Vetted Encryption

Abstract

We introduce Vetted Encryption (VE), a novel cryptographic primitive, which addresses the following scenario: a receiver controls, or vets, who can send them encrypted messages. We model this as a filter publicly checking ciphertext validity, where the overhead does not grow with the number of senders. The filter receives one public key for verification, and every user receives one personal encryption key.

We present three versions: Anonymous, Identifiable, and Opaque VE (AVE, IVE and OVE), and concentrate on formal definitions, security notions and examples of instantiations based on preexisting primitives of the latter two. For IVE, the sender is identifiable both to the filter and the receiver, and we make the comparison with identity-based signcryption. For OVE, a sender is anonymous to the filter, but is identified to the receiver. OVE is comparable to group signatures with message recovery, with the important additional property of confidentiality of messages.

A Unique Identity Based Signature Scheme

We construct an identity based signature scheme with unique signatures (${\textsc {UIBSS}}$) by using the known certificate based transformation on an unique signature scheme [3]. We generate a master signing and verification key for a ${\textsc {USS}}$ scheme, as well as set up a PRF. Given an identity $\MakeUppercase {ID}$ we use the PRF to derive randomness, which is then fed into the key generation algorithm of a ${\textsc {USS}}$ scheme. In other words: the key generation of the ${\textsc {USS}}$ is derandomised, with the given randomness depending on a given identity. The resulting key pair () are components of the user key $\MakeUppercase {USK}$ of $\MakeUppercase {ID}$. The key $\MakeUppercase {USK}$ also includes a certificate, which is signed under the master signing key. A signature of a message $\MakeUppercase {m}$ in the ${\textsc {UIBSS}}$ scheme is simply (), where . Finally, verification requires that both signatures $\sigma$ and $\MakeUppercase {CERT} _{ \MakeUppercase {ID} }$ verifies on $\MakeUppercase {m}$ and , respectively. We present the construction of our ${\textsc {UIBSS}}$ in Fig. 9, see the full version for the syntax of ${\textsc {IBS}}$ schemes.

Fig. 9.

The construction of an identity based signature scheme with unique signatures using a unique signature scheme ($\textsc {USS}$) and a psuedo random function ($\mathsf {PRF}$). Note that we denote the signing and verification key generated by ${\mathsf {Uss{.}Kg}}$ during ${\mathsf {Uibss{.}Kg}}$ as $( \MakeUppercase {MSK} , \MakeUppercase {MVK} )$ solely to distinguish these keys from the signing and verification keys that constitute the $\MakeUppercase {USK}$ of a particular $\MakeUppercase {ID}$.

We adopt the security notion of existential unforgeability of identity based signature schemes to our scheme [10]. Informally, the notion states that given access to a signing oracle and a corruption oracle, an adversary should not be able to find a tuple ($\MakeUppercase {m} , \MakeUppercase {ID} , \sigma$) which passes the verification algorithm, where she has not asked to corrupt $\MakeUppercase {ID}$, and not asked for a signature on ($\MakeUppercase {m} , \MakeUppercase {ID}$). Since the general certificate construction has been proven to produce identity-based signature schemes that satisfy this notion of security, it follows that our scheme is secure with respect to existential unforgeability [3].

For unique signature schemes implies $\sigma = \sigma '$ [11]. However, we will relax this requirement, and rather require that it is computationally hard for an adversary to win the following game: given the verification key, and access to a derivation oracle, find a tuple ($\MakeUppercase {m} , \MakeUppercase {ID} , \varsigma , \varsigma '$) such that , yet $\varsigma \ne \varsigma '$. We define this security notion as outsider unicity, with the game formally defined in Fig. 10. As always, the advantage of the adversary is her probability of winning the game.

Fig. 10.

The outsider unicity game for unique identity based signature schemes.

Our certificate based ${\textsc {UIBSS}}$ scheme achieves outsider unicity due to the unicity property of the underlying unique signature scheme, as well as it’s notion of unforgeability. Informally, the unicity of signatures forces an adversary to find a forgery on .

Lemma 7

(Outsider unicity of ${\textsc {UIBSS}}$ construction). For all adversaries , there exists an adversary such that