Indistinguishability Obfuscation Research Articles

Multi-key and Multi-input Predicate Encryption (for Conjunctions) from Learning with Errors

We put forward two natural generalizations of predicate encryption (PE), dubbed multi-key and multi-input PE. More in details, our contributions are threefold.Definitions. We formalize security of multi-key PE and multi-input PE following the standard indistinguishability paradigm, and modeling security both against malicious senders (i.e., corruption of encryption keys) and malicious receivers (i.e., collusions).Constructions. We construct adaptively secure multi-key and multi-input PE supporting the conjunction of poly-many arbitrary single-input predicates, assuming the sub-exponential hardness of the learning with errors (LWE) problem.Applications. We show that multi-key and multi-input PE for expressive enough predicates suffices for interesting cryptographic applications, including non-interactive multi-party computation (NI-MPC) and matchmaking encryption (ME). In particular, plugging in our constructions of multi-key and multi-input PE, under the sub-exponential LWE assumption, we obtain the first ME supporting arbitrary policies with unbounded collusions, as well as robust (resp. non-robust) NI-MPC for so-called all-or-nothing functions satisfying a non-trivial notion of reusability and supporting a constant (resp. polynomial) number of parties. Prior to our work, both of these applications required much heavier tools such as indistinguishability obfuscation or compact functional encryption.

Indistinguishability Obfuscation from Well-Founded Assumptions

At least since the initial public proposal of public-key cryptography based on computational hardness conjectures, cryptographers have contemplated the possibility of a "one-way compiler" that translates computer programs into "incomprehensible" but equivalent forms. And yet, the search for such a "one-way compiler" remained elusive for decades. We examine a formalization of this concept with the notion of indistinguishability obfuscation (iO) . Roughly speaking, iO requires that the compiled versions of any two equivalent programs (with the same size and running time) be indistinguishable from any efficient adversary. Finally, we show how to construct iO in such a way that we can prove the security of our iO scheme based on well-studied computational hardness conjectures in cryptography.

Self-Bilinear Map from One Way Encoding System and i𝒪

A bilinear map whose domain and target sets are identical is called a self-bilinear map. Original self-bilinear maps are defined over cyclic groups. Since the map itself reveals information about the underlying cyclic group, the Decisional Diffie–Hellman Problem (DDH) and the computational Diffie–Hellman (CDH) problem may be solved easily in some specific groups. This brings a lot of limitations to constructing secure self-bilinear schemes. As a compromise, a self-bilinear map with auxiliary information was proposed in CRYPTO’2014. In this paper, we construct this weak variant of a self-bilinear map from generic sets and indistinguishable obfuscation. These sets should own several properties. A new notion, One Way Encoding System (OWES), is proposed to summarize these properties. The new Encoding Division Problem (EDP) is defined to complete the security proof. The OWES can be built by making use of one level of graded encoding systems (GES). To construct a concrete self-bilinear map scheme, Garg, Gentry, and Halvei(GGH13) GES is adopted in our work. Even though the security of GGH13 was recently broken by Hu et al., their algorithm does not threaten our applications. At the end of this paper, some further considerations for the EDP for concrete construction are given to improve the confidence that EDP is indeed hard.

(Inner-Product) Functional Encryption with Updatable Ciphertexts

We propose a novel variant of functional encryption which supports ciphertext updates, dubbed ciphertext-updatable functional encryption. Such a feature further broadens the practical applicability of the functional encryption paradigm and allows for fine-grained access control even after a ciphertext is generated. Updating ciphertexts is carried out via so-called update tokens which a dedicated party can use to convert ciphertexts. However, allowing update tokens requires some care for the security definition. Our contribution is threefold: We define our new primitive with a security notion in the indistinguishability setting. Within CUFE, functional decryption keys and ciphertexts are labeled with tags such that only if the tags of the decryption key and the ciphertext match, then decryption succeeds. Furthermore, we allow ciphertexts to switch their tags to any other tag via update tokens. Such tokens are generated by the holder of the main secret key and can only be used in the desired direction.We present a generic construction of CUFE for any functionality as well as predicates different from equality testing on tags which relies on the existence of indistinguishability obfuscation (iO).We present a practical construction of CUFE for the inner-product functionality from standard assumptions (i.e., LWE) in the random-oracle model. On the technical level, we build on the recent functional encryption schemes with fine-grained access control and linear operations on encrypted data (Abdalla et al., AC’20) and introduce an additional ciphertext updatability feature. Proving security for such a construction turned out to be non-trivial, particularly when revealing keys for the updated challenge ciphertext is allowed. Overall, such construction enriches the set of known inner-product functional encryption schemes with the additional updatability feature of ciphertexts.

Beyond the Csiszár–Körner Bound: Best-Possible Wiretap Coding via Obfuscation

A wiretap coding scheme (Wyner in Bell Syst Tech J 54(8):1355–1387, 1975) enables Alice to reliably communicate a message m to an honest Bob by sending an encoding c over a noisy channel ChB\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf{ChB}$$\\end{document}, while at the same time hiding m from Eve who receives c over another noisy channel ChE\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf{ChE}$$\\end{document}. Wiretap coding is clearly impossible when ChB\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf{ChB}$$\\end{document} is a degraded version of ChE\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf{ChE}$$\\end{document}, in the sense that the output of ChB\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf{ChB}$$\\end{document} can be simulated using only the output of ChE\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf{ChE}$$\\end{document}. A classic work of Csiszár and Korner (IEEE Trans Inf Theory 24(3):339–348, 1978) shows that the converse does not hold. This follows from their full characterization of the channel pairs (ChB,ChE)\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$(\ extsf{ChB},\ extsf{ChE})$$\\end{document} that enable information-theoretic wiretap coding. In this work, we show that in fact the converse does hold when considering computational security; that is, wiretap coding against a computationally bounded Eve is possible if and only ifChB\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf{ChB}$$\\end{document} is not a degraded version of ChE\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf{ChE}$$\\end{document}. Our construction assumes the existence of virtual black-box obfuscation of specific classes of “evasive” functions that generalize fuzzy point functions and can be heuristically instantiated using indistinguishability obfuscation. Finally, our solution has the appealing feature of being universal in the sense that Alice’s algorithm depends only on ChB\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf{ChB}$$\\end{document} and not on ChE\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf{ChE}$$\\end{document}.

Forward and backward secure updatable ElGamal encryption scheme for cloud storage

Updatable encryption can support key/ciphertext update functionality, resist key compromise attacks, and be applicable to cloud storage. However, as a type of partitioning strategy, leakage sets or firewalls technique has been adopted by the existing updatable encryption schemes to build a relaxed security model, which forbids the adversary from querying the secret key at the challenge-equal epochs and hardly captures forward and backward security. In this paper, an enhanced security model can be built by considering a corruption oracle that allows any secret key query without requiring leakage sets. Then we utilize the indistinguishability obfuscation technique of the punctured program to construct an updatable ElGamal encryption scheme with no-directional key update and uni-directional ciphertext update. Furthermore, under the framework of the enhanced security model, the proposed scheme is proven to be IND-CPA. Finally, by comparison with the existing updatable encryption schemes, the proposed scheme eliminates leakage sets and firewalls, and can achieve both forward and backward security.

Candidate iO from Homomorphic Encryption Schemes

We propose a new approach to construct general-purpose indistinguishability obfuscation (iO). Our construction is obtained via a new intermediate primitive that we call split fully homomorphic encryption (split FHE), which we show to be sufficient for constructing iO. Specifically, split FHE is FHE where decryption takes the following two-step syntactic form: (i) a secret decryption step that uses the secret key and produces a hint which is (asymptotically) shorter than the length of the encrypted message, and (ii) a public decryption step that only requires the ciphertext and the previously generated hint (and not the entire secret key) and recovers the encrypted message. In terms of security, the hints for a set of ciphertexts should not allow one to violate semantic security for any other ciphertexts. Next, we show a generic candidate construction of split FHE based on three building blocks: (i) A standard FHE scheme with linear decrypt-and-multiply (which can be instantiated with essentially all LWE-based constructions), (ii) a linearly homomorphic encryption scheme with short decryption hints (such as the Damgård-Jurik encryption scheme, based on the DCR problem), and (iii) a cryptographic hash function (which can be based on a variety of standard assumptions). Our approach is heuristic in the sense that our construction is not provably secure and makes implicit assumptions about the interplay between these underlying primitives. We show evidence that this construction is secure by providing an argument in an appropriately defined oracle model. We view our construction as a big departure from the state-of-the-art constructions, and it is in fact quite simple.

Abuse-resistant deniable encryption

Deniable encryption (DE) allows private communication over an insecure channel even under the coercion. That is, after an adversary forces communication participants to reveal their secret keys and randomness used during the communication, the message confidentiality can still be preserved. Since its introduction, a large body of studies have been made to improve the DE system in terms of efficiency, security definition and functionality, which is the focus of this paper. However, as far as we know, none of existing DE systems considers the abuse of deniability caused by malicious users, which is a crucial feature from the view of practical applications of DE. For instance, a malicious user (e.g., an employee who holds some sensitive documents and intends to sell these confidential contents for obtaining financial gain) can utilize a DE system to transmit the confidential content without the risk of being caught, which is extremely dangerous to the interests and security of his/her organization. In this paper, to mitigate this threat, we formally define the syntax and security notions of abuse-resistant deniable encryption, which restricts what users can deny. Then, we put forward a concrete construction of abuse-resistant DE scheme, and prove its security under the assumptions of indistinguishability obfuscation and one-way function. Compared with other related work, the proposed construction has advantages in terms of functionality and ciphertext rate simultaneously.

Anonymous Homomorphic IBE with Application to Anonymous Aggregation

All anonymous identity-based encryption (IBE) schemes that are group homomorphic (to the best of our knowledge) require knowledge of the identity to compute the homomorphic operation. This paper is motivated by this open problem, namely to construct an anonymous group-homomorphic IBE scheme that does not sacrifice anonymity to perform homomorphic operations. Note that even when strong assumptions, such as indistinguishability obfuscation (iO), are permitted, no schemes are known. We succeed in solving this open problem by assuming iO and the hardness of the DBDH problem over rings (specifically, ZN2 for RSA modulus N). We then use the existence of such a scheme to construct an IBE scheme with re-randomizable anonymous encryption keys, which we prove to be IND-ID-RCCA secure. Finally, we use our results to construct identity-based anonymous aggregation protocols.

Short attribute-based signatures for arbitrary Turing machines from standard assumptions

This paper presents the first attribute-based signature (ABS) scheme supporting signing policies representable by Turing machines (TM), based on well-studied computational assumptions. Our work supports arbitraryTMs as signing policies in the sense that the TMs can accept signing attribute strings of unbounded polynomial length and there is no limit on their running time, description size, or space complexity. Moreover, we are able to achieve input-specific running time for the signing algorithm. All other known expressive ABS schemes could at most support signing policies realizable by either arbitrary polynomial-size circuits or TMs having a pre-determined upper bound on the running time. Consequently, those schemes can only deal with signing attribute strings whose lengths are a priori bounded, as well as suffers from the worst-case running time problem. On a more positive note, for the first time in the literature, the signature size of our ABS scheme only depends on the size of the signed message and is completely independent of the size of the signing policy under which the signature is generated. This is a significant achievement from the point of view of communication efficiency. Our ABS construction makes use of indistinguishability obfuscation (IO) for polynomial-size circuits and certain IO-compatible cryptographic tools. Note that, all of these building blocks including IO for polynomial-size circuits are currently known to be realizable under well-studied computational assumptions.

One-Way Functions and (Im)perfect Obfuscation

A program obfuscator takes a program and outputs a “scrambled” version of it, where the goal is that the obfuscated program will not reveal much about its structure beyond what is apparent from executing it. There are several ways of formalizing this goal. Specifically, in indistinguishability obfuscation, first defined by Barak et al. (CRYPTO 2001), the requirement is that the results of obfuscating any two functionally equivalent programs (circuits) will be computationally indistinguishable. Recently, a fascinating candidate construction for indistinguishability obfuscation was proposed by Garg et al. (FOCS 2013). This has led to a flurry of discovery of intriguing constructions of primitives and protocols whose existence was not previously known (for instance, fully deniable encryption by Sahai and Waters, STOC 2014). Most of them explicitly rely on additional hardness assumptions, such as one-way functions. Our goal is to get rid of this extra assumption. We cannot argue that indistinguishability obfuscation of all polynomial-time circuits implies the existence of one-way functions, since if P = NP, then program obfuscation (under the indistinguishability notion) is possible. Instead, the ultimate goal is to argue that if P 6= NP and program obfuscation is possible, then one-way functions exist. Our main result is that if NP 6⊆ io-BPP and there is an efficient (even imperfect) indistinguishability obfuscator, then there are one-way functions. In addition, we show that the existence of an indistinguishability obfuscator implies (unconditionally) the existence of SZKarguments for NP. This, in turn, provides an alternative version of our main result, based on the assumption of hard-on-the average NP problems. To get some of our results we need obfuscators for simple programs such as 3CNF formulas. ∗This paper incorporates the manuscript of Moran and Rosen [MR13]. †Weizmann Institute of Science. Email: {ilan.komargodski,moni.naor,eylon.yogev}@weizmann.ac.il. Supported in part by a grant from the I-CORE Program of the Planning and Budgeting Committee, the Israel Science Foundation, BSF, IMOS and the Citi Foundation. Moni Naor is the incumbent of the Judith Kleeman Professorial Chair. ‡IDC Herzliya. Email: talm@idc.ac.il. Supported by ISF grant no. 1790/13 and by the European Union Seventh Framework Programme (FP7/2007-2013) under grant agreement no. 293843 §Cornell University. Email: rafael@cs.cornell.edu. Supported in part by a Alfred P. Sloan Fellowship, Microsoft New Faculty Fellowship, NSF Award CNS1217821, NSF CAREER Award CCF-0746990, NSF Award CCF-1214844, AFOSR YIP Award FA9550-10-1-0093, and DARPA and AFRL under contract FA8750-11-20211. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the Defense Advanced Research Projects Agency or the US Government. ¶IDC Herzliya. Email: alon.rosen@idc.ac.il. Supported by ISF grant no. 1255/12 and by the ERC under the EU’s Seventh Framework Programme (FP/2007-2013) ERC Grant Agreement n. 307952.

Indistinguishable Leakage-Resilient Circuit Compiler

Abstract Transforming any circuit into a circuit with the same functionality but resilience against well-defined classes of leakage is an essential subject of cryptography. Whereas, according to the relationship between $VBB$ and simulated leakage-resilient circuit compiler, the compiling needs a specific mechanism to guarantee that its input is free of any leakage. Unfortunately, it makes it tough to implement this strategy in the context of actual leaks. In this work, we formally propose the indistinguishable bounded leakage-resilient circuit compiler $\bar{C}$ to solve the problem mentioned above. Specifically, it specifies that any polynomial-time adversary who derives the bound secret information from the circuit compiler can not distinguish an equivalent compiled circuit $\bar{C}^{\prime}$ with the same output. To achieve this goal, first, we utilize the leakage-resilient indistinguishable encoding as its input. Second, it takes advantage of the indistinguishability obfuscation $(IO)$ program to construct an obfuscated circuit that removes the random coins of the input encoding . Its total running time is the original circuit $C$ running time plus $poly(\kappa )$, and the size is independent of the original $C$. As this new compiler overcomes the restriction of the simulated-based leakage resilient circuit compiler,it will bring an independent interest result in leakage-resilient cryptography.

A Note on Perfect Correctness by Derandomization

We show a general compiler that transforms a large class of erroneous cryptographic schemes (such as public-key encryption, indistinguishability obfuscation, and secure multiparty computation schemes) into perfectly correct ones. The transformation works for schemes that are correct on all inputs with probability noticeably larger than half, and are secure under parallel repetition. We assume the existence of one-way functions and of functions with deterministic (uniform) time complexity 2^{O(n)} and non-deterministic circuit complexity 2^{Omega (n)}. Our transformation complements previous results that showed how public-key encryption and indistinguishability obfuscation that err on a noticeable fraction of inputs can be turned into ones that for all inputs are often correct, showing that they can be made perfectly correct. The technique relies on the idea of “reverse randomization” [Naor, Crypto 1989] and on Nisan–Wigderson style derandomization, previously used in cryptography to remove interaction from witness-indistinguishable proofs and commitment schemes [Barak, Ong and Vadhan, Crypto 2003].

Towards Lightweight Provable Data Possession for Cloud Storage Using Indistinguishability Obfuscation

Cloud Computing has proved to be a boon for many individuals and organizations who cannot afford infrastructure and maintenance cost of resources. But the untrusted nature of Cloud Server (CS) brings many challenges related to security and trust. Public auditing is one process that enables users to delegate the integrity verification of outsourced data to external party such as Third-Party Auditor (TPA). Provable Data Possession (PDP) is one approach of auditing that can verify the integrity using cryptographic algorithms. Many PDP schemes are based on bilinear pairing and homomorphic authenticators that involves complex computations that leads to increased verification time. The lightweight auditing processes is a need today using modern cryptographic techniques. Indistinguishability Obfuscation (IO) is one of the modern but weaker primitive that, if used with one-way functions, provide multiple cryptographic constructs. Sahai and Waters proposed construction of cryptographic constructs using IO. Zhang <i>et al.</i> proposed lightweight public auditing scheme using these IO. But still there are many goals to achieve such as group support, collusion handling, privacy-preserving etc. using IO. In this paper, we are trying to explore these issues and lists future research directions in this field.

Functional encryption for cubic polynomials and implementation

Functional encryption (FE), which provides fine-grained access control on encrypted data, is becoming a new hot spot in the field of cryptography. Recent applications, such as outsourcing computation, searchable encryption and so on, suggest that FE has unlimited possibilities. It especially shows great feasibility to construct indistinguishability obfuscation and reuseable garbled circuits. Furthermore, bounded collusion functional encryption is an extension of FE which is against more than one key query and protects the security of messages under more than one function keys. In this paper, we proposed a bounded collusion FE for cubic polynomials, which follows from Agrawal and Rosen's work on TCC 2017. Our construction only invokes the Regev public key encryption and a linear FE scheme which avoids complex encodings defined recursively. What's more, we proposes an FE scheme for all circuit with FULL-SIM security. Finally, we also implement these schemes and do some analyses on parameters' size, time and space performance.

Improved multi‐party verification protocol with reduced computational overhead in cloud storage system

AbstractAlthough in industry and academia cloud computing provides several services, cloud storage is the most unavoidable one. Cloud storage allows remote data validation of the deployed user's data without keeping a local copy. A third‐party auditor is delegated by the users in order to examine the remote data integrity thereby reducing the burden of the users. Data integrity checking protects the user's data from tinkering and illicit access especially when they store data in public clouds such as AWS. Various schemes were proposed by several scholars which possess computational overhead and communication overhead during the integrity checking. Most of the schemes proposed were possessing computational overhead in the cloud server side which increases the financial overwhelming of the clients. In this article an improved multiparty computation architecture is proposed to minimize the computational overhead in the cloud server side while generating the proof of the data blocks in public clouds. The proposed scheme can be implemented on semi‐trusted cloud environments and allows a set of server nodes called ingestion nodes to compute on private inputs thus preserving the privacy and soundness of the computing data. The improved protocol also uses an indistinguishability obfuscation program with a message authentication code tag to minimize the verification overhead of the third‐party auditor as well as preserves the privacy and security of the stored data.

Watermarking Cryptographic Functionalities from Standard Lattice Assumptions

A software watermarking scheme allows one to embed a “mark” into a program without significantly altering the behavior of the program. Moreover, it should be difficult to remove the watermark without destroying the functionality of the program. Recently, Cohen et al. (STOC 2016) and Boneh et al. (PKC 2017) showed how to watermark cryptographic functions such as PRFs using indistinguishability obfuscation. Notably, in their constructions, the watermark remains intact even against arbitrary removal strategies. A natural question is whether we can build watermarking schemes from standard assumptions that achieve this strong mark-unremovability property.

Simple and Generic Constructions of Succinct Functional Encryption

We propose simple and generic constructions of succinct functional encryption. Our key tool is exponentially-efficient indistinguishability obfuscator (XIO), which is the same as indistinguishability obfuscator (IO) except that the size of an obfuscated circuit (or the running-time of an obfuscator) is slightly smaller than that of a brute-force canonicalizer that outputs the entire truth table of a circuit to be obfuscated. A “compression factor” of XIO indicates how much XIO compresses the brute-force canonicalizer. In this study, we propose a significantly simple framework to construct succinct functional encryption via XIO and show that XIO is a powerful enough to achieve cutting-edge cryptography. In particular, we prove the followings: Single-key weakly succinct secret-key functional encryption (SKFE) is constructed from XIO (even with a bad compression factor) and one-way function. Single-key weakly succinct public-key functional encryption (PKFE) is constructed from XIO with a good compression factor and public-key encryption. Single-key weakly succinct PKFE is constructed from XIO (even with a bad compression factor) and identity-based encryption.

A novel appliance-based secure data aggregation scheme for bill generation and demand management in smart grids

ABSTRACT Internet of Things (IoT) has been introduced into smart grids, which has achieved great improvement. The statistics of power consumption is one of the important functions but could lead to the leakage of user daily behaviour. Researchers have put efforts into secure data aggregation protocols to avoid such potential risk. However, only a few schemes have considered the dynamic unit price of electricity, and no schemes have been designed for calculating the power consumption of every appliance in a specific area. This paper proposes a novel appliance-based data aggregation scheme (ABDAS) for bill generation and demand management in smart grids. In the proposed scheme, chameleon hash function (CHF) is utilised to facilitate the extraction of aggregated data due to the characteristic of collision controllability. Furthermore, indistinguishability obfuscation (IO) is utilised to keep the chameleon hash value secret and decrease the overhead of the trusted third party. The fog nodes (FNs) in our scheme are responsible for the calculation of aggregation with its powerful computing and storage capabilities. The security analysis shows that our scheme satisfies IND-CPA and multiple security goals. Additionally, the performance evaluation indicates that the computational overhead of our scheme is lower than that of existing schemes.

Comments on “Efficient Public Verification of Data Integrity for Cloud Storage Systems From Indistinguishability Obfuscation”

Recently, Zhang et al. proposed a novel public data integrity verification scheme for the cloud storage using indistinguishability obfuscation ( $iO$ ), and extend it to support batch verification and data dynamic operations ( IEEE Transactions on Information Forensics and Security , vol. 12, no. 3, pp. 676–688, Mar. 2017). However, we find that the scheme has two flaws: (a) the self-checking of the uploaded blocks and tags in Store phase is not reliable, i.e., it is easy to generate invalid block-tag pairs without being detected; (b) the extended scheme for data dynamic operations suffers from a chosen message attack, i.e., if some uploaded blocks match a certain pattern, the cloud storage is able to replace any existing block by a forged one without being detected, which violates the scheme’s security model. Then, we provide solutions to these problems while preserving all the desirable features of the original scheme.