Non-interactive key exchange (NIKE) enables two or multiple parties (just knowing the public system parameters and each other's public key) to derive a (group) session key without the need for interaction. Recently, NIKE in multi-party settings has been attached importance. However, we note that most existing multi-party NIKE protocols, underlying costly cryptographic techniques (i.e., multilinear maps and indistinguishability obfuscation), lead to high computational costs once employed in practice. Therefore, it is a challenging task to achieve multi-party NIKE protocols by using more practical cryptographic primitives. In this paper, we propose a secure and efficient NIKE protocol for secure communications in dynamic groups, whose construction only bases on bilinear maps. This protocol allows multiple parties to negotiate asymmetric group keys (a public group encryption key and each party's decryption key) without any interaction among one another. Additionally, the protocol supports updating of group keys in an efficient and non-interactive way once any party outside a group or any group member joins or leaves the group. Further, any party called a sender (even outside a group) intending to connect with some or all of group members called receivers in a group, just needs to generate a ciphertext with constant size under the public group encryption key, and only the group member who is the real receiver can decrypt the ciphertext to obtain the session key. We prove our protocol captures the correctness and indistinguishability of session key under k-Bilinear Diffie-Hellman exponent (k-BDHE) assumption. Efficiency evaluation shows the efficiency of our protocol.
Non-interactive key exchange (NIKE) enables two or multiple parties (just knowing the public system parameters and each other's public key) to derive a (group) session key without the need for interaction. Recently, NIKE in multi-party settings has been attached importance. However, we note that most existing multi-party NIKE protocols, underlying costly cryptographic techniques (i.e., multilinear maps and indistinguishability obfuscation), lead to high computational costs once employed in practice. Therefore, it is a challenging task to achieve multi-party NIKE protocols by using more practical cryptographic primitives. In this paper, we propose a secure and efficient NIKE protocol for secure communications in dynamic groups, whose construction only bases on bilinear maps. This protocol allows multiple parties to negotiate asymmetric group keys (a public group encryption key and each party's decryption key) without any interaction among one another. Additionally, the protocol supports updating of group keys in an efficient and non-interactive way once any party outside a group or any group member joins or leaves the group. Further, any party called a sender (even outside a group) intending to connect with some or all of group members called receivers in a group, just needs to generate a ciphertext with constant size under the public group encryption key, and only the group member who is the real receiver can decrypt the ciphertext to obtain the session key. We prove our protocol captures the correctness and indistinguishability of session key under k-Bilinear Diffie-Hellman exponent (k-BDHE) assumption. Efficiency evaluation shows the efficiency of our protocol.
The question of generalising the celebrated 2-party non-interactive key exchange (NIKE), Diffie-Hellman protocol, to a multipartite setting was left as an important open problem. In 2003, Boneh and Silverberg put forward a theoretical construction of multipartite NIKE protocol from a new notion called multilinear maps. In their protocol, however, the number of users N and the multilinearity k are related by N = k + 1, resulting in the system initialising another multilinear map when the number of users who want to exchange a session key changes. In this paper, we describe two extensional schemes of multipartite NIKE, which enables any less than or equal to N users derive a common shared key from an (N – 1)-multilinear map. In addition, using our extensional schemes, we show a concrete scenario: the establishment of any discussion group in a user group and its privacy version. Furthermore, we analyse its security.
Abstract Non-interactive group key exchange is a fundamental primitive for establishing secure communication channels in multi-party settings. However, existing protocols usually rely on computationally expensive tools, such as multi-linear maps and indistinguishability obfuscation, or lack efficient support for dynamic groups. To address these limitations, we propose a secure and efficient non-interactive group key exchange protocol built upon bilinear maps, which offers the following advantages over existing solutions. First, our protocol suits well for dynamic groups by enabling non-interactive key updates to accommodate frequent membership changes. Second, it exhibits two desirable features for distributed applications: sender un-restriction, which permits any party to send a message, and recipient un-restriction, which allows a sender to select an arbitrary subset of members as recipients. Furthermore, our protocol generates constant-size ciphertexts, enhancing its efficiency and scalability. We formally prove that our protocol achieves fully collusion-resistance in the standard model under the k-Bilinear Diffie-Hellman Exponent (k-BDHE) assumption. Performance analysis confirms the protocol's practical efficiency.
The question of generalising the celebrated 2-party non-interactive key exchange (NIKE), Diffie-Hellman protocol, to a multipartite setting was left as an important open problem. In 2003, Boneh and Silverberg put forward a theoretical construction of multipartite NIKE protocol from a new notion called multilinear maps. In their protocol, however, the number of users N and the multilinearity k are related by N = k + 1, resulting in the system initialising another multilinear map when the number of users who want to exchange a session key changes. In this paper, we describe two extensional schemes of multipartite NIKE, which enables any less than or equal to N users derive a common shared key from an (N – 1)-multilinear map. In addition, using our extensional schemes, we show a concrete scenario: the establishment of any discussion group in a user group and its privacy version. Furthermore, we analyse its security.
Non-interactive key exchange (NIKE) is a fundamental notion in Cryptography. This notion was introduced by Diffie and Hellman in 1976. They proposed the celebrated 2-party NIKE protocol and left open as a fascinating question, whether NIKE could be realized in the mul-tiparty setting. NIKE has since then been an active area of research with an ultimate goal of obtaining best possible security in the multiparty setting. Although this has evaded researchers for many decades, advancements have been made through relaxations in multiple directions such as restricting to 3-parties, static/semi-static model (where the adversary needs to commit to the set of parties he wishes to be challenged upon ahead of time), random-oracle model, allowing initial setup, etc. In this work, we settle the longstanding open question: we present the first multiparty NIKE protocol that is adaptively secure with no setup and in the standard model. Our construction is based on indistinguishability obfuscation and obliviously-patchable punc-turable pseudorandom functions, a new notion that we introduce. We employ novel techniques of using indistinguishability obfuscation, which are interesting in their own right and which we believe would find wider applications in other settings. One such technique pertains overcoming, the somewhat inherent, drawback of non-adaptivity of the puncturing technique introduced by Sahai and Waters [STOC’14]. Central to this technique is our new notion of obliviously-patchable puncturable pseudorandom functions. We present a concrete construction of these pseudorandom functions using multilinear maps and their recent approximations – the leveled-graded encoding schemes. Note that pseudorandom functions amount to an interactive assumption. We shall establish via a meta-reduction technique that, in natural settings, an interactive assumption is necessary (even with setup). ∗University of California, Los Angeles.
Modern collaborative and group-oriented applications typically involve communications over open networks. Given the openness of today's networks, communications among group members must be secure and, at the same time, efficient. Group key agreement (GKA) is widely employed for secure group communications in modern collaborative and group-oriented applications. This paper studies the problem of GKA in identity-based cryptosystems with an emphasis on round-efficient, sender-unrestricted, member-dynamic, and provably secure key escrow freeness. The problem is resolved by proposing a one-round dynamic asymmetric GKA protocol which allows a group of members to dynamically establish a public group encryption key, while each member has a different secret decryption key in an identity-based cryptosystem. Knowing the group encryption key, any entity can encrypt to the group members so that only the members can decrypt. We construct this protocol with a strongly unforgeable stateful identity-based batch multisignature scheme. The proposed protocol is shown to be secure under the k -bilinear Diffie-Hellman exponent assumption.
Non-interactive key exchange (NIKE) allows two parties to establish a shared key without communications. In ID-based non-interactive key exchange (ID-NIKE) protocols, private key generator (PKG) knows user's private key, so it can calculate the shared key between two participants, and most constructions of ID-NIKE need expensive pairing operation. To overcome these disadvantages, a security model of certificateless non-interactive key exchange (CL-NIKE) is proposed in this paper. And a scheme without pairings is also given. The proposed protocol is proved secure in the Random Oracle Model (ROM) based on the gap Diffie-Hellman (GDH) and computational Diffie-Hellman (CDH) problem. In the new protocol, key generation center (KGC) only knows user's partial key and is not able to calculate the shared key. Moreover, the new protocol is more efficient than the existing ID-NIKE schemes because it is pairing-free.