Recently, Fan et al. proposed the first anonymous multi-receiver identity (ID)-based encryption (AMIBE) scheme to encrypt a message for multiple selected receivers while achieving anonymity. They claimed that nobody, except the sender, knows who the selected receivers are. However, their scheme has been shown that any selected receiver can extract the identities of the other selected receivers because their security model cannot capture the full requirement of receiver anonymity. In this article, we first re-define the security model of AMIBE. We then propose a new AMIBE scheme to achieve complete receiver anonymity. We prove that the proposed AMIBE scheme is semantically secure against adaptive chosen cipher text attacks (CCA). Comparisons are given to demonstrate the proposed AMIBE scheme's advantages.
Recently, Fan et al. proposed the first anonymous multi-receiver identity (ID)-based encryption (AMIBE) scheme to encrypt a message for multiple selected receivers while achieving anonymity. They claimed that nobody, except the sender, knows who the selected receivers are. However, their scheme has been shown that any selected receiver can extract the identities of the other selected receivers because their security model cannot capture the full requirement of receiver anonymity. In this article, we first re-define the security model of AMIBE. We then propose a new AMIBE scheme to achieve complete receiver anonymity. We prove that the proposed AMIBE scheme is semantically secure against adaptive chosen cipher text attacks (CCA). Comparisons are given to demonstrate the proposed AMIBE scheme's advantages.
In a multi-receiver encryption system, a sender chooses a set of authorized receivers and sends them a message securely and efficiently, as the message is well encrypted and only one ciphertext corresponding to the message is generated no matter how many receivers the sender has chosen. It can be applied to video conferencing systems, pay-per-view channels, remote education, and so forth. Due to privacy considerations, an authorized receiver may not expect that his identity is revealed. In 2010, anonymous multi-receiver identity-based (ID-based) encryption was first discussed, and furthermore, many works on the topic have been presented so far. Unfortunately, we find that all of those schemes fail to prove the chosen ciphertext attacks (CCA) security in either confidentiality or anonymity. In this manuscript, we propose the first anonymous multi-receiver ID-based authenticated encryption scheme with CCA security in both confidentiality and anonymity. In the proposed scheme, the identity of the sender of a ciphertext can be authenticated by the receivers after a successful decryption. In addition, the proposed scheme also is the first CCA-secure one against insider attacks. Moreover, only one pairing computation is required in decryption.
Multireceiver identity-based encryption is a cryptographic primitive, which allows a sender to encrypt a message for multiple receivers efficiently and securely. In some applications, the receivers may not want their identities to be revealed. Motivated by this issue, in 2010, Fan et al. first proposed the concept of anonymous multireceiver identity-based encryption (AMRIBE). Since then, lots of literature studies in this field have been proposed. After surveying the existing works, however, we found that most of them fail to achieve provable anonymity with tight reduction. A security proof with tight reduction means better quality of security and better efficiency of implementation. In this paper, we focus on solving the open problem in this field that is to achieve the ANON-IND-CCA security with tight reduction by giving an AMRIBE scheme. The proposed scheme is proven to be IND-MID-CCA and ANON-MID-CCA secure with tight reduction under a variant of the DBDH assumption. To the best of our knowledge, this is the first scheme proven with tight reducible full CCA security in the standard model.
In 2010, Fan et al. first introduced the concept of anonymous multi-receiver identity-based encryption (AMRIBE). They used the concept of Fujisaki–Okamoto transformation (F.O. transformation) to support their proof in random oracle models. Recently, many works on this topic have been proposed. Most of them adopted Fujisaki–Okamoto transformation to achieve the indistinguishability of encryptions under multi-ID, chosen-ciphertext attacks (IND-MID-CCA) security. However, we find out that these schemes do not gain anonymity against insider attacks. In this manuscript, we use a sequence of games to prove that any AMRIBE scheme will fail to gain anonymity under chosen-ciphertext attacks and chosen-plaintext attacks if the IND-MID-CCA security is proven using Fujisaki–Okamoto transformation.
An anonymous identity based encryption (anonymous IBE) scheme requires that an adversary can not determine the identity of the recipient from a ciphertext encrypted by the corresponding public key. The anonymity was formalized in previous works [1], [13], and this can be considered under chosen plaintext attack and adaptive chosen ciphertext attack, yielding two notions of security, ID-II-CPA and ID-II-CCA, where II denotes “indistinguishability of identities.” However, how to obtain an ID-II-CCA secure anonymous IBE in the random oracle model is still a challenging problem. We firstly propose a new notion of plaintext awareness in the two identities setting, called PATI. Secondly, we prove that the IBE scheme is ID-II-CCA secure if it is PATI secure. Finally, we propose the first generic conversion for anonymous IBE from ID-II-CPA to ID-II-CCA in the random oracle model.
In the situation where there are one sender and multiple receivers, a receiver selective opening (RSO) attack for an identity-based encryption (IBE) scheme considers adversaries that can corrupt some of the receivers and get their user secret keys and plaintexts. Security against RSO attacks for an IBE scheme ensures confidentiality of ciphertexts of uncorrupted receivers. In this paper, we formalize a definition of RSO security against chosen ciphertext attacks (RSO-CCA security) for IBE and propose the first RSO-CCA secure IBE schemes. More specifically, we construct an RSO-CCA secure IBE scheme based on an IND-ID-CPA secure IBE scheme and a non-interactive zero-knowledge proof system with unbounded simulation soundness and multi-theorem zero-knowledge. Through our generic construction, we obtain the first pairing-based and lattice-based RSO-CCA secure IBE schemes.