Identity-Based Revocation From Subset Difference Methods Under Simple Assumptions

Abstract

Identity-based revocation (IBR) is a specific kind of broadcast encryption that can effectively send ciphertext to a set of receivers. In IBR, a ciphertext is associated with a set of revoked users instead of a set of receivers and the maximum number of users in the system can be an exponential value in the security parameter. In this paper, we reconsider the general method of Lee et al. (ESORICS 2014) that constructs a public-key revocation (PKR) scheme by combining the subset difference (SD) method of Naor, Naor, and Lotspiech (CRYPTO 2001) and a single revocation encryption (SRE) scheme. Lee et al. left it as an open problem to construct an SRE scheme under the standard assumption without random oracles. In this paper, we first propose a selectively secure SRE scheme under the standard assumption without random oracles. We also propose a fully secure SRE scheme under simple static assumptions without random oracles. Next, we present an efficient IBR scheme that supports fast decryption by combining the SD method and our SRE scheme. The security of our IBR scheme depends on that of the underlying SRE scheme. Finally, we implemented our SRE and IBR schemes and measured the performance.

Comments on “Identity-Based Revocation From Subset Difference Methods Under Simple Assumptions”

“…In this section, we briefly review the LP-IBR scheme which is built on a combination of a SRE scheme and the SD scheme [11]. We use the notations as presented in [9].…”

“…Despite the intended design principle of the LP-IBR scheme, the key assignment method of the SD scheme is described incorrectly in [9]. Here we describe the original key assignment method of the SD scheme.…”

“…In [9], a specific instance of a SRE scheme is presented for constructing an IBR scheme using prime-order bilinear groups. For completeness we review it briefly here.…”

A generic construction for revocable identity-based encryption with subset difference methods

“…Identitybased broadcast encryption (IBBE) can provide more powerful revocation than existing PKBE because the maximum number of users in the system can be exponential [25]. Identity-based revocation (IBR) can be viewed as a cryptographic scheme that implements direct user revocation because all system users except the revoked users can decrypt a ciphertext where a revoked set R is specified in the ciphertext [26,27]. However, PKBE, IBBE, and IBR have the disadvantage that a user cannot be revoked after the creation of a ciphertext.…”

“…However, the IBR scheme for our generic construction only requires that the revoked set R of ciphertexts just consists of a single revoked identity ID . Thus, we can derive a simplified LSW-IBR scheme which supports a single revoked identity, and this simplified IBR scheme provides selective security in the DBDH assumption [ 27 ]. Finally, we choose the two-level BB-HIBE scheme of Boneh and Boyen [ 38 ] that provides selective security in the DBDH assumption.…”