Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

The Computer Journal

Insecurity of 'Improved Anonymous Multi-Receiver Identity-Based Encryption'

H. Wang

Published May 30, 2013• 15 citations
Publisher

Abstract

Anonymous multi-receiver identity-based encryption can protect the receiver identity privacy and message confidentiality. Thus, it can be used in many fields, such as Voice over Internet Protocol and pay-TV systems. In 2012, Chien improved an anonymous multi-receiver identity-based encryption scheme. This paper points out that Chien's scheme does not satisfy the indistinguishability of encryptions under selective multi-identity, chosen ciphertext attacks. The analysis is important for understanding the security risks.

DOI
10.1093/comjnl/bxt052

Related papers

On the Security of an Anonymous Multi-Receiver Encryption Protocol

Gang Zeng

Anonymous multi-receiver encryption (AME) achieves the security properties of confidentiality and anonymity. Thus, it can be used in VoIP (Voice over Internet Protocol), pay-TV systems, et al. In 2012, Zhang et al. proposed an efficient anonymous multi-receiver encryption protocol. They claimed that their protocol can protect the receiver identity privacy and keep message confidential. In this paper, we point out the weaknesses of Zhang et al.'s protocol. Their protocol cannot satisfy the anonymity against the inner attackers. On the other hand, their AME protocol cannot satisfy the indistinguishability of encryptions under selective multi-identity, chosen ciphertext attacks (IND-AME-CCA). Thus, Zhang et al.'s protocol is insecure. The analysis is important for the engineer to mitigate the security risks.

Advanced materials research•Jun 1, 2014•0 citations

Anonymous Multi-Receiver Identity-Based Authenticated Encryption with CCA Security

Chun‐I Fan, Yi‐Fan Tseng

In a multi-receiver encryption system, a sender chooses a set of authorized receivers and sends them a message securely and efficiently, as the message is well encrypted and only one ciphertext corresponding to the message is generated no matter how many receivers the sender has chosen. It can be applied to video conferencing systems, pay-per-view channels, remote education, and so forth. Due to privacy considerations, an authorized receiver may not expect that his identity is revealed. In 2010, anonymous multi-receiver identity-based (ID-based) encryption was first discussed, and furthermore, many works on the topic have been presented so far. Unfortunately, we find that all of those schemes fail to prove the chosen ciphertext attacks (CCA) security in either confidentiality or anonymity. In this manuscript, we propose the first anonymous multi-receiver ID-based authenticated encryption scheme with CCA security in both confidentiality and anonymity. In the proposed scheme, the identity of the sender of a ciphertext can be authenticated by the receivers after a successful decryption. In addition, the proposed scheme also is the first CCA-secure one against insider attacks. Moreover, only one pairing computation is required in decryption.

Symmetry•Oct 16, 2015•21 citations

Cryptanalysis and improvements of an anonymous multi-receiver identity-based encryption scheme

H. Wang, Yu Zhang, Hu Xiong +1 more

In 2010, Fan et al. presented an anonymous multi-receiver identity-based encryption scheme where they adopt Lagrange interpolating polynomial mechanism. They showed that their scheme makes it impossible for an attacker or any other message receiver to derive the identity of a message receiver such that the privacy of every receiver can be guaranteed. They also formally showed that every receiver in the proposed scheme is anonymous to any other receiver. In this work, the authors study the security of Fan et al.'s anonymous multi-receiver identity-based encryption scheme. It is regretful that they found their scheme is insecure. Every receiver in Fan et al.'s scheme is not anonymous to any other receiver. The authors showed that simple protocol changes can fix these weaknesses and render Fan et al.'s scheme. The improved scheme is proved to satisfy the confidentiality and receiver anonymity in the random oracle.

IET Information Security•Mar 7, 2012•62 citations

Privacy‐preserving multireceiver ID‐based encryption with provable security

Yuh‐Min Tseng, Yi‐Hung Huang, Chang Hui-ju

SUMMARY Multireceiver identity (ID) based encryption and ID‐based broadcast encryption allow a sender to use the public identities of multiple receivers to encrypt messages so that only the selected receivers or a privileged set of users can decrypt the messages. It can be used for many practical applications such as digital content distribution, pay‐per‐view and multicast communication. For protecting the privacy of receivers or providing receiver anonymity, several privacy‐preserving (or anonymous) multireceiver ID‐based encryption and ID‐based broadcast encryption schemes were recently proposed, in which receiver anonymity means that nobody (including any selected receiver), except the sender, knows who the other selected receivers are. However, security incompleteness or flaws were found in these schemes. In this paper, we propose a new privacy‐preserving multireceiver ID‐based encryption scheme with provable security. We formally prove that the proposed scheme is semantically secure for confidentiality and receiver anonymity. Compared with the previously proposed anonymous multireceiver ID‐based encryption and ID‐based broadcast encryption schemes, the proposed scheme has better performance and robust security. Copyright © 2012 John Wiley & Sons, Ltd.

International Journal of Communication Systems•Jun 29, 2012•35 citations

CCA-secure Anonymous Multi-receiver ID-based Encryption

Yuh‐Min Tseng, Yi‐Hung Huang, Chang Hui-ju

Recently, Fan et al. proposed the first anonymous multi-receiver identity (ID)-based encryption (AMIBE) scheme to encrypt a message for multiple selected receivers while achieving anonymity. They claimed that nobody, except the sender, knows who the selected receivers are. However, their scheme has been shown that any selected receiver can extract the identities of the other selected receivers because their security model cannot capture the full requirement of receiver anonymity. In this article, we first re-define the security model of AMIBE. We then propose a new AMIBE scheme to achieve complete receiver anonymity. We prove that the proposed AMIBE scheme is semantically secure against adaptive chosen cipher text attacks (CCA). Comparisons are given to demonstrate the proposed AMIBE scheme's advantages.

International Conference on Advanced Information Networking and Applications Workshops (WAINA)•Mar 1, 2012•19 citations

On the Anonymity of Multi-Receiver Identity-Based Encryption Based on Fujisaki–Okamoto Transformation

Yi‐Fan Tseng, Chun‐I Fan, Cheng-Wei Sung

In 2010, Fan et al. first introduced the concept of anonymous multi-receiver identity-based encryption (AMRIBE). They used the concept of Fujisaki–Okamoto transformation (F.O. transformation) to support their proof in random oracle models. Recently, many works on this topic have been proposed. Most of them adopted Fujisaki–Okamoto transformation to achieve the indistinguishability of encryptions under multi-ID, chosen-ciphertext attacks (IND-MID-CCA) security. However, we find out that these schemes do not gain anonymity against insider attacks. In this manuscript, we use a sequence of games to prove that any AMRIBE scheme will fail to gain anonymity under chosen-ciphertext attacks and chosen-plaintext attacks if the IND-MID-CCA security is proven using Fujisaki–Okamoto transformation.

International Journal of Foundations of Computer Science•Jun 1, 2019•0 citations
Anonymous multi-receiver identity-based encryption can protect the receiver identity privacy and message confidentiality. Thus, it can be used in many fields, such as Voice over Internet Protocol and pay-TV systems. In 2012, Chien improved an anonymous multi-receiver identity-based encryption scheme. This paper points out that Chien's scheme does not satisfy the indistinguishability of encryptions under selective multi-identity, chosen ciphertext attacks. The analysis is important for understanding the security risks.
Anonymous multi-receiver encryption (AME) achieves the security properties of confidentiality and anonymity. Thus, it can be used in VoIP (Voice over Internet Protocol), pay-TV systems, et al. In 2012, Zhang et al. proposed an efficient anonymous multi-receiver encryption protocol. They claimed that their protocol can protect the receiver identity privacy and keep message confidential. In this paper, we point out the weaknesses of Zhang et al.'s protocol. Their protocol cannot satisfy the anonymity against the inner attackers. On the other hand, their AME protocol cannot satisfy the indistinguishability of encryptions under selective multi-identity, chosen ciphertext attacks (IND-AME-CCA). Thus, Zhang et al.'s protocol is insecure. The analysis is important for the engineer to mitigate the security risks.
In a multi-receiver encryption system, a sender chooses a set of authorized receivers and sends them a message securely and efficiently, as the message is well encrypted and only one ciphertext corresponding to the message is generated no matter how many receivers the sender has chosen. It can be applied to video conferencing systems, pay-per-view channels, remote education, and so forth. Due to privacy considerations, an authorized receiver may not expect that his identity is revealed. In 2010, anonymous multi-receiver identity-based (ID-based) encryption was first discussed, and furthermore, many works on the topic have been presented so far. Unfortunately, we find that all of those schemes fail to prove the chosen ciphertext attacks (CCA) security in either confidentiality or anonymity. In this manuscript, we propose the first anonymous multi-receiver ID-based authenticated encryption scheme with CCA security in both confidentiality and anonymity. In the proposed scheme, the identity of the sender of a ciphertext can be authenticated by the receivers after a successful decryption. In addition, the proposed scheme also is the first CCA-secure one against insider attacks. Moreover, only one pairing computation is required in decryption.
In 2010, Fan et al. presented an anonymous multi-receiver identity-based encryption scheme where they adopt Lagrange interpolating polynomial mechanism. They showed that their scheme makes it impossible for an attacker or any other message receiver to derive the identity of a message receiver such that the privacy of every receiver can be guaranteed. They also formally showed that every receiver in the proposed scheme is anonymous to any other receiver. In this work, the authors study the security of Fan et al.'s anonymous multi-receiver identity-based encryption scheme. It is regretful that they found their scheme is insecure. Every receiver in Fan et al.'s scheme is not anonymous to any other receiver. The authors showed that simple protocol changes can fix these weaknesses and render Fan et al.'s scheme. The improved scheme is proved to satisfy the confidentiality and receiver anonymity in the random oracle.
SUMMARY Multireceiver identity (ID) based encryption and ID‐based broadcast encryption allow a sender to use the public identities of multiple receivers to encrypt messages so that only the selected receivers or a privileged set of users can decrypt the messages. It can be used for many practical applications such as digital content distribution, pay‐per‐view and multicast communication. For protecting the privacy of receivers or providing receiver anonymity, several privacy‐preserving (or anonymous) multireceiver ID‐based encryption and ID‐based broadcast encryption schemes were recently proposed, in which receiver anonymity means that nobody (including any selected receiver), except the sender, knows who the other selected receivers are. However, security incompleteness or flaws were found in these schemes. In this paper, we propose a new privacy‐preserving multireceiver ID‐based encryption scheme with provable security. We formally prove that the proposed scheme is semantically secure for confidentiality and receiver anonymity. Compared with the previously proposed anonymous multireceiver ID‐based encryption and ID‐based broadcast encryption schemes, the proposed scheme has better performance and robust security. Copyright © 2012 John Wiley & Sons, Ltd.
Recently, Fan et al. proposed the first anonymous multi-receiver identity (ID)-based encryption (AMIBE) scheme to encrypt a message for multiple selected receivers while achieving anonymity. They claimed that nobody, except the sender, knows who the selected receivers are. However, their scheme has been shown that any selected receiver can extract the identities of the other selected receivers because their security model cannot capture the full requirement of receiver anonymity. In this article, we first re-define the security model of AMIBE. We then propose a new AMIBE scheme to achieve complete receiver anonymity. We prove that the proposed AMIBE scheme is semantically secure against adaptive chosen cipher text attacks (CCA). Comparisons are given to demonstrate the proposed AMIBE scheme's advantages.
In 2010, Fan et al. first introduced the concept of anonymous multi-receiver identity-based encryption (AMRIBE). They used the concept of Fujisaki–Okamoto transformation (F.O. transformation) to support their proof in random oracle models. Recently, many works on this topic have been proposed. Most of them adopted Fujisaki–Okamoto transformation to achieve the indistinguishability of encryptions under multi-ID, chosen-ciphertext attacks (IND-MID-CCA) security. However, we find out that these schemes do not gain anonymity against insider attacks. In this manuscript, we use a sequence of games to prove that any AMRIBE scheme will fail to gain anonymity under chosen-ciphertext attacks and chosen-plaintext attacks if the IND-MID-CCA security is proven using Fujisaki–Okamoto transformation.