Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Direct Constructions of Bidirectional Proxy Re-Encryption with Alleviated Trust in Proxy.

Jian Weng, Yunlei Zhao

Published Jan 1, 2011• 7 citations
OpenAlex

Abstract

In this work, we study (the direct constructions of) bidirectional proxy re-encryption (PRE) with alleviated trust in the proxy, specifically the master secret security (MSS) and the nontransitivity (NT) security, in the standard model, and achieve the following: • A multi-hop MSS-secure bidirectional PRE scheme with security against chosen plaintext attacks (CPA) in the standard model, where the ciphertext remains constant size regardless how many times it has been re-encrypted. To the best of our knowledge, there exists previously no MSS-secure multi-hop bidirectional PRE scheme with constant size of ciphertexts (whether in the random oracle model or not). • A single-hop MSS-secure and non-transitive bidirectional PRE scheme with security against chosen ciphertext attacks (CCA) in the standard model. The CCA-secure scheme is based on the CPA-secure scheme, and particularly employs a new re-encryption key (REK) generation mechanism to which each user makes equal contributions, where a single REK is used in both directions with the same computation so that the proxy needs not to distinguish the transform direction when it re-encrypts ciphertexts. Besides alleviated trust in proxy, single-hop non-transitive bidirectional PRE schemes also enjoy better fine-grained delegate right control (against malicious proxy). The security analysis uses Coron’s technique [Coron, Crypto 2000], which particularly allows adaptive secret-key corruption. Along the way, we also refine and clarify the security models for bidirectional PRE. 1

Related papers

Toward CCA-secure bidirectional proxy re-encryption without pairing nor random oracle

Longxia Zhang, Xu An Wang, Wei Wang

Proxy re-encryption, introduced by Blaze et al. in 1998, allows a proxy to transform a ciphertext computed under Alice's public key into one that can be opened under Bob's decryption key. An open problem of constructing (bidirectional or unidirectional) IND-PRE-CCA2 secure proxy re-encryption scheme in the standard model yet without pairings was left until now. In this paper, based on Hanaoka's efficient chosen ciphertext secure public key encryption under the computational Diffie-Hellman assumption, we try to solve this open problem by presenting two new bidirectional proxy re-encryption schemes, which are restricted IND-PRE-CCA2 secure without pairing nor random oracle.

International Conference on Signal Processing Systems (ICSPS)•Jul 1, 2010•1 citation

On the security of two multi-use CCA-secure proxy re-encryption schemes

Jindan Zhang, Xu An Wang, Yi Ding +1 more

In proxy re-encryption (PRE), a semi-trusted proxy can convert a ciphertext originally intended for Alice into one which can be decrypted by Bob, while the proxy cannot know the corresponding plaintext. PRE can be classified as single-use PRE and multi-use PRE according to the times the ciphertext can be transformed. In multi-use PRE schemes, the ciphertext can be transformed from A to B and to C and so on. In CCS’09 (post session), Wang et al. proposed a multi-use unidirectional CCA-secure proxy re-encryption scheme. Unfortunately, we show their proposal is not CCA-secure in the corresponding security models by giving concrete attacks. In 2010, Ren et al. proposed a hierarchical identity-based proxy re-encryption scheme without random oracles, and claimed their scheme was also multi-use and CCA-secure, we also show their scheme is not secure.

International Journal of Intelligent Information and Database Systems•Jan 1, 2013•3 citations

Chosen-Ciphertext Secure Proxy Re-Encryption for Bounded Linear Functions

Fucai Luo, Haiyan Wang, Xingfu Yan +1 more

Proxy re-encryption (PRE) allows a proxy to use the reencryption keys to convert ciphertexts encrypted under the delegators' public keys into ones that can be decrypted using the delegatees' secret keys, without revealing the underlying plaintext. However, PRE is limited to an all-or-nothing re-encryption, that is, the delegatee can either decrypt the re-encrypted ciphertext to obtain the whole message, or it learns nothing about the underlying message. To address this limitation, Zhou et al. (Asiacrypt 2023) proposed a new variant of PRE called fine-grained PRE (FPRE). FPRE extends PRE to support fine-grained re-encryption, allowing the proxy to convert any ciphertext encrypting a message m to a new ciphertext encrypting f (m) with a fine-grained re-encryption key for any function f. This enables the delegator to flexibly control the sharing of messages by specifying functions. Unfortunately, their scheme achieves only CPA security and requires a common random/reference string (CRS) during key generation. This requirement may weaken the syntax of (F)PRE, which allows users to independently generate their own keys. In this paper, we propose a new FPRE for bounded linear functions that we prove is CCA1 secure and does not require a CRS, based on the Learning with Errors (LWE) assumption. When the linear function is set to be the identity function, our construction immediately yields the first PRE scheme without a CRS, with CCA1 security under adaptive corruptions in the standard model. The main technique behind our construction is the design of a deterministic preimage computation algorithm for the decryption oracle in the security proof. To demonstrate the broader applicability of our proposed algorithm beyond the context of (F)PRE, we use it to prove the selective-identity CCA1 security of Agrawal et al.'s (Eurocrypt 2010) identity-based encryption (IBE) scheme, which was previously only known to be selective-identity CPA secure.

•Dec 5, 2024•0 citations

Restricted CCA-secure bidirectional proxy re-encryption scheme

Guo Duntao, Xu An Wang, Minqing Zhang +1 more

Proxy re-encryption allows a proxy to transform a ciphertext computed under Alice's public key into one that can be opened under Bob's decryption key. In CANS'08, Deng et al. proposed the first bidirectional IND-PRE-CCA2 secure proxy re-encryption without parings. Later, in PKC'09, Shao et al. proposed the first unidirectional IND-PRE-CCA2 secure proxy re-encryption without parings. But both of these schemes prove their security in the random oracle. They left an open problem of constructing (bidirectional or unidirectional) IND-PRE-CCA2 secure proxy re-encryption scheme in the standard model yet without pairings. In this paper, we try to solve this open problem by proposing two new restricted IND-PRE-CCA2 secure bidirectional proxy re-encryption schemes without pairing nor random oracle.

•Jul 1, 2010•0 citations

Lattice-Based Key Private Pres with HRA Security and Pcs Security

Yang Wang, Yanmin Zhao, Mingqiang Wang

Proxy re-encryption (PRE) schemes, which nicely solve the problem of delegating decryption rights, enable a semi-trusted proxy to transform a ciphertext encrypted under one key into a ciphertext of the same message under another arbitrary key. Cohen first pointed out the insufficiency of the security under chosen-plaintext attacks (CPA) of PREs in PKC 2019, and proposed a strictly stronger security notion, named security under honest re-encryption attacks (HRA), of PREs. Surprisingly, a few PREs satisfy the stronger HRA security and almost all of them are paring-based till now. To the best of our knowledge, we present the first direct construction of HRA secure single-hop PREs based on standard LWE problems with comparably small and polynomially-bounded parameters in this paper. Combing known reductions, the HRA security of our PREs could also be guaranteed by the worst-case basic lattice problems (e.g. SIVPγ with γ=Õ(n3.5)). Our single-hop PRE schemes are key-private, which means that the implicit identities of a re-encryption key will not be revealed even in the case of a proxy colluding with some corrupted users. Meanwhile, our single-hop PRE schemes are also post-compromise (PCS) secure, ensuring that a re-encrypted ciphertext remains confidential even when the past key, potential old ciphertexts and the re-encryption key have been exposed. Some discussions about key-privacy of multi-hop PREs are also proposed, which indicates that several constructions of multi-hop PREs do not satisfy their key-privacy definitions.

Computer Standards & Interfaces•Jan 1, 2022•4 citations

A Multi-use CCA-Secure Proxy Re-encryption Scheme

Yi Cai, Xudong Liu

Proxy re-encryption (PRE) can be classified as single-hop PRE and multi-use PRE according to the times which the ciphertext is transformed. Finding a unidirectional, multi-use, and chosen ciphertext attack (CCA) secure PRE is presented as an open problem by Canetti et al. Wang claimed to resolve this problem by proposing the first multi-use CCAsecure unidirectional PRE scheme. But we found that different with single-hop PRE, multi-use PRE without randomize encrypt key in its re-encryption algorithm could be vulnerable to attack. A new type attack to multi-use CCA-secure PRE named proxy bypass attack is proposed with a concrete attacks on Wang-MultiUse-PRE scheme. This attack is also effective for other multi-use scheme. At last we propose an improvement for Multi-Use-PRE to resist proxy bypass attack by randomize re-encryption algorithm.

IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech)•Aug 1, 2014•6 citations
In this work, we study (the direct constructions of) bidirectional proxy re-encryption (PRE) with alleviated trust in the proxy, specifically the master secret security (MSS) and the nontransitivity (NT) security, in the standard model, and achieve the following: • A multi-hop MSS-secure bidirectional PRE scheme with security against chosen plaintext attacks (CPA) in the standard model, where the ciphertext remains constant size regardless how many times it has been re-encrypted. To the best of our knowledge, there exists previously no MSS-secure multi-hop bidirectional PRE scheme with constant size of ciphertexts (whether in the random oracle model or not). • A single-hop MSS-secure and non-transitive bidirectional PRE scheme with security against chosen ciphertext attacks (CCA) in the standard model. The CCA-secure scheme is based on the CPA-secure scheme, and particularly employs a new re-encryption key (REK) generation mechanism to which each user makes equal contributions, where a single REK is used in both directions with the same computation so that the proxy needs not to distinguish the transform direction when it re-encrypts ciphertexts. Besides alleviated trust in proxy, single-hop non-transitive bidirectional PRE schemes also enjoy better fine-grained delegate right control (against malicious proxy). The security analysis uses Coron’s technique [Coron, Crypto 2000], which particularly allows adaptive secret-key corruption. Along the way, we also refine and clarify the security models for bidirectional PRE. 1
Proxy re-encryption, introduced by Blaze et al. in 1998, allows a proxy to transform a ciphertext computed under Alice's public key into one that can be opened under Bob's decryption key. An open problem of constructing (bidirectional or unidirectional) IND-PRE-CCA2 secure proxy re-encryption scheme in the standard model yet without pairings was left until now. In this paper, based on Hanaoka's efficient chosen ciphertext secure public key encryption under the computational Diffie-Hellman assumption, we try to solve this open problem by presenting two new bidirectional proxy re-encryption schemes, which are restricted IND-PRE-CCA2 secure without pairing nor random oracle.
In proxy re-encryption (PRE), a semi-trusted proxy can convert a ciphertext originally intended for Alice into one which can be decrypted by Bob, while the proxy cannot know the corresponding plaintext. PRE can be classified as single-use PRE and multi-use PRE according to the times the ciphertext can be transformed. In multi-use PRE schemes, the ciphertext can be transformed from A to B and to C and so on. In CCS’09 (post session), Wang et al. proposed a multi-use unidirectional CCA-secure proxy re-encryption scheme. Unfortunately, we show their proposal is not CCA-secure in the corresponding security models by giving concrete attacks. In 2010, Ren et al. proposed a hierarchical identity-based proxy re-encryption scheme without random oracles, and claimed their scheme was also multi-use and CCA-secure, we also show their scheme is not secure.
Proxy re-encryption (PRE) allows a proxy to use the reencryption keys to convert ciphertexts encrypted under the delegators' public keys into ones that can be decrypted using the delegatees' secret keys, without revealing the underlying plaintext. However, PRE is limited to an all-or-nothing re-encryption, that is, the delegatee can either decrypt the re-encrypted ciphertext to obtain the whole message, or it learns nothing about the underlying message. To address this limitation, Zhou et al. (Asiacrypt 2023) proposed a new variant of PRE called fine-grained PRE (FPRE). FPRE extends PRE to support fine-grained re-encryption, allowing the proxy to convert any ciphertext encrypting a message m to a new ciphertext encrypting f (m) with a fine-grained re-encryption key for any function f. This enables the delegator to flexibly control the sharing of messages by specifying functions. Unfortunately, their scheme achieves only CPA security and requires a common random/reference string (CRS) during key generation. This requirement may weaken the syntax of (F)PRE, which allows users to independently generate their own keys. In this paper, we propose a new FPRE for bounded linear functions that we prove is CCA1 secure and does not require a CRS, based on the Learning with Errors (LWE) assumption. When the linear function is set to be the identity function, our construction immediately yields the first PRE scheme without a CRS, with CCA1 security under adaptive corruptions in the standard model. The main technique behind our construction is the design of a deterministic preimage computation algorithm for the decryption oracle in the security proof. To demonstrate the broader applicability of our proposed algorithm beyond the context of (F)PRE, we use it to prove the selective-identity CCA1 security of Agrawal et al.'s (Eurocrypt 2010) identity-based encryption (IBE) scheme, which was previously only known to be selective-identity CPA secure.
Proxy re-encryption allows a proxy to transform a ciphertext computed under Alice's public key into one that can be opened under Bob's decryption key. In CANS'08, Deng et al. proposed the first bidirectional IND-PRE-CCA2 secure proxy re-encryption without parings. Later, in PKC'09, Shao et al. proposed the first unidirectional IND-PRE-CCA2 secure proxy re-encryption without parings. But both of these schemes prove their security in the random oracle. They left an open problem of constructing (bidirectional or unidirectional) IND-PRE-CCA2 secure proxy re-encryption scheme in the standard model yet without pairings. In this paper, we try to solve this open problem by proposing two new restricted IND-PRE-CCA2 secure bidirectional proxy re-encryption schemes without pairing nor random oracle.
Proxy re-encryption (PRE) schemes, which nicely solve the problem of delegating decryption rights, enable a semi-trusted proxy to transform a ciphertext encrypted under one key into a ciphertext of the same message under another arbitrary key. Cohen first pointed out the insufficiency of the security under chosen-plaintext attacks (CPA) of PREs in PKC 2019, and proposed a strictly stronger security notion, named security under honest re-encryption attacks (HRA), of PREs. Surprisingly, a few PREs satisfy the stronger HRA security and almost all of them are paring-based till now. To the best of our knowledge, we present the first direct construction of HRA secure single-hop PREs based on standard LWE problems with comparably small and polynomially-bounded parameters in this paper. Combing known reductions, the HRA security of our PREs could also be guaranteed by the worst-case basic lattice problems (e.g. SIVPγ with γ=Õ(n3.5)). Our single-hop PRE schemes are key-private, which means that the implicit identities of a re-encryption key will not be revealed even in the case of a proxy colluding with some corrupted users. Meanwhile, our single-hop PRE schemes are also post-compromise (PCS) secure, ensuring that a re-encrypted ciphertext remains confidential even when the past key, potential old ciphertexts and the re-encryption key have been exposed. Some discussions about key-privacy of multi-hop PREs are also proposed, which indicates that several constructions of multi-hop PREs do not satisfy their key-privacy definitions.
Proxy re-encryption (PRE) can be classified as single-hop PRE and multi-use PRE according to the times which the ciphertext is transformed. Finding a unidirectional, multi-use, and chosen ciphertext attack (CCA) secure PRE is presented as an open problem by Canetti et al. Wang claimed to resolve this problem by proposing the first multi-use CCAsecure unidirectional PRE scheme. But we found that different with single-hop PRE, multi-use PRE without randomize encrypt key in its re-encryption algorithm could be vulnerable to attack. A new type attack to multi-use CCA-secure PRE named proxy bypass attack is proposed with a concrete attacks on Wang-MultiUse-PRE scheme. This attack is also effective for other multi-use scheme. At last we propose an improvement for Multi-Use-PRE to resist proxy bypass attack by randomize re-encryption algorithm.