Search

In order to protect user data while maintaining application functionality, encrypted databases can use specialized cryptography such as property-revealing encryption, which allows a property of the underlying plaintext values to be computed from the ciphertext. One example is deterministic encryption which ensures that the same plaintext encrypted under the same key will produce the same ciphertext. This technology enables clients to make queries on sensitive data hosted in a cloud server and has considerable potential to protect data. However, the security implications of deterministic encryption are not well understood.We provide a leakage analysis of deterministic encryption through the application of the framework of quantitative information flow. A key insight from this framework is that there is no single "right'' measure by which leakage can be quantified: information flow depends on the operational scenario and different operational scenarios require different leakage measures. We evaluate leakage under three operational scenarios, modeled using three different gain functions, under a variety of prior distributions in order to bring clarity to this problem.

Comparable Encryption proposed by Furukawa (ESORICS 2013, CANS 2014) is a variant of order-preserving encryption (OPE) and order-revealing encryption (ORE); we cannot compare a ciphertext of v and another ciphertext of v', but we can compare a ciphertext of v and a token of b and compare a token of $b$ and another token of b'. Comparable encryption allows us to implement range and point queries while keeping the order of v's as secret as possible. Recently, Karras, Malhotra, Bhatt, Nikitin, Antyukhov, and Idreos independently re-define comparable encryption and propose two schemes, a basic one and an "ambiguous" one, based on linear algebra~(SIGMOD 2016). The basic scheme is just comparable encryption. To hide the order revealed by tokens, they also proposed an ambiguous scheme where each ciphertext has two interpretations v and vdummy. In the context of an indexed database, this means that every encryption has two places in the database corresponding to the two interpretations, masking the correct placement in the database unless the dummy value is detectable. They assessed that their basic scheme (and ambiguous scheme upon the basic scheme) is secure against known-plaintext attacks; the adversary will require O(l) plaintext-ciphertext pairs to recover secret key, where l is a security parameter. This paper cryptanalyzes their comparable encryption schemes by using simple linear algebra. We show that a few tokens and a few plaintext-ciphertext pairs instead of O(l) pairs allow us to mount several attacks efficiently. Our attacks are summarized as follows: Attacks against the basic scheme: -A ciphertext-only attack using two tokens orders the ciphertexts correctly. -A known-plaintext attack using two tokens and two plaintexts reveals exact value of v. Attacks against the ambiguous scheme: -A ciphertext-only attack using two tokens orders the ciphertexts with a constant probability. -A known-plaintext attack using three tokens and three plaintexts reveals exact value of v.

Some lattice-based public key cryptosystems allow one to transform ciphertext from one lattice or ring representation to another efficiently and without knowledge of public and private keys. In this work we explore this lattice transformation property from cryptographic engineering viewpoint. We apply ciphertext transformation to compress Ring-LWE ciphertexts and to enable efficient decryption on an ultra-lightweight implementation targets such as Internet of Things, Smart Cards, and RFID applications. Significantly, this can be done without modifying the original encryption procedure or its security parameters. Such flexibility is unique to lattice-based cryptography and may find additional, unique real-life applications.Ciphertext compression can significantly increase the probability of decryption errors. We show that the frequency of such errors can be analyzed, measured and used to derive precise failure bounds for n-bit error correction. We introduce XECC, a fast multi-error correcting code that allows constant time implementation in software.We use these tools to construct and explore TRUNC8, a concrete Ring-LWE encryption and authentication system. We analyze its implementation, security, and performance. We show that our lattice compression technique reduces ciphertext size by more than 40% at equivalent security level, while also enabling public key cryptography on previously unreachable ultra-lightweight platforms.The experimental public key encryption and authentication system has been implemented on an 8-bit AVR target, where it easily outperforms elliptic curve and RSA-based proposals at similar security level. Similar results have been obtained with a Cortex M0 implementation. The new decryption code requires only a fraction of the software footprint of previous Ring-LWE implementations with the same encryption parameters, and is well suited for hardware implementation.

In ciphertext policy attribute-based encryption scheme, access policies are associated with ciphertext and tied to it. It is necessary to hide the access policy in the most sensitive spots such as political, medical and economic fields, that is, receiver's anonymity. In this paper, we propose an efficient CP-ABE construction with hidden policy and prove it to be fully secure under static assumptions applying the dual system encryption methodology. Access structures in our construction are AND gates on positive, negative and wildcard attributes and the ciphertext size is short, which is only concerned with the number of wildcards.

In the emerging Internet of Things, lightweight public-key cryptography is an essential component for many cost-efficient security solutions. Since conventional public-key schemes, such as ECC and RSA, remain expensive and energy hungry even after aggressive optimization, this work investigates a possible alternative. In particular, we show the practical potential of replacing the Gaussian noise distribution in the Ring-LWE based encryption scheme by Lindner and Peikert/Lyubashevsky et al. with a binary distribution. When parameters are carefully chosen, our construction is resistant against any state-of-the-art cryptanalytic techniques (e.g., attacks on original Ring-LWE or NTRU) and suitable for low-cost scenarios. In the end, our scheme can enable public-key encryption even on very small and low-cost 8-bit (ATXmega128) and 32-bit (Cortex-M0) microcontrollers.

In this paper, we propose the first identity-based broadcast encryption scheme, which can simultaneously achieves confidentiality and full anonymity against adaptive chosen-ciphertext attacks under a standard assumption. In addition, two further desirable features are also provided: one is fully-collusion resistant which means that even if all users outside of receivers S collude they cannot obtain any information about the plaintext. The other one is stateless which means that the users in the system do not need to update their private keys when the other users join or leave our system. In particular, our scheme is highly efficient, where the public parameters size, the private key size and the decryption cost are all constant and independent to the number of receivers.

Non-malleability is an important and intensively studied security notion for many cryptographic primitives. In the context of public key encryption, this notion means it is infeasible for an adversary to transform an encryption of some message m into one of a related message m' under the given public key. Although it has provided a strong security property for many applications, it still does not suffice for some scenarios like the system where the users could issue keys on-the-fly. In such settings, the adversary may have the power to transform the given public key and the ciphertext. To withstand such attacks, Fischlin introduced a stronger notion, known as complete non-malleability, which requires that the non-malleability property be preserved even for the adversaries attempting to produce a ciphertext of some related message under the transformed public key. To date, many schemes satisfying this stronger security have been proposed, but they are either inefficient or proved secure in the random oracle model. In this work, we put forward a new encryption scheme in the common reference string model. Based on the standard DBDH assumption, the proposed scheme is proved completely non-malleable secure against adaptive chosen ciphertext attacks in the standard model. In our scheme, the well-formed public keys and ciphertexts could be publicly recognized without drawing support from unwieldy techniques like non-interactive zero knowledge proofs or one-time signatures, thus achieving a better performance.

For secure and reliable data transmission over the network from unauthorized users in a Communication system, there are various type of cryptographic algorithm has been introduced but RSA is the most famous cryptographic algorithm in these entire cryptographic algorithm. It involves the encryption decryption key generation. In this paper we provide a modify RSA algorithm based on the n prime no. and bit stuffing. Security of RSA is mainly depends on factorization. In this technique we use n prime no. because large prime numbers are not easily factorized and bit stuffing provide extra layer of encryption by which we provide maximum security and efficiency for data over the network.

Many encrypted database (EDB) systems have been proposed in the last few years as cloud computing has grown in popularity and data breaches have increased. The state-of-the-art EDB systems for relational databases can handle SQL queries over encrypted data and are competitive with commercial database systems. These systems, most of which are based on the design of CryptDB (SOSP 2011), achieve these properties by making use of property-preserving encryption schemes such as deterministic (DTE) and order- preserving encryption (OPE). In this paper, we study the concrete security provided by such systems. We present a series of attacks that recover the plaintext from DTE- and OPE-encrypted database columns using only the encrypted column and publicly-available auxiliary information. We consider well-known attacks, including frequency analysis and sorting, as well as new attacks based on combinatorial optimization. We evaluate these attacks empirically in an electronic medical records (EMR) scenario using real patient data from 200 U.S. hospitals. When the encrypted database is operating in a steady-state where enough encryption layers have been peeled to permit the application to run its queries, our experimental results show that an alarming amount of sensitive information can be recovered. In particular, our attacks correctly recovered certain OPE-encrypted attributes (e.g., age and disease severity) for more than 80% of the patient records from 95% of the hospitals; and certain DTE- encrypted attributes (e.g., sex, race, and mortality risk) for more than 60% of the patient records from more than 60% of the hospitals.

In this paper, we will consider a two party computation model in which the client wishes to make a query to the server, but doesn't want to reveal his query to anyone. Existing solutions are based on Oblivious Transfer, k - Anonymous Oblivious Transfer and Deterministic Encryption and Bloom Filers. Here, we propose two protocols first being the k*l -- Anonymous Oblivious Transfer protocol and second, the combination of Symmetric Key Encryption (Block Cipher) and k*l -- Anonymous Oblivious Transfer protocol which we will apply to approach the anonymous query problem where the server cannot tell which record the querying client wants from the records and neither the client could receive anything but the record pertaining to his query. Our protocol can achieve anonymity theoretically and is practical in situations where privacy is given more priority than speed.

A considerable amount of research has been carried out in harvesting the benefit of chaos theory in image encryption. However, there are not many schema that effectively maximize the advantages of Lorenz system. In this paper, we present one such image encryption algorithm that utilizes the Lorenz system for pixel manipulations. The schema employs a unique diffusion technique using Knight's tour and ensures a secure encryption with high key sensitivity. Various security checks such as histogram analysis, information entropy analysis and correlation analysis were carried out on the encrypted image. Simulation results prove that the algorithm gives excellent encryption parameters like information entropy and correlation coefficients along with the encrypted image being secure against commonly known attacks. The paper also compares the algorithm with other similar encryption methods.

We propose the notion of disavowable public key encryption with non-interactive opening (disavowable PKENO) where, for a ciphertext and a message, the receiver of the ciphertext can issue a proof that the plaintext of the ciphertext is NOT the message, and give a fairly practical construction.

In this paper, we present a new inner product proxy re-encryption scheme. The scheme can easily be converted into a threshold attribute-based proxy re-encryption scheme, and can be used to provide fine-grained access control in cloud storage systems. Our scheme is very efficient, requiring a linear number of exponentiations and a constant number of pairing computations for encryption and decryption. The length of the ciphertext is also independent of the length of the vector. The scheme is proven adaptively secure under standard assumptions in groups of composite orders.

Searchable (symmetric) encryption allows encryption while still enabling search for keywords. Its immediate application is cloud storage where a client outsources its files while the (cloud) service provider should search and selectively retrieve those. Searchable encryption is an active area of research and a number of schemes with different efficiency and security characteristics have been proposed in the literature. Any scheme for practical adoption should be efficient -- i.e. have sub-linear search time --, dynamic -- i.e. allow updates -- and semantically secure to the most possible extent. Unfortunately, efficient, dynamic searchable encryption schemes suffer from various drawbacks. Either they deteriorate from semantic security to the security of deterministic encryption under updates, they require to store information on the client and for deleted files and keywords or they have very large index sizes. All of this is a problem, since we can expect the majority of data to be later added or changed. Since these schemes are also less efficient than deterministic encryption, they are currently an unfavorable choice for encryption in the cloud. In this paper we present the first searchable encryption scheme whose updates leak no more information than the access pattern, that still has asymptotically optimal search time, linear, very small and asymptotically optimal index size and can be implemented without storage on the client (except the key). Our construction is based on the novel idea of learning the index for efficient access from the access pattern itself. Furthermore, we implement our system and show that it is highly efficient for cloud storage.

We propose an efficient additive homomorphic encryption scheme. In our scheme, an encryption of a message is simply its noisy modular reduction by several different moduli. The security of our scheme relies on the hardness of a new problem, the co-Approximate Common Divisor problem. We analyze its hardness by applying all known attacks and devising dedicated attacks. These analyses are not complete, but give sufficiently plausible evidence for the hardness of this new problem. Our scheme has an advantage in the performance since both of encryption and decryption consist of only several modular multiplications where a modulus is a hard-to-factor integer N or its prime factor, whereas the previous require more expensive modular exponentiations. In fact, our rudimentary implementation demonstrates that our public-key encryption scheme requires about 0.72ms, 4.00μs and 0.40μs for encryption, decryption and an addition of ciphertexts, respectively. It also takes about 40μs to compute an encryption of the mean of 1000 integers of 128-bit from their ciphertexts. To the best of our knowledge, our encryption scheme is the most efficient of those that support an additive homomorphic property. As an application of additive homomorphic encryption, we present how to efficiently evaluate a symmetric polynomial by additionally providing ciphertexts of some powers of messages. We also present a threshold version of our encryption scheme for smooth adoption of our scheme to advanced applications such as private set operations.

We introduce a new encryption notion called Euclidean Distance based Encryption (EDE). In this notion, a ciphertext encrypted with a vector and a threshold value can be decrypted with a private key of another vector, if and only if the Euclidean distance between these two vectors is less than or equal to the threshold value. Euclidean distance is the underlying technique in the pattern recognition and image processing community for image recognition. The primary application of this encryption notion is to enable an identity-based encryption that incorporates biometric identifiers, such as fingerprint, face, hand geometry, vein and iris. In that application, usually the input biometric will not be exactly the same during the enrollment and encryption phases. In this poster, we propose this new encryption notion and study its construction. We show how to generically and efficiently construct an EDE from an inner-product encryption (IPE) with reasonable size of private keys and ciphertexts. We also propose a new IPE scheme that is equipped with a specific characteristic to build EDE, namely the need for short private key. Our IPE scheme achieves the shortest private key compared to existing IPE schemes in the literature, where our private key is composed of two group elements only.

Order-preserving encryption enables performing many classes of queries -- including range queries -- on encrypted databases. Popa et al. recently presented an ideal-secure order-preserving encryption (or encoding) scheme, but their cost of insertions (encryption) is very high. In this paper we present an also ideal-secure, but significantly more efficient order-preserving encryption scheme. Our scheme is inspired by Reed's referenced work on the average height of random binary search trees. We show that our scheme improves the average communication complexity from O(n log n) to O(n) under uniform distribution. Our scheme also integrates efficiently with adjustable encryption as used in CryptDB. In our experiments for database inserts we achieve a performance increase of up to 81% in LANs and 95% in WANs.

Motivated by privacy and usability requirements in various scenarios where existing cryptographic tools (like secure multi-party computation and functional encryption) are not adequate, we introduce a new cryptographic tool called Controlled Functional Encryption (C-FE). As in functional encryption, C-FE allows a user (client) to learn only certain functions of encrypted data, using keys obtained from an authority. However, we allow (and require) the client to send a fresh key request to the authority every time it wants to evaluate a function on a ciphertext. We obtain efficient solutions by carefully combining CCA2 secure public-key encryption (or rerandomizable RCCA secure public-key encryption, depending on the nature of security desired) with Yao's garbled circuit. Our main contributions in this work include developing and for- mally defining the notion of C-FE; designing theoretical and practical constructions of C-FE schemes achieving these definitions for specific and general classes of functions; and evaluating the performance of our constructions on various application scenarios.

A variant of public key encryption that promises efficiency gains due to batch processing is multi-recipient public key encryption (MR-PKE). Precisely, in MR-PKE, a dedicated encryption routine takes a vector of messages and a vector of public keys and outputs a vector of ciphertexts, where the latter can be decrypted individually, as in regular PKE. In this paper we revisit the established security notions of MR-PKE and the related primitive MR-KEM. We identify a subtle flaw in a security model by Bellare, Boldyreva, and Staddon, that also appears in later publications by different authors. We further observe that these security models rely on the knowledge-of-secret-key (KOSK) assumption---a requirement that is rarely met in practice. We resolve this situation by proposing strengthened security notions for MR-PKE and MR-KEMs, together with correspondingly secure yet highly efficient schemes. Importantly, our models abstain from restricting the set of considered adversaries in the way prior models did, and in particular do not require the KOSK setting. We prove our constructions secure assuming hardness of the static Diffie-Hellman problem, in the random oracle model.

The field of image processing in the encrypted domain has been given increasing attention for the extensive potential applications, for example, providing efficient and secure solutions for privacy-preserving applications in untrusted environment. One obstacle to the widespread use of these techniques is the ciphertext expansion of high orders of magnitude caused by the existing homomorphic encryptions. In this paper, we provide a way to tackle this issue for image processing in the encrypted domain. By using characteristics of image format, we develop an image encryption scheme to limit ciphertext expansion while preserving the homomorphic property. The proposed encryption scheme first encrypts image pixels with an existing probabilistic homomorphic cryptosystem, and then compresses the whole encrypted image in order to save storage space. Our scheme has a much smaller ciphertext expansion factor compared with the element-wise encryption scheme, while preserving the homomorphic property. It is not necessary to require additional interactive protocols when applying secure signal processing tools to the compressed encrypted image. We present a fast algorithm for the encryption and the compression of the proposed image encryption scheme, which speeds up the computation and makes our scheme much more efficient. The analysis on the security, ciphertext expansion ratio, and computational complexity are also conducted. Our experiments demonstrate the validity of the proposed algorithms. The proposed scheme is suitable to be employed as an image encryption method for the applications in secure image processing.

Different from the traditional public key encryption, searchable public key encryption allows a data owner to encrypt his data under a user's public key in such a way that the user can generate search token keys using her secret key and then query an encryption storage server. On receiving such a search token key, the server filters all or related stored encryptions and returns matched ones as response.Searchable pubic key encryption has many promising applications. Unfortunately, existing schemes either only support simple query predicates, such as equality queries and conjunctive queries, or have a superpolynomial blowup in ciphertext size and search token key size.In this paper, based on the key-policy attribute-based encryption scheme proposed by Lewko et al. recently, we present a new construction of searchable public key encryption. Compared to previous works in this field, our construction is much more expressive and efficient and is proven secure in the standard model.

In a recent paper at Asiacrypt'2012, Jain et al point out that Veron code-based identification scheme is not perfect zero-knowledge. In particular, this creates a gap in security arguments of proof of plaintext knowledge (PPK) and verifiable encryption for the McEliece public key encryption (PKE) proposed by Morozov and Takagi at ACISP'2012. We fix the latter result by showing that PPK for the code-based Niederreiter and McEliece PKE's can be constructed using Stern zero-knowledge identification scheme, which is unaffected by the above mentioned problem. Since code-based verifiable encryption uses PPK as a main ingredient, our proposal presents a fix for the McEliece verifiable encryption as well. In addition, we present the Niederreiter verifiable encryption.

There has been much recent progress in constructing cryptosystems that maintain their security without requiring uniform randomness and perfect secrecy. These schemes are motivated by a diverse set of problems such as providing resilience to side-channel leakage, using weak physical sources of randomness as secret keys, and allowing deterministic encryption for high-entropy messages. Nevertheless, despite this progress, some basic and seemingly achievable security properties have eluded our reach. For example, we are unable to prove the security of basic tools for manipulating weak/leaky random sources, such as as pseudo-entropy generators and seed-dependent computational condensers. We also do not know how to prove leakage-resilient security of any cryptosystem with a uniquely determined secret key. In the context of deterministic encryption we do not have a standard-model constructions achieving the strongest notion of security proposed by Bellare, Boldyreva and O'Neill (CRYPTO '07), that would allow us to encrypt arbitrarily correlated messages of sufficiently large individual entropy.We provide broad black-box separation results, showing that the security of such primitives cannot be proven under virtually any standard cryptographic hardness assumption via a reduction that treats the adversary as a black box. We do so by formalizing the intuition that "the only way that a reduction can simulate the correctly distributed view for an attacker is to know all the secrets, in which case it does not learn anything useful from the attack". Such claims are often misleading and clever way of getting around them allow us to achieve a wealth of positive results with imperfect/leaky randomness. However, in this work we show that this intuition can be formalized and that it indeed presents a real barrier for the examples given above.

Several Chaotic Image Encryption algorithms have been proposed recently due to increase in the need of secure image/multimedia transmissions over public network. Even though chaotic image encryption algorithms perform better compared to normal cryptographic encryption techniques but still most of the algorithms require considerable amount of time which would increase the overall processing time. In this research we concentrated to achieve speed-up of chaotic encryption algorithm. We have shown a CUDA-based implementation of chaotic image encryption algorithm using logistic map with NVIDIA's Tesla C2050 GPU device. Compared to original implementation on CPU, CUDA based implementation works has shown significant amount of improvement in terms of operational speed up.

Sahai and Waters [6] proposed Attribute-Based Encryption (ABE) as a new paradigm of encryption algorithms that allow the sender to set a policy describing who can decrypt a particular ciphertext. In this paper, we first propose a ciphertext policy attribute-based encryption (CP-ABE) scheme from lattices, which supports flexible threshold access policies on literal (or boolean) attributes. Then we extend it to support multi-valued attributes without increasing the public key and ciphertext size. Our scheme's master secret key has only one matrix despite of the number of the system's attributes. The security of our schemes is based on the worst-case hardness on lattices.

We propose a new and efficient scheme for broadcast encryption. A broadcast encryption system allows a broadcaster to send an encrypted message to a dynamically chosen subset RS, |RS|=n of a given set of users, such that only users in this subset can decrypt the message. An important component of broadcast encryption schemes is revocation of users by the broadcaster, thereby updating the subset RS. Revocation may be either temporary, for a specific ciphertext, or permanent. We present the first public key broadcast encryption scheme that support permanent revocation of users. Our scheme is fully collusion resistant. In other words, even if all the users in the network collude with a revoked user, the revoked user cannot encrypt messages without receiving new keys from the broadcaster. The procedure is based on Cipher-text Policy Attribute-Based Encryption (CP-ABE).The overhead of our system is O(log n) in all major performance measures including length of private and public keys, computational complexity, user's storage space, and computational complexity of encryption and decryption.

An identity-based online/offline encryption (IBOOE) scheme splits the encryption process into two phases. The first phase performs most of the heavy computations, such as modular exponentiation or pairing over points on elliptic curve. The knowledge of the plaintext or the receiver's identity is not required until the second phase, where the ciphertext is produced by only light computations, such as integer addition/multiplication or hashing. This division of computations makes encryption affordable by devices with limited computation power since the preparation works can be executed "offline" or possibly by some powerful devices. The identity-based (ID-based) nature of the scheme also allows the preparation of ciphertext without certificate verification.Since efficiency is the main concern, less burden in the computation requirements of all phases (i.e., both phases of encryption and the decryption phase) and smaller ciphertext size are desirable. In this paper, we propose new schemes with improved efficiency over previous schemes by assuming random oracles. Our first construction is a very efficient scheme secure against chosen-plaintext attack (CPA), which is just slightly modified from an existing scheme. We then proceed to propose a new notion called ID-based Online/Offline KEM (IBOOKEM) that allows the key encapsulation process to be split into offline and online stages, in the same way as IBOOE does. We also present a generic transformation to get security against chosen-ciphertext attack (CCA) for IBOOE from any IBOOKEM scheme with one-wayness only. Our schemes (both CPA and CCA) are the most efficient one in the state-of-the-art, in terms of online computation and ciphertext size, which are the two main focuses of online/offline schemes. Our schemes are very suitable to be deployed on embedded devices such as smartcard or wireless sensor which have very limited computation powers and the communication bandwidth is very expensive.

In order to construct a CCA-secure (i.e. secure against chosen ciphertext attack) public key encryption scheme using the usual KEM/DEM (Key Encapsulation Mechanism/Data Encapsulation Mechanism) framework, one needs KEM and DEM schemes, both of which are CCA-secure. A CCA-secure DEM scheme can be constructed in a various way, but in order to construct a hybrid scheme producing ciphertexts of compact size, the DEM scheme needs to be a length-preserving symmetric cipher. However, it has been pointed out in the recent literature that the length-preserving symmetric cipher is in fact fairly expensive to realize because one needs strong PRP (pseudo random permutation) which is complex. As alternatives to the KEM/DEM framework for constructing compact hybrid encryption have been introduced in the public key (non identity-based) setting. In this paper, as contributions to this line of research, we construct hybrid identity-based encryption schemes which produce compact ciphertexts while providing both efficiency and strong security without resorting to the strong length-preserving symmetric cipher. In particular, all of the proposed schemes incur only one group element ciphertext expansion (defined as the size of the ciphertext minus the size of the plaintext message) and do not depend on the strong PRP. We provide security analysis of our schemes against chosen ciphertext attack under the well-known computational assumptions, in the random oracle model. We believe that our schemes are suitable for implementing on small devices.

In this work, we put forward the notion of Worry-Free Encryption. This allows Alice to encrypt confidential information under Bob's public key and send it to him, without having to worry about whether Bob has the authority to actually access this information. This is done by encrypting the message under a hidden access policy that only allows Bob to decrypt if his credentials satisfy the policy. Our notion can be seen as a functional encryption scheme but in a public-key setting. As such, we are able to insist that even if the credential authority is corrupted, it should not be able to compromise the security of any honest user.We put forward the notion of Worry-Free Encryption and show how to achieve it for any polynomial-time computable policy, under only the assumption that IND-CPA public-key encryption schemes exist. Furthermore, we construct CCA-secure Worry-Free Encryption, efficiently in the random oracle model, and generally (but inefficiently) using simulation-sound non-interactive zero-knowledge proofs.

Existing CP-ABE schemes incur very large ciphertext size, which increases linearly with respect to the number of attributes in the access policy. Large ciphertext prevents CP-ABE from being adopted in the communication constrained environments. In this paper, we proposed a new construction of CP-ABE, named Constant-size CP-ABE (denoted as CCP-ABE) that significantly reduces the ciphertext to a constant size for an AND gate access policy with any given number of attributes. Each ciphertext in CCP-ABE requires only elements on a bilinear group.Based on CCP-ABE, we further proposed an Attribute Based Broadcast Encryption (ABBE) scheme. Compared to existing Broadcast Encryption (BE) schemes, ABBE is more flexible because a broadcasted message can be encrypted by an expressive access policy, either with or without explicit specifying the receivers. Moreover, ABBE significantly reduces the storage and communication overhead to the order of $O(\log N)$, where $N$ is the system size.

In this paper, we propose a new practical identity-based encryption scheme which is suitable for wireless sensor network (WSN). We call it Receiver-Bounded Online/Offline Identity-based Encryption (RB-OOIBE). It splits the encryption process into two parts -- the offline and the online part. In the offline part, all heavy computations are done without the knowledge of the receiver's identity and the plaintext message. In the online stage, only light computations such as modular operation and symmetric key encryption are required, together with the receiver's identity and the plaintext message. Moreover, since each offline ciphertext can be re-used for the same receiver, the number of offline ciphertexts the encrypter holds only confines the number of receivers instead of the number of messages to be encrypted. In this way, a sensor node (with limited computation power and limited storage) in WSN can send encrypted data easily: A few offline ciphertexts can be computed in the manufacturing stage while the online part is light enough for the sensor to process.

This paper describes details of procedure for breaking a product sum or subset sum public key cryptosystem with two blocks of cipher text which has a random sequence in the message. This attack can successfully break some small examples of this cryptosystem. These examples may be not too small to evaluate the system.

There exist many large collections of private data that must be protected on behalf of the entities that hold them or the clients they serve. However, there are also often many legitimate reasons for sharing that data in a controlled manner. How can two parties decide to share data without prior knowledge of what data they have? For example, two intelligence agencies might be willing to cooperate by sharing documents about a specific case, and need a way of determining which documents might be of interest to each other.We introduce and address the problem of allowing such entities to search each other's data securely and anonymously. We aim to protect the content of the queries, as well as the content of documents unrelated to those queries, while concealing the identity of the participants. Although there exist systems for solving similar problems, to our knowledge we are the first to address this specific need and also the first to present a secure anonymous search system that is practical for real-time querying. In order to achieve this in an efficient manner, we make use of Bloom filters [5], definitions of security for deterministic encryption [22] that we adapt and instantiate in the private key setting and of a novel encryption primitive, reroutable encryption.

We propose a fully homomorphic encryption scheme -- i.e., a scheme that allows one to evaluate circuits over encrypted data without being able to decrypt. Our solution comes in three steps. First, we provide a general result -- that, to construct an encryption scheme that permits evaluation of arbitrary circuits, it suffices to construct an encryption scheme that can evaluate (slightly augmented versions of) its own decryption circuit; we call a scheme that can evaluate its (augmented) decryption circuit bootstrappable.Next, we describe a public key encryption scheme using ideal lattices that is almost bootstrappable.Lattice-based cryptosystems typically have decryption algorithms with low circuit complexity, often dominated by an inner product computation that is in NC1. Also, ideal lattices provide both additive and multiplicative homomorphisms (modulo a public-key ideal in a polynomial ring that is represented as a lattice), as needed to evaluate general circuits.Unfortunately, our initial scheme is not quite bootstrappable -- i.e., the depth that the scheme can correctly evaluate can be logarithmic in the lattice dimension, just like the depth of the decryption circuit, but the latter is greater than the former. In the final step, we show how to modify the scheme to reduce the depth of the decryption circuit, and thereby obtain a bootstrappable encryption scheme, without reducing the depth that the scheme can evaluate. Abstractly, we accomplish this by enabling the encrypter to start the decryption process, leaving less work for the decrypter, much like the server leaves less work for the decrypter in a server-aided cryptosystem.

Recently, Baek et al. proposed an efficient public key encryption scheme with keyword search based on the scheme of Boneh et al., However, the security model of Baek et al. seriously limits the ability of the adversary.In this paper, we enhance the security model of the public key encryption with keyword search to properly incorporate the ability of an adversary. We also construct a public key encryption scheme with keyword search secure in the enhanced security model.

Ciphertext policy attribute based encryption (CPABE) allows a sender to distribute messages based on an access policy which can be expressed as a boolean function consisting of (OR, AND) gates between attributes. A receiver whose secret key is associated with those attributes could only decrypt a ciphertext successfully if and only if his attributes satisfy the ciphertext's access policy. Fine-grained access control, a new concept mentioned by GPSW in CCS'06 can realize a more delicate access policy which could be represented as an access tree with threshold gates connecting attributes.In ICALP'08, Goyal et al. design a bounded CPABE (denoted as GJPS) with fine-grained access policy which can be proven secure under a number-theoretic assumption. In this paper, we improve their scheme by providing faster encryption / decryption algorithm and shortened ciphertext size. Moreover, we use one-time signature technique to obtain a chosen ciphertext secure extension and give its complete security proof in the standard model under traditional Decisional Bilinear Diffie-Hellman (DBDH) assumption and strong existential unforgeability of one-time signature scheme.

Over the last couple of years several encryption algorithms applied to MPEG video streams emerged. Most of the algorithms tried to optimize the encryption process with respect to encryption speed. In this paper we will describe, evaluate and compare four MPEG encryption algorithms. Video Encryption Algorithm (VEA), Modified video encryption algorithm (MVEA), Real time Video Encryption Algorithm (RVEA), Perceptual Video Encryption Algorithm (PVEA) with respect to their encryption speed, security level and string size. PVEA is a generalized version of VEA for Perceptual Encryption, by selectively encrypting FLC data element in the video stream. Encrypting FLC data element makes PVEA maintain the strict-size preservation feature.

We construct an Attribute-Based Encryption (ABE) scheme that allows a user's private key to be expressed in terms of any access formula over attributes. Previous ABE schemes were limited to expressing only monotonic access structures. We provide a proof of security for our scheme based on the Decisional Bilinear Diffie-Hellman (BDH) assumption. Furthermore, the performance of our new scheme compares favorably with existing, less-expressive schemes.

In ciphertext policy attribute-based encryption (CP-ABE), every secret key is associated with a set of attributes, and every ciphertext is associated with an access structure on attributes. Decryption is enabled if and only if the user's attribute set satisfies the ciphertext access structure. This provides fine-grained access control on shared data in many practical settings, e.g., secure database and IP multicast.In this paper, we study CP-ABE schemes in which access structures are AND gates on positive and negative attributes. Our basic scheme is proven to be chosen plaintext (CPA) secure under the decisional bilinear Diffie-Hellman (DBDH) assumption. We then apply the Canetti-Halevi-Katz technique to obtain a chosen ciphertext (CCA) secure extension using one-time signatures. The security proof is a reduction to the DBDH assumption and the strong existential unforgeability of the signature primitive.In addition, we introduce hierarchical attributes to optimize our basic scheme - reducing both ciphertext size and encryption/decryption time while maintaining CPA security. We conclude with a discussion of practical applications of CP-ABE.

In this work we re-visit the question of building cryptographic primitives that remain secure even when queried on inputs that depend on the secret key. This was investigated by Black, Rogaway, and Shrimpton in the context of randomized encryption schemes and in the random oracle model. We extend the investigation to deterministic symmetric schemes (such as PRFs and block ciphers) and to the standard model. We term this notion "security against key-dependent-input attack", or KDI-security for short. Our motivation for studying KDI security is the existence of significant real-world implementations of deterministic encryption (in the context of storage encryption) that actually rely on their building blocks to be KDI secure.We consider many natural constructions for PRFs, ciphers, tweakable ciphers and randomized encryption, and examine them with respect to their KDI security. We exhibit inherent limitations of this notion and show many natural constructions that fail to be KDI secure in the standard model, including some schemes that have been proven in the random oracle model. On the positive side, we demonstrate examples where some measure of KDI security can be provably achieved (in particular, we show such examples in the standard model).

In this paper we construct two new fuzzy identity-based encryption (IBE) schemes in the random oracle model. Not only do our schemes provide public parameters whose size is independent of the number of attributes in each identity (used as public key) but they also have useful structures which result in more efficient key extraction and/or encryption than the random oracle version of Sahai and Water's fuzzy IBE scheme, considered recently by Pirretti et al. We prove that the confidentiality of the proposed schemes is relative to the Bilinear Decisional Bilinear Diffie-Hellman problem.

A self-escrowed public key infrastructure (SE-PKI) combines the usual functionality of a public-key infrastructure with the ability to recover private keys given some trap-door information. We present an additively homomorphic variant of an existing SE-PKI for ElGamal encryption. We also propose a new efficient SE-PKI based on the ElGamal and Okamoto-Uchiyama cryptosystems that is more efficient than the previous SE-PKI. This is the first SE-PKI that does not suffer from a key doubling problem of previous SE-PKI proposals. Additionally, we present the first self-escrowed encryption schemes secure against chosen-ciphertext attack in the standard model. These schemes are also quite efficient and are based on the Cramer-Shoup cryptosystem, and the Kurosawa-Desmedt hybrid variant in different groups.

Type systems for secure information flow aim to prevent a program from leaking information from variables classified as $H$ to variables classified as $L$. In this work we extend such a type system to address encryption and decryption; our intuition is that encrypting a $H$ plaintext yields a $L$ ciphertext. We argue that well-typed, polynomial-time programs in our system satisfy a computational probabilistic noninterference property, provided that the encryption scheme is IND-CCA secure. As a part of our proof, we first consider secure information flow in a language with a random assignment operator (but no encryption). We establish a result that may be of independent interest, namely, that well-typed, probabilistically total programs with random assignments satisfy probabilistic noninterference. We establish this result using a weak probabilistic bisimulation.

As more sensitive data is shared and stored by third-party sites on the Internet, there will be a need to encrypt data stored at these sites. One drawback of encrypting data, is that it can be selectively shared only at a coarse-grained level (i.e., giving another party your private key). We develop a new cryptosystem for fine-grained sharing of encrypted data that we call Key-Policy Attribute-Based Encryption (KP-ABE). In our cryptosystem, ciphertexts are labeled with sets of attributes and private keys are associated with access structures that control which ciphertexts a user is able to decrypt. We demonstrate the applicability of our construction to sharing of audit-log information and broadcast encryption. Our construction supports delegation of private keys which subsumesHierarchical Identity-Based Encryption (HIBE).

The concept of policy-based cryptography is a promising paradigm for trust establishment and authorization in largescale open environments like the Internet and Mobile Networks. It aims at providing a framework for performing cryptographic operations with respect to policies formalized as monotone Boolean expressions written in standard normal forms. A policy involves conjunctions and disjunctions of conditions where each condition is fulfilled by a digital credential representing the signature of a specific credential issuer on a set of statements about a certain entity. Therefore, an entity fulfills a policy if any only if it has been issued a set of credentials fulfilling the combination of conditions specified by the policy.In this work, we focus on policy-based encryption schemes which allow to encrypt a message according to a policy so that only entities fulfilling the policy are able to decrypt the message. More generally, policy-based encryption belongs to an emerging family of encryption schemes sharing the ability to integrate encryption with access control structures. This ability is mainly enabled by bilinear pairings over elliptic curves and allows for several interesting applications in different contexts.A policy-based encryption scheme has to fulfill two primary requirements: on one hand, provable security under well defined attack models. On the other hand, efficiency, especially when dealing with the conjunctions and disjunctions of credential-based conditions.The contributions of our research work are twofold:1. The standard acceptable notion of security for public-key encryption schemes is indistinguishability against chosen ciphertext attacks. Hence, it is natural to require that a policy-based encryption scheme also satisfies this strong notion of security. However, the definition of this security notion must be adapted to the policy-based setting. Our first contribution is the definition of policy-oriented security model for policy-based encryption schemes as well as the development of an efficient policy-based encryption scheme that is provably secure under our security model in the random oracle model.2. Policy-based encryption schemes may suffer from the key-escrow property i.e. in addition to the legitimate holder of the credentials fulfilling the encryption policy, any collusion of credential issuers who are able to issue a set of credentials fulfilling the policy can decrypt the message. Our second contribution is to address this issue through the notion of policy-based public-key encryption. The latter allows encrypting a message not only with respect to a policy but also according to a public-key so that only an entity fulfilling the policy and having access to the corresponding private-key is able to decrypt the message. We developed a policy-based public-key encryption scheme from bilinear pairings and proved its security under the corresponding security model. Our proposal improves related work in terms of both security and efficiency.

Block ciphers generally have fixed and relatively small input length. Thus they are often used in some mode of operations (e.g., ECB, CBC, CFB, and CTR) that enables the encryption of longer messages. Unfortunately, all these modes of operation reveal some information on their inputs or on relationships between different inputs. As an example, in the CBC mode, encrypting two messages with an identical prefix will result in identical initial blocks in the ciphertexts. Due to the well-known birthday attack and the small input length, the CBC mode becomes less secure as the number of data blocks to be encrypted increases. This leads to a challenging task, namely to design schemes for storage device block or sector level data encryption that are efficient and do not have the disadvantages mentioned above. In this paper, we propose an efficient cipher whose data/cipher blocks can be specified flexibly to match the length of a block unit for current and foreseeable future storage devices. We show that our encryption scheme is provably secure under the assumption that the underlying one-way hash function is a random function.

A cryptosystem based on a clipped Hopfield neural network (CHNN) was recently proposed primarily for encryption of digital images and videos. The system is fast and suitable for hardware implementation. The present paper investigates the security aspects of the CHNN-based cryptosystem, and the following weaknesses are pointed out: 1) the cryptosystem is not sufficiently secure against the ciphertext-only attacks due to the weak randomness properties of the generated keystream, and 2) the cryptosystem is insecure against known/chosen-plaintext attacks and only one known plaintext-ciphertext pair is enough to completely break all ciphertexts of the same or smaller size obtained using the same encryption keys. The security of CHNN-based cryptosystem cannot be improved unless the basic model is fundamentally changed.

Lightweight encryption offers a cogent alternative to full encryption of visual content in application settings with clients of low processing power, e.g. mobile applications, as it counterbalances security demands and computational demands. We present a lightweight transparent encryption scheme for JPEG 2000 that is based on and integrated into the wavelet lifting scheme. Keys are constructed from parameterized biorthogonal filters. The proposed method comes at extremely low computational cost and provides natural support for transparent encryption. We discuss the advantages and disadvantages of this encryption scheme with respect to keyspace, computational demands, compression performance, and security.

A forward-secure encryption scheme protects secret keys from exposure by evolving the keys with time. Forward security has several unique requirements in hierarchical identity-based encryption (HIBE) scheme: (1) users join dynamically; (2) encryption is joining-time-oblivious; (3) users evolve secret keys autonomously.We present a scalable forward-secure HIBE (fs-HIBE) scheme satisfying the above properties. We also show how our fs-HIBE scheme can be used to construct a forward-secure public-key broadcast encryption scheme, which protects the secrecy of prior transmissions in the broadcast encryption setting. We further generalize fs-HIBE into a collusion-resistant multiple hierarchical ID-based encryption scheme, which can be used for secure communications with entities having multiple roles in role-based access control. The security of our schemes is based on the bilinear Diffie-Hellman assumption in the random oracle model.

Secret handshake protocols were recently introduced by Balfanz, et al. [1] to allow members of the same group to authenticate each other secretly, in the sense that someone who is not a group member cannot tell, by engaging in the handshake protocol, whether his counterparty is a member of the group. On the other hand, any two parties who are members of the same group will recognize each other as members. Thus, secret handshakes can be used in any scenario where group members need to identify each other without revealing their group affiliations to outsiders. The secret handshake protocol of [1] relies on a Bilinear Diffie-Hellman assumption on certain elliptic curves. We show how to build secret handshake protocols secure under more standard cryptographic assumptions, like the RSA or the Diffie Hellman (DH) assumption, using a novel tool of CA-oblivious public key encryption, i.e. an encryption scheme where neither the public key nor the ciphertext reveal any information about the Certification Authority which certified the public key.