Secure Public-key Encryption Scheme Research Articles

Verifiable Encryption from MPC-in-the-Head

Verifiable encryption (VE) is a protocol where one can provide assurance that an encrypted plaintext satisfies certain properties, or relations. It is an important building block in cryptography with many useful applications, such as key escrow, group signatures, optimistic fair exchange, and others. However, the majority of previous VE schemes are restricted to instantiation with specific public-key encryption schemes or relations. In this work, we propose a novel framework that realizes VE protocols using zero-knowledge proof systems based on the MPC-in-the-head paradigm (Ishai et al. STOC 2007). Our generic compiler can turn a large class of zero-knowledge proofs into secure VE protocols for any secure public-key encryption scheme with the undeniability property, a notion that essentially guarantees binding of encryption when used as a commitment scheme. Our framework is versatile: because the circuit proven by the MPC-in-the-head prover is decoupled from a complex encryption function, the work of the prover is focused on proving the encrypted data satisfies the relation, not the proof of plaintext knowledge. Hence, our approach allows for instantiation with various combinations of properties about the encrypted data and encryption functions. We then consider concrete applications, to demonstrate the efficiency of our framework, by first giving a new approach and implementation to verifiably encrypt discrete logarithms in any prime order group more efficiently than was previously known. Then we give the first practical verifiable encryption scheme for AES keys with post-quantum security, along with an implementation and benchmarks.

Possibility of decryption speed-up by parallel processing in CCA secure hashed ElGamal.

In order to prove the ElGamal CCA(Chosen Ciphertext Attack) security in the random oracle model, it is necessary to use the group where ICDH(Interactive Computational Diffie Hellman) assumption holds. Until now, only bilinear group with complex algebraic structure has been known as the ICDH group. In this paper, we introduce the ICDH group with simple algebraic structure. In other words, we prove that ICDH assumption holds in the integer group with composite modulus. On the basis of this, we propose the CCA secure hashed ElGamal and its fast variant to speed up decryption by parallel processing. Our parallel scheme has the fastest decryption among all CCA secure PKE(Public Key Encryption) schemes implemented in integer group and gives the possibility that ElGamal protocol could be practical when the big modulus numbers are used to resist the quantum attack.

Side-channel attacks on CRYSTALS-KYBER, countermeasures and comparison with SKELYA (DSTU 8961-2019)

Although the mathematical problems used in post-quantum cryptography algorithms appear to be mathematically secure, a class of attacks known as side-channel attacks may prove to be a threat to the security of such algorithms. Side-channel attacks affect the hardware on which the cryptographic algorithm runs, they are not attacks on the algorithm itself.
 The good news is that side-channel analysis on new post-quantum cryptographic algorithms started early, even before the algorithms were standardized, given that older algorithms still face side-channel problems.
 Kyber is a lattice-based post-quantum algorithm based on the complexity of the M-LWE problem. Kyber offers a secure public key encryption (PKE) scheme against a chosen plaintext attack (CPA) and a secure key encapsulation mechanism against a chosen ciphertext attack (CCA).
 This paper provides a study of side-channel and fault-injection attacks on lattice-based schemes, with focus on the Kyber (KEM).
 Considering the wide range of known attacks, the protection of the algorithm requires the implementation of individual countermeasures. The paper presents and tests a number of countermeasures capable of providing/improving protection against existing SCA/FIA for Kyber KEM.
 The obtained results show that the presented countermeasures incur a reasonable performance cost. Therefore, the use of special countermeasures in real implementations of lattice-based schemes, either alone or as an augmentation of general countermeasures, is necessary.

Analysis of the FO Transformation in the Lattice-Based Post-Quantum Algorithms

Newer variants of the Fujisaki–Okamoto transformation are used in most candidates of the third round of the NIST Post-Quantum Cryptography standardization call in the category of public key encryption schemes. These transformations are applied to obtain a highly secure key encapsulation mechanism from a less secure public key encryption scheme. Furthermore, there are five candidates (three finalists and two alternatives) that passed to the third round of the process and whose security is based in lattice problems. This work analyzes the different ways in which the lattice-based candidates of the NIST call apply the Fujisaki–Okamoto transformation and the particularities of each application. The study of such differences and their repercussion in the design of the proposals will allow a better understanding of the algorithms. Moreover, we propose a modification of the Kyber algorithm—the only public key encryption candidate established as a PQC standard by NIST in its more recent publication—in order to avoid the re-encryption in the decapsulation algorithm and, in this way, to reduce the side channel attacks vulnerability.

Forward Secure Public Key Encryption with Keyword Search for Outsourced Cloud Storage

Cloud storage has become a primary industry in remote data management service but also attracts security concerns, where the best available approach for preventing data disclosure is encryption. Among them the public key encryption with keyword search (PKSE) is considered to be a promising technique, since clients can efficiently search over encrypted data files. That is, a client first generates a search token when to query data files, the cloud server uses the search token to proceed the query over encrypted data files. However, a serious attack is raised when PKSE meets cloud. Formally speaking, the cloud server can learn the information of a newly added encrypted data file containing the keyword that previously queried by using the search tokens it has received, and can further discover the privacy information. To address this issue, we propose a forward secure public key searchable encryption scheme, in which a cloud server cannot learn any information about a newly added encrypted data file containing the keyword that previously queried. To better understand the design principle, we introduce a framework for constructing forward secure public key searchable encryption schemes based on attribute-based searchable encryption. Finally, the experiments show our scheme is efficient.

CPA/CCA2-secure PKE with squared-exponential DFR from low-noise LPN

LPN (learning parity with noise) problem is a good candidate for post-quantum cryptography which enjoys simplicity and suitability for weak-power devices. Döttling et al. (ASIACRYPT 2012) initiated the first secure public key encryption (PKE) under the low-noise LPN assumption. Kiltz et al. (PKC 2014) proposed a simpler and more efficient scheme using double-trapdoor technique from the same assumption. Both schemes abide the decoding failure rate (DFR) 2−Θ(k) (k is the security parameter) and there exists CPA/CCA2-secure PKE with squared-exponential DFR 2−Θ(k2) from constant-noise LPN (Yu and Zhang, CRYPTO 2016). In this work, we give a positive answer with squared-exponential DFR in the low-noise setting.More precisely, we first introduce a variant (VxLPN) of the low-noise Exact LPN (xLPN, proposed by Jain et al. at ASIACRYPT 2012 and used as building block in commitments and zero-knowledge proofs), where the coefficient matrix A follows the uniform distribution over {0,1}q×n (n=Θ(k2),q=Θ(n)), the secret x is sampled from Bμn (Bμ is the Bernoulli distribution with noise rate μ=Θ(1q)), and the noise e follows a column vector distribution uniform over {z∈{0,1}q:|z|=qμ}. A series of reductions show that VxLPN is at least as hard as the standard LPN for the same noise rate μ. We then construct from the VxLPN CPA/CCA2 secure PKE schemes with squared-exponential DFR 2−Θ(k2) which share the common structure extrinsically with Kiltz et al. and Yu-Zhang schemes. The secret key(s) in our schemes are simply sampled from the Bernoulli distribution, and comparatively, the secret key(s) in Yu-Zhang schemes must be chosen from a tailored version of Bernoulli distribution (along with the coefficient matrix A that follows a distribution Dλn×n=Un×λ⋅Uλ×n induced by multiplying two random matrices in the public key, λ=Θ(log2⁡n)) in order to guarantee the correctness of their schemes. Consider the performance on 128-bit security level, our CCA2-secure scheme only holds 117.79 MB public keys, 67.31 MB secret keys and 10.15 KB ciphertexts, and thus is more efficient than the schemes of Döttling et al. and Kiltz et al. ((14.53 GB, 14.48 GB, 14.06 KB) and (161.78 MB, 92.45 MB, 13.60 KB) respectively).

A CCA secure public key encryption scheme based on finite groups of Lie type

A CCA secure public key encryption scheme based on finite groups of Lie type

Two-Round Password-Based Authenticated Key Exchange from Lattices

Password-based authenticated key exchange (PAKE) allows participants sharing low-entropy passwords to agree on cryptographically strong session keys over insecure networks. In this paper, we present two PAKE protocols from lattices in the two-party and three-party settings, respectively, which can resist quantum attacks and achieve mutual authentication. The protocols in this paper achieve two rounds of communication by carefully utilizing the splittable properties of the underlying primitive, a CCA (Chosen-Ciphertext Attack)-secure public key encryption (PKE) scheme with associated nonadaptive approximate smooth projection hash (NA-ASPH) system. Compared with other related protocols, the proposed two-round PAKE protocols have relatively less communication and computation overhead. In particular, the two-round 3PAKE is more practical in large-scale communication systems.

A fast and secure public-key image encryption scheme based on Mordell elliptic curves

Encryption schemes based on elliptic curves (ECs) have shown high resistance against modern cryptanalysis. However, these schemes involve heavy computation for the generation of points over ECs, and therefore they are not suitable for communication systems such as sensor networks and Internet of Things. Thus, we propose a fast and secure public-key image encryption scheme. In this scheme, the sender and receiver agree on a public EC. Then the scheme performs pixel-masking and pixel-scrambling procedures using random numbers and a dynamic substitution box over ECs that are isomorphic to the public EC. For a fixed public EC, we prove that our scheme has a computational complexity that is a polylogarithmic function of the size of the plain text. In other words, the computational complexity of our scheme is independent of the point generation over ECs. We tested the security of our scheme against modern attacks by encrypting all standard images in the USC-SIPI image database. Compared to some state-of-the-art cryptosystems, our scheme is fast and has high security.

Public-Key Encryption Secure Against Related Randomness Attacks for Improved End-to-End Security of Cloud/Edge Computing

Public-key encryption is often used to protect data security/privacy and secure communication in scenarios of cloud computing and edge computing. Related randomness attacks model (RRA) for public-key encryption was motivated by randomness failures. This paper proposes some methods of constructing secure public-key encryption scheme against related randomness attacks, i.e. RRA-CPA secure public-key encryption scheme with efficient decryption algorithm and short ciphertexts size obtained from one-way function with weak RKA-security and indistinguishability obfuscation, RRA-CPA secure public-key encryption scheme against arbitrarily function from any publicly deniable encryption and RRA-CCA secure public-key encryption scheme against arbitrarily function from standard IND-CCA public-key encryption scheme with a hardcore function for arbitrarily correlated inputs.

CCA Secure Public Key Encryption against After-the-Fact Leakage without NIZK Proofs

In leakage resilient cryptography, there is a seemingly inherent restraint on the ability of the adversary that it cannot get access to the leakage oracle after the challenge. Recently, a series of works made a breakthrough to consider a postchallenge leakage. They presented achievable public key encryption (PKE) schemes which are semantically secure against after-the-fact leakage in the split-state model. This model puts a more acceptable constraint on adversary’s ability that the adversary cannot query the leakage of secret states as a whole but the functions of several parts separately instead of prechallenge query only. To obtain security against chosen ciphertext attack (CCA) for PKE schemes against after-the-fact leakage attack (AFL), existing works followed the paradigm of “double encryption” which needs noninteractive zero knowledge (NIZK) proofs in the encryption algorithm. We present an alternative way to achieve AFL-CCA security via lossy trapdoor functions (LTFs) without NIZK proofs. First, we formalize the definition of LTFs secure against AFL (AFLR-LTFs) and all-but-one variants (ABO). Then, we show how to realize this primitive in the split-state model. This primitive can be used to construct AFLR-CCA secure PKE scheme in the same way as the method of “CCA from LTFs” in traditional sense.

Simulation-based receiver selective opening CCA secure PKE from standard computational assumptions

In the situation where there are one sender and multiple receivers and the sender transmits ciphertexts of correlated plaintexts, a receiver selective opening (RSO) attack for a public key encryption (PKE) scheme considers adversaries that can corrupt some of the receivers and get their secret keys and plaintexts. Security against RSO attacks for a PKE scheme ensures confidentiality of ciphertexts of uncorrupted receivers. Simulation-based RSO security against chosen ciphertext attacks (SIM-RSO-CCA) is the strongest security notion in all RSO attack scenarios. Jia, Lu, and Li (2016) [19] proposed the first SIM-RSO-CCA secure PKE scheme. However, their scheme used indistinguishability obfuscation, which is not known to be constructed from any standard computational assumption. In this paper, we give two contributions for constructing SIM-RSO-CCA secure PKE from standard computational assumptions. Firstly, we propose a generic construction of SIM-RSO-CCA secure PKE using an IND-CPA secure PKE scheme and a non-interactive zero-knowledge proof system satisfying one-time simulation soundness. Secondly, we propose an efficient and concrete construction of SIM-RSO-CCA secure PKE based on the decisional Diffie-Hellman (DDH) assumption. Moreover, we give a method for efficiently expanding the plaintext space of the DDH-based construction. By applying this method to the construction, we obtain the first DDH-based SIM-RSO-CCA secure PKE scheme supporting a super-polynomially large plaintext space with compact ciphertexts.

From Minicrypt to Obfustopia via Private-Key Functional Encryption

Private-key functional encryption enables fine-grained access to symmetrically encrypted data. Although private-key functional encryption (supporting an unbounded number of keys and ciphertexts) seems significantly weaker than its public-key variant, its known realizations all rely on public-key functional encryption. At the same time, however, up until recently it was not known to imply any public-key primitive, demonstrating our poor understanding of this primitive. Bitansky et al. (Theory of cryptography—14th international conference, TCC 2016-B, 2016) showed that sub-exponentially secure private-key function encryption bridges from nearly exponential security in Minicrypt to slightly super-polynomial security in Cryptomania, and from sub-exponential security in Cryptomania to Obfustopia. Specifically, given any sub-exponentially secure private-key functional encryption scheme and a nearly exponentially secure one-way function, they constructed a public-key encryption scheme with slightly super-polynomial security. Assuming, in addition, a sub-exponentially secure public-key encryption scheme, they then constructed an indistinguishability obfuscator (or a public-key functional encryption scheme if the given building blocks are polynomially secure). We show that quasi-polynomially secure private-key functional encryption bridges from sub-exponential security in Minicrypt all the way to Cryptomania. First, given any quasi-polynomially secure private-key functional encryption scheme, we construct an indistinguishability obfuscator for circuits with inputs of poly-logarithmic length. Then, we observe that such an obfuscator can be used to instantiate many natural applications of indistinguishability obfuscation. Specifically, relying on sub-exponentially secure one-way functions, we show that quasi-polynomially secure private-key functional encryption implies not just public-key encryption but leads all the way to public-key functional encryption for circuits with inputs of poly-logarithmic length. Moreover, relying on sub-exponentially secure injective one-way functions, we show that quasi-polynomially secure private-key functional encryption implies a hard-on-average distribution over instances of a PPAD-complete problem. Underlying our constructions is a new transformation from single-input functional encryption to multi-input functional encryption in the private-key setting. The previously known such transformation (Brakerski et al. J Cryptol 31(2):434–520, 2018) required a sub-exponentially secure single-input scheme, and obtained a scheme supporting only a slightly super-constant number of inputs. Our transformation both relaxes the underlying assumption and supports more inputs: Given any quasi-polynomially secure single-input scheme, we obtain a scheme supporting a poly-logarithmic number of inputs.

Public key encryption with equality test from generic assumptions in the random oracle model

Public key encryption with equality test (PKEET) is a variant of classical public key encryption (PKE) with the special functionality of an equality test, and can be used in many applications such as in keyword search on encrypted data and for efficient management by partitioning encrypted data in the cloud. Since the original proposal of Yang et al. (CT-RSA, 2010), several subsequent proposals to improve the efficiency or functionality of PKEET have been reported.We present a PKEET construction from generic assumptions in the random oracle model. In particular, whereas previous results require number-theoretic assumptions or strictly stronger generic assumptions such as the existence of secure hierarchical identity-based encryption, our proposal requires only the existence of cryptographic hash functions and secure PKE schemes satisfying a special property, called randomness extractability. Informally, randomness extractability means that one can recover the randomness used in a ciphertext when given a secret key corresponding to a public key for the ciphertext. We investigate the fact that PKE schemes satisfying this property can be designed by the Fujisaki-Okamoto (FO) transformation, which is the widely utilized method to obtain secure PKE schemes from basic cryptographic primitives in the random oracle model. As a result, in combination with the FO transformation, we obtain a PKEET construction in the random oracle model if there exist a one-way PKE scheme, a one-time secure symmetric key encryption scheme, collision-resistant and one-way hash functions, and a pseudorandom function. In this sense, we remark that our PKEET construction is derived from fundamental generic assumptions only.

On the KDM-CCA Security from Partial Trapdoor One-Way Family in the Random Oracle Model

Abstract In PKC 2000, Pointcheval presented a generic technique to make a highly secure cryptosystem from any partially trapdoor one-way function in the random oracle model. More precisely, any suitable problem providing a one-way cryptosystem can be efficiently derived into a chosen-ciphertext attack (CCA) secure public key encryption (PKE) scheme. In fact, the overhead only consists of two hashing and a XOR. In this paper, we consider the key-dependent message (KDM) security of the Pointcheval’s transformation. Unfortunately, we do not know how to directly prove its KDM-CCA security because there are some details in the proof that we can not bypass. However, a slight modification of the original transformation (we call twisted Pointcheval’s scheme) makes it possible to obtain the KDM-CCA security. As a result, we prove that the twisted Pointcheval’s scheme achieves the KDM-CCA security without introducing any new assumption. That is, we can construct a KDM-CCA secure PKE scheme from partial trapdoor one-way injective family in the random oracle model.

Practical public key encryption with selective opening security for receivers

Data security and privacy protection is one of the highest concerns in cloud computing. Selective opening security (SOA security) is a security notion focusing on a multi-user setting on the Internet. In recent years, many public-key encryption (PKE) constcutions have been proposed that meet SOA security. Most of them focus on the sender corruption setting. However, less attention has been paid on the receiver corruption setting. Inspired by the work of Heuer et al. (PKC 2015), which showed a practical SOA secure PKE scheme (in the sender corruption setting) from a key encapsulation mechanism (KEM) and a message authentication code (MAC), we propose a practical generic PKE construction achieving simulation-based SOA security under chosen-ciphertext attacks for recievers (RSIM-SO-CCA security). Our construction is also based on a KEM and a MAC. We show that if the underlying KEM is one-way secure in the presence of a plaintext-checking oracle (OW-PCA) and the underlying MAC is strong unforgeable under one-time chosen message attacks (sUF-OT-CMA), then our generic construction is RSIM-SO-CCA secure in the random oracle model.

A countermeasure against cryptographic key leakage in cloud: public-key encryption with continuous leakage and tampering resilience

Public-key encryption is an important security mechanism used in cloud environment. To ensure the confidentiality of data encrypted using public-key encryption, countermeasures against cryptographic key leakage by side-channel attacks should be applied to the encryption scheme implemented both in locality and in cloud server. Traditional public-key encryption does not capture side-channel attacks. Moreover, the adversary can inject fault to tamper with the secret key and observe the output of the public-key encryption scheme under this modified key which is called “tampering attack”. In this paper, we present two continuous leakage and tampering resilient CCA secure public-key encryption schemes. For implementations of our schemes during the key update, bounded number of tampering queries for arbitrary key relations and bounded leakage is allowed. By updating the secret key, our schemes are secure against continuous leakage and tampering attacks.

Super-strong RKA secure MAC, PKE and SE from tag-based hash proof system

$$\mathcal {F}$$ -related-key attacks (RKA) on cryptographic systems consider adversaries who can observe the outcome of a system under not only the original key, say k, but also related keys f(k), with f adaptively chosen from $$\mathcal {F}$$ by the adversary. In this paper, we define new RKA security notions for several cryptographic primitives including message authentication code (MAC), public-key encryption (PKE) and symmetric encryption (SE). This new kind of RKA notions are called super-strong RKA securities, which stipulate minimal restrictions on the adversary’s forgery or oracle access, thus turn out to be the strongest ones among existing RKA security requirements. We present paradigms for constructing super-strong RKA secure MAC, PKE and SE from a common ingredient, namely Tag-based hash proof system (THPS). We also present constructions for THPS based on the k-linear and the DCR assumptions. When instantiating our paradigms with concrete THPS constructions, we obtain super-strong RKA secure MAC, PKE and SE schemes for the class of restricted affine functions $$\mathcal {F}_{\text {raff}}$$ , of which the class of linear functions $$\mathcal {F}_{\text {lin}}$$ is a subset. To the best of our knowledge, our MACs, PKEs and SEs are the first ones possessing super-strong RKA securities for a non-claw-free function class $$\mathcal {F}_{\text {raff}}$$ in the standard model and under standard assumptions. Our constructions are free of pairing and are as efficient as those proposed in previous works. In particular, the keys, tags of MAC and ciphertexts of PKE and SE all consist of only a constant number of group elements.

Incremental Deterministic Public-Key Encryption

Motivated by applications in large storage systems, we initiate the study of incremental deterministic public-key encryption. Deterministic public-key encryption, introduced by Bellare, Boldyreva, and O'Neill (CRYPTO '07), provides an alternative to randomized public-key encryption in various scenarios where the latter exhibits inherent drawbacks. A deterministic encryption algorithm, however, cannot satisfy any meaningful notion of security for low-entropy plaintexts distributions, but Bellare et al. demonstrated that a strong notion of security can in fact be realized for relatively high-entropy plaintext distributions. In order to achieve a meaningful level of security, a deterministic encryption algorithm should be typically used for encrypting rather long plaintexts for ensuring a sufficient amount of entropy. This requirement may be at odds with efficiency constraints, such as communication complexity and computation complexity in the presence of small updates. Thus, a highly desirable property of deterministic encryption algorithms is incrementality: Small changes in the plaintext translate into small changes in the corresponding ciphertext. We present a framework for modeling the incrementality of deterministic public-key encryption. Our framework extends the study of the incrementality of cryptography primitives initiated by Bellare, Goldreich and Goldwasser (CRYPTO '94). Within our framework, we propose two schemes, which we prove to enjoy an optimal tradeoff between their security and incrementality up to lower-order factors. Our first scheme is a generic method which can be based on any deterministic public-key encryption scheme, and, in particular, can be instantiated with any semantically secure (randomized) public-key encryption scheme in the random-oracle model. Our second scheme is based on the Decisional Diffie---Hellman assumption in the standard model. The approach underpinning our schemes is inspired by the fundamental "sample-then-extract" technique due to Nisan and Zuckerman (JCSS '96) and refined by Vadhan (J. Cryptology '04), and by the closely related notion of "locally computable extractors" due to Vadhan. Most notably, whereas Vadhan used such extractors to construct private-key encryption schemes in the bounded-storage model, we show that techniques along these lines can also be used to construct incremental public-key encryption schemes.

Building Secure Public Key Encryption Scheme from Hidden Field Equations

Multivariate public key cryptography is a set of cryptographic schemes built from the NP-hardness of solving quadratic equations over finite fields, amongst which the hidden field equations (HFE) family of schemes remain the most famous. However, the original HFE scheme was insecure, and the follow-up modifications were shown to be still vulnerable to attacks. In this paper, we propose a new variant of the HFE scheme by considering the special equation x2=x defined over the finite field F3 when x=0,1. We observe that the equation can be used to further destroy the special structure of the underlying central map of the HFE scheme. It is shown that the proposed public key encryption scheme is secure against known attacks including the MinRank attack, the algebraic attacks, and the linearization equations attacks. The proposal gains some advantages over the original HFE scheme with respect to the encryption speed and public key size.