Despite the large number of certificateless encryption schemes proposed recently, many of them have been found insecure under a practical attack, called malicious-but-passive KGC （Key Generation Center） attack. In t...Despite the large number of certificateless encryption schemes proposed recently, many of them have been found insecure under a practical attack, called malicious-but-passive KGC （Key Generation Center） attack. In this work we propose the first generic construction of certificateless encryption, which can be proven secure against malicious-but- passive KGC attacks in the standard model. In order to encrypt a message of any length, we consider the KEM/DEM （key encapsulation mechanism/data encapsulation mechanism） framework in the certificateless setting, and propose a generic construction of certificateless key encapsulation mechanism （CL-KEM） secure against malicious-but-passive KGC attacks in the standard model. It is based on an identity-based KEM, a public key encryption and a message authentication code. The high efficiency of our construction is due to the efficient implementations of these underlying building blocks, and is comparable to Bentahar et al.＇s CL-KEMs, which have only been proven secure under the random oracle model with no consideration of the malicious-but-passive KGC attack. We also introduce the notion of certificateless tag-based KEM （CL-TKEM）, which is an extension of Abe et al.＇s work to the certificateless setting. We show that an efficient CL-TKEM can be constructed by modifying our CL-KEM scheme. We also show that with a CL-TKEM and a data encapsulation mechanism secure under our proposed security model, an efficient certificateless hybrid encryption can be constructed by applying Abe et al.＇s transformation in the certificateless setting.展开更多
This paper proposes an adaptively secure solution to certificateless distributed key encapsulation mechanism from pairings by using Canetti＇s adaptive secure key generation scheme based on discrete logarithm. The pro...This paper proposes an adaptively secure solution to certificateless distributed key encapsulation mechanism from pairings by using Canetti＇s adaptive secure key generation scheme based on discrete logarithm. The proposed scheme can withstand adaptive attackers that can choose players for corruption at any time during the run of the protocol, and this kind of attack is powerful and realistic. In contrast, all previously presented threshold certificateless public key cryptosystems are proven secure against the more idealized static adversaries only. They choose and fix the subset of target players before running the protocol. We also prove security of this scheme in the random oracle model.展开更多
选择密文攻击下的不可区分(Indistinguishability against Chosen Ciphertext Attack,IND-CCA)安全的密钥封装机制可以由选择明文攻击下的不可区分(Indistinguishability against Chosen Plaintext Attack,IND-CPA)或者选择明文攻击下...选择密文攻击下的不可区分(Indistinguishability against Chosen Ciphertext Attack,IND-CCA)安全的密钥封装机制可以由选择明文攻击下的不可区分(Indistinguishability against Chosen Plaintext Attack,IND-CPA)或者选择明文攻击下的单向(One-Wayness against Chosen Plaintext Attack,OW-CPA)安全的公钥加密方案使用FO(Fujisaki-Okamoto)变换得到,并在随机预言机模型(Random Oracle Model,ROM)下是安全的。截止目前,并没有一个基于LPN(Learning Parity with Noise)问题的密钥封装机制能在标准模型下达到选择密文攻击(Chosen Ciphertext Attack,CCA)安全。以双陷门技术回答敌手的解封装询问,以抗第二原像哈希函数检测方案中密文的有效性,由此可得出首个基于LPN在标准模型下达到CCA安全的密钥封装机制的直接构造,其密钥通过特殊LPN问题构造,并不依赖随机预言机。通过一系列的游戏和相邻游戏间的安全规约,可证明该密钥封装机制在量子算法的攻击下是CCA安全的。展开更多
Ciphertext-policy attribute-based encryption(CP-ABE)is a promising cryptographic solution to the problem for enforcing fine-grained access control over encrypted data in the cloud.However,when applying CP-ABE to data ...Ciphertext-policy attribute-based encryption(CP-ABE)is a promising cryptographic solution to the problem for enforcing fine-grained access control over encrypted data in the cloud.However,when applying CP-ABE to data outsourcing scenarios,we have to address the challenging issue of policy updates because access control elements,such as users,attributes,and access rules may change frequently.In this paper,we propose a notion of access policy updatable ciphertext-policy attribute-based encryption(APU-CP-ABE)by combining the idea of ciphertext-policy attribute-based key encapsulation and symmetric proxy re-encryption.When an access policy update occurs,data owner is no longer required to download any data for re-encryption from the cloud,all he needs to do is generate a re-encryption key and produce a new encapsulated symmetric key,and then upload them to the cloud.The cloud server executes re-encryption without decryption.Because the re-encrypted ciphertext is encrypted under a completely new key,users cannot decrypt data even if they keep the old symmetric keys or parts of the previous ciphertext.We present an APU-CP-ABE construction based on Syalim et al.’s[Syalim,Nishide and Sakurai(2017)]improved symmetric proxy re-encryption scheme and Agrawal et al.’s[Agrawal and Chase(2017)]attribute-based message encryption scheme.It requires only 6 bilinear pairing operations for decryption,regardless of the number of attributes involved.This makes our construction particularly attractive when decryption is time-critical.展开更多
量子计算机的深入研究已经威胁到基于离散对数和大整数分解问题的传统公钥密码,美国国家标准与技术研究院(National Institute of Standards and Technology,NIST)于2017年开始了后量子密码算法征集,希望从全球提交的算法中评选出可以...量子计算机的深入研究已经威胁到基于离散对数和大整数分解问题的传统公钥密码,美国国家标准与技术研究院(National Institute of Standards and Technology,NIST)于2017年开始了后量子密码算法征集,希望从全球提交的算法中评选出可以代替传统公钥密码的后量子公钥密码标准。在征集的后量子密码算法中,基于格的密码算法占比最多,基于格的密码算法具有抵抗量子算法攻击、困难问题存在“最坏情形”到“平均情形”的安全归约、计算简单等优势,是后量子密码算法中最具应用前景的密码算法。目前为止,提交的基于格的密钥封装算法均需要去随机化、误差采样等操作。去随机化即将底层概率性加密算法,通过引入随机喻言机模型(Random Oracle Model,ROM),将加密算法转化为确定性算法,以实现量子随机喻言机模型下的安全归约。误差采样指模空间上的离散高斯采样,在基于格的公钥加密中,通常需要特殊的算法设计,以满足加密算法性能与安全性需求。去随机化和误差采样操作既降低了算法运行效率,又增加了遭受侧信道攻击的风险。本文基于格的单向陷门函数,设计并实现了高效密钥封装算法,算法避免了去随机化和误差采样等操作,从算法设计层面提升了方案的效率。首先,本文提出了针对密钥封装算法设计场景的格上单向陷门优化技术,显著减小了格陷门的长度;其次,基于优化的格上陷门单向函数,构造了高效的量子随机喻言机模型(Quantum Random Oracle Model,QROM)下选择密文攻击不可区分安全(Indistinguishability against Chosen Ciphertext,IND-CCA)的密钥封装方案;最后,对密钥封装方案进行了攻击分析和实用参数设置分析,并对方案进行了软件实现和性能分析。展开更多
文摘Despite the large number of certificateless encryption schemes proposed recently, many of them have been found insecure under a practical attack, called malicious-but-passive KGC （Key Generation Center） attack. In this work we propose the first generic construction of certificateless encryption, which can be proven secure against malicious-but- passive KGC attacks in the standard model. In order to encrypt a message of any length, we consider the KEM/DEM （key encapsulation mechanism/data encapsulation mechanism） framework in the certificateless setting, and propose a generic construction of certificateless key encapsulation mechanism （CL-KEM） secure against malicious-but-passive KGC attacks in the standard model. It is based on an identity-based KEM, a public key encryption and a message authentication code. The high efficiency of our construction is due to the efficient implementations of these underlying building blocks, and is comparable to Bentahar et al.＇s CL-KEMs, which have only been proven secure under the random oracle model with no consideration of the malicious-but-passive KGC attack. We also introduce the notion of certificateless tag-based KEM （CL-TKEM）, which is an extension of Abe et al.＇s work to the certificateless setting. We show that an efficient CL-TKEM can be constructed by modifying our CL-KEM scheme. We also show that with a CL-TKEM and a data encapsulation mechanism secure under our proposed security model, an efficient certificateless hybrid encryption can be constructed by applying Abe et al.＇s transformation in the certificateless setting.
基金the National Basic Research Program(973)of China(No.2007CB311201)the National High Technology Research and Development Program(863) of China(Nos.2006AA01Z422,2007AA01Z456)
文摘This paper proposes an adaptively secure solution to certificateless distributed key encapsulation mechanism from pairings by using Canetti＇s adaptive secure key generation scheme based on discrete logarithm. The proposed scheme can withstand adaptive attackers that can choose players for corruption at any time during the run of the protocol, and this kind of attack is powerful and realistic. In contrast, all previously presented threshold certificateless public key cryptosystems are proven secure against the more idealized static adversaries only. They choose and fix the subset of target players before running the protocol. We also prove security of this scheme in the random oracle model.
文摘选择密文攻击下的不可区分(Indistinguishability against Chosen Ciphertext Attack,IND-CCA)安全的密钥封装机制可以由选择明文攻击下的不可区分(Indistinguishability against Chosen Plaintext Attack,IND-CPA)或者选择明文攻击下的单向(One-Wayness against Chosen Plaintext Attack,OW-CPA)安全的公钥加密方案使用FO(Fujisaki-Okamoto)变换得到,并在随机预言机模型(Random Oracle Model,ROM)下是安全的。截止目前,并没有一个基于LPN(Learning Parity with Noise)问题的密钥封装机制能在标准模型下达到选择密文攻击(Chosen Ciphertext Attack,CCA)安全。以双陷门技术回答敌手的解封装询问,以抗第二原像哈希函数检测方案中密文的有效性,由此可得出首个基于LPN在标准模型下达到CCA安全的密钥封装机制的直接构造,其密钥通过特殊LPN问题构造,并不依赖随机预言机。通过一系列的游戏和相邻游戏间的安全规约,可证明该密钥封装机制在量子算法的攻击下是CCA安全的。
基金This research is funded by Science and Technology Program of Guangzhou(Grant No.201707010358).
文摘Ciphertext-policy attribute-based encryption(CP-ABE)is a promising cryptographic solution to the problem for enforcing fine-grained access control over encrypted data in the cloud.However,when applying CP-ABE to data outsourcing scenarios,we have to address the challenging issue of policy updates because access control elements,such as users,attributes,and access rules may change frequently.In this paper,we propose a notion of access policy updatable ciphertext-policy attribute-based encryption(APU-CP-ABE)by combining the idea of ciphertext-policy attribute-based key encapsulation and symmetric proxy re-encryption.When an access policy update occurs,data owner is no longer required to download any data for re-encryption from the cloud,all he needs to do is generate a re-encryption key and produce a new encapsulated symmetric key,and then upload them to the cloud.The cloud server executes re-encryption without decryption.Because the re-encrypted ciphertext is encrypted under a completely new key,users cannot decrypt data even if they keep the old symmetric keys or parts of the previous ciphertext.We present an APU-CP-ABE construction based on Syalim et al.’s[Syalim,Nishide and Sakurai(2017)]improved symmetric proxy re-encryption scheme and Agrawal et al.’s[Agrawal and Chase(2017)]attribute-based message encryption scheme.It requires only 6 bilinear pairing operations for decryption,regardless of the number of attributes involved.This makes our construction particularly attractive when decryption is time-critical.
文摘量子计算机的深入研究已经威胁到基于离散对数和大整数分解问题的传统公钥密码,美国国家标准与技术研究院(National Institute of Standards and Technology,NIST)于2017年开始了后量子密码算法征集,希望从全球提交的算法中评选出可以代替传统公钥密码的后量子公钥密码标准。在征集的后量子密码算法中,基于格的密码算法占比最多,基于格的密码算法具有抵抗量子算法攻击、困难问题存在“最坏情形”到“平均情形”的安全归约、计算简单等优势,是后量子密码算法中最具应用前景的密码算法。目前为止,提交的基于格的密钥封装算法均需要去随机化、误差采样等操作。去随机化即将底层概率性加密算法,通过引入随机喻言机模型(Random Oracle Model,ROM),将加密算法转化为确定性算法,以实现量子随机喻言机模型下的安全归约。误差采样指模空间上的离散高斯采样,在基于格的公钥加密中,通常需要特殊的算法设计,以满足加密算法性能与安全性需求。去随机化和误差采样操作既降低了算法运行效率,又增加了遭受侧信道攻击的风险。本文基于格的单向陷门函数,设计并实现了高效密钥封装算法,算法避免了去随机化和误差采样等操作,从算法设计层面提升了方案的效率。首先,本文提出了针对密钥封装算法设计场景的格上单向陷门优化技术,显著减小了格陷门的长度;其次,基于优化的格上陷门单向函数,构造了高效的量子随机喻言机模型(Quantum Random Oracle Model,QROM)下选择密文攻击不可区分安全(Indistinguishability against Chosen Ciphertext,IND-CCA)的密钥封装方案;最后,对密钥封装方案进行了攻击分析和实用参数设置分析,并对方案进行了软件实现和性能分析。
