Abstract The concept of Proxy Re‐Encryption (PRE) was introduced by Blaze, Bleumer and Strauss at Eurocrypt in 1998. In this concept, a semi‐trusted proxy user acquires a re‐encryption key from the delegator. Then the proxy can easily convert the encrypted message under Alice's public key into an encrypted message under Bob's public key, without knowing the content of the message. For a unidirectional PRE, a master secret security (MSS) has been proposed as another security requirement by Ateniese et al. MSS provides security to the secret key of the delegator from computation by association with a malicious delegatee and dishonest proxy. In this study, first we have shown that Aono et al.'s scheme is not secure under the MSS model. Second, we have designed a unidirectional PRE scheme, based on Aono et al.'s study, and proved its security under the MSS model. In Table 2, we have shown that our scheme is more efficient in terms of computational and communication costs. Third, we have constructed a lattice‐based unidirectional PRE + scheme, similar to the scheme proposed by Wang et al. In this scheme the encryptor itself works as the delegator.
Abstract The concept of Proxy Re‐Encryption (PRE) was introduced by Blaze, Bleumer and Strauss at Eurocrypt in 1998. In this concept, a semi‐trusted proxy user acquires a re‐encryption key from the delegator. Then the proxy can easily convert the encrypted message under Alice's public key into an encrypted message under Bob's public key, without knowing the content of the message. For a unidirectional PRE, a master secret security (MSS) has been proposed as another security requirement by Ateniese et al. MSS provides security to the secret key of the delegator from computation by association with a malicious delegatee and dishonest proxy. In this study, first we have shown that Aono et al.'s scheme is not secure under the MSS model. Second, we have designed a unidirectional PRE scheme, based on Aono et al.'s study, and proved its security under the MSS model. In Table 2, we have shown that our scheme is more efficient in terms of computational and communication costs. Third, we have constructed a lattice‐based unidirectional PRE + scheme, similar to the scheme proposed by Wang et al. In this scheme the encryptor itself works as the delegator.
Proxy re-encryption (PRE) securely enables the re-encryption of ciphertexts from one key to another, without relying on trusted parties, i.e., it offers delegation of decryption rights. PRE allows a semi-trusted third party termed as a "proxy" to securely divert encrypted files of user A (delegator) to user B (delegatee) without revealing any information about the underlying files to the proxy. To eliminate the necessity of having a costly certificate verification process, Green and Ateniese introduced an identity-based PRE (IB-PRE). The potential applicability of IB-PRE leads to intensive research from its first instantiation. Unfortunately, till today, there is no unidirectional IB-PRE secure in the standard model, which can withstand quantum attack. In this paper, we provide, for the first time, a concrete construction of unidirectional IB-PRE which is secure in standard model based on the hardness of learning with error problem. Our technique is to use the novel trapdoor delegation technique of Micciancio and Peikert. The way we use trapdoor delegation technique may prove useful for functionalities other than proxy re-encryption as well.
Proxy re‐encryption (PRE) is a promising cryptographic structure for pervasive data sharing in cloud‐based social networks, which enables a semi‐trusted proxy to convert a ciphertext for Alice into a ciphertext for Bob without seeing the corresponding plaintext. Since the proxy is semi‐trust, a PRE scheme which can resist the collusion attack will be of great practical value. Jiang et al . in 2015 and Kim and Jeong in 2016 have proposed collusion‐resistant PRE (CR‐PRE) schemes from the lattice by a similar technique, respectively. However, through the analysis of their schemes, the authors find that both of them have defects in the construction of the re‐encryption key, which will lead to the re‐encryption ciphertext cannot be decrypted or decrypted error with high probability. In this study, the authors first point out the defects in the work of Jiang et al . 's work and Kim and Jeong's work and propose an improved collusion‐resistant unidirectional PRE scheme from lattice, based on learning with errors problems. In addition to solving the defects, CR‐PRE still has many useful properties similar to the previous schemes, such as unidirectional, collusion resistant, chosen‐plaintext attack secure and so on.
In 1998, Blaze, Bleumer and Strauss introduced a cryptographic primitive called proxy re-encryption in which a proxy can transform-without seeing the plaintext-a ciphertext encrypted under one key into an encryption of the same plaintext under another key. The concept has recently drawn renewed interest. Notably, Canetti and Hohenberger showed how to properly define (and realize) chosen-ciphertext security for the primitive. Their system is bidirectional as the translation key allows converting ciphertexts in both directions. This paper presents the first unidirectional proxy re-encryption schemes with chosen-ciphertext security in the standard model (i.e., without the random oracle idealization). The first system provably fits a unidirectional extension of the Canetti-Hohenberger security model. As a second contribution, the paper considers a more realistic adversarial model where attackers may choose dishonest users' keys on their own. It is shown how to modify the first scheme to achieve security in the latter scenario. At a moderate expense, the resulting system provides additional useful properties such as non-interactive temporary delegations. Both constructions are efficient and rely on mild complexity assumptions in bilinear groups. Like the Canetti-Hohenberger scheme, they meet a relaxed flavor of chosen-ciphertext security introduced by Canetti, Krawczyk and Nielsen.
Proxy Re-Encryption was introduced by Blaze, Bleumer and Strauss to efficiently solve the problem of delegation of decryption rights. In proxy re-encryption, a semi-honest proxy transforms a ciphertext intended for Alice to a ciphertext of the same message for Bob without learning anything about the underlying message. From its introduction, several proxy re-encryption schemes in the Public Key In-frastructure (PKI) and Identity (ID) based setting have been proposed. In practice, systems in the public key infrastructure suffer from the certificate management problem and those in identity based setting suffer from the key escrow problem. Certificateless Proxy Re-encryption schemes enjoy the advantages provided by ID-based constructions without suffering from the key escrow problem. In this work, we construct the first unidirectional, single-hop CCA-secure certificateless proxy re-encryption scheme without pairing by extending the PKI based construction of Chow et al. proposed in 2010. We prove its security in the random oracle model under the Computational Diffie-Hellman (CDH) assumption. Prior to this work, the only secure certificateless proxy re-encryption scheme is due to Guo et al. proposed in 2013 using bilinear pairing. The construction proposed in this work is more efficient than that system and its security relies on more standard assumptions. We also show that the recently proposed construction of Yang et al. is insecure with respect to the security model considered in this work.
In this work, we study (the direct constructions of) bidirectional proxy re-encryption (PRE) with alleviated trust in the proxy, specifically the master secret security (MSS) and the nontransitivity (NT) security, in the standard model, and achieve the following: • A multi-hop MSS-secure bidirectional PRE scheme with security against chosen plaintext attacks (CPA) in the standard model, where the ciphertext remains constant size regardless how many times it has been re-encrypted. To the best of our knowledge, there exists previously no MSS-secure multi-hop bidirectional PRE scheme with constant size of ciphertexts (whether in the random oracle model or not). • A single-hop MSS-secure and non-transitive bidirectional PRE scheme with security against chosen ciphertext attacks (CCA) in the standard model. The CCA-secure scheme is based on the CPA-secure scheme, and particularly employs a new re-encryption key (REK) generation mechanism to which each user makes equal contributions, where a single REK is used in both directions with the same computation so that the proxy needs not to distinguish the transform direction when it re-encrypts ciphertexts. Besides alleviated trust in proxy, single-hop non-transitive bidirectional PRE schemes also enjoy better fine-grained delegate right control (against malicious proxy). The security analysis uses Coron’s technique [Coron, Crypto 2000], which particularly allows adaptive secret-key corruption. Along the way, we also refine and clarify the security models for bidirectional PRE. 1