lattice based proxy re encryption
play

Lattice-based Proxy Re-encryption PKC 2014 , 26.03.14 Elena - PowerPoint PPT Presentation

Lattice-based Proxy Re-encryption PKC 2014 , 26.03.14 Elena Kirshanova Horst Grtz Institute for IT Security Ruhr University Bochum Outline 1 Definition of PRE and Security Model 2 Previous constructions and our contribution 3 One-way functions


  1. Lattice-based Proxy Re-encryption PKC 2014 , 26.03.14 Elena Kirshanova Horst Görtz Institute for IT Security Ruhr University Bochum

  2. Outline 1 Definition of PRE and Security Model 2 Previous constructions and our contribution 3 One-way functions on lattices 4 Extended G-trapdoor and Re-Encryption

  3. The informal definition of a Proxy Re-Encyption PRE based on lattices|PKC 2014|26.03.14 3/23

  4. The informal definition of a Proxy Re-Encyption PRE based on lattices|PKC 2014|26.03.14 3/23

  5. The informal definition of a Proxy Re-Encyption PRE based on lattices|PKC 2014|26.03.14 3/23

  6. The informal definition of a Proxy Re-Encyption PRE based on lattices|PKC 2014|26.03.14 3/23

  7. The formal Definition Definition 1 (Proxy Re-Encryption) A unidirectional Proxy Re-Encryption (PRE) is a tuple of algorithms: ◮ ( pk , sk ) ← KeyGen ( 1 n ) ◮ c pk ← Enc ( pk , m ) ◮ m ← Dec ( sk , c ) PRE based on lattices|PKC 2014|26.03.14 4/23

  8. The formal Definition Definition 1 (Proxy Re-Encryption) A unidirectional Proxy Re-Encryption (PRE) is a tuple of algorithms: ◮ ( pk , sk ) ← KeyGen ( 1 n ) ◮ c pk ← Enc ( pk , m ) ◮ m ← Dec ( sk , c ) ◮ rk pk → pk ′ ← ReKeyGen ( pk , sk , pk ′ ) PRE based on lattices|PKC 2014|26.03.14 4/23

  9. The formal Definition Definition 1 (Proxy Re-Encryption) A unidirectional Proxy Re-Encryption (PRE) is a tuple of algorithms: ◮ ( pk , sk ) ← KeyGen ( 1 n ) ◮ c pk ← Enc ( pk , m ) ◮ m ← Dec ( sk , c ) ◮ rk pk → pk ′ ← ReKeyGen ( pk , sk , pk ′ ) ◮ c ′ ← ReEnc ( rk pk → pk ′ , c pk ) PRE based on lattices|PKC 2014|26.03.14 4/23

  10. PRE-CCA1 Security (simplified) PRE CCA1 A A , Π ( n ) pk ∗ ( pk , pk ′ ) rk pk → pk ′ ( Dec ( c ) , pk ) · · · m 0 , m 1 m 0 , m 1 ∈ M b ← { 0 , 1 } c ∗ = Enc ( pk ∗ , m b ) c ∗ If b = b ′ output 1 b ′ ∈ { 0 , 1 } b ′ else output 0

  11. PRE-CCA1 Security (simplified) PRE CCA1 A A , Π ( n ) pk ∗ ( pk , pk ′ ) rk pk → pk ′ ( Dec ( c ) , pk ) · · · m 0 , m 1 m 0 , m 1 ∈ M b ← { 0 , 1 } c ∗ = Enc ( pk ∗ , m b ) c ∗ If b = b ′ output 1 b ′ ∈ { 0 , 1 } b ′ else output 0

  12. PRE-CCA1 Security (simplified) PRE CCA1 A A , Π ( n ) pk ∗ ( pk , pk ′ ) rk pk → pk ′ ( Dec ( c ) , pk ) · · · m 0 , m 1 m 0 , m 1 ∈ M b ← { 0 , 1 } c ∗ = Enc ( pk ∗ , m b ) c ∗ If b = b ′ output 1 b ′ ∈ { 0 , 1 } b ′ else output 0

  13. PRE-CCA1 Security (simplified) PRE CCA1 A A , Π ( n ) pk ∗ ( pk , pk ′ ) rk pk → pk ′ ( Dec ( c ) , pk ) · · · m 0 , m 1 m 0 , m 1 ∈ M b ← { 0 , 1 } c ∗ = Enc ( pk ∗ , m b ) c ∗ If b = b ′ output 1 b ′ ∈ { 0 , 1 } b ′ else output 0

  14. PRE-CCA1 Security (simplified) PRE CCA1 A A , Π ( n ) pk ∗ ( pk , pk ′ ) rk pk → pk ′ ( Dec ( c ) , pk ) · · · m 0 , m 1 m 0 , m 1 ∈ M b ← { 0 , 1 } c ∗ = Enc ( pk ∗ , m b ) c ∗ If b = b ′ output 1 b ′ ∈ { 0 , 1 } b ′ else output 0

  15. PRE-CCA1 Security (simplified) PRE CCA1 A A , Π ( n ) pk ∗ ( pk , pk ′ ) rk pk → pk ′ ( Dec ( c ) , pk ) · · · m 0 , m 1 m 0 , m 1 ∈ M b ← { 0 , 1 } c ∗ = Enc ( pk ∗ , m b ) c ∗ If b = b ′ output 1 b ′ ∈ { 0 , 1 } b ′ else output 0

  16. PRE-CCA1 Security (simplified) PRE CCA1 A A , Π ( n ) pk ∗ ( pk , pk ′ ) rk pk → pk ′ ( Dec ( c ) , pk ) · · · m 0 , m 1 m 0 , m 1 ∈ M b ← { 0 , 1 } c ∗ = Enc ( pk ∗ , m b ) c ∗ If b = b ′ output 1 b ′ ∈ { 0 , 1 } b ′ else output 0 PRE based on lattices|PKC 2014|26.03.14 5/23

  17. Desired properties of PRE schemes ◮ Unidirectional (rk pk → pk ′ � = rk pk ′ → pk ) PRE based on lattices|PKC 2014|26.03.14 6/23

  18. Desired properties of PRE schemes ◮ Unidirectional (rk pk → pk ′ � = rk pk ′ → pk ) ◮ Non-interactive (ReKeyGen ( pk , sk , pk ′ ) ) PRE based on lattices|PKC 2014|26.03.14 6/23

  19. Desired properties of PRE schemes ◮ Unidirectional (rk pk → pk ′ � = rk pk ′ → pk ) ◮ Non-interactive (ReKeyGen ( pk , sk , pk ′ ) ) ◮ Collusion ‘safe’ PRE based on lattices|PKC 2014|26.03.14 6/23

  20. Desired properties of PRE schemes ◮ Unidirectional (rk pk → pk ′ � = rk pk ′ → pk ) ◮ Non-interactive (ReKeyGen ( pk , sk , pk ′ ) ) ◮ Collusion ‘safe’ ◮ Key optimal ◮ Non-transitive ◮ Proxy invisibility PRE based on lattices|PKC 2014|26.03.14 6/23

  21. Outline 1 Definition of PRE and Security Model 2 Previous constructions and our contribution 3 One-way functions on lattices 4 Extended G-trapdoor and Re-Encryption

  22. PRE overview Unidirectional Non-interactive Collusion-safe Assumption Security Model [BBS98] ✗ ✗ ✗ DDH IND-CPA PRE based on lattices|PKC 2014|26.03.14 8/23

  23. PRE overview Unidirectional Non-interactive Collusion-safe Assumption Security Model [BBS98] ✗ ✗ ✗ DDH IND-CPA [AFGH06] ✓ ✓ ✓ eDBDH IND-CPA PRE based on lattices|PKC 2014|26.03.14 8/23

  24. PRE overview Unidirectional Non-interactive Collusion-safe Assumption Security Model [BBS98] ✗ ✗ ✗ DDH IND-CPA [AFGH06] ✓ ✓ ✓ eDBDH IND-CPA [CH07] ✗ ✗ ✗ DBDH IND-CCA PRE based on lattices|PKC 2014|26.03.14 8/23

  25. PRE overview Unidirectional Non-interactive Collusion-safe Assumption Security Model [BBS98] ✗ ✗ ✗ DDH IND-CPA [AFGH06] ✓ ✓ ✓ eDBDH IND-CPA [CH07] ✗ ✗ ✗ DBDH IND-CCA [Xag10] ✗ ✗ ✗ LWE IND-CPA PRE based on lattices|PKC 2014|26.03.14 8/23

  26. PRE overview Unidirectional Non-interactive Collusion-safe Assumption Security Model [BBS98] ✗ ✗ ✗ DDH IND-CPA [AFGH06] ✓ ✓ ✓ eDBDH IND-CPA [CH07] ✗ ✗ ✗ DBDH IND-CCA [Xag10] ✗ ✗ ✗ LWE IND-CPA This work ✓ ✓ ✓ LWE IND-CCA1 PRE based on lattices|PKC 2014|26.03.14 8/23

  27. Main result Theorem 2 Our unidirectional Proxy Re-Encryption scheme is IND-CCA1-secure assuming the hardness of decision-LWE. PRE based on lattices|PKC 2014|26.03.14 9/23

  28. Outline 1 Definition of PRE and Security Model 2 Previous constructions and our contribution 3 One-way functions on lattices 4 Extended G-trapdoor and Re-Encryption

  29. Lattice definition ◮ Lattice Λ of dimension m is a discrete additive subgroup of Z m . b 1 b 2 PRE based on lattices|PKC 2014|26.03.14 11/23

  30. Lattice definition ◮ Lattice Λ of dimension m is a discrete additive subgroup of Z m . b 1 b 2 ◮ Basis B = { b 1 , . . . , b k } : Λ( B ) = { Bz : z ∈ Z k } . PRE based on lattices|PKC 2014|26.03.14 11/23

  31. Gaussians on Lattices v ← D Λ , s ⇔ v ∝ ρ s ( x ) = exp ( − π � x � 2 s 2 ) PRE based on lattices|PKC 2014|26.03.14 12/23

  32. One-way functions from lattices � � ◮ Public ∈ Z n × m A , q = poly ( n ) , m ≈ n log q q PRE based on lattices|PKC 2014|26.03.14 13/23

  33. One-way functions from lattices � � ◮ Public ∈ Z n × m A , q = poly ( n ) , m ≈ n log q q SIS LWE g A ( s , e ) = s t A + e t mod q ∈ Z m u := f A ( x ) = Ax mod q ∈ Z n q q PRE based on lattices|PKC 2014|26.03.14 13/23

  34. One-way functions from lattices � � ◮ Public ∈ Z n × m A , q = poly ( n ) , m ≈ n log q q SIS LWE g A ( s , e ) = s t A + e t mod q ∈ Z m u := f A ( x ) = Ax mod q ∈ Z n q q : sample x ′ ← D Λ u , s f − 1 g − 1 : find the unique s A A s.t. Ax ′ = u (or e ) PRE based on lattices|PKC 2014|26.03.14 13/23

  35. G-trapdoor [PM12] and a short R ← Z ¯ nk × nk define ◮ For a uniform A 0 ∈ Z n × ¯ m q � I � − R A = [ A 0 | G ] = [ A 0 | G − A 0 R ] I for some G with easy f − 1 and g − 1 G . G PRE based on lattices|PKC 2014|26.03.14 14/23

  36. G-trapdoor [PM12] and a short R ← Z ¯ nk × nk define ◮ For a uniform A 0 ∈ Z n × ¯ m q � I � − R A = [ A 0 | G ] = [ A 0 | G − A 0 R ] I for some G with easy f − 1 and g − 1 G . G ◮ [ A 0 | A 0 R ] is uniform by the leftover hash lemma, so is A . PRE based on lattices|PKC 2014|26.03.14 14/23

  37. G-trapdoor [PM12] and a short R ← Z ¯ nk × nk define ◮ For a uniform A 0 ∈ Z n × ¯ m q � I � − R A = [ A 0 | G ] = [ A 0 | G − A 0 R ] I for some G with easy f − 1 and g − 1 G . G ◮ [ A 0 | A 0 R ] is uniform by the leftover hash lemma, so is A . � R � ◮ A · = G I PRE based on lattices|PKC 2014|26.03.14 14/23

  38. Outline 1 Definition of PRE and Security Model 2 Previous constructions and our contribution 3 One-way functions on lattices 4 Extended G-trapdoor and Re-Encryption

  39. Extended G-trapdoor ◮ Idea: generate multiple R -transformations trapdoor for g A � �� � A = [ A 0 | G − A 0 R 1 | G − A 0 R 2 ] � �� � trapdoor for f A ◮ R 1 allows to sample short vectors (i.e. generate rk) ◮ R 2 allows to invert s t A + e t (i.e. decrypt) PRE based on lattices|PKC 2014|26.03.14 16/23

  40. Encryption ◮ pk = [ A 0 | G − A 0 R 1 | G − A 0 R 2 ] ∈ Z n × m , sk := [ R 1 | R 2 ] q PRE based on lattices|PKC 2014|26.03.14 17/23

  41. Encryption ◮ pk = [ A 0 | G − A 0 R 1 | G − A 0 R 2 ] ∈ Z n × m , sk := [ R 1 | R 2 ] q ◮ Enc ( mes , pk ) : c 1 = s t · pk + e t 1 mod q , c 2 = s t · A aux + e t 2 + enc ( mes ) mod q , $ $ and enc ( mes ) := mes · ⌊ q − Z n − Z n × nk for s ← q , e 1 , e 2 ← D s , A aux ← 2 ⌋ . q PRE based on lattices|PKC 2014|26.03.14 17/23

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend