Déjà Q All Over Again: Tighter and Broader Reductions of q-Type Assumptions

Abstract

In this paper, we demonstrate that various cryptographic constructions-including ones for broadcast, attribute-based, and hierarchical identity-based encryption-can rely for security on only the static subgroup hiding assumption when instantiated in composite-order bilinear groups, as opposed to the dynamic q-type assumptions on which their security previously was based. This specific goal is accomplished by more generally extending the recent Déjà Q framework (Chase and Meiklejohn, Eurocrypt 2014) in two main directions. First, by teasing out common properties of existing reductions, we expand the q-type assumptions that can be covered by the framework; i.e., we demonstrate broader classes of assumptions that can be reduced to subgroup hiding. Second, while the original framework applied only to asymmetric composite-order bilinear groups, we provide a reduction to subgroup hiding that works in symmetric (as well as asymmetric) composite-order groups. As a bonus, our new reduction achieves a tightness of log(q) rather than q.

Compact IBBE and Fuzzy IBE from Simple Assumptions

“…In prime order groups, Delerablée's construction [27] is proved selectively secure in the random oracle model under a highly non-standard q-type assumption, where q simultaneously depends on the number of private key queries and the maximal number of receivers per ciphertext. While this assumption is a special case of the Uber assumption of Boneh, Boyen and Goh [10], it seems to escape the family of assumptions that reduce the constant-size subgroup assumptions via the framework of Chase, Maller and Meiklejohn [24]: in Section 3.1, we indeed explain why the results of [24] alone do not immediately guarantee the security of Delerablée's IBBE in composite order groups. 4 Moreover, even if they did, a direct instantiation of [27] in composite order groups would only be guaranteed to be secure in the random oracle model.…”

“…Our schemes are proved selectively secure using the Déjà Q technique of Chase and Meiklejohn [23], which was re-used by Wee [63] and refined by Chase et al [24]. In Appendix A, we provide detailed comparisons of our schemes with previously known realizations.…”

“…It is natural to ask whether the scheme can be lifted to the composite-order setting and proved secure based on subgroup decision assumptions via the Déjà Q framework [23,24]. That is, we ask whether the Uber assumption in asymmetric composite-order bilinear groups defined in [24] covers the GDDHE assumption or not?…”

“…One of the most appealing tradeoffs was given in the scheme of Boneh, Gentry and Waters [14], which features short ciphertexts and private keys but linear-size private keys in the total number of users. While its security was initially proved under a parameterised assumption, recent extensions [63,24] of the Déjà Q framework [23] showed how to prove the security (against static adversaries) of its composite-order-group instantiations under constant-size subgroup assumptions. Boneh et al suggested a variant [17] of the BGW scheme [14] with polylogarithmic complexity in all metrics using multi-linear maps.…”

“…That is, we ask whether the Uber assumption in asymmetric composite-order bilinear groups defined in [24] covers the GDDHE assumption or not? The answer is negative.…”