There is, I think, something ethereal about i —the square root of minus one. I remember first hearing about it at school. It seemed an odd beast at that time—an intruder hovering on the edge of reality.

Usually familiarity dulls this sense of the bizarre, but in the case of i it was the reverse: over the years the sense of its surreal nature intensified. It seemed that it was impossible to write mathematics that described the real world in …

I and i

Non-interactive arguments enable a prover to convince a verifier that a statement is true. Recently there has been a lot of progress both in theory and practice on constructing highly efficient non-interactive arguments with small size and low verification complexity, so-called succinct non-interactive arguments SNARGs and succinct non-interactive arguments of knowledge SNARKs.

Many constructions of SNARGs rely on pairing-based cryptography. In these constructions a proof consists of a number of group elements and the verification consists of checking a number of pairing product equations. The question we address in this article is how efficient pairing-based SNARGs can be.

Our first contribution is a pairing-based preprocessing SNARK for arithmetic circuit satisfiability, which is an NP-complete language. In our SNARK we work with asymmetric pairings for higher efficiency, a proof is only 3 group elements, and verification consists of checking a single pairing product equations using 3 pairings ini¾?total. Our SNARK is zero-knowledge and does not reveal anything about the witness the prover uses to make the proof.

As our second contribution we answer an open question of Bitansky, Chiesa, Ishai, Ostrovsky and Paneth TCC 2013 by showing that linear interactive proofs cannot have a linear decision procedure. It follows from this that SNARGs where the prover and verifier use generic asymmetric bilinear group operations cannot consist of a single group element. This gives the first lower bound for pairing-based SNARGs. It remains an intriguing open problem whether this lower bound can be extended to rule out 2 group element SNARGs, which would prove optimality of our 3 element construction.

/pdf/on-the-size-of-pairing-based-non-interactive-arguments-4urpm6ld1a.pdf

On the Size of Pairing-Based Non-interactive Arguments

Order-preserving encryption - an encryption scheme where the sort order of ciphertexts matches the sort order of the corresponding plaintexts - allows databases and other applications to process queries involving order over encrypted data efficiently. The ideal security guarantee for order-preserving encryption put forth in the literature is for the ciphertexts to reveal no information about the plaintexts besides order. Even though more than a dozen schemes were proposed, all these schemes leak more information than order. This paper presents the first order-preserving scheme that achieves ideal security. Our main technique is mutable ciphertexts, meaning that over time, the ciphertexts for a small number of plaintext values change, and we prove that mutable ciphertexts are needed for ideal security. Our resulting protocol is interactive, with a small number of interactions. We implemented our scheme and evaluated it on microbenchmarks and in the context of an encrypted MySQL database application. We show that in addition to providing ideal security, our scheme achieves 1 - 2 orders of magnitude higher performance than the state-of-the-art order-preserving encryption scheme, which is less secure than our scheme.

https://people.csail.mit.edu/nickolai/papers/popa-mope.pdf

An Ideal-Security Protocol for Order-Preserving Encoding

We survey the notion of provably secure searchable encryption (SE) by giving a complete and comprehensive overview of the two main SE techniques: searchable symmetric encryption (SSE) and public key encryption with keyword search (PEKS). Since the pioneering work of Song, Wagner, and Perrig (IEEE S&P '00), the field of provably secure SE has expanded to the point where we felt that taking stock would provide benefit to the community.The survey has been written primarily for the nonspecialist who has a basic information security background. Thus, we sacrifice full details and proofs of individual constructions in favor of an overview of the underlying key techniques. We categorize and compare the different SE schemes in terms of their security, efficiency, and functionality. For the experienced researcher, we point out connections between the many approaches to SE and identify open research problems.Two major conclusions can be drawn from our work. While the so-called IND-CKA2 security notion becomes prevalent in the literature and efficient (sublinear) SE schemes meeting this notion exist in the symmetric setting, achieving this strong form of security efficiently in the asymmetric setting remains an open problem. We observe that in multirecipient SE schemes, regardless of their efficiency drawbacks, there is a noticeable lack of query expressiveness that hinders deployment in practice.

http://romisatriawahono.net/lecture/rm/survey/network%20security/Bosch%20-%20Provably%20Secure%20Searchable%20Encryption%20-%202014.pdf

A Survey of Provably Secure Searchable Encryption

We present a new identity based scheme based on pairings over elliptic curves. It combines the functionalities of signature and encryption and is provably secure in the random oracle model. We compare it with Malone-Lee’s one from security and efficiency points of view. We give a formal proof of semantical security under the Decisional Bilinear Diffie-Hellman assumption for this new scheme and we show how to devise other provably secure schemes that produce even shorter ciphertexts.

/pdf/new-identity-based-signcryption-schemes-from-pairings-3wmdxukjst.pdf

New identity based signcryption schemes from pairings.

To provide the binding between a user and his public key, traditional digital signature schemes use certificates that are signed by a trusted third party. While Shamir’s identity-based signature scheme can dispense with certificates, the key escrow of a user’s private key is inherent in the identity-based signature scheme. In Asiacrypt 2003, a new digital signature paradigm called the certificateless signature was introduced. The certificateless signature eliminates the need for certificates and does not suffer from the inherent key escrow problem. In this paper, we provide a generic secure construction of a certificateless signature. We also present an extended construction whose trust level is the same as that of a traditional public key signature scheme.

Generic construction of certificateless signature

We construct two new multiparty digital signature schemes that allow multiple signers to sequentially produce a compact, fixed-length signature. First, we introduce a new primitive that we call ordered multisignatures (OMS), which allows signers to attest to a common mes- sage as well as the order in which they signed. Our OMS construction substantially improves computational efficiency and scalability over any existing scheme with suitable functionality. Second, we design a new identity-based sequential aggregate signature scheme, where signers can attest to different messages and signature verification does not require knowledge of tradi- tional public keys. The latter property permits savings on bandwidth and storage as compared to public-key solutions. In contrast to the only prior scheme to provide this functionality, ours offers improved security that does not rely on synchronized clocks or a trusted first signer. We provide formal security definitions and support the proposed schemes with security proofs under appropriate computational assumptions. We focus on potential applications of our schemes to secure network routing, but we believe they will find many other applications as well.

/pdf/ordered-multisignatures-and-identity-based-sequential-4a64f24ta1.pdf

Ordered Multisignatures and Identity-Based Sequential Aggregate Signatures, with Applications to Secure Routing.

We construct new multiparty signature schemes that allow multiple signers to sequentially produce a compact, fixed-length signature simultaneously attesting to the message(s) they want to sign. First, we introduce a new primitive that we call ordered multisignatures (OMS), which allow signers to attest to a common message as well as the order in which they signed. Our OMS construction substantially improves computational efficiency over any existing scheme with comparable functionality. Second, we design a new identity-based sequential aggregate signature scheme, where signers can attest to different messages and signature verification does not require knowledge of traditional public keys. The latter property permits savings on bandwidth and storage as compared to public-key solutions. In contrast to the only prior scheme to provide this functionality, ours offers improved security that does not rely on synchronized clocks or a trusted first signer. Security proofs according to the corresponding security definitions and under appropriate computational assumptions are provided for all the proposed schemes. We give several applications of our schemes to secure network routing, and we believe that they will find many other applications as well.

https://www.cc.gatech.edu/~aboldyre/papers/bgoy.pdf

Ordered multisignatures and identity-based sequential aggregate signatures, with applications to secure routing

As the Internet becomes an indispensable element of modern life, PKC (Public Key Cryptography) is gaining a considerable attention because it can assure the security requirements of many applications. To guarantee the authenticity of public keys, traditional PKC requires certificates to be signed by a CA (Certification Authority). However, the management of infrastructure supporting certificates is the main complaint against traditional PKC. While identity-based PKC can eliminate this cumbersome infrastructure, the key escrow of a user’s private key is inherent in identity-based PKC. Recently, a new PKC paradigm called the certificateless PKC was introduced. Certificateless PKC eliminates the need for unwieldy certificates and retains the desirable properties of identity-based PKC without the inherent key escrow problem. In this paper, we provide a generic secure construction of certificateless encryption. While previous schemes are based on the algebraic properties of bilinear mappings, our construction is built from general primitives. This result shows that certificateless encryption can be constructed in a more general way.

Generic Construction of Certificateless Encryption

A signcryption scheme is a cryptographic primitive that performs signature and encryption simultaneously, at less cost than is required by the traditional signature-then-encryption approach. We propose new signcryption schemes based on KCDSA. These are the first signcryption schemes that are based on a standardized signature scheme. We expect that these schemes will soon be applied to established KCDSA systems. We also propose a new signcryption scheme for multiple recipients which requires very small communication overhead.

Dae Hyun Yum

Papers

Generic construction of certificateless signature

Ordered Multisignatures and Identity-Based Sequential Aggregate Signatures, with Applications to Secure Routing.

Ordered multisignatures and identity-based sequential aggregate signatures, with applications to secure routing

Generic Construction of Certificateless Encryption

New Signcryption Schemes Based on KCDSA