Deniable encryption (Canetti et al. CRYPTO ’97) is an intriguing primitive that provides a security guarantee against not only eavesdropping attacks as required by semantic security, but also stronger coercion attacks performed after the fact. The concept of deniability has later demonstrated useful and powerful in many other contexts, such as leakage resilience, adaptive security of protocols, and security against selective opening attacks. Despite its conceptual usefulness, our understanding of how to construct deniable primitives under standard assumptions is restricted. In particular, from standard assumptions such as Learning with Errors (LWE), we have only multi-distributional or non-negligible advantage deniable encryption schemes, whereas with the much stronger assumption of indistinguishable obfuscation, we can obtain at least fully-secure sender-deniable PKE and computation. How to achieve deniability for other more advanced encryption schemes under standard assumptions remains an interesting open question. In this work, we construct a bi-deniable inner product encryption (IPE) in the multi-distributional model without relying on obfuscation as a black box. Our techniques involve new ways of manipulating Gaussian noise, and lead to a significantly tighter analysis of noise growth in Dual Regev type encryption schemes. We hope these ideas can give insight into achieving deniability and related properties for further, advanced cryptographic constructions under standard assumptions.
Deniable encryption (Canetti et al. CRYPTO ’97) is an intriguing primitive that provides a security guarantee against not only eavesdropping attacks as required by semantic security, but also stronger coercion attacks performed after the fact. The concept of deniability has later demonstrated useful and powerful in many other contexts, such as leakage resilience, adaptive security of protocols, and security against selective opening attacks. Despite its conceptual usefulness, our understanding of how to construct deniable primitives under standard assumptions is restricted. In particular, from standard assumptions such as Learning with Errors (LWE), we have only multi-distributional or non-negligible advantage deniable encryption schemes, whereas with the much stronger assumption of indistinguishable obfuscation, we can obtain at least fully-secure sender-deniable PKE and computation. How to achieve deniability for other more advanced encryption schemes under standard assumptions remains an interesting open question. In this work, we construct a bi-deniable inner product encryption (IPE) in the multi-distributional model without relying on obfuscation as a black box. Our techniques involve new ways of manipulating Gaussian noise, and lead to a significantly tighter analysis of noise growth in Dual Regev type encryption schemes. We hope these ideas can give insight into achieving deniability and related properties for further, advanced cryptographic constructions under standard assumptions.
Bi-deniable Encryption scheme means that when the sender and the receiver are coerced, the coercer can obtain fake plaintext, random numbers, and secret keys. It’s a solution strategy in the case of information leakage. Compared with traditional encryption, deniable encryption can provide secret communications in situations of coercion in the Post-Quantum era. Compared with sender-deniable encryption and receiver-deniable encryption, bi-deniable encryption can achieve secret communications in the situation that both sender and receiver are coerced by the coercer. So, we propose to design a bi-deniable encryption scheme under the multi-distribution model. In our bi-deniable encryption scheme, we construct a bi-deniable encryption scheme based on the assumption of Decision-Learning With Errors (DLWE) under the multi-distribution model. Firstly, the principle of Inner Product Predicate Encryption (IPPE) is applied in our scheme. Secondly, we apply the framework of Bi-Translucent Set (BTS), combined with inner product predicate encryption. Thirdly, we construct a series of probabilistic polynomial time algorithms, which apply linear transformation between different lattice structures, and Regev dual encryption. Fourthly, the statistical indistinguishability between the sampling algorithm with discrete Gaussian sampling algorithm, and the computational indistinguishability between LWE’s ciphertext samples with uniform samples, the property of indistinguishability is applied in theorem proving, which obtain Indistinguishability under Chosen Plaintext Attacks (IND-CPA) security and the property of bi-deniability. Given the value range of the Gaussian parameter and security parameter in our scheme, the correctness of the bi-deniable encryption scheme is guaranteed. We also give the security proof of IND-CPA and bi-deniability’s property by a series of games. The ‘Inner-Product Bi-Translucent Set’ Bi-Deniable Encryption scheme under the multi-distribution model is based on Decision-LWE assumption, and can avoid quantum-resistant attacks. The bi-deniable encryption scheme is firstly constructed by the inner product with the Decision-LWE assumption, which can provide better properties of security and deniability.
Abstract. The primitive of deniable encryption was first introduced by Canetti et al. (CRYPTO, 1997). Deniable encryption is a regular public key encryption scheme with the added feature that after running the protocol honestly and transmitting a message m, both Sender and Receiver may produce random coins showing that the transmitted ciphertext was an encryption of any message m ′ in the message space. Deniable encryption is a key tool for constructing incoercible protocols, since it allows a party to send one message and later provide apparent evidence to a coercer that a different message was sent. In addition, deniable encryption may be used to obtain adaptively-secure multiparty computation (MPC) protocols and is secure under selective-opening attacks. Different flavors such as sender-deniable and receiver-deniable encryption, where only the Sender or Receiver can produce fake random coins, have been considered. Recently, several open questions regarding the feasibility of deniable encryption have been resolved (c.f. (O’Neill et al., CRYPTO, 2011), (Bendlin et al., ASIACRYPT, 2011)). A fundamental remaining open question is whether it is possible to construct sender-deniable Encryption Schemes with super-polynomial security, where an adversary has negligible advantage in distinguishing real and fake openings. The primitive of simulatable public key encryption (PKE), introduced by Damg˚ard and Nielsen (CRYPTO, 2000), is a public key encryption scheme with additional properties that allow oblivious sampling of public keys and
Deniable encryption is an intriguing scheme against the problem of information leakage caused by adversary coercion. Previously proposed deniable schemes cannot resist the attack of quantum computers and there are few implementations of these schemes. Aiming at this problem, a deniable encryption scheme based on learning with errors (LWE) and related implementations were proposed. The scheme can resist the quantum attack, and also can deny the plaintext to any fake plaintext, so that the sender can resist the adversary’s coercive attack. Firstly, by using the indistinguishability of the LWE problem, a subset with low density named “translucent set” was constructed in a uniform space. The “translucent set” was used to construct the ciphertexts of bits 0 and 1, which enabled one-way deniability of a single bit and reduced the error rate. Then, a plaintext coding method was proposed to realize two-way deniability of a single bit so that the sender could deny the original plaintext to any fake plaintext. The theoretical analyses were given to show the deniability, security (IND–CPA), correctness, complexity and ciphertext expansion rate of the scheme. Finally, the scheme was implemented by C++, and experiments had been done for the error rate, ciphertext expansion rate, encryption and decryption efficiency. The experimental results showed that the error rate and ciphertext expansion rate were consistent with the theoretical results. Compared with other deniable schemes based on the quadratic residual problem, the proposed scheme has obvious advantages in anti-quantum attack, efficiency and ciphertext expansion rate. Specifically, the encryption efficiency is improved by 70%, and the ciphertext expansion rate is reduced to 1/3 of above schemes.
Inner-product functional encryption (IPFE) is an exciting paradigm for non-interactively computing on encrypted data where a master secret key can be used to derive decryption keys associated with certain inner-product functions in such a way that the decryption operation reveals an inner-product result, and nothing else. Over the decades, all efforts regarding existing IPFE schemes have been dedicated to extending them to multi-input/multi-client scenarios, understanding the security concepts that can be achieved, and identifying a multitude of practical use cases. However, in the event of key compromise, a common issue in real-world applications, the existing IPFE schemes are unable to guarantee the confidentiality of past encryptions. This paper introduces a novel variant of IPFE that supports key updates, called updatable IPFE, potentially opening up a new avenue of research to address the common key exposure problem. In this setting, any sender can initiate the transition to the next period by computing a new public key and a special update. The special update can be processed by the system administrator and the receiver to compute the next-period master secret key and the next-period decryption key, respectively. If done honestly, future (regular) ciphertexts generated with the new public key can be decrypted with the new decryption key, but ciphertexts from the past cannot be decrypted with the new decryption key. To formally illustrate this, we formalize the notion of the indistinguishability-based security under chosen randomness chosen plaintext attacks (IND-CR-CPA). We further propose the first efficient construction of updatable IPFE in the standard model, based on Learning with Errors (LWE) assumption with polynomial modulus-to-noise rate. Finally, we conduct a comprehensive performance evaluation of our updatable IPFE, and the experimental results demonstrate its computational efficiency, making it a viable solution for real-world applications.
Since its proposal by Regev in 2005, the Learning With Errors (LWE) problem was used as the underlying problem for a great variety of schemes. Its applications are many-fold, reaching from basic and highly practical primitives like key exchange, public-key encryption, and signature schemes to very advanced solutions like fully homomorphic encryption, group signatures, and identity based encryption. One of the underlying reasons for this fertility is the flexibility with that LWE can be instantiated. Unfortunately, this comes at a cost: It makes selecting parameters for cryptographic applications complicated. When selecting parameters for a new LWE-based primitive, a researcher has to take the influence of several parameters on the efficiency of the scheme and the runtime of a variety of attacks into consideration. In fact, the missing trust in the concrete hardness of LWE is one of the main problems to overcome to bring LWE-based schemes to practice. This thesis aims at closing the gap between the theoretical knowledge of the hardness of LWE, and the concrete problem of selecting parameters for an LWE-based scheme. To this end, we analyze the existing methods to estimate the hardness of LWE, and introduce new estimation techniques where necessary. Afterwards, we show how to transfer this knowledge into instantiations that are at the same time secure and efficient. We show this process on three examples: - A highly optimized public-key encryption scheme for embedded devices that is based on a variant of Ring-LWE. - A practical signature scheme that served as the foundation of one of the best lattice-based signature schemes based on standard lattices. - An advanced public-key encryption scheme that enjoys the unique property of natural double hardness based on LWE instances similar to those used for fully homomorphic encryption.