Communication Complexity of Conditional Disclosure of Secrets and Attribute-Based Encryption

Gay, Romain; Kerenidis, Iordanis; Wee, Hoeteck

doi:10.1007/978-3-662-48000-7_24

Cited by 44 publications

(21 citation statements)

References 52 publications

(90 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…4 We further mention that our construction can be viewed as dual to the construction of [IW14]; See Remark 8.5. Finally, we note that CDS protocols have recently found applications in Attribute-Based Encryption (see [GKW15]). For this application, the CDS is required to satisfy some linearity properties which hold for our CDS-based construction.…”

Section: Constructing Cdsmentioning

confidence: 94%

“…We show that in this case the random variables Remark 8.3 (Linearity). We say that a CDS (F 1 , F 2 ) is linear [GKW15] if for any fixed 1-input (x, y) the decoding function Dec x,y which maps the messages of Alice and Bob (viewed together as a vector over a field F) to the secret b ∈ F is linear over F. It is not hard to verify that Theorem 2.7 yields a linear CDS. In fact, our scheme satisfies a stronger notion of linearity: for any fixed input (x, y) the functions F 1 and F 2 are degree 1 functions in the secret b and in the common randomness randomness (c, d).…”

Section: Cds For Dependency Programsmentioning

confidence: 99%

“…These linearity properties are useful for some applications such as Attribute Based Encryption schemes (cf. [IW14,GKW15]).…”

Section: Cds For Dependency Programsmentioning

confidence: 99%

See 2 more Smart Citations

From Private Simultaneous Messages to Zero-Information Arthur–Merlin Protocols and Back

Applebaum

Raykov

2016

J Cryptol

View full text Add to dashboard Cite

Göös, Pitassi and Watson (ITCS, 2015) have recently introduced the notion of Zero-Information Arthur-Merlin Protocols (ZAM). In this model, which can be viewed as a private version of the standard Arthur-Merlin communication complexity game, Alice and Bob are holding a pair of inputs x and y respectively, and Merlin, the prover, attempts to convince them that some public function f evaluates to 1 on (x, y). In addition to standard completeness and soundness, Göös et al., require a "zero-knowledge" property which asserts that on each yes-input, the distribution of Merlin's proof leaks no information about the inputs (x, y) to an external observer. In this paper, we relate this new notion to the well-studied model of Private Simultaneous Messages (PSM) that was originally suggested by Feige, Naor and Kilian (STOC, 1994). Roughly speaking, we show that the randomness complexity of ZAM corresponds to the communication complexity of PSM, and that the communication complexity of ZAM corresponds to the randomness complexity of PSM. This relation works in both directions where different variants of PSM are being used. As a secondary contribution, we reveal new connections between different variants of PSM protocols which we believe to be of independent interest. Our results give rise to better ZAM protocols based on existing PSM protocols, and to better protocols for conditional disclosure of secrets (a variant of PSM) from existing ZAMs.

show abstract

Section: Constructing Cdsmentioning

confidence: 94%

Section: Cds For Dependency Programsmentioning

confidence: 99%

See 1 more Smart Citation

From Private Simultaneous Messages to Zero-Information Arthur–Merlin Protocols and Back

Applebaum

Raykov

2016

J Cryptol

View full text Add to dashboard Cite

show abstract

“…On the lower-bound front much less is known. While we have tight lower bounds for restricted forms of CDS (e.g., when the computations are restricted to linear functions [19,9,12]), only few, relatively weak, lower-bounds are known for general CDS. It is important to note that an insecure solution to the problem has a communication cost of 1 bit!…”

Section: The Quest For Lower Boundsmentioning

confidence: 98%

Placing Conditional Disclosure of Secrets in the Communication Complexity Universe

Applebaum

Vasudevan

2021

J Cryptol

View full text Add to dashboard Cite

In the conditional disclosure of secrets (CDS) problem (Gertner et al., J. Comput. Syst. Sci., 2000) Alice and Bob, who hold n-bit inputs x and y respectively, wish to release a common secret z to Carol (who knows both x and y) if and only if the input (x, y) satisfies some predefined predicate f . Alice and Bob are allowed to send a single message to Carol which may depend on their inputs and some shared randomness, and the goal is to minimize the communication complexity while providing information-theoretic security.Despite the growing interest in this model, very few lower-bounds are known. In this paper, we relate the CDS complexity of a predicate f to its communication complexity under various communication games. For several basic predicates our results yield tight, or almost tight, lowerbounds of Ω(n) or Ω(n 1− ), providing an exponential improvement over previous logarithmic lower-bounds.We also define new communication complexity classes that correspond to different variants of the CDS model and study the relations between them and their complements. Notably, we show that allowing for imperfect correctness can significantly reduce communication -a seemingly new phenomenon in the context of information-theoretic cryptography. Finally, our results show that proving explicit super-logarithmic lower-bounds for imperfect CDS protocols is a necessary step towards proving explicit lower-bounds against the class AM, or even AM ∩ coAM -a well known open problem in the theory of communication complexity. Thus imperfect CDS forms a new minimal class which is placed just beyond the boundaries of the "civilized" part of the communication complexity world for which explicit lower-bounds are known.

show abstract

“…Eventualy, constant-size ciphertexts or keys ("constant" meaning that it only depends on the security parameter and not on the number of adversarial queries or features of the system) often translate into non-constant-size assumptions. In some situations, information theoretic arguments [32] even rule out the possibility of simultaneously achieving constant-size ciphertexts and keys, no matter which assumption is considered.…”

Section: Introductionmentioning

confidence: 99%

Compact IBBE and Fuzzy IBE from Simple Assumptions

Gong

Libert

Ramanna

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We propose new constructions for identity-based broadcast encryption (IBBE) and fuzzy identity-based encryption (FIBE) in bilinear groups of composite order. Our starting point is the IBBE scheme of Delerablée (Asiacrypt 2007) and the FIBE scheme of Herranz et al. (PKC 2010) proven secure under parameterised assumptions called generalised decisional bilinear Diffie-Hellman (GDDHE) and augmented multi-sequence of exponents Diffie-Hellman (aMSE-DDH) respectively. The two schemes are described in the prime-order pairing group. We transform the schemes into the setting of (symmetric) composite-order groups and prove security from two static assumptions (subgroup decision). The Déjà Q framework of Chase et al. (Asiacrypt 2016) is known to cover a large class of parameterised assumptions (dubbedüber assumption), that is, these assumptions, when defined in asymmetric composite-order groups, are implied by subgroup decision assumptions in the underlying compositeorder groups. We argue that the GDDHE and aMSE-DDH assumptions are not covered by the Déjà Qüber assumption framework. We therefore work out direct security reductions for the two schemes based on subgroup decision assumptions. Furthermore, our proofs involve novel extensions of Déjà Q techniques of Wee (TCC 2016-A) and Chase et al. Our constructions have constant-size ciphertexts. The IBBE has constant-size keys as well and guarantees stronger security as compared to Delerablée's IBBE, thus making it the first compact IBBE known to be selectively secure without random oracles under simple assumptions. The fuzzy IBE scheme is the first to simultaneously feature constant-size ciphertexts and security under standard assumptions.

show abstract

Communication Complexity of Conditional Disclosure of Secrets and Attribute-Based Encryption

Cited by 44 publications

References 52 publications

From Private Simultaneous Messages to Zero-Information Arthur–Merlin Protocols and Back

From Private Simultaneous Messages to Zero-Information Arthur–Merlin Protocols and Back

Placing Conditional Disclosure of Secrets in the Communication Complexity Universe

Compact IBBE and Fuzzy IBE from Simple Assumptions

Contact Info

Product

Resources

About