IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences

On the Security of a Conditional Proxy Re-Encryption

Xi Zhang, Min-Rong Chen

Published Jan 1, 2009• 2 citations

Abstract

To enable fine-grained delegations for proxy re-encryption systems, in AsiaCCS'09, Weng et al.'s introduced the concept of conditional proxy re-encryption (C-PRE), in which the proxy can convert a ciphertext only if a specified condition is satisfied. Weng et al. also proposed a C-PRE scheme, and claimed that their scheme is secure against chosen-ciphertext attack (CCA). In this paper, we show that their scheme is not CCA-secure under their defined security model.

DOI: 10.1587/transfun.e92.a.2644

Related papers

A Multi-use CCA-Secure Proxy Re-encryption Scheme

Yi Cai, Xudong Liu

Proxy re-encryption (PRE) can be classified as single-hop PRE and multi-use PRE according to the times which the ciphertext is transformed. Finding a unidirectional, multi-use, and chosen ciphertext attack (CCA) secure PRE is presented as an open problem by Canetti et al. Wang claimed to resolve this problem by proposing the first multi-use CCAsecure unidirectional PRE scheme. But we found that different with single-hop PRE, multi-use PRE without randomize encrypt key in its re-encryption algorithm could be vulnerable to attack. A new type attack to multi-use CCA-secure PRE named proxy bypass attack is proposed with a concrete attacks on Wang-MultiUse-PRE scheme. This attack is also effective for other multi-use scheme. At last we propose an improvement for Multi-Use-PRE to resist proxy bypass attack by randomize re-encryption algorithm.

IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech)Aug 1, 20146 citations

On the security of two multi-use CCA-secure proxy re-encryption schemes

Jindan Zhang, Xu An Wang, Yi Ding +1 more

In proxy re-encryption (PRE), a semi-trusted proxy can convert a ciphertext originally intended for Alice into one which can be decrypted by Bob, while the proxy cannot know the corresponding plaintext. PRE can be classified as single-use PRE and multi-use PRE according to the times the ciphertext can be transformed. In multi-use PRE schemes, the ciphertext can be transformed from A to B and to C and so on. In CCS’09 (post session), Wang et al. proposed a multi-use unidirectional CCA-secure proxy re-encryption scheme. Unfortunately, we show their proposal is not CCA-secure in the corresponding security models by giving concrete attacks. In 2010, Ren et al. proposed a hierarchical identity-based proxy re-encryption scheme without random oracles, and claimed their scheme was also multi-use and CCA-secure, we also show their scheme is not secure.

International Journal of Intelligent Information and Database SystemsJan 1, 20133 citations

Chosen-Ciphertext Secure Proxy Re-Encryption for Bounded Linear Functions

Fucai Luo, Haiyan Wang, Xingfu Yan +1 more

Proxy re-encryption (PRE) allows a proxy to use the reencryption keys to convert ciphertexts encrypted under the delegators' public keys into ones that can be decrypted using the delegatees' secret keys, without revealing the underlying plaintext. However, PRE is limited to an all-or-nothing re-encryption, that is, the delegatee can either decrypt the re-encrypted ciphertext to obtain the whole message, or it learns nothing about the underlying message. To address this limitation, Zhou et al. (Asiacrypt 2023) proposed a new variant of PRE called fine-grained PRE (FPRE). FPRE extends PRE to support fine-grained re-encryption, allowing the proxy to convert any ciphertext encrypting a message m to a new ciphertext encrypting f (m) with a fine-grained re-encryption key for any function f. This enables the delegator to flexibly control the sharing of messages by specifying functions. Unfortunately, their scheme achieves only CPA security and requires a common random/reference string (CRS) during key generation. This requirement may weaken the syntax of (F)PRE, which allows users to independently generate their own keys. In this paper, we propose a new FPRE for bounded linear functions that we prove is CCA1 secure and does not require a CRS, based on the Learning with Errors (LWE) assumption. When the linear function is set to be the identity function, our construction immediately yields the first PRE scheme without a CRS, with CCA1 security under adaptive corruptions in the standard model. The main technique behind our construction is the design of a deterministic preimage computation algorithm for the decryption oracle in the security proof. To demonstrate the broader applicability of our proposed algorithm beyond the context of (F)PRE, we use it to prove the selective-identity CCA1 security of Agrawal et al.'s (Eurocrypt 2010) identity-based encryption (IBE) scheme, which was previously only known to be selective-identity CPA secure.

Dec 5, 20240 citations

Identity-based multi-condition proxy re-encryption

Pingshu Wang

In a proxy re-encryption system, a semi-trusted proxy can convert a ciphertext originally intended for Alice into one encrypting the same plaintext for Bob without seeing the underlying plaintext.However, a fine-grained delegation is demanded in some scenarios.For this, Weng et al. introduce the notion of conditional proxy re-encryption (CPRE), and formalize its security model and propose an efficient CPRE scheme.This paper presents the notion of identity-based multi-condition proxy re-encryption, which is a variant of identity-based condition proxy re-encryption.In such system, ciphertexts are generated under specified conditions by Alice, and the proxy can translate the ciphertext if the relevant conditions are satisfied.We formalize its security model and construct a concrete multi-condition proxy re-encryption scheme, and prove its security in the standard model.

International Conference on Advances in Mechanical Engineering and Industrial Informatics (AMEII)Jan 1, 20162 citations

Improving the Security of an Efficient Unidirectional Proxy Re-Encryption Scheme

Sébastien Canard, Julien Devigne, Fabien Laguillaumie

A proxy re-encryption (PRE) scheme allows a designated proxy, that has beforehand received aso-called re-encryption key, to translate a ciphertext intended to one user to a ciphertext intendedto another one. Traditionally, the re-encryption key is generated at the initiative of the initialreceiver and ideally, no secret keys should be known to the proxy. Such scheme is said unidirectionalif the transformation from one user to another does not necessarily imply the possibility tomake the inverse transformation. Regarding the literature on unidirectional proxy re-encryption, itseems hard to prove the strongest security level (namely indistinguishability under chosen ciphertextattacks - IND-CCA) of such schemes. Most of the time, PRE either reaches a chosen-plaintextsecurity or a replayable CCA security. At Africacrypt 2010, Chow, Weng, Yang and Deng proposeda scheme that satisfies CCA security in the random oracle model. However, their modelcan actually be strengthen. Indeed, we show in this paper how to modify this scheme so that itsimproved security achieves a full CCA security. In particular, we now allow the adversary of theCCA security for re-encryption to corrupt the user i′ who is the initial receiver of the challengedciphertext and at the same time to obtain the re-encryption key from i′ to the targeted users. Theresulting scheme is therefore a fully secure PRE which does not rely on pairings, and secure in therandom oracle model. It can be implemented efficiently with any traditional modular arithmetic.

Jan 1, 201121 citations

CCA-Secure Type-Based Proxy Re-Encryption Without Pairings

Linru Ma

Type-based proxy re-encryption is an effective and efficient cryptographic solution to ciphertext delegation and distribution,which also enables the ciphertext owners to carry out fine-grained delegation control.In this paper,we propose a new type-based proxy re-encryption scheme without pairings and prove it against the chosen-ciphertext attack(CCA) in the random oracle model.Compared with the existing type-based proxy re-encryption schemes constructed with pairings,our scheme owns better efficiency as well as the master key security.

Dianzi xuebaoJan 1, 20113 citations