Digital signature,one of the most important cryptographic primitives,has been commonly used in information systems,and thus enhancing the security of a signature scheme can benefit such an application.Currently,leakag...Digital signature,one of the most important cryptographic primitives,has been commonly used in information systems,and thus enhancing the security of a signature scheme can benefit such an application.Currently,leakage-resilient cryptography is a very hot topic in cryptographic research.A leakage-resilient cryptographic primitive is said to be secure if arbitrary but bounded information about the signer's secret key(involving other states) is leaked to an adversary.Obviously,the leakage-resilient signature is more secure than the common signature.We construct an efficient leakage-resilient signature scheme based on BLS signature in the bounded retrieval model.We also prove that our scheme is provably secure under BLS signature.展开更多
Fiat-Shamir is a mainstream construction paradigm of lattice-based signature schemes.While its theoretical security is well-studied,its implementation security in the presence of leakage is a relatively under-explored...Fiat-Shamir is a mainstream construction paradigm of lattice-based signature schemes.While its theoretical security is well-studied,its implementation security in the presence of leakage is a relatively under-explored topic.Specifically,even some side-channel attacks on lattice-based Fiat-Shamir signature(FS-Sig)schemes have been proposed since 2016,little work on the leakage resilience of these schemes appears.Worse still,the proof idea of the leakage resilience of FS-Sig schemes based on traditional number-theoretic assumptions does not apply to most lattice-based FS-Sig schemes.For this,we propose a framework to construct fully leakage resilient lattice-based FS-Sig schemes in the bounded memory leakage(BML)model.The framework consists of two parts.The first part shows how to construct leakage resilient FS-Sig schemes in BML model from leakage resilient versions of nonlossy or lossy identification schemes,which can be instantiated based on lattice assumptions.The second part shows how to construct fully leakage resilient FS-Sig schemes based on leakage resilient ones together with a new property called state reconstruction.We show almost all lattice-based FS-Sig schemes have this property.As a concrete application of our fundamental framework,we apply it to existing lattice-based FS-Sig schemes and provide analysis results of their security in the leakage setting.展开更多
Threshold public key encryption allows a set of servers to decrypt a ciphertext if a given threshold of authorized servers cooperate. In the setting of threshold public key encryption, we consider the question of how ...Threshold public key encryption allows a set of servers to decrypt a ciphertext if a given threshold of authorized servers cooperate. In the setting of threshold public key encryption, we consider the question of how to correctly decrypt a ciphertext where all servers continually leak information about their secret keys to an external attacker. Dodis et al. and Akavia et al. show two concrete schemes on how to store secrets on continually leaky servers. However, their construc- tions are only interactive between two servers. To achieve continual leakage security among more than two servers, we give the first threshold public key encryption scheme against adaptively chosen ciphertext attack in the continual leak- age model under three static assumptions. In our model, the servers update their keys individually and asynchronously, without any communication between two servers. Moreover, the update procedure is re-randomized and the randomness can leak as well.展开更多
In recent years,much attention has been focused on designing provably secure cryptographic primitives in the presence of key leakage.Many constructions of leakage-resilient cryptographic primitives have been proposed....In recent years,much attention has been focused on designing provably secure cryptographic primitives in the presence of key leakage.Many constructions of leakage-resilient cryptographic primitives have been proposed.However,for any polynomial time adversary,most existing leakage-resilient cryptographic primitives cannot ensure that their outputs are random,and any polynomial time adversary can obtain a certain amount of leakage on the secret key from the corresponding output of a cryptographic primitive.In this study,to achieve better performance,a new construction of a chosen ciphertext attack 2(CCA2)secure,leakage-resilient,and certificateless public-key encryption scheme is proposed,whose security is proved based on the hardness of the classic decisional Diffie-Hellman assumption.According to our analysis,our method can tolerate leakage attacks on the private key.This method also achieves better performance because polynomial time adversaries cannot achieve leakage on the private key from the corresponding ciphertext,and a key leakage ratio of 1/2 can be achieved.Because of these good features,our method may be significant in practical applications.展开更多
In order to tolerate possible leakage of secret keys, leakage-resilient cryptosystem models a class of attractive leakage output by allowing an adversary to provide any computable leakage function and learning the par...In order to tolerate possible leakage of secret keys, leakage-resilient cryptosystem models a class of attractive leakage output by allowing an adversary to provide any computable leakage function and learning the partial keys or other possible intemal states from the output of function. In this work, we present an adaptively secure broadcast encryption resilient to key continual leakage in the standard model. Our scheme provides the tolerance of continual leakage, in which any user can generate multiple private keys per user by periodically updating the key. We use the dual system encryption mechanism to implement the leakage resilience and adaptive security, and intrinsically set an algorithm to refresh a key and produce a same distributed new key. We also give the evaluation of the leakage bound and leakage fraction, and the simulations show that our scheme can tolerate about 71% leakage fraction with 3.34× 10^-52 failure probability in standard 80-bit security level when we adjust the leakage factor to allow the private key to be 100 Kb.展开更多
For leakage-resilient ciphertext-policy attribute-based encryption （CP-ABE） at present, the size of the ciphertexts in most of them relies on the number of attributes. How to overcome this shortcoming is a challenge...For leakage-resilient ciphertext-policy attribute-based encryption （CP-ABE） at present, the size of the ciphertexts in most of them relies on the number of attributes. How to overcome this shortcoming is a challenge problem. Based on the Goldreich-Levin theorem and dual system encryption, an efficient CP-ABE scheme with constant size ciphertexts is proposed in this paper. It can tolerate leakage on master secret key and attribute-based secret keys with auxiliary inputs. Furthermore, the proposed scheme can be realized as resilience against continual leakage if keys are periodically updated. Under some static assumptions instead of other strong assumptions, the introduced scheme achieves adaptively security in the standard model.展开更多
基金supported by National Natural Science Foundation of China under Grant No.60703086,No.60973046Postdoctoral Science Foundation of China under Grant No. 20090451241Program for Talents in Nanjing University of Posts and Telecommunications under Grant No.NY209014
文摘Digital signature,one of the most important cryptographic primitives,has been commonly used in information systems,and thus enhancing the security of a signature scheme can benefit such an application.Currently,leakage-resilient cryptography is a very hot topic in cryptographic research.A leakage-resilient cryptographic primitive is said to be secure if arbitrary but bounded information about the signer's secret key(involving other states) is leaked to an adversary.Obviously,the leakage-resilient signature is more secure than the common signature.We construct an efficient leakage-resilient signature scheme based on BLS signature in the bounded retrieval model.We also prove that our scheme is provably secure under BLS signature.
基金This work was supported in part by National Natural Science Foundation of China(Grant Nos.61632020,U1936209,62002353)Beijing Natural Science Foundation(4192067).
文摘Fiat-Shamir is a mainstream construction paradigm of lattice-based signature schemes.While its theoretical security is well-studied,its implementation security in the presence of leakage is a relatively under-explored topic.Specifically,even some side-channel attacks on lattice-based Fiat-Shamir signature(FS-Sig)schemes have been proposed since 2016,little work on the leakage resilience of these schemes appears.Worse still,the proof idea of the leakage resilience of FS-Sig schemes based on traditional number-theoretic assumptions does not apply to most lattice-based FS-Sig schemes.For this,we propose a framework to construct fully leakage resilient lattice-based FS-Sig schemes in the bounded memory leakage(BML)model.The framework consists of two parts.The first part shows how to construct leakage resilient FS-Sig schemes in BML model from leakage resilient versions of nonlossy or lossy identification schemes,which can be instantiated based on lattice assumptions.The second part shows how to construct fully leakage resilient FS-Sig schemes based on leakage resilient ones together with a new property called state reconstruction.We show almost all lattice-based FS-Sig schemes have this property.As a concrete application of our fundamental framework,we apply it to existing lattice-based FS-Sig schemes and provide analysis results of their security in the leakage setting.
基金This work was supported by the Science and Technology on Communication Security Laboratory Foundation （9140C110301110C1103）, the Weaponry Equipment Pre-Research Foundation, the PLA General Armament Department （9140A04020311DZ02）, and the National Natural Science Foundation of China （61370203）.
文摘Threshold public key encryption allows a set of servers to decrypt a ciphertext if a given threshold of authorized servers cooperate. In the setting of threshold public key encryption, we consider the question of how to correctly decrypt a ciphertext where all servers continually leak information about their secret keys to an external attacker. Dodis et al. and Akavia et al. show two concrete schemes on how to store secrets on continually leaky servers. However, their construc- tions are only interactive between two servers. To achieve continual leakage security among more than two servers, we give the first threshold public key encryption scheme against adaptively chosen ciphertext attack in the continual leak- age model under three static assumptions. In our model, the servers update their keys individually and asynchronously, without any communication between two servers. Moreover, the update procedure is re-randomized and the randomness can leak as well.
基金Project supported by the National Key R&D Program of China(No.2017YFB0802000)the National Natural Science Foundation of China(Nos.61572303 and 61772326)+2 种基金the National Cryptography Development Fund During the 13thFive-Year Plan Period,China(No.MMJJ20170216)the Foundation of State Key Laboratory of Information Security,China(No.2017-MS-03)the Fundamental Research Funds for the Central Universities,China(No.GK201803064)
文摘In recent years,much attention has been focused on designing provably secure cryptographic primitives in the presence of key leakage.Many constructions of leakage-resilient cryptographic primitives have been proposed.However,for any polynomial time adversary,most existing leakage-resilient cryptographic primitives cannot ensure that their outputs are random,and any polynomial time adversary can obtain a certain amount of leakage on the secret key from the corresponding output of a cryptographic primitive.In this study,to achieve better performance,a new construction of a chosen ciphertext attack 2(CCA2)secure,leakage-resilient,and certificateless public-key encryption scheme is proposed,whose security is proved based on the hardness of the classic decisional Diffie-Hellman assumption.According to our analysis,our method can tolerate leakage attacks on the private key.This method also achieves better performance because polynomial time adversaries cannot achieve leakage on the private key from the corresponding ciphertext,and a key leakage ratio of 1/2 can be achieved.Because of these good features,our method may be significant in practical applications.
基金Acknowledgements The work was supported by the National Natural Science Foundation of China （Grant No. 61370224）, the Key Program of Natural Science Foundation of Hubei Province （2013CFA046）, and the Open Fund Program for State Key Laboratory of Information Security of China.
文摘In order to tolerate possible leakage of secret keys, leakage-resilient cryptosystem models a class of attractive leakage output by allowing an adversary to provide any computable leakage function and learning the partial keys or other possible intemal states from the output of function. In this work, we present an adaptively secure broadcast encryption resilient to key continual leakage in the standard model. Our scheme provides the tolerance of continual leakage, in which any user can generate multiple private keys per user by periodically updating the key. We use the dual system encryption mechanism to implement the leakage resilience and adaptive security, and intrinsically set an algorithm to refresh a key and produce a same distributed new key. We also give the evaluation of the leakage bound and leakage fraction, and the simulations show that our scheme can tolerate about 71% leakage fraction with 3.34× 10^-52 failure probability in standard 80-bit security level when we adjust the leakage factor to allow the private key to be 100 Kb.
基金supported in part by the Nature Science Foundation of China (61472307, 61402112, 61100165, 61100231)Natural Science Basic Research Plan in Shaanxi Province of China (2016JM6004)
文摘For leakage-resilient ciphertext-policy attribute-based encryption （CP-ABE） at present, the size of the ciphertexts in most of them relies on the number of attributes. How to overcome this shortcoming is a challenge problem. Based on the Goldreich-Levin theorem and dual system encryption, an efficient CP-ABE scheme with constant size ciphertexts is proposed in this paper. It can tolerate leakage on master secret key and attribute-based secret keys with auxiliary inputs. Furthermore, the proposed scheme can be realized as resilience against continual leakage if keys are periodically updated. Under some static assumptions instead of other strong assumptions, the introduced scheme achieves adaptively security in the standard model.
