Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Computer Standards & Interfaces

Lattice-Based Key Private Pres with HRA Security and Pcs Security

Yang Wang, Yanmin Zhao, Mingqiang Wang

Published Jan 1, 2022• 4 citations
Publisher

Abstract

Proxy re-encryption (PRE) schemes, which nicely solve the problem of delegating decryption rights, enable a semi-trusted proxy to transform a ciphertext encrypted under one key into a ciphertext of the same message under another arbitrary key. Cohen first pointed out the insufficiency of the security under chosen-plaintext attacks (CPA) of PREs in PKC 2019, and proposed a strictly stronger security notion, named security under honest re-encryption attacks (HRA), of PREs. Surprisingly, a few PREs satisfy the stronger HRA security and almost all of them are paring-based till now. To the best of our knowledge, we present the first direct construction of HRA secure single-hop PREs based on standard LWE problems with comparably small and polynomially-bounded parameters in this paper. Combing known reductions, the HRA security of our PREs could also be guaranteed by the worst-case basic lattice problems (e.g. SIVPγ with γ=Õ(n3.5)). Our single-hop PRE schemes are key-private, which means that the implicit identities of a re-encryption key will not be revealed even in the case of a proxy colluding with some corrupted users. Meanwhile, our single-hop PRE schemes are also post-compromise (PCS) secure, ensuring that a re-encrypted ciphertext remains confidential even when the past key, potential old ciphertexts and the re-encryption key have been exposed. Some discussions about key-privacy of multi-hop PREs are also proposed, which indicates that several constructions of multi-hop PREs do not satisfy their key-privacy definitions.

DOI
10.1016/j.csi.2023.103778

Related papers

HRA-Secure Proxy Re-encryption with Re-encryption Simulatability under Lwe in Standard Model

Bimei Wang, Lin Hou, Lisha Yao +2 more

Proxy re-encryption (PRE) is a momentous and widely used cryptographic technique. It enables a proxy to forward ciphertext without the need of decryption. PRE has received significant interest in applications like cloud computing, blockchain, and the Internet of Things. Despite its wide range of uses, PRE has also been subject to new security and privacy regulations. In PKC’19, Cohen $et~al.$~first drew attention to the weakness in PRE's security against chosen-plaintext attacks (CPA) and put up a more stringent security concept known as security against honest re-encryption attacks (HRA). Notably, Cohen provides a beneficial conclusion as well. It is proveded that PRE schemes with re-encryption simulatability property can be elevated from CPA to HRA security. It is also proved that CPA-secure PRE schemes with re-encryption simulatability property can be directly elevated to those satisfying HRA security. However, those PRE schemes with re-encryption simulatability are almost always based on pairings. In this study, to the best of our knowledge, we directly construct HRA-secure PRE with re-encryption simulatability for the first time based on the learning with errors (LWE) assumption, which was widely believed to be quantum-resistant. Based on the re-encryption key generation algorithm and the re-encryption algorithm construction method of the above scheme, we can modify attribute-based conditional proxy re-encryption (AB-CPRE) as well as the corresponding attribute-based proxy re-encryption (AB-PRE) algorithm to make them have re-encryption simulatability properties. Finally, by using this property, We boost the security of AB-CPRE scheme of ESORICS'21 from CPA to HRA and simplify the HRA-security proof for the AB-PRE of ESORICS'21.

•Nov 28, 2023•0 citations

Improved AB-CPREs with HRA Security

Yu Zhang, Yang Wang, Mingqiang Wang

Attribute-based conditional proxy re-encryption (AB-CPRE) schemes offer flexible controls over delegations of decryption rights, and offer an efficient solution for enforcing access control on outsourced encrypted datum. Recently, Liang et al. proposed the first lattice-based AB-CPREs with selective attribute security against chosen-plaintext attacks (CPA) in ESORICS 2021. In this paper, we first show how to construct a CPA secure AB-CPRE scheme which is suitable for circuits in NC $^{1}$ with polynomially bounded parameters. By contrast, schemes proposed by Liang et al. are only suitable for circuits in NC $^{0}$ with similar parameters. We then show how to convert our CPA secure AB-CPREs to be secure against honest re-encryption attacks (HRA) under a more reasonable definition. We could show that the CPA security and the HRA security of our schemes are based on standard LWE assumptions for suitable parameters in the standard model.

International Conference on Data Security and Privacy Protection (DSPP)•Oct 16, 2023•2 citations

Direct Constructions of Bidirectional Proxy Re-Encryption with Alleviated Trust in Proxy.

Jian Weng, Yunlei Zhao

In this work, we study (the direct constructions of) bidirectional proxy re-encryption (PRE) with alleviated trust in the proxy, specifically the master secret security (MSS) and the nontransitivity (NT) security, in the standard model, and achieve the following: • A multi-hop MSS-secure bidirectional PRE scheme with security against chosen plaintext attacks (CPA) in the standard model, where the ciphertext remains constant size regardless how many times it has been re-encrypted. To the best of our knowledge, there exists previously no MSS-secure multi-hop bidirectional PRE scheme with constant size of ciphertexts (whether in the random oracle model or not). • A single-hop MSS-secure and non-transitive bidirectional PRE scheme with security against chosen ciphertext attacks (CCA) in the standard model. The CCA-secure scheme is based on the CPA-secure scheme, and particularly employs a new re-encryption key (REK) generation mechanism to which each user makes equal contributions, where a single REK is used in both directions with the same computation so that the proxy needs not to distinguish the transform direction when it re-encrypts ciphertexts. Besides alleviated trust in proxy, single-hop non-transitive bidirectional PRE schemes also enjoy better fine-grained delegate right control (against malicious proxy). The security analysis uses Coron’s technique [Coron, Crypto 2000], which particularly allows adaptive secret-key corruption. Along the way, we also refine and clarify the security models for bidirectional PRE. 1

•Jan 1, 2011•7 citations

Chosen-Ciphertext Secure Proxy Re-Encryption for Bounded Linear Functions

Fucai Luo, Haiyan Wang, Xingfu Yan +1 more

Proxy re-encryption (PRE) allows a proxy to use the reencryption keys to convert ciphertexts encrypted under the delegators' public keys into ones that can be decrypted using the delegatees' secret keys, without revealing the underlying plaintext. However, PRE is limited to an all-or-nothing re-encryption, that is, the delegatee can either decrypt the re-encrypted ciphertext to obtain the whole message, or it learns nothing about the underlying message. To address this limitation, Zhou et al. (Asiacrypt 2023) proposed a new variant of PRE called fine-grained PRE (FPRE). FPRE extends PRE to support fine-grained re-encryption, allowing the proxy to convert any ciphertext encrypting a message m to a new ciphertext encrypting f (m) with a fine-grained re-encryption key for any function f. This enables the delegator to flexibly control the sharing of messages by specifying functions. Unfortunately, their scheme achieves only CPA security and requires a common random/reference string (CRS) during key generation. This requirement may weaken the syntax of (F)PRE, which allows users to independently generate their own keys. In this paper, we propose a new FPRE for bounded linear functions that we prove is CCA1 secure and does not require a CRS, based on the Learning with Errors (LWE) assumption. When the linear function is set to be the identity function, our construction immediately yields the first PRE scheme without a CRS, with CCA1 security under adaptive corruptions in the standard model. The main technique behind our construction is the design of a deterministic preimage computation algorithm for the decryption oracle in the security proof. To demonstrate the broader applicability of our proposed algorithm beyond the context of (F)PRE, we use it to prove the selective-identity CCA1 security of Agrawal et al.'s (Eurocrypt 2010) identity-based encryption (IBE) scheme, which was previously only known to be selective-identity CPA secure.

•Dec 5, 2024•0 citations

Collusion resistant identity-based proxy re-encryption scheme on lattice

Xiaohong Deng, Hua Xie, Weizhi Xiong

Proxy re-encryption plays an important role for data security in cloud computing and big data, but the traditional re-encryption scheme based on the classical number theory problem cannot resist quantum attack, and the lattice-based cryptosystem has been proved to have the ability to resist quantum attack, so the lattice-based re-encryption scheme has always been a research hotspot. In view of the problem that collusion-resistance and multi-hop cannot be satisfied at the same time in existing schemes, this paper proposes a new identity-based proxy re-encryption scheme on lattice. Firstly, the scheme uses trapdoors as private keys to achieve one-way anti-collusion. In addition, we construct a variant of Learning with Errors (LWE), which uses a convert algorithm to transform the user matrix and replace the vector with a uniform matrix, so that the scheme can meet the requirements of multi-hop and encrypt multiple bits of messages at one time. Theoretical analysis and experimental simulation prove that the security of the new scheme can be reduced to a decision LWE problem, which can reach the IND-sID-CPA security in the standard model and can improve the encryption efficiency while ensuring the security.

International Conference on Computer Information Science and Application Technology (CISAT)•Oct 11, 2023•1 citation

Achieving Multi-Hop PRE via Branching Program

Zengpeng Li, Chunguang Ma, Ding Wang

Proxy re-encryption (PRE) is a fundamental cryptographic primitive in secure data sharing and e-mail forwarding, etc. To our knowledge, most existing efficient lattice-based PRE schemes focus on the construction of single-hop, key-private, multi-bit and chosen-ciphertext attack (CCA), etc. Few works of literature discussed the detailed multi-hop construction over lattices. Very recently, Chandran et al. (PKC'14) proposed a lattice-based PRE scheme that builds upon the key switching mechanism of Brakerski (CRYPTO'12), and pointed out that their scheme can achieve multi-hop PRE scheme by the ideal circuit family for a directed graph G. In this paper, we are still working along this line and achieving multi-hop PRE via the branching program (BP), which is one type of NC1 circuit and can be used to compute encrypted data. To our knowledge, we proposed the first multi-hop PRE scheme via BP which supports homomorphic evaluation. We also analyze the security of our scheme under decisional learning with errors (LWE) assumption.

IEEE Transactions on Cloud Computing•Oct 18, 2017•21 citations
Proxy re-encryption (PRE) schemes, which nicely solve the problem of delegating decryption rights, enable a semi-trusted proxy to transform a ciphertext encrypted under one key into a ciphertext of the same message under another arbitrary key. Cohen first pointed out the insufficiency of the security under chosen-plaintext attacks (CPA) of PREs in PKC 2019, and proposed a strictly stronger security notion, named security under honest re-encryption attacks (HRA), of PREs. Surprisingly, a few PREs satisfy the stronger HRA security and almost all of them are paring-based till now. To the best of our knowledge, we present the first direct construction of HRA secure single-hop PREs based on standard LWE problems with comparably small and polynomially-bounded parameters in this paper. Combing known reductions, the HRA security of our PREs could also be guaranteed by the worst-case basic lattice problems (e.g. SIVPγ with γ=Õ(n3.5)). Our single-hop PRE schemes are key-private, which means that the implicit identities of a re-encryption key will not be revealed even in the case of a proxy colluding with some corrupted users. Meanwhile, our single-hop PRE schemes are also post-compromise (PCS) secure, ensuring that a re-encrypted ciphertext remains confidential even when the past key, potential old ciphertexts and the re-encryption key have been exposed. Some discussions about key-privacy of multi-hop PREs are also proposed, which indicates that several constructions of multi-hop PREs do not satisfy their key-privacy definitions.
Proxy re-encryption (PRE) is a momentous and widely used cryptographic technique. It enables a proxy to forward ciphertext without the need of decryption. PRE has received significant interest in applications like cloud computing, blockchain, and the Internet of Things. Despite its wide range of uses, PRE has also been subject to new security and privacy regulations. In PKC’19, Cohen et al.et~al.et al.~first drew attention to the weakness in PRE's security against chosen-plaintext attacks (CPA) and put up a more stringent security concept known as security against honest re-encryption attacks (HRA). Notably, Cohen provides a beneficial conclusion as well. It is proveded that PRE schemes with re-encryption simulatability property can be elevated from CPA to HRA security. It is also proved that CPA-secure PRE schemes with re-encryption simulatability property can be directly elevated to those satisfying HRA security. However, those PRE schemes with re-encryption simulatability are almost always based on pairings. In this study, to the best of our knowledge, we directly construct HRA-secure PRE with re-encryption simulatability for the first time based on the learning with errors (LWE) assumption, which was widely believed to be quantum-resistant. Based on the re-encryption key generation algorithm and the re-encryption algorithm construction method of the above scheme, we can modify attribute-based conditional proxy re-encryption (AB-CPRE) as well as the corresponding attribute-based proxy re-encryption (AB-PRE) algorithm to make them have re-encryption simulatability properties. Finally, by using this property, We boost the security of AB-CPRE scheme of ESORICS'21 from CPA to HRA and simplify the HRA-security proof for the AB-PRE of ESORICS'21.
Attribute-based conditional proxy re-encryption (AB-CPRE) schemes offer flexible controls over delegations of decryption rights, and offer an efficient solution for enforcing access control on outsourced encrypted datum. Recently, Liang et al. proposed the first lattice-based AB-CPREs with selective attribute security against chosen-plaintext attacks (CPA) in ESORICS 2021. In this paper, we first show how to construct a CPA secure AB-CPRE scheme which is suitable for circuits in NC 1^{1}1 with polynomially bounded parameters. By contrast, schemes proposed by Liang et al. are only suitable for circuits in NC 0^{0}0 with similar parameters. We then show how to convert our CPA secure AB-CPREs to be secure against honest re-encryption attacks (HRA) under a more reasonable definition. We could show that the CPA security and the HRA security of our schemes are based on standard LWE assumptions for suitable parameters in the standard model.
In this work, we study (the direct constructions of) bidirectional proxy re-encryption (PRE) with alleviated trust in the proxy, specifically the master secret security (MSS) and the nontransitivity (NT) security, in the standard model, and achieve the following: • A multi-hop MSS-secure bidirectional PRE scheme with security against chosen plaintext attacks (CPA) in the standard model, where the ciphertext remains constant size regardless how many times it has been re-encrypted. To the best of our knowledge, there exists previously no MSS-secure multi-hop bidirectional PRE scheme with constant size of ciphertexts (whether in the random oracle model or not). • A single-hop MSS-secure and non-transitive bidirectional PRE scheme with security against chosen ciphertext attacks (CCA) in the standard model. The CCA-secure scheme is based on the CPA-secure scheme, and particularly employs a new re-encryption key (REK) generation mechanism to which each user makes equal contributions, where a single REK is used in both directions with the same computation so that the proxy needs not to distinguish the transform direction when it re-encrypts ciphertexts. Besides alleviated trust in proxy, single-hop non-transitive bidirectional PRE schemes also enjoy better fine-grained delegate right control (against malicious proxy). The security analysis uses Coron’s technique [Coron, Crypto 2000], which particularly allows adaptive secret-key corruption. Along the way, we also refine and clarify the security models for bidirectional PRE. 1
Proxy re-encryption (PRE) allows a proxy to use the reencryption keys to convert ciphertexts encrypted under the delegators' public keys into ones that can be decrypted using the delegatees' secret keys, without revealing the underlying plaintext. However, PRE is limited to an all-or-nothing re-encryption, that is, the delegatee can either decrypt the re-encrypted ciphertext to obtain the whole message, or it learns nothing about the underlying message. To address this limitation, Zhou et al. (Asiacrypt 2023) proposed a new variant of PRE called fine-grained PRE (FPRE). FPRE extends PRE to support fine-grained re-encryption, allowing the proxy to convert any ciphertext encrypting a message m to a new ciphertext encrypting f (m) with a fine-grained re-encryption key for any function f. This enables the delegator to flexibly control the sharing of messages by specifying functions. Unfortunately, their scheme achieves only CPA security and requires a common random/reference string (CRS) during key generation. This requirement may weaken the syntax of (F)PRE, which allows users to independently generate their own keys. In this paper, we propose a new FPRE for bounded linear functions that we prove is CCA1 secure and does not require a CRS, based on the Learning with Errors (LWE) assumption. When the linear function is set to be the identity function, our construction immediately yields the first PRE scheme without a CRS, with CCA1 security under adaptive corruptions in the standard model. The main technique behind our construction is the design of a deterministic preimage computation algorithm for the decryption oracle in the security proof. To demonstrate the broader applicability of our proposed algorithm beyond the context of (F)PRE, we use it to prove the selective-identity CCA1 security of Agrawal et al.'s (Eurocrypt 2010) identity-based encryption (IBE) scheme, which was previously only known to be selective-identity CPA secure.
Proxy re-encryption plays an important role for data security in cloud computing and big data, but the traditional re-encryption scheme based on the classical number theory problem cannot resist quantum attack, and the lattice-based cryptosystem has been proved to have the ability to resist quantum attack, so the lattice-based re-encryption scheme has always been a research hotspot. In view of the problem that collusion-resistance and multi-hop cannot be satisfied at the same time in existing schemes, this paper proposes a new identity-based proxy re-encryption scheme on lattice. Firstly, the scheme uses trapdoors as private keys to achieve one-way anti-collusion. In addition, we construct a variant of Learning with Errors (LWE), which uses a convert algorithm to transform the user matrix and replace the vector with a uniform matrix, so that the scheme can meet the requirements of multi-hop and encrypt multiple bits of messages at one time. Theoretical analysis and experimental simulation prove that the security of the new scheme can be reduced to a decision LWE problem, which can reach the IND-sID-CPA security in the standard model and can improve the encryption efficiency while ensuring the security.
Proxy re-encryption (PRE) is a fundamental cryptographic primitive in secure data sharing and e-mail forwarding, etc. To our knowledge, most existing efficient lattice-based PRE schemes focus on the construction of single-hop, key-private, multi-bit and chosen-ciphertext attack (CCA), etc. Few works of literature discussed the detailed multi-hop construction over lattices. Very recently, Chandran et al. (PKC'14) proposed a lattice-based PRE scheme that builds upon the key switching mechanism of Brakerski (CRYPTO'12), and pointed out that their scheme can achieve multi-hop PRE scheme by the ideal circuit family for a directed graph G. In this paper, we are still working along this line and achieving multi-hop PRE via the branching program (BP), which is one type of NC1 circuit and can be used to compute encrypted data. To our knowledge, we proposed the first multi-hop PRE scheme via BP which supports homomorphic evaluation. We also analyze the security of our scheme under decisional learning with errors (LWE) assumption.