Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2410.19338 · IEEE Computer Security Foundations Workshop (CSFW)

Privacy-Preserving Server-Supported Decryption

Peeter Laud, Alisa Pankova, Jelizaveta Vakarjuk

Published Jun 16, 2025• 2 citations
arXivHTMLPDF

Abstract

In this paper, we consider encryption systems with two-out-of-two threshold decryption, where one of the parties (the client) initiates the decryption and the other one (the server) assists. Existing threshold decryption schemes disclose to the server the ciphertext that is being decrypted. We give a construction, where the identity of the ciphertext is not leaked to the server, and the client's privacy is thus preserved. While showing the security of this construction, we run into the issue of defining the security of a scheme with blindly assisted decryption. We discuss previously proposed security definitions for similar cryptographic functionalities and argue why they do not capture the expected meaning of security. We propose an ideal functionality for the encryption with server-supported blind threshold decryption in the universal composability model, carefully balancing between the meaning of privacy, and the ability to implement it. We construct a protocol and show that it is a secure implementation of the proposed functionality in the random oracle model.

DOI
10.1109/csf64896.2025.00004

Related papers

Symmetric Blind Decryption with Perfect Secrecy

Juha Partala

A blind decryption scheme enables a user to query decryptions from a decryption server without revealing information about the plain-text message. Such schemes are useful, for example, for the implementation of privacy-preserving encrypted file storages and payment systems. In terms of functionality, blind decryption is close to oblivious transfer. For noiseless channels, information-theoretically secure oblivious transfer is impossible. However, in this paper, we show that this is not the case for blind decryption. We formulate a definition of perfect secrecy of symmetric blind decryption for the following setting: at most one of the scheme participants is a passive adversary (honest-but-curious). We also devise a symmetric blind decryption scheme based on modular arithmetic on a ring Zp2 , where p is a prime, and show that it satisfies our notion of perfect secrecy.

arXiv:1510.06231•Journal of Computer Networks and Communications•Jan 1, 2017•1 citation

Quantum secure blind decryption with two users

Masahito Hayashi, Yuki Ito

We propose two types of protocols for quantum secure blind decryption, involving two users and servers. User 1 holds the encrypted ciphertext. The servers store several indexed keys including the key encrypting the ciphertext. User 2 aims to obtain the decrypted text. The protocols are designed to preserve the following types of secrecy: Users ensure the secrecy of the text from the servers. Servers maintain the secrecy of the keys from the users. Our protocols enable User 2 to obtain the decrypted text while preserving these secrecy requirements. Additionally, the second protocol ensures the secrecy of the key index to identify the key encrypting the ciphertext from the servers, and the second protocol requires two non-commuting servers. Furthermore, we analyze the secrecy of the second protocol under post-attack scenarios, where the two servers communicates with each other after the completion of the protocol. We show that our quantum protocol satisfies the secrecy under these attacks, whereas its classical counterpart fails to do so.

quant-pharXiv:2606.01949•Jun 2, 2026•0 citations

How to Handle Invalid Queries for Malicious-Private Protocols Based on Homomorphic Encryption

Koji Nuida

We consider a setting of two-party computation between a server and a client where every message received by the server is encrypted by a fully homomorphic encryption (FHE) scheme and its decryption key is held by the client only. Akavia and Vald (IACR ePrint Archive, 2021) revisited the privacy problem in such protocols against malicious servers and revealed (as opposed to a naive expectation) that under certain condition, a malicious server can recover the client's input even if the underlying FHE scheme is IND-CPA secure. They also gave some sufficient conditions for the FHE scheme to ensure the privacy against malicious servers. However, their argument did not consider the possibility that a query from a malicious server to a client involves an invalid ciphertext. In this paper, we show, by giving a concrete example, that if such an invalid query is just rejected by the client, then the sufficient conditions in Akavia and Vald's result do not in general ensure the privacy against malicious servers. We also propose another option to handle an invalid query in a way that the client returns a random ciphertext (without explicitly rejecting the query), and show that such a protocol is private against malicious servers if the underlying FHE scheme is IND-CPA secure, sanitizable (in the sense of Ducas and Stehlé, EUROCRYPT 2016), and circular secure.

ACM ASIA Public-Key Cryptography Workshop (APKC)•May 24, 2022•4 citations

A New Privacy-Preserving Broadcast Encryption Scheme from DPVS

Hao Wang, Zhihua Zheng, Yilei Wang

In this paper, we consider the privacy-preserving problem in the context of broadcast encryption. We provide a security definition for privacy-preserving broadcast encryption, and construct a new scheme. To achieve privacy-preserving, we blind the cipher texts using the random factors. Moreover, we use a pair of orthonormal bases to construct secret key and cipher texts for proper decryption. Our privacy-preserving broadcast encryption scheme can be proven in the adaptive model without random oracle. The key technique used to obtain our result is an elaborate combination of the dual system encryption proposed by Waters and a new approach on bilinear pairings using the notion of dual pairing vector spaces (DPVS) proposed by Okamoto and Takasima.

International Conference on Intelligent Networking and Collaborative Systems (INCoS)•Sep 1, 2013•3 citations

A new model of Client-Server Communications under information theoretic security

Mitsugu Iwamoto, Tsukasa Omino, Yuichi Komano +1 more

A new model for a Client-Server Communication (CSC) system satisfying information theoretic security is proposed, and its fundamental properties are discussed. Our CSC allows n users to upload their respective messages to a server securely by using symmetric key encryptions with their own keys, and all ciphertexts are decrypted by the server. If we require all messages to be perfectly secure in CSC against the corrupted clients and adversaries without any keys, it is proved that a one time pad or more inefficient encryption must be used for each communication link between a client and the server. This means that, in order to realize more efficient CSC, it is necessary to leak out some information of each message. Based on these observations, we introduce a new model for such a secure CSC formally, and discuss its fundamental properties. In addition, we propose the optimal construction of CSC under several constraints on security parameters called security rates.

IEEE Information Theory Workshop (ITW)•Nov 1, 2014•2 citations

Identity-Based Threshold Decryption Schemes Secure against Chosen Ciphertext Attacks in the Standard Model

Mei Qi, He Da

We propose two efficient Identity-Based threshold decryption schemes.They are proved secure against chosen ciphertext attacks under the standard decisional bilinear Diffie-Hellman assumption.The first one is constructed from(one of) the Selective ID-Based Encryption(Selective-IBE) scheme proposed by Boneh and Boyen recently,yet the second one is transformed from the Full ID-Based Encryption(Full-IBE) scheme obtained by Waters.As the based IBE schemes,the attacker in the first proposal has to choose the challenge identity before the common parameter is generated.while the attacker in the second one could choose the identity adaptively.To the best of our knowledge,previous related schemes could only be proved secure in the random oracle model.

Journal of the Graduate School of the Chinese Academy of Sciences•Jan 1, 2006•1 citation
In this paper, we consider encryption systems with two-out-of-two threshold decryption, where one of the parties (the client) initiates the decryption and the other one (the server) assists. Existing threshold decryption schemes disclose to the server the ciphertext that is being decrypted. We give a construction, where the identity of the ciphertext is not leaked to the server, and the client's privacy is thus preserved. While showing the security of this construction, we run into the issue of defining the security of a scheme with blindly assisted decryption. We discuss previously proposed security definitions for similar cryptographic functionalities and argue why they do not capture the expected meaning of security. We propose an ideal functionality for the encryption with server-supported blind threshold decryption in the universal composability model, carefully balancing between the meaning of privacy, and the ability to implement it. We construct a protocol and show that it is a secure implementation of the proposed functionality in the random oracle model.
A blind decryption scheme enables a user to query decryptions from a decryption server without revealing information about the plain-text message. Such schemes are useful, for example, for the implementation of privacy-preserving encrypted file storages and payment systems. In terms of functionality, blind decryption is close to oblivious transfer. For noiseless channels, information-theoretically secure oblivious transfer is impossible. However, in this paper, we show that this is not the case for blind decryption. We formulate a definition of perfect secrecy of symmetric blind decryption for the following setting: at most one of the scheme participants is a passive adversary (honest-but-curious). We also devise a symmetric blind decryption scheme based on modular arithmetic on a ring Zp2 , where p is a prime, and show that it satisfies our notion of perfect secrecy.
We propose two types of protocols for quantum secure blind decryption, involving two users and servers. User 1 holds the encrypted ciphertext. The servers store several indexed keys including the key encrypting the ciphertext. User 2 aims to obtain the decrypted text. The protocols are designed to preserve the following types of secrecy: Users ensure the secrecy of the text from the servers. Servers maintain the secrecy of the keys from the users. Our protocols enable User 2 to obtain the decrypted text while preserving these secrecy requirements. Additionally, the second protocol ensures the secrecy of the key index to identify the key encrypting the ciphertext from the servers, and the second protocol requires two non-commuting servers. Furthermore, we analyze the secrecy of the second protocol under post-attack scenarios, where the two servers communicates with each other after the completion of the protocol. We show that our quantum protocol satisfies the secrecy under these attacks, whereas its classical counterpart fails to do so.
We consider a setting of two-party computation between a server and a client where every message received by the server is encrypted by a fully homomorphic encryption (FHE) scheme and its decryption key is held by the client only. Akavia and Vald (IACR ePrint Archive, 2021) revisited the privacy problem in such protocols against malicious servers and revealed (as opposed to a naive expectation) that under certain condition, a malicious server can recover the client's input even if the underlying FHE scheme is IND-CPA secure. They also gave some sufficient conditions for the FHE scheme to ensure the privacy against malicious servers. However, their argument did not consider the possibility that a query from a malicious server to a client involves an invalid ciphertext. In this paper, we show, by giving a concrete example, that if such an invalid query is just rejected by the client, then the sufficient conditions in Akavia and Vald's result do not in general ensure the privacy against malicious servers. We also propose another option to handle an invalid query in a way that the client returns a random ciphertext (without explicitly rejecting the query), and show that such a protocol is private against malicious servers if the underlying FHE scheme is IND-CPA secure, sanitizable (in the sense of Ducas and Stehlé, EUROCRYPT 2016), and circular secure.
In this paper, we consider the privacy-preserving problem in the context of broadcast encryption. We provide a security definition for privacy-preserving broadcast encryption, and construct a new scheme. To achieve privacy-preserving, we blind the cipher texts using the random factors. Moreover, we use a pair of orthonormal bases to construct secret key and cipher texts for proper decryption. Our privacy-preserving broadcast encryption scheme can be proven in the adaptive model without random oracle. The key technique used to obtain our result is an elaborate combination of the dual system encryption proposed by Waters and a new approach on bilinear pairings using the notion of dual pairing vector spaces (DPVS) proposed by Okamoto and Takasima.
A new model for a Client-Server Communication (CSC) system satisfying information theoretic security is proposed, and its fundamental properties are discussed. Our CSC allows n users to upload their respective messages to a server securely by using symmetric key encryptions with their own keys, and all ciphertexts are decrypted by the server. If we require all messages to be perfectly secure in CSC against the corrupted clients and adversaries without any keys, it is proved that a one time pad or more inefficient encryption must be used for each communication link between a client and the server. This means that, in order to realize more efficient CSC, it is necessary to leak out some information of each message. Based on these observations, we introduce a new model for such a secure CSC formally, and discuss its fundamental properties. In addition, we propose the optimal construction of CSC under several constraints on security parameters called security rates.
We propose two efficient Identity-Based threshold decryption schemes.They are proved secure against chosen ciphertext attacks under the standard decisional bilinear Diffie-Hellman assumption.The first one is constructed from(one of) the Selective ID-Based Encryption(Selective-IBE) scheme proposed by Boneh and Boyen recently,yet the second one is transformed from the Full ID-Based Encryption(Full-IBE) scheme obtained by Waters.As the based IBE schemes,the attacker in the first proposal has to choose the challenge identity before the common parameter is generated.while the attacker in the second one could choose the identity adaptively.To the best of our knowledge,previous related schemes could only be proved secure in the random oracle model.