Key-dependent message (KDM) security identity-based encryption (IBE) schemes aim to solve the security risks caused by the dependency between plaintext and secret keys in traditional IBE schemes. However, current KDM-IBE schemes are only secure with respect to affine functions, which limits their security level when a message is derived from the evaluation of a polynomial function using the secret key. To address this issue, in this study, we propose a novel approach to construct a KDM-IBE scheme with respect to polynomial or even arbitrary functions that achieves maximum security based on the learning with errors (LWE) assumption. Our approach overcomes two major technical barriers to constructing KDM-IBE schemes with respect to polynomial functions. Compared to existing KDM-IBE schemes, our proposed scheme ensures the secrecy of the key-related plaintext, even when it is obtained using arbitrary functions, not just affine functions. Thus, our approach provides a more robust solution to the security risks inherent in traditional IBE schemes.
Key-dependent message (KDM) security identity-based encryption (IBE) schemes aim to solve the security risks caused by the dependency between plaintext and secret keys in traditional IBE schemes. However, current KDM-IBE schemes are only secure with respect to affine functions, which limits their security level when a message is derived from the evaluation of a polynomial function using the secret key. To address this issue, in this study, we propose a novel approach to construct a KDM-IBE scheme with respect to polynomial or even arbitrary functions that achieves maximum security based on the learning with errors (LWE) assumption. Our approach overcomes two major technical barriers to constructing KDM-IBE schemes with respect to polynomial functions. Compared to existing KDM-IBE schemes, our proposed scheme ensures the secrecy of the key-related plaintext, even when it is obtained using arbitrary functions, not just affine functions. Thus, our approach provides a more robust solution to the security risks inherent in traditional IBE schemes.
Based on the learning with errors (LWE) problem, we construct an identity-based encryption (IBE) scheme in the standard-model which is secure against the key dependent message (KDM) attacks and the selective opening (SO) attacks. KDM security, which requires that the scheme can still obtain secrecy even if the messages depend on the secret key, is necessary for IBE when updating the identity secret keys with the old ones. SO security, which requires that when the adversary corrupts some fraction of senders, the uncorrupted senders' messages still maintain privacy, is useful for IBE since that one user receives messages from many senders is a natural scenario. Although there is a KDM secure IBE scheme based on LWE constructed by Alperin-Sheriff and Peikert (PKC'12), and a SO secure IBE scheme based on LWE constructed by He et al. (IWSEC'15), those two schemes cannot achieve both of the security requirements at the same time.
Abstract. We construct the first public-key encryption scheme that is proven secure (in the standard model, under standard assumptions) even when the attacker gets access to encryptions of arbitrary efficient functions of the secret key. Specifically, under either the DDH or LWE assumption, and for arbitrary but fixed polynomials L and N, we obtain a public-key encryption scheme that resists key-dependent message (KDM) attacks for up to N(k) public keys and functions of circuit size up to L(k), where k denotes the size of the secret key. We call such a scheme bounded KDM secure. Moreover, we show that our scheme suffices for one of the important applications of KDM security: ability to securely instantiate symbolic protocols with axiomatic proofs of security. We also observe that any fully homomorphic encryption scheme that additionally enjoys circular security and circuit privacy is fully KDM secure in the sense that its algorithms can be independent of the polynomials L and N as above. Thus, the recent fully homomorphic encryption scheme of Gentry (STOC 2009) is fully KDM secure under certain non-standard hardness assumptions. Finally, we extend an impossibility result of Haitner and Holenstein (TCC 2009), showing that it is impossible to prove KDM security against a family of query functions that contains exponentially hard pseudo-random functions if the proof makes only a black-box use of the query function and the adversary attacking the scheme. This shows that the non-black-box use of the query function in our proof of security is inherent.
Key-dependent message (KDM) security is of great research significance, to better analyse and solve the potential security problems in complex application scenarios. Most of the current KDM security schemes are based on traditional hard mathematical problems, where the public key and ciphertext are not compact enough, and make the ciphertext size grow linearly with the degree of the challenge functions. To solve the above problems and the inefficient ciphertext operation, the authors propose a compact lattice-based cryptosystem with a variant of the RLWE problem, which applies an invertible technique to obtain the RLWE* problem. It remains hard after the modification from the RLWE problem. Compared with the ACPS scheme, our scheme further expands the set of challenge functions based on the affine function of the secret key, and the size of public key and ciphertext is O˜(n), which is independent of the challenge functions. In addition, this scheme enjoys a high level of efficiency, the cost of encryption and decryption is only ploylog(n) bit operations per message symbol, and we also prove that our scheme is KDM-CPA secure under the RLWE* assumption.
Key-dependent message (KDM) secure encryption schemes provide secrecy even when the attacker sees encryptions of messages related to the secret-key sk. Namely, the scheme should remain secure even when messages of the form f(sk) are encrypted, where f is taken from some function class F . A KDM amplification procedure takes an encryption scheme which satisfies F-KDM security and boost it into a G-KDM secure scheme, where the function class G should be richer than F . It was recently shown by Brakerski et al. (TCC 2011) and Barak et al. (EUROCRYPT 2010), that a strong form of amplification is possible, provided that the underlying encryption scheme satisfies some special additional properties. In this work, we prove the first generic KDM amplification theorem which relies solely on the KDM security of the underlying scheme without making any other assumptions. Specifically, we show that an elementary form of KDM security against functions in which each output bit either copies or flips a single bit of the key (aka projections) can be amplified into KDM security with respect to any function family that can be computed in arbitrary fixed polynomial-time. Furthermore, our amplification theorem and its proof are insensitive to the exact setting of KDM security, and they hold in the presence of multiple-keys and in the symmetric-key/public-key and the CPA/CCA cases. As a result, we can amplify the security of all known KDM constructions, including ones that could not be amplified before. Finally, we study the minimal conditions under which full-KDM security (with respect to all functions) can be achieved. We show that under strong notion of KDM security, the existence of cyclic-secure fully-homomorphic encryption is not only sufficient for full-KDM security, as shown by Barak et al., but also necessary. On the other hand, we observe that for standard KDM security, this condition can be relaxed by adopting Gentry’s bootstrapping technique (STOC 2009) to the KDM setting.
In this work, we deal with cryptosystems which are provably secure even if we encrypt a key-dependent message. These cryptosystems are called KDM-secure. First, we define KDM-security and discuss its relationship with other kinds of security, especially IND-CPA-security. Thereafter, we construct the public- key and the symmetric-key encryption scheme of Applebaum et al. (CRYPTO 2009) and we prove KDM-security of these cryprosystems with respect to the set of affine functions. The security of our cryptosystems is based on the LWE problem and the LPN problem as its special case. We study these problems and their variants. Moreover, we give a brief introduction to lattices and hard lattice problems because there exist reductions from hard lattice problems to LWE. 1
Since the introduction of the ring learning with errors (R-LWE) by Lyubashevsky, Peikert and Regev, many efficient and secure applications were founded in cryptography. In this paper, we mainly present an efficient public-key encryption scheme based on the R-LWE assumption. It is very simple to describe and analyze. As well as it can achieve security against certain key-dependent message (KDM) attacks. Namely, this efficient encryption scheme can securely encrypt its own secret key. The security of this scheme follows from the already proven hardness of the R-LWE problem since the R-LWE assumption is reducible to worst-case problems on the ideal lattice. Besides, the scheme enjoys a high level efficiency and low cost since the operations of the scheme are very simple and fast. The cost of both the encryption and decryption is only polylog(n) bit per message symbol.