Key-Insulated Public Key Cryptosystems

Abstract

Abstract. Cryptographic computations (decryption, signature generation, etc.) are often performed on a relatively insecure device (e.g., a mobile device or an Internet-connected host) which cannot be trusted to maintain secrecy of the private key. We propose and investigate the notion of key-insulated security whose goal is to minimize the damage caused by secret-key exposures. In our model, the secret key(s) stored on the insecure device are refreshed at discrete time periods via interaction with a physically-secure -but computationally-limiteddevice which stores a "master key". All cryptographic computations are still done on the insecure device, and the public key remains unchanged. In a (t, N )-keyinsulated scheme, an adversary who compromises the insecure device and obtains secret keys for up to t periods of his choice is unable to violate the security of the cryptosystem for any of the remaining N − t periods. Furthermore, the scheme remains secure (for all time periods) against an adversary who compromises only the physically-secure device.We focus primarily on key-insulated public-key encryption. We construct a (t, N )-key-insulated encryption scheme based on any (standard) public-key encryption scheme, and give a more ef£cient construction based on the DDH assumption. The latter construction is then extended to achieve chosen-ciphertext security.

Functional Encryption: New Perspectives and Lower Bounds

“…A natural question is whether their ciphertexts can be made to have size independent of q (or, at the very least, o(q)). 4 Indeed, in light of the results of Dodis, Katz, Xu and Yung [DKXY02] and most recently, Goldwasser, Lewko and Wilson [GLW12] in the context of bounded-collusion IBE, one might expect that achieving "short" ciphertexts is actually be possible in general.…”

On the Theory and Practice of Personal Digital Signatures

“…A second related class of solutions is known as Key Insulated and Intrusion Resilient signatures [11,14]. In a nutshell, this model and ours are incomparable, but we believe that our approach is the more realistic of the two.…”

Revocable Identity-Based Encryption Revisited: Security Model and Construction

“…But to show this thinking is wrong, we give an exceptional attack (decryption key exposure), wherein an adversary is allowed to obtain a decryption key dk ID * ,T with the condition T ̸ = T * . This setting is based on the similar attitude of key-insulated PKE [16], where it is desired that no information of the plaintext is revealed from a ciphertext even if all (short-term) decryption keys of a "different time period" are exposed. This kind of attack is not covered by the Boldyreva et al security model; that is, the adversary may obtain not a secret key sk ID * but a decryption key dk ID * ,T , and ID * can still be alive in the system in the challenge time period T * ̸ = T .…”