IACR Communications in Cryptology

CCA2-Secure Unidirectional Proxy Re-encryption from Cryptographic Group Actions

Hyungrok Jo, Shingo Sato, Junji Shikata

Published Aug 3, 2026• 0 citations

Abstract

Proxy re-encryption (PRE) allows a semi-trusted party (called a proxy) to transform ciphertexts under one user's public key into ciphertexts under another user's public key, without revealing any information about the underlying messages or the secret keys. On the other hand, post-quantum cryptography (PQC) is one of the most active areas, and in particular, many lattice-based PRE schemes have been proposed so far in the area of PQC. However, there is no post-quantum PRE satisfying security against adaptive chosen ciphertext attacks ( C C A 2 security), while C C A 2 security is one of the most desirable security notions for PRE. In this paper, we propose a group-action-based PRE scheme that achieves C C A 2 security for the first time. We give security proofs for our PRE in the random oracle model (ROM) and the quantum random oracle model (QROM). In particular, we can obtain the CSIDH-instantiation of this PRE scheme as the first post-quantum PRE. Our result contributes to the developments of post-quantum cryptography, and shows further potential of isogeny-based cryptography.

DOI: 10.62056/a6qgy4fbmo

Related papers

Toward CCA-secure bidirectional proxy re-encryption without pairing nor random oracle

Longxia Zhang, Xu An Wang, Wei Wang

Proxy re-encryption, introduced by Blaze et al. in 1998, allows a proxy to transform a ciphertext computed under Alice's public key into one that can be opened under Bob's decryption key. An open problem of constructing (bidirectional or unidirectional) IND-PRE-CCA2 secure proxy re-encryption scheme in the standard model yet without pairings was left until now. In this paper, based on Hanaoka's efficient chosen ciphertext secure public key encryption under the computational Diffie-Hellman assumption, we try to solve this open problem by presenting two new bidirectional proxy re-encryption schemes, which are restricted IND-PRE-CCA2 secure without pairing nor random oracle.

International Conference on Signal Processing Systems (ICSPS)Jul 1, 20101 citation

Restricted CCA-secure bidirectional proxy re-encryption scheme

Guo Duntao, Xu An Wang, Minqing Zhang +1 more

Proxy re-encryption allows a proxy to transform a ciphertext computed under Alice's public key into one that can be opened under Bob's decryption key. In CANS'08, Deng et al. proposed the first bidirectional IND-PRE-CCA2 secure proxy re-encryption without parings. Later, in PKC'09, Shao et al. proposed the first unidirectional IND-PRE-CCA2 secure proxy re-encryption without parings. But both of these schemes prove their security in the random oracle. They left an open problem of constructing (bidirectional or unidirectional) IND-PRE-CCA2 secure proxy re-encryption scheme in the standard model yet without pairings. In this paper, we try to solve this open problem by proposing two new restricted IND-PRE-CCA2 secure bidirectional proxy re-encryption schemes without pairing nor random oracle.

Jul 1, 20100 citations

Improving the Security of an Efficient Unidirectional Proxy Re-Encryption Scheme

Sébastien Canard, Julien Devigne, Fabien Laguillaumie

A proxy re-encryption (PRE) scheme allows a designated proxy, that has beforehand received aso-called re-encryption key, to translate a ciphertext intended to one user to a ciphertext intendedto another one. Traditionally, the re-encryption key is generated at the initiative of the initialreceiver and ideally, no secret keys should be known to the proxy. Such scheme is said unidirectionalif the transformation from one user to another does not necessarily imply the possibility tomake the inverse transformation. Regarding the literature on unidirectional proxy re-encryption, itseems hard to prove the strongest security level (namely indistinguishability under chosen ciphertextattacks - IND-CCA) of such schemes. Most of the time, PRE either reaches a chosen-plaintextsecurity or a replayable CCA security. At Africacrypt 2010, Chow, Weng, Yang and Deng proposeda scheme that satisfies CCA security in the random oracle model. However, their modelcan actually be strengthen. Indeed, we show in this paper how to modify this scheme so that itsimproved security achieves a full CCA security. In particular, we now allow the adversary of theCCA security for re-encryption to corrupt the user i′ who is the initial receiver of the challengedciphertext and at the same time to obtain the re-encryption key from i′ to the targeted users. Theresulting scheme is therefore a fully secure PRE which does not rely on pairings, and secure in therandom oracle model. It can be implemented efficiently with any traditional modular arithmetic.

Jan 1, 201121 citations

Bidirectional proxy re-encryption schemes without pairing nor random oracle

Xu An Wang, Ping Wei, Weidong Zhong +1 more

Blaze et al. in 1998 introduced the concept of proxy re-encryption, which allows a proxy to transform a ciphertext computed under Alice's public key into one that can be opened under Bob's decryption key. In CCS'07, Canetti et al. proposed an IND-PRE-CCA2 bidirectional proxy re-encryption scheme, and later, Libert et al. proposed another IND-PRE-CCA2 secure unidirectional proxy re-encryption. However, both schemes rely on the costly bilinear pairings. In CANS'08, Deng et al. proposed the first IND-PRE-CCA2 secure proxy re-encryption without parings. Later, in PKC'09, Shao et al. proposed another IND-PRE-CCA2 secure proxy re-encryption without parings. But both of these schemes prove their security in the random oracle. In this paper, based on Hanaoka's efficient chosen ciphertext secure public key encryption under the computational Diffie-Hellman assumption, we present two new interesting bidirectional proxy re-encryption schemes, which are restricted IND-PRE-CCA2 secure without pairing nor random oracle.

Jul 1, 20101 citation

New CCA-Secure Proxy Re-encryption Scheme without Random Oracles

Xu An Wang, Ping Wei, Minqing Zhang

Proxy re-encryption (PRE) allows a ciphertext computed under Alice's public key to be transformed to those which can be decrypted by Bob. In PKC'08, Libert and Vergnaud proposed the first unidirectional RCCA-secure PRE scheme in the standard model. They left the open problem of constructing unidirectional CCA-secure PRE scheme in the standard model open. Until recently, this open problem was solved by Weng et al. and Shao et al. independently. In this paper, based on Shao et al.'s proposal, we give a new efficient CCA-secure PRE scheme without random oracles and prove its security.

International Conference on Computational Intelligence and Security (CIS)Dec 1, 20102 citations

Lattice-based Unidirectional IBPRE Secure in Standard Model

Priyanka Dutta, Willy Susilo, Dung Hoang Duong +2 more

Proxy re-encryption (PRE) securely enables the re-encryption of ciphertexts from one key to another, without relying on trusted parties, i.e., it offers delegation of decryption rights. PRE allows a semi-trusted third party termed as a "proxy" to securely divert encrypted files of user A (delegator) to user B (delegatee) without revealing any information about the underlying files to the proxy. To eliminate the necessity of having a costly certificate verification process, Green and Ateniese introduced an identity-based PRE (IB-PRE). The potential applicability of IB-PRE leads to intensive research from its first instantiation. Unfortunately, till today, there is no unidirectional IB-PRE secure in the standard model, which can withstand quantum attack. In this paper, we provide, for the first time, a concrete construction of unidirectional IB-PRE which is secure in standard model based on the hardness of learning with error problem. Our technique is to use the novel trapdoor delegation technique of Micciancio and Peikert. The way we use trapdoor delegation technique may prove useful for functionalities other than proxy re-encryption as well.

arXiv:2005.06741May 14, 20201 citation