Short Public Parameters Research Articles

Zero-knowledge proofs for set membership: efficient, succinct, modular

We consider the problem of proving in zero knowledge that an element of a public set satisfies a given property without disclosing the element, i.e., for some u, “u in S and P(u) holds”. This problem arises in many applications (anonymous cryptocurrencies, credentials or whitelists) where, for privacy or anonymity reasons, it is crucial to hide certain data while ensuring properties of such data. We design new modular and efficient constructions for this problem through new commit-and-prove zero-knowledge systems for set membership, i.e. schemes proving u in S for a value u that is in a public commitment c_u. We also extend our results to support non-membership proofs, i.e. proving u notin S. Being commit-and-prove, our solutions can act as plug-and-play modules in statements of the form “u in S and P(u) holds” by combining our set (non-)membership systems with any other commit-and-prove scheme for P(u). Also, they work with Pedersen commitments over prime order groups which makes them compatible with popular systems such as Bulletproofs or Groth16. We implemented our schemes as a software library, and tested experimentally their performance. Compared to previous work that achieves similar properties—the clever techniques combining zkSNARKs and Merkle Trees in Zcash—our solutions offer more flexibility, shorter public parameters and 3.7 times –30times faster proving time for a set of size 2^{64}.

Large Universe CCA2 CP-ABE With Equality and Validity Test in the Standard Model

Abstract Attribute-based encryption with equality test (ABEET) simultaneously supports fine-grained access control on the encrypted data and plaintext message equality comparison without decrypting the ciphertexts. Recently, there have been several literatures about ABEET proposed. Nevertheless, most of them explore the ABEET schemes in the random oracle model, which has been pointed out to have many defects in practicality. The only existing ABEET scheme in the standard model, proposed by Wang et al., merely achieves the indistinguishable against chosen-plaintext attack security. Considering the aforementioned problems, in this paper, we propose the first direct adaptive chosen-ciphertext security ciphertext-policy ABEET scheme in the standard model. Our method only adopts a chameleon hash function and adds one dummy attribute to the access structure. Compared with the previous works, our scheme achieves the security improvement, ciphertext validity check and large universe. Besides, we further optimize our scheme to support the outsourced decryption. Finally, we first give the detailed theoretical analysis of our constructions in computation and storage costs, then we implement our constructions and carry out a series of experiments. Both results indicate that our constructions are more efficient in Setup and Trapdoor and have the shorter public parameters than the existing ABEET ones do.

Leveled Adaptively Strong-Unforgeable Identity-Based Fully Homomorphic Signatures

The identity-based homomorphic signature (IBHS) enables an untrusted server to run some computation over the outsourced data and derive a short signature, vouching for the correctness of the output of the computation, while greatly simplifying key management. To our knowledge, constructions of IBHS have been few and far between. However, the existing IBHS schemes, which either handle only linear functions or has a large public key parameter and satisfies only the artificial notion of selective security. In this work, we construct the first leveled adaptively secure identity-based fully homomorphic signature (IBFHS) schemes without additional public parameters, which can be used to sign many different datasets. Thereby positively answering the open question of constructing a leveled IBFHS scheme with short public parameters, proposed by Wang et al., (ISC, 2015, Springer). We achieve the stronger security and better parameters by using the trapdoor vanishing and vector encoding technique. In our scheme, the size of every evaluated signature depends only logarithmically on the size of the input dataset, and the complexity of verifying a signature for a computation can be amortized when verifying the same computation on many different datasets. Furthermore, we prove that our construction is strongly-unforgeable against adaptively chosen identity and message attacks under the small integer solution (SIS) assumption in standard lattices.

Continuous Leakage-Resilient Identity-Based Encryption with Tight Security

Abstract In the actual applications, an adversary can break the security of cryptography scheme through various leakage attacks (e.g. side-channel attacks, cold-boot attacks, etc.), even the continuous leakage attacks. That is, a practical cryptography scheme must maintain its claimed security in the continuous leakage setting. However, the previous constructions on the leakage-resilient identity-based encryption (IBE) scheme could tolerate a leakage that is bounded, and cannot resist the continuous leakage attacks. In order to further achieve the better security, a novel method to build the continuous leakage-resilient IBE scheme with tight security is presented in this paper, and the scheme’s security is proved, in the standard model, based on a stronger security assumption that depends on the number of queries made by the adversary. In addition, our proposal has several advantages over previous such constructions, e.g. shorter public parameters, higher communication efficiency, tight security, etc.

Certificateless Signcryption Scheme Without Random Oracles

Signcryption can realize encryption and signature simultaneously with lower computational costs and communication overhead than those of the traditional sign-then-encrypt approach. Certificateless cryptosystem solves the key escrow problem in the identity-based cryptosystem and simplifies the public key management in the traditional public key cryptosystem. So far there have been some certificateless signcryption schemes proposed in the standard model. However, they are either insecure or inefficient. They need long system public parameters, making it hard to deploy them in the limited storage environments. Based on the Gentry's identity-based encryption scheme, the authors propose a certificateless signcryption scheme in the standard model. Compared with previous schemes, the proposed scheme has not only much higher computational efficiency, but also shorter public parameters. The authors also give rigorous proof of its security.

Unbounded and revocable hierarchical identity-based encryption with adaptive security, decryption key exposure resistant, and short public parameters.

Revocation functionality and hierarchy key delegation are two necessary and crucial requirements to identity-based cryptosystems. Revocable hierarchical identity-based encryption (RHIBE) has attracted a lot of attention in recent years, many RHIBE schemes have been proposed but shown to be either insecure or bounded where they have to fix the maximum hierarchical depth of RHIBE at setup. In this paper, we propose a new unbounded RHIBE scheme with decryption key exposure resilience and with short public system parameters, and prove our RHIBE scheme to be adaptively secure. Our system model is scalable inherently to accommodate more levels of user adaptively with no adding workload or restarting the system. By carefully designing the hybrid games, we overcome the subtle obstacle in applying the dual system encryption methodology for the unbounded and revocable HIBE. To the best of our knowledge, this is the first construction of adaptively secure unbounded RHIBE scheme.

IBE and function-private IBE under linear assumptions with shorter ciphertexts and private keys, and extensions

Many identity-based encryption schemes under the k-LIN assumption contain 2k + 1 group elements in the ciphertext overhead and private keys. In this paper, we push the limit further by constructing an IBE scheme under the k-LIN assumption with 2k group elements in the ciphertext overhead and private keys. The schemes have variants with shorter public parameters under the k-SCasc assumption, which is a close assumption to k-LIN. Furthermore, via additional refinements, we also put efforts in reducing the public parameter size of our schemes, under either k-LIN or k-SCasc. While we mainly consider securities in the standard model for our schemes, we also show how to make relatively more efficient schemes secure in the random oracle model. Our technique additionally expands to the scheme of Boneh et al. (CRYPTO 2013) to yield more efficient function-private IBE under the 2-LIN (aka, DLIN) assumption. Overall, the shortened size in ciphertexts and private keys inherently leads to fewer exponentiations and pairings in encryption and decryption, and hence yields schemes with better computational efficiency.

IBE and function-private IBE under linear assumptions with shorter ciphertexts and private keys, and extensions

Many identity-based encryption schemes under the k-LIN assumption contain 2k + 1 group elements in the ciphertext overhead and private keys. In this paper, we push the limit further by constructing an IBE scheme under the k-LIN assumption with 2k group elements in the ciphertext overhead and private keys. The schemes have variants with shorter public parameters under the k-SCasc assumption, which is a close assumption to k-LIN. Furthermore, via additional refinements, we also put efforts in reducing the public parameter size of our schemes, under either k-LIN or k-SCasc. While we mainly consider securities in the standard model for our schemes, we also show how to make relatively more efficient schemes secure in the random oracle model. Our technique additionally expands to the scheme of Boneh et al. (CRYPTO 2013) to yield more efficient function-private IBE under the 2-LIN (aka, DLIN) assumption. Overall, the shortened size in ciphertexts and private keys inherently leads to fewer exponentiations and pairings in encryption and decryption, and hence yields schemes with better computational efficiency.

Identity Based Generalized Proxy Signcryption Scheme

Generalized signcryption can work as an encryption scheme, a signature scheme or a signcryption scheme with only one keypair and one algorithm. We extend it to the proxy system setting by considering sharing the same keypair and algorithm between the proxy signature and proxy signcryption, and we call it generalized proxy signcryption (GPSC). We give the formal definition and security model of GPSC in the identity-based setting by considering the whole abilities of an attacker, and propose a concrete scheme in the standard model. Our scheme is publicly verifiable, with strong security by considering insider attack, and with short system public parameters. Our scheme can be proved semantically secure against adaptively chosen ciphertext, chosen id and chosen warrant attack (short for IND-IB-GPSC-CCA) under the Decisional Bilinear Diffie-Hellman (DBDH) assumption, and existentially unforgeable against adaptively chosen message, chosen id and chosen warrant attack (short for EUF-IB-GPSC-CMA) under the (Computational Diffie-Hellman) CDH assumption. The performance evaluation shows it is of high efficiency. Moreover, we give a general construction of identity-based GPSC scheme from an identity-based combined signature and encryption scheme. DOI: http://dx.doi.org/10.5755/j01.itc.45.1.8758

Strongly Unforgeable and Efficient Proxy Signature Scheme with Fast Revocation Secure in the Standard Model

The existing proxy signature schemes with the proxy revocation function are proven to be malleable and do not possess strong unforgeability. Motivated by these concerns, a new proxy signature scheme with fast revocation is proposed, and it can be proved that the proposed scheme can achieve strong unforgeability in the standard model. By using this scheme, the original signer can generate the delegation warrant for the proxy signer, and at the same time, he/she can perform the immediate revocation to completely terminate the delegation when needed. Analyses show that the proposed scheme satisfies all of the security requirements of proxy signature and has shorter public parameters than the existing ones.

Fully secure fuzzy identity-based encryption for secure IoT communications

How to securely transmit data is an important problem in Internet of Things (IoT). Fuzzy identity-based encryption (FIBE) is a good candidate for resolving this problem. However, existing FIBE schemes suffer from the following disadvantages: rely on random oracle models, merely secure in selective-ID model, long public parameters, and loose security reduction. In this paper, we propose a new FIBE scheme. Our scheme is secure in the full model without random oracles, and at the same time has a tight security reduction and short public parameters. This means that our scheme is quite suitable for secure transmitting data in IOT.

Sequential aggregate signatures with short public keys without random oracles

The notion of aggregate signature has been motivated by applications and it enables any user to compress different signatures signed by different signers on different messages into a short signature. Sequential aggregate signature, in turn, is a special kind of aggregate signature that only allows a signer to add his signature into an aggregate signature in sequential order. This latter scheme has applications in diversified settings such as in reducing bandwidth of certificate chains and in secure routing protocols. Lu, Ostrovsky, Sahai, Shacham, and Waters (EUROCRYPT 2006) presented the first sequential aggregate signature scheme in the standard model. The size of their public key, however, is quite large (i.e., the number of group elements is proportional to the security parameter), and therefore, they suggested as an open problem the construction of such a scheme with short keys.In this paper, we propose the first sequential aggregate signature schemes with short public keys (i.e., a constant number of group elements) in prime order (asymmetric) bilinear groups that are secure under static assumptions in the standard model. Furthermore, our schemes employ a constant number of pairing operations per message signing and message verification operation. Technically, we start with a public-key signature scheme based on the recent dual system encryption technique of Lewko and Waters (TCC 2010). This technique cannot directly provide an aggregate signature scheme since, as we observed, additional elements should be published in a public key to support aggregation. Thus, our constructions are careful augmentation techniques for the dual system technique to allow it to support sequential aggregate signature schemes. We also propose a multi-signature scheme with short public parameters in the standard model.

Self-updatable encryption with short public parameters and its extensions

Cloud storage is very popular since it has many advantages, but there is a new threat to cloud storage that was not considered before. Self-updatable encryption that updates a past ciphertext to a future ciphertext by using a public key is a new cryptographic primitive introduced by Lee et al. (in: Sako K, Sarkar P (eds) Advances in cryptology—ASIACRYPT 2013, 2013) to defeat this threat, in which an adversary who obtained a past private key can still decrypt a (previously unread) past ciphertext stored in cloud storage. Additionally, an SUE scheme can be combined with an attribute-based encryption (ABE) scheme to construct a powerful revocable-storage ABE (RS-ABE) scheme introduced by Sahai et al. (in: Safavi-Naini R, Canetti R (eds) Advances in cryptology—CRYPTO 2012, 2012) that provides the key revocation and ciphertext updating functionality for cloud storage. In this paper, we propose an efficient SUE scheme and its extended schemes. First, we propose an SUE scheme with short public parameters in prime-order bilinear groups and prove its security under a $$q$$ -type assumption. Next, we extend our SUE scheme to a time-interval SUE (TI-SUE) scheme that supports a time interval in ciphertexts. Our TI-SUE scheme has short public parameters and it is also secure under the $$q$$ -type assumption. Finally, we propose the first large universe RS-ABE scheme with short public parameters in prime-order bilinear groups and prove its security in the selective revocation list model under a $$q$$ -type assumption.

An improved certificateless strong key-insulated signature scheme in the standard model

Exposure of secret keys may be the most devastating attack on a public key cryptographic scheme since such that security is entirely lost. The key-insulated security provides a promising approach to deal with this threat since it can effectively mitigate the damage caused by the secret key exposure. To eliminate the cumbersome certificate management in traditional PKI-supported key-insulated signature while overcoming the key escrow problem in identity-based key-insulated signature, two certificateless key-insulated signature schemes without random oracles have been proposed so far. However, both of them suffer from some security drawbacks and do not achieve existential unforgeability. In this paper, we propose a new certificateless strong key-insulated signature scheme that is proven secure in the standard model. Compared with the previous certificateless strong proxy signature scheme, the proposed scheme offers stronger security and enjoys higher computational efficiency and shorter public parameters.

Analysis and Improvements of Several (H)IBS/IBSC/PRBE Schemes

Constructing efficient (Hierarchical) identitybased signature/signcryption ((H)IBS/IBSC) schemes in thestandard model with full security remain as open problemsfor a long time. Ren et al. constructed efficient (H)IBS/IBSCschemes with full security without random oracle in ISDPE’07 and Chinacrypt’08, . They claimed their schemescan be proved to simultaneously achieve high efficiency,short public parameters and a tight reduction. But weshall show their schemes are not secure. Furthermore, wegive improvements to these schemes which can resist theproposed attack. Proxy re-encryption is a primitive whichallows the transformation from A’s ciphertext to be B’sciphertext by using proxies, without the proxy knowing thecorresponding plaintexts or secret keys of A or B. Proxybroadcast re-encryption aims at transforming ciphertextfrom one user to a group, which is a generalization of proxyre-encryption. Recently, Sun et al. proposed a CCA-secureunidirectional proxy broadcast re-encryption in the standardmodel, we also show their scheme has some flaws.

A provable secure fuzzy identity based signature scheme

To use biometrics identities in an identity based encryption system, Sahai and Waters first introduced the notion of fuzzy identity based encryption (FIBE) in 2005. Yang et al. extended it to digital signature and introduced the concept of fuzzy identity based signature (FIBS) in 2008, and constructed an FIBS scheme based on Sahai and Waters’s FIBE scheme. In this paper, we further formalize the notion and security model of FIBS scheme and propose a new construction of FIBS scheme based on bilinear pairing. The proposed scheme not only provides shorter public parameters, private key and signature, but also have useful structures which result in more efficient verification than that of Yang et al.’s FIBS scheme. The proposed FIBS scheme is proved to be existentially unforgeable under a chosen message attack and selective fuzzy identity attack in the random oracle model under the discrete logarithm assumption.

Improved Hierarchical Identity-Based Parallel Key-Insulated Encryption

The problem of key-exposure is an important issue in modern society due to the growing use of mobile devices. Weng et al. proposed an identity-based parallel keyinsulated encryption (IBPKIE) scheme to solve the keyexposure problem in an identity-based cryptosystem. The scheme has long public parameters and a loose security reduction. Ren et al. presented a new IBPKIE scheme which had constant size public parameters and a tight reduction, and then extended it to a hierarchical IBPKIE (HIBPKIE) scheme. However, Wang et al. analyzed two schemes of Ren et al. and showed that they are not secure against chosen-plaintext attack. In this paper, we propose an improved IBPKIE scheme which achieves IND-ID-KI-CPA security without random oracles. Moreover, our scheme has short public parameters and a tight reduction. We then present an HIBPKIE scheme which achieves IND-sID-KI-CPA security without random oracles. In this scheme, the ciphertext size is independent of the level of the hierarchy in the HIBPKIE scheme.

New Constructions of Short Signatures in the Standard Model

To meet the need s in low-bandwidth communication, low-storage and less computation environments , a new technique is introduced to construct short signature in the standard model. The new short signature scheme is constructed based on the bilinear pairing and has short public parameters . In addition, the size of the signature achieves 160 bits. U nder the n -Exponent Computational Diffie-Hellman Problem( n -CDH), the new scheme is provable security. Finally, we also give the application of the new scheme by constructing the short identity-based signature and threshold signatures.

New Identity-based Short Signature Without Random Oracles

A new identity-based short signature(IBS) is proposed in this paper. The new scheme is constructed in the standard model and has short public parameters and private keys. In addition, the size of the signature achieves 320 bits, which is much more efficient than the existing IBS schemes. Under the n-Computational Diffie-Hellman Exponent Problem(n-CDH), the new scheme is provable security.

Adaptively secure hierarchical identity-based signature in the standard model

Hierarchical identity-based signature (HIBS) has wide applications in the large network. However, the existing works cannot solve the trade-off between the security and efficiency. The main challenge at present is to construct a high efficient and strong secure HIBS with a low computation cost. In this paper, a new construction of HIBS scheme is proposed. The new scheme achieves the adaptive security which is a strong security in the identity-based cryptography. But our scheme has short public parameters and the private keys size shrinks as the hierarchy depth increases. The signature size is a constant and the cost of verification only requires four bilinear pairings, which are independent of hierarchy depth. Furthermore, under the q-strong computational diffie-Hellman problem ( q-SDH) assumption, the scheme is provably secure against existential forgery for adaptive chosen message and identity attack in the standard model.