© 2026 Aqora Quantum S.A.S.

Terms Privacy Legal Notice

Journal of the Institute of Electronics Engineers of Korea

ID-Based Proxy Re-encryption Scheme with Chosen-Ciphertext Security

Woo Kwon Koo, Jungyeon Hwang, Hyoung-Joong Kim, Donghoon Lee

Published Jan 1, 2009• 1 citation

Abstract

A proxy re-encryption scheme allows Alice to temporarily delegate the decryption rights to Bob via a proxy. Alice gives the proxy a re-encryption key so that the proxy can convert a ciphertext for Alice into the ciphertext for Bob. Recently, ID-based proxy re-encryption schemes are receiving considerable attention for a variety of applications such as distributed storage, DRM, and email-forwarding system. And a non-interactive identity-based proxy re-encryption scheme was proposed for achieving CCA-security by Green and Ateniese. In the paper, we show that the identity-based proxy re-encryption scheme is unfortunately vulnerable to a collusion attack. The collusion of a proxy and a malicious user enables two parties to derive other honest users' private keys and thereby decrypt ciphertexts intended for only the honest user. To solve this problem, we propose two ID-based proxy re-encryption scheme schemes, which are proved secure under CPA and CCA in the random oracle model. For achieving CCA-security, we present self-authentication tag based on short signature. Important features of proposed scheme is that ciphertext structure is preserved after the ciphertext is re-encrypted. Therefore it does not lead to ciphertext expansion. And there is no limitation on the number of re-encryption.

Related papers

Collusion-Resistant Identity-Based Proxy Re-Encryption Without Random Oracles

JunJie Qiu, Jungbok Jo, Hoon Jae Lee

In an identity-based proxy re-encryption scheme, a semi-trusted proxy can convert a ciphertext under Alice's public identity into a ciphertext for Bob.The proxy does not know the secret key of Alice or Bob, and also does not know the plaintext during the conversion.In identity-based proxy re-encryption, the collusion of the proxy and a delegatee may result in the decryption of ciphertext for delegator.In this paper, we present a new scheme which can avoid the collusion of proxy and delegatee.Our scheme improves the scheme of Chu and Tzeng while inheriting all useful properties such as unidirectionality and non-interactivity.In our scheme, we get the security by using added secret parameter and change the secret key and re-encryption key.Our sheme is secure against Chosen-Ciphertext Attack (CCA) and collusion attack in the standard model.

International Journal of Security and Its Applications•Sep 30, 2015•5 citations

CCA-secure Identity Based Proxy Re-encryption Based on a Variant of BB1 IBE

Xu An Wang, Xiaoyuan Yang, Junru Hu

In 1998, Blaze, Bleumer, and Strauss proposed a kind of cryptographic primitive called proxy re-encryption. In proxy re-encryption, a proxy can transform a ciphertext computed under Alice's public key into one that can be opened under Bob's decryption key. In this paper, with the help of the PKG, we construct a CCA-secure identity based proxy reencryption scheme based on a variant of BBi identity based encryption (IBE), we also prove its security in the random oracle model.

International Conference on Networks Security, Wireless Communications and Trusted Computing (NSWCTC)•Jan 1, 2010•2 citations

Security Analysis of a Multi-use Identity Based CCA-Secure Proxy Re-encryption Scheme

Jindan Zhang, Xu An Wang

In proxy re-encryption (PRE), a semi-trusted proxy can convert a cipher text originally intended for Alice into one which can be decrypted by Bob, while the proxy can not know the underlying plaintext. In multi-use PRE schemes, the cipher text can be transformed from Alice to Bob and to Charlie and so on. Due to its cipher text transformation property, it is difficult to achieve chosen cipher text security for PRE, especially for multi-use PRE. IBE is a new kind of public-key encryption where the recipient's public key is an arbitrary string that represents the recipient's identity. Identity based proxy re-encryption (IBPRE) is a primitive combing the feature of IBE and PRE. Recently Wang et al. proposed a multi-use unidirectional CCA-secure identity based proxy re-encryption (IBPRE) scheme. Unfortunately, we show their proposal is not CCA-secure in the corresponding security models by giving concrete attacks.

International Conference on Intelligent Networking and Collaborative Systems (INCoS)•Sep 1, 2012•10 citations

On the security of two multi-use CCA-secure proxy re-encryption schemes

Jindan Zhang, Xu An Wang, Yi Ding +1 more

In proxy re-encryption (PRE), a semi-trusted proxy can convert a ciphertext originally intended for Alice into one which can be decrypted by Bob, while the proxy cannot know the corresponding plaintext. PRE can be classified as single-use PRE and multi-use PRE according to the times the ciphertext can be transformed. In multi-use PRE schemes, the ciphertext can be transformed from A to B and to C and so on. In CCS’09 (post session), Wang et al. proposed a multi-use unidirectional CCA-secure proxy re-encryption scheme. Unfortunately, we show their proposal is not CCA-secure in the corresponding security models by giving concrete attacks. In 2010, Ren et al. proposed a hierarchical identity-based proxy re-encryption scheme without random oracles, and claimed their scheme was also multi-use and CCA-secure, we also show their scheme is not secure.

International Journal of Intelligent Information and Database Systems•Jan 1, 2013•3 citations

Certificateless Proxy Re-Encryption Without Pairing: Revisited

Akshayaram Srinivasan, Chandrasekharan Pandu Rangan

Proxy Re-Encryption was introduced by Blaze, Bleumer and Strauss to efficiently solve the problem of delegation of decryption rights. In proxy re-encryption, a semi-honest proxy transforms a ciphertext intended for Alice to a ciphertext of the same message for Bob without learning anything about the underlying message. From its introduction, several proxy re-encryption schemes in the Public Key In-frastructure (PKI) and Identity (ID) based setting have been proposed. In practice, systems in the public key infrastructure suffer from the certificate management problem and those in identity based setting suffer from the key escrow problem. Certificateless Proxy Re-encryption schemes enjoy the advantages provided by ID-based constructions without suffering from the key escrow problem. In this work, we construct the first unidirectional, single-hop CCA-secure certificateless proxy re-encryption scheme without pairing by extending the PKI based construction of Chow et al. proposed in 2010. We prove its security in the random oracle model under the Computational Diffie-Hellman (CDH) assumption. Prior to this work, the only secure certificateless proxy re-encryption scheme is due to Guo et al. proposed in 2013 using bilinear pairing. The construction proposed in this work is more efficient than that system and its security relies on more standard assumptions. We also show that the recently proposed construction of Yang et al. is insecure with respect to the security model considered in this work.

•Jan 1, 2015•1 citation

Toward CCA-secure bidirectional proxy re-encryption without pairing nor random oracle

Longxia Zhang, Xu An Wang, Wei Wang

Proxy re-encryption, introduced by Blaze et al. in 1998, allows a proxy to transform a ciphertext computed under Alice's public key into one that can be opened under Bob's decryption key. An open problem of constructing (bidirectional or unidirectional) IND-PRE-CCA2 secure proxy re-encryption scheme in the standard model yet without pairings was left until now. In this paper, based on Hanaoka's efficient chosen ciphertext secure public key encryption under the computational Diffie-Hellman assumption, we try to solve this open problem by presenting two new bidirectional proxy re-encryption schemes, which are restricted IND-PRE-CCA2 secure without pairing nor random oracle.

International Conference on Signal Processing Systems (ICSPS)•Jul 1, 2010•1 citation

A proxy re-encryption scheme allows Alice to temporarily delegate the decryption rights to Bob via a proxy. Alice gives the proxy a re-encryption key so that the proxy can convert a ciphertext for Alice into the ciphertext for Bob. Recently, ID-based proxy re-encryption schemes are receiving considerable attention for a variety of applications such as distributed storage, DRM, and email-forwarding system. And a non-interactive identity-based proxy re-encryption scheme was proposed for achieving CCA-security by Green and Ateniese. In the paper, we show that the identity-based proxy re-encryption scheme is unfortunately vulnerable to a collusion attack. The collusion of a proxy and a malicious user enables two parties to derive other honest users' private keys and thereby decrypt ciphertexts intended for only the honest user. To solve this problem, we propose two ID-based proxy re-encryption scheme schemes, which are proved secure under CPA and CCA in the random oracle model. For achieving CCA-security, we present self-authentication tag based on short signature. Important features of proposed scheme is that ciphertext structure is preserved after the ciphertext is re-encrypted. Therefore it does not lead to ciphertext expansion. And there is no limitation on the number of re-encryption.

In an identity-based proxy re-encryption scheme, a semi-trusted proxy can convert a ciphertext under Alice's public identity into a ciphertext for Bob.The proxy does not know the secret key of Alice or Bob, and also does not know the plaintext during the conversion.In identity-based proxy re-encryption, the collusion of the proxy and a delegatee may result in the decryption of ciphertext for delegator.In this paper, we present a new scheme which can avoid the collusion of proxy and delegatee.Our scheme improves the scheme of Chu and Tzeng while inheriting all useful properties such as unidirectionality and non-interactivity.In our scheme, we get the security by using added secret parameter and change the secret key and re-encryption key.Our sheme is secure against Chosen-Ciphertext Attack (CCA) and collusion attack in the standard model.

In proxy re-encryption (PRE), a semi-trusted proxy can convert a cipher text originally intended for Alice into one which can be decrypted by Bob, while the proxy can not know the underlying plaintext. In multi-use PRE schemes, the cipher text can be transformed from Alice to Bob and to Charlie and so on. Due to its cipher text transformation property, it is difficult to achieve chosen cipher text security for PRE, especially for multi-use PRE. IBE is a new kind of public-key encryption where the recipient's public key is an arbitrary string that represents the recipient's identity. Identity based proxy re-encryption (IBPRE) is a primitive combing the feature of IBE and PRE. Recently Wang et al. proposed a multi-use unidirectional CCA-secure identity based proxy re-encryption (IBPRE) scheme. Unfortunately, we show their proposal is not CCA-secure in the corresponding security models by giving concrete attacks.

In proxy re-encryption (PRE), a semi-trusted proxy can convert a ciphertext originally intended for Alice into one which can be decrypted by Bob, while the proxy cannot know the corresponding plaintext. PRE can be classified as single-use PRE and multi-use PRE according to the times the ciphertext can be transformed. In multi-use PRE schemes, the ciphertext can be transformed from A to B and to C and so on. In CCS’09 (post session), Wang et al. proposed a multi-use unidirectional CCA-secure proxy re-encryption scheme. Unfortunately, we show their proposal is not CCA-secure in the corresponding security models by giving concrete attacks. In 2010, Ren et al. proposed a hierarchical identity-based proxy re-encryption scheme without random oracles, and claimed their scheme was also multi-use and CCA-secure, we also show their scheme is not secure.

Proxy Re-Encryption was introduced by Blaze, Bleumer and Strauss to efficiently solve the problem of delegation of decryption rights. In proxy re-encryption, a semi-honest proxy transforms a ciphertext intended for Alice to a ciphertext of the same message for Bob without learning anything about the underlying message. From its introduction, several proxy re-encryption schemes in the Public Key In-frastructure (PKI) and Identity (ID) based setting have been proposed. In practice, systems in the public key infrastructure suffer from the certificate management problem and those in identity based setting suffer from the key escrow problem. Certificateless Proxy Re-encryption schemes enjoy the advantages provided by ID-based constructions without suffering from the key escrow problem. In this work, we construct the first unidirectional, single-hop CCA-secure certificateless proxy re-encryption scheme without pairing by extending the PKI based construction of Chow et al. proposed in 2010. We prove its security in the random oracle model under the Computational Diffie-Hellman (CDH) assumption. Prior to this work, the only secure certificateless proxy re-encryption scheme is due to Guo et al. proposed in 2013 using bilinear pairing. The construction proposed in this work is more efficient than that system and its security relies on more standard assumptions. We also show that the recently proposed construction of Yang et al. is insecure with respect to the security model considered in this work.

Proxy re-encryption, introduced by Blaze et al. in 1998, allows a proxy to transform a ciphertext computed under Alice's public key into one that can be opened under Bob's decryption key. An open problem of constructing (bidirectional or unidirectional) IND-PRE-CCA2 secure proxy re-encryption scheme in the standard model yet without pairings was left until now. In this paper, based on Hanaoka's efficient chosen ciphertext secure public key encryption under the computational Diffie-Hellman assumption, we try to solve this open problem by presenting two new bidirectional proxy re-encryption schemes, which are restricted IND-PRE-CCA2 secure without pairing nor random oracle.