4. Public key encryption with equality test
4.2 The cipher-bound trapdoors
國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
4.2 The cipher-bound trapdoors
A research about equality test with cipher-bound trapdoors was proposed in [79]. Rather than existing PKEET schemes with permanent trapdoor which Bob can test the equality of all Alice’s ciphertexts once he got Alice’s trapdoor, a brand-new idea called ciphertext-bound-authority (CBA) was proposed in this paper. What is CBA? It denotes that the trapdoor which enables equality test is allocated ciphertext by ciphertext, every ciphertext requires a specific trapdoor. If ciphertext 1 is authorized to Bob, no information about ciphertext 2 will be leaked even when two ciphertexts are encrypted using the same public key.
Syntax of CBA-PKEET
The architecture mainly follows Tang’s AoN-PKEET construction; the only modification is the trapdoor which is modified from an overall authorization to an individual authorization. For clear expression, the syntax is introduced here again.
• 𝑆𝑒𝑡𝑢𝑝 1¼ : On input a secure parameter 𝜅, public parameters 𝑝𝑝 are generated for public usage.
• 𝐾𝐺𝑒𝑛(𝑝𝑝): A user picks a pair of private key and public key (𝑠𝑘, 𝑝𝑘) through the public parameters 𝑝𝑝, where the public key is published and the private key is securely kept.
• 𝐸𝑛𝑐(𝑝𝑘, 𝑚): The sender uses the receiver’s public key to encrypt a message 𝑚 into a testable ciphertext 𝐶.
• 𝐷𝑒𝑐(𝑠𝑘, 𝐶): The receiver can decrypt the acquired ciphertext 𝐶 and obtain the hidden message 𝑚.
• 𝑇𝑟𝑎𝑝𝑑𝑜𝑜𝑟(𝑠𝑘, 𝐶): The receiver is able to authorize the equality testability to some users through a trapdoor 𝑇 ← 𝑇𝑟𝑎𝑝𝑑𝑜𝑜𝑟(𝑠𝑘, 𝐶).
• 𝑇𝑒𝑠𝑡(𝐶Í, 𝐶•, 𝑇Í, 𝑇•) : On input two ciphertexts (𝐶Í, 𝐶•) and their receivers’ trapdoors (𝑇Í, 𝑇•), the authorized user can verify the equivalence between two ciphertexts. After the equality test, the algorithm outputs 1 for equal messages or 0 for different messages.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
What advantages or applications do ciphertext-bound authorities provides?
Let’s focus on the trapdoor phase, obviously the trapdoor algorithm 𝑇𝑟𝑎𝑝𝑑𝑜𝑜𝑟(𝑠𝑘, 𝐶) takes a ciphertext as an additional parameter when compared to the AoN-PKEET scheme. That is what so called ciphertext-bound authorities / trapdoors. Definitely, it provides an additional choice that the data receiver can authorize the authority of a particular ciphertext, rather than all ciphertexts to the tester. In the following two scenarios, the authorization of particular range might be more suitable than overall authorization.
• A patient has some teeth problems so that he visits a dentist. Before being diagnosed, the dentist unavoidably checks the medical records of this patient. Now, the ciphertext-bound authorities might help the patient to reveal necessary teeth-related records to the dentist and meanwhile hide others like heart disease or high blood-pressure for his better privacy.
• Bank A tries to verify only one payment with bank B. If there are only equality test schemes with permanent trapdoors, bank A has to open all its ledger to bank B for simply one equality test request. The ciphertext-bound authority provides a more flexible solution to satisfy this problem.
Numerous cases may support the idea that sometimes an individual authorization is more flexible than an overall authorization. It is worthy to be noted that overall authorizations still satisfy many current applications, which will not be replaced by the individual authorizations. It is emphasized that the individual authorization makes equality test scheme much more flexible and stable. Then, after the syntax, a concrete construction of CBA-PKEET is proposed in this work.
• 𝑆𝑒𝑡𝑢𝑝(1¼): On input a secure parameter 𝜅 , a multiplicative cyclic group {𝔾, 𝑔, 𝑞} is generated where 𝑔 ∈ 𝔾 denotes a generator of 𝔾; 𝑞 stands for the order of 𝔾. For all elements in 𝔾 and ℤW∗, the bit-length are set as 𝔾 = 𝑞 and 𝑞 = 𝜅, respectively. Three collision-resistant and one-way hash functions 𝐻•: 0, 1 ∗ → ℤW∗, 𝐻—: 𝔾 → 0, 1 WÜ—¼ and 𝐻Þ: 𝔾 → 0, 1 ¼ are required. The message space ℳ is set identical to group 𝔾. The outputted public parameters are 𝑝𝑝 ← {𝜅, 𝔾, 𝑔, 𝑞, 𝐻•, 𝐻—, 𝐻Þ}.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
• 𝐾𝑒𝑦𝐺𝑒𝑛(𝑝𝑝): On input the public parameters 𝑝𝑝, a user randomly picks 𝑥 $ ℤW∗ as its private key and publishes the public key 𝑦 ← 𝑔s.
• 𝐸𝑛𝑐(𝑝𝑘, 𝑚): To encrypt a message 𝑚 ∈ 𝔾, a sender randomly picks 𝑟 $ ℤW∗ and outputs 𝐶 ← (𝑈, 𝑉) where 𝑢 ← 𝐻• 𝑚 𝑟 𝐻Þ 𝑚 , 𝑈 ← 𝑔ý, 𝑉 ← 𝐻— 𝑦ý ⨁ 𝑚 𝑟 𝐻Þ 𝑚 . Symbol ⨁ and || denote the XOR operation and the concatenation symbol, respectively.
• 𝐷𝑒𝑐(𝑠𝑘, 𝐶): To decrypt a ciphertext (𝑈, 𝑉) ← 𝐶, the receiver computes 𝑚 𝑟 𝐻Þ 𝑚 ← 𝐻— 𝑈s ⨁𝑉 and accepts 𝑚 if 𝑈 = 𝑔• ² ƒ •á ² .
• 𝑇𝑟𝑎𝑝𝑑𝑜𝑜𝑟(𝑠𝑘, 𝐶): The receiver is able to authorize the equality testability to someone through trapdoor 𝑇 ← 𝐿𝑆𝐵¼ 𝐻— 𝑈s . Symbol 𝐿𝑆𝐵¼(∙) denotes the least 𝜅 significant bits of the inputted parameter.
• 𝑇𝑒𝑠𝑡(𝐶Í, 𝐶•, 𝑇Í, 𝑇•) : On input ciphertexts 𝐶Í ← (𝑈Í, 𝑉Í) , 𝐶• ← (𝑈•, 𝑉•) and trapdoors (𝑇Í, 𝑇•), the equality between them is verified through the following equation. If the equation holds, it outputs 1 for tested equal; or it outputs 0 for non-equal.
( 𝐿𝑆𝐵¼(VÍ) ⨁ 𝑇Í ) = ( 𝐿𝑆𝐵¼(V•) ⨁ 𝑇• ) (38)
The CBA-PKEET is perfect consistency and computational soundness. Equation (38) is clear that:
𝐿𝑆𝐵¼(VÍ) ⨁ 𝑇Í = 𝐿𝑆𝐵¼(VÍ ⨁ 𝐻—(𝑈Ís)) = HÞ(mÍ) and 𝐿𝑆𝐵¼(V•) ⨁ 𝑇• = HÞ(m•).
• Perfect consistency: when 𝑚Í = 𝑚•, the perfect consistency holds because 𝐻Þ 𝑚Í = 𝐻Þ(𝑚•).
• Computationally soundness: the verification whether 𝐻Þ 𝑚Í = 𝐻Þ(𝑚•) or not is almost the same as whether 𝑚Í = 𝑚• or not. But there is negligible probability 𝐴𝑑𝑣𝒜,•Ž«á that 𝑚Í ≠ 𝑚• ∧ 𝐻Þ 𝑚Í = 𝐻Þ 𝑚• . Symbol 𝐴𝑑𝑣𝒜,•Ž« á is defined in section 2.2.1, which denotes the negligible probability that collisions of hash function 𝐻Þ were found.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
Table 3: The efficiency comparison between CBA-PKEET and previous PKEET schemes
𝐾𝐺𝑒𝑛 𝐸𝑛𝑐 𝐷𝑒𝑐 𝑇𝑟𝑎𝑝𝑑𝑜𝑜𝑟 𝑇𝑒𝑠𝑡
PKEET [75] 𝑡2 3 𝑡2 3 𝑡2 N/A 2 𝑡v
PCE [80] 𝑡2 4 𝑡2 2 𝑡v N/A 2 𝑡v
AoN-PKEET [76] 2 𝑡2 5 𝑡2 2 𝑡2 0 4 𝑡2
FG-PKEET [77] 2 𝑡2 4 𝑡2 2 𝑡2 3 𝑡2 4 𝑡v
CBA-PKEET 𝑡2 2 𝑡2 2 𝑡2 𝑡2 2 𝑡s
Efficiency comparison with previous works
Table 3 shows the efficiency comparison with previous PKEET works. Symbols 𝑡2, 𝑡v and 𝑡s are defined in Table 1, which stands for the time of exponential operations, pairing operations and XOR operations, respectively. The bilinear pairing is a computational heavy operation that costs approximately 8 times as the exponential operation in cyclic groups. Besides, 𝑡s is negligible when compared to the other two operations.
𝑡s ≪ 𝑡2 < 𝑡v ≅ 8 𝑡2 (39)
Compared to previous works, the proposed CBA-PKEET works pretty efficiently since the computational heavy tool, bilinear mapping, is not adopted in this construction. Most previous works require heavy computations while equality tests were executed, and this is one of the most remarkable advantages that CBA-PKEET owns.
Security proof
Theorem 6: CBA-PKEET is OW-CCA2 secure against type-I adversaries in RO model.
Proof. Assuming that CBA-PKEET is not OW-CCA2 secure, which means there is a type-I adversary has non-negligible probability 𝜖(𝜅) to break the one-way security, then it could be demonstrated how to play a simulator role to break the one-wayness of the hash function 𝐻Þ by utilizing this adversary. Following, the one-wayness “given 𝐻Þ and 𝐻Þ(𝛿), find 𝛿” and the random
‧
simulated by the simulator is depicted in the following Figure 16.Figure 16: The simulated OW-CCA2 game of CBA-PKEET.
The proof begins with environment settings like 𝑝𝑝 ← 𝑆𝑒𝑡𝑢𝑝 1É and (𝑠𝑘, 𝑝𝑘) ← 𝐾𝐺𝑒𝑛(𝑝𝑝).
Two hash tables 𝜏•, 𝜏— are initialized empty. The adversary is allowed to request decryption queries 𝒪Š and 𝒪Š¡, trapdoor queries 𝒪™, and hash queries 𝒪• and 𝒪•¡ to the simulator, which will be replied as those drawn in The simulated OW-CCA2 game of CBA-PKEET.. The random oracles
‧
pair over any message 𝑚 and randomize 𝑟. In other words, there is actually no information hidden in ciphertext 𝐶∗ since both 𝑈∗ and 𝑉∗ are just some meaningless random numbers. The only clue comes from the injection 𝜏—. 𝑎𝑑𝑑 𝑈∗ Ý~, 𝑉∗⊕ 𝐻Þ 𝛿 which reveals the hash value 𝐻Þ(𝛿) to the adversary. Now the problem can be simplified to the targeted question: if the adversary can find a message 𝑚 that satisfies 𝐻Þ 𝑚 = 𝐻Þ(𝛿) to break the one-way security of CBA-PKEET, then the simulator can directly output 𝛿 ← 𝑚 to break the one-wayness of hash function 𝐻Þ. By the negligible probability of breaking the one-wayness of hash functions, it is proved one-way security for CBA-PKEET.
Figure 17: The simulated IND-CCA2 game for CBA-PKEET.
Theorem 7: CBA-PKEET is IND-CCA2 secure against type-II adversaries in RO model.
Proof. As type-II adversaries, the trapdoors are not available in the security proof. Assuming that CBA-PKEET is not IND-CCA2 secure, which means there is a type-II adversary has non-negligible probability 𝜖(𝜅) to break the IND-CCA2 security, then it can be demonstrated how to play a simulator role to break the DDH problem by utilizing this adversary. Following, the DDH problem
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
“whether (𝛾 = 𝛼𝛽) ← 𝒜 𝑔, 𝑔ˆ, 𝑔Œ, 𝑔• or not” will be imported for security proof. By integrating the IND-CCA2 secure model illustrated in Figure 9 and the random oracle model defined in section 2.2.1, the applied secure game is illustrated in Figure 17.
It is clear that the simulator begins the game with two settings: the first one is to replace 𝐻• with random oracle that has to be queried to the simulator; the second one is to set 𝑝𝑘 ← 𝑔Œ. With these settings, the simulator may be able to answer the decryption oracles 𝒪Š and 𝒪Š¡ through checking the hash table 𝜏. With above settings, the simulator successfully simulates an IND-CCA2 game. Then, if the adversary has a correct guess 𝑏Ó = 𝑏, the simulator outputs 𝛾 = 𝛼𝛽; otherwise, the simulator outputs 𝛾 ≠ 𝛼𝛽. The discussion continues with two scenarios.
• In case 𝛾 = 𝛼𝛽. This is the CBA-PKEET scheme. Then, the adversary has non-negligible probability 𝜖(𝜅) to break the IND-CCA2 security of CBA-PKEET.
• In case 𝛾 ≠ 𝛼𝛽. This is not the CBA-PKEET scheme so that the adversary has only 50%
probability to output correctly.
Both of above cases occur in half probability. In sum, the simulator will win with (1 + 𝜖(𝜅))/2 probability; in other words, it acquires 𝜖(𝜅)/2 advanced probability to break the DDH assumption and it is non-negligible. By the intractability of the DDH problem, it is proved that there is no polynomial-time adversary is able to break the IND-CCA2 security of CBA-PKEET with non-negligible probability. To conclude, it is proved that CBA-PKEET is IND-CCA2 security based on the intractability of the DDH assumption.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y