Data is typically encrypted before transmission to a cloud server to safeguard user privacy. However, such encryption prevents the server from performing searches on the data, necessitating the introduction of novel cryptographic primitives, such as public key encryption with multi-ciphertext equality test (PKEMET). PKEMET allows the cloud server to execute a single equality test on multiple ciphertexts, determining if the underlying messages are identical disclosing any extra information. Ciphertext-policy attribute-based encryption (CP-ABE) facilitates secure and efficient data sharing in cloud computing environments by supporting fine-grained access control and flexible encryption. In this work, we integrate the concepts of PKEMET and CP-ABE, introducing a novel cryptographic primitive of CP-ABE with multi-ciphertext equality test (CP-ABEMET). We present the first quantum-resistant CP-ABEMET scheme based on the learning with errors (LWE) problem. This scheme enables the receiver to delegate the cloud server to perform a single equality test among multiple messages encrypted under distinct access policies. Importantly, during the multi-ciphertexts equality test, the server gains no knowledge of the encrypted messages. Furthermore, our proposed scheme not only achieves traditional indistinguishability against chosen plaintext attack (IND-CPA) and one-way against chosen plaintext attack (OW-CPA) security but is also proven to be number secure and resilient against collusion attacks. Finally, a comparative performance analysis between our CP-ABEMET and existing equality test schemes demonstrates that our approach is more practical, efficient, and secure.
Data is typically encrypted before transmission to a cloud server to safeguard user privacy. However, such encryption prevents the server from performing searches on the data, necessitating the introduction of novel cryptographic primitives, such as public key encryption with multi-ciphertext equality test (PKEMET). PKEMET allows the cloud server to execute a single equality test on multiple ciphertexts, determining if the underlying messages are identical disclosing any extra information. Ciphertext-policy attribute-based encryption (CP-ABE) facilitates secure and efficient data sharing in cloud computing environments by supporting fine-grained access control and flexible encryption. In this work, we integrate the concepts of PKEMET and CP-ABE, introducing a novel cryptographic primitive of CP-ABE with multi-ciphertext equality test (CP-ABEMET). We present the first quantum-resistant CP-ABEMET scheme based on the learning with errors (LWE) problem. This scheme enables the receiver to delegate the cloud server to perform a single equality test among multiple messages encrypted under distinct access policies. Importantly, during the multi-ciphertexts equality test, the server gains no knowledge of the encrypted messages. Furthermore, our proposed scheme not only achieves traditional indistinguishability against chosen plaintext attack (IND-CPA) and one-way against chosen plaintext attack (OW-CPA) security but is also proven to be number secure and resilient against collusion attacks. Finally, a comparative performance analysis between our CP-ABEMET and existing equality test schemes demonstrates that our approach is more practical, efficient, and secure.
Abstract Amid the rapid evolution of cloud computing, safeguarding data privacy has become a core priority for both academic and industrial communities. To protect user data from unauthorized access, vast volumes of sensitive information are encrypted before being transmitted to and stored on cloud platforms. Nevertheless, encryption inherently limits the platform’s ability to manipulate encrypted data, like direct search or matching on ciphertexts. Traditional Public Key Encryption with Equality Test (PKEET) schemes address this issue by enabling ciphertext equivalence verification without decryption, but they lack support for multi-ciphertext scenarios and fine-grained security. We propose a novel quantum-resistant Public Key Encryption with Multi-ciphertexts Equality Test (PKE-MET) scheme, the first to be constructed based on the Learning with Rounding (LWR) problem in lattice-based cryptography. We prove that the scheme achieves Chosen Ciphertext Attack (CCA2) security under the standard model, addressing the limitation of the existing Learning With Error (LWE)-based PKE-MET scheme which only reaches Chosen-Plaintext Attack (CPA) security. Compared with LWE-based solution, our scheme eliminates the need for complex discrete Gaussian sampling and adopts a smaller modulus. Theoretical analysis demonstrates that our proposed scheme exhibits good ciphertext scalability. Compared with the LWE-based solution, it requires only approximately 1/3 of the ciphertext storage. This reduces storage and communication resource consumption, thus lightening the operational load on cloud servers.
Ciphertext policy attribute-based encryption (CP-ABE) is a promising cryptographic technology that provides fine-grained access control as well as data confidentiality. It enables one sender to encrypt the data for more receivers, and to specify a policy on who can decrypt the ciphertext using his/her attributes alone. However, most existing ABE schemes are constructed on bilinear maps and they cannot resist quantum attacks. In this paper, we propose a multi-authority CP-ABE (MA-CPABE) scheme on ideal lattices which is still secure in post-quantum era. On one hand, multiple attribute authorities are required when user's attributes cannot be managed by a central authority. On the other hand, compared with generic lattice, the ideal lattice has extra algebraic structure and can be used to construct more efficient cryptographic applications. By adding some virtual attributes for each authority, our scheme can support flexible threshold access policy. Security analysis shows that the proposed scheme is secure against chosen plaintext attack (CPA) in the standard model under the ring learning with errors (R-LWE) assumption.
The advent of quantum computing poses a significant threat to traditional cryptographic algorithms, including RSA, Diffie-Hellman, and Elliptic Curve Cryptography, due to the capabilities of quantum algorithms like Shor’s algorithm. Post-quantum cryptography (PQC) has emerged to address these challenges, with lattice-based cryptography (LBC) being a prominent candidate. LBC, underpinned by hard mathematical problems like Learning with Errors (LWE) and Ring-LWE (RLWE), offers robust security against quantum and classical adversaries. In parallel, Ciphertext-Policy Attribute-Based Encryption (CPABE) has become a critical tool for enabling fine-grained access control in data-sharing scenarios, such as secure cloud storage and IoT. While existing CP-ABE implementations rely on bilinear pairings vulnerable to quantum attacks, lattice-based CPABE schemes provide a quantum-resistant alternative. Despite their potential, these schemes face challenges in computational efficiency, collusion resistance, and implementation correctness. Our contributions include a detailed mathematical breakdown of one of the state-of-the-art (SOTA) lattice-based CP-ABE schemes and a novel correctness proof for the same scheme.
Cloud computing enables users to remove the necessity of the need of local hardware architecture, which removes the burden of the users from high computation costs. Therefore, it has attracted much attention and research has been conducted heavily on it. To protect users’ privacy, data is usually encrypted prior to being sent to the cloud server. As the resulting system is unusable, since the cloud can no longer search throughout the data, new cryptographic primitive such as public-key encryption with equality test (PKEET) has been introduced. In PKEET, users can test whether the underlying messages of two ciphertexts encrypted under different public keys are equal or not without the need to decrypt those ciphertexts. This is a very useful tool, especially for the cloud database, since PKEET mainly focuses on the equality test between two ciphertexts. However, in practice, the cloud server may need to verify the equivalence among more than two ciphertexts. This leads to disclosing unnecessary information of users and redundant computation cost will also occur when using traditional PKEET schemes. How to make this more efficient and practical remains an interesting research problem. In this article, to solve the aforementioned problems by providing a novel concept of public-key encryption with multi-ciphertext equality test (PKE-MET). In PKE-MET, each ciphertext can designate a numberssuch that the cloud server can only perform equality test on this ciphertext with others−1ciphertexts, where all their designated numbers ares. For PKE-MET, besides traditional OW-CPA and IND-CPA security, we specially define Number security. We instantiate PKE-MET to a concrete scheme and give its security proof. Furthermore, to enable the primitive to be more practical in applications, we extend it to the concept of PKE with flexible MET (PKE-FMET). In PKE-FMET, the cloud server can perform equality test on any number of ciphertexts as long as the maximum number of their designated numbers is less than or equal to the number of ciphertexts. We construct a PKE-FMET scheme based on our PKE-MET construction and prove its security under the defined security models. Besides, the performance analysis mainly of efficiency and security between our constructions and existing equality test schemes in cloud computing show that our proposed schemes are more efficient and secure in the multi-ciphertext scenario.
Identity-based encryption with equality test (IBEET) provides a feasible way for cloud server partitioning or searching on ciphertexts in the cloud. In that case, the server can judge if two different ciphertexts encrypt the same plaintexts or not. In response to threats posed by quantum computers, lattice-based IBEET schemes have been proposed to make cloud service post-quantum secure. However, those schemes are inefficient and can hardly meet the needs of resource-constrained devices. In this article, an efficient post-quantum IBEET scheme is introduced, which achieves testability by embedding the hash value of plaintext into testing trapdoor instead of encrypting it directly and doubling the size of ciphertext. We also prove that, with the Learning With Errors (LWE) problem assumption, the new scheme is one-way secure against selective identity and chosen ciphertext attacks (OW-sID-CCA) in quantum secure model. Furthermore, we evaluate the performance of the new construction and demonstrate its efficiency by showing that it only costs about half storage comparing with other lattice-based IBEET schemes. The execution time of encryption and decryption phrases in the new scheme reduce by 50%, while the computational cost in test algorithm keeps the same. Therefore, the new proposed IBEET is much more practical for working in post-quantum cloud computing scenarios.
With the rapid development of quantum computing technology, data sharing systems in cloud storage may suffer from quantum computing attacks. Recently, many researchers have proposed encryption schemes to achieve quantum attack resistance and fine-grained data access control. However, single point of failure and secure attribute revocation are two critical problems for quantum-resistant encryption scheme in cloud storage environments. In order to deal with these problems, in this paper, we propose a revocable multi-authority attribute-based encryption from lattice (RMA-ABE-L) in cloud storage. Firstly, RMA-ABE-L scheme can achieve fine-grained data access control with quantum computing attack resistance. We design efficient anti-quantum algorithms based on R-LWE problem and merge them with ciphertext-policy attribute-based encryption (CP-ABE) structure. Secondly, RMA-ABE-L scheme can solve the single point of failure problem. We design the multi-authority structure to so that the compromise of some authorities does not affect the functioning of the whole data sharing system. Moreover, RMA-ABE-L scheme can realize secure attribute revocation. We design a secure attribute revocation mechanism and set special identity construction. The performance analysis shows that RMA-ABE-L scheme is more efficient than other related schemes.