An important open problem in the area of Traitor Tracing is designing a scheme with constant expansion of the size of keys (users' keys and the encryption key) and of the size of ciphertexts with respect to the size of the plaintext. This problem is known from the introduction of Traitor Tracing by Chor, Fiat and Naor. We refer to such schemes as traitor tracing with constant transmission rate. Here we present a general methodology and two protocol constructions that result in the first two public-key traitor tracing schemes with constant transmission rate in settings where plaintexts can be calibrated to be sufficiently large. Our starting point is the notion of copyrighted function which was presented by Naccache, Shamir and Stern. We first solve the open problem of discrete-log-based and public-key-based copyrighted function. Then, we observe the simple yet crucial relation between (public-key) copyrighted encryption and (public-key) traitor tracing, which we exploit by introducing a generic design paradigm for designing constant transmission rate traitor tracing schemes based on copyrighted encryption functions. Our first scheme achieves the same expansion efficiency as regular ElGamal encryption. The second scheme introduces only a slightly larger (constant) overhead, however, it additionally achieves efficient black-box traitor tracing (against any pirate construction).

Traitor Tracing with constant transmission rate

Cryptosystems I.- On Ideal Lattices and Learning with Errors over Rings.- Fully Homomorphic Encryption over the Integers.- Converting Pairing-Based Cryptosystems from Composite-Order Groups to Prime-Order Groups.- Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption.- Obfuscation and Side Channel Security.- Secure Obfuscation for Encrypted Signatures.- Public-Key Encryption in the Bounded-Retrieval Model.- Protecting Circuits from Leakage: the Computationally-Bounded and Noisy Cases.- 2-Party Protocols.- Partial Fairness in Secure Two-Party Computation.- Secure Message Transmission with Small Public Discussion.- On the Impossibility of Three-Move Blind Signature Schemes.- Efficient Device-Independent Quantum Key Distribution.- Cryptanalysis.- New Generic Algorithms for Hard Knapsacks.- Lattice Enumeration Using Extreme Pruning.- Algebraic Cryptanalysis of McEliece Variants with Compact Keys.- Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds.- IACR Distinguished Lecture.- Cryptography between Wonderland and Underland.- Automated Tools and Formal Methods.- Automatic Search for Related-Key Differential Characteristics in Byte-Oriented Block Ciphers: Application to AES, Camellia, Khazad and Others.- Plaintext-Dependent Decryption: A Formal Security Treatment of SSH-CTR.- Computational Soundness, Co-induction, and Encryption Cycles.- Models and Proofs.- Encryption Schemes Secure against Chosen-Ciphertext Selective Opening Attacks.- Cryptographic Agility and Its Relation to Circular Encryption.- Bounded Key-Dependent Message Security.- Multiparty Protocols.- Perfectly Secure Multiparty Computation and the Computational Overhead of Cryptography.- Adaptively Secure Broadcast.- Universally Composable Quantum Multi-party Computation.- Cryptosystems II.- A Simple BGN-Type Cryptosystem from LWE.- Bonsai Trees, or How to Delegate a Lattice Basis.- Efficient Lattice (H)IBE in the Standard Model.- Hash and MAC.- Multi-property-preserving Domain Extension Using Polynomial-Based Modes of Operation.- Stam's Collision Resistance Conjecture.- Universal One-Way Hash Functions via Inaccessible Entropy.- Foundational Primitives.- Constant-Round Non-malleable Commitments from Sub-exponential One-Way Functions.- Constructing Verifiable Random Functions with Large Input Spaces.- Adaptive Trapdoor Functions and Chosen-Ciphertext Security.

Advances in cryptology -- EUROCRYPT 2010 : 29th Annual International Conference on the Theory and Applications of Cryptographic Techniques, French Riviera, May 30-June 3, 2010 : proceedings

In this paper, we present new adaptively secure identity-based encryption IBE schemes. One of the distinguishing properties of the schemes is that it achieves shorter public parameters than previous schemes. Both of our schemes follow the general framework presented in the recent IBE scheme of Yamada Eurocrypt 2016, employed with novel techniques tailored to meet the underlying algebraic structure to overcome the difficulties arising in our specific setting. Specifically, we obtain the following:

- Our first scheme is proven secure under the ring learning with errors RLWE assumption and achieves the best asymptotic space efficiency among existing schemes from the same assumption. The main technical contribution is in our new security proof that exploits the ring structure in a crucial way. Our technique allows us to greatly weaken the underlying hardness assumption e.g., we assume the hardness of RLWE with a fixed polynomial approximation factor whereas Yamada's scheme requires a super-polynomial approximation factor while improving the overall efficiency.

- Our second IBE scheme is constructed on bilinear maps and is secure under the 3-computational bilinear Diffie-Hellman exponent assumption. This is the first IBE scheme based on the hardness of a computational/search problem, rather than a decisional problem such as DDH and DLIN on bilinear maps with sub-linear public parameter size.

Partitioning via Non-linear Polynomial Functions: More Compact IBEs from Ideal Lattices and Bilinear Maps

A signature scheme is existentially unforgeable if, given any polynomial (in the security parameter) number of pairs (m>sub /sub sub /sub sub /sub sub /sub sub /sub sub /sub sub /sub sub /sub sub /sub sub /sub sub /sub< }. We present an existentially unforgeable signature scheme that requires at most 6 times the amount of time needed to generate a signature using RSA (which is not existentially unforgeable), and point out applications where its use is desirable.

An Efficient Existentially Unforgeable signature Scheme and its Applications

https://www.nics.uma.es/sites/default/files/papers/nunez2017proxy.pdf

Proxy Re-Encryption

Independent work by Chatterjee and Sarkar [9] and Naccache [16] provided a variant of Waters' IBE to reduce public parameters. The idea is to divide an l-bit identity into l′ blocks of l/l′ so that size of the vector $\overrightarrow{V}$ can be reduced from l elements of G to l′ elements of G. We name this technique as blocking technique. This leads to some associated degradation in security reduction. In this paper our contribution is two fold: First we apply Waters' [21] idea to convert Agrawal et al. [1] selective-ID secure lattice HIBE to adaptive-ID secure HIBE then using blocking technique we reduce the public parameters. Second we present efficient lattice identity based encryption in standard model with smaller public key size which is variant of [1]. Using blocking technique our scheme reduces public key size by a factor of β at the cost of increasing (β−lg (β))2 number of bits in q where q is size of field Zq. There is an interesting trade-off between reducing the public parameter size and increase in the computational cost. For 160-bit identities we show that compared to scheme [1] the public parameter size can be reduced by almost 90% while increasing the computation cost by only 8.71% for appropriate choice of β.

Adaptively secure efficient lattice (H)IBE in standard model with short public parameters

At Eurocrypt 1998, Blaze, Bleumer and Strauss [8] presented a new primitive called Proxy Re-Encryption (PRE). PRE is a public key encryption which allows a semi trusted proxy to alter a ciphertext for Alice (delegator) into a ciphertext for Bob (delegatee) without knowing the message. To the best of our knowledge there does not exist any lattice based identity based unidirection PRE scheme. In this paper, we have costructed lattice based identity based unidirection PRE scheme. Our scheme is noninteractive. In this scheme, we have used Micciancio and Peikert’s strong trapdoor [16] for lattices which is simple, efficient and easy to implement than [3].

Lattice Based Identity Based Unidirectional Proxy Re-Encryption Scheme

At Eurocrypt 1998, Blaze, Bleumer and Strauss [7]presented a new primitive called Proxy Re-Encryption (PRE). This new primitive allows semi trusted proxy to transform a ciphertext for Alice (delegator) into a ciphertext for Bob (delegatee) without knowing the message. Ateniese et al [6] introduced master secret security as another security requirement for unidirectional PRE. Master secret security demands that no coalition of dishonest proxy and malicious delegatees can compute the master secret key (private key) of the delegator. In this paper, first we have shown that Aono et al’s scheme [4] is not secure under master secret security model. In other words if proxy and delegatee collude they can compute the private key of the delegator. Second, based on Aono et al’s paper [4] we have constructed unidirectional PRE which is also secure under master secret security model. Like [4], our scheme is also multi-use.

/pdf/cryptanalysis-of-unidirectional-proxy-re-encryption-scheme-7082fihq5c.pdf

Cryptanalysis of Unidirectional Proxy Re-Encryption Scheme

Threshold public key encryption is a cryptographic primitive where a secret key of an organization is distributed among special members called decryption servers insiders and a certain threshold number of insiders must cooperate to decrypt any ciphertext. Threshold public key encryption with an additional randomized algorithm Tsplit is called resplittable threshold public key encryption RTPKE. Cryptographic primitive RTPKE was introduced by Hanaoka et al. [Generic construction of chosen ciphertext secure proxy re-encryption, in CT-RSA, San Francisco, CA, USA, LNCS, O. Dunkelman, ed., Springer-Verlag, Heidelberg, 2012, pp. 349–364] in a generic construction of chosen ciphertext attack secure proxy re-encryption scheme. In MIST 2013 conference Singh et al. [Lattice based efficient threshold public key encryption scheme, J. Wirel. Mob. Netw. Ubiquitous Comput. Dependable Appl. JoWUA 44 2013, pp. 93–107] presented lattice-based RTPKE scheme based on Regev's LWE [On lattices, learning with errors, random linear codes, and cryptography, in STOC, Baltimore, MD, USA, H.N. Gabow and R. Fagin, eds., ACM, University of Wales, Cardiff, 2005, pp. 84–93] assumption. In this paper, we propose lattice-based RTPKE scheme in the identity-based setting.

Lattice-based identity-based resplittable threshold public key encryption scheme

The concept of identity-based cryptosystem was introduced by Adi Shamir in 1984. In this new paradigm users’ public key can be any string which uniquely identifies the user. The task of Public Key Generator (PKG) in IBE is to authenticate identity of the entity, generate the private key corresponding to the identity of the entity and finally transmit the private key securely to the entity. In large network PKG has a burdensome job. So the notion of Hierarchical IBE (HIBE) was introduced in [11,12] to distribute the workload by delegating the capability of private key generation and identity authentication to lower-level PKGs. In Eurocrypt 2010 Agrawal et al [1] presented an efficient lattice based secure HIBE scheme in the standard model in weaker security notion i.e. selective-ID. Based on [1], Singh et al [18] constructed adaptive-ID secure HIBE with short public parameters and still the public parameters is very large (total l′′×h + 2 matrices). In this paper, we have reduced the size of the public parameters from l′′×h + 2 matrices to l′′ + 2 matrices using Chatterjee and Sarkar’s [8] and blocking technique [7], where h is the number of levels in HIBE.

https://link.springer.com/content/pdf/10.1007%2F978-3-642-55032-4_56.pdf

A. K. Banerjee

Papers

Adaptively secure efficient lattice (H)IBE in standard model with short public parameters

Lattice Based Identity Based Unidirectional Proxy Re-Encryption Scheme

Cryptanalysis of Unidirectional Proxy Re-Encryption Scheme

Lattice-based identity-based resplittable threshold public key encryption scheme

Efficient Lattice HIBE in the Standard Model with Shorter Public Parameters