Search

Plaintext-checkable encryption (PCE) can support searches over ciphertext by directly using plaintext. The functionality of a search is modeled by a specific check algorithm that takes a pair of target plaintext and ciphertext as input and returns 1 if the correct decryption result of the ciphertext is identical to the target plaintext. A trivial solution is to use an existing scheme (e.g., deterministic RSA) to achieve this, but there is no security guarantee with this method. Previous rigorous works have either relied on some mathematical structures to build PCE that can proven in the standard model or can be generic, as in the random oracle model. Hence, in this work, we aim to construct PCE that can be proven in the standard model by using standard primitives in a modular way in two steps. The first step is to present a warm-up construction of PCE from hash garbling and hash functions whose security is only proven in the random oracle model. The second step is to provide a full-fledged construction based on the warm-up, with slight modifications for achieving security in the standard model. Finally, we show the feasibility of the proposed construction through experiments. [ABSTRACT FROM AUTHOR]

Various applications use asymmetric cryptography to secure communications between both parties, and it raises the main issue of generating vast amounts of computation and storage. Thus, elliptic curve cryptography (ECC) is a methodology that emerged to overcome this issue using its low computation and generation of small keys with its strong encryption strategy. ECC is becoming mandatory and used mostly for public key encryption protocols. ECC has expanded cumulative acceptance in practice due to the reduced bit magnitude of operands compared to RSA for safety level. Previously, protocols designed for ECC suggested calculation of scalar development and it was accomplished in finite fields as projective, affine, and Jacobian simulations of coordinates. Arithmetic operations in a limited area establish the core benefits of the ECC algorithm. Even though ECC generated an issue of complex key generation using its curve formation, to overcome this issue a hyperelliptic curve cryptosystems (HECC) is proposed in this study. HECC perform ECC in the Public Key Cryptography (PKC) domain. This study presented an optimization-based key generation and made a random selection of integers for encrypting the message. Selecting a prime number as the private key and multiplying it to the encrypted message to generate a public key is done. This encrypted message is mapped to the curve to check whether it satisfies the curve equation or not. Once an encrypted message is obtained, it is then sent to a second party for pursuing the message. On the side of the second party, a reverse process called decryption takes place. Thus, a secured transmission of data communication takes place. Implementing this algorithm in MATLAB resulted in 94% accuracy and an error of 6%, which was a higher performance ratio than previous methods.

Public Key Encryption with Equality Test (PKEET) is a cryptographic primitive that allows an authorized entity to test whether two given ciphertexts are the encryption of the same message without decrypting them. The security of cryptographic schemes is analyzed using security model, and thus in order to derive reasonable security against the real attackers, the security model should reflect the real attack as closely as possible. However, security model widely used by PKEET fails to capture corruption attack, since it does not cover the real attacker who can adaptively corrupt users. On the other hand, many PKEET schemes suffer from a security loss that is linear in the number of users when using security model with adaptive corruption attack, which causes that the actual security guarantees of the schemes linearly degrade in that. Therefore, the goal of this paper is to resolve these two problems. We present a PKEET scheme in setting with adaptive corruptions in which the security loss is a constant, and in particular, the comparison shows that our scheme is efficient.

In the era of digital advancements, safeguarding medical data holds significant importance. This article introduces a novel approach to encrypting images through public-key encryption, incorporating the properties of Elliptic Curve Cryptography (ECC) and the Blum-Goldwasser Cryptosystem (BGC). The proposed method capitalizes on the chaotic properties of a sequence generator to augment the randomness in the encrypted image. The encryption process initiates with a secure key exchange mechanism using elliptic curves and the Blum-Goldwasser Cryptosystem. Pixel randomization is achieved through a chaotic map, followed by encryption using ECC and BGC, which integrates the discrete logarithmic problem, probabilistic encryption, and the quadratic residuosity problem. Both ECC and BGC components contribute to unpredictability and complexity, fortifying the security measures. The amalgamation of these cryptographic techniques provides resilience against cyber threats such as brute-force attacks and differential cryptanalysis. Thorough simulations and performance assessments affirm the effectiveness and computational efficiency of this hybrid approach when compared to existing methods. The experimental values of information entropy, average correlation, NPCR and UACI are 7.9998, 0.0010, 99.6901% and 33.5260% respectively. The total time taken for the proposed methodology is 0.142 seconds. These values indicates that the proposed hybrid chaotic image encryption method displays promise for diverse applications.

Public key encryption with equality test (PKEET) can test if two ciphertexts generated from different public keys contain the same message without decryption. In the application of cloud storage, PKEET could be used to search on encrypted data. Currently, there have been many researches about security, efficiency, and function of PKEET. After analyzing the ciphertext sizes in the existing proposals, we find that the ciphertext sizes in PKEET schemes are usually large. In this case, it will bring storage burden for the cloud server. To address the problem, in this paper, we introduce a new notion of lightweight public key encryption with equality test (L-PKEET). Then we present a concrete construction of L-PKEET. Furthermore, we demonstrate that L-PKEET can reduce ciphertext sizes efficiently. In terms of the computation cost and ciphertext size, we compare L-PKEET with related schemes which also achieve four kinds of authorization. The comparison results show that L-PKEET is more efficient in terms of encryption, decryption, and test algorithms. Regarding the adversaries with/without trapdoor, we theoretically prove that L-PKEET can meet OW-CCA security and IND-CCA security, respectively. [ABSTRACT FROM AUTHOR]

Public key encryption with equality test (PKEET) plays an important role in the cloud storage. It allows a third party to test whether two ciphertexts contain the same message without decryption. Since the third party is not fully trusted, it is sometimes necessary to prevent the third party from testing the ciphertexts all the time. To this end, we propose the notion of revocable public key encryption with equality test (R-PKEET). We give the construction of R-PKEET in the random oracle model, which employs time key to update trapdoor and partial ciphertexts. In details, our scheme enables a user to revoke the third party's test right by sending a time key to the cloud server, which is responsible for updating partial ciphertexts using the time key. Compared with related works, our scheme achieves both lightweight revocation and lower computational complexity by using Shamir's secret sharing and Lagrange interpolating polynomial. [ABSTRACT FROM AUTHOR]

Free Space Optical (FSO) communication has potential terrestrial and non-terrestrial applications. It allows large bandwidth for higher data transfer capacity. Due to its high directivity, it has a potential security advantage over traditional radio frequency (RF) communications. However, eavesdropping attacks are still possible in long non-terrestrial transmission FSO links, where the geometry of the link allows foreign flying objects such as Unmanned Aerial vehicles (UAVs) and drones to interrupt the links. This exposes non-terrestrial FSO links to adversary security attacks. Hence, data security techniques implementation is required to achieve immune FSO communication links. Unlike the commonly proposed physical layer security techniques, this paper presents a lab-based demonstration of a secured FSO communication link based on data cryptography using the GNU Radio platform and software-defined radio (SDR) hardware. The utilized encryption algorithm (Xsalsa20) in this paper requires high-time complexity to be broken by power-limited flying objects that interrupt the FSO beam. The results show that implementing cryptographic encryption techniques into FSO systems provided resilience against eavesdropping attacks and preserved data security. The experiment results show that, at a distance of 250 mm and laser output power of 10 mW, the system achieves a packet delivery rate of 92 % and transmission rate of 10 Mbit/s. This is because the SDR used in this experiment requires a minimum received electrical amplitude of 27.5 mV to process the received signal. Long distance and higher data rates can be achieved using less sensitive SDR hardware. [ABSTRACT FROM AUTHOR]

In cloud computing applications, users need to encrypt data locally before uploading it to the cloud server to ensure the security of private data. Searchable encryption technology allows users to directly search encrypted data on the server. Users with search permission can search ciphertext without limitation. In practical applications, the loss of user key and malicious attacks are easy to cause security threats to private data, and users should not keep the ability to retrieve data. This paper proposed a public-key searchable encryption scheme that supported the revocation of user retrieval rights. It divided the whole life cycle of the system into different periods. The ciphertext in the next period was evolved from the ciphertext in the last period. It revoked the user permission through the ciphertext evolution and time key distribution control. The scheme supports multi-keyword retrieval, reduces the computing cost, and cancels the search ability of all ciphertexts at the previous time to ensure the forward security of ciphertexts. [ABSTRACT FROM AUTHOR]

The proliferation of big data has brought exponential amount of increase in data that is being remotely stored around the globe. Thus, making it imperative to secure the remote data through some encryption mechanism to ensure privacy preservation. However, it often becomes difficult to perform operations over the encrypted data. In order to solve this problem, the equality test function based public key encryption (PKEwET) is proposed. PKEwET approach basically allows secure comparison over encrypted data without revealing the underlying data. This work aims to improve Water’s scheme while introducing a new functionality. More precisly, equality test is being introduced to Water’s scheme so that the encrypted data may be compared without decryption process. To achieve this, an authorization mechanism is being included in which the authorized party uses the trapdoor to test the ciphertext. The scheme is designed under standard model. The security of the proposed scheme is proved with two types of adversaries under the standard model. Finally, the superiority of the proposed scheme in terms of performance is also discussed.

With the development of quantum computers, the classical public key encryption system is not capable enough to guarantee the communication security of internet of things (IoT).Because the mathematical puzzles which post-quantum encryption algorithms are based on cannot yet be broken by quantum computers, these new algorithms have good anti-quantum computing security.In particular, the lattice-based cryptography is expected to become the main technology of the next generation public key cryptosystem.However, post-quantum encryption algorithms have the disadvantages of large amount of computation and high storage space.The communication efficiency of IoT will be affected if post-quantum encryption algorithms are directly applied to the lightweight device under IoT environment.In order to better guarantee the communication security and improve the commutation efficiency of IoT, Sym-BRLWE (symmetrical binary RLWE) encryption scheme was proposed.Sym-BRLWE was improved from the existing post-quantum encryption scheme based on BRLWE (binary ringlearning with errors) problem.Specifically, Sym-BRLWE encryption algorithm met the efficiency requirements of IoT via improving the random number selection on the discrete uniform distribution and the calculation of the polynomial multiplication.Sym-BRLWE encryption algorithm achieved high efficiency and high security via adding encryption security precautions, then it is more suitable for IoT lightweight devices.From the security analysis, the proposed Sym-BRLWE encryption scheme had high security.It could theoretically resist lattice attacks, timing attacks, simple power analysis (SPA) and differential power analysis (DPA).From simulation experiments, which were carried out in a binary computing environment simulating an 8-bit micro-device, the proposed Sym-BRLWE encryption scheme has high efficiency and small key size in encryption and decryption.It could reduce the total encryption time by 30% to 40% when compared with other BRLWE-based encryption schemes with the parameter selection of the 140 bit quantum security level.

At present, most searchable encryption focuses on text search, aiming at how to search graphics in cloud computing, a new privacy preserving searchable encryption scheme under public key system is proposed. Through a new similarity judgment technique, the characteristic information of graphic shape is transformed into single keyword encryption, and the graphic shape searchable encryption (GSSE) is realized by using the public key authentication encryption with keyword searchable (PAEKS), which realizes the function of protecting the privacy of users and data, and the fixed size ciphertext and trapdoor are achieved. Finally, under the random oracle model, it is proved that the scheme proposed in this paper has the semantic security of external selection multi-keyword attack and internal keyword guessing attack. Finally, under the random oracle model, the semantic security of external selection multi- keyword attack and internal keyword guessing attack of the scheme is proved. The experimental results show that the scheme has high efficiency. [ABSTRACT FROM AUTHOR]

In this paper, we present a new identity-based encryption (IBE) system that is named Backward Compatible Identity-based Encryption (BC-IBE). Our BC-IBE is proposed to solve the problem caused by the out-of-synchronization between users' private keys and ciphertexts. Encryption systems such as revocable IBE or revocable Attribute-based Encryption (ABE) often require updating private keys to revoke users after a certain time period. However, in those schemes, an updated key can be used to decrypt the ciphertexts created only during the current time period. Once the key is updated and the previous keys are removed, the user, the owner of the updated key, will lose access to the past ciphertexts. In our paper, we propose BC-IBE that supports backward compatibility, to solve this problem. In our proposed system, user's private keys and ciphertexts can be updated periodically with time tags, and these processes can be used to revoke users who do not receive an updated key as the other revocable encryption does. However, in our proposed system, a private key newly issued to a user is backward compatible. This means that it decrypts not only the ciphertexts at the present time period but also all past ciphertexts. This implies that our proposed scheme guarantees the decryption of all encrypted data even if they are not synchronized. Compared to the existing revocable identity-based encryption system, our proposed BC-IBE has the advantage of simplifying key management and securely delegating ciphertext updates. Our proposed scheme only requires a single backward-compatible private key to decrypt all past ciphertexts created. Moreover, the ciphertext update process in our proposed scheme does not require any special privileges and does not require decryption. This means that this process can be securely delegated to a third-party server, such as a cloud server, and it prevents the potential leakage of secrets. For those reasons, BC-IBE is suitable for a system where users are more dynamic, such as the Internet-of-Things (IoT) network, or a system that regularly updates the data, like cloud data storage. In this paper, we provide the construction of BC-IBE and prove its formal security. [ABSTRACT FROM AUTHOR]

In this paper, we present a side-channel analysis (SCA) on key encapsulation mechanisms (KEMs) based on the Fujisaki–Okamoto (FO) transformation and its variants. Many post-quantum KEMs usually perform re-encryption during key decapsulation to achieve chosen-ciphertext attack (CCA) security. The side-channel leakage of re-encryption can be exploited to mount a key-recovery plaintext-checking attack (KR-PCA), even if the chosen-plaintext attack (CCA) secure decryption constructing the KEM is securely implemented. Herein, we propose an efficient side-channel-assisted KR-PCA on post-quantum KEMs, and achieve a key recovery with significantly fewer attack traces than existing ones in TCHES 2022 and 2023. The basic concept of the proposed attack is to introduce a new KR-PCA based on a multiple-valued (MV-)PC oracle and then implement a dedicated MV-PC oracle based on a multi-classification neural network (NN). The proposed attack is applicable to the NIST PQC selected algorithm Kyber and the similar lattice-based Saber, FrodoKEM and NTRU Prime, as well as SIKE. We also present how to realize a sufficiently reliable MV-PC oracle from NN model outputs that are not 100% accurate, and analyze the tradeoff between the key recovery success rate and the number of attack traces. We assess the feasibility of the proposed attack through attack experiments on three typical symmetric primitives to instantiate a random oracle (SHAKE, SHA3, and AES software). The proposed attack reduces the number of attack traces required for a reliable key recovery by up to 87% compared to the existing attacks against Kyber and other lattice-based KEMs, under the condition of 99.9999% success rate for key recovery. The proposed attack can also reduce the number of attack traces by 85% for SIKE.

In modern society, the Internet is one of the most used means of communication. Thus, secure information transfer is inevitably of major importance. Computers nowadays use encryption methods based on arithmetic operations to turn messages into ciphertexts that are practically impossible for an attacker to reverse-engineer using a classical computer. Lately, it has been proven that this is possible in a post-quantum setting where quantum computers of considerable size are available to attackers. With the advance of technology of quantum computers, it is now more necessary than ever before to construct encryption schemes that cannot be broken either using a classical or a quantum computer. The National Institute of Technology and Standards (NIST) has orchestrated a competition, and numerous encryption schemes have been proposed. The NIST has identified one algorithm to be standardized for the post-quantum era. This algorithm is called CRYSTALS-Kyber and is based on module learning with errors (MLWE). This paper investigates how to apply error correcting codes in order to create some excess decryption failure rate (DFR) and to take advantage of that in order to re-tune Kyber's parameters in the pursuit of higher security. By applying Polar Codes, Kyber's security was managed to be increased by 54.4% under a new set of parameters, while keeping the decryption failure rate well below the upper acceptable bound set by the NIST. [ABSTRACT FROM AUTHOR]

The ring learning with errors (RLWE) problem can be used to construct efficient post-quantum public key encryption schemes. An error distribution, normally a Gaussian-like distribution, is involved in the RLWE problem. In this work we focus on using polar codes to alleviate a natural trade-off present in RLWE public key encryption schemes; namely, we would like a wider error distribution to increase security, but a wider error distribution comes at the cost of an increased probability of decryption error. The motivation of this work is to improve the bit-security level by using wider error distribution while keeping the target decryption failure rate achievable. The approach we proposed in this work is twofold. Firstly, we formulate RLWE public key encryption as a channel model with some noise terms known by the decoder. This makes our approach distinguished from existing research of this kind in the literature which ignores these known terms. Secondly, we design polar codes for the derived channel model. Theoretically and numerically, we show the proposed modeling and polar coding scheme contributes to a considerable bit-security level improvement compared with NewHope, a submission to National Institute of Standards and Technology (NIST), with almost the same parameters. Moreover, polar encoding and decoding support isochronous implementations in the sense that the timings of associated operations are irrelevant to the sensitive information. [ABSTRACT FROM AUTHOR]

In this paper, we present the communication complexity results of several chosen-ciphertext attack (CCA2) secure public key cryptosystems that are resilient to certain classes of secret key leakage attacks. In particular, we discuss the communication complexity trade-off between cryptosystems and generic transformations that rely on the random oracle model and those that are designed under the standard model. For this purpose, we propose a communication complexity measure for public key cryptosystems that equals the total amount of bits involving the receiver's public key and a ciphertext transmission by the sender. Using this complexity measure, we show that random oracle model-based cryptosystems and transformations are more efficient in terms of communication complexity, albeit relying on the stronger assumption that some cryptographic primitives behave like truly random functions. As corollaries of our results, we also address the problem of establishing communication complexity lower bounds by which leakage-secure communication between two parties can occur, and show that our cryptosystems and generic transformations achieve polynomial lower bounds in communication complexity relative to the security parameter of an adversary. [ABSTRACT FROM AUTHOR]

Abstract With the rapid development of cloud computing technology and communication technology, cloud storage has become a tool used by people in daily life. Cloud storage service enables users to outsource data to cloud servers and retrieve desired document efficiently. Individual privacy in outsource data are very sensitive and should be prevented from any leakage. Public-key encryption with keyword search (PEKS) scheme resolves this tension, while public-key authentication encryption with keyword search (PAEKS) scheme improve its keyword guessing attacks problem potentially. Whereas, the loss of keyword privacy, the limitation of single user interaction and low efficiency make PEKS/PAEKS schemes far from enough in practical applications.In this paper, we develop a multi-recipient public key encryption scheme with keyword search without pairing (MREKS) for cloud storage under public key infrastructure. The proposed scheme has the merits of supporting multi-recipient keyword search way as well as requiring no expensively bilinear pairing operations under standard model. We present a concrete and efficient construction of MREKS, and prove its security based on discrete logarithm assumptions. Furthermore, we embed the algorithm of data plaintext encryption and decryption into the scheme, which makes the scheme more practical. We show that our scheme enjoys much more efficiency than previous PEKS/PAEKS scheme in the simulation experiment, especially the keyword encryption is optimized by 79.5%.

Public key encryption with equality test can determine whether the plaintexts of ciphertexts encrypted with different public keys in the cloud server are identical. Most of the public key encryption schemes with equality test based on traditional PKI system are implemented by bilinear pairs, whose computation is cumbersome and inefficient. At the same time, with the increase in the number of users, the generation, application, issuance and revocation of a large number of certificates become more and more onerous, which brings challenges to the maintenance and sustainable work of the system. To address this problem, this paper proposes a pairing-free identity-based public key encryption with equality test. The scheme determines a straight line through the two points constructed from the plaintext information, and uses the straight line to implement the encryption, decryption, authorization and equality test processes, which gets rid of the restriction of bilinear pairs and improves the computational efficiency. Meanwhile, the scheme is constructed based on the identity cryptosystem, which solves the complex certificate management problem in the traditional PKI system. Under the CDH and DDH assumptions in the random oracle model, the proposed scheme is capable to achieve the security of OW-IDCCA and IND-ID-CCA. [ABSTRACT FROM AUTHOR]

In cloud storage, data owners usually achieve confidentiality of information through giving encrypted data to the server and as a consequence, the possibility of searching over the database is lost. Searchable encryption (SE) is a method to encrypt data in such a way that keyword searching would still be possible. However, to the best of our knowledge, existing literature on SE schemes only supports search operations carried out by an individual users. In this paper, we introduce the concept of public key encryption with distributed keyword search (PEDKS) to provide a solution for scenarios where the search ability can be distributed among authorized subsets of users according to a predefined access structure. Therefore, by employing a PEDKS, group members realizing the specified access structure can cooperatively query to search. We further propose a concrete construction of a PEDKS scheme and prove its security under the intractability of ECDL and BDH problems. Performance analysis and comparison with related concepts are provided as well. [ABSTRACT FROM AUTHOR]

In a highly evolved big data era, intelligent data analysis can improve social operation efficiency and save resources. However, it also brings masses of conflicts, such as malicious mining and abuse of personal privacy information. This paper introduces a privacy protection scheme for social applications. In this scheme, attribute based searchable encryption is used to defend the security of confidential data and ensure the availability of data. Moreover, the access control structure of ciphertext strategy can meet the needs of data sharing in social applications. Security analysis shows that the scheme does not disclose privacy information in index ciphertext, search trapdoor, and equality test. Compared with plaintext information upload and sharing, the additional performance overhead caused by the scheme is acceptable. The scheme can be actually deployed in social applications. [ABSTRACT FROM AUTHOR]

With the development of quantum computers, the classical public key encryption system is not capable enough to guarantee the communication security of internet of things (IoT). Because the mathematical puzzles which post-quantum encryption algorithms are based on cannot yet be broken by quantum computers, these new algorithms have good anti-quantum computing security. In particular, the lattice-based cryptography is expected to become the main technology of the next generation public key cryptosystem. However, post-quantum encryption algorithms have the disadvantages of large amount of computation and high storage space. The communication efficiency of IoT will be affected if post-quantum encryption algorithms are directly applied to the lightweight device under IoT environment. In order to better guarantee the communication security and improve the commutation efficiency of IoT, Sym-BRLWE (symmetrical binary RLWE) encryption scheme was proposed. Sym-BRLWE was improved from the existing post-quantum encryption scheme based on BRLWE (binary ring-learning with errors) problem. Specifically, Sym-BRLWE encryption algorithm met the efficiency requirements of IoT via improving the random number selection on the discrete uniform distribution and the calculation of the polynomial multiplication. Sym-BRLWE encryption algorithm achieved high efficiency and high security via adding encryption security precautions, then it is more suitable for IoT lightweight devices. From the security analysis, the proposed Sym-BRLWE encryption scheme had high security. It could theoretically resist lattice attacks, timing attacks, simple power analysis (SPA) and differential power analysis (DPA). From simulation experiments, which were carried out in a binary computing environment simulating an 8-bit micro-device, the proposed Sym-BRLWE encryption scheme has high efficiency and small key size in encryption and decryption. It could reduce the total encryption time by 30% to 40% when compared with other BRLWE-based encryption schemes with the parameter selection of the 140 bit quantum security level. [ABSTRACT FROM AUTHOR]

Traditional public key cryptography requires certificates as a link between each user's identity and her/his public key. Typically, public key infrastructures (PKI) are used to manage and maintain certificates. However, it takes a lot of resources to build PKI which includes many roles and complex policies. The concept of certificateless public key encryption (CL-PKC) was introduced to eliminate the need for certificates. Based on this concept, a mechanism called certificateless public key encryption with equality test (CL-PKEET) was proposed to ensure the confidentiality of private data and provide an equality test of different ciphertexts. The mechanism is suitable for cloud applications where users cannot only protect personal private data but also enjoy cloud services which test the equality of different ciphertexts. More specifically, any two ciphertexts can be tested to determine whether they are encrypted from the same plaintext. Indeed, any practical system needs to provide a solution to revoke compromised users. However, these existing CL-PKEET schemes do not address the revocation problem, and the related research is scant. Therefore, the aim of this article is to propose the first revocable CL-PKEET scheme called RCL-PKEET which can effectively remove illegal users from the system while maintaining the effectiveness of existing CL-PKEET schemes in encryption, decryption, and equality testing processes. Additionally, we formally demonstrate the security of the proposed scheme under the bilinear Diffie-Hellman assumption. [ABSTRACT FROM AUTHOR]