More Efficient Constructions for Inner-Product Encryption

Abstract

International audienceWe propose new constructions for inner product encryption – IPE1 and IPE2, both secure under the eXternal Diffie-Hellman assumption (SXDH) in asymmetric pairing groups. The first scheme has constant-size ciphertexts whereas the second one is weakly attribute hiding. IPE2 is derived from the identity-based encryption scheme of Jutla Roy (Asiacrypt 2013), that was extended from tag-based quasi-adaptive non-interactive zero-knowledge (QA-NIZK) proofs for linear subspaces of vector spaces over bilinear groups. The verifier common reference string (CRS) in these tag-based systems are split into two parts, that are combined during verification. We consider an alternate form of the tag-based QA-NIZK proof with a single verifier CRS that already includes a tag, different from the one defining the language. The verification succeeds as long as the two tags are unequal. Essentially, we embed a two-equation revocation mechanism in the verification. The new QA-NIZK proof system leads to IPE1, a constant-sized ciphertext IPE scheme with very short ciphertexts. Both the IPE schemes are obtained by applying the n-equation revocation technique of Attrapadung and Libert (PKC 2010) to the corresponding identity based encryption schemes and proved secure under SXDH assumption. As an application, we show how our schemes can be specialised to obtain the first fully secure identity-based broadcast encryption based on SXDH with a trade-off among the public parameters , ciphertext and key sizes, all of them being sub-linear in the maximum number of recipients of a broadcast

Practical Inner Product Encryption with Constant Private Key

“…Herein, we compare the efficiency of the proposed IPE scheme with the schemes proposed in [1,3,[5][6][7]15,16,[22][23][24][25][26][27][28][29][30]36] (Because [4,17] are the complete versions of [16,24], we only compare our work with [16,24]). As shown in Table 1, we compare our scheme to others in two aspects: the size of the private key and the number of pairing operations for decryption.…”

“…Huang et al [30] proposed the first enabled-disabled IPE, which supports timed-release services and data self-destruction. Ramanna [15] constructed two IPE schemes using tag-based quasi-adaptive noninteractive zero knowledge, where the first and second both have the property of constant-size ciphertext but only the second has the property of attribute-hiding. Zhang et al [7] recently proposed a new IPE scheme based on a double encryption system; it has been demonstrated to achieve adaptive security under a weak attribute-hiding model.…”

“…The IND-CPA security shown in this section is equivalent to payload-hiding. We emphasize that attribute-hiding is unnecessary for an IPE scheme; in [15][16][17], schemes have been proposed satisfying only payload hiding.…”

“…More precisely, under the security approach of IPE, an adversary learns nothing about the encrypted message from a ciphertext associated with an attribute vector x if they do not own the private key associated with a predicate vector y such that x, y = 0. Such a definition is also called the IND-CPA security for IPE scheme in some papers [15] and is defined as the payload-hiding property in [1]. Alternatively, the security definition defined in [1], called the attribute-hiding property, states that a ciphertext reveals nothing about the corresponding ciphertext attribute x.…”

“…However, we emphasize that the attribute-hiding property is not an absolutely necessary property for IPE. Many IPE schemes proposed in the literature achieve only IND-CPA security/payload hiding, such as that in [15][16][17].…”