CCA. Simple CCA-Secure Public Key Encryption from Any Non-Malleable ID-based Encryption

Transcript

1 All rights are reserved and copyright of this manuscript belongs to the authors. This manuscript has been published without reviewing and editing as received from the authors: posting the manuscript to SCIS 2008 does not prevent future submissions to any journals or conferences with proceedings. SCIS 2008 The 2008 Symposium on Cryptography and Information Security Miyazaki, Japan, Jan , 2008 The Institute of Electronics, Information and Communication Engineers ID CCA Simple CCA-Secure Public Key Encryption from Any Non-Malleable ID-based Encryption Takahiro Matsuda Goichiro Hanaoka Kanta Matsuura Hideki Imai ID CCA 2005 Boneh Katz (BK ) MAC 704 ID 256 ID IND-CCA NM-sID-CPA (CCA) (Public Key Encryption, PKE) (CPA) ID (Identity-based Encryption, IBE) CCA PKE IBE-PKE IBE-PKE 2004 Canetti [6] CPA IBE PKE (CHK ) One-Time One- Time 2005 Boneh [4] MAC ( (Universal Hash Function)) (BK )Leftover Hash Lemma [8], , Institute of Industrial Science, The University of Tokyo, 4-6- Komaba, Meguro-ku, Tokyo , Japan. tmatsuda@iis.u-tokyo.ac.jp, , Research Center for Information Security, National Institute of Advanced Industrial Science and Technology, -8-3 Sotokanda, Chiyoda-ku, Tokyo 0-002, Japan. ( ) IBE [5,, 9] IBE (IND-(s)ID-CPA) IBE (Non-Malleability, NM) χ m R m χ IBE (NM-(s)ID-CPA) (IND-(s)ID-CPA) (NM-(s)-ID-CCA) (IND-(s)ID-CCA) [2] IBE CCA PKE IBE ID (NMsID-CPA) IBE CCA PKE IND-sID-CCA NM-sID-CPA IBE NM-sID-CPA ( )

2 IBE CCA PKE PKE IBE ([3] [2] ) CHK BK IBE 2 x y y x y x x y x y 2. Π 3 PKE.KG: κ sk pk PKE.Enc: pk m M χ X PKE.Dec: sk χ m ( ) M X Π IND-CCA (Indistinguishability against Adaptive Chosen-Ciphertext Attacks, IND-CCA) A IND-CCA Challenger C IND- CCA game Setup. C PKE.KG( κ ) pk A sk Phase. A Challenger q (χ, χ 2,..., χ q ) C χ i m i PKE.Dec(sk, χ i ) (m i M { }) Challenge. A 2 m 0, m C C b {0, } m b χ PKE.Enc(pk, m b ) χ A Phase 2. A Phase q 2 Challenge χ Guess. A C b b q D = q + q 2 A Π A IND-CCA Adv IND-CCA Π,A = Pr[b = b] /2. q D t A Adv IND-CCA Π,A ɛ Π (t,q D,ɛ)-IND-CCA ɛ Π IND-CCA 2.2 ID ID Π 4 IBE.Setup: κ msk prm IBE.Ext: prm msk ID I ID d ID IBE.Enc: prm ID I m M χ X IBE.Dec: d ID χ m ( ) I M X Π ID NM-sID-CPA IBE NM-sID- CPA Attrapadung [2] ID ID (Non-Malleability against selective-id Chosen-Plaintext Attacks, NM-sID-CPA) A NM-sID- CPA Challenger C NM-sID-CPA game Init. A ID Setup. C IBE.Setup( κ ) prm A msk Phase. A C q (ID, ID 2,..., ID q ) C ID i d IDi IBE.Ext(prm, msk, ID i ) A ID 2

3 Challenge. A M M M C C M m m χ IBE.Enc(prm, ID, m ) A Phase 2. A Phase q 2 Output. A C m R m = (m, m 2,..., m t) χ = (χ, χ 2,..., χ t) (χ i IBE.Enc(prm, ID, m i ) i {,...,t}) R C C χ IBE.Dec(d ID, ) (d ID IBE.Ext(prm, msk, ID )) m q E = q + q 2 A R(m, χ ) χ / χ / m R(m, m ) = true R := R(m, χ ) R := R(m, χ ) ID Π A NM-sID-CPA Π,A = Pr[R ] Pr[R ] 2. q E t A Π,A ɛ Π (t,q E,ɛ)-NM-sID-CPA ɛ Π NMsID-CPA 2.3 H : K M in M out M in M out K H 2.3. A (One-Way Hash Function, OWHF) H Adv OW H,A = Pr[k K; m M in ; h H k (m); m A(k, h) : H k (m ) = h] 3. t A Adv OW H,A ɛ H (t,ɛ)-owhf ɛ H OWHF TCRHF Cramer [7] A (Target Collision Resistant Hash Function, TCRHF) H Adv TCR H,A = Pr[k K; m M in ; m 2 A(k, m ) : H k (m ) = H k (m 2 ) m m 2 ] t κ A t = R 3 R 4. t A Adv TCR H,A ɛ H (t,ɛ)-tcrhf ɛ H TCRHF 3 Π = (IBE.Setup, IBE.Ext, IBE.Enc, IBE.Dec) NMsID-CPA ID H : K {0, } γ I ( K {0, } γ H ) Π Π M Π ID Π M Π M Π {0, } γ 3.. Π (t, q D, 2q D ( ɛ tcr )ɛ cca 4 (ɛ ow + 2 )) -NM-sID-CPA ID γ H (t, ɛ ow )-OWHF (t, ɛ tcr )-TCRHF Π (t, q D, ɛ cca )-IND-CCA A Π (t, q D, ɛ cca ) -IND- CCA A /2 + ɛ cca Π A (t, ɛ tcr )- TCRHF (t, ɛ ow )-OWHF H ID Π (t, q D, 2q D ( ɛ tcr )ɛ cca 4 (ɛ ow + 2 )) γ -NM-sID-CPA S q D > 0 S A IND-CCA game NM-sID-CPA Challenger C NM-sID-CPA game Setup. S k K r {0, } γ ID H k (r ) ID NM-sID-CPA game ID C prm S P K = (prm, k) A Phase. S A χ i = ID i, y i i {,...,q} ID i m i ID i = ID : m i = : ID i C d IDi IBE.Dec(d IDi, y i ) m i = m i r i m i Challenge. A (m 0, m ) S χ b S {0, } m M Π (m bs ) r {0, } γ M bs = m bs r, M bs = m r M Π M Π = (M 0, M ) 3

4 PKE.KG( κ ) : (prm, msk) IBE.Setup( κ ) k K SK = msk, P K = (prm, k) Output (SK, P K). PKE.Enc(P K, m) : r {0, } γ ; ID H k (r) y IBE.Enc(prm, ID, m r) χ = ID, y Output χ. PKE.Dec(SK, χ) : Parse χ as ID, y ; d ID IBE.Ext(prm, msk, ID) m r IBE.Dec(d ID, y) (If this decrypts to then output and stop.) Output m if H k (r) = ID. Otherwise output. : Π Challenge C y χ = ID, y A Phase 2. Phase Guess. A b A R := γ 2 b A S y b A = b S : m M Π (m bs ) r {0, } γ α y IBE.Enc(prm, ID, m r ) ( α) y IBE.Enc(prm, ID, m r ) : A χ j = ID j, y j j {,...,qd } y j y S C (R, y ) S α S NM-sID-CPA Π,S S NM-sID-CPA Challenge C M Π 2 NM-sID- CPA game M Π M S M 0 M /2 NM-sID- CPA Challenger b C {0, } M bc M b C S b S Pr[b S = b C ] = Pr[b S b C ] = /2 b S b C S A Challenge χ Π χ Valid A χ = ID, y Valid A S b S b C Valid S b A b S b C Valid 6 Case : b A = b S b S = b C Valid Case 2: b A = b S b S = b C Valid Case 3: b A = b S b S b C Case 4: b A b S b S = b C Valid Case 5: b A b S b S = b C Valid Case 6: b A b S b S b C Case i Case i Case i S Adv i Adv i := Pr[R i ] Pr[R i ] = Pr[ i ] (Pr[R i ] Pr[R i ]) NM-sID-CPA Π,S = 6 i= Adv i Case : b A = b S b S = b C Valid M = m bs r M = m r b A = b S A guess S y m bs r A b A S α S M = m bs r γ y A m r γ r r ( α) /2 γ ( /2 γ = P γ ) Pr[R ] = α + ( α) P γ r r r r y m r γ S y Pr[R ] = P γ Pr[ ] Pr[ ] = Pr[b A = b S b S = b C Valid] = Pr[b A = b S b S = b C Valid] Pr[Valid b S = b C ] Pr[b S = b C ] Pr[b A = b S b S = b C Valid] = /2 + ɛ cca S y ID m bs r A Challenge Valid A View Π A Pr[Valid b S = b C ] ( P v ) (Pr[Valid b S = b C ] = P v ) Pr[b S = b C ] = /2 Case S Adv = Pr[ ] (Pr[R ] Pr[R ]) = (/2+ɛ cca ) ( P v ) /2 (α+( α) P γ P γ ) = /2 α (/2 + ɛ cca ) ( P v ) ( P γ ) 4

5 Case 2 : b A = b S b S = b C Valid Case M = m bs r M = m r Pr[R 2 ] = α + ( α) P γ Pr[R 2 ] = P γ Pr[ 2 ] Pr[ 2 ] = Pr[b A = b S b S = b C Valid] = Pr[b A = b S b S = b C Valid] Pr[Valid b S = b C ] Pr[b S = b C ] Case Pr[Valid b S = b C ] = P v Pr[b A = b S b S = b C Valid] A Valid A S P k Pr[b S = b C ] = /2 Case 2 S Adv 2 = Pr[ 2 ] (Pr[R 2 ] Pr[R 2 ]) = /2 P k P v α ( P γ ) Case 3 : b A = b S b S b C M = m r M = m bs r Pr[R 3 ] Pr[R 3 ] Case Pr[R 3 ] = P γ Pr[R 3 ] = α + ( α) P γ Pr[ 3 ] Pr[ 3 ] = Pr[b A = b S b S b C ] = Pr[b A = b S b S b C ] Pr[b S b C ] b S b C A χ A m 0 m A Challenge A S Case 3 b S A b A b S /2 Pr[b A = b S b S b C ] = /2 Pr[b S b C ] = /2 Case 3 S Adv 3 = Pr[ 3 ] (Pr[R 3 ] Pr[R 3 ]) = /2 /2 {P γ α ( α) P γ } = /4 α ( P γ ) Case 4 : b A b S b S = b C Valid M M Case b A b S S y A Valid A r γ Pr[R 4 ] = 0 A M = m r A R(M, y i ) y i P γ Pr[R 4 ] P γ Pr[ 4 ] Pr[ 4 ] = Pr[b A b S b S = b C Valid] = Pr[b A b S b S = b C Valid] Pr[Valid b S = B C ] Pr[b S = b C ] = ( (/2 + ɛ cca )) ( P v ) /2 = /2 (/2 ɛ cca ) ( P v ) Pr[b A = b S b S = b C Valid] = /2 + ɛ cca Pr[Valid b S = b C ] = P v Pr[b S = b C ] = /2 Case 4 S Adv 4 = Pr[ 4 ] (Pr[R 4 ] Pr[R 4 ]) /2 (/2 ɛ cca ) ( P v ) P γ Case 5 : b A b S b S = b C Valid M M Case Valid A S Valid A H k (r A ) = ID M A = m A r A y A ID, y A b A b S S A q D y Pr[R 5 ] S q D H k (r A ) = ID M A = m A r A y A m A r A r A = r Pr[R 5 ] /q D Pr[r A = r 5 ] = /q D ( Pr[r A r 5 ]) [r A r 5 ] Case 5 S A r IBE.Enc(prm, H k (r ), m bs r ) H k (r )(= ID ) r k S A r A r H k (r A ) = H k (r ) = ID r A r k r A r H k (r A ) = H k (r ) = ID r A H ɛ tcr Pr[R 5 ] /q D ( ɛ tcr ) Case 4 Pr[R 5 ] P γ Pr[ 5 ] Pr[ 5 ] = Pr[b A b S b S = b C Valid] = ( Pr[b A = b S b S = b C Valid]) Pr[Valid b S = b C ] Pr[b S = b C ] = ( P k ) P v /2 Pr[b A = b S b S = b C Valid] = P k Pr[Valid b S = b C ] = P v Pr[b S = b C ] = /2 Case 5 S Adv 5 = Pr[ 5 ] (Pr[R 5 ] Pr[R 5 ]) ( P k ) P v /2 {/q D ( ɛ tcr ) P γ } Case 6 : b A b S b S b C M M Case 3 Pr[R 6 ] Pr[R 6 ] 0 P r[r 6 ] Case 6 b S b C A 5

6 ID ID m r y y r A r ID = H k (r ) r γ ID = H k (r ) r ID r {r ID = H k (r)}( r ) H ɛ ow Pr[R 6 ] ɛ ow Pr[ 6 ] Pr[ 3 ] Pr[ 6 ] = /4 Case 6 S Adv 6 = Pr[ 6 ] (Pr[R 6 ] Pr[R 6 ]) /4 ɛ ow Case Π,S Π,S = 6 i= Adv i /2 (/2 + ɛ cca ) ( P v ) α ( P γ ) + /2 P k P v α ( P γ ) /4 α ( P γ ) /2 (/2 ɛ cca ) ( Pv) P γ + ( P k ) P v /2 {/q D ( ɛ tcr ) P γ } /4 ɛ ow 2 5 α = {/q D ( ɛ tcr ) P γ }/( P γ ) P k α Π,S /2 (/2 + ɛ cca ) ( P v ) {/q D ( ɛ tcr ) P γ } /4 {/q D ( ɛ tcr ) P γ } /2 (/2 ɛ cca ) ( Pv) P γ + /2 P v {/q D ( ɛ tcr ) P γ ) /4 ɛ ow (α) = /2 /q D P v (/2 ɛ cca ) ( ɛ tcr ) + /2 /q D ( ɛ tcr ) ɛ cca /4 P γ /4 ɛ ow (P v ) IND-CCA (/2 ɛ cca 0) ( ɛ tcr ) 0 P v 0 ( ) 0 Π,S /2 /q D ( ɛ tcr ) ɛ cca /4 (ɛ ow + /2 γ ) A ɛ cca Π H (t, ɛ tcr )-TCRHF (t, ɛ ow )-OWHF α A S Π NM-sID-CPA ɛ tcr ( ɛ tcr ) Π ID Π r ID = H k (r) H H κ κ 2κ IND NM BK [4] MAC CCA IND-sID-CPA NM-sID-CPA 4 IBE CCA PKE IBE IBE-PKE IBE NMsID-CPA IBE [] M. Abe, Y. Cui, H. Imai, E. Kiltz, Efficient Hybrid Encryption from ID-Based Encryption, Available at eprint.iacr.org/2007/023/ [2] N. Attrapadung, Y. Cui, D. Galindo, G. Hanaoka, I. Hasuo, H. Imai, K. Matsuura, P. Yang, R. Zhang, Relations Among Notions of Security for Identity Based Encryption Schemes, Proc. of LATIN 06, LNCS 3887, pp. 30-4, [3] M. Bellare, A. Desai, D. Poincheval, P. Rogaway, Relations among Proc. of CRYPTO 98, LNCS 462, pp , 998. [4] D. Boneh, J. Katz, Improved Efficiency for CCA-Secure Cryptosystems Built Using Identity-Based Encryption, Proc. of CT-RSA 05, LNCS 3376, pp.87-03, [5] X. Boyen, Q. Mei, B. Waters, Direct Chosen Ciphertext Security from Identity-Based Techniques, CR-RSA 05, LNCS 3376, pp , [6] R. Canetti, S. Halevi, J. Katz, Chosen-Ciphertext Security from Identity-Based Encryption, Proc. of EURO- CRYPT 04, LNCS 3027, pp , [7] R. Cramer, V. Shoup, Design and Analysis of Practical Public-Key Encryption Schemes Secure against Adaptive Chosen Ciphertext Attack, SIAM Journal on Computing Vol. 33, pp , [8] J. Håstad, R. Impagliazzo, L. Levin, M. Luby, Construction of a Pseudorandom Generator from any One-Way Function, SIAM J. Comp. 28(4): , 999. [9] R. Zhang, Tweaking TBE/IBE to PKE Transforms with Chameleon Hash Functions, Proc. of ACNS 07, LNCS 452, pp ,