Public Key Size Research Articles

Efficient Encryption From Random Quasi-Cyclic Codes

We propose a framework for constructing efficient code-based encryption schemes that do not hide any structure in their public matrix. The framework is in the spirit of the schemes first proposed by Alekhnovich in 2003 and based on the difficulty of decoding random linear codes from random errors of low weight. We depart somewhat from Alekhnovich’s approach and propose an encryption scheme based on the difficulty of decoding random quasi-cyclic codes. We propose two new cryptosystems instantiated within our framework: the hamming quasi-cyclic cryptosystem (HQC), based on the hamming metric, and the rank quasi-cyclic cryptosystem (RQC), based on the rank metric. We give a security proof, which reduces the indistinguishability under chosen plaintext attack security of our systems to a decision version of the well-known problem of decoding random families of quasi-cyclic codes for the hamming and rank metrics (the respective $\mathsf {QCSD}$ and $\mathsf {RQCSD}$ problems). We also provide an analysis of the decryption failure probability of our scheme in the Hamming metric case: for the rank metric there is no decryption failure. Our schemes benefit from a very fast decryption algorithm together with small key sizes of only a few thousand bits. The cryptosystems are very efficient for low encryption rates and are very well suited to key exchange and authentication. Asymptotically, for $\lambda $ the security parameter, the public key sizes are respectively in $\mathcal {O}({\lambda }^{2})$ for HQC and in $\mathcal {O}\left({\lambda ^{\frac {4}{3}}}\right)$ for RQC. Practical parameter compares well to the systems based on ring-learning parity with noise or the recent moderate density parity check codes system.

Full secure identity-based encryption scheme over lattices for wireless sensor networks in the standard model

This paper proposes a lattice-based identity-based encryption scheme which can be used in wireless sensor networks to achieve secure communication. More precisely, a known lattice-based chosen plain-text secure encryption scheme and the bonsai trees primitive are used to design an identity-based encryption (IBE) scheme in this paper. To reduce the public key size of the proposed IBE scheme, a public matrices chosen rule is used in this paper which reduces the public key size of proposed scheme to be close to half of that of a known lattice-based scheme. Under the hardness of the decision variant of the learning with errors (LWE) problem, we prove that the proposed IBE scheme is indistinguishable against the adaptive chosen identities and chosen-plaintext attack in the standard model. Moreover, the message-to-ciphtertext expanse factor of this scheme is also controlled efficiently which is nearly closed to that of Gentry's scheme. Due to the quantum intractability of the LWE problem on which the scheme is based, the proposed IBE scheme is secure even in quantum-era.

Multimodal biometric Identity Based Encryption

In this paper, we describe the first generic construction for multimodal biometric Identity Based Encryption considering two distance measures at the same time. Current protocols for fuzzy/biometric IBE are designed either for set overlap or Euclidean distance within unimodal biometrics. However, the similarity measures for biometric templates can be quite different from those considered in theoretical works. For instance, a fingerprint template usually consists of a set of minutiae, and two templates are considered as similar if more than a certain number of minutiae in one template are near distinct minutiae in the other. In this case, the similarity measure has to consider both Euclidean distance and set difference at the same time. Similarly, multimodal systems that are designed to address the limitations of unimodal systems may involve two different traits requiring different distance measures for each modality.In order to have high recognition rate and thus increased possibility of decryption even in case of white noise (slight perturbation of biometric features), our generic construction is based on two different biometric IBE systems encoding the same message. This way, employment of both distance measures is possible using multiple matchers within multimodal setting and a failure on the decryption of a message encrypted using the first biometric representation, can be compensated with an attempt on the second part of the ciphertext encrypting the same message but using a different representation of the same receiver. Specifically, we combine a fuzzy IBE-type scheme and the recently introduced Distance Based Encryption (DBE) scheme with minimum overhead in terms of public parameters, ciphertext and private key size. For this purpose, we describe an efficient biometric IBE scheme denoted as ordFIBE, which is restricted for biometrics that can be represented as an ordered/grouped set of features. We study the security of ordFIBE both in random oracle model (ROM) and for small universe of attributes in standard model. In ROM, its efficiency is further improved by employing online/offline encryption technique. Next, we instantiate the new construction by combining ordFIBE and the DBE scheme of Guo et al. (2014), which shares the same setup phase, in particular, common public parameters. Finally, we describe a new scheme for set difference metric that partially solves an open problem introduced in Katz et al. (2008).

A New variant of the McEliece cryptosystem based on the Smith form of convolutional codes

ABSTRACTIn this article, the authors propose a new version of the McEliece cryptosystem based on the Smith form of convolutional codes. They use the Smith form to hide a part of the code in the public matrix, and they leave the other part secret. The secret part will then be used for decryption. They hide this part by multiplying it on the left by a random matrix, and they add a random matrix which has a few conditions. Their scheme has a small public key size compared to the original McEliece scheme and resists the unique decoding attack against convolutional structure presented at the conference PQCrypto 2013 by Landais and Tillich. Further, the exhaustive search attack is infeasible on their system.

Polynomial-time key recovery attack on the Faure–Loidreau scheme based on Gabidulin codes

Encryption schemes based on the rank metric lead to small public key sizes of order of few thousands bytes which represents a very attractive feature compared to Hamming metric-based encryption schemes where public key sizes are of order of hundreds of thousands bytes even with additional structures like the cyclicity. The main tool for building public key encryption schemes in rank metric is the McEliece encryption setting used with the family of Gabidulin codes. Since the original scheme proposed in 1991 by Gabidulin, Paramonov and Tretjakov, many systems have been proposed based on different masking techniques for Gabidulin codes. Nevertheless, over the years most of these systems were attacked essentially by the use of an attack proposed by Overbeck. In 2005 Faure and Loidreau designed a rank-metric encryption scheme which was not in the McEliece setting. The scheme is very efficient, with small public keys of size a few kiloBytes and with security closely related to the linearized polynomial reconstruction problem which corresponds to the decoding problem of Gabidulin codes. The structure of the scheme differs considerably from the classical McEliece setting and until our work, the scheme had never been attacked. We show in this article that for a range of parameters, this scheme is also vulnerable to a polynomial-time attack that recovers the private key by applying Overbeck’s attack on an appropriate public code. As an example we break in a few seconds parameters with 80-bit security claim. Our work also shows that some parameters are not affected by our attack but at the cost of a lost of efficiency for the underlying schemes.

Lattice-based group signature with verifier-local revocation

Among several post quantum primitives proposed in the past few decades, lattice-based cryptography is considered as the most promising one, due to its underlying rich combinatorial structure, and the worst-case to average-case reductions. The first lattice-based group signature scheme with verifier-local revocation (VLR) is treated as the first quantum-resistant scheme supported member revocation, and was put forward by Langlois et al. This VLR group signature (VLR-GS) has group public key size of O(nm log N log q), and a signature size of O(tm logN log q log β). Nguyen et al. constructed a simple efficient group signature from lattice, with significant advantages in bit-size of both the group public key and the signature. Based on their work, we present a VLR-GS scheme with group public key size of O(nm log q) and signature size of O(tm log q). Our group signature has notable advantages: support of membership revocation, and short in both the public key size and the signature size.

A Public Key Compression Scheme for Fully Homomorphic Encryption Based on Quadratic Parameters With Correction

For efficiency improvement and public key size reduction, a new public key compression scheme is proposed for fully homomorphic encryption based on quadratic parameters with correction (QPC-PKC scheme). Compared with existing public key compression schemes, the size of the public key in the proposed scheme is reduced from $\tilde {\mathrm {O}}({\lambda }^{5})$ to $\tilde {\mathrm {O}}({\lambda }^{3.5})$ by reducing the number of subgroup public key elements and the element bit-lengths. Based on the construction mechanisms of the somewhat fully homomorphic encryption (SWHE), a QPC-PKC SWHE scheme is constructed and the parameter constraints are presented. The correctness and semantical security of the proposed QPC-PKC SWHE scheme are then proved based on the error-free approximate greatest common divisor assumption. Finally, the public key size performance of the QPC-PKC scheme is theoretically analyzed, while the public key sizes and running times of the QPC-PKC SWHE scheme are experimentally evaluated. The results show that the public key size of the proposed scheme is significantly reduced compared with the existing schemes, and the encryption efficiency of the QPC-PKC SWHE scheme is also improved as expected.

Revocable Group Signatures with Compact Revocation List Using Vector Commitments

A group signature allows any group member to anonymously sign a message. One of the important issues is an efficient membership revocation. The scheme proposed by Libert et al. has achieved O(1) signature and membership certificate size, O(1) signing and verification times, and \(O(\log N)\) public key size, where N is the total number of members. However the Revocation List (RL) data is large, due to O(R) signatures in RL, where R is the number of revoked members. The scheme proposed by Nakanishi et al. achieved a compact RL of O(R/T) signatures for any integer T. However, this scheme increases membership certificate size by O(T). In this paper, we extend the scheme proposed by Libert et al., by reducing the RL size to O(R/T) using a vector commitment to compress the revocation entries, while O(1) membership certificate size remains.

Building Secure Public Key Encryption Scheme from Hidden Field Equations

Multivariate public key cryptography is a set of cryptographic schemes built from the NP-hardness of solving quadratic equations over finite fields, amongst which the hidden field equations (HFE) family of schemes remain the most famous. However, the original HFE scheme was insecure, and the follow-up modifications were shown to be still vulnerable to attacks. In this paper, we propose a new variant of the HFE scheme by considering the special equation x2=x defined over the finite field F3 when x=0,1. We observe that the equation can be used to further destroy the special structure of the underlying central map of the HFE scheme. It is shown that the proposed public key encryption scheme is secure against known attacks including the MinRank attack, the algebraic attacks, and the linearization equations attacks. The proposal gains some advantages over the original HFE scheme with respect to the encryption speed and public key size.

Multiparty Key Exchange, Efficient Traitor Tracing, and More from Indistinguishability Obfuscation

In this work, we show how to use indistinguishability obfuscation (iO) to build multiparty key exchange, efficient broadcast encryption, and efficient traitor tracing. Our schemes enjoy several interesting properties that have not been achievable before: Our multiparty non-interactive key exchange protocol does not require a trusted setup. Moreover, the size of the published value from each user is independent of the total number of users. Our broadcast encryption schemes support distributed setup, where users choose their own secret keys rather than be given secret keys by a trusted entity. The broadcast ciphertext size is independent of the number of users. Our traitor tracing system is fully collusion resistant with short ciphertexts, secret keys, and public key. Ciphertext size is logarithmic in the number of users and secret key size is independent of the number of users. Our public key size is polylogarithmic in the number of users. The recent functional encryption system of Garg, Gentry, Halevi, Raykova, Sahai, and Waters also leads to a traitor tracing scheme with similar ciphertext and secret key size, but the construction in this paper is simpler and more direct. These constructions resolve an open problem relating to differential privacy. Generalizing our traitor tracing system gives a private broadcast encryption scheme (where broadcast ciphertexts reveal minimal information about the recipient set) with optimal size ciphertext. Several of our proofs of security introduce new tools for proving security using indistinguishability obfuscation.

Adaptively Secure Broadcast Encryption With Constant Ciphertexts

In this paper, we present a new public key broadcast encryption (BE) for achieving adaptive security against arbitrary number of colluders. Specifically, our scheme is built from composite order multilinear maps and enjoys ciphertext overhead of a constant number of group elements which are ${O}$ (1) bits. Furthermore, the private key size and public key size are all poly-logarithmic in the total number of users. Herein, we generalize the methodology of Lewko and Waters for realizing dual system encryption to the composite order multilinear groups, and then prove the adaptive security of our scheme under static assumptions in the standard model. Compared with the state-of-the-art, our scheme achieves the adaptive security in simple and non-interactive falsifiable assumptions with the optimized parameter size for BE.

Efficient hierarchical identity based encryption scheme in the standard model over lattices

Using lattice basis delegation in a fixed dimension, we propose an efficient lattice-based hierarchical identity based encryption (HIBE) scheme in the standard model whose public key size is only (dm 2 + mn) log q bits and whose message-ciphertext expansion factor is only log q, where d is the maximum hierarchical depth and (n, m, q) are public parameters. In our construction, a novel public key assignment rule is used to averagely assign one random and public matrix to two identity bits, which implies that d random public matrices are enough to build the proposed HIBE scheme in the standard model, compared with the case in which 2d such public matrices are needed in the scheme proposed at Crypto 2010 whose public key size is (2dm 2 + mn +m) log q. To reduce the message-ciphertext expansion factor of the proposed scheme to log q, the encryption algorithm of this scheme is built based on Gentry’s encryption scheme, by which m 2 bits of plaintext are encrypted into m 2 log q bits of ciphertext by a one time encryption operation. Hence, the presented scheme has some advantages with respect to not only the public key size but also the message-ciphertext expansion factor. Based on the hardness of the learning with errors problem, we demonstrate that the scheme is secure under selective identity and chosen plaintext attacks.

Attribute-based signatures on lattices

Because of its wide application in anonymous authentication and attribute-based messaging, the attribute-based signature scheme has attracted the public attention since it was proposed in 2008. However, most of the existing attribute-based signature schemes are no longer secure in quantum era. Fortunately, lattice-based cryptography offers the hope of withstanding quantum computers. And lattices has elevated it to the status of a promising potential alternative to cryptography based on discrete log and factoring, owing to implementation simplicity, provable security reductions and quantum-immune. In this paper, the first lattice attribute-based signature scheme in random oracle model is proposed, which is proved existential unforgeability and perfect privacy. Compared with the current attribute-based signature schemes, our new attribute-based signature scheme can resist quantum attacks and has much shorter public-key size and signature size. Furthermore, this scheme is extended into an attribute-based signature scheme on number theory research unit (NTRU) lattice, which is also secure even in quantum era and has much higher efficiency than the former.

Improved lattice-based ring signature schemes from basis delegation

Ring signature enables the members to sign anonymously without a manager, it has many online applications, such as e-voting, e-money, whistle blowing etc. As a promising post-quantum candidate, lattice-based cryptography attracts much attention recently. Several efficient lattice-based ring signatures have been naturally constructed from lattice basis delegation, but all of them have large verification key sizes. Our observation finds that a new concept called the split-small integer solution (SIS) problem introduced by Nguyen et al. at PKC'15 is excellent in reducing the public key sizes of lattice-based ring signature schemes from basis delegation. In this research, we first define an extended concept called the extended split-SIS problem, and then prove that the hardness of the extended problem is as hard as the approximating shortest independent vectors problem (SIVP) problem within certain polynomial factor. Moreover, we present an improved ring signature and prove that it is anonymous and unforgeable against the insider corruption. Finally, we give two other improved existing ring signature schemes from lattices. In the end, we show the comparison with the original scheme in terms of the verification key sizes. Our research data illustrate that the public key sizes of the proposed schemes are reduced significantly.

A new group signature scheme for dynamic membership

Group signatures allow a group member to sign messages anonymously on behalf of the group. Generally, group signatures have anonymity, traceability and authentication. It has been well applied in practical distributed security communication environments. However, very few schemes can achieve the non-frameability and support dynamic membership management. In this paper, we propose a new group signature scheme. Our scheme achieves the non-frameability without the trusted issuer. Meanwhile, this scheme can support dynamic members join and revocation without incurring other secure threats. Furthermore, in our scheme, the size of group member's private key and the size of group public key are shorter than other schemes while the costs to be kept constant for signing and verifying. In particular, we prove that our scheme achieves anonymity, traceability and non-frameability under the random oracle model.

Deriving Practical Applicability of Hierarchical Identity Based Encryption in Massively Multiplayer Online Role Playing Games

Massively Multiplayer Online Role Playing Games (MMORPGs) are virtual environments that allow players to socialize, compete, contribute, produce and consume goods leading to an intricate lifestyle resembling real world. With millions of subscribers populating these virtual worlds, investing their time and effort to hoard virtual assets, the boundary between real and virtual economies has become obscure. Players improvise their economy and build their character over a long period, in the persistent virtual world. Hence, each login and subsequent session must be secured. Public Key Infrastructure (PKI) is used to establish a secure channel for communicating user credentials with the game server. However, PKI is complex, expensive and difficult to deploy. Hierarchical Identity Based Encryption (HIBE) provides a simple, scalable, certificate-free and efficient alternative to the conventional public key infrastructure. This paper investigates the architecture models, security threats and existing security solutions in MMORPGs. The suitability of HIBE for the establishment of secure login session in MMORPGs, is analyzed using three HIBE protocols. The scalability of the protocols were scrutinized, based on parameters like security degradation, public parameter size, ciphertext size and private key size. Computational complexity in terms of encryption and decryption overhead for each protocol, was approximated. Based on the results, the most suitable HIBE protocol for securing the login sessions in MMORPGs was derived.

Secure Data Aggregation with Fully Homomorphic Encryption in Large-Scale Wireless Sensor Networks.

With the rapid development of wireless communication technology, sensor technology, information acquisition and processing technology, sensor networks will finally have a deep influence on all aspects of people’s lives. The battery resources of sensor nodes should be managed efficiently in order to prolong network lifetime in large-scale wireless sensor networks (LWSNs). Data aggregation represents an important method to remove redundancy as well as unnecessary data transmission and hence cut down the energy used in communication. As sensor nodes are deployed in hostile environments, the security of the sensitive information such as confidentiality and integrity should be considered. This paper proposes Fully homomorphic Encryption based Secure data Aggregation (FESA) in LWSNs which can protect end-to-end data confidentiality and support arbitrary aggregation operations over encrypted data. In addition, by utilizing message authentication codes (MACs), this scheme can also verify data integrity during data aggregation and forwarding processes so that false data can be detected as early as possible. Although the FHE increase the computation overhead due to its large public key size, simulation results show that it is implementable in LWSNs and performs well. Compared with other protocols, the transmitted data and network overhead are reduced in our scheme.

Adaptively secure broadcast encryption under standard assumptions with better efficiency

In this study, the authors present an efficient public-key broadcast encryption (PKBE) scheme with sub-linear size of public keys, private keys and ciphertexts and prove its adaptive security under standard assumptions. Compared with the currently best scheme of Garg et al. (CCS 2010) that provides adaptive security under standard assumptions and sub-linear size of various parameters, the ciphertext size of the author's scheme is 94% shorter and the encryption algorithm of their scheme is also 2.8 times faster than the scheme of Garg et al. To achieve their scheme, they adapt the dual system encryption technique of Waters. However, there is a challenging problem to use this technique for the construction of PKBE with sub-linear size of ciphertexts such as a tag compression problem. To overcome this problem, they first devise a novel tag update technique for broadcast encryption. Using this technique, they build an efficient PKBE scheme in symmetric bilinear groups, and prove its adaptive security under standard assumptions.

Full secure identity-based encryption scheme with short public key size over lattices in the standard model

An efficient identity-based encryption (IBE) scheme over lattice is proposed in this paper. Under the hardness of the learning with errors (LWE) problem, the proposed scheme is semantic secure against adaptive chosen identity and chosen plaintext attack in the standard model. To improve the efficiency of the lattice-based IBE scheme, unlike the identity string is encoded into a matrix by a group of public matrices in several known constructions, the identity string of l bits is encoded into a vector with the help of vectors in this paper. With the help of this idea, we achieve the private key extraction of IBE scheme at the same lattice. Then, the public key of the proposed scheme only consists of one matrix and vectors, compared with that the public keys of the known lattice-based IBE schemes all consist as a group of matrices. Hence, the public key size of this scheme is shorter than that of the known constructions.

Structural cryptanalysis of McEliece schemes with compact keys

A very popular trend in code-based cryptography is to decrease the public-key size by focusing on subclasses of alternant/Goppa codes which admit a very compact public matrix, typically quasi-cyclic ($$\mathrm{QC}$$QC), quasi-dyadic ($$\mathrm{QD}$$QD), or quasi-monoidic ($$\mathrm{QM}$$QM) matrices. We show that the very same reason which allows to construct a compact public-key makes the key-recovery problem intrinsically much easier. The gain on the public-key size induces an important security drop, which is as large as the compression factor $$p$$p on the public-key. The fundamental remark is that from the $$k\times n$$k×n public generator matrix of a compact McEliece, one can construct a $$k/p \times n/p$$k/p×n/p generator matrix which is--from an attacker point of view--as good as the initial public-key. We call this new smaller code the folded code. Any key-recovery attack can be deployed equivalently on this smaller generator matrix. To mount the key-recovery in practice, we also improve the algebraic technique of Faugere, Otmani, Perret and Tillich (FOPT). In particular, we introduce new algebraic equations allowing to include codes defined over any prime field in the scope of our attack. We describe a so-called structural elimination which is a new algebraic manipulation which simplifies the key-recovery system. As a proof of concept, we report successful attacks on many cryptographic parameters available in the literature. All the parameters of CFS-signatures based on $$\mathrm{QD}$$QD/$$\mathrm{QM}$$QM codes that have been proposed can be broken by this approach. In most cases, our attack takes few seconds (the hardest case requires less than 2 h). In the encryption case, the algebraic systems are harder to solve in practice. Still, our attack succeeds against several cryptographic challenges proposed for $$\mathrm{QD}$$QD and $$\mathrm{QM}$$QM encryption schemes. We mention that some parameters that have been proposed in the literature remain out of reach of the methods given here. However, regardless of the key-recovery attack used against the folded code, there is an inherent weakness arising from Goppa codes with $$\mathrm{QM}$$QM or $$\mathrm{QD}$$QD symmetries. Indeed, the security of such schemes is not relying on the bigger compact public matrix but on the small folded code which can be efficiently broken in practice with an algebraic attack for a large set of parameters.