A Parametric Family of Attack Models for Proxy Re-encryption

Abstract

Proxy Re-Encryption (PRE) is a type of Public-Key Encryption (PKE) that provides an additional re-encryption functionality. Although PRE is inherently more complex than PKE, attack models for PRE have not been developed further than those inherited from PKE. In this paper we address this gap and define a parametric family of attack models for PRE, based on the availability of both the decryption and reencryption oracles during the security game. This family enables the definition of a set of intermediate security notions for PRE that ranges from "plain" IND-CPA to "full" IND-CCA. We analyze some relations among these notions of security, and in particular, the separations that arise when the re-encryption oracle leaks re-encryption keys. In addition, we discuss which of these security notions represent meaningful adversarial models for PRE. Finally, we provide an example of a recent "CCA1secure" scheme from PKC 2014 whose security model does not capture chosen-ciphertext attacks through re-encryption and for which we describe an attack under a more realistic security notion. This attack emphasizes the fact that PRE schemes that leak re-encryption keys cannot achieve strong security notions.

On the application of generic CCA‐secure transformations to proxy re‐encryption

“…For reasons we will see later, in this work we need a finer‐grained definition of the attack models, so we will make use of the parametric family of attack models for PRE proposed in by Nuñez, et al ., which is defined in terms of the availability of the decryption and re‐encryption oracles during the security game. These attack models are of the form CCA i , j , where indices i , j ∈{0,1,2} mark the last phase of the security game where the decryption and re‐encryption oracles, respectively, are available to the adversary.…”

“…Figure depicts the resulting lattice‐shaped hierarchy of indistinguishability notions. See for more details about the definition of the parametric families of attack models and security notions for PRE.…”

“…These conditions include the satisfaction of a new property of PRE called “ perfect key switching ”, which characterizes schemes where the re‐encryption process preserves the original randomness of ciphertexts, and a weak notion of security called IND‐CCA 0,1 , due to Nuñez, et al . , where the adversary only has access to the re‐encryption oracle before the challenge. The schemes resulting from this transformation achieve IND‐CCA 2,1 security in the random oracle model, a notion slightly weaker than full CCA‐security.…”

Non-transferable proxy re-encryption for multiple groups

“…A bidirectional single-hop PRE scheme without bilinear maps is considered by Deng et al in 2008 and then it is also CCA secure in random oracle model. Bidirectional PRE schemes have attracted much attention from the cryptography community (Ateniese et al, 2006;Blaze et al, 1998;Guo et al, 2015;Ivan and Dodis, 2003;Libert and Vergnaud, 2008;Niu et al, 2009; because they have many interesting and useful applications, such as the e-mail forwarding, the encrypted files distribution, the digital rights management (Nuez et al, 2015) and the cloud data sharing (Fan and Liu, 2016).…”

The Fallout of Key Compromise in a Proxy-Mediated Key Agreement Protocol

“…Note that in the traditional proxy re-encryption literature (i.e., in the public-key setting), the re-encryption oracle is considered as a delicate point. See for example[17], where several generic attacks using the re-encryption oracle are discussed.…”