Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Chosen-Ciphertext Secure Proxy Re-Encryption for Bounded Linear Functions

Fucai Luo, Haiyan Wang, Xingfu Yan, Xiaofan Zheng

Published Dec 5, 2024• 0 citations
Publisher

Abstract

Proxy re-encryption (PRE) allows a proxy to use the reencryption keys to convert ciphertexts encrypted under the delegators' public keys into ones that can be decrypted using the delegatees' secret keys, without revealing the underlying plaintext. However, PRE is limited to an all-or-nothing re-encryption, that is, the delegatee can either decrypt the re-encrypted ciphertext to obtain the whole message, or it learns nothing about the underlying message. To address this limitation, Zhou et al. (Asiacrypt 2023) proposed a new variant of PRE called fine-grained PRE (FPRE). FPRE extends PRE to support fine-grained re-encryption, allowing the proxy to convert any ciphertext encrypting a message m to a new ciphertext encrypting f (m) with a fine-grained re-encryption key for any function f. This enables the delegator to flexibly control the sharing of messages by specifying functions. Unfortunately, their scheme achieves only CPA security and requires a common random/reference string (CRS) during key generation. This requirement may weaken the syntax of (F)PRE, which allows users to independently generate their own keys. In this paper, we propose a new FPRE for bounded linear functions that we prove is CCA1 secure and does not require a CRS, based on the Learning with Errors (LWE) assumption. When the linear function is set to be the identity function, our construction immediately yields the first PRE scheme without a CRS, with CCA1 security under adaptive corruptions in the standard model. The main technique behind our construction is the design of a deterministic preimage computation algorithm for the decryption oracle in the security proof. To demonstrate the broader applicability of our proposed algorithm beyond the context of (F)PRE, we use it to prove the selective-identity CCA1 security of Agrawal et al.'s (Eurocrypt 2010) identity-based encryption (IBE) scheme, which was previously only known to be selective-identity CPA secure.

DOI
10.36227/techrxiv.173337791.18642506/v1

Related papers

Collusion-Resistant Identity-Based Proxy Re-Encryption Without Random Oracles

JunJie Qiu, Jungbok Jo, Hoon Jae Lee

In an identity-based proxy re-encryption scheme, a semi-trusted proxy can convert a ciphertext under Alice's public identity into a ciphertext for Bob.The proxy does not know the secret key of Alice or Bob, and also does not know the plaintext during the conversion.In identity-based proxy re-encryption, the collusion of the proxy and a delegatee may result in the decryption of ciphertext for delegator.In this paper, we present a new scheme which can avoid the collusion of proxy and delegatee.Our scheme improves the scheme of Chu and Tzeng while inheriting all useful properties such as unidirectionality and non-interactivity.In our scheme, we get the security by using added secret parameter and change the secret key and re-encryption key.Our sheme is secure against Chosen-Ciphertext Attack (CCA) and collusion attack in the standard model.

International Journal of Security and Its Applications•Sep 30, 2015•5 citations

Direct Constructions of Bidirectional Proxy Re-Encryption with Alleviated Trust in Proxy.

Jian Weng, Yunlei Zhao

In this work, we study (the direct constructions of) bidirectional proxy re-encryption (PRE) with alleviated trust in the proxy, specifically the master secret security (MSS) and the nontransitivity (NT) security, in the standard model, and achieve the following: • A multi-hop MSS-secure bidirectional PRE scheme with security against chosen plaintext attacks (CPA) in the standard model, where the ciphertext remains constant size regardless how many times it has been re-encrypted. To the best of our knowledge, there exists previously no MSS-secure multi-hop bidirectional PRE scheme with constant size of ciphertexts (whether in the random oracle model or not). • A single-hop MSS-secure and non-transitive bidirectional PRE scheme with security against chosen ciphertext attacks (CCA) in the standard model. The CCA-secure scheme is based on the CPA-secure scheme, and particularly employs a new re-encryption key (REK) generation mechanism to which each user makes equal contributions, where a single REK is used in both directions with the same computation so that the proxy needs not to distinguish the transform direction when it re-encrypts ciphertexts. Besides alleviated trust in proxy, single-hop non-transitive bidirectional PRE schemes also enjoy better fine-grained delegate right control (against malicious proxy). The security analysis uses Coron’s technique [Coron, Crypto 2000], which particularly allows adaptive secret-key corruption. Along the way, we also refine and clarify the security models for bidirectional PRE. 1

•Jan 1, 2011•7 citations

ID-Based Proxy Re-encryption Scheme with Chosen-Ciphertext Security

Woo Kwon Koo, Jungyeon Hwang, Hyoung-Joong Kim +1 more

A proxy re-encryption scheme allows Alice to temporarily delegate the decryption rights to Bob via a proxy. Alice gives the proxy a re-encryption key so that the proxy can convert a ciphertext for Alice into the ciphertext for Bob. Recently, ID-based proxy re-encryption schemes are receiving considerable attention for a variety of applications such as distributed storage, DRM, and email-forwarding system. And a non-interactive identity-based proxy re-encryption scheme was proposed for achieving CCA-security by Green and Ateniese. In the paper, we show that the identity-based proxy re-encryption scheme is unfortunately vulnerable to a collusion attack. The collusion of a proxy and a malicious user enables two parties to derive other honest users' private keys and thereby decrypt ciphertexts intended for only the honest user. To solve this problem, we propose two ID-based proxy re-encryption scheme schemes, which are proved secure under CPA and CCA in the random oracle model. For achieving CCA-security, we present self-authentication tag based on short signature. Important features of proposed scheme is that ciphertext structure is preserved after the ciphertext is re-encrypted. Therefore it does not lead to ciphertext expansion. And there is no limitation on the number of re-encryption.

Journal of the Institute of Electronics Engineers of Korea•Jan 1, 2009•1 citation

Secure and Efficient IBE-PKE Proxy Re-Encryption

Takeo Mizuno, Hiroshi DOI

In proxy re-encryption schemes, a semi-trusted entity called a proxy can convert a ciphertext encrypted for Alice into a new ciphertext for Bob without seeing the underlying plaintext. Several proxy re-encryption schemes have been proposed, however, only two schemes which enables the conversion of IBE ciphertexts to PKE ciphertexts has been proposed. One of schemes has some drawbacks such that the size of the re-encrypted ciphertext increases and Bob must be aware of existence of the proxy, which means Bob cannot decrypt a re-encrypted ciphertext with same PKE decryption algorithm. The other one achieves security under Selective-ID model. We propose a new, efficient scheme that enables the conversion of IBE ciphertexts to PKE ciphertexts, and prove full-ID CPA security in the standard model. In our scheme, the size of the re-encrypted ciphertext is optimal and Bob should not aware of existence of the proxy. As far as we know, this is the first IBE-PKE type scheme that holds the above properties.

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences•Jan 1, 2011•11 citations

On the Security of a Conditional Proxy Re-Encryption

Xi Zhang, Min-Rong Chen

To enable fine-grained delegations for proxy re-encryption systems, in AsiaCCS'09, Weng et al.'s introduced the concept of conditional proxy re-encryption (C-PRE), in which the proxy can convert a ciphertext only if a specified condition is satisfied. Weng et al. also proposed a C-PRE scheme, and claimed that their scheme is secure against chosen-ciphertext attack (CCA). In this paper, we show that their scheme is not CCA-secure under their defined security model.

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences•Jan 1, 2009•2 citations

On the Security of Group-based Proxy Re-encryption Scheme.

B. Purushothama, B. B. Amberker

Proxy re-encryption (PRE) allows a semi-trusted proxy to convert a ciphertext intended for Alice into a ciphertext for Bob without learning anything about the underlying plaintext. Chunbo Ma et al. have proposed a group based proxy re-encryption scheme to convert a ciphertext from one group to another. Any group member can independently decrypt the ciphertexts encrypted to its group. In their paper, the authors gave a security proof to say that the scheme is secure against adaptive chosen ciphertext attack. However, we highlight the aws in their scheme and show that their scheme is not secure against adaptive chosen ciphertext attack. In this direction, we construct an adversary who issues only one decryption oracle query and break the security of their scheme with non-negligible advantage.

•Jan 1, 2013•1 citation
Proxy re-encryption (PRE) allows a proxy to use the reencryption keys to convert ciphertexts encrypted under the delegators' public keys into ones that can be decrypted using the delegatees' secret keys, without revealing the underlying plaintext. However, PRE is limited to an all-or-nothing re-encryption, that is, the delegatee can either decrypt the re-encrypted ciphertext to obtain the whole message, or it learns nothing about the underlying message. To address this limitation, Zhou et al. (Asiacrypt 2023) proposed a new variant of PRE called fine-grained PRE (FPRE). FPRE extends PRE to support fine-grained re-encryption, allowing the proxy to convert any ciphertext encrypting a message m to a new ciphertext encrypting f (m) with a fine-grained re-encryption key for any function f. This enables the delegator to flexibly control the sharing of messages by specifying functions. Unfortunately, their scheme achieves only CPA security and requires a common random/reference string (CRS) during key generation. This requirement may weaken the syntax of (F)PRE, which allows users to independently generate their own keys. In this paper, we propose a new FPRE for bounded linear functions that we prove is CCA1 secure and does not require a CRS, based on the Learning with Errors (LWE) assumption. When the linear function is set to be the identity function, our construction immediately yields the first PRE scheme without a CRS, with CCA1 security under adaptive corruptions in the standard model. The main technique behind our construction is the design of a deterministic preimage computation algorithm for the decryption oracle in the security proof. To demonstrate the broader applicability of our proposed algorithm beyond the context of (F)PRE, we use it to prove the selective-identity CCA1 security of Agrawal et al.'s (Eurocrypt 2010) identity-based encryption (IBE) scheme, which was previously only known to be selective-identity CPA secure.
In an identity-based proxy re-encryption scheme, a semi-trusted proxy can convert a ciphertext under Alice's public identity into a ciphertext for Bob.The proxy does not know the secret key of Alice or Bob, and also does not know the plaintext during the conversion.In identity-based proxy re-encryption, the collusion of the proxy and a delegatee may result in the decryption of ciphertext for delegator.In this paper, we present a new scheme which can avoid the collusion of proxy and delegatee.Our scheme improves the scheme of Chu and Tzeng while inheriting all useful properties such as unidirectionality and non-interactivity.In our scheme, we get the security by using added secret parameter and change the secret key and re-encryption key.Our sheme is secure against Chosen-Ciphertext Attack (CCA) and collusion attack in the standard model.
In this work, we study (the direct constructions of) bidirectional proxy re-encryption (PRE) with alleviated trust in the proxy, specifically the master secret security (MSS) and the nontransitivity (NT) security, in the standard model, and achieve the following: • A multi-hop MSS-secure bidirectional PRE scheme with security against chosen plaintext attacks (CPA) in the standard model, where the ciphertext remains constant size regardless how many times it has been re-encrypted. To the best of our knowledge, there exists previously no MSS-secure multi-hop bidirectional PRE scheme with constant size of ciphertexts (whether in the random oracle model or not). • A single-hop MSS-secure and non-transitive bidirectional PRE scheme with security against chosen ciphertext attacks (CCA) in the standard model. The CCA-secure scheme is based on the CPA-secure scheme, and particularly employs a new re-encryption key (REK) generation mechanism to which each user makes equal contributions, where a single REK is used in both directions with the same computation so that the proxy needs not to distinguish the transform direction when it re-encrypts ciphertexts. Besides alleviated trust in proxy, single-hop non-transitive bidirectional PRE schemes also enjoy better fine-grained delegate right control (against malicious proxy). The security analysis uses Coron’s technique [Coron, Crypto 2000], which particularly allows adaptive secret-key corruption. Along the way, we also refine and clarify the security models for bidirectional PRE. 1
A proxy re-encryption scheme allows Alice to temporarily delegate the decryption rights to Bob via a proxy. Alice gives the proxy a re-encryption key so that the proxy can convert a ciphertext for Alice into the ciphertext for Bob. Recently, ID-based proxy re-encryption schemes are receiving considerable attention for a variety of applications such as distributed storage, DRM, and email-forwarding system. And a non-interactive identity-based proxy re-encryption scheme was proposed for achieving CCA-security by Green and Ateniese. In the paper, we show that the identity-based proxy re-encryption scheme is unfortunately vulnerable to a collusion attack. The collusion of a proxy and a malicious user enables two parties to derive other honest users' private keys and thereby decrypt ciphertexts intended for only the honest user. To solve this problem, we propose two ID-based proxy re-encryption scheme schemes, which are proved secure under CPA and CCA in the random oracle model. For achieving CCA-security, we present self-authentication tag based on short signature. Important features of proposed scheme is that ciphertext structure is preserved after the ciphertext is re-encrypted. Therefore it does not lead to ciphertext expansion. And there is no limitation on the number of re-encryption.
In proxy re-encryption schemes, a semi-trusted entity called a proxy can convert a ciphertext encrypted for Alice into a new ciphertext for Bob without seeing the underlying plaintext. Several proxy re-encryption schemes have been proposed, however, only two schemes which enables the conversion of IBE ciphertexts to PKE ciphertexts has been proposed. One of schemes has some drawbacks such that the size of the re-encrypted ciphertext increases and Bob must be aware of existence of the proxy, which means Bob cannot decrypt a re-encrypted ciphertext with same PKE decryption algorithm. The other one achieves security under Selective-ID model. We propose a new, efficient scheme that enables the conversion of IBE ciphertexts to PKE ciphertexts, and prove full-ID CPA security in the standard model. In our scheme, the size of the re-encrypted ciphertext is optimal and Bob should not aware of existence of the proxy. As far as we know, this is the first IBE-PKE type scheme that holds the above properties.
Proxy re-encryption (PRE) allows a semi-trusted proxy to convert a ciphertext intended for Alice into a ciphertext for Bob without learning anything about the underlying plaintext. Chunbo Ma et al. have proposed a group based proxy re-encryption scheme to convert a ciphertext from one group to another. Any group member can independently decrypt the ciphertexts encrypted to its group. In their paper, the authors gave a security proof to say that the scheme is secure against adaptive chosen ciphertext attack. However, we highlight the aws in their scheme and show that their scheme is not secure against adaptive chosen ciphertext attack. In this direction, we construct an adversary who issues only one decryption oracle query and break the security of their scheme with non-negligible advantage.