Skip to main content
Log in

Adaptively secure revocable hierarchical IBE from k-linear assumption

  • Published:
Designs, Codes and Cryptography Aims and scope Submit manuscript

Abstract

Revocable identity-based encryption (RIBE) is an extension of IBE with an efficient key revocation mechanism. Revocable hierarchical IBE (RHIBE) is its further extension with key delegation functionality. Although there are various adaptively secure pairing-based RIBE schemes, all known hierarchical analogues only satisfy selective security. In addition, the currently known most efficient adaptively secure RIBE and selectively secure RHIBE schemes rely on non-standard assumptions, which are referred to as the augmented DDH assumption and q-type assumptions, respectively. In this paper, we propose a simple but effective design methodology for RHIBE schemes. We provide a generic design framework for RHIBE based on an HIBE scheme with a few properties. Fortunately, several state-of-the-art pairing-based HIBE schemes have the properties. In addition, our construction preserves the sizes of master public keys, ciphertexts, and decryption keys, as well as the complexity assumptions of the underlying HIBE scheme. Thus, we obtain the first RHIBE schemes with adaptive security under the standard k-linear assumption. We prove adaptive security by developing a new proof technique for RHIBE. Due to the compactness-preserving construction, the proposed R(H)IBE schemes have similar efficiencies to the most efficient existing schemes.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Fig. 1
Fig. 2
Fig. 3

Similar content being viewed by others

Notes

  1. To be precise, these works are prior to Katsumata et al. [24]; thus, they do not consider the stronger DKER.

  2. Note that we consider insider security as the minimum requirement. The definition and necessity of insider security is discussed in Sect. 1.3.

  3. Although the security of Seo and Emura’s original scheme is based on the q-weak bilinear Diffie-Hellman inversion assumption, that of the modified scheme is based on the q-bilinear Diffie-Hellman exponent assumption [45].

  4. Recall that the difference between the weaker and the stronger DKER only appears in the hierarchical setting. Thus, the approach proposed by Watanabe et al. does not provide a pathway to achieve the stronger DKER.

  5. In other words, each parent user \(\textsf {pa}(\mathtt {ID})\) updates \(\textsf {delk}_{\textsf {pa}(\mathtt {ID})} = ( \textsf {delk}_{\textsf {pa}(\mathtt {ID}), \theta } )_{\theta \in \mathcal {AN}_{\textsf {pa}(\mathtt {ID})}}\) by adding \(\textsf {delk}_{\textsf {pa}(\mathtt {ID}), \theta '}\) when they create \(\textsf {sk}_{\mathtt {ID}, \theta '}\) and/or \(\textsf {ku}_{\textsf {pa}(\mathtt {ID}), \mathtt {T}, \theta '}\) for \(\theta ' \notin \mathcal {AN}_{\textsf {pa}(\mathtt {ID})}. \) This procedure also updates \(\mathcal {AN}_{\textsf {pa}(\mathtt {ID})} \leftarrow \mathcal {AN}_{\textsf {pa}(\mathtt {ID})} \cup \{\theta '\}\).

  6. Note that there may be an adversary that does not receive \(\textsf {sk}_\mathtt {ID}\) for any \(\mathtt {ID}\in \textsf {prefix}^+(\mathtt {ID}^\star )\). Here, we ignore such adversaries and assume that an adversary always receives \(\textsf {sk}_\mathtt {ID}\) for some \(\mathtt {ID}\in \textsf {prefix}^+(\mathtt {ID}^\star )\).

  7. Otherwise, the adversary can create \(\textsf {dk}_{\mathtt {ID}^\star ,\mathtt {T}^\star }\) from \(\textsf {ku}_{\textsf {pa}(\mathtt {ID}^\star _{[\ell ]}), \mathtt {T}^\star , \theta }\) and \(\textsf {sk}_{\mathtt {ID}^\star _{[\ell ]}, \theta }\). Note that, according to the definition of \(\ell ^\star \), the adversary can receive \(\textsf {ku}_{\textsf {pa}(\mathtt {ID}^\star _{[ \ell ]}), \mathtt {T}^\star , \theta }\) even if it shares the same \(\theta \) with \(\textsf {sk}_{\mathtt {ID}^\star _{[\ell ]}, \theta }\) for \(\ell \in [\ell ^\star - 1]\) because the adversary does not know the secret keys.

  8. Note that the original \(\mathsf {JR}\) IBE, which is secure under the SXDH assumption, is not compatible with the reduction. Here, Watanabe et al. had to modify the scheme and rely on the non-standard variant of the DDH assumption.

  9. Note that we can avoid this issue by guessing \(\mathtt {T}^\star \) with reduction loss \(|\mathcal {T}|\) as the proofs of the above adaptively secure RIBE. However, our construction does not require the guess; thus, it avoids this issue. That is why the proposed RIBE scheme achieves tighter reduction than the \(\mathsf {WES}\) RIBE [52] and its variant [19], as shown in Table 2.

  10. If \(|\mathtt {ID}'| = L\), this step is skipped.

  11. Here, \(\textsf {sk}_{\mathtt {ID}}\) is the latest secret key, i.e., the result of Step (2).

  12. This check ensures that previously revoked identities remain revoked in the next time period.

  13. This is the condition of the stronger DKER. The condition of the weaker DKER is replaced by \((\mathtt {ID}, \mathtt {T}) \ne (\mathtt {ID}', \mathtt {T}^\star )\) for all \(\mathtt {ID}' \in \textsf {prefix}^+(\mathtt {ID}^\star )\).

  14. In this sense, our notion is more closely related to wicked IBE rather than wildcarded IBE because wildcards are associated with a ciphertext/secret key in wildcarded/wicked IBE. Nonetheless, we use “wildcarded” to express this intuitive property.

  15. Shacham define an HIBE secret key \(\textsf {H}.\textsf {sk}_\mathtt {ID}\) with limited delegation such that it can derive a secret key \(\textsf {H}.\textsf {sk}_{\mathtt {ID}'}\) of a suffix identity \(\mathtt {ID}'\) only when \(|\mathtt {ID}'|\) is less than or equal to limited bound \(|\mathtt {ID}'| = L' < L\).

  16. To be precise, we use Chen-Gay-Wee’s instantiation of a dual system group [12] as Chen-Wee’s HIBE scheme. In addition, the scheme proposed by Gong et al. satisfies prefix decryption restriction only if \(n \ge 2\), where n is a predetermined parameter to manage the efficiency trade-off in their scheme, and we note that this flexible parameter n is crucial. It is difficult to prove that other unbounded HIBE schemes [31, 33] have the prefix decryption restriction because they do not have such a parameter.

  17. The guess is not required to prove selective security: thus, the reduction loss differs by a factor O(Q).

References

  1. Abdalla M., Birkett J., Catalano D., Dent A.W., Malone-Lee J., Neven G., Schuldt J.C.N., Smart N.P.: Wildcarded identity-based encryption. J. Cryptol 24(1), 42–82 (2011).

    Article  MathSciNet  Google Scholar 

  2. Abdalla M., Kiltz E., Neven G.: Generalized key delegation for hierarchical identity-based encryption. In: J. Biskup, J. López (eds.) Computer Security - ESORICS 2007, 12th European Symposium On Research In Computer Security, Proceedings, Lecture Notes in Computer Science, vol. 4734, pp. 139–154. Springer (2007).

  3. Agrawal S., Boneh D., Boyen X.: Efficient lattice (H)IBE in the standard model. In: H. Gilbert (ed.) Advances in Cryptology - EUROCRYPT 2010, 29th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Lecture Notes in Computer Science, vol. 6110, pp. 553–572. Springer (2010).

  4. Agrawal S., Boneh D., Boyen X.: Lattice basis delegation in fixed dimension and shorter-ciphertext hierarchical IBE. In: T. Rabin (ed.) Advances in Cryptology - CRYPTO 2010, 30th Annual Cryptology Conference, Lecture Notes in Computer Science, vol. 6223, pp. 98–115. Springer (2010).

  5. Blazy O., Kiltz E., Pan J.: (hierarchical) identity-based encryption from affine message authentication. In: J.A. Garay, R. Gennaro (eds.) Advances in Cryptology - CRYPTO 2014 - 34th Annual Cryptology Conference, Proceedings, Part I, Lecture Notes in Computer Science, vol. 8616, pp. 408–425. Springer (2014).

  6. Boldyreva A., Goyal V., Kumar V.: Identity-based encryption with efficient revocation. In: P. Ning, P.F. Syverson, S. Jha (eds.) Proceedings of the 2008 ACM Conference on Computer and Communications Security, CCS 2008, pp. 417–426. ACM (2008).

  7. Boneh D., Boyen X.: Efficient selective-id secure identity-based encryption without random oracles. In: C. Cachin, J. Camenisch (eds.) Advances in Cryptology - EUROCRYPT 2004, International Conference on the Theory and Applications of Cryptographic Techniques, Proceedings, Lecture Notes in Computer Science, vol. 3027, pp. 223–238. Springer (2004).

  8. Boneh D., Boyen X., Goh E.: Hierarchical identity based encryption with constant size ciphertext. In: R. Cramer (ed.) Advances in Cryptology - EUROCRYPT 2005, 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Lecture Notes in Computer Science, vol. 3494, pp. 440–456. Springer (2005).

  9. Boneh D., Franklin M.K.: Identity-based encryption from the weil pairing. In: J. Kilian (ed.) Advances in Cryptology - CRYPTO 2001, 21st Annual International Cryptology Conference, Proceedings, Lecture Notes in Computer Science, vol. 2139, pp. 213–229. Springer (2001).

  10. Cash D., Hofheinz D., Kiltz E., Peikert C.: Bonsai trees, or how to delegate a lattice basis. J. Cryptol. 25(4), 601–639 (2012).

    Article  MathSciNet  Google Scholar 

  11. Chang D., Chauhan A.K., Kumar S., Sanadhya S.K.: Revocable identity-based encryption from codes with rank metric. In: N.P. Smart (ed.) Topics in Cryptology - CT-RSA 2018 - The Cryptographers’ Track at the RSA Conference 2018, Lecture Notes in Computer Science, vol. 10808, pp. 435–451. Springer (2018).

  12. Chen J., Gay R., Wee H.: Improved dual system ABE in prime-order groups via predicate encodings. In: E. Oswald, M. Fischlin (eds.) Advances in Cryptology - EUROCRYPT 2015 - 34th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Lecture Notes in Computer Science, vol. 9057, pp. 595–624. Springer (2015).

  13. Chen J., Gong J.: ABE with tag made easy - concise framework and new instantiations in prime-order groups. In: T. Takagi, T. Peyrin (eds.) Advances in Cryptology - ASIACRYPT 2017 - 23rd International Conference on the Theory and Applications of Cryptology and Information Security. Proceedings, Part II, Lecture Notes in Computer Science, vol. 10625, pp. 35–65. Springer (2017).

  14. Chen J., Lim H.W., Ling S., Wang H., Nguyen, K.: Revocable identity-based encryption from lattices. In: W. Susilo, Y. Mu, J. Seberry (eds.) Information Security and Privacy - 17th Australasian Conference, ACISP 2012, Lecture Notes in Computer Science, vol. 7372, pp. 390–403. Springer (2012).

  15. Chen J., Wee H.: Dual system groups and its applications—compact HIBE and more. IACR Cryptol. ePrint Archive 2014, 265 (2014).

    Google Scholar 

  16. Döttling N., Garg S.: From selective IBE to full IBE and selective HIBE. In: Y. Kalai, L. Reyzin (eds.) Theory of Cryptography—15th International Conference, TCC 2017, Lecture Notes in Computer Science, vol. 10677, pp. 372–408. Springer (2017).

  17. Emura K., Seo J.H., Youn T.: Semi-generic transformation of revocable hierarchical identity-based encryption and its DBDH instantiation. IEICE Trans. 99-A(1), 83–91 (2016).

  18. Escala A., Herold G., Kiltz E., Ràfols C., Villar J.L.: An algebraic framework for Diffie-Hellman assumptions. J. Cryptol. 30(1), 242–288 (2017).

    Article  MathSciNet  Google Scholar 

  19. Ge A., Wei P.: Identity-based broadcast encryption with efficient revocation. In: D. Lin, K. Sako (eds.) Public-Key Cryptography—PKC 2019 - 22nd IACR International Conference on Practice and Theory of Public-Key Cryptography, Proceedings, Part I, Lecture Notes in Computer Science, vol. 11442, pp. 405–435. Springer (2019).

  20. Gong J., Cao Z., Tang S., Chen J.: Extended dual system group and shorter unbounded hierarchical identity based encryption. Des. Codes Cryptogr. 80(3), 525–559 (2016).

    Article  MathSciNet  Google Scholar 

  21. Hu Z., Liu S., Chen K., Liu J.K.: Revocable identity-based encryption from the computational Diffie-Hellman problem. In: W. Susilo, G. Yang (eds.) Information Security and Privacy - 23rd Australasian Conference, ACISP 2018, Proceedings, Lecture Notes in Computer Science, vol. 10946, pp. 265–283. Springer (2018).

  22. Ishida Y., Shikata J., Watanabe Y.: CCA-secure revocable identity-based encryption schemes with decryption key exposure resistance. IJACT 3(3), 288–311 (2017).

    Article  MathSciNet  Google Scholar 

  23. Jutla C.S., Roy A.: Shorter quasi-adaptive NIZK proofs for linear subspaces. J. Cryptol. 30(4), 1116–1156 (2017).

    Article  MathSciNet  Google Scholar 

  24. Katsumata S., Matsuda T., Takayasu A.: Lattice-based revocable (hierarchical) IBE with decryption key exposure resistance. In: D. Lin, K. Sako (eds.) Public-Key Cryptography—PKC 2019—22nd IACR International Conference on Practice and Theory of Public-Key Cryptography, Proceedings, Part II, Lecture Notes in Computer Science, vol. 11443, pp. 441–471. Springer (2019).

  25. Langrehr R., Pan J.: Tightly secure hierarchical identity-based encryption. In: D. Lin, K. Sako (eds.) Public-Key Cryptography - PKC 2019 - 22nd IACR International Conference on Practice and Theory of Public-Key Cryptography, Proceedings, Part I, Lecture Notes in Computer Science, vol. 11442, pp. 436–465. Springer (2019).

  26. Langrehr R., Pan J.: Hierarchical identity-based encryption with tight multi-challenge security. In: A. Kiayias, M. Kohlweiss, P. Wallden, V. Zikas (eds.) Public-Key Cryptography - PKC 2020 - 23rd IACR International Conference on Practice and Theory of Public-Key Cryptography, Proceedings, Part I, Lecture Notes in Computer Science, vol. 12110, pp. 153–183. Springer (2020).

  27. Lee K.: Revocable hierarchical identity-based encryption with adaptive security. IACR Cryptol. ePrint Arch. 2016, 749 (2016).

    Google Scholar 

  28. Lee K.: A generic construction for revocable identity-based encryption with subset difference methods. IACR Cryptol. ePrint Arch. 2019, 798 (2019).

    Google Scholar 

  29. Lee K., Lee D.H., Park J.H.: Efficient revocable identity-based encryption via subset difference methods. Des. Codes Cryptogr. 85(1), 39–76 (2017).

    Article  MathSciNet  Google Scholar 

  30. Lee K., Park S.: Revocable hierarchical identity-based encryption with shorter private keys and update keys. Des. Codes Cryptogr. 86(10), 2407–2440 (2018).

    Article  MathSciNet  Google Scholar 

  31. Lewko A.B.: Tools for simulating features of composite order bilinear groups in the prime order setting. In: D. Pointcheval, T. Johansson (eds.) Advances in Cryptology - EUROCRYPT 2012 - 31st Annual International Conference on the Theory and Applications of Cryptographic Techniques. Proceedings, Lecture Notes in Computer Science, vol. 7237, pp. 318–335. Springer (2012).

  32. Lewko A.B., Waters B.: New techniques for dual system encryption and fully secure HIBE with short ciphertexts. In: D. Micciancio (ed.) Theory of Cryptography, 7th Theory of Cryptography Conference, TCC 2010, Lecture Notes in Computer Science, vol. 5978, pp. 455–479. Springer (2010).

  33. Lewko A.B., Waters B.: Unbounded HIBE and attribute-based encryption. In: K.G. Paterson (ed.) Advances in Cryptology—EUROCRYPT 2011—30th Annual International Conference on the Theory and Applications of Cryptographic Techniques. Proceedings, Lecture Notes in Computer Science, vol. 6632, pp. 547–567. Springer (2011).

  34. Libert B., Vergnaud D.: Adaptive-ID secure revocable identity-based encryption. In: M. Fischlin (ed.) Topics in Cryptology—CT-RSA 2009, The Cryptographers’ Track at the RSA Conference 2009. Proceedings, Lecture Notes in Computer Science, vol. 5473, pp. 1–15. Springer (2009)

  35. Ma X., Lin D.: Generic constructions of revocable identity-based encryption. In: Z. Liu, M. Yung (eds.) Information Security and Cryptology—15th International Conference, Inscrypt 2019, Lecture Notes in Computer Science, vol. 12020, pp. 381–396. Springer (2019).

  36. Ma X., Lin D.: Generic constructions of ribe via subset difference method. IACR Cryptol. ePrint Arch. 2019, 1376 (2019).

    Google Scholar 

  37. Naor D., Naor M., Lotspiech J.: Revocation and tracing schemes for stateless receivers. In: J. Kilian (ed.) Advances in Cryptology—CRYPTO 2001, 21st Annual International Cryptology Conference. Proceedings, Lecture Notes in Computer Science, vol. 2139, pp. 41–62. Springer (2001).

  38. Okamoto T., Takashima K.: Achieving short ciphertexts or short secret-keys for adaptively secure general inner-product encryption. Des. Codes Cryptogr. 77(2–3), 725–771 (2015).

    Article  MathSciNet  Google Scholar 

  39. Ramanna S.C., Sarkar P.: Efficient (anonymous) compact HIBE from standard assumptions. In: S.S.M. Chow, J.K. Liu, L.C.K. Hui, S. Yiu (eds.) Provable Security - 8th International Conference, ProvSec 2014. Proceedings, Lecture Notes in Computer Science, vol. 8782, pp. 243–258. Springer (2014).

  40. Ryu G., Lee K., Park S., Lee D.H.: Unbounded hierarchical identity-based encryption with efficient revocation. In: H. Kim, D. Choi (eds.) Information Security Applications—16th International Workshop, WISA 2015, Lecture Notes in Computer Science, vol. 9503, pp. 122–133. Springer (2015).

  41. Seo J.H., Emura K.: Efficient delegation of key generation and revocation functionalities in identity-based encryption. In: E. Dawson (ed.) Topics in Cryptology—CT-RSA 2013—The Cryptographers’ Track at the RSA Conference 2013, Lecture Notes in Computer Science, vol. 7779, pp. 343–358. Springer (2013).

  42. Seo J.H., Emura K.: Revocable identity-based encryption revisited: Security model and construction. In: K. Kurosawa, G. Hanaoka (eds.) Public-Key Cryptography - PKC 2013 - 16th International Conference on Practice and Theory in Public-Key Cryptography. Proceedings, Lecture Notes in Computer Science, vol. 7778, pp. 216–234. Springer (2013).

  43. Seo J.H., Emura K.: Adaptive-id secure revocable hierarchical identity-based encryption. In: K. Tanaka, Y. Suga (eds.) Advances in Information and Computer Security - 10th International Workshop on Security, IWSEC 2015, Lecture Notes in Computer Science, vol. 9241, pp. 21–38. Springer (2015).

  44. Seo J.H., Emura K.: Revocable hierarchical identity-based encryption: History-free update, security against insiders, and short ciphertexts. In: K. Nyberg (ed.) Topics in Cryptology - CT-RSA 2015, The Cryptographer’s Track at the RSA Conference 2015, Lecture Notes in Computer Science, vol. 9048, pp. 106–123. Springer (2015).

  45. Shacham H.: The BBG HIBE has limited delegation. IACR Cryptol. ePrint Arch. 2007, 201 (2007).

    Google Scholar 

  46. Shen L., Zhang F., Sun Y., Ma J.: An efficient revocable ID-based encryption scheme in the standard model. IJES 9(2), 168–176 (2017).

    Article  Google Scholar 

  47. Takayasu A., Watanabe Y.: Lattice-based revocable identity-based encryption with bounded decryption key exposure resistance. In: J. Pieprzyk, S. Suriadi (eds.) Information Security and Privacy—22nd Australasian Conference, ACISP 2017, Lecture Notes in Computer Science, vol. 10342, pp. 184–204. Springer (2017).

  48. Takayasu A., Watanabe Y.: Revocable identity-based encryption with bounded decryption key exposure resistance: lattice-based construction and more. IACR Cryptol. ePrint Arch. 2017, 323 (2017).

    MATH  Google Scholar 

  49. Wang C., Li Y., Jiang S., Wu J.: An efficient adaptive-id secure revocable hierarchical identity-based encryption scheme. In: M. Qiu (ed.) Smart Computing and Communication—First International Conference, SmartCom 2016, Lecture Notes in Computer Science, vol. 10135, pp. 506–515. Springer (2016).

  50. Wang C., Li Y., Xia X., Zheng K.: An efficient and provable secure revocable identity-based encryption scheme. PLoS ONE 9(9), e106925 (2014).

    Article  Google Scholar 

  51. Wang S., Zhang J., He J., Wang H., Li C.: Simplified revocable hierarchical identity-based encryption from lattices. In: Y. Mu, R.H. Deng, X. Huang (eds.) Cryptology and Network Security - 18th International Conference, CANS 2019, Fuzhou, China, October 25–27, 2019, Proceedings, Lecture Notes in Computer Science, vol. 11829, pp. 99–119. Springer (2019).

  52. Watanabe Y., Emura K., Seo J.H.: New revocable IBE in prime-order groups: Adaptively secure, decryption key exposure resistant, and with short public parameters. In: H. Handschuh (ed.) Topics in Cryptology—CT-RSA 2017—The Cryptographers’ Track at the RSA Conference 2017. Proceedings, Lecture Notes in Computer Science, vol. 10159, pp. 432–449. Springer (2017).

  53. Waters B.: Dual system encryption: Realizing fully secure IBE and HIBE under simple assumptions. In: S. Halevi (ed.) Advances in Cryptology—CRYPTO 2009, 29th Annual International Cryptology Conference. Proceedings, Lecture Notes in Computer Science, vol. 5677, pp. 619–636. Springer (2009).

  54. Xing Q., Wang B., Wang X., Chen P., Yu B., Tang Y., Gao X.: Unbounded revocable hierarchical identity-based encryption with adaptive-id security. In: J. Chen, L.T. Yang (eds.) 18th IEEE International Conference on High Performance Computing and Communications, 14th IEEE International Conference on Smart City, 2nd IEEE International Conference on Data Science and Systems, HPCC/SmartCity/DSS 2016, pp. 430–437. IEEE (2016).

  55. Xing Q., Wang B., Wang X., Tao J.: Unbounded and revocable hierarchical identity-based encryption with adaptive security, decryption key exposure resistant, and short public parameters. PLoS ONE 13(4), e0195204 (2018).

    Article  Google Scholar 

  56. Zhandry M.: Secure identity-based encryption in the quantum random oracle model. In: R. Safavi-Naini, R. Canetti (eds.) Advances in Cryptology—CRYPTO 2012—32nd Annual Cryptology Conference, Proceedings, Lecture Notes in Computer Science, vol. 7417, pp. 758–775. Springer (2012).

Download references

Acknowledgements

This work is supported by JST CREST Grant Number JPMJCR14D6, JSPS KAKENHI Grant Number JP17K12697, JP18H05289, and MEXT Leading Initiative for Excellent Young Researchers.

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Atsushi Takayasu.

Additional information

Communicated by C. Padro.

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Emura, K., Takayasu, A. & Watanabe, Y. Adaptively secure revocable hierarchical IBE from k-linear assumption. Des. Codes Cryptogr. 89, 1535–1574 (2021). https://doi.org/10.1007/s10623-021-00880-w

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10623-021-00880-w

Keywords

Mathematics Subject Classification

Navigation