Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Entropy

New Constructions of Identity-Based Dual Receiver Encryption from Lattices

Yuan Liu, Licheng Wang, Xiaoying Shen, Lixiang Li

Published May 28, 2020• 3 citations
Publisher

Abstract

Dual receiver encryption (DRE), being originally conceived at CCS 2004 as a proof technique, enables a ciphertext to be decrypted to the same plaintext by two different but dual receivers and becomes popular recently due to itself useful application potentials such secure outsourcing, trusted third party supervising, client puzzling, etc. Identity-based DRE (IB-DRE) further combines the bilateral advantages/facilities of DRE and identity-based encryption (IBE). Most previous constructions of IB-DRE are based on bilinear pairings, and thus suffers from known quantum algorithmic attacks. It is interesting to build IB-DRE schemes based on the well-known post quantum platforms, such as lattices. At ACISP 2018, Zhang et al. gave the first lattice-based construction of IB-DRE, and the main part of the public parameter in this scheme consists of 2 n + 2 matrices where n is the bit-length of arbitrary identity. In this paper, by introducing an injective map and a homomorphic computation technique due to Yamada at EUROCRYPT 2016, we propose another lattice-based construction of IB-DRE in an even efficient manner: The main part of the public parameters consists only of 2 p n 1 p + 2 matrices of the same dimensions, where p ( ≥ 2 ) is a flexible constant. The larger the p and n, the more observable of our proposal. Typically, when p = 2 and n = 284 according to the suggestion given by Peikert et al., the size of public parameters in our proposal is reduced to merely 12% of Zhang et al.’s method. In addition, to lighten the pressure of key generation center, we extend our lattice-based IB-DRE scheme to hierarchical scenario. Finally, both the IB-DRE scheme and the HIB-DRE scheme are proved to be indistinguishable against adaptively chosen identity and plaintext attacks (IND-ID-CPA).

DOI
10.3390/e22060599

Related papers

Efficient Lattice based (H)IB-DRE

Kunwar Pal Singh

In CCS'04, Diament etc al. presented special kind of public key encryption called Dual Receiver Encryption (DRE).In DRE, sender encrypts the plaintext using public keys of two independent receivers.Both independent receivers can decrypt the ciphertext into the same plaintext using their own private keys.This new cryptography primitive has applications in construction of complete nonmalleability and plaintext-awareness public key encryption, for a secure management of data that is to be disseminated to distributed processors, for ubiquitous and mobile computing applications.Daode Zhang et.al. constructed lattice-based IB-DRE scheme which is secure against stronger security notion i.e. adaptive-ID.We present hierarchical identity based dual encryption (HIB-DRE) scheme under LWE assumption.To the best of our knowledge, this gives the first provably secure HIB-DRE scheme in the lattice based setting.Independent work by Naccache[1] and Chatterjee -Sarkar[2] presented a variant of Waters's identity based encryption scheme to reduce Public Parameters.They have considered an identity of l-bits as l chunks where size of each chunk is l/l .This reduces the Public Parameter (PP) size from l to l n × m matrices.This idea was named as blocking technique [3].We have used blocking technique to reduce the size of PP.Daode Zhang et.al.[4] presented adaptive secure IB-DRE scheme.This scheme[4] contains l + 1, n × m matrices as PPs, where l denotes the number of the bits in identity.Using blocking technique we have reduced the size of PP by around factor β .Because of this the size of prime number q in field Z q is increased by 2 β which results in increase in computation cost.We have shown that compared to Daode Zhang et.al.scheme the size of the PP can be decreased approximately by 80% and the time complexity is increased by only 1.40% for a suitably chosen β .

Journal of Wireless Mobile Networks Ubiquitous Computing and Dependable Applications•Dec 30, 2022•0 citations

(Identity-based) dual receiver encryption from lattice-based programmable hash functions with high min-entropy

Yanyan Liu, Daode Zhang, Yi Deng +1 more

Dual receiver encryption (DRE) is an important cryptographic primitive introduced by Diament et al. at CCS’04, which allows two independent receivers to decrypt a same ciphertext to obtain the same plaintext. This primitive is quite useful in designing combined public key cryptosystems and denial of service attack-resilient protocols. In this paper, we obtain some results as follows. Using weak lattice-based programmable hash functions (wLPHF) with high min-entropy (Crypto’16), we give a generic IND-CCA secure DRE construction in the standard model. Furthermore, we get a concrete DRE scheme by instantiating a concrete wLPHF with high min-entropy. For DRE notion in the identity-based setting, identity-based DRE (IB-DRE), basing on lattice-based programmable hash functions (LPHF) with high min-entropy, we give a framework of IND-ID-CPA secure IB-DRE construction in the standard model. When instantiating with concrete LPHFs with high min-entropy, we obtain five concrete IB-DRE schemes.

Cybersecurity•Jun 13, 2019•5 citations

Hierarchical identity-based encryption with receiver selective opening security in the multi-challenge setting

Zi-Yuan Liu, Masahiro Mambo, Raylin Tso +1 more

Receiver selective opening (RSO) security considers the security of encryption schemes under the scenario of a single sender and multiple receivers, where an adversary is allowed to adaptively corrupt some receivers’ secret keys. RSO security has been proven to be more secure than indistinguishability-based security notions. A lot of research has focused on RSO security in terms of public-key encryption and identity-based encryption (IBE); however, hierarchical IBE (HIBE), which is a generalization of IBE, is still lacking in the study, and how to obtain such a construction remains an open problem. To address this gap, we initiate a study of RSO security on HIBE in this work. Precisely, we first formalize the definition of simulation-based RSO against identity-chosen-plaintext/ciphertext attacks in the k-challenge setting (SIM-ID-RSO $$_k$$ -CPA/CCA) for HIBE. We then present generic SIM-ID-RSO $$_k$$ -CCA secure HIBE constructions by introducing the double secret key paradigm. Specifically, we show that a SIM-ID-RSO $$_k$$ -CCA secure HIBE scheme can be obtained from an IND-ID-CPA secure HIBE scheme as well as a one-time signature scheme that satisfies strong unforgeability. Through our general construction, we can derive various concrete schemes based on different hard assumptions (e.g., lattice-based and pairing-based SIM-ID-RSO $$_k$$ -CCA secure HIBE schemes) according to usage requirements.

Designs Codes and Cryptography•Jul 1, 2026•0 citations

Adaptively Secure Efficient (H)IBE over Ideal Lattice with Short Parameters

Yuan Zhang, Yuan Liu, Yurong Guo +2 more

Identity-based encryption (IBE), and its hierarchical extension (HIBE), are interesting cryptographic primitives that aim at the implicit authentication on the users' public keys by using users' identities directly. During the past several decades, numerous elegant pairing-based (H)IBE schemes were proposed. However, most pairing-related security assumptions suffer from known quantum algorithmic attacks. Therefore, the construction of lattice-based (H)IBE became one of the hot directions in recent years. In the setting of most existing lattice-based (H)IBE schemes, each bit of a user's identity is always associated with a parameter matrix. This always leads to drastic but unfavorable increases in the sizes of the system public parameters. To overcome this issue, we propose a flexible trade-off mechanism between the size of the public parameters and the involved computational cost using the blocking technique. More specifically, we divide an identity into l' segments and associate each segment with a matrix, while increasing the lattice modulo slightly for maintaining the same security level. As a result, for the setting of 160-bit identities, we show that the size of the public parameters can be reduced by almost 89.7% (resp. 93.8%) while increasing the computational cost by merely 5.2% (resp. 12.25%) when l' is a set of 16 (resp. 8). Finally, our IBE scheme is extended to an HIBE scheme, and both of them are proved to achieve the indistinguishability of ciphertexts against adaptively chosen identity and chosen plaintext attack (IND-ID-CPA) in the standard model, assuming that the well-known ring learning with error (RLWE) problem over the involved ideal lattices is intractable, even in the post-quantum era.

Entropy•Nov 2, 2020•4 citations

Efficient hierarchical identity based encryption scheme in the standard model over lattices

Fenghe Wang, Chunxiao Wang, Zhenhua Liu

Using lattice basis delegation in a fixed dimension, we propose an efficient lattice-based hierarchical identity based encryption (HIBE) scheme in the standard model whose public key size is only ( dm 2 + mn ) log q bits and whose message-ciphertext expansion factor is only log q , where d is the maximum hierarchical depth and ( n , m , q ) are public parameters. In our construction, a novel public key assignment rule is used to averagely assign one random and public matrix to two identity bits, which implies that d random public matrices are enough to build the proposed HIBE scheme in the standard model, compared with the case in which 2 d such public matrices are needed in the scheme proposed at Crypto 2010 whose public key size is (2 dm 2 + mn + m ) log q . To reduce the message-ciphertext expansion factor of the proposed scheme to log q , the encryption algorithm of this scheme is built based on Gentry’s encryption scheme, by which m 2 bits of plaintext are encrypted into m 2 log q bits of ciphertext by a one time encryption operation. Hence, the presented scheme has some advantages with respect to not only the public key size but also the message-ciphertext expansion factor. Based on the hardness of the learning with errors problem, we demonstrate that the scheme is secure under selective identity and chosen plaintext attacks.

Frontiers of Information Technology & Electronic Engineering•Aug 1, 2016•5 citations

Construction of Compact Lattice-Based IBE with Equality Test

Chunfeng FU, Renjie Jin, Longjiang Qu +1 more

Identity-based encryption with equality test (IBE-ET) allows the detection of whether two different ciphertexts encrypt the same plaintext without decryption within the conventional identity-based encryption (IBE) model. This property ensures the confidentiality of communication and reduces the storage overhead of ciphertexts in cryptosystems. However, IBE-ET schemes based on traditional assumptions, such as discrete logarithm and integer factoring, are vulnerable to quantum algorithm attacks, highlighting the importance of designing lattice-based IBE-ET schemes. To address this, researchers have proposed several lattice-based IBE-ET schemes that utilize outdated lattice IBE paradigms and are inefficient in terms of parameter size. In this work, we construct a new lattice-based IBE-ET scheme using the most compact lattice IBE framework known to date. Our new proposal significantly improves the parameters compared to previous constructions. Furthermore, we provide a security reduction in the random oracle model, along with corresponding parameter selection and the comparison between our scheme and known constructions. The results imply that our scheme is efficient.

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences•Oct 7, 2024•0 citations
Dual receiver encryption (DRE), being originally conceived at CCS 2004 as a proof technique, enables a ciphertext to be decrypted to the same plaintext by two different but dual receivers and becomes popular recently due to itself useful application potentials such secure outsourcing, trusted third party supervising, client puzzling, etc. Identity-based DRE (IB-DRE) further combines the bilateral advantages/facilities of DRE and identity-based encryption (IBE). Most previous constructions of IB-DRE are based on bilinear pairings, and thus suffers from known quantum algorithmic attacks. It is interesting to build IB-DRE schemes based on the well-known post quantum platforms, such as lattices. At ACISP 2018, Zhang et al. gave the first lattice-based construction of IB-DRE, and the main part of the public parameter in this scheme consists of 2 n + 2 matrices where n is the bit-length of arbitrary identity. In this paper, by introducing an injective map and a homomorphic computation technique due to Yamada at EUROCRYPT 2016, we propose another lattice-based construction of IB-DRE in an even efficient manner: The main part of the public parameters consists only of 2 p n 1 p + 2 matrices of the same dimensions, where p ( ≥ 2 ) is a flexible constant. The larger the p and n, the more observable of our proposal. Typically, when p = 2 and n = 284 according to the suggestion given by Peikert et al., the size of public parameters in our proposal is reduced to merely 12% of Zhang et al.’s method. In addition, to lighten the pressure of key generation center, we extend our lattice-based IB-DRE scheme to hierarchical scenario. Finally, both the IB-DRE scheme and the HIB-DRE scheme are proved to be indistinguishable against adaptively chosen identity and plaintext attacks (IND-ID-CPA).
In CCS'04, Diament etc al. presented special kind of public key encryption called Dual Receiver Encryption (DRE).In DRE, sender encrypts the plaintext using public keys of two independent receivers.Both independent receivers can decrypt the ciphertext into the same plaintext using their own private keys.This new cryptography primitive has applications in construction of complete nonmalleability and plaintext-awareness public key encryption, for a secure management of data that is to be disseminated to distributed processors, for ubiquitous and mobile computing applications.Daode Zhang et.al. constructed lattice-based IB-DRE scheme which is secure against stronger security notion i.e. adaptive-ID.We present hierarchical identity based dual encryption (HIB-DRE) scheme under LWE assumption.To the best of our knowledge, this gives the first provably secure HIB-DRE scheme in the lattice based setting.Independent work by Naccache[1] and Chatterjee -Sarkar[2] presented a variant of Waters's identity based encryption scheme to reduce Public Parameters.They have considered an identity of l-bits as l chunks where size of each chunk is l/l .This reduces the Public Parameter (PP) size from l to l n × m matrices.This idea was named as blocking technique [3].We have used blocking technique to reduce the size of PP.Daode Zhang et.al.[4] presented adaptive secure IB-DRE scheme.This scheme[4] contains l + 1, n × m matrices as PPs, where l denotes the number of the bits in identity.Using blocking technique we have reduced the size of PP by around factor β .Because of this the size of prime number q in field Z q is increased by 2 β which results in increase in computation cost.We have shown that compared to Daode Zhang et.al.scheme the size of the PP can be decreased approximately by 80% and the time complexity is increased by only 1.40% for a suitably chosen β .
Dual receiver encryption (DRE) is an important cryptographic primitive introduced by Diament et al. at CCS’04, which allows two independent receivers to decrypt a same ciphertext to obtain the same plaintext. This primitive is quite useful in designing combined public key cryptosystems and denial of service attack-resilient protocols. In this paper, we obtain some results as follows. Using weak lattice-based programmable hash functions (wLPHF) with high min-entropy (Crypto’16), we give a generic IND-CCA secure DRE construction in the standard model. Furthermore, we get a concrete DRE scheme by instantiating a concrete wLPHF with high min-entropy. For DRE notion in the identity-based setting, identity-based DRE (IB-DRE), basing on lattice-based programmable hash functions (LPHF) with high min-entropy, we give a framework of IND-ID-CPA secure IB-DRE construction in the standard model. When instantiating with concrete LPHFs with high min-entropy, we obtain five concrete IB-DRE schemes.
Receiver selective opening (RSO) security considers the security of encryption schemes under the scenario of a single sender and multiple receivers, where an adversary is allowed to adaptively corrupt some receivers’ secret keys. RSO security has been proven to be more secure than indistinguishability-based security notions. A lot of research has focused on RSO security in terms of public-key encryption and identity-based encryption (IBE); however, hierarchical IBE (HIBE), which is a generalization of IBE, is still lacking in the study, and how to obtain such a construction remains an open problem. To address this gap, we initiate a study of RSO security on HIBE in this work. Precisely, we first formalize the definition of simulation-based RSO against identity-chosen-plaintext/ciphertext attacks in the k-challenge setting (SIM-ID-RSO k_kk​ -CPA/CCA) for HIBE. We then present generic SIM-ID-RSO k_kk​ -CCA secure HIBE constructions by introducing the double secret key paradigm. Specifically, we show that a SIM-ID-RSO k_kk​ -CCA secure HIBE scheme can be obtained from an IND-ID-CPA secure HIBE scheme as well as a one-time signature scheme that satisfies strong unforgeability. Through our general construction, we can derive various concrete schemes based on different hard assumptions (e.g., lattice-based and pairing-based SIM-ID-RSO k_kk​ -CCA secure HIBE schemes) according to usage requirements.
Identity-based encryption (IBE), and its hierarchical extension (HIBE), are interesting cryptographic primitives that aim at the implicit authentication on the users' public keys by using users' identities directly. During the past several decades, numerous elegant pairing-based (H)IBE schemes were proposed. However, most pairing-related security assumptions suffer from known quantum algorithmic attacks. Therefore, the construction of lattice-based (H)IBE became one of the hot directions in recent years. In the setting of most existing lattice-based (H)IBE schemes, each bit of a user's identity is always associated with a parameter matrix. This always leads to drastic but unfavorable increases in the sizes of the system public parameters. To overcome this issue, we propose a flexible trade-off mechanism between the size of the public parameters and the involved computational cost using the blocking technique. More specifically, we divide an identity into l' segments and associate each segment with a matrix, while increasing the lattice modulo slightly for maintaining the same security level. As a result, for the setting of 160-bit identities, we show that the size of the public parameters can be reduced by almost 89.7% (resp. 93.8%) while increasing the computational cost by merely 5.2% (resp. 12.25%) when l' is a set of 16 (resp. 8). Finally, our IBE scheme is extended to an HIBE scheme, and both of them are proved to achieve the indistinguishability of ciphertexts against adaptively chosen identity and chosen plaintext attack (IND-ID-CPA) in the standard model, assuming that the well-known ring learning with error (RLWE) problem over the involved ideal lattices is intractable, even in the post-quantum era.
Using lattice basis delegation in a fixed dimension, we propose an efficient lattice-based hierarchical identity based encryption (HIBE) scheme in the standard model whose public key size is only ( dm 2 + mn ) log q bits and whose message-ciphertext expansion factor is only log q , where d is the maximum hierarchical depth and ( n , m , q ) are public parameters. In our construction, a novel public key assignment rule is used to averagely assign one random and public matrix to two identity bits, which implies that d random public matrices are enough to build the proposed HIBE scheme in the standard model, compared with the case in which 2 d such public matrices are needed in the scheme proposed at Crypto 2010 whose public key size is (2 dm 2 + mn + m ) log q . To reduce the message-ciphertext expansion factor of the proposed scheme to log q , the encryption algorithm of this scheme is built based on Gentry’s encryption scheme, by which m 2 bits of plaintext are encrypted into m 2 log q bits of ciphertext by a one time encryption operation. Hence, the presented scheme has some advantages with respect to not only the public key size but also the message-ciphertext expansion factor. Based on the hardness of the learning with errors problem, we demonstrate that the scheme is secure under selective identity and chosen plaintext attacks.
Identity-based encryption with equality test (IBE-ET) allows the detection of whether two different ciphertexts encrypt the same plaintext without decryption within the conventional identity-based encryption (IBE) model. This property ensures the confidentiality of communication and reduces the storage overhead of ciphertexts in cryptosystems. However, IBE-ET schemes based on traditional assumptions, such as discrete logarithm and integer factoring, are vulnerable to quantum algorithm attacks, highlighting the importance of designing lattice-based IBE-ET schemes. To address this, researchers have proposed several lattice-based IBE-ET schemes that utilize outdated lattice IBE paradigms and are inefficient in terms of parameter size. In this work, we construct a new lattice-based IBE-ET scheme using the most compact lattice IBE framework known to date. Our new proposal significantly improves the parameters compared to previous constructions. Furthermore, we provide a security reduction in the random oracle model, along with corresponding parameter selection and the comparison between our scheme and known constructions. The results imply that our scheme is efficient.