC enjoys excellent performance in efficiency and practicality in the cloud computing scenario.

PIRB: Privacy-Preserving Identity-Based Redactable Blockchains with Accountability

In this paper, we propose a privacy-preserving identity-based redactable blockchain (PIRB), the first identity-based redactable blockchain that supports flexible policies while maintaining accountability. Based on digital identities, PIRB enables a knowledge owner to set one policy for a batch of users while preserving policy privacy. Furthermore, similar to state-of-the-art solutions, PIRB draws inspiration from the proxy re-encryption technique to enforce user accountability. The design of PIRB entails addressing two primary technical challenges: firstly, achieving a flexible policy while upholding policy privacy; secondly, establishing accountability measures. To tackle the former challenge, we propose an enhanced identity-based encryption scheme that integrates polynomial function techniques. To address the latter challenge, a distinct identifier is generated for each user and subsequently concealed within the user’s secret key. Specifically, following existing schemes, we present the first scheme PIRB-I to cater to one-way access control scenarios, empowering owners to define access policies for designated editors. Additionally, recognizing the needs on the editor side for owner selection, we enhance PIRB-I through the introduction of matchmaking encryption, thereby supporting bilateral access control in a framework denoted as the second scheme PIRB-II. Notably, PIRB-I and PIRB-II involve a trade-off between computational and communication complexities. Specifically, when contrasted with PIRB-I, PIRB-II facilitates editors in owner selection, thereby mitigating editors’ communication overheads at the cost of increased computational overheads during policy generation and matching. Theoretical analysis demonstrates the inherent trade-off complexity and the resilience exhibited by PIRB-I and PIRB-II against chosen-plaintext attacks. Extensive experimentation on the FISCO blockchain shows that, compared with the state-of-the-art works, PIRB-I and PIRB-II achieve 200 times and 100 times computational efficiency improvements and 50 times and 60 times communication efficiency improvements on average, respectively.

IoT-friendly, pre-computed and outsourced attribute based encryption

IoT-friendly, pre-computed and outsourced attribute based encryption

KDM Security IBE Based on LWE beyond Affine Functions

Key-dependent message (KDM) security identity-based encryption (IBE) schemes aim to solve the security risks caused by the dependency between plaintext and secret keys in traditional IBE schemes. However, current KDM-IBE schemes are only secure with respect to affine functions, which limits their security level when a message is derived from the evaluation of a polynomial function using the secret key. To address this issue, in this study, we propose a novel approach to construct a KDM-IBE scheme with respect to polynomial or even arbitrary functions that achieves maximum security based on the learning with errors (LWE) assumption. Our approach overcomes two major technical barriers to constructing KDM-IBE schemes with respect to polynomial functions. Compared to existing KDM-IBE schemes, our proposed scheme ensures the secrecy of the key-related plaintext, even when it is obtained using arbitrary functions, not just affine functions. Thus, our approach provides a more robust solution to the security risks inherent in traditional IBE schemes.

A computer-aided feature-based encryption model with concealed access structure for medical Internet of Things

A computer-aided feature-based encryption model with concealed access structure for medical Internet of Things

Anonymous Homomorphic IBE with Application to Anonymous Aggregation

All anonymous identity-based encryption (IBE) schemes that are group homomorphic (to the best of our knowledge) require knowledge of the identity to compute the homomorphic operation. This paper is motivated by this open problem, namely to construct an anonymous group-homomorphic IBE scheme that does not sacrifice anonymity to perform homomorphic operations. Note that even when strong assumptions, such as indistinguishability obfuscation (iO), are permitted, no schemes are known. We succeed in solving this open problem by assuming iO and the hardness of the DBDH problem over rings (specifically, ZN2 for RSA modulus N). We then use the existence of such a scheme to construct an IBE scheme with re-randomizable anonymous encryption keys, which we prove to be IND-ID-RCCA secure. Finally, we use our results to construct identity-based anonymous aggregation protocols.

Improving User Privacy in Identity-Based Encryption Environments

The promise of identity-based systems is that they maintain the functionality of public key cryptography while eliminating the need for public key certificates. The first efficient identity-based encryption (IBE) scheme was proposed by Boneh and Franklin in 2001; variations have been proposed by many researchers since then. However, a common drawback is the requirement for a private key generator (PKG) that uses its own master private key to compute private keys for end users. Thus, the PKG can potentially decrypt all ciphertext in the environment (regardless of who the intended recipient is), which can have undesirable privacy implications. This has led to limited adoption and deployment of IBE technology. There have been numerous proposals to address this situation (which are often characterized as methods to reduce trust in the PKG). These typically involve threshold mechanisms or separation-of-duty architectures, but unfortunately often rely on non-collusion assumptions that cannot be guaranteed in real-world settings. This paper proposes a separation architecture that instantiates several intermediate CAs (ICAs), rather than one (as in previous work). We employ digital credentials (containing a specially-designed attribute based on bilinear maps) as the blind tokens issued by the ICAs, which allows a user to easily obtain multiple layers of pseudonymization prior to interacting with the PKG. As a result, our proposed architecture does not rely on unrealistic non-collusion assumptions and allows a user to reduce the probability of a privacy breach to an arbitrarily small value.

Continuous Leakage-resilient and Hierarchical Identity-based Online/Offline Encryption

<p>By dividing encryption as online and offline stages, the online/offline encryption schemes are very suitable to lightweight equipment. For the offline stage, high-performance equipment is used for complex preprocessing calculation, and the online stage the lightweight devices only make some simple calculations. In addition, side channel attacks can disclose some secret information of the cryptosystem, which leads to the destruction of the security of the cryptography schemes. Most of the online/offline identity-based encryption schemes cannot resist side channel attacks. The paper proposes a concrete hierarchical identity-based and online/offline encryption scheme that can resist continuous leakage of secret key. By the dual system encryption technology, we prove that the given scheme is fully secure. Through key updation technology, our proposed scheme resists continual leakage of private key. The relative leakage rate of the private key can reach 1/3. In addition, the presented scheme has the hierarchical function which effectively solves the problem of heavy load in a single key generation center. The given scheme is suitable for applications in distributed environment.</p> <p> </p>

Dual-Server Identity-Based Encryption with Authorized Equality Test for IoT Data in Clouds

The massive amounts of data collected by Internet of things (IoT) devices can be stored in clouds to solve the problem of the low storage capacity of IoT terminals. However, the privacy and security of outsourced IoT data may be compromised on the cloud side. Traditional cryptographic technologies can protect data privacy but require the user to retrieve the data for decryption and further processing, which would bring vast amounts of bandwidth and computation burden to users. This paper proposes a dual-server identity-based encryption scheme supporting authorized ciphertext equality test (DS-IBE-AET), where two noncolluding servers with authorizations from users can collaboratively carry out an equality test on outsourced IoT ciphertexts without decrypting the data. DS-IBE-AET can resist offline keyword guessing attacks confronted by existing encryption schemes with equality test in the single server model. Security analysis demonstrates that the proposed DS-IBE-AET scheme offers unforgeability for private keys of users and servers and confidentiality protection for outsourced IoT data and authentication tokens. The performance analysis indicates the practicality of our DS-IBE-AET construction for securing outsourced IoT data in clouds.

Reinforced securing of data leakage in Mobile Ad hoc Network (MANET) by hybrid mechanism of identity based encryption (IBE)

In Mobile Ad hoc Network (MANET), private data leakage that involves user’s private keys may become a threat to the computing systems security. It is essential that usual requirement of traditional cryptographic patterns or mechanisms have been performed for enduring several leakage attacks. However, the attacker can track and crack the cryptographic security due to the performance of continuous leakage attacks, which assist in introducing leakage resilience cryptography. But, still there are certain issues such as data loss, data failure system, data affecting and system break that are not yet resolved. As a result, various bounded-leakage models have been created for Identity Based Encryption (IBE) constructions that fail to fulfill their stated security under continuous-leakage assaults. This paper has introduced a hybrid mechanism of security to resolve the above listed issues by focusing in avoiding continuous leakage resilient through modified IBE schemes using Adaptive Chosen Cipher-text Attacks (ACCA) with Elliptical Curve Digital Signature Algorithm (ECDSA).

IBE-Signal: Reshaping Signal into a MITM-Attack-Resistant Protocol

The Signal Protocol is one of the most popular privacy protocols today for protecting Internet chats and supports end-to-end encryption. Nevertheless, despite its many advantages, the Signal Protocol is not resistant to Man-In-The-Middle (MITM) attacks because a malicious server can distribute the forged identity-based public keys during the user registration phase. To address this problem, we proposed the IBE-Signal scheme that replaced the Extended Triple Diffie–Hellman (X3DH) key agreement protocol with enhanced Identity-Based Encryption (IBE). Specifically, the adoption of verifiable parameter initialization ensures the authenticity of system parameters. At the same time, the Identity-Based Signature (IBS) enables our scheme to support mutual authentication. Moreover, we proposed a distributed key generation mechanism that served as a risk decentralization to mitigate IBE’s key escrow problem. Besides, the proposed revocable IBE scheme is used for the revocation problem. Notably, the IND-ID-CPA security of the IBE-Signal scheme is proven under the random oracle model. Compared with the existing schemes, our scheme provided new security features of mutual authentication, perfect forward secrecy, post-compromise security, and key revocation. Experiments showed that the computational overhead is lower than that of other schemes when the Cloud Privacy Centers (CPCs) number is less than 8.

A direct construction of continuous leakage-resilient (H)IBE scheme with CCA security from dual system encryption

A direct construction of continuous leakage-resilient (H)IBE scheme with CCA security from dual system encryption

CLAP-PRE: Certificateless Autonomous Path Proxy Re-Encryption for Data Sharing in the Cloud

In e-health systems, patients encrypt their personal health data for privacy purposes and upload them to the cloud. There exists a need for sharing patient health data with doctors for healing purposes in one’s own preferred order. To achieve this fine-gained access control to delegation paths, some researchers have designed a new proxy re-encryption (PRE) scheme called autonomous path proxy re-encryption (AP-PRE), where the delegator can control the whole delegation path in a multi-hop delegation process. In this paper, we introduce a certificateless autonomous path proxy re-encryption (CLAP-PRE) using multilinear maps, which holds both the properties (i.e., certificateless, autonomous path) of certificateless encryption and autonomous path proxy re-encryption. In the proposed scheme, (a) each user has two public keys (user’s identity and traditional public key) with corresponding private keys, and (b) each ciphertext is first re-encrypted from a public key encryption (PKE) scheme to an identity-based encryption (IBE) scheme and then transformed in the IBE scheme. Our scheme is an IND-CPA secure CLAP-PRE scheme under the k-multilinear decisional Diffie–Hellman (k-MDDH) assumption in the random oracle model.