Skip to main content
SpringerLink
Log in

Identity-based encryption with hierarchical key-insulation in the standard model

  • Published:
Designs, Codes and Cryptography Aims and scope Submit manuscript

Abstract

A key exposure problem is unavoidable since it seems human error can never be eliminated completely, and key-insulated encryption is one of the cryptographic solutions to the problem. At Asiacrypt’05, Hanaoka et al. introduced hierarchical key-insulation functionality, which is attractive functionality that enhances key exposure resistance, and proposed an identity-based hierarchical key-insulated encryption (hierarchical IKE) scheme in the random oracle model. In this paper, we first propose the hierarchical IKE scheme in the standard model (i.e., without random oracles). Our hierarchical IKE scheme is secure under the symmetric external Diffie–Hellman (\(\mathsf{SXDH}\)) assumption, which is a static assumption. Particularly, in the non-hierarchical case, our construction is the first IKE scheme that achieves constant-size parameters including public parameters, secret keys, and ciphertexts. Furthermore, we also propose the first public-key-based key-insulated encryption (PK-KIE) in the hierarchical setting by using our technique.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3

Similar content being viewed by others

Notes

  1. This fact was also mentioned in [20].

  2. This means that initial helper keys \(hk^{(\ell -1)}_{\texttt {I},0},\ldots ,hk^{(2)}_{\texttt {I},0},hk^{(1)}_{\texttt {I},0}\) must be updated by \(hk^{(\ell )}_{\texttt {I},0}\) first and foremost since \(0\notin \mathcal {T}_i\) for every \(i\in \{0,1,\ldots ,\ell -1\}\).

  3. In the case \(i=\ell \), \(R_i^{(y)}\) and \(R_i^{(x)}\) mean empty strings, namely we have \(hk^{(\ell )}_{\texttt {I},0}:=(D_{y},D'_{y},\)\(D_{x},D'_{x},D, \{(K^{(y)}_{j},K^{(x)}_{j})\}_{j=0}^{\ell -1})\).

  4. In the case \(i=1\), \(\{(\hat{k}^{(y)}_{j},\hat{k}^{(x)}_{j})\}_{j=0}^{\ell -1}\) means an empty string, namely we have \(\delta ^{(0)}_{\texttt {I},t_{0}}:=(\hat{d}_{y},\)\( \hat{d}'_{y}, \hat{d}_{x}, \hat{d}'_{x}, \hat{d})\).

  5. The formal definitions of the \(\mathsf{CBDH}\) and \(\mathsf{DBDH}\) assumptions are given in Appendix A.

  6. The formal description of the OTS is given in Appendix A.

  7. This means that initial helper keys \(hk^{(\ell -1)}_{0},\ldots ,hk^{(2)}_{0},hk^{(1)}_{0}\) must be updated by \(hk^{(\ell )}_{0}\) first and foremost since \(0\notin \mathcal {T}_i\) for every \(i\in \{0,1,\ldots ,\ell -1\}\).

  8. In the case \(i=\ell \), \(R_{\ell }\), \(D_{y}\), \(D_{x}\), D, and \(\{(K^{(y)}_{j},K^{(x)}_{j})\}_{j=0}^{i-1}\) mean empty strings, and we consider these as identity elements in \(\mathbb {G}_2\) when these elements are used in operations.

  9. In the case \(i=1\), \(\{(\hat{k}^{(y)}_{j},\hat{k}^{(x)}_{j})\}_{j=0}^{\ell -1}\) means an empty string, namely we have \(\delta ^{(0)}_{t_{0}}:=(\hat{d}_{y}, \ldots , \hat{d}_5, \hat{k}_{vk},\hat{k}'_{vk})\).

References

  1. Bellare M., Miner S.: A forward-secure digital signature scheme. In: Wiener M. (ed.) Advances in Cryptology—CRYPTO’99. Lecture Notes in Computer Science, vol. 1666, pp. 431–448. Springer, Berlin (1999).

  2. Bellare M., Palacio A.: Protecting against key-exposure: strongly key-insulated encryption with optimal threshold. Appl. Algebr. Eng. Commun. Comput. 16(6), 379–396 (2006).

    Article  MathSciNet  MATH  Google Scholar 

  3. Bethencourt J., Sahai A., Waters B.: Ciphertext-policy attribute-based encryption. In: IEEE Symposium on Security and Privacy, S&P’07, pp. 321–334 (2007)

  4. Blakley G.: Safeguarding cryptographic keys. In: Proceedings of the 1979 AFIPS National Computer Conference, pp. 313–317. AFIPS Press, Monval, NJ (1979)

  5. Boneh D., Canetti R., Halevi S., Katz J.: Chosen ciphertext security from identity based encryption. SIAM J. Comput. 36(5), 1301–1328 (2007).

    Article  MathSciNet  MATH  Google Scholar 

  6. Boneh D., Sahai A., Waters B.: Functional encryption: definitions and challenges. In: Ishai Y. (ed.) Theory of Cryptography. Lecture Notes in Computer Science, vol. 6597, pp. 253–273. Springer, Berlin (2011).

    Google Scholar 

  7. Canetti R., Halevi S., Katz J.: A forward-secure public-key encryption scheme. In: Biham E. (ed.) Advances in Cryptology—EUROCRYPT 2003. Lecture Notes in Computer Science, vol. 2656, pp. 255–271. Springer, Berlin (2003).

    Google Scholar 

  8. Canetti R., Halevi S., Katz J.: Chosen-ciphertext security from identity-based encryption. In: Cachin C., Camenisch J. (eds.) Advances in Cryptology—EUROCRYPT 2004, vol. 3027, pp. 207–222. Springer, Berlin (2004).

    Chapter  Google Scholar 

  9. Chatterjee S., Menezes A.: On cryptographic protocols employing asymmetric pairings—the role of \({\varPsi }\) revisited. Discret. Appl. Math. 159(13), 1311–1322 (2011).

    Article  MathSciNet  MATH  Google Scholar 

  10. Chen J., Gong J.: ABE with tag made easy: Concise framework and new instantiations in prime-order groups. In: Advances in Cryptology—ASIACRYPT 2017. Springer, Berlin (2017)

  11. Cheon J., Hopper N., Kim Y., Osipkov I.: Timed-release and key-insulated public key encryption. In: Crescenzo G., Rubin A. (eds.) Financial Cryptography and Data Security, vol. 4107, pp. 191–205. Springer, Berlin (2006).

    Chapter  Google Scholar 

  12. Dodis Y., Katz J., Xu S., Yung M.: Key-insulated public key cryptosystems. In: Knudsen L. (ed.) Advances in Cryptology—EUROCRYPT 2002, vol. 2332, pp. 65–82. Springer, Berlin (2002).

    Chapter  Google Scholar 

  13. Dodis Y., Katz J., Xu S., Yung M.: Strong key-insulated signature schemes. In: Desmedt Y. (ed.) Public Key Cryptography—PKC 2003. Lecture Notes in Computer Science, vol. 2567, pp. 130–144. Springer, Berlin (2002).

    Chapter  Google Scholar 

  14. Dodis Y., Franklin M., Katz J., Miyaji A., Yung M.: Intrusion-resilient public-key encryption. In: Joye M. (ed.) Topics in Cryptology—CT-RSA 2003. Lecture Notes in Computer Science, vol. 2612, pp. 19–32. Springer, Berlin (2003).

    Chapter  Google Scholar 

  15. Dodis Y., Franklin M., Katz J., Miyaji A., Yung M.: A generic construction for intrusion-resilient public-key encryption. In: Okamoto T. (ed.) Topics in Cryptology—CT-RSA 2004. Lecture Notes in Computer Science, vol. 2964, pp. 81–98. Springer, Berlin (2004).

    Chapter  Google Scholar 

  16. Dodis Y., Luo W., Xu S., Yung M.: Key-insulated symmetric key cryptography and mitigating attacks against cryptographic cloud software. In: Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security, ASIACCS ’12, pp. 57–58. ACM, New York (2012).

  17. Galbraith S.D., Paterson K.G., Smart N.P.: Pairings for cryptographers. Discret. Appl. Math. 156(16), 3113–3121 (2008).

    Article  MathSciNet  MATH  Google Scholar 

  18. Gentry C., Silverberg A.: Hierarchical ID-based cryptography. In: Zheng Y. (ed.) Advances in Cryptology—ASIACRYPT 2002. Lecture Notes in Computer Science, vol. 2501, pp. 548–566. Springer, Berlin (2002).

    Google Scholar 

  19. Hanaoka G., Weng J.: Generic constructions of parallel key-insulated encryption. In: Garay J., De Prisco R. (eds.) Security and Cryptography for Networks, vol. 6280, pp. 36–53. Springer, Berlin (2010).

    Chapter  Google Scholar 

  20. Hanaoka Y., Hanaoka G., Shikata J., Imai H.: Identity-based hierarchical strongly key-insulated encryption and its application. In: Roy B. (ed.) Advances in Cryptology—ASIACRYPT 2005. Lecture Notes in Computer Science, vol. 3788, pp. 495–514. Springer, Berlin (2005).

    Google Scholar 

  21. Hanaoka G., Hanaoka Y., Imai H.: Parallel key-insulated public key encryption. In: Yung M., Dodis Y., Kiayias A., Malkin T. (eds.) Public Key Cryptography—PKC 2006. Lecture Notes in Computer Science, vol. 3958, pp. 105–122. Springer, Berlin (2006).

    Chapter  Google Scholar 

  22. Itkis G., Reyzin L.: SiBIR: Signer-base intrusion-resilient signatures. In: Yung M. (ed.) Advances in Cryptology—CRYPTO 2002. Lecture Notes in Computer Science, vol. 2442, pp. 499–514. Springer, Berlin (2002).

    Chapter  Google Scholar 

  23. Jutla C., Roy A.: Shorter quasi-adaptive NIZK proofs for linear subspaces. In: Sako K., Sarkar P. (eds.) Advances in Cryptology—ASIACRYPT 2013. Lecture Notes in Computer Science, vol. 8269, pp. 1–20. Springer, Berlin (2013).

    Google Scholar 

  24. Libert B., Quisquater J.J., Yung M.: Parallel key-insulated public key encryption without random oracles. In: Okamoto T., Wang X. (eds.) Public Key Cryptography—PKC 2007. Lecture Notes in Computer Science, vol. 4450, pp. 298–314. Springer, Berlin (2007).

    Chapter  Google Scholar 

  25. Matsuda T., Nakai Y., Matsuura K.: Efficient generic constructions of timed-release encryption with pre-open capability. In: Joye M., Miyaji A., Otsuka A. (eds.) Pairing-Based Cryptography—Pairing 2010, vol. 6487, pp. 225–245. Springer, Berlin (2010).

    Chapter  Google Scholar 

  26. Ramanna S., Sarkar P.: Efficient (anonymous) compact HIBE from standard assumptions. In: Chow S., Liu J., Hui L., Yiu S. (eds.) Provable Security. Lecture Notes in Computer Science, vol. 8782, pp. 243–258. Springer, Berlin (2014).

    Google Scholar 

  27. Ramanna S., Chatterjee S., Sarkar P.: Variants of Waters’ dual system primitives using asymmetric pairings. In: Fischlin M., Buchmann J., Manulis M. (eds.) Public Key Cryptography—PKC 2012. Lecture Notes in Computer Science, vol. 7293, pp. 298–315. Springer, Berlin (2012).

    Chapter  Google Scholar 

  28. Sahai A., Waters B.: Fuzzy identity-based encryption. In: Cramer R. (ed.) Advances in Cryptology—EUROCRYPT 2005. Lecture Notes in Computer Science, vol. 3494, pp. 457–473. Springer, Berlin (2005).

    Google Scholar 

  29. Shamir A.: How to share a secret. Commun. ACM 22(11), 612–613 (1979).

    Article  MathSciNet  MATH  Google Scholar 

  30. Watanabe Y., Shikata J.: Identity-based hierarchical key-insulated encryption without random oracles. In: Cheng C.M., Chung K.M., Persiano G., Yang B.Y. (eds.) Public-Key Cryptography—PKC 2016, Part I. Lecture Notes in Computer Science, vol. 9614, pp. 255–279. Springer, Berlin (2016).

    Chapter  Google Scholar 

  31. Watanabe Y., Emura K., Seo J.H.: New revocable IBE in prime-order groups: adaptively secure, decryption key exposure resistant, and with short public parameters. In: Handschuh H. (ed.) Topics in Cryptology—CT-RSA 2017, vol. 10159, pp. 432–449. Springer, Berlin (2017).

    Chapter  Google Scholar 

  32. Waters B.: Efficient identity-based encryption without random oracles. In: Cramer R. (ed.) Advances in Cryptology—EUROCRYPT 2005, vol. 3494, pp. 114–127. Springer, Berlin (2005).

    Chapter  Google Scholar 

  33. Waters B.: Dual system encryption: realizing fully secure IBE and HIBE under simple assumptions. In: Halevi S. (ed.) Advances in Cryptology—CRYPTO 2009, vol. 5677, pp. 619–636. Springer, Berlin (2009).

    Chapter  Google Scholar 

  34. Weng J., Liu S., Chen K., Ma C.: Identity-based parallel key-insulated encryption without random oracles: security notions and construction. In: Barua R., Lange T. (eds.) Progress in Cryptology—INDOCRYPT 2006, vol. 4329, pp. 409–423. Springer, Berlin (2006).

    Chapter  Google Scholar 

  35. Weng J., Liu S., Chen K., Zheng D., Qiu W.: Identity-based threshold key-insulated encryption without random oracles. In: Malkin T. (ed.) Topics in Cryptology—CT-RSA 2008, vol. 4964, pp. 203–220. Springer, Berlin (2008).

    Chapter  Google Scholar 

Download references

Acknowledgements

We would like to thank anonymous referees for their helpful comments. The first author was in part supported by JSPS KAKENHI Grant Number JP15H02710, and in part conducted under the auspices of the MEXT Program for Promoting the Reform of National Universities. The second author is supported by JSPS Research Fellowships for Young Scientists, and was supported by Grant-in-Aid for JSPS Fellows Grant Numbers JP13J03998 and JP16J10532, and Grant-in-Aid for Young Scientists JP17K12697.

Author information

Authors and Affiliations

  1. Graduate School of Environment and Information Sciences, Yokohama National University, 79-7 Tokiwadai, Hodogaya-ku, Yokohama, 240-8501, Japan

    Junji Shikata

  2. Institute of Advanced Sciences, Yokohama National University, 79-7 Tokiwadai, Hodogaya-ku, Yokohama, 240-8501, Japan

    Junji Shikata

  3. Graduate School of Informatics and Engineering, The University of Electro-Communications, 1-5-1 Chofugaoka, Chofu, Japan

    Yohei Watanabe

  4. Information Technology Research Institute (ITRI), National Institute of Advanced Industrial Science and Technology (AIST), 2-4-7 Aomi, Koto-ku, Tokyo, Japan

    Yohei Watanabe

Authors
  1. Junji Shikata
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Yohei Watanabe
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Yohei Watanabe.

Additional information

Communicated by C. Blundo.

Preliminary version appeared in PKC 2016 [30].

Appendix A: Omitted descriptions

Appendix A: Omitted descriptions

Bilinear Group A bilinear group generator \(\mathcal {G}\) is an algorithm that takes a security parameter \(\lambda \) as input and outputs a bilinear group \((p, \mathbb {G}_1, \mathbb {G}_2, \mathbb {G}_T, g_1, \)\(g_2, e)\), where p is a prime, \(\mathbb {G}_1\), \(\mathbb {G}_2\), and \(\mathbb {G}_T\) are multiplicative cyclic groups of order p, \(g_1\) and \(g_2\) are (random) generators of \(\mathbb {G}_1\) and \(\mathbb {G}_2\), respectively, and e is an efficiently computable and non-degenerate bilinear map \(e: \mathbb {G}_1 \times \mathbb {G}_2 \rightarrow \mathbb {G}_T\) with the following bilinear property: For any \(u, u'\in \mathbb {G}_1\) and \(v, v' \in \mathbb {G}_2\), \(e(uu',v)=e(u,v)e(u',v)\) and \(e(u,vv')=e(u,v)e(u,v')\).

A bilinear map e is called symmetric or a “Type-1” pairing if \(\mathbb {G}_1=\mathbb {G}_2\). Otherwise, it is called asymmetric. In the asymmetric setting, e is called a “Type-2” pairing if there is an efficiently computable isomorphism either from \(\mathbb {G}_1\) to \(\mathbb {G}_2\) or from \(\mathbb {G}_2\) to \(\mathbb {G}_1\). If no efficiently computable isomorphisms are known, then it is called a “Type-3” pairing. In this paper, we focus on the Type-3 pairing, which is the most efficient setting in terms of group sizes (of \(\mathbb {G}_1\)) and operations. For details, see [9, 17].

We next give formal definitions the \(\mathsf{CBDH}\) and \(\mathsf{DBDH}\) assumptions as follows. In the following, we assume the Type-1 pairing (i.e., \(\mathbb {G}:=\mathbb {G}_1=\mathbb {G}_2\)).

Computational Bilinear Diffie–Hellman (\(\mathsf{CBDH}\)) Assumption Let \(\mathcal {A}\) be a PPT adversary and we consider \(\mathcal {A}\)’s advantage against the \(\mathsf{CBDH}\) problem as follows.

Definition 6

The \(\mathsf{CBDH}\) assumption relative to a generator \(\mathcal {G}\) holds if for all PPT adversaries \(\mathcal {A}\), \(Adv^{\mathsf{CBDH}}_{\mathcal {G},\mathcal {A}}(\lambda )\) is negligible in \(\lambda \).

Decisional Bilinear Diffie–Hellman (\(\mathsf{DBDH}\)) Assumption Let \(\mathcal {A}\) be a PPT adversary and we consider \(\mathcal {A}\)’s advantage against the \(\mathsf{DBDH}\) problem as follows.

Definition 7

The \(\mathsf{DBDH}\) assumption relative to a generator \(\mathcal {G}\) holds if for all PPT adversaries \(\mathcal {A}\), \(Adv^{\mathsf{DBDH}}_{\mathcal {G},\mathcal {A}}(\lambda )\) is negligible in \(\lambda \).

Finally, we describe the definition of OTS as follows.

One-time signature An OTS scheme \(\varPi _{\textsc {ots}}\) consists of three-tuple algorithms (KGen, Sign, Ver) defined as follows.

  • \((vk,sk)\leftarrow \textsf {KGen}(\lambda )\): It takes a security parameter \(\lambda \) and outputs a pair of a public key and a secret key (vk, sk).

  • \(\sigma \leftarrow \textsf {Sign}(sk,m)\): It takes the secret key sk and a message \(m\in \mathcal {M}\) and outputs a signature \(\sigma \).

  • 1 or \(0\leftarrow \textsf {Ver}(vk,m,\sigma )\): It takes the public key vk and a pair of a message and a signature \((m,\sigma )\), and then outputs 1 or 0.

We assume that \(\varPi _{\textsc {ots}}\) meets the following correctness property: For all security parameters \(\lambda \in \mathbb {N}\), all \((vk,sk)\leftarrow \textsf {KGen}(\lambda )\), and all \(m\in \mathcal {M}\), it holds that \(1\leftarrow \textsf {Ver}(vk,(m,\textsf {Sign}(sk,m)))\).

We describe the notion of strong unforgeability against one-time attack (\(\mathsf{sUF}\text {-}\mathsf{OT}\)). Let \(\mathcal {A}\) be a PPT adversary, and \(\mathcal {A}\)’s advantage against \(\mathsf{sUF}\text {-}\mathsf{OT}\) security is defined by

\(\textit{Sign}(\cdot )\) is a signing oracle which takes a message m as input, and then returns \(\sigma \) by running \(\textsf {Sign}(sk,m)\). \(\mathcal {A}\) is allowed to access to the above oracle only once.

Definition 8

An OTS scheme \(\varPi _{\textsc {ots}}\) is said to be \(\mathsf{sUF}\text {-}\mathsf{OT}\) secure if for all PPT adversaries \(\mathcal {A}\), \(Adv^{\mathsf{sUF}\text {-}\mathsf{OT}}_{\varPi _{\textsc {ots}},\mathcal {A}}(\lambda )\) is negligible in \(\lambda \).

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Shikata, J., Watanabe, Y. Identity-based encryption with hierarchical key-insulation in the standard model. Des. Codes Cryptogr. 87, 1005–1033 (2019). https://doi.org/10.1007/s10623-018-0503-4

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10623-018-0503-4

Keywords

Mathematics Subject Classification

Search

Navigation