Efficient Chosen Ciphertext Secure Public Key Encryption under the Computational Diffie-Hellman Assumption

Hanaoka, Goichiro; Kurosawa, Kaoru

doi:10.1007/978-3-540-89255-7_19

Cited by 81 publications

(82 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…When applying our technique to the Cramer-Shoup scheme, ciphertext length of the resulting scheme becomes the same as that of the Kurosawa-Desmedt (KD) scheme [35] which is the best known DDH-based PKE scheme. We should also note that this technique is not applicable to other similar schemes such as the Cash-Kiltz-Shoup [11], Hanaoka-Kurosawa [26], and Kiltz schemes [33]. This fact is primarily due to the structure of HPS-based constructions, and thus, it is difficult to apply the above technique to PKE schemes from other methodology, e.g.…”

Section: Definition 53 (Smooth Function) Let F : X → Y Be a Hash Fumentioning

confidence: 99%

See 1 more Smart Citation

Chosen Ciphertext Secure Keyed-Homomorphic Public-Key Encryption

Emura

Hanaoka

Ohtake

et al. 2013

Public-Key Cryptography – PKC 2013

Self Cite

View full text Add to dashboard Cite

In homomorphic encryption schemes, anyone can perform homomorphic operations, and therefore, it is difficult to manage when, where and by whom they are performed. In addition, the property that anyone can "freely" perform the operation inevitably means that ciphertexts are malleable, and it is well-known that adaptive chosen ciphertext (CCA) security and the homomorphic property can never be achieved simultaneously. In this paper, we show that CCA security and the homomorphic property can be simultaneously handled in situations that the user(s) who can perform homomorphic operations on encrypted data should be controlled/limited, and propose a new concept of homomorphic publickey encryption, which we call keyed-homomorphic public-key encryption (KH-PKE). By introducing a secret key for homomorphic operations, we can control who is allowed to perform the homomorphic operation. To construct KH-PKE schemes, we introduce a new concept, transitional universal property, and present a practical KH-PKE scheme with multiplicative homomorphic operations from the decisional Diffie-Hellman (DDH) assumption. For ℓ-bit security, our DDH-based KH-PKE scheme yields only ℓ-bit longer ciphertext size than that of the Cramer-Shoup PKE scheme. Finally, we consider an identitybased analogue of KH-PKE, called keyed-homomorphic identity-based encryption (KH-IBE) and give its concrete construction from the Gentry IBE scheme.

show abstract

Section: Definition 53 (Smooth Function) Let F : X → Y Be a Hash Fumentioning

confidence: 99%

“…This fact is primarily due to the structure of HPS-based constructions, and thus, it is difficult to apply the above technique to PKE schemes from other methodology, e.g. [8,26,32].…”

Section: Definition 53 (Smooth Function) Let F : X → Y Be a Hash Fumentioning

confidence: 99%

Chosen Ciphertext Secure Keyed-Homomorphic Public-Key Encryption

Emura

Hanaoka

Ohtake

et al. 2013

Public-Key Cryptography – PKC 2013

Self Cite

View full text Add to dashboard Cite

show abstract

“…Hanaoka and Kurosawa [13] describe a publicly verifiable KEM that, when combined with a DEM, would yield a (somewhat non-trivial, cf. Section 4) publicly verifiable PKE.…”

Section: Our Pke Scheme With Strictly Non-trivial Publicly Verifiablementioning

confidence: 99%

Publicly Verifiable Ciphertexts

Nieto

Manulis

Poettering

et al. 2012

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. In many applications, where encrypted traffic flows from an open (public) domain to a protected (private) domain, there exists a gateway that bridges the two domains and faithfully forwards the incoming traffic to the receiver. We observe that indistinguishability against (adaptive) chosen-ciphertext attacks (IND-CCA), which is a mandatory goal in face of active attacks in a public domain, can be essentially relaxed to indistinguishability against chosen-plaintext attacks (IND-CPA) for ciphertexts once they pass the gateway that acts as an IND-CCA/CPA filter by first checking the validity of an incoming IND-CCA ciphertext, then transforming it (if valid) into an IND-CPA ciphertext, and forwarding the latter to the recipient in the private domain. "Non-trivial filtering" can result in reduced decryption costs on the receivers' side. We identify a class of encryption schemes with publicly verifiable ciphertexts that admit generic constructions of (non-trivial) IND-CCA/CPA filters. These schemes are characterized by existence of public algorithms that can distinguish between valid and invalid ciphertexts. To this end, we formally define (non-trivial) public verifiability of ciphertexts for general encryption schemes, key encapsulation mechanisms, and hybrid encryption schemes, encompassing public-key, identity-based, and tagbased encryption flavours. We further analyze the security impact of public verifiability and discuss generic transformations and concrete constructions that enjoy this property.

show abstract

“…The currently most efficient (constrained) CCA secure KEMs, which are provably secure in the standard model, are defined in prime order groups [14,34,8,33,28,10,22,25,42,24]. The ciphertext overhead in these schemes consists of at least two group elements.…”

Section: Introductionmentioning

confidence: 99%

“…This reduces the ciphertext overhead to match that of the other schemes defined in standard prime order groups and based on non-interactive assumptions, when taking into account the additional overhead of a MAC required by these schemes e.g. KurosawaDesmedt [34], Hofheinz-Kiltz [28] and Hanaoka-Kurosawa [22,Sect. 6].…”

Section: Introductionmentioning

confidence: 99%

On the Impossibility of Constructing Efficient Key Encapsulation and Programmable Hash Functions in Prime Order Groups

Hanaoka

Matsuda

Schuldt

2012

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. In this paper, we focus on the problem of minimizing ciphertext overhead, and discuss the (im)possibility of constructing key encapsulation mechanisms (KEMs) with low ciphertext overhead. More specifically, we rule out the existence of algebraic black-box reductions from the (bounded) CCA security of a natural class of KEMs to any non-interactive problem. The class of KEMs captures the structure of the currently most efficient KEMs defined in standard prime order groups, but restricts an encapsulation to consist of a single group element and a string. This result suggests that we cannot rely on existing techniques to construct a CCA secure KEM in standard prime order groups with a ciphertext overhead lower than two group elements. Furthermore, we show how the properties of an (algebraic) programmable hash function can be exploited to construct a simple, efficient and CCA secure KEM based on the hardness of the decisional Diffie-Hellman problem with the ciphertext overhead of just a single group element. Since this KEM construction is covered by the above mentioned impossibility result, this enables us to derive a lower bound on the hash key size of an algebraic programmable hash function, and rule out the existence of algebraic (poly, n)-programmable hash functions in prime order groups for any integer n. The latter result answers an open question posed by Hofheinz and Kiltz (CRYPTO'08) in the case of algebraic programmable hash functions in prime order groups.

show abstract

Efficient Chosen Ciphertext Secure Public Key Encryption under the Computational Diffie-Hellman Assumption

Cited by 81 publications

References 40 publications

Chosen Ciphertext Secure Keyed-Homomorphic Public-Key Encryption

Chosen Ciphertext Secure Keyed-Homomorphic Public-Key Encryption

Publicly Verifiable Ciphertexts

On the Impossibility of Constructing Efficient Key Encapsulation and Programmable Hash Functions in Prime Order Groups

Contact Info

Product

Resources

About