Statistically Consistent Broadcast Authenticated Encryption with Keyword Search

Abstract

Searchable Encryption (SE) allows users to perform a keyword search over encrypted documents. In Eurocrypt’04, Boneh et al. introduced Public-key Encryption with Keyword Search (PEKS). Broadcast Encryption with Keyword Search (BEKS) is a natural progression to allow some amount of access control. Unfortunately, PEKS and BEKS suffer from keyword-guessing attacks (KGA). In the case of KGA, an adversary guesses the keyword encoded in a trapdoor by creating a ciphertext on a sequence of keywords of its choice and testing them against the trapdoor. In ACISP’21, Liu et al. introduced a variant of BEKS called Broadcast Authenticated Encryption with Keyword Search (BAEKS), which tried to mitigate KGA in BEKS. This construction did not argue consistency and achieved weaker security in the random oracle model.

In this work, we first introduce the notion of consistency for BAEKS and introduce security models much stronger than those of Liu et al. We propose a new statistically-consistent construction of BAEKS in the standard model that achieves security in the newly introduced models. Our proposal is proven adaptively secure under the well-studied bilateral Matrix Diffie-Hellman Assumption and still achieves asymptotic efficiency similar to that of Liu et al.

A Security Models of [20]

In [20], Liu et al. introduced broadcast authenticated encryption with keyword search (BAEKS) as an extension of public-key authenticated encryption with keyword search (PAEKS) [18]. To capture the challenges in case of this new primitive, [20] introduced several security games. We reproduce the games from [20] next for completeness. They introduced four security games– two games to capture the security of trapdoors and two to capture the security of ciphertexts.

Trapdoor Privacy. Informally, trapdoor privacy captures trapdoors do not leak the keywords encoded. The formal security game next is reproduced verbatim from [20].

• $\textbf{Setup}$: Given security parameter, the challenger $\mathcal {C}$ sends the public parameter $\textsf{pp}$, the challenge sender’s public key $(\textsf{pk}_{{\textsf{S}}^*})$ and the challenge receiver’s public key $(\textsf{pk}_{{\textsf{R}}^*})$ to the adversary $\mathcal {A}$.

• $\mathbf {Query\ Phase}\text {-}\textsf{I}$:

  • Hash Queries: $\mathcal {C}$ responds to hash queries with random numbers.

  • Ciphertext Query: Given a keyword $\omega$, a receiver set’s public keys $\mathcal {R}= \{\textsf{pk}_{\textsf{R}_1},\ldots ,\textsf{pk}_{\textsf{R}_\ell }\}$, $\mathcal {C}$ computes a ciphertext w.r.t $\textsf{sk}_{{\textsf{S}}^*}$, $\omega$ and $\mathcal {R}$ and returns it to $\mathcal {A}$.

  • Trapdoor Query: Given a keyword $\tilde{\omega }$, a sender’s public key $\textsf{pk}_{\widetilde{\textsf{S}}}$, a chosen public key $\textsf{pk}_{\textsf{R}_i}\in \mathcal {R}$, it computes a trapdoor $\textsf{Tr}$ w.r.t. $\textsf{pk}_{\widetilde{\textsf{S}}}$, $\tilde{\omega }$ and $\textsf{pk}_{\textsf{R}_i}$, returns it to $\mathcal {A}$.

• $\textbf{Challenge}$: $\mathcal {A}$ chooses two keywords $({\tilde{\omega }}^*_0,{\tilde{\omega }}^*_1)$ such that $({\tilde{\omega }}^*_0,\mathcal {R})$ and $({\tilde{\omega }}^*_1,\mathcal {R})$ have not been queried for ciphertexts where $\textsf{pk}_{{\textsf{R}}^*}\in \mathcal {R}$, and $({\tilde{\omega }}^*_0,\textsf{pk}_{{\textsf{S}}^*})$ and $({\tilde{\omega }}^*_1,\textsf{pk}_{{\textsf{S}}^*})$ have not been queried for trapdoors and sends them to $\mathcal {C}$. $\mathcal {C}$ randomly chooses a bit $b\hookleftarrow \{0,1\}$ and provides $\mathcal {A}$ with a trapdoor $\textsf{Tr}^*\leftarrow \textsf{Trapdoor}(\textsf{pk}_{{\textsf{S}}^*},{\tilde{\omega }}^*_b,\textsf{sk}_{{\textsf{R}}^*})$ and returns it to $\mathcal {A}$.

• $\mathbf {Query\ Phase}\text {-}\textsf{II}$: Similar to $\mathbf {Query\ Phase}\text {-}\textsf{I}$ maintaining natural restrictions.

• $\textbf{Guess}$: $\mathcal {A}$ guesses a bit $b'$ and wins if $b = b'$.

Ciphertext Indistinguishability. Informally, ciphertext indistinguishability captures ciphertexts do not leak the keywords encoded. The formal security game is as follows.

• $\textbf{Setup}$: Given security parameter, the challenger $\mathcal {C}$ sends the public parameter $\textsf{pp}$, the challenge sender’s public key $(\textsf{pk}_{{\textsf{S}}^*})$ and the challenge receiver’s set public key $({{\mathcal {R}}^*} = \{\textsf{pk}_{{\textsf{R}}^*_1},\ldots ,\textsf{pk}_{{\textsf{R}}^*_\ell }\})$ to the adversary $\mathcal {A}$.

• $\mathbf {Query\ Phase}\text {-}\textsf{I}$:

  • Hash Queries: $\mathcal {C}$ responds to hash queries with random numbers.

  • Ciphertext Query: Given a keyword $\omega$, a receiver set’s public keys $\mathcal {R}= \{\textsf{pk}_{\textsf{R}_1},\ldots ,\textsf{pk}_{\textsf{R}_\ell }\}$, $\mathcal {C}$ computes a ciphertext w.r.t $\textsf{sk}_{{\textsf{S}}^*}$, $\omega$ and $\mathcal {R}$ and returns it to $\mathcal {A}$.

  • Trapdoor Query: Given a keyword $\tilde{\omega }$, a sender’s public key $\textsf{pk}_{\widetilde{\textsf{S}}}$, a chosen public key $\textsf{pk}_{\textsf{R}_i}\in \mathcal {R}$, it computes a trapdoor $\textsf{Tr}$ w.r.t. $\textsf{pk}_{\widetilde{\textsf{S}}}$, $\tilde{\omega }$ and $\textsf{sk}_{\textsf{R}_i}$, returns it to $\mathcal {A}$.

• $\textbf{Challenge}$: $\mathcal {A}$ chooses two keywords $({\omega }^*_0,{\omega }^*_1)$ such that $({\omega }^*_0,\textsf{pk}_{{\textsf{S}}^*})$ and $({\omega }^*_1,\textsf{pk}_{{\textsf{S}}^*})$ have not been queried for trapdoors and sends them to $\mathcal {C}$. $\mathcal {C}$ randomly chooses a bit $b\hookleftarrow \{0,1\}$ and provides $\mathcal {A}$ with a ciphertext $\textsf{Ct}^*\leftarrow \textsf{SrchEnc}(\textsf{sk}_{{\textsf{S}}^*},{\omega }^*_b,{{\mathcal {R}}^*})$ and returns it to $\mathcal {A}$.

• $\mathbf {Query\ Phase}\text {-}\textsf{II}$: Similar to $\mathbf {Query\ Phase}\text {-}\textsf{I}$ maintaining natural restrictions.

• $\textbf{Guess}$: The adversary guesses a bit $b'$ and wins if $b = b'$.

Anonymity. Informally, anonymity captures ciphertexts do not leak the receiver set encoded. The formal security game is as follows.

• $\textbf{Setup}$: Given security parameter, the challenger $\mathcal {C}$ sends the public parameter $\textsf{pp}$, the challenge sender’s public key $(\textsf{pk}_{{\textsf{S}}^*})$ and the challenge receiver’s set public key $({\mathcal {R}}^*_0 = \{\textsf{pk}_{{\textsf{R}}^*_0},\textsf{pk}_{{\textsf{R}}^*_2},\ldots ,\textsf{pk}_{{\textsf{R}}^*_\ell }\})$, $({\mathcal {R}}^*_1 = \{\textsf{pk}_{{\textsf{R}}^*_1},\textsf{pk}_{{\textsf{R}}^*_2},\ldots ,\textsf{pk}_{{\textsf{R}}^*_\ell }\})$ to the adversary $\mathcal {A}$.

• $\mathbf {Query\ Phase}\text {-}\textsf{I}$:

  • Hash Queries: $\mathcal {C}$ responds to hash queries with random numbers.

  • Ciphertext Query: Given a keyword $\omega$, a receiver set’s public keys $\mathcal {R}= \{\textsf{pk}_{\textsf{R}_1},\ldots ,\textsf{pk}_{\textsf{R}_\ell }\}$, $\mathcal {C}$ computes a ciphertext w.r.t $\textsf{sk}_{{\textsf{S}}^*}$, $\omega$ and $\mathcal {R}$ and returns it to $\mathcal {A}$.

  • Trapdoor Query: Given a keyword $\tilde{\omega }$, a sender’s public key $\textsf{pk}_{\widetilde{\textsf{S}}}$, a chosen public key from $\{\textsf{pk}_{\textsf{R}_0},\textsf{pk}_{\textsf{R}_1}\}$, it computes a trapdoor $\textsf{Tr}$ w.r.t. $\textsf{pk}_{\widetilde{\textsf{S}}}$, $\tilde{\omega }$ and $\textsf{pk}_{\textsf{R}_i}$ for $i\in \{0,1\}$, returns it to $\mathcal {A}$.

• $\textbf{Challenge}$: $\mathcal {A}$ chooses a keyword ${\omega }^*$ such that $({\omega }^*,\textsf{pk}_{{\textsf{S}}^*})$ has not been queried for trapdoors and sends them to $\mathcal {C}$. $\mathcal {C}$ randomly chooses a bit $b\hookleftarrow \{0,1\}$ and provides $\mathcal {A}$ with $\textsf{Ct}^*\leftarrow \textsf{SrchEnc}(\textsf{sk}_{{\textsf{S}}^*},{\omega }^*,{{\textsf{R}}^*_b})$ and returns it to $\mathcal {A}$.

• $\mathbf {Query\ Phase}\text {-}\textsf{II}$: Similar to $\mathbf {Query\ Phase}\text {-}\textsf{I}$ maintaining natural restrictions.

• $\textbf{Guess}$: The adversary guesses a bit $b'$ and wins if $b = b'$.

Trapdoor Anonymity. Informally, trapdoor anonymity captures trapdoors do not leak the receiver information encoded. The formal security game is as follows.

• $\textbf{Setup}$: Given security parameter, the challenger $\mathcal {C}$ sends the public parameter $\textsf{pp}$, the challenge sender’s public key $(\textsf{pk}_{{\textsf{S}}^*})$ and two challenge receiver’s public key $(\textsf{pk}_{{\textsf{R}}^*_0},\textsf{pk}_{{\textsf{R}}^*_1})$ to the adversary $\mathcal {A}$.

• $\mathbf {Query\ Phase}\text {-}\textsf{I}$:

  • Hash Queries: $\mathcal {C}$ responds to hash queries with random numbers.

  • Ciphertext Query: Given a keyword $\omega$, a receiver set’s public keys $\mathcal {R}= \{\textsf{pk}_{\textsf{R}_1},\ldots ,\textsf{pk}_{\textsf{R}_\ell }\}$, $\mathcal {C}$ computes a ciphertext w.r.t $\textsf{sk}_{{\textsf{S}}^*}$, $\omega$ and $\mathcal {R}$ and returns it to $\mathcal {A}$.

  • Trapdoor Query: Given a keyword $\tilde{\omega }$, a sender’s public key $\textsf{pk}_{\widetilde{\textsf{S}}}$, a chosen public key from $\{\textsf{pk}_{\textsf{R}_0},\textsf{pk}_{\textsf{R}_1}\}$, it computes a trapdoor $\textsf{Tr}$ w.r.t. $\textsf{pk}_{\widetilde{\textsf{S}}}$, $\tilde{\omega }$ and $\textsf{pk}_{\textsf{R}_i}$ for $i\in \{0,1\}$, returns it to $\mathcal {A}$.

• $\textbf{Challenge}$: $\mathcal {A}$ chooses a keyword ${\tilde{\omega }}^*$ such that $({\tilde{\omega }}^*_0,\textsf{pk}_{{\textsf{S}}^*})$ has not been queried for trapdoors and $({\tilde{\omega }}^*,\mathcal {R})$ has not been queried for ciphertexts where ${\textsf{R}}^*_0,{\textsf{R}}^*_1$ have different inclusion relationships with $\mathcal {R}$, and sends them to $\mathcal {C}$. $\mathcal {C}$ randomly chooses a bit $b\hookleftarrow \{0,1\}$ and provides $\mathcal {A}$ with a trapdoor $\textsf{Tr}^*\leftarrow \textsf{Trapdoor}(\textsf{pk}_{{\textsf{S}}^*},{\tilde{\omega }}^*,\textsf{sk}_{{\textsf{R}}^*_b})$ and returns it to $\mathcal {A}$.

• $\mathbf {Query\ Phase}\text {-}\textsf{II}$: Similar to $\mathbf {Query\ Phase}\text {-}\textsf{I}$ maintaining natural restrictions.

• $\textbf{Guess}$: $\mathcal {A}$ guesses a bit $b'$ and wins if $b = b'$.