Search

Multi-user searchable encryption (MUSE) schemes provide solutions for searching over ciphertexts shared by different users, but the significant overhead of communication and computation leads to high latency in the group sharing system. Moreover, most MUSE schemes support only single-keyword search, and are vulnerable to the internal keyword guessing attack (IKGA). In this paper, to address these challenging tasks, we first propose a dual-server Public-key Puncturable Encryption with Conjunctive Keyword Search (dPPECKS) scheme in a group sharing scenario by extending the Punctrable Encryption (PE) and conjunctive keyword search (CKS) technologies. Our scheme realizes the efficient and dynamic update of team members, including user joining and exiting. Through rigorous analysis, we prove that our scheme can achieve IND-CKA2 security and resist IKGA. Extensive evaluation results demonstrate that our proposed scheme achieves significant improvements in terms of communication and computation costs. For example, compared with prior related work, with 90 people left in a team of 100, the storage cost of ciphertext is reduced from 80 to 1.8 KB. Under the same setting, it costs only 0.177 s to generate the ciphertext in our scheme, which is 90 times less than that in another scheme. [ABSTRACT FROM AUTHOR]

Ciphertext-Policy Attribute-Based Searchable Encryption (CP-ABSE) is one of the most suitable encryption mechanisms in cloud environments for its fine-grained access structure and keyword retrieval capability over the ciphertext. However, in the CP-ABSE schemes, guaranteeing the forward security of the outsourced cloud data and securely deleting those no longer needed data without relying on the cloud are challenging problems. To handle such challenges, we propose a Puncturable CP-ABSE (Pun-CP-ABSE) scheme that achieves self-controlled data deletion with a fine-grained access structure under the searchable mechanism. The data owner punctures the trapdoor to accomplish the data deletion. Then, the deletion process does not need to communicate with a trusted third party and can guarantee forward security. After the puncturation, the cloud server can no longer search for the corresponding ciphertext. Furthermore, we prove the Pun-CP-ABSE scheme is secure against the Chosen-Plaintext Attack (CPA) and Chosen-Keyword Attack (CKA). We have also implemented the Pun-CP-ABSE scheme to show its efficiency and feasibility.

With the rapid deployment of storage services, secure and efficient user authorization and revocation data shared through the cloud have become a grand challenge hindering cloud data applications. When previous direct and indirect user revocation schemes implemented large-scale user revocation, they faced heavy communication and computational costs. To address these challenges, this study presents a new encryption scheme that combines ciphertext-policy attribute-based encryption (CP-ABE) with puncturable encryption to achieve efficient and flexible user revocation. We design a proxy server to reduce the computational overhead in the decryption phase. Because the puncture process is performed on a semi-honest cloud, we use the digital signature method to verify the correctness of its operation. Furthermore, we prove the security of our scheme under the chosen-plaintext attack (CPA), and compare it with other schemes to highlight its advantages. Numerical analysis and experimental simulation results reveal that our scheme is more suitable than other schemes for use in a cloud environment for user revocation. [ABSTRACT FROM AUTHOR]

Puncturable encryption allows recipients to revoke the decryption capability of ciphertexts flexibly, thus provides a fine-grained way to achieve forward security. So far, puncturable encryption and its variants have found many interesting applications, including the design of advanced cryptographic protocols and messaging systems. In this paper, we put forward the first generic construction of incremental symmetric puncturable encryption that can support an arbitrary number of punctures and achieve semantic security without random oracles. To this end, we introduce the notion of extended key-homomorphic puncturable PRF (EKHP-PRF) by abstracting the properties implicitly desired in many applications of almost key-homomorphic PRFs, which essentially removes the influence of errors due to almost key-homomorphism. Moreover, we present an efficient instantiation of EKHP-PRF based on a variant of Module Learning with Errors (MLWE) problem, namely non-uniform MLWE (NMLWE). Thus, we get the first lattice-based puncturable encryption featuring an arbitrary number of punctures in the standard model. [ABSTRACT FROM AUTHOR]

The concept of puncturable encryption (PE) was introduced by Green and Miers at IEEE S&P, 2015. PE allows recipients to update their decryption keys to revoke decryption capability for selected messages without communicating with senders. From the first instantiation, PE shows its essence for many interesting applications, such as asynchronous messaging systems, group messaging systems, public-key watermarking schemes, secure cloud emails, and many more. To eliminate the necessity of having a costly certificate verification process, Wei et al. introduced puncturable identity-based encryption (PIBE) at ESORICS, 2019. Unfortunately, till today, there is no PIBE , which can withstand quantum attack. In this paper, we aim to fill this gap in the literature by presenting the first constructions of PIBE , for both selective and adaptive identity, which are secure in the standard model based on the hardness of learning with errors problem. Finally, we extend the design idea of selectively secure PIBE to provide the first construction of lattice-based puncturable key-policy attribute-based encryption (KP - PABE), which can facilitate fine-grained access mechanism with decryption revocation. Design ideas of proposed constructions can, also, be useful to construct other lattice-based expressive PE. [ABSTRACT FROM AUTHOR]

Cloud file sharing (CFS) in cloud storage is one of the essential tools for enterprises to improve their core competitiveness. In the sharing process, user dynamic management and players/readers abuse has always been a problem that needs to be solved, but malicious encryptors are also a new challenge. Therefore, preventing malicious encryption is another way to protect copyright issues. This scheme proposes a traitor tracing scheme with puncturable-based broadcast encryption in cloud storage, which is an improved scheme proposed in Ref. Garg et al. (2010). Based on the original completely collusion resistant traitor tracing scheme, the uniform distribution of hash output is used to prevent malicious encryptors. In addition, users can perform authentication during the decryption phase to prevent replay attacks. At the same time, the puncture algorithm is introduced, so that normal users can dynamically revoke themselves without affecting the normal use of other users. We prove that the scheme is secure under chosen plaintext attack (CPA). Theoretical analysis also shows that our scheme can prevent malicious encryptors in cloud file sharing and allow normal users to dynamically revoke. After experimental verification, our scheme offers distinct advantages over the existing one. • Prevent malicious encryptors. We use the feature of uniform distribution of hash output to hash random numbers, which makes it impossible to embed the random trapdoor. • Dynamic management of users. We incorporate puncture encryption that allow legitimate recipients to update their private key by self-puncture, thereby revoking the private key's ability to decrypt message. Also, the ability of other recipients to decrypt messages is not affected. • User self-verification. During encryption, The user hashes the decrypted M and R , and then compares them with h = H (R ‖ M ‖ L) to see whether they suffer replay attacks. [ABSTRACT FROM AUTHOR]

In recent years, motivated by the revelation of long-term and widespread surveillance of personal communications, extensive efforts have been putting into store-and-forward asynchronous messaging systems (e.g., email and SMS) for providing critical security guarantees. Of particular interest among them is forward security, which makes past messages remain secure in the event that the secret key gets exposed. Traditional forward-secure public key encryption can provide forward security for asynchronous scenarios, but it is not flexible enough for instant messaging systems. This is mainly because that, after updating his/her secret key, the user totally loses the decryption capacity of ciphertexts that have not been received. In this paper, to achieve practical forward-security of asynchronous messaging systems, we investigate the construction of a new primitive named forward-secure puncturable encryption (FSPE) that captures fine-grained forward security. Namely, the user can maintain the decryption capacity of those encrypted messages that have not been received yet. Meanwhile, even if the secret key is disclosed, those received messages can still remain secure. Specifically, we propose a communication-efficient FSPE scheme for achieving fine-grained forward-secure asynchronous messaging. Moreover, to improve the efficiency of asynchronous messaging built upon FSPE, we extend it to support outsourced decryption. We also implement the proposed scheme and evaluate a proof-of-concept of main algorithms, so as to increase confidence on its correctness and practicability. [ABSTRACT FROM AUTHOR]

Forward secrecy is considered an essential design goal of modern key establishment (KE) protocols, such as TLS 1.3, for example. Furthermore, efficiency considerations such as zero round-trip time (0-RTT), where a client is able to send cryptographically protected payload data along with the very first KE message, are motivated by the practical demand for secure low-latency communication. For a long time, it was unclear whether protocols that simultaneously achieve 0-RTT and full forward secrecy exist. Only recently, the first forward-secret 0-RTT protocol was described by Günther et al. (Eurocrypt, 2017). It is based on puncturable encryption. Forward secrecy is achieved by “puncturing” the secret key after each decryption operation, such that a given ciphertext can only be decrypted once (cf. also Green and Miers, S&P 2015). Unfortunately, their scheme is completely impractical, since one puncturing operation takes between 30 s and several minutes for reasonable security and deployment parameters, such that this solution is only a first feasibility result, but not efficient enough to be deployed in practice. In this paper, we introduce a new primitive that we term Bloom filter encryption (BFE), which is derived from the probabilistic Bloom filter data structure. We describe different constructions of BFE schemes and show how these yield new puncturable encryption mechanisms with extremely efficient puncturing. Most importantly, a puncturing operation only involves a small number of very efficient computations, plus the deletion of certain parts of the secret key, which outperforms previous constructions by orders of magnitude. This gives rise to the first forward-secret 0-RTT protocols that are efficient enough to be deployed in practice. We believe that BFE will find applications beyond forward-secret 0-RTT protocols. [ABSTRACT FROM AUTHOR]

In an identity-based signature (IBS) system, each user uses individual information as his/her public key, and also holds a private key issued by a fully trusted key generation center (KGC) with a master secret key. This avoids the mandatory requirement of public key infrastructure, and thus motivates the wide deployment of IBS in various fields. In practical scenarios, the premise that IBS can provide the intended security guarantee is to remain secret keys unrevealed. That is, on the one hand, after a user's secret key is leaked, then an adversary can use it to create correct signatures for any messages, which invalidates all signatures produced by this user him/herself. On the other hand, what is worse, after the master secret key is disclosed, then all users' signatures become useless, since the adversary can produce any user's private key with it. In this paper, to reduce the damage of secret key leakage in IBS system, we introduce system-widely and fine-grained forward-secure IBS (SWFG-fs-IBS). In this primitive, the master secret key is immediately punctured after issuing a secret key for a new user, such that it would fail to issue a secret key for the same user again. Similarly, we also perform puncture operations on each user's private key after signing messages, which prevents the exposed private key from creating signatures for previously signed messages. Concretely, we first define the syntax and security notions of SWFG-fs-IBS, and then propose its concrete construction with provable security. The theoretical analysis indicates that our proposal provides stronger and more practical forward security than previous fs-IBS schemes. We also provide an implementation of our proposal, and present extensive experiments to demonstrate its feasibility. [ABSTRACT FROM AUTHOR]