Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Trapdoor Delegation and HIBE from Middle-Product LWE in Standard Model

Huy Quoc Le, Dung Hoang Duong, Willy Susilo, Josef Pieprzyk

Published Jan 1, 2020• 8 citations
OpenAlex

Abstract

© 2020, Springer Nature Switzerland AG. At CRYPTO 2017, Roşca, Sakzad, Stehlé and Steinfeld introduced the Middle–Product LWE (MPLWE) assumption which is as secure as Polynomial-LWE for a large class of polynomials, making the corresponding cryptographic schemes more flexible in choosing the underlying polynomial ring in design while still keeping the equivalent efficiency. Recently at TCC 2019, Lombardi, Vaikuntanathan and Vuong introduced a variant of MPLWE assumption and constructed the first IBE scheme based on MPLWE. Their core technique is to construct lattice trapdoors compatible with MPLWE in the same paradigm of Gentry, Peikert and Vaikuntanathan at STOC 2008. However, their method cannot directly offer a Hierarchical IBE construction. In this paper, we make a step further by proposing a novel trapdoor delegation mechanism for an extended family of polynomials from which we construct, for the first time, a Hierachical IBE scheme from MPLWE. Our Hierarchy IBE scheme is provably secure in the standard model.

Related papers

Improved Trapdoors and Public Key Search Encryption Based on Middle-Product LWE

Yufan Yao, Jianhua Wang, Ke Wang +3 more

Abstract Middle-product learning with errors (MP-LWE) was proposed in 2017 by Rosa et al., it is considered to be a method that combines the high efficiency of the R-LWE with the security guarantee of the ordinary LWE. Following the idea of this problem, in the TCC 2019, Alex Lombardi et al. further studied the method of constructing identity-based encryption (IBE) scheme on the premise of the MP-LWE. They introduced several major technologies, these include the introduction of a new leftover hash lemma and the instan-tiation of a brand-new variant of lattice trapdoor corresponding to MP-LWE. The idea of instantiation of trapdoor is very novel, but the equation can not be solved correctly by using the trapdoor. In the current work, we have improved the research results of the Lombardi et al., that is, we re-instantiate the trapdoor matching MP-LWE and use it to construct a new IBE scheme. Further, we also use the classical transformation of Abdalla et al. to transform the constructed IBE scheme into a MP-LWE-based public key search encryption scheme (PEKS). Compared to IBE and PEKS schemes from LWE, our scheme is more effective, and their ciphertexts and keys size are only O˜(n) in size (for identities of size n bits). Compared to IBE and PEKS schemes from ring-LWE, our schemes have similar efficiency

•Jul 17, 2023•1 citation

Trapdoor Delegation and HIBE from Middle-Product LWE in Standard Model

Huy Quoc Le, Dung Hoang Duong, Willy Susilo +1 more

arXiv:2007.06881•Lecture notes in computer science•Jan 1, 2020•0 citations

How to Delegate a Lattice Basis.

David M. Cash, Dennis Hofheinz, Eike Kiltz

We present a technique, which we call basis delegation, that allows one to use a short basis of a given lattice to derive a new short basis of a related lattice in a secure way. And since short bases for lattices essentially function like cryptographic trapdoors, basis delegation turns out to be a very powerful primitive. As the main application of our technique, we show how to construct hierarchical identity-based encryption (HIBE) that is secure, without random oracles, under the assumption that certain standard lattice problems are hard in the worst case. This construction and its variants constitute the first HIBE schemes from lattices, as well as the first lattice-based constructions of stateless signatures and identity-based encryption without random oracles. 1

•Jan 1, 2009•55 citations

Tight Lattice-Based Signatures without Trapdoors from Search LWE

Nico Döttling, Rutchathon Chairattana-Apirom, Julian Loss +2 more

The study of digital signatures with tight reductions has attracted considerable attention over the past two decades, as such schemes inherit essentially the same quantitative hardness as the underlying computational problem. In the context of lattice-based cryptography, the GPV approach (Gentry, Peikert, and Vaikuntanathan, STOC ’08) admits a simple tight reduction from the SIS problem, but relies on preimage sampling via trapdoors, which often leads to complex and brittle implementations. By contrast, tight proofs for trapdoor-free constructions, following the Fiat–Shamir paradigm, necessarily rely on decisional assumptions, most notably the decisional LWE assumption. From the perspective of concrete security, however, reliance on a search assumption is preferable, as known search-to-decision reductions for LWE provide only weak quantitative guarantees. \ind This paper presents the first efficient lattice-based signature scheme with a tight reduction to a search assumption (namely, the hardness of the search LWE problem) that does not require any trapdoor in the scheme itself (but merely uses, instead, a trapdoor in the proof). Our construction follows the Fiat-Shamir paradigm and can be viewed as a lattice analogue of Chevallier–Mames signatures (CRYPTO ’05). Establishing security in the lattice setting, however, requires overcoming significant technical obstacles: in particular, our proof develops several new techniques to cope with the inherently weak soundness guarantees of lattice-based interactive proofs.

•Jun 23, 2026•0 citations

An ideal lattice based IBE scheme in the standard model

Xiaoyuan Yang, Liqiang Wu, Minqing Zhang +2 more

Under the standard model, an IND-sID-CPA secure IBE (Identity Based Encryption) scheme is proposed, which is based on an improved trapdoor generation function over ring and decisional R-LWE (ring-learning with errors) assumption, thus the hardness of recovering system master key can be reduced to solve the Ideal-SIS (small integer solution) problem, and the attack to the ciphertext is equivalent to solving the SVP (the shortest vector problem) in the worst case on ideal lattice to within a fixed poly( n ) factor. Moreover, the proposed scheme has advantages of high encryption and decryption speed and low encryption blowup factor compared with all known IBE scheme from the standard lattice under the standard model.

Wuhan University Journal of Natural Sciences•Sep 3, 2011•2 citations

Efficient Batched IBE from Lattices in the Standard Model

Saisi Xiong, Yijian Zhang, Jie Chen

In this work, we present the first lattice-based construction of batched IBE in the standard model, whose security is proven under the succinct LWE assumption. Prior batched IBE schemes are only known either based on pairing-based assumptions or in the random oracle model. Moreover, our scheme is shown to be highly efficient, as the master public key, decryption key, and ciphertext are independent of the batch size B. Technically, we mainly rely on an insightful observation: batched IBE can be obtained solely from Inner-Product Encryption (IPE). To satisfy the efficiency requirements of batched IBE, we require an IPE scheme that owns two important features: decomposable key generation and compact components. Finally, we show how to construct such an IPE scheme from the well-known BGG+14 IPE scheme via careful modification.

IACR Communications in Cryptology•Aug 3, 2026•2 citations
© 2020, Springer Nature Switzerland AG. At CRYPTO 2017, Roşca, Sakzad, Stehlé and Steinfeld introduced the Middle–Product LWE (MPLWE) assumption which is as secure as Polynomial-LWE for a large class of polynomials, making the corresponding cryptographic schemes more flexible in choosing the underlying polynomial ring in design while still keeping the equivalent efficiency. Recently at TCC 2019, Lombardi, Vaikuntanathan and Vuong introduced a variant of MPLWE assumption and constructed the first IBE scheme based on MPLWE. Their core technique is to construct lattice trapdoors compatible with MPLWE in the same paradigm of Gentry, Peikert and Vaikuntanathan at STOC 2008. However, their method cannot directly offer a Hierarchical IBE construction. In this paper, we make a step further by proposing a novel trapdoor delegation mechanism for an extended family of polynomials from which we construct, for the first time, a Hierachical IBE scheme from MPLWE. Our Hierarchy IBE scheme is provably secure in the standard model.
Abstract Middle-product learning with errors (MP-LWE) was proposed in 2017 by Rosa et al., it is considered to be a method that combines the high efficiency of the R-LWE with the security guarantee of the ordinary LWE. Following the idea of this problem, in the TCC 2019, Alex Lombardi et al. further studied the method of constructing identity-based encryption (IBE) scheme on the premise of the MP-LWE. They introduced several major technologies, these include the introduction of a new leftover hash lemma and the instan-tiation of a brand-new variant of lattice trapdoor corresponding to MP-LWE. The idea of instantiation of trapdoor is very novel, but the equation can not be solved correctly by using the trapdoor. In the current work, we have improved the research results of the Lombardi et al., that is, we re-instantiate the trapdoor matching MP-LWE and use it to construct a new IBE scheme. Further, we also use the classical transformation of Abdalla et al. to transform the constructed IBE scheme into a MP-LWE-based public key search encryption scheme (PEKS). Compared to IBE and PEKS schemes from LWE, our scheme is more effective, and their ciphertexts and keys size are only O˜(n) in size (for identities of size n bits). Compared to IBE and PEKS schemes from ring-LWE, our schemes have similar efficiency
We present a technique, which we call basis delegation, that allows one to use a short basis of a given lattice to derive a new short basis of a related lattice in a secure way. And since short bases for lattices essentially function like cryptographic trapdoors, basis delegation turns out to be a very powerful primitive. As the main application of our technique, we show how to construct hierarchical identity-based encryption (HIBE) that is secure, without random oracles, under the assumption that certain standard lattice problems are hard in the worst case. This construction and its variants constitute the first HIBE schemes from lattices, as well as the first lattice-based constructions of stateless signatures and identity-based encryption without random oracles. 1
The study of digital signatures with tight reductions has attracted considerable attention over the past two decades, as such schemes inherit essentially the same quantitative hardness as the underlying computational problem. In the context of lattice-based cryptography, the GPV approach (Gentry, Peikert, and Vaikuntanathan, STOC ’08) admits a simple tight reduction from the SIS problem, but relies on preimage sampling via trapdoors, which often leads to complex and brittle implementations. By contrast, tight proofs for trapdoor-free constructions, following the Fiat–Shamir paradigm, necessarily rely on decisional assumptions, most notably the decisional LWE assumption. From the perspective of concrete security, however, reliance on a search assumption is preferable, as known search-to-decision reductions for LWE provide only weak quantitative guarantees. \ind This paper presents the first efficient lattice-based signature scheme with a tight reduction to a search assumption (namely, the hardness of the search LWE problem) that does not require any trapdoor in the scheme itself (but merely uses, instead, a trapdoor in the proof). Our construction follows the Fiat-Shamir paradigm and can be viewed as a lattice analogue of Chevallier–Mames signatures (CRYPTO ’05). Establishing security in the lattice setting, however, requires overcoming significant technical obstacles: in particular, our proof develops several new techniques to cope with the inherently weak soundness guarantees of lattice-based interactive proofs.
Under the standard model, an IND-sID-CPA secure IBE (Identity Based Encryption) scheme is proposed, which is based on an improved trapdoor generation function over ring and decisional R-LWE (ring-learning with errors) assumption, thus the hardness of recovering system master key can be reduced to solve the Ideal-SIS (small integer solution) problem, and the attack to the ciphertext is equivalent to solving the SVP (the shortest vector problem) in the worst case on ideal lattice to within a fixed poly( n ) factor. Moreover, the proposed scheme has advantages of high encryption and decryption speed and low encryption blowup factor compared with all known IBE scheme from the standard lattice under the standard model.
In this work, we present the first lattice-based construction of batched IBE in the standard model, whose security is proven under the succinct LWE assumption. Prior batched IBE schemes are only known either based on pairing-based assumptions or in the random oracle model. Moreover, our scheme is shown to be highly efficient, as the master public key, decryption key, and ciphertext are independent of the batch size B. Technically, we mainly rely on an insightful observation: batched IBE can be obtained solely from Inner-Product Encryption (IPE). To satisfy the efficiency requirements of batched IBE, we require an IPE scheme that owns two important features: decomposable key generation and compact components. Finally, we show how to construct such an IPE scheme from the well-known BGG+14 IPE scheme via careful modification.