Identity-Based Encryption Secure Against Chosen-Ciphertext Selective Opening Attack
|
|
|
- Bernard Watts
- 7 years ago
- Views:
Transcription
1 Identity-Based Encryption Secure Against Chosen-Ciphertext Selective Opening Attack Junzuo Lai, Robert H. Deng, Shengli Liu, Jian Weng, and Yunlei Zhao Shanghai Jiao Tong University, Shanghai , China Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 1 / 34
2 SOA Security IBE and Selective Opening Attack. SIM-SO-CCA Security. IBE with SIM-SO-CCA Security. Extractable 1SPO-IBE; Cross-Authentication Codes. Conclusion Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 2 / 34
3 Identity-Based Encryption An IBE scheme consists of the following four algorithms: Setup(1 κ ) ( PK, MSK ). PK: public parameter; MSK: master secret key. KeyGen(PK, MSK, ID) SK ID. SK ID is the private key for identity ID. Enc(PK, ID, M) CT. CT: ciphertext. Dec(PK, SK ID, CT) M/. An IBE scheme has completeness error ɛ if the correct decryption holds with probability at least 1 ɛ, where the probability is taken over the coins used in encryption. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 3 / 34
4 Identity-Based Encryption An IBE scheme consists of the following four algorithms: Setup(1 κ ) ( PK, MSK ). PK: public parameter; MSK: master secret key. KeyGen(PK, MSK, ID) SK ID. SK ID is the private key for identity ID. Enc(PK, ID, M) CT. CT: ciphertext. Dec(PK, SK ID, CT) M/. An IBE scheme has completeness error ɛ if the correct decryption holds with probability at least 1 ɛ, where the probability is taken over the coins used in encryption. unzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 3 / 34
5 Identity-Based Encryption An IBE scheme consists of the following four algorithms: Setup(1 κ ) ( PK, MSK ). PK: public parameter; MSK: master secret key. KeyGen(PK, MSK, ID) SK ID. SK ID is the private key for identity ID. Enc(PK, ID, M) CT. CT: ciphertext. Dec(PK, SK ID, CT) M/. An IBE scheme has completeness error ɛ if the correct decryption holds with probability at least 1 ɛ, where the probability is taken over the coins used in encryption. unzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 3 / 34
6 Identity-Based Encryption An IBE scheme consists of the following four algorithms: Setup(1 κ ) ( PK, MSK ). PK: public parameter; MSK: master secret key. KeyGen(PK, MSK, ID) SK ID. SK ID is the private key for identity ID. Enc(PK, ID, M) CT. CT: ciphertext. Dec(PK, SK ID, CT) M/. An IBE scheme has completeness error ɛ if the correct decryption holds with probability at least 1 ɛ, where the probability is taken over the coins used in encryption. unzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 3 / 34
7 Selective Opening Attack Selective Opening Attack: a vector of ciphertexts, adaptive corruptions exposing not only some message but also the random coins. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 4 / 34
8 Selective Opening Attack Selective Opening Attack: a vector of ciphertexts, adaptive corruptions exposing not only some message but also the random coins. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 4 / 34
9 SIM-SO-CPA(CCA2) Security: SIM-SOA security requires that anything that can be computed by a PPT adversary from all the ciphertexts and the opened messages together with the corresponding randomness can also be computed by a PPT simulator with only the opened messages. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 5 / 34
10 Related works Bellare, Hofheinz and Yilek formalize the security model of SOA, including IND-SOA, SIM-SOA. SIM-SOA security is stronger than IND-SOA security. Fehr, Hofheinz, Kiltz, and Wee [FHKW2010] proposed the first construction of PKE with SIM-SO-CCA2 Security. Bellare, Waters, and S. Yilek[BWY2011] proposed the first construction of IBE with SIM-SO-CCA2 Security. How to construct IBE with SIM-SO-CCA2 Security remains open. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 6 / 34
![Fehr, Hofheinz, Kiltz, and Wee [FHKW2010] proposed the first construction of PKE with SIM-SO-CCA2 Security. Bellare, Waters, and S.](/docs-images/41/22614498/images/page_10.jpg "Yilek[BWY2011] proposed the first construction of IBE with SIM-SO-CCA2 Security. How to construct IBE with SIM-SO-CCA2 Security remains open.")
11 Related works Bellare, Hofheinz and Yilek formalize the security model of SOA, including IND-SOA, SIM-SOA. SIM-SOA security is stronger than IND-SOA security. Fehr, Hofheinz, Kiltz, and Wee [FHKW2010] proposed the first construction of PKE with SIM-SO-CCA2 Security. Bellare, Waters, and S. Yilek[BWY2011] proposed the first construction of IBE with SIM-SO-CCA2 Security. How to construct IBE with SIM-SO-CCA2 Security remains open. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 6 / 34
![Fehr, Hofheinz, Kiltz, and Wee [FHKW2010] proposed the first construction of PKE with SIM-SO-CCA2 Security. Bellare, Waters, and S.](/docs-images/41/22614498/images/page_11.jpg "Yilek[BWY2011] proposed the first construction of IBE with SIM-SO-CCA2 Security. How to construct IBE with SIM-SO-CCA2 Security remains open.")
12 Related works Bellare, Hofheinz and Yilek formalize the security model of SOA, including IND-SOA, SIM-SOA. SIM-SOA security is stronger than IND-SOA security. Fehr, Hofheinz, Kiltz, and Wee [FHKW2010] proposed the first construction of PKE with SIM-SO-CCA2 Security. Bellare, Waters, and S. Yilek[BWY2011] proposed the first construction of IBE with SIM-SO-CCA2 Security. How to construct IBE with SIM-SO-CCA2 Security remains open. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 6 / 34
![Fehr, Hofheinz, Kiltz, and Wee [FHKW2010] proposed the first construction of PKE with SIM-SO-CCA2 Security. Bellare, Waters, and S.](/docs-images/41/22614498/images/page_12.jpg "Yilek[BWY2011] proposed the first construction of IBE with SIM-SO-CCA2 Security. How to construct IBE with SIM-SO-CCA2 Security remains open.")
13 Related works Bellare, Hofheinz and Yilek formalize the security model of SOA, including IND-SOA, SIM-SOA. SIM-SOA security is stronger than IND-SOA security. Fehr, Hofheinz, Kiltz, and Wee [FHKW2010] proposed the first construction of PKE with SIM-SO-CCA2 Security. Bellare, Waters, and S. Yilek[BWY2011] proposed the first construction of IBE with SIM-SO-CCA2 Security. How to construct IBE with SIM-SO-CCA2 Security remains open. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 6 / 34
![Fehr, Hofheinz, Kiltz, and Wee [FHKW2010] proposed the first construction of PKE with SIM-SO-CCA2 Security. Bellare, Waters, and S.](/docs-images/41/22614498/images/page_13.jpg "Yilek[BWY2011] proposed the first construction of IBE with SIM-SO-CCA2 Security. How to construct IBE with SIM-SO-CCA2 Security remains open.")
14 Related works Bellare, Hofheinz and Yilek formalize the security model of SOA, including IND-SOA, SIM-SOA. SIM-SOA security is stronger than IND-SOA security. Fehr, Hofheinz, Kiltz, and Wee [FHKW2010] proposed the first construction of PKE with SIM-SO-CCA2 Security. Bellare, Waters, and S. Yilek[BWY2011] proposed the first construction of IBE with SIM-SO-CCA2 Security. How to construct IBE with SIM-SO-CCA2 Security remains open. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 6 / 34
![Fehr, Hofheinz, Kiltz, and Wee [FHKW2010] proposed the first construction of PKE with SIM-SO-CCA2 Security. Bellare, Waters, and S.](/docs-images/41/22614498/images/page_14.jpg "Yilek[BWY2011] proposed the first construction of IBE with SIM-SO-CCA2 Security. How to construct IBE with SIM-SO-CCA2 Security remains open.")
15 SIM-SO-CCA2 Security: Exp cca so real A,M,R (1 κ ) Challenger A = (A 1, A 2, A 3 ) (PK, MSK) Setup(1 κ ) M = (M (1),..., M (n) ) M(α) R = (R (1),..., R (n) ) R PK (α, ID) (α, ID) A KeyGen( ),Dec( ) 1 (PK) CT = Enc(PK, ID, M; R) CT I (M (i),r (i) ) i I R( ID, M, I, out A ) I A KeyGen( ),Dec( ) 2 ( CT) out A A KeyGen( ),Dec( ) 3 (( M (i), R (i) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 7 / 34
16 SIM-SO-CCA2 Security: Exp cca so real A,M,R (1 κ ) Challenger A = (A 1, A 2, A 3 ) (PK, MSK) Setup(1 κ ) M = (M (1),..., M (n) ) M(α) R = (R (1),..., R (n) ) R PK (α, ID) (α, ID) A KeyGen( ),Dec( ) 1 (PK) CT = Enc(PK, ID, M; R) CT I (M (i),r (i) ) i I R( ID, M, I, out A ) I A KeyGen( ),Dec( ) 2 ( CT) out A A KeyGen( ),Dec( ) 3 (( M (i), R (i) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 7 / 34
17 SIM-SO-CCA2 Security: Exp cca so real A,M,R (1 κ ) Challenger A = (A 1, A 2, A 3 ) (PK, MSK) Setup(1 κ ) M = (M (1),..., M (n) ) M(α) R = (R (1),..., R (n) ) R PK (α, ID) (α, ID) A KeyGen( ),Dec( ) 1 (PK) CT = Enc(PK, ID, M; R) CT I (M (i),r (i) ) i I R( ID, M, I, out A ) I A KeyGen( ),Dec( ) 2 ( CT) out A A KeyGen( ),Dec( ) 3 (( M (i), R (i) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 7 / 34
18 SIM-SO-CCA2 Security: Exp cca so ideal A,M,R (1 κ ) Challenger S = (S 1, S 2, S 3 ) (α, ID) (α, ID) S 1 (1 κ ) M = (M (1),..., M (n) ) M(α) I [n] I S 2 (1 M(i) ) (M (i) ) i I (( Out S S ) ) 3 M (i) i I R( ID, M, I, out S ) SIM-SO-CCA2 Security: PPT A, PPT R, PPT M, S such that [ Pr R( ] [ ID, M, I, out A ) = 1 Pr R( ID, M, I, out S ) = 1] is negligible. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 8 / 34
![PPT R, PPT M, S such that [ Pr R( ] [ ID, M, I, out A ) = 1 Pr R( ID, M, I, out S ) = 1] is negligible. Junzuo Lai, Robert H.](/docs-images/41/22614498/images/page_18.jpg "Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective")
19 SIM-SO-CCA2 Security: Exp cca so ideal A,M,R (1 κ ) Challenger S = (S 1, S 2, S 3 ) (α, ID) (α, ID) S 1 (1 κ ) M = (M (1),..., M (n) ) M(α) I [n] I S 2 (1 M(i) ) (M (i) ) i I (( Out S S ) ) 3 M (i) i I R( ID, M, I, out S ) SIM-SO-CCA2 Security: PPT A, PPT R, PPT M, S such that [ Pr R( ] [ ID, M, I, out A ) = 1 Pr R( ID, M, I, out S ) = 1] is negligible. unzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 8 / 34
![PPT R, PPT M, S such that [ Pr R( ] [ ID, M, I, out A ) = 1 Pr R( ID, M, I, out S ) = 1] is negligible. unzuo Lai, Robert H.](/docs-images/41/22614498/images/page_19.jpg "Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective")
20 How to get SIM-SO-CCA2 Security: the idea Challenger S = (S 1, S 2, S 3 ) (α, ID) (α, ID) S 1 (1 κ ) M = (M (1),..., M (n) ) I I S 2 (1 M(i) ) (M (i) ) i I Out S S 3 (( M (i) ) i I ) Aim: ( ID, M, I, out A ) c ( ID, M, I, out S ) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 9 / 34
21 How to get SIM-SO-CCA2 Security: the idea Challenger S = (S 1, S 2, S 3 ) (α, ID) (α, ID) S 1 (1 κ ) M M(α) M = (M (1),..., M (n) ) { (PK, MSK) Setup(1 κ ) (α, ID) A KeyGen,Dec( ) 1 (PK) } I I S 2 (1 M(i) ) Aim: (M (i) ) i I (( Out S S ) 3 M (i) i I ( ) ( ) ID, M, I, out A c ID, M, I, out S ) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 10 / 34
22 How to get SIM-SO-CCA2 Security: the idea Challenger S = (S 1, S 2, S 3 ) (α, ID) (α, ID) S 1 (1 κ ) M M(α) M = (M (1),..., M (n) ) Aim: { (PK, MSK) Setup(1 κ ) (α, ID) A KeyGen( ),Dec( ) 1 (PK) } I I S 2 (1 M(i) ) (M (i) ) i I {I A KeyGen( ),Dec( ) 2 ( CT) } (( Out S S ) ) 3 M (i) i I ( ID, M, I, out A ) c ( ID, M, I, out S ) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 11 / 34
23 How to get SIM-SO-CCA2 Security: the idea Challenger S = (S 1, S 2, S 3 ) (α, ID) (α, ID) S 1 (1 κ ) M M(α) M = (M (1),..., M (n) ) Aim: { (PK, MSK) Setup(1 κ ) (α, ID) A KeyGen( ),Dec( ) 1 (PK) } I I S 2 (1 M(i) ) (M (i) ) i I {I A KeyGen( ),Dec( ) 2 ( CT) } (( Out S S ) ) 3 M (i) i I {Out A A KeyGen( ),Dec( ) 3 ( ) ( ) ID, M, I, out A c ID, M, I, out S (( M (i), R (i)) i I ) } Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 12 / 34
24 SIM-SO-CPA Security for single bit messages IBE1 encrypts single bits. IBE1 is IND-ID-CPA secure. IBE1 is One-Sided Publicly Openable(1SPO). IBE1 is SIM-SO-CPA Secure. Definition 1 (1SPO-IBE1) Let C = Enc1(PK, ID, 0; R). Let Coins(PK, ID, C, 0) := {R C = IBE1.Enc(PK, ID, 0; R )}. An IBE1 scheme is One-Sided Publicly Openable if R POpen(PK, ID, C) outputs a random R in Coins(PK, ID, C, 0). Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 13 / 34
25 SIM-SO-CPA Security for single bit messages IBE1 encrypts single bits. IBE1 is IND-ID-CPA secure. IBE1 is One-Sided Publicly Openable(1SPO). IBE1 is SIM-SO-CPA Secure. Definition 1 (1SPO-IBE1) Let C = Enc1(PK, ID, 0; R). Let Coins(PK, ID, C, 0) := {R C = IBE1.Enc(PK, ID, 0; R )}. An IBE1 scheme is One-Sided Publicly Openable if R POpen(PK, ID, C) outputs a random R in Coins(PK, ID, C, 0). Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 13 / 34
26 SIM-SO-CPA Security for single bit messages C[0] = C[1] = C[0] C[0] C[1] C[0] opened with the original randomness opened with POpen opened with the original randomness opened with POpen Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 14 / 34
27 SIM-SO-CPA Security for multi-bit messages [BWY2011] M. Bellare, B. Waters, and S. Yilek. Identity-based encryption secure against selective opening attack. In TCC2011. IBE=(Setup, KeyGen, Enc, Dec) encrypting multi-bits. IBE.Setup=IBE1.Setup; IBE.KeyGen=IBE1.KeyGen; IBE.Enc: C 1 C 2... C l... IBE1.Enc IBE1.Enc... IBE1.Enc... m 1 (0/1) m 2 (0/1)... m l (0/1) CT = (C 1, C 2,..., C l ) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 15 / 34
28 SIM-SO-CPA Security for multi-bit messages M. Bellare, B. Waters, and S. Yilek. Identity-based encryption secure against selective opening attack. In TCC, pages 235õ252, C 1 C 2... C l IBE.Dec:... IBE1.Dec IBE1.Dec... IBE1.Dec... m 1 m 2... m l SIM-SO-CPA Security for multi-bit messages follows from the SIM-SO- CPA Security of single-bit by hybrid argument. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 16 / 34
29 SIM-SO-CPA Security for multi-bit messages M. Bellare, B. Waters, and S. Yilek. Identity-based encryption secure against selective opening attack. In TCC, pages 235õ252, C 1 C 2... C l IBE.Dec:... IBE1.Dec IBE1.Dec... IBE1.Dec... m 1 m 2... m l SIM-SO-CPA Security for multi-bit messages follows from the SIM-SO- CPA Security of single-bit by hybrid argument. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 16 / 34
30 SIM-SO-CCA2 Security for multi-bit messages 2-level IND-ID-CPA CHK Transform ============== IND-ID-CCA2. CHK Transform SIM-SO-CPA =========== SIM-SO-CCA2 The signing key of OTS might be disclosed in the opening! Bit-wise Encryption from 1-bit IND-ID-CCA secure 1SPO-IBE? C 1 C 2... C l... IBE.Enc: IBE1.Enc IBE1.Enc... IBE1.Enc... m 1 (0/1) m 2 (0/1)... m l (0/1) IBE is NOT CCA2 secure even if IBE1 is! Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 17 / 34
31 SIM-SO-CCA2 Security for multi-bit messages 2-level IND-ID-CPA CHK Transform ============== IND-ID-CCA2. CHK Transform SIM-SO-CPA =========== SIM-SO-CCA2 The signing key of OTS might be disclosed in the opening! Bit-wise Encryption from 1-bit IND-ID-CCA secure 1SPO-IBE? C 1 C 2... C l... IBE.Enc: IBE1.Enc IBE1.Enc... IBE1.Enc... m 1 (0/1) m 2 (0/1)... m l (0/1) IBE is NOT CCA2 secure even if IBE1 is! unzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 17 / 34
32 SIM-SO-CCA2 Security for multi-bit messages 2-level IND-ID-CPA CHK Transform ============== IND-ID-CCA2. CHK Transform SIM-SO-CPA =========== SIM-SO-CCA2 The signing key of OTS might be disclosed in the opening! Bit-wise Encryption from 1-bit IND-ID-CCA secure 1SPO-IBE? C 1 C 2... C l... IBE.Enc: IBE1.Enc IBE1.Enc... IBE1.Enc... m 1 (0/1) m 2 (0/1)... m l (0/1) IBE is NOT CCA2 secure even if IBE1 is! unzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 17 / 34
33 SIM-SO-CCA2 Security for multi-bit messages 2-level IND-ID-CPA CHK Transform ============== IND-ID-CCA2. CHK Transform SIM-SO-CPA =========== SIM-SO-CCA2 The signing key of OTS might be disclosed in the opening! Bit-wise Encryption from 1-bit IND-ID-CCA secure 1SPO-IBE? C 1 C 2... C l... IBE.Enc: IBE1.Enc IBE1.Enc... IBE1.Enc... m 1 (0/1) m 2 (0/1)... m l (0/1) IBE is NOT CCA2 secure even if IBE1 is! unzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 17 / 34
34 SIM-SO-CCA2: Our approach IBE.Enc: CT = (C 1, C 2,..., C l, T), T = XAuth(K 1,..., K l ). C 1, K 1 C 2, K 2... C l, K l... IBE ex.enc IBE ex.enc... IBE ex.enc... m 1 (0/1) m 2 (0/1)... m l (0/1) New Primitives: IBE ex and X-Authentication Code. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 18 / 34
35 SIM-SO-CCA2: Our approach IBE.Enc: CT = (C 1, C 2,..., C l, T), T = XAuth(K 1,..., K l ). C 1, K 1 C 2, K 2... C l, K l... IBE ex.enc IBE ex.enc... IBE ex.enc... m 1 (0/1) m 2 (0/1)... m l (0/1) New Primitives: IBE ex and X-Authentication Code. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 18 / 34
36 Extractable 1SPO-IBE Extractable 1SPO-IBE: IBE ex =(Setup ex,keygen ex, Enc ex, Dec ex ) IBE ex encrypts a single bit. IBE ex is One-Sided Publicly Openable. IBE ex also encapsulates a key, when encrypting 1. IBE ex is IND-ID-CCA2 secure, i.e, for random K, Enc ex (PK ex, ID, 1; R) c ( Enc ex (PK ex, ID, 0; R ), K ) (C, K) c (C, K ) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 19 / 34
37 Extractable 1SPO-IBE Extractable 1SPO-IBE: IBE ex =(Setup ex,keygen ex, Enc ex, Dec ex ) IBE ex encrypts a single bit. IBE ex is One-Sided Publicly Openable. IBE ex also encapsulates a key, when encrypting 1. IBE ex is IND-ID-CCA2 secure, i.e, for random K, Enc ex (PK ex, ID, 1; R) c ( Enc ex (PK ex, ID, 0; R ), K ) (C, K) c (C, K ) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 19 / 34
38 Extractable 1SPO-IBE Extractable 1SPO-IBE: IBE ex =(Setup ex,keygen ex, Enc ex, Dec ex ) IBE ex encrypts a single bit. IBE ex is One-Sided Publicly Openable. IBE ex also encapsulates a key, when encrypting 1. IBE ex is IND-ID-CCA2 secure, i.e, for random K, Enc ex (PK ex, ID, 1; R) c ( Enc ex (PK ex, ID, 0; R ), K ) (C, K) c (C, K ) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 19 / 34
39 Extractable 1SPO-IBE Extractable 1SPO-IBE: IBE ex =(Setup ex,keygen ex, Enc ex, Dec ex ) IBE ex encrypts a single bit. IBE ex is One-Sided Publicly Openable. IBE ex also encapsulates a key, when encrypting 1. IBE ex is IND-ID-CCA2 secure, i.e, for random K, Enc ex (PK ex, ID, 1; R) c ( Enc ex (PK ex, ID, 0; R ), K ) (C, K) c (C, K ) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 19 / 34
40 l-cross-authentication code [FHKW2010] S. Fehr, D. Hofheinz, E. Kiltz, and H. Wee. Encryption schemes secure against chosen-ciphertext selective opening attacks. In EUROCRYPT2010. l-cross-authentication code: l-xac=(xauth, XVer) T XAuth(K 1,..., K l ); 1/0 XVer(K, T); Correctness. fail XAC (κ) := Pr[XVer(K i, XAuth(K 1,..., K l )) 1], is negligible, where K 1,..., K l K in the probability. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 20 / 34
41 l-cross-authentication code [FHKW2010] S. Fehr, D. Hofheinz, E. Kiltz, and H. Wee. Encryption schemes secure against chosen-ciphertext selective opening attacks. In EUROCRYPT2010. l-cross-authentication code: l-xac=(xauth, XVer) T XAuth(K 1,..., K l ); 1/0 XVer(K, T); Correctness. fail XAC (κ) := Pr[XVer(K i, XAuth(K 1,..., K l )) 1], is negligible, where K 1,..., K l K in the probability. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 20 / 34
42 l-cross-authentication code [FHKW2010] S. Fehr, D. Hofheinz, E. Kiltz, and H. Wee. Encryption schemes secure against chosen-ciphertext selective opening attacks. In EUROCRYPT2010. l-cross-authentication code: l-xac=(xauth, XVer) T XAuth(K 1,..., K l ); 1/0 XVer(K, T); Correctness. fail XAC (κ) := Pr[XVer(K i, XAuth(K 1,..., K l )) 1], is negligible, where K 1,..., K l K in the probability. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 20 / 34
43 Security of l-cross-authentication code Security against impersonation and substitution attacks. Adv imp (κ) := max Pr[XVer(K, T ) = 1 K K] XAC T where the max is over all T XT, and Adv sub XAC (κ) := max Pr T K i K, T i,k i,f XVer(K i, T T := XAuth(K 1,..., K l ), ) = 1 T F(T) where the max is over all i [l], all K i = (K j ) j i K l 1 and all (possibly randomized) functions F : T T. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 21 / 34
44 Security of l-cross-authentication code Security against impersonation and substitution attacks. Adv imp (κ) := max Pr[XVer(K, T ) = 1 K K] XAC T where the max is over all T XT, and Adv sub XAC (κ) := max Pr T K i K, T i,k i,f XVer(K i, T T := XAuth(K 1,..., K l ), ) = 1 T F(T) where the max is over all i [l], all K i = (K j ) j i K l 1 and all (possibly randomized) functions F : T T. unzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 21 / 34
45 Properties of l-xac Definition 2 (Strong and semi-unique l-xac.) Strongness: K 1,..., K l K. T XAuth(K 1,..., K l ). Given i, (K j ) j i and T, ˆK i ReSamp(K i, T) such that, conditioned on (K j ) j i and T, ˆK i s Ki. Semi-Uniqueness: The key space K = K a K b. Given tag T and K a K a, there exists at most one K b K b such that XVer((K a, K b ), T) = 1. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 22 / 34
46 Construction from Extractable 1SPO-IBE and XAC Construct IBE=(Setup, KeyGen, Enc, Dec) from (l + 1)-XAC=(XAuth, XVer) IBE ex =(Setup ex,keygen ex, Enc ex, Dec ex ) Setup(1 κ ) : (PK ex, MSK ex ) Setup ex (1 κ ). l { }} { K a K a and H : ID C C K b. PK = (PK ex, H, K a ), MSK = MSK ex. KeyGen(PK, MSK, ID) : SK ID KeyGen ex (PK ex, MSK ex, ID). Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 23 / 34
47 Construction from Extractable 1SPO-IBE and XAC Construct IBE=(Setup, KeyGen, Enc, Dec) from (l + 1)-XAC=(XAuth, XVer) IBE ex =(Setup ex,keygen ex, Enc ex, Dec ex ) Setup(1 κ ) : (PK ex, MSK ex ) Setup ex (1 κ ). l { }} { K a K a and H : ID C C K b. PK = (PK ex, H, K a ), MSK = MSK ex. KeyGen(PK, MSK, ID) : SK ID KeyGen ex (PK ex, MSK ex, ID). Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 23 / 34
48 Construction from Extractable 1SPO-IBE and XAC Construct IBE=(Setup, KeyGen, Enc, Dec) from (l + 1)-XAC=(XAuth, XVer) IBE ex =(Setup ex,keygen ex, Enc ex, Dec ex ) Setup(1 κ ) : (PK ex, MSK ex ) Setup ex (1 κ ). l { }} { K a K a and H : ID C C K b. PK = (PK ex, H, K a ), MSK = MSK ex. KeyGen(PK, MSK, ID) : SK ID KeyGen ex (PK ex, MSK ex, ID). Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 23 / 34
49 Construction Enc(PK, ID, M) : To encrypt a message M = m 1 m l {0, 1} l (C i, K i ) Enc ex (PK ex, ID, 1) if m i = 1, C i Enc ex (PK ex, ID, 0), K i K if m i = 0 K l+1 = (K a, K b ), where K b = H(ID, C 1,..., C l ), T = XAuth(K 1,..., K l+1 ). CT = (C 1,..., C l, T). Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 24 / 34
50 Construction Enc(PK, ID, M) : To encrypt a message M = m 1 m l {0, 1} l (C i, K i ) Enc ex (PK ex, ID, 1) if m i = 1, C i Enc ex (PK ex, ID, 0), K i K if m i = 0 K l+1 = (K a, K b ), where K b = H(ID, C 1,..., C l ), T = XAuth(K 1,..., K l+1 ). CT = (C 1,..., C l, T). Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 24 / 34
51 Construction Enc(PK, ID, M) : To encrypt a message M = m 1 m l {0, 1} l (C i, K i ) Enc ex (PK ex, ID, 1) if m i = 1, C i Enc ex (PK ex, ID, 0), K i K if m i = 0 K l+1 = (K a, K b ), where K b = H(ID, C 1,..., C l ), T = XAuth(K 1,..., K l+1 ). CT = (C 1,..., C l, T). Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 24 / 34
52 Construction Enc(PK, ID, M) : To encrypt a message M = m 1 m l {0, 1} l (C i, K i ) Enc ex (PK ex, ID, 1) if m i = 1, C i Enc ex (PK ex, ID, 0), K i K if m i = 0 K l+1 = (K a, K b ), where K b = H(ID, C 1,..., C l ), T = XAuth(K 1,..., K l+1 ). CT = (C 1,..., C l, T). Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 24 / 34
53 Construction Dec(PK, SK ID, CT) : To decrypt CT = (C 1,..., C l, T), K b = H(ID, C 1,..., C l ); Set K l+1 = (K a, K b ) l XVer(K l+1, T) = 1? If not, output {}}{ M = 0 0. Otherwise, for i [l], and sets (m i, K i ) Dec ex(pk ex, SK ID, C i ) m i = XVer(K i, T) Outputs the message M = m 1 m l. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 25 / 34
54 Construction Dec(PK, SK ID, CT) : To decrypt CT = (C 1,..., C l, T), K b = H(ID, C 1,..., C l ); Set K l+1 = (K a, K b ) l XVer(K l+1, T) = 1? If not, output {}}{ M = 0 0. Otherwise, for i [l], and sets (m i, K i ) Dec ex(pk ex, SK ID, C i ) m i = XVer(K i, T) Outputs the message M = m 1 m l. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 25 / 34
55 Construction Dec(PK, SK ID, CT) : To decrypt CT = (C 1,..., C l, T), K b = H(ID, C 1,..., C l ); Set K l+1 = (K a, K b ) l XVer(K l+1, T) = 1? If not, output {}}{ M = 0 0. Otherwise, for i [l], and sets (m i, K i ) Dec ex(pk ex, SK ID, C i ) m i = XVer(K i, T) Outputs the message M = m 1 m l. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 25 / 34
56 Construction Dec(PK, SK ID, CT) : To decrypt CT = (C 1,..., C l, T), K b = H(ID, C 1,..., C l ); Set K l+1 = (K a, K b ) l XVer(K l+1, T) = 1? If not, output {}}{ M = 0 0. Otherwise, for i [l], and sets (m i, K i ) Dec ex(pk ex, SK ID, C i ) m i = XVer(K i, T) Outputs the message M = m 1 m l. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 25 / 34
57 Simulator Challenger S = (S 1, S 2, S 3 ) M M(α) = (M (1),..., M (n) ) (α, ID) (α, ID) S 1 (1 κ ) { (PK, MSK) Setup(1 κ ) (α, ID) A KeyGen,Dec( ) 1 (PK) } l I {}}{ I S 2 (1 M(i) ) { CT (i) = Enc(PK, ID (i), 1 1), I A KeyGen,Dec( ) 2 ( CT) } (M (i) ) i I (( Out S S ) ) 3 M (i) { If m (i) i I j = 0, ReSamp(K (i) j, T) ˆK (i) j R (i) j ( POpen(PK, ID, C (i) j ), ˆK (i) ) j Out A A KeyGen,Dec( ) (( 3 M (i), R (i)) ) } i I Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 26 / 34
58 Security Proof: Hybrid Argument Suppose that the first challenger ciphertext is CT = (C 1, C 2, C 3, T). Game 0: C 1 [m 1 ] C 2 [m 2 ] C 3 [m 3 ] T = XAuth(K 1, K 2, K 3, K 4 ) Game 1: C 1 [1] C 2 [m 2 ] C 3 [m 3 ] T = XAuth(K 1, K 2, K 3, K 4 ) Game 2: C 1 [1] C 2 [1] C 3 [m 3 ] T = XAuth(K 1, K 2, K 3, K 4 ) Game 3: C 1 [1] C 2 [1] C 3 [1] T = XAuth(K 1, K 2, K 3, K 4 ) The green parts will be opened with POpen and ReSample. We will prove that Game 0 c Game 1 c Game 2 c Game 3. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 27 / 34
59 Security Proof: Hybrid Argument ( Game 1 c Game 2) if m 2 = 1, Game 1 = Game 2; if m 2 = 0, reduction to the IND-ID-CCA2 security of IBE ex. The IND-ID-CCA2 adversary B KeyGen ex,dec ex (ID, C, K ) for IBE ex prepares the challenge ciphertext Game 1: C 1 [1] C 2 [0] C 3 [m 3 ] T = XAuth(K 1, K 2, K 3, K 4 ) Game: C 1 [1] C C 3 [m 3 ] T = XAuth(K 1, K, K 3, K 4 ) Game 2: C 1 [1] C 2 [1] C 3 [m 3 ] T = XAuth(K 1, K 2, K 3, K 4 ) It opens C with ˆK ReSamp(K 1, K 3, K 4, T), R 2 ( POpen(PK, ID, C ), ˆK ) Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 28 / 34
60 Security Proof: Hybrid Argument B KeyGen ex,dec ex (ID, C, K ) answers A s queries his own oracles KeyGen ex ( ), Dec ex ( ) except A s Dec query for CT = ( C 1,..., C l, T ) under ID and C j = C. In this case B KeyGen ex,dec ex (ID, C, K ) answers with m j = XVer(K, T). If (C, K ) is an encryption of 1, then m j = XVer(K, T) matches the decryption algorithm. If C is an encryption of 0, then K is random, and XVer(K, T) = 0 except with probability Adv sub XAC (κ). Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 29 / 34
61 Security Proof: Hybrid Argument B KeyGen ex,dec ex (ID, C, K ) answers A s queries his own oracles KeyGen ex ( ), Dec ex ( ) except A s Dec query for CT = ( C 1,..., C l, T ) under ID and C j = C. In this case B KeyGen ex,dec ex (ID, C, K ) answers with m j = XVer(K, T). If (C, K ) is an encryption of 1, then m j = XVer(K, T) matches the decryption algorithm. If C is an encryption of 0, then K is random, and XVer(K, T) = 0 except with probability Adv sub XAC (κ). unzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 29 / 34
62 Security Proof: Hybrid Argument B KeyGen ex,dec ex (ID, C, K ) answers A s queries his own oracles KeyGen ex ( ), Dec ex ( ) except A s Dec query for CT = ( C 1,..., C l, T ) under ID and C j = C. In this case B KeyGen ex,dec ex (ID, C, K ) answers with m j = XVer(K, T). If (C, K ) is an encryption of 1, then m j = XVer(K, T) matches the decryption algorithm. If C is an encryption of 0, then K is random, and XVer(K, T) = 0 except with probability Adv sub XAC (κ). unzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 29 / 34
63 Security Proof: Hybrid Argument Since CT CT (i) for i [n], then we have T T (i), due to the collision resistance of H and semi-unique property of XAC. The Resamplable property of XAC ensures that K is not disclosed during the corruption. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 30 / 34
64 Construction of extractable 1SPO-IBEs We construct two one-bit 1SPO-IBEs, one based on the anonymous extension of Lewko-Waters IBE scheme by De Caro, Iovino and Persiano and the other based on the Boyen-Waters anonymous IBE. Both schemes rely on a pairing e : G G G T. The 1SPO property of the two one-bit IBE schemes is guaranteed by the fact that G is an efficiently samplable and explainable domain, which is characterized by two PPT algorithms Sample and Sample 1 for group G. The IND-ID-CCA2 security of extractable 1SPO-IBEs makes use of 2-hierarchical IBE technique. The construction of XAC follows that in [FKHW10]. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 31 / 34
65 Conclusion We introduced a new primitive extractable IBE, defined its IND- ID-CCA security, and proposed two instantications; Combined with strengthened Cross Authentication Code, we construct the first IBE with SIM-SO-CCA2 security. Junzuo Lai, Robert H. Deng, Shengli Liu, JianIdentity-Based Weng, and Yunlei Encryption Zhao (SJTU-CIS) Secure Against Chosen-Ciphertext Selective Opening Attack 32 / 34
MESSAGE AUTHENTICATION IN AN IDENTITY-BASED ENCRYPTION SCHEME: 1-KEY-ENCRYPT-THEN-MAC
MESSAGE AUTHENTICATION IN AN IDENTITY-BASED ENCRYPTION SCHEME: 1-KEY-ENCRYPT-THEN-MAC by Brittanney Jaclyn Amento A Thesis Submitted to the Faculty of The Charles E. Schmidt College of Science in Partial
Definitions for Predicate Encryption
Definitions for Predicate Encryption Giuseppe Persiano Dipartimento di Informatica, Università di Salerno, Italy giuper@dia.unisa.it Thursday 12 th April, 2012 Cryptographic Proofs 1 Content Results on
Identity-based Encryption with Post-Challenge Auxiliary Inputs for Secure Cloud Applications and Sensor Networks
Identity-based Encryption with Post-Challenge Auxiliary Inputs for Secure Cloud Applications and Sensor Networks Tsz Hon Yuen - Huawei, Singapore Ye Zhang - Pennsylvania State University, USA Siu Ming
Anonymity and Time in Public-Key Encryption
Anonymity and Time in Public-Key Encryption Elizabeth Anne Quaglia Thesis submitted to the University of London for the degree of Doctor of Philosophy Information Security Group Department of Mathematics
Identity-Based Encryption Secure Against Selective Opening Attack
Identity-Based Encryption Secure Against Selective Opening Attack Mihir Bellare 1, Brent Waters 2, and Scott Yilek 3 1 Department of Computer Science and Engineering, University of California San Diego,
Lecture 10: CPA Encryption, MACs, Hash Functions. 2 Recap of last lecture - PRGs for one time pads
CS 7880 Graduate Cryptography October 15, 2015 Lecture 10: CPA Encryption, MACs, Hash Functions Lecturer: Daniel Wichs Scribe: Matthew Dippel 1 Topic Covered Chosen plaintext attack model of security MACs
Identity-Based Encryption from the Weil Pairing
Appears in SIAM J. of Computing, Vol. 32, No. 3, pp. 586-615, 2003. An extended abstract of this paper appears in the Proceedings of Crypto 2001, volume 2139 of Lecture Notes in Computer Science, pages
CryptoVerif Tutorial
CryptoVerif Tutorial Bruno Blanchet INRIA Paris-Rocquencourt bruno.blanchet@inria.fr November 2014 Bruno Blanchet (INRIA) CryptoVerif Tutorial November 2014 1 / 14 Exercise 1: preliminary definition SUF-CMA
Multi-Input Functional Encryption for Unbounded Arity Functions
Multi-Input Functional Encryption for Unbounded Arity Functions Saikrishna Badrinarayanan, Divya Gupta, Abhishek Jain, and Amit Sahai Abstract. The notion of multi-input functional encryption (MI-FE) was
Controlled Functional Encryption
Controlled Functional Encryption Muhammad Naveed 1, Shashank Agrawal 1, Manoj Prabhakaran 1, Xiaofeng Wang 2, Erman Ayday 3, Jean-Pierre Hubaux 3 and Carl A. Gunter 1 1 University of Illinois at Urbana-Champaign
New Efficient Searchable Encryption Schemes from Bilinear Pairings
International Journal of Network Security, Vol.10, No.1, PP.25 31, Jan. 2010 25 New Efficient Searchable Encryption Schemes from Bilinear Pairings Chunxiang Gu and Yuefei Zhu (Corresponding author: Chunxiang
On the Achievability of Simulation-Based Security for Functional Encryption
On the Achievability of Simulation-Based Security for Functional Encryption Angelo De Caro 1, Vincenzo Iovino 2, Abhishek Jain 3, Adam O Neill 4, Omer Paneth 4, and Giuseppe Persiano 2 1 NTT Secure Platform
Certificate Based Signature Schemes without Pairings or Random Oracles
Certificate Based Signature Schemes without Pairings or Random Oracles p. 1/2 Certificate Based Signature Schemes without Pairings or Random Oracles Joseph K. Liu, Joonsang Baek, Willy Susilo and Jianying
CS558. Network Security. Boston University, Computer Science. Midterm Spring 2014.
CS558. Network Security. Boston University, Computer Science. Midterm Spring 2014. Instructor: Sharon Goldberg March 25, 2014. 9:30-10:50 AM. One-sided handwritten aid sheet allowed. No cell phone or calculators
Function Private Functional Encryption and Property Preserving Encryption : New Definitions and Positive Results
Function Private Functional Encryption and Property Preserving Encryption : New Definitions and Positive Results Shashank Agrawal Shweta Agrawal Saikrishna Badrinarayanan Abishek Kumarasubramanian Manoj
Chosen-Ciphertext Security from Identity-Based Encryption
Chosen-Ciphertext Security from Identity-Based Encryption Dan Boneh Ran Canetti Shai Halevi Jonathan Katz Abstract We propose simple and efficient CCA-secure public-key encryption schemes (i.e., schemes
Chapter 11. Asymmetric Encryption. 11.1 Asymmetric encryption schemes
Chapter 11 Asymmetric Encryption The setting of public-key cryptography is also called the asymmetric setting due to the asymmetry in key information held by the parties. Namely one party has a secret
Digital Signatures. Prof. Zeph Grunschlag
Digital Signatures Prof. Zeph Grunschlag (Public Key) Digital Signatures PROBLEM: Alice would like to prove to Bob, Carla, David,... that has really sent them a claimed message. E GOAL: Alice signs each
Authentication and Encryption: How to order them? Motivation
Authentication and Encryption: How to order them? Debdeep Muhopadhyay IIT Kharagpur Motivation Wide spread use of internet requires establishment of a secure channel. Typical implementations operate in
Lecture 9 - Message Authentication Codes
Lecture 9 - Message Authentication Codes Boaz Barak March 1, 2010 Reading: Boneh-Shoup chapter 6, Sections 9.1 9.3. Data integrity Until now we ve only been interested in protecting secrecy of data. However,
1 Domain Extension for MACs
CS 127/CSCI E-127: Introduction to Cryptography Prof. Salil Vadhan Fall 2013 Reading. Lecture Notes 17: MAC Domain Extension & Digital Signatures Katz-Lindell Ÿ4.34.4 (2nd ed) and Ÿ12.0-12.3 (1st ed).
Chosen-Ciphertext Security from Identity-Based Encryption
Chosen-Ciphertext Security from Identity-Based Encryption Dan Boneh Ran Canetti Shai Halevi Jonathan Katz June 13, 2006 Abstract We propose simple and efficient CCA-secure public-key encryption schemes
The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)
The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?) Hugo Krawczyk Abstract. We study the question of how to generically compose symmetric encryption and authentication
Non-Interactive CCA-Secure Threshold Cryptosystems with Adaptive Security: New Framework and Constructions
Non-Interactive CCA-Secure Threshold Cryptosystems with Adaptive Security: New Framework and Constructions Benoît Libert 1 and Moti Yung 2 1 Université catholique de Louvain, ICTEAM Institute (Belgium)
1 Message Authentication
Theoretical Foundations of Cryptography Lecture Georgia Tech, Spring 200 Message Authentication Message Authentication Instructor: Chris Peikert Scribe: Daniel Dadush We start with some simple questions
Professor Radha Poovendran EE Department, University of Washington, Seattle, WA & Professor Dawn Song EECS Department, University of California,
Professor Radha Poovendran EE Department, University of Washington, Seattle, WA & Professor Dawn Song EECS Department, University of California, Berkeley, CA 1 Summer School Objectives Exposure to current
Foundations of Group Signatures: The Case of Dynamic Groups
A preliminary version of this paper appears in Topics in Cryptology CT-RSA 05, Lecture Notes in Computer Science Vol.??, A. Menezes ed., Springer-Verlag, 2005. This is the full version. Foundations of
Authenticated encryption
Authenticated encryption Dr. Enigma Department of Electrical Engineering & Computer Science University of Central Florida wocjan@eecs.ucf.edu October 16th, 2013 Active attacks on CPA-secure encryption
Provable-Security Analysis of Authenticated Encryption in Kerberos
Provable-Security Analysis of Authenticated Encryption in Kerberos Alexandra Boldyreva Virendra Kumar Georgia Institute of Technology, School of Computer Science 266 Ferst Drive, Atlanta, GA 30332-0765
1 Signatures vs. MACs
CS 120/ E-177: Introduction to Cryptography Salil Vadhan and Alon Rosen Nov. 22, 2006 Lecture Notes 17: Digital Signatures Recommended Reading. Katz-Lindell 10 1 Signatures vs. MACs Digital signatures
Adaptively-Secure, Non-Interactive Public-Key Encryption
Adaptively-Secure, Non-Interactive Public-Key Encryption Ran Canetti 1, Shai Halevi 1, and Jonathan Katz 2 1 IBM T.J. Watson Research Center, NY, USA. 2 Department of Computer Science, University of Maryland.
Recongurable Cryptography: A exible approach to long-term security
Recongurable Cryptography: A exible approach to long-term security Julia Hesse and Dennis Hofheinz and Andy Rupp Karlsruhe Institute of Technology, Germany {julia.hesse, dennis.hofheinz, andy.rupp}@kit.edu
Efficient Certificate-Based Encryption Scheme Secure Against Key Replacement Attacks in the Standard Model *
JOURNAL OF INFORMATION SCIENCE AND ENGINEERING 0, 55-568 (04) Efficient Certificate-Based Encryption Scheme Secure Against Key Replacement Attacks in the Standard Model * College of Computer and Information
Wildcarded Identity-Based Encryption
Wildcarded Identity-Based Encryption Michel Abdalla 1, James Birkett 2, Dario Catalano 3, Alexander W. Dent 4, John Malone-Lee 5, Gregory Neven 6,7, Jacob C. N. Schuldt 8, and Nigel P. Smart 9 1 Ecole
Lecture 2 August 29, 13:40 15:40
Lecture 2 August 29, 13:40 15:40 Public-key encryption with keyword search Anonymous identity-based encryption Identity-based encryption with wildcards Public-key encryption with keyword search & anonymous
Identity-Based Encryption from Lattices in the Standard Model
Identity-Based Encryption from Lattices in the Standard Model Shweta Agrawal and Xavier Boyen Preliminary version July 20, 2009 Abstract. We construct an Identity-Based Encryption (IBE) system without
Privacy in Encrypted Content Distribution Using Private Broadcast Encryption
Privacy in Encrypted Content Distribution Using Private Broadcast Encryption Adam Barth 1, Dan Boneh 1, and Brent Waters 2 1 Stanford University, Stanford, CA 94305 {abarth, dabo}@cs.stanford.edu 2 SRI
Computational Soundness of Symbolic Security and Implicit Complexity
Computational Soundness of Symbolic Security and Implicit Complexity Bruce Kapron Computer Science Department University of Victoria Victoria, British Columbia NII Shonan Meeting, November 3-7, 2013 Overview
CIS 5371 Cryptography. 8. Encryption --
CIS 5371 Cryptography p y 8. Encryption -- Asymmetric Techniques Textbook encryption algorithms In this chapter, security (confidentiality) is considered in the following sense: All-or-nothing secrecy.
Multi-Channel Broadcast Encryption
Multi-Channel Broadcast Encryption Duong Hieu Phan 1,2, David Pointcheval 2, and Viet Cuong Trinh 1 1 LAGA, University of Paris 8 2 ENS / CNRS / INRIA Abstract. Broadcast encryption aims at sending a content
MTAT.07.003 Cryptology II. Digital Signatures. Sven Laur University of Tartu
MTAT.07.003 Cryptology II Digital Signatures Sven Laur University of Tartu Formal Syntax Digital signature scheme pk (sk, pk) Gen (m, s) (m,s) m M 0 s Sign sk (m) Ver pk (m, s)? = 1 To establish electronic
1 Digital Signatures. 1.1 The RSA Function: The eth Power Map on Z n. Crypto: Primitives and Protocols Lecture 6.
1 Digital Signatures A digital signature is a fundamental cryptographic primitive, technologically equivalent to a handwritten signature. In many applications, digital signatures are used as building blocks
Digital Signatures. What are Signature Schemes?
Digital Signatures Debdeep Mukhopadhyay IIT Kharagpur What are Signature Schemes? Provides message integrity in the public key setting Counter-parts of the message authentication schemes in the public
Securing Remote Access Inside Wireless Mesh Networks
This is the full version of the paper which appears in: Information Security Applications: 10th International Workshop, WISA 2009, Busan, Korea, August 25-27, 2009. H. Y. Youm, M. Yung (Eds.) Springer-Verlag,
Efficient File Sharing in Electronic Health Records
Efficient File Sharing in Electronic Health Records Clémentine Gritti, Willy Susilo and Thomas Plantard University of Wollongong, Australia 27/02/2015 1/20 Outline for Section 1 1 Introduction 2 Solution
1 Construction of CCA-secure encryption
CSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong 10 October 2012 1 Construction of -secure encryption We now show how the MAC can be applied to obtain a -secure encryption scheme.
Security/Privacy Models for "Internet of things": What should be studied from RFID schemes? Daisuke Moriyama and Shin ichiro Matsuo NICT, Japan
Security/Privacy Models for "Internet of things": What should be studied from RFID schemes? Daisuke Moriyama and Shin ichiro Matsuo NICT, Japan 1 Internet of Things (IoT) CASAGRAS defined that: A global
Verifiable Outsourced Computations Outsourcing Computations to Untrusted Servers
Outsourcing Computations to Untrusted Servers Security of Symmetric Ciphers in Network Protocols ICMS, May 26, 2015, Edinburgh Problem Motivation Problem Motivation Problem Motivation Problem Motivation
Message Authentication Code
Message Authentication Code Ali El Kaafarani Mathematical Institute Oxford University 1 of 44 Outline 1 CBC-MAC 2 Authenticated Encryption 3 Padding Oracle Attacks 4 Information Theoretic MACs 2 of 44
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE. Mihir Bellare UCSD 1
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE Mihir Bellare UCSD 1 The public key setting Alice M D sk[a] (C) Bob pk[a] C C $ E pk[a] (M) σ $ S sk[a] (M) M, σ Vpk[A] (M, σ) Bob can: send encrypted data
Identity-Based Encryption
Identity-Based ryption Gregory Neven IBM Zurich Research Laboratory gone WILD Public-key encryption PKI pk KeyGen sk M Dec M Sender (pk) Receiver (sk) 2 1 Identity-based encryption (IBE) [S84] Goal: Allow
Lecture 3: One-Way Encryption, RSA Example
ICS 180: Introduction to Cryptography April 13, 2004 Lecturer: Stanislaw Jarecki Lecture 3: One-Way Encryption, RSA Example 1 LECTURE SUMMARY We look at a different security property one might require
Lecture 5 - CPA security, Pseudorandom functions
Lecture 5 - CPA security, Pseudorandom functions Boaz Barak October 2, 2007 Reading Pages 82 93 and 221 225 of KL (sections 3.5, 3.6.1, 3.6.2 and 6.5). See also Goldreich (Vol I) for proof of PRF construction.
Separations in Circular Security for Arbitrary Length Key Cycles. Venkata Koppula! Kim Ramchen! Brent Waters
Separations in Circular Security for Arbitrary Length Key Cycles Venkata Koppula! Kim Ramchen! Brent Waters Circular Security Circular Security Circular Security Choose pk, sk! Encrypt using pk! Circular
MACs Message authentication and integrity. Table of contents
MACs Message authentication and integrity Foundations of Cryptography Computer Science Department Wellesley College Table of contents Introduction MACs Constructing Secure MACs Secure communication and
Cryptography for the Cloud
Cryptography for the Cloud ENS - CNRS - INRIA Cyber-Sécurité - SPECIF CNAM, Paris, France - November 7th, 2014 The Cloud Introduction 2 Access from Anywhere Introduction 3 Available for Everything One
Advanced Cryptography
Family Name:... First Name:... Section:... Advanced Cryptography Final Exam July 18 th, 2006 Start at 9:15, End at 12:00 This document consists of 12 pages. Instructions Electronic devices are not allowed.
Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption
Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption Ronald Cramer Victor Shoup December 12, 2001 Abstract We present several new and fairly practical public-key
SYMMETRIC ENCRYPTION. Mihir Bellare UCSD 1
SYMMETRIC ENCRYPTION Mihir Bellare UCSD 1 Syntax A symmetric encryption scheme SE = (K,E,D) consists of three algorithms: K and E may be randomized, but D must be deterministic. Mihir Bellare UCSD 2 Correct
Multi-Recipient Encryption Schemes: Efficient Constructions and their Security
This is the full version of the paper with same title that appeared in IEEE Transactions on Information Theory, Volume 53, Number 11, 2007. It extends the previously published versions Ku, BBS. Multi-Recipient
Provably Secure Timed-Release Public Key Encryption
Provably Secure Timed-Release Public Key Encryption JUNG HEE CHEON Seoul National University, Korea and NICHOLAS HOPPER, YONGDAE KIM and IVAN OSIPKOV University of Minnesota - Twin Cities A timed-release
The Feasibility of SET-IBS and SET-IBOOS Protocols in Cluster-Based Wireless Sensor Network
The Feasibility of SET-IBS and SET-IBOOS Protocols in Cluster-Based Wireless Sensor Network R.Anbarasi 1, S.Gunasekaran 2 P.G. Student, Department of Computer Engineering, V.S.B Engineering College, Karur,
Introduction. Digital Signature
Introduction Electronic transactions and activities taken place over Internet need to be protected against all kinds of interference, accidental or malicious. The general task of the information technology
A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem
A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem Jintai Ding, Xiang Xie, Xiaodong Lin University of Cincinnati Chinese Academy of Sciences Rutgers University Abstract.
Secure Single Sign-on Schemes Constructed from Nominative Signatures
Secure Single Sign-on Schemes Constructed from Nominative Signatures Jingquan Wang, Guilin Wang, and Willy Susilo Center for Computer and Information Security Research School of Computer Science and Software
Cryptographic hash functions and MACs Solved Exercises for Cryptographic Hash Functions and MACs
Cryptographic hash functions and MACs Solved Exercises for Cryptographic Hash Functions and MACs Enes Pasalic University of Primorska Koper, 2014 Contents 1 Preface 3 2 Problems 4 2 1 Preface This is a
Authenticated Encryption: Relations among notions and analysis of the generic composition paradigm
An extended abstract of this paper appears in Tatsuaki Okamoto, editor, Advances in Cryptology ASIACRYPT 2000, Volume 1976 of Lecture Notes in Computer Science, pages 531 545, Kyoto, Japan, December 3
Simple and Efficient Public-Key Encryption from Computational Diffie-Hellman in the Standard Model
Simple and Efficient Public-Key Encryption from Computational Diffie-Hellman in the Standard Model Kristiyan Haralambiev 1 Tibor Jager 2 Eike Kiltz 3 Victor Shoup 4 Abstract This paper proposes practical
MAC. SKE in Practice. Lecture 5
MAC. SKE in Practice. Lecture 5 Active Adversary Active Adversary An active adversary can inject messages into the channel Active Adversary An active adversary can inject messages into the channel Eve
Secure Group Oriented Data Access Model with Keyword Search Property in Cloud Computing Environment
Secure Group Oriented Data Access Model with Keyword Search Property in Cloud Computing Environment Chih Hung Wang Computer Science and Information Engineering National Chiayi University Chiayi City 60004,
3-6 Toward Realizing Privacy-Preserving IP-Traceback
3-6 Toward Realizing Privacy-Preserving IP-Traceback The IP-traceback technology enables us to trace widely spread illegal users on Internet. However, to deploy this attractive technology, some problems
Public Key Encryption with Keyword Search Revisited
Public Key Encryption with Keyword Search Revisited Joonsang Baek, Reihaneh Safiavi-Naini,Willy Susilo University of Wollongong Northfields Avenue Wollongong NSW 2522, Australia Abstract The public key
Network Security CS 5490/6490 Fall 2015 Lecture Notes 8/26/2015
Network Security CS 5490/6490 Fall 2015 Lecture Notes 8/26/2015 Chapter 2: Introduction to Cryptography What is cryptography? It is a process/art of mangling information in such a way so as to make it
Keywords: Authentication, Third party audit, cloud storage, cloud service provider, Access control.
Volume 5, Issue 3, March 2015 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com Identity Based
Talk announcement please consider attending!
Talk announcement please consider attending! Where: Maurer School of Law, Room 335 When: Thursday, Feb 5, 12PM 1:30PM Speaker: Rafael Pass, Associate Professor, Cornell University, Topic: Reasoning Cryptographically
CS155. Cryptography Overview
CS155 Cryptography Overview Cryptography Is n A tremendous tool n The basis for many security mechanisms Is not n The solution to all security problems n Reliable unless implemented properly n Reliable
Lecture 13: Message Authentication Codes
Lecture 13: Message Authentication Codes Last modified 2015/02/02 In CCA security, the distinguisher can ask the library to decrypt arbitrary ciphertexts of its choosing. Now in addition to the ciphertexts
Non-Interactive CCA-Secure Threshold Cryptosystems with Adaptive Security: New Framework and Constructions
Non-Interactive CCA-Secure Threshold Cryptosystems with Adaptive Security: New Framework and Constructions Benoît Libert 1 and Moti Yung 2 1 Université catholique de Louvain, ICTEAM Institute (Belgium)
Leakage-Resilient Authentication and Encryption from Symmetric Cryptographic Primitives
Leakage-Resilient Authentication and Encryption from Symmetric Cryptographic Primitives Olivier Pereira Université catholique de Louvain ICTEAM Crypto Group B-1348, Belgium olivier.pereira@uclouvain.be
Symmetric Crypto MAC. Pierre-Alain Fouque
Symmetric Crypto MAC Pierre-Alain Fouque Birthday Paradox In a set of D elements, by picking at random D elements, we have with high probability a collision two elements are equal D=365, about 23 people
Chapter 2 TSAS: Third-Party Storage Auditing Service
Chapter 2 TSAS: Third-Party Storage Auditing Service Abstract In cloud storage systems, data owners host their data on cloud servers and users (data consumers) can access the data from cloud servers Due
Chapter 12. Digital signatures. 12.1 Digital signature schemes
Chapter 12 Digital signatures In the public key setting, the primitive used to provide data integrity is a digital signature scheme. In this chapter we look at security notions and constructions for this
Victor Shoup Avi Rubin. fshoup,rubing@bellcore.com. Abstract
Session Key Distribution Using Smart Cards Victor Shoup Avi Rubin Bellcore, 445 South St., Morristown, NJ 07960 fshoup,rubing@bellcore.com Abstract In this paper, we investigate a method by which smart
Ciphertext verification security of symmetric encryption schemes
www.scichina.com info.scichina.com www.springerlink.com Ciphertext verification security of symmetric encryption schemes HU ZhenYu 1, SUN FuChun 1 & JIANG JianChun 2 1 National Laboratory of Information
Searchable Encryption Revisited: Consistency Properties, Relation to Anonymous IBE, and Extensions
An extended abstract of this paper appears in Victor Shoup, editor, Advances in Cryptology CRYPTO 2005, Volume 3621 of Lecture Notes in Computer Science, pages 205 222, Santa Barbara, California, August
Secure Large-Scale Bingo
Secure Large-Scale Bingo Antoni Martínez-Ballesté, Francesc Sebé and Josep Domingo-Ferrer Universitat Rovira i Virgili, Dept. of Computer Engineering and Maths, Av. Països Catalans 26, E-43007 Tarragona,
Chosen-Ciphertext Security from Identity-Based Encryption
Chosen-Ciphertext Security from Identity-Based Encryption Ran Canetti 1, Shai Halevi 1, and Jonathan Katz 2 1 IBM T. J. Watson Research Center, Hawthorne, NY. {canetti,shaih}@watson.ibm.com 2 Dept. of
Sample or Random Security A Security Model for Segment-Based Visual Cryptography
Sample or Random Security A Security Model for Segment-Based Visual Cryptography Sebastian Pape Dortmund Technical University March 5th, 2014 Financial Cryptography and Data Security 2014 Sebastian Pape
Public Key Encryption that Allows PIR Queries
Public Key Encryption that Allows PIR Queries Dan Boneh Eyal Kushilevitz Rafail Ostrovsky William E Skeith III Appeared at CRYPTO 2007: 50-67 Abstract Consider the following problem: Alice wishes to maintain
Information Security Theory vs. Reality
Information Security Theory vs. Reality 0368-4474-01, Winter 2011 Lecture 14: More on vulnerability and exploits, Fully homomorphic encryption Eran Tromer Slides credit: Vinod Vaikuntanathan (U. Toronto)
Privacy, Discovery, and Authentication for the Internet of Things
Privacy, Discovery, and Authentication for the Internet of Things David Wu Joint work with Ankur Taly, Asim Shankar, and Dan Boneh The Internet of Things (IoT) Lots of smart devices, but only useful if
Semantic Security for the McEliece Cryptosystem without Random Oracles
Semantic Security for the McEliece Cryptosystem without Random Oracles Ryo Nojima 1, Hideki Imai 23, Kazukuni Kobara 3, and Kirill Morozov 3 1 National Institute of Information and Communications Technology
Identity-based Encryption with Efficient Revocation
A preliminary version of this paper appears in Proceedings of the 14th ACM Conference on Computer and Communications Security, CCS 2008, ACM Press, 2008. This is the full version. Identity-based Encryption
Cryptography and Network Security, PART IV: Reviews, Patches, and11.2012 Theory 1 / 53
Cryptography and Network Security, PART IV: Reviews, Patches, and Theory Timo Karvi 11.2012 Cryptography and Network Security, PART IV: Reviews, Patches, and11.2012 Theory 1 / 53 Key Lengths I The old
Outline. Computer Science 418. Digital Signatures: Observations. Digital Signatures: Definition. Definition 1 (Digital signature) Digital Signatures
Outline Computer Science 418 Digital Signatures Mike Jacobson Department of Computer Science University of Calgary Week 12 1 Digital Signatures 2 Signatures via Public Key Cryptosystems 3 Provable 4 Mike
Efficient and Secure Authenticated Key Exchange Using Weak Passwords
Efficient and Secure Authenticated Key Exchange Using Weak Passwords Jonathan Katz Rafail Ostrovsky Moti Yung Abstract Mutual authentication and authenticated key exchange are fundamental techniques for
Public Key Encryption with keyword Search
Public Key Encryption with keyword Search Dan Boneh Stanford University Giovanni Di Crescenzo Telcordia Rafail Ostrovsky Giuseppe Persiano UCLA Università di Salerno Abstract We study the problem of searching
A Generic Framework for Three-Factor Authentication
A Generic Framework for Three-Factor Authentication Jiangshan Yu 1 Guilin Wang 2 Yi Mu 2 Wei Gao 3 1 School of Computer Science University of Birmingham, UK 2 School of Computer Science and Software Engineering