Search

In the era of cloud computing, public key encryption with keyword search (PEKS) is an extremely useful cryptographic tool for searching on encryption data, whose strongest security notion is indistinguishability encryption against chosen ciphertext attack (ind-cca). Adballa et al. presented a transformation from identity based encryption (IBE) to PEKS in the Theory of Cryptography Conference 2010. This paper proposes a new framework of ind-cca secure PEKS in the standard model. Our main technical tool is a newly introduced notion of smooth projective hash function with key mapping, in which the hash key hk is mapped into another mapping projection key mhp besides the classical projection key hp. Finally, we provide an instantiation of our framework based on symmetric eXternal Diffie–Hellman assumption. [ABSTRACT FROM AUTHOR]

The objectives of this special issue are advanced security technologies and services for future computing environments, including, but not limited to, security primitives, protocols and security applications and services. Recent advances in security technologies and services for future computing environments have created a new class of the following: (i) Wireless sensor networks and radio-frequency identification security and privacy; (ii) security architectures for distributed network systems, P2P systems, cloud and grid systems; and (iii) security in e-commerce, mobile and wireless networks, and finally, security standards and assurance methods. All papers are expected to focus on novel approaches for advanced security technologies and services for future computing environments and to present high-quality results for tackling problems arising from the ever-growing advanced security technologies and services for future computing environments. [ABSTRACT FROM AUTHOR]

Lossy trapdoor functions (LTFs) have already found various applications in cryptography with many priorities. But constructing leakage resilient (LR) CCA secure PKE schemes through this way received less attention. Existing works could only be proven secure in a weakened model due to the power of leakage attack. To address this problem, we introduce a new variant of ABO-LTF which is called branch hidden ABO-LTF (BHABO-LTF) in this paper. This primitive provides protection for the information of evaluated branches rather than lossy branches, which means even an adversary knows the information of the set of lossy branches, it can still not determine whether the output is evaluated on an injective or a lossy branch as long as the inversion key is kept secret. We observe that if this primitive has Chameleon property, we could present a generic construction of CCA secure PKE schemes. Due to the transparency of lossy branches of the primitive, we find that our construction can naturally be extended to accommodate leakage resilience. We give a generic construction with a realization of LR-BHABO-LTFs under the decisional composite residuosity assumption. This construction can be proved secure in a well-accepted security model rather than existing LTF-based ones in weak key-leakage model. Besides, without the need to hide the information of lossy branches, a Chameleon BHABO-LTF can be constructed by additively homomorphic CPA secure PKE alone. So our work can also be viewed as an interesting progress to give a construction of CCA secure PKE from additively homomorphic CPA secure PKE with certain properties as well as their LR counterparts, which has been a longstanding problem. [ABSTRACT FROM AUTHOR]

Due to its great efficiency and quantum resistance, public key cryptography based on Ring-LWE problem has drawn much attention in recent years. A batch of cryptanalysis works provided ever-improved security estimations for various Ring-LWE schemes, but few works discussed the security of Ring-LWE cryptography from kleptographic aspect. In this paper, we show how to embed a backdoor into a classic Ring-LWE encryption scheme so that partial bits of the plaintext are leaked to the owner of the backdoor. By theoretical analysis and experimental observations, we argue that the klepto Ring-LWE encryption scheme with such backdoor is feasible and practical. [ABSTRACT FROM AUTHOR]

In the identity-based broadcast encryption (IBBE), only these users whose identities are chosen in the ciphertext computing can decrypt the encrypted message. In this paper, we introduce an extension of IBBE, namely Identity-Based Broadcast Encryption for Inner Product (IBBE-IP), where message encryption is replaced by inner product encryption (IPE) introduced by Abdalla et al. (PKC 2015). Precisely, in the IBBE-IP, the private key is associated with a pair of an identity and a vector (I D , y →). The user with private key of (I D , y →) can decrypt the encrypted vector x → for an identity set S selected by the encryptor and learn the inner product 〈 x → , y → 〉 if and only if I D ∈ S. Differing from the IBBE, the decryption in the IBBE-IP yields the inner product associated with the encrypted vector without leaking any information of the vector. The encrypted vector is protected as long as the number of selected identities is less than their length. We present a construction of IBBE-IP with constant-size private keys and it supports unbounded private key queries, which was unachieved in the previous works of IPE in the public-key setting. The security of our proposed scheme is proved in the random oracle model. [ABSTRACT FROM AUTHOR]

With the progress of cloud computing, many users hope in time to upload their data into cloud for sharing. For sensitive data, the owner must encrypt it before sending it to cloud server. The state of the art method for fine-grained access control on encrypted data is attribute-based encryption (ABE). Though ABE is believed to be an outstanding technique for secure data sharing, it has many efficiency drawbacks. For example, its ciphertext size and decryption time increase linearly with the number of attributes used during encryption and decryption, and it is hard to revoke a user’s access ability. In this paper, we propose a method to outsource the decryption of ABE via public cloud computing, and to control a user’s decryption capacity through a bounded revocation technique. The public cloud server can transform any user’s ABE ciphertexts into short ElGamal-type ciphertexts via the user’s public transformation key. The transformed ciphertexts are actually ElGamal-type identity-based ciphertexts obtained through a bounded-collision identity-based encryption scheme, and the decryption time only requires one exponentiation. Our scheme can revoke user’s decryption ability. But it limits to scenario with bounded number of revocation. [ABSTRACT FROM AUTHOR]

Certificateless signcryption (CLSC) has attracted much attention from the research community since it provides both confidentiality and unforgeability, and, at the same time, it does not suffer from the certificate management problem in traditional public key cryptography and the key escrow problem in identity-based cryptography. However, most CLSC schemes are based on the bilinear pairing which is still a time-costing operation although many efforts have been made to improve its efficiency. Recently, Yu et al. proposed a pairing-free CLSC scheme and proved its security. In this paper, we point out that their scheme can be totally broken since confidentiality and unforgeability actually are not captured. [ABSTRACT FROM AUTHOR]

Cryptographic systems refer to a set of algorithms needed to implement a particular form of encryption, decryption, signature and verification, which have practical applications in engineering area. Among cryptographic systems, Multivariate Public Key Cryptography (MPKC) is one of the most popular post-quantum candidates since it has the potential to resist quantum computer attacks. MPKC must be protected against a wide range of attacks, including side-channel attack, which is any attack based on information gained from the physical implementation of cryptographic systems. However, there are few side-channel attacks on MPKC schemes. In this paper, we present techniques to exploit Differential Power Analysis and fault analysis attacks for analyzing the effectiveness of side-channel attacks on MPKC schemes. We propose a general model of side-channel attacks on enhanced Tame Transformation Signature (enTTS) scheme, which is one of the representative MPKC schemes. We implement a naive enTTS scheme on Application Specific Integrated Circuits and propose a successful side-channel attack on the implementation. Experimental results show that our attack successfully obtains all the pieces from the private keys of the enTTS scheme and they clearly demonstrate the importance of protecting MPKC against side-channel attacks. [ABSTRACT FROM AUTHOR]

At present, 'mixed-type' multivariate schemes are relatively rare except the Dragon scheme and its variants (Little Dragon Two scheme and Poly-Dragon scheme). However, they are insecure. In this paper, we first define a particular polynomial called Three-color Polynomial (this polynomial has three-class variables, and the form of the associated symmetric matrix of its quadratic part is similar to the 'three-color model' in colorimetry. So we call it three-color polynomial), and its corresponding Three-color Map. Based on the three-color map, we then present a mixed multivariate signature scheme named RGB (it means Red–Green–Blue, because the central map of this scheme is a threecolor map, and the 'three-color' stands for RGB in colorimetry), which is a variant of the Unbalanced Oil–Vinegar (UOV) signature scheme. Compared with UOV, each polynomial of the central map of RGBhas more cross-terms among all the variables {Y, Z, T}. The variable Y has much to do with message values.To a certain degree, the variable Y stands for the message values. This means that the message values can be more fully mixed with other variable values in the central map, and the adversary is very difficult to forge the signature. Thus, in theory RGB is more secure than UOV. Through detailed analysis, we find thatRGBcan resist current known algebraic attacks under proper parameters, such as exhaustive search attack, separation attack, MinRank attack and direct attack (other algebraic attacks are inapplicable for RGB). Besides, our experiments show that under choosing the security level of 280, the signing time of Magma implementation of RGB is 0.046 s on an ordinary Linux-PC with 2.50 GHz, and the signing time of its C implementation is ∼0.003 s on an 800MHz machine. The comparisons show that the signing speed of RGB is faster than that of Sflashv2, Quartz, UOV, Rainbow and RSA-1024, and is slightly slower than that of ECDSA-163 and NTRUSign-251. Overall, this new scheme can attain very good performance in terms of security and efficiency. [ABSTRACT FROM AUTHOR]

With the purpose of taking physical attacks into account in security proofs, leakage-resilient cryptography has been initiated. Recently, many leakage-resilient cryptographic primitives have been proposed. In this paper, we put forward the first leakage-resilient wicked identity-based encryption (wicked IBE) scheme. To achieve this goal, we first present a new wicked IBE scheme in the composite order groups. The security proof of this scheme is achieved via the dual system encryption technique. In contrast with existing wicked IBE schemes, the new proposal can be proved fully secure in the standard model, even when the maximum hierarchy depth is a polynomial in the security parameter. Moreover, its security is based on some standard assumptions in the composite groups, which are independent of the hierarchy depth of the scheme. Based on this newly proposed scheme, we then put forward a fully secure leakage-resilient wicked IBE scheme in the bounded memory-leakage model. The leakage here is not only allowed on the user's secret key, but also on the master secret key. Its security is proved in the standard model by a hybrid argument in a sequence of computationally indistinguishable games. To the best of our knowledge, this is the first wicked IBE scheme in the context of leakage resilience. [ABSTRACT FROM AUTHOR]

In Cramer et al. (2007, Bounded CCA2-Secure Encryption. In Kurosawa, K. (ed.), Advances in Cryptology - ASIACRYPT 2007, Kuching, Malaysia, December 2-6, Lecture Notes in Computer Science, Vol. 4833, pp. 502-518. Springer, Berlin, Germany) proposed a public-key encryption scheme secure against adversaries with a bounded number of decryption queries based on the decisional Diffie-Hellman problem. In this paper, we show that the same result can be obtained based on weaker computational assumptions, namely: the computational Diffie-Hellman and the hashed Diffie-Hellman assumptions. [ABSTRACT FROM AUTHOR]

Signcryption schemes play a vital role to accomplish confidentiality, integrity, authentication and non-repudiation of messages simultaneously. In the literature, many certificateless signcryption (CLSC) schemes have been designed; however, most of them are vulnerable to ephemeral secret leakage (ESL) attack. In these schemes, sender uses an ephemeral secret to compute a ciphertext on a message. However, there is a possibility to compromise the ephemeral secret, since it is generally precomputed and stored in an insecure device. Furthermore, it is generated by an external source, which can be controlled by an adversary. Thus, from the knowledge of compromised ephemeral secret, an adversary may calculate the private key of the sender and the message from the eavesdropped ciphertext, and this problem is called ESL attack. In this paper, we proposed a leakage-free CLSC, which is secure against ESL attack in the random oracle model. The proposed scheme provides confidentiality under the Co-Bilinear Diffie-Hellman (Co-BDH) assumption and unforgeability based on Co-Computational Diffie-Hellman assumption. [ABSTRACT FROM AUTHOR]

It is essential that a multi-user cryptographic primitive be revocable since a legitimate user may quit the organization, or may act on malicious intent, or the relevant key may be leaked. In the group signature context, usually the group manager publishes the revocation list that contains revocation tokens. Since signers/verifiers need to obtain the revocation list in each revocation epoch to generate/verify a group signature, a small-size revocation list is really important in practice. However, all previous revocable group signatures require at least an O(r)-size revocation list, where r is the number of revoked users. In this paper, we propose the first revocable group signature scheme with a constant-size revocation list using identity-based revocation (IBR) techniques. We use an IBR scheme proposed by Attrapadung-Libert-Panafieu (PKC 2011) as a building block. As in the Libert-Peters-Yung schemes (EUROCRYPT 2012/CRYPTO 2012), no signing key update is required. In addition, the verification cost does not depend on the number of revoked users r. Although the maximum number of revoked users needs to be fixed in the setup phase, the maximum number of group members is potentially unbounded as in IBR. This property has not been achieved in the recent scalable revocable group signature schemes and seems to be of independent interest. [ABSTRACT FROM AUTHOR]

In this paper, we propose a new notion of public key encryption scheme with authorized equality test (PKE-AET), which allows authorized users those who have warrants to test the equivalence between two messages, where the messages are encrypted using different public keys. Comparing with the existing researches, our PKE-AET provides two kinds of warrants that are referred to as receiver's warrants and cipher-warrants. The proposed PKE-AET is able to deal with the following complicated scenario: Assume that a receiver authorizes a receiver's warrant to a tester, which makes the tester be able to perform equality test on all of receivers' ciphertext; on the other hand, if receiver authorizes a cipher-warrant corresponding to a specific ciphertext to the tester, then the tester only acquires the equality test on that particular ciphertext. The equality between two ciphertexts can be verified by the tester without decryption after he or she receives two warrants and varies their validations. Moreover, for security analysis, we define two types of adversaries and security notions for PKE-AET in the multi-user setting. Furthermore, we prove that our PKE-AET is one-way CCA secure against type-I adversaries and IND-CCA secure against type-II adversaries. Finally, the proposed scheme leads better efficiency than most of previous equality test schemes. [ABSTRACT FROM AUTHOR]

Probabilistic public key encryption with equality test (PKEET), introduced by Yang et al. in CTRSA 2010, is able to check whether two ciphertexts are encryptions of the same message under different public keys without leaking anything else about the message encrypted under either public key. PKEET schemes have many applications, for example, in constructing searchable encryption and partitioning encrypted data. Previous PKEET schemes lack a delegation mechanism for users to specify who can perform the equality test between their ciphertexts. In this paper, we propose the notion of public key encryption with delegated equality test (PKE-DET), which requires only the delegated party to deal with the work in a practical multi-user setting, and present a concrete construction in Type 2 pairing, which is provably secure under the newly introduced security notions. [ABSTRACT FROM AUTHOR]

In this paper, we introduce a general paradigm called identity-based extractable hash proof system (IB-EHPS), which is an extension of extractable hash proof system (EHPS) proposed by Wee (CRYPTO'10). We show how to construct identity-based key encapsulation mechanism (IB-KEM) from IB-EHPS in a simple and modular fashion. Our construction provides a generic method of building and interpreting CCA-secure IB-KEMs based on computational assumptions. As instantiations, we realize IB-EHPS from the bilinear Diffie–Hellman assumption and the modified bilinear Diffie–Hellman assumption, respectively. Besides, we carefully investigate the relation between EHPS and IB-EHPS, and indicate possible refinement and generalization of EHPS. [ABSTRACT FROM PUBLISHER]

Secrecy of decryption keys is an important pre-requisite for security of any encryption scheme and compromised private keys must be immediately replaced. Forward Security (FS), introduced to Public Key Encryption (PKE) by Canetti et al. (Eurocrypt 2003), reduces damage from compromised keys by guaranteeing confidentiality of messages that were encrypted prior to the compromise event. The FS property was also shown to be achievable in (Hierarchical) Identity-Based Encryption (HIBE) by Yao et al. (ACM CCS 2004). Yet, for emerging encryption techniques, offering flexible access control to encrypted data, by means of functional relationships between ciphertexts and decryption keys, FS protection was not known to exist. In this paper, we introduce FS to the powerful setting of Hierarchical Predicate Encryption (HPE), proposed by Okamoto and Takashima (Asiacrypt 2009). Anticipated applications of FS-HPE schemes can be found in searchable encryption and in fully private communication. Considering the dependencies among the concepts, our FS-HPE scheme implies forward-secure flavors of Predicate Encryption and (Hierarchical) Attribute-Based Encryption. Our FS-HPE scheme guarantees FS for plaintexts and for attributes that are hidden in HPE ciphertexts. It further allows delegation of decrypting abilities at any point in time, independent of FS time evolution. It realizes zero-inner-product predicates and is proved adaptively secure under standard assumptions. As the ‘cross-product’ approach taken in FS-HIBE is not directly applicable to the HPE setting, our construction resorts to techniques that are specific to existing HPE schemes and extends them with what can be seen as a reminiscent of binary tree encryption from FS-PKE. [ABSTRACT FROM AUTHOR]

Certificate-based encryption (CBE) and certificateless encryption (CLE) are proposed to lessen the certificate management problem in a traditional public-key encryption setting. Although they are two different notions, CBE and CLE are closely related and possess several common features. The encryption in CBE and CLE does not require authenticity verification of the recipient's public key. The decryption in both notions requires two secrets that are generated by the third party and the public key owner, respectively. Recently a generic conversion from CLE to CBE was given, but unfortunately its security proof is flawed. This paper provides an elaborate security model of CBE, based on which a provably secure generic construction of CBE from CLE is proposed. A concrete instantiation is also presented to demonstrate the application of our generic construction. [ABSTRACT FROM AUTHOR]

Recently, Gu et al. proposed an efficient identity-based proxy signature scheme and demonstrated their scheme was provably secure in the standard model. In this paper, we show their scheme is not secure against the malicious user through proposing three concrete attacks. [ABSTRACT FROM AUTHOR]

The Visual cryptography scheme (VCS) is a perfect secure method that encrypts a secret image by breaking it into shadow images. A distinctive property of VCS is that one can visually, without computation, decode the secret by superimposing shadow images. However, much of the contrast of the reconstructed image is lost. A different kind of VCS has been recently proposed by Viet and Kurosawa, called VCS with reversing, allowing participants to perform a reversing operation (reverse black and white) on shadow images. Two drawbacks of the Viet–Kurosawa VCS are: (1) one can only reconstruct an almost ideal contrast image but not an ideal contrast image and (2) the Viet–Kurosawa VCS is constructed just from a perfect black VCS. This paper shows a real perfect contrast VCS such that the black and white pixels are perfectly reconstructed within finite runs, no matter what VCS (perfect black or non-perfect black) is used. [ABSTRACT FROM AUTHOR]

Self-updatable encryption (SUE) is a new kind of public-key encryption, motivated by cloud computing, which enables anyone (i.e. cloud server with no access to private keys) to update a past ciphertext to a future ciphertext by using a public key. The main applications of SUE are revocable-storage attribute-based encryption (RS-ABE) that provides an efficient and secure access control to encrypted data stored in cloud storage. In this setting, there is a new threat such that a revoked user still can access past ciphertexts given to him by a storage server. RS-ABE solves this problem by combining user revocation and ciphertext updating functionalities. We propose the first SUE and RS-ABE schemes secure against a relevant form of chosen-ciphertext security (CCA). Due to the fact that some ciphertexts are easily derived from others, we employ a different notion of CCA that avoids easy challenge related messages. Specifically, we define "time extended challenge" CCA security for SUE which excludes ciphertexts that are easily derived from the challenge (over time periods) from being queried on. We then propose an efficient SUE scheme with such CCA security, and we also present an RS-ABE scheme with this CCA security. [ABSTRACT FROM AUTHOR]

In recent years, much attention has been focused on designing provably secure public-key encryption (PKE) scheme in the presence of key-leakage. However, most of them are researched in the bounded-leakage model, and cannot keep their claimed security in the continuous leakage setting. What's more, most of traditional leakage-resilient PKE schemes cannot ensure that all of elements in ciphertext are random from the adversary's view, and any polynomial time adversary can get leakage on the secret key from the corresponding ciphertext. But, in the real world, an adversary can trivially break the security of PKE scheme under the continuous leakage attacks. To get an efficient PKE scheme which can keep its original security in the continuous-leakage model, we propose a new construction of chosen-ciphertext attacks secure PKE scheme, and whose security is based on the hardness of the classical decisional Diffie-Hellman assumption and the target collision resistance of the hash function. Our method not only can tolerate continuous leakage attacks on the secret key through key update operation, but also enjoys better performances, such as the round leakage parameter λC ≤ log q - ω(log k) (k is the security parameter, q is a big prime order of the underlying group.) is independent of the plaintext space, and has the constant size, also, any polynomial time adversary unable to obtain leakage on the secret key from the corresponding ciphertext, etc. Because of these good performance features, our proposal may have some significant value in the practical applications. [ABSTRACT FROM AUTHOR]

As a new variant of digital signature, attribute-based signature (ABS) is appealing for many scenarios, where both authentication and anonymity are desired. However, in such a paradigm, a user's secret key is not linkable to an authenticated identity, and the same set of attributes might be shared among multiple users. Consequently, a malicious user would leak his secret key for some purposes without the risk of being identified among these equal users. On the other hand, for a cryptosystem with a large number of users, there should be an efficient revocation mechanism to further inform that a user's credential is abolished. We note that none of the existing ABS schemes simultaneously supports traceability and revocability, which are crucial towards the practicability of ABS. In this work, we first give a formal security model for traceable and revocable ABS. Next, we provide a concrete construction that admits flexible threshold signing predicates. Finally, we prove the anonymity and traceability of the proposed scheme in the standard model. To the best of our knowledge, our construction is the first ABS scheme that enjoys the functionalities of traceability and revocability simultaneously, and thus is more feasible for practical applications. [ABSTRACT FROM AUTHOR]

In mobile environments, data stored in nodes are subject to side-channel attacks such as power analysis, emitted signal, detected radiation, etc. In this work, we propose a leakage-resilient inner-product encryption that the decryption will succeed if and only if the decryption attribute vector (generate the token) meets the orthogonal encryption attribute vector (obfuscated encryption policy), that is, the match holds that the inner product of two vectors is zero. Propose scheme supports the security of attribute-hiding and leakage-resilient in the standard model. The adversary cannot only issue any token reveal query on non-match vector, but also can request at most ℓ-bit information on the token-leakage query even if the queried vector matches the challenge vector. We prove the security by the technique of dual system encryption in the orthogonal subgroups, to be strongly leakage-resilient and adaptively attribute-hiding. We also deploy our scheme as a building block to devise a secure twoparty point/polynomial evaluation protocol in mobility environments, in which two parties cooperate to evaluate a polynomial in the sense that their sensitive inputs of both point and polynomial are fully preserved. Finally, we assess the performance of leakage resilience including the leakage bound and the leakage fraction (LF). Analysis shows that the leakage bound is approximate (n − 1) log π2 and the LF is about 1/2(1 + ω1 + ω3), where n is the length of vector, π2 is the order of subgroupGπ2 and ω1, ω3 are the constants. We can obtain optimized LF 1/2 − o(1) by varying the sizes of subgroups. [ABSTRACT FROM AUTHOR]

We propose a generic construction that yields efficient identity-based encryption (IBE) schemes secure against chosen ciphertext attack (CCA) in the standard model. Our construction extends Kiltz et al.'s (Eurocrypt '09) method of constructing CCA-secure public-key encryption schemes via randomness extraction to the identity-based setting. The main idea of our construction is to transform 'ϵ1ϵ1-almost κκ-entropic' and valid/invalid ciphertext indistinguishable (VI-IND) identity-based hash proof system to the one that satisfies the stronger 'ϵ2ϵ2-universal' and VI-IND property. This transformation is realized by a randomness extractor based on the 4-wise hash function. We demonstrate that our generic construction can produce CCA-secure IBE schemes whose efficiency is comparable with the most efficient but non-generic CCA-secure IBE schemes without random oracles in the literature. [ABSTRACT FROM AUTHOR]

We propose enhancing a reconfigurable and extensible embedded reduced instruction set computer (RISC) processor core with a protected zone for isolated execution of cryptographic algorithms. The protected zone is a collection of processor subsystems such as functional units optimized for high-speed execution of integer operations, a small amount of local memory for storing sensitive data during cryptographic computations, and special-purpose and cryptographic registers to execute instructions securely. We outline the principles for secure software implementations of cryptographic algorithms in a processor equipped with the proposed protected zone.We demonstrate the efficiency and effectiveness of our proposed zone by implementing the most-commonly used cryptographic algorithms in the protected zone; namely RSA, elliptic curve cryptography, pairingbased cryptography, Advanced Encryption Standard (AES) block cipher, and secure hash algorithm (SHA)-1 and SHA-256 cryptographic hash functions. In terms of time efficiency, our software implementations of cryptographic algorithms running on the enhanced core compare favorably with equivalent software implementations on similar processors reported in the literature. The protected zone is designed in such a modular fashion that it can easily be integrated into any RISC processor. The proposed enhancements for the protected zone are realized on an field programmabel gate array (FPGA) device. The implementation results on the FPGA confirm that its area overhead is relatively moderate in the sense that it can be used in many embedded processors. Finally, the protected zone is useful against cold-boot and micro-architectural side-channel attacks such as cache-based and branch prediction attacks. [ABSTRACT FROM AUTHOR]

Certificateless public key encryption (CLE) and certificate-based encryption (CBE) are motivated to simultaneously solve the heavy certificate management problem inherent in the traditional public key encryption (PKE) and the key escrow problem inherent in the identity-based encryption (IBE). Al-Riyami and Paterson proposed a general conversion from CLE to CBE, which is neat and natural. Kang and Park pointed out a flaw in their security proof. Wu et al. proposed another generic conversion from CLE to CBE which additionally involves collision resistant hash functions. It remains an open problem whether the generic conversion due to Al-Riyami and Paterson is provably secure or not. We are motivated to solve this open problem. Our basic idea is to enhance Type II adversary's power a little by allowing it to conditionally replace a user's public key. We first formalize a new security model of CLE in this way. Then, we succeed in proving that the Al-Riyami-Paterson generic conversion from CLE to CBE is secure, if the CLE scheme is secure in our new security model. Finally, a concrete provably secure CBE scheme is presented to demonstrate the applicability of our result. [ABSTRACT FROM AUTHOR]

We revisit the concept of public key encryption with delegated search (PKEDS), a concept proposed by Ibraimi et al. A PKEDS scheme allows a receiver to authorize a third-party server to search in two ways: either according to a message chosen by the server itself or according to a trapdoor sent by the receiver. We first show some observations on the primitive formulation and the proposed PKEDS scheme by Ibraimi et al. and point out that the single-server setting may limit the application of this primitive. We then extend the concept to the multiple-server setting and present a new security model. We finally propose a new PKEDS scheme, which is proven secure, and compare it with that by Ibraimi et al. [ABSTRACT FROM AUTHOR]

Recent research shows that many public-key or identity-based encryption schemes are vulnerable to side-channel attacks on the keys by the interaction of an adversary with a physical device. To tolerate the possible key leakage, leakage-resilient cryptography models a class of leakage output by allowing the adversary to be able to specify a computable leakage function and obtaining the partial keys or other possibly internal states from the output of function. In this article, we propose a leakage-resilient hidden-vector encryption (HVE) scheme that supports the predicate operators such as conjunction, disjunction, comparison, range query and subset query, etc. The proposed scheme is leakage-resilient attribute-hiding secure in the sense that the adversary cannot only obtain the tokens of non-match vectors but also learn amount of key information of the vector that matches the challenge vector. To the best of our knowledge, this is the first HVE that supports token-leakage resilience. We prove the security with a series of computationally indistinguishable games that uses the dual system encryption mechanism. We also analyze and discuss the performance of leakage bound parameters and leakage fraction in the practical security level. Finally, we also give an extensive scheme to achieve the security of both attribute-hiding and payload-hiding, and analyze the performance in larger alphabets. [ABSTRACT FROM PUBLISHER]

We put forward a notion of forward security for stateful public-key encryption against state exposure and chosen ciphertext attack. This new notion is important in mobile applications in which small devices that perform ‘stateful encryptions’ are vulnerable to attacks which can result in the compromise of internal states. We precisely formulate a security definition and propose two efficient schemes which are provably secure under standard computational assumptions. [ABSTRACT FROM PUBLISHER]