Short Ciphertexts Research Articles

Anonymous spatial encryption under affine space delegation functionality with full security

Anonymous encryption provides the decrypter’s identity privacy preservation as well as plaintext confidentiality. Spatial encryption, which is a kind of functional encryption, provides a generalized framework for special property encryption schemes such as broadcast encryption, predicate encryption, forward secure encryption, (hierarchical) identity-based encryption, delegatable attribute-based encryption etc. In this paper, we propose an anonymous spatial encryption scheme that deploys an affine subspace delegation mechanism. Our proposed scheme captures the message confidentiality, recipient anonymity, adaptive security, partial-order delegation and short ciphertext, simultaneously. To the best of our knowledge, the proposed scheme is the first anonymous spatial encryption that provides the anonymity property in adaptive security model, whose construction is based on a dual system encryption mechanism in bilinear composite-order groups. We also give a conversion construction to move into a prime-order setting with canceling property, whose security is based on the Decision Linear Problem. Finally, we provide a transformation methodology to obtain a CCA-secure scheme that combines a one-time signature, delegation functionality and the CPA-secure scheme.

Ciphertext-policy hierarchical attribute-based encryption with short ciphertexts

Attribute-based encryption (ABE) systems allow encrypting to uncertain receivers by means of an access policy specifying the attributes that the intended receivers should possess. ABE promises to deliver fine-grained access control of encrypted data. However, when data are encrypted using an ABE scheme, key management is difficult if there is a large number of users from various backgrounds. In this paper, we elaborate on ABE and propose a new versatile cryptosystem referred to as ciphertext-policy hierarchical ABE (CP-HABE). In a CP-HABE scheme, the attributes are organized in a matrix and the users having higher-level attributes can delegate their access rights to the users at a lower level. These features enable a CP-HABE system to host a large number of users from different organizations by delegating keys, e.g., enabling efficient data sharing among hierarchically organized large groups. We construct a CP-HABE scheme with short ciphertexts. The scheme is proven secure in the standard model under non-interactive assumptions.

Efficient Fully Homomorphic Encryption from (Standard) $\mathsf{LWE}$

A fully homomorphic encryption (FHE) scheme allows anyone to transform an encryption of a message, $m$, into an encryption of any (efficient) function of that message, $f(m)$, without knowing the secret key. We present a leveled FHE scheme that is based solely on the (standard) learning with errors ($\mathsf{LWE}$) assumption. (Leveled FHE schemes are initialized with a bound on the maximal evaluation depth. However, this restriction can be removed by assuming “weak circular security.'') Applying known results on $\mathsf{LWE}$, the security of our scheme is based on the worst-case hardness of “short vector problems” on arbitrary lattices. Our construction improves on previous works in two aspects: 1. We show that “somewhat homomorphic” encryption can be based on $\mathsf{LWE}$, using a new relinearization technique. In contrast, all previous schemes relied on complexity assumptions related to ideals in various rings. 2. We deviate from the “squashing paradigm” used in all previous works. We introduce a new dimension-modulus reduction technique, which shortens the ciphertexts and reduces the decryption complexity of our scheme, without introducing additional assumptions. Our scheme has very short ciphertexts, and we therefore use it to construct an asymptotically efficient $\mathsf{LWE}$-based single-server private information retrieval (PIR) protocol. The communication complexity of our protocol (in the public-key model) is $k\cdot\mathrm{polylog}(k)+\log|\mathtt{DB}|$ bits per single-bit query, in order to achieve security against $2^k$-time adversaries (based on the best known attacks against our underlying assumptions).

Anonymous HIBE with short ciphertexts: full security in prime order groups

Anonymous Hierarchical Identity-Based Encryption (HIBE) is an extension of Identity-Based Encryption (IBE), and it provides not only a message hiding property but also an identity hiding property. Anonymous HIBE schemes can be applicable to anonymous communication systems and public key encryption systems with keyword searching. However, previous anonymous HIBE schemes have some disadvantages that the security was proven in the weaker model, the size of ciphertexts is not short, or the construction was based on composite order bilinear groups. In this paper, we propose the first efficient anonymous HIBE scheme with short ciphertexts in prime order (asymmetric) bilinear groups, and prove its security in the full model with an efficient reduction. To achieve this, we use the dual system encryption methodology of Waters. We also present the benchmark results of our scheme by measuring the performance of our implementation.

Efficient and adaptively secure broadcast encryption systems

ABSTRACTBroadcast encryption is an effective way to broadcast a message securely such that more than one privileged receiver can decrypt it. The well‐known constructions of identity‐based broadcast encryption only support bounded broadcast users that had to deploy the maximum user number in advance. This is somewhat inefficient and impractical if the broadcast user number is predetermined. In this paper, we propose an adaptively secure identity‐based broadcast encryption in the standard model that supports arbitrary number of users in broadcast set, which eliminates the size of public parameters with a constant number of group elements and obtain short ciphertexts, secret keys, and public parameters. We use the techniques of semi‐functional ciphertexts and semi‐functional keys in orthogonal subgroups to implement the boundless broadcast set and adaptive security by means of dual‐system encryption mechanism in a composite‐order group, and we prove the scheme to be fully secure without the random oracles in the static assumptions. The proposed scheme captures the properties of confidentiality, adaptive security, constant key, and short ciphertext. We also evaluate the computational costs and communication overheads and give the deployment in secure set‐top box broadcast systems. Copyright © 2012 John Wiley & Sons, Ltd.

Provably secure threshold public-key encryption with adaptive security and short ciphertexts

Threshold public-key encryption is a cryptographic primitive allowing decryption control in group-oriented encryption applications. Existing TPKE schemes suffer from long ciphertexts with size linear in the number of authorized users or can only achieve non-adaptive security, which is too weak to capture the capacity of the attackers in the real world. In this paper, we propose an efficient TPKE scheme with constant-size ciphertexts and adaptive security. Security is proven under the decision Bilinear Diffie–Hellman Exponentiation assumption in the standard model. Then we extend our basic construction with efficient trade-offs between the key size and the ciphertext size. Finally, we illustrate improvements to transmit multiple secret session keys in one session with almost no extra cost.

Adaptively Secure Broadcast Encryption with Short Ciphertexts

We propose an adaptively secure broadcast encryption scheme with short ciphertexts, where the size of broadcast encryption message is fixed regardless of the size of the broadcast group. In our proposed scheme, members can join and leave the group without requiring any change to public parameters of the system or private keys of existing members. Our construction has a twofold improvement over previously known best broadcast encryption schemes. First, we propose a scheme that immediately yields adaptive security without any increase in the size of ciphertexts or use of a random oracle. Secondly, the proof of security in the proposed scheme is defined in a stronger security model closely simulating an adversary in real world. In our security model, the adversary can selectively query private keys of the group members after the setup and can receive decryption of broadcast encryption messages at any given time.

Functional encryption for public-attribute inner products: Achieving constant-size ciphertexts with adaptive security or support for negation

In functional encryption (FE) schemes, ciphertexts and private keys are associated with attributes and decryption is possible whenever key and ciphertext attributes are suitably related. It is known that expressive realizations can be obtained from a simple functional encryption flavor called inner product encryption (IPE), where decryption is allowed whenever ciphertext and key attributes form orthogonal vectors. In this paper, we construct public-attribute inner product encryption (PAIPE) systems, where ciphertext attributes are public (in contrast to attribute-hiding IPE systems). Our PAIPE schemes feature constant-size ciphertexts for the zero and non-zero evaluations of inner products. These schemes respectively imply an adaptively secure identity-based broadcast encryption scheme and an identity-based revocation mechanism that both feature short ciphertexts and rely on simple assumptions in prime order groups. We also introduce the notion of negated spatial encryption, which subsumes non-zero-mode PAIPE and can be seen as the revocation analogue of the spatial encryption primitive of Boneh and Hamburg.

Attribute-based encryption schemes with constant-size ciphertexts

Attribute-based encryption (ABE), as introduced by Sahai and Waters, allows for fine-grained access control on encrypted data. In its key-policy flavor (the dual ciphertext-policy scenario proceeds the other way around), the primitive enables senders to encrypt messages under a set of attributes and private keys are associated with access structures that specify which ciphertexts the key holder will be allowed to decrypt. In most ABE systems, the ciphertext size grows linearly with the number of ciphertext attributes and the only known exception only supports restricted forms of access policies. This paper proposes the first attribute-based encryption (ABE) schemes allowing for truly expressive access structures and with constant ciphertext size. Our first result is a ciphertext-policy attribute-based encryption (CP-ABE) scheme with O(1)-size ciphertexts for threshold access policies and where private keys remain as short as in previous systems. As a second result, we show that a certain class of identity-based broadcast encryption schemes generically yields monotonic key-policy attribute-based encryption (KP-ABE) systems in the selective set model. Our final contribution is a KP-ABE realization supporting non-monotonic access structures (i.e., that may contain negated attributes) with short ciphertexts. As an intermediate step toward this result, we describe a new efficient identity-based revocation mechanism that, when combined with a particular instantiation of our general monotonic construction, gives rise to the most expressive KP-ABE realization with constant-size ciphertexts. The downside of our second and third constructions is that private keys have quadratic size in the number of attributes. On the other hand, they reduce the number of pairing evaluations to a constant, which appears to be a unique feature among expressive KP-ABE schemes.

Fully collusion-resistant trace-and-revoke scheme in prime-order groups

A trace-and-revoke scheme is a type of broadcast encryption scheme for content protection on various platforms such as pay-per-view TV and DVD players. In 2006, Boneh and Waters (BW) presented a fully collusion-resistant trace-and-revoke scheme. However, a decisive drawback of their scheme is to re- quire composite-order groups. In this paper, we present a new trace-and-revoke scheme that works in prime-order groups. Our scheme is fully collusion-resistant and achieves ciphertexts and pri- vate keys of size 0(√N) for N users. For the same level of security, our scheme is better than the BW scheme in all aspects of efficiency. Some superior features include 8.5 times faster encryption, 12 times faster decryption, and 3.4 times shorter ciphertexts. To achieve our goal, we introduce a novel technique where, by using asymmetric bilinear maps in prime-order groups, the cancellation effect same as in composite-order groups can be obtained.

Efficient signcryption in the standard model

SUMMARYSigncryption is a cryptographic primitive that fulfills both the functions of digital signature and public key encryption simultaneously, at a cost significantly lower than that required by the traditional signature‐then‐encryption approach. The performance advantage of signcryption over the signature‐then‐encryption method makes signcryption useful in many applications, such as electronic commerce, mobile communications, and smart cards. In this paper, we propose an efficient signcryption scheme in the standard model. We prove that our scheme satisfies the confidentiality and strong unforgeability. Compared with the Tan's scheme, our scheme has | G | + | p | (320) bits shorter ciphertext, 2 | p | − | G | (160) bits shorter private key, and | GT | + | G | (1184) bits shorter public key. In addition, in the Tan's scheme, a user must hold two public key/private key pairs at one time if it were both sender and receiver. Our scheme only needs a public key/private key pair, which is more practical for application. Copyright © 2011 John Wiley & Sons, Ltd.

Provably Secure Role-Based Encryption with Revocation Mechanism

Role-Based Encryption (RBE) realizes access control mechanisms over encrypted data according to the widely adopted hierarchical RBAC model. In this paper, we present a practical RBE scheme with revocation mechanism based on partial-order key hierarchy with respect to the public key infrastructure, in which each user is assigned with a unique private-key to support user identification, and each role corresponds to a public group-key that is used to encrypt data. Based on this key hierarchy structure, our RBE scheme allows a sender to directly specify a role for encrypting data, which can be decrypted by all senior roles, as well as to revoke any subgroup of users and roles. We give a full proof of security of our scheme against hierarchical collusion attacks. In contrast to the existing solutions for encrypted file systems, our scheme not only supports dynamic joining and revoking users, but also has shorter ciphertexts and constant-size decryption keys.

Asymmetric group key agreement protocol for open networks and its application to broadcast encryption

Asymmetric group key agreement is a recently introduced versatile cryptographic primitive. It allows a group of users to negotiate a common encryption key which is accessible to any entities, and each user only holds her respective secret decryption key. This concept not only enables confidential communications among group users but also permits any outsider to send encrypted messages to the group. The existing instantiation is only secure against passive adversaries. In this paper, we first introduce an authenticated asymmetric group key agreement protocol which offers security against active attacks in open networks. Based on this protocol, we then propose a broadcast encryption system without relying on a trusted dealer to distribute the secret keys to the users. Our system is equipped with the perfect forward security property and has short ciphertexts. Improved systems are also described to allow a sender to select receivers for broadcast encryption and to balance the transmission overhead against the ciphertext size.

Anonymous HIBE Scheme Secure Against Full Adaptive-ID Attacks

This paper constructs a new anonymous IBE scheme,and expands it to an anonymous HIBE scheme secure against full adaptive-ID attacks.These systems are built in composite order groups,which have four prime order subgroups.To achieve the anonymity,the authors blinded the public parameters and ciphertexts using the random elements of same subgroup.Moreover,the authors used the random elements of different subgroup to construct secret key for properly decryption.This idea is inspired by the related work,which proposed by Seo et al.in PKC 2009.To obtain full security,the authors applied the new techniques for dual system encryption recently introduced by Lewko and Waters in TCC 2010.Like the techniques used in their paper,the authors also used the semi-functional structures,and employed a hyhrid argument in the security by a sequence of games proof.And employed an additional dummy semi-functional structure to overcome the difficulty in the proof of the anonymity.The new anonymous HIBE scheme has short ciphertexts,and can be proven to be secure in the full-ID model using static assumptions.However,the previous schemes were only proven in the selective-ID model,under some non-static assumption which depended on the depth of the hierarchy.

Adaptively secure identity-based broadcast encryption with constant size private keys and ciphertexts from the subgroups

The main challenge in building efficient broadcast systems is to encrypt messages with short ciphertexts. The well-known constructions of identity-based broadcast encryption (IBBE) with constant size ciphertexts in the standard model are based on the non-standard cryptography assumption. In addition, these constructions cannot solve the trade-off between the private keys and ciphertexts. These folklore construction methods lead to schemes that are somewhat inefficient and leave open the problem of finding more efficient direct constructions. In this paper, we give a secure identity-based broadcast encryption scheme with a constant-size ciphertext and private keys. It is constructed by using dual techniques in the subgroups. The proposed scheme achieves the full security (adaptive security) under three static (i.e. non q -based) assumptions. It is worth noting that only recently Waters’s scheme achieves adaptive security under simple assumptions. One feature of our scheme is that it is relatively simple to get adaptive security.

New Identity-based Broadcast Encryption with Constant Ciphertexts in the Standard Model

How to build an efficient identity-based broadcast system with short ciphertexts is a main challenge at present . The existing constructions with constant size ciphertexts in the standard model are based on the non-standard cryptography assumption. In addition, these constructions cannot solve the trade-off betwe e n the private keys and ciphertexts. Hence t hese methods lead to schemes that are somewhat inefficient in the real world. To overcome these shortcomings, two schemes are introduced at first. The initial construction has constant size ciphertexts and O(| S |)-size private keys(where S denotes the set of receivers). Then the second scheme achieves constant size ciphertexts and constant size private keys which solve the trade-off between the private keys and ciphertexts. Furthermore, their security rest s on the hardness of the decision Diffie-Hellman Exponent problem instead of other strong assumptions. However, both schemes only achieve a weak security-selective-identity security. Finally, two helpful constructions are proposed. They are constructed in the standard model and achieve full security which is stronger than selective-identity security.

Anonymous Hierarchical Identity-Based Encryption with Short Ciphertexts

We propose an anonymous Hierarchical Identity-Based Encryption (anonymous HIBE) scheme with short ciphertexts. Prior to our work, most anonymous HIBE schemes have long ciphertexts increased according to the hierarchical depth of recipient. The size of the ciphertext in our scheme does not depend on the depth of the hierarchy. Moreover, our scheme achieves the lowest computational cost because during the decryption phase the computational cost of decryption is constant. The security can be proven under reasonable assumptions without using random oracles. Our scheme achieves selective-ID security notion.

New Constructions of Identity-based Broadcast Encryption without Random Oracles

The main challenge in building efficient broadcast systems is to encrypt messages with short ciphertexts. In this paper, we present a new construction based on the identity. Our construction contains the desirable features, such as constant size ciphertexts and private keys, short public keys and not fixing the total number of possible users in the setup. In addition, the proposed scheme achieves the full security which is stronger than the selective-identity security. Furthermore we show that the proof of security does not rely on the random oracles. To the best our knowledge, it is the first efficient scheme that is full security and achieves constant size ciphertexts and private keys which solve the trade-off between the ciphertext size and the private key size.

Adaptively Secure Identity-Based Threshold Broadcast Encryption without Random Oracles

A mobile ad hoc network has the computational and energy constraints, the general threshold cryptography does not suit it. In this paper, we consider a new kind of proper public encryption to the ad hoc networks: threshold broadcast encryption. A new construction of identity-based threshold broadcast encryption is proposed. In the proposed scheme, any user can dynamically join the system as a possible recipient, and the sender can dynamically choose the set of recipients and the threshold value t. Our new scheme achieves constant size private keys and O(n-t)-size ciphertexts. This is the first scheme which achieves short ciphertexts and full security in the standard model. Finally, we also show that it is provable security under n+1-Weak Decision Bilinear Diffie-Hellman Exponent (n+1-wDBDHE) assumption.

An efficient conversion scheme for enhancing security of Diffie-Hellman-based encryption

Nowadays, indistinguishability against adaptive chosen-ciphertext attacks (IND-CCA2) has been widely accepted as a proper security criterion for encryption schemes. In this paper, an efficient conversion is proposed to satisfy the IND-CCA2 security. It uses the random oracle methodology and the idea of hybrid encryption, and can enhance any Diffie-Hellman based encryption scheme, which is only one-way under plaintext-checking attack. Compared with other existing conversions, this conversion has the advantages of short ciphertext and low computation overhead, especially when it is applied to the multi-recipient setting.