On the Joint Security of Encryption and Signature, Revisited

Abstract

Abstract. We revisit the topic of joint security for combined public key schemes, wherein a single keypair is used for both encryption and signature primitives in a secure manner. While breaking the principle of key separation, such schemes have attractive properties and are sometimes used in practice. We give a general construction for a combined public key scheme having joint security that uses IBE as a component and that works in the standard model. We provide a more efficient direct construction, also in the standard model. We then consider the problem of how to build signcryption schemes from jointly secure combined public key schemes. We provide a construction that uses any such scheme to produce a triple of schemes -signature, encryption, and signcryption -that are jointly secure in an appropriate and strong security model.

Chosen Ciphertext Secure Keyed-Homomorphic Public-Key Encryption

“…This is a statistical property that roughly ensures that the "min-entropy" of the output of a function (for uniformly random input) is sufficiently high, and thus it is information-theoretically hard to guess the output of a function for random inputs. We also show that natural cryptographic functions, a one-way function (OWF), an always second-preimage resistant (aSec secure) hash function [41], and a key derivation function (KDF) [16], have the property, and thus in practice we can use (an appropriate modification of) cryptographic hash functions such as SHA-series).…”

“…We note that, besides the injective functions (with superpolynomially large domain) which are trivially smooth, the smoothness is in fact satisfied by several famous cryptographic functions such as OWFs, always second-preimage resistant (aSec secure) hash functions [41], and KDFs [16]; see Appendix A. Interestingly, the universal 2 property of the CS projective hash family is preserved by hashing its output to be a shorter element. Intuitively, for the CS projective hash family, the bound of the advantage of adversaries for the universal 2 property is closely related to the parameter for the underlying subset membership problem M, therefore the bound cannot be freely selected (e.g., the order of the group should be larger than a certain threshold relevant to the desired security level) since M must be hard.…”

“…In this section, we show that natural cryptographic functions, a one-way function (OWF), an always secondpreimage resistant (aSec secure) hash function [41], and a key derivation function (KDF) [16], are smooth in the sense of Definition 5.3.…”

Key-Versatile Signatures and Applications: RKA, KDM and Joint Enc/Sig

“…Practitioners ask if one can do better. We want a joint encryption and signature (JES) scheme [53,61], where there is a single key-pair (sk , pk ) used for both encryption and signing. We aim to minimize the public-key overhead, (loosely) defined as the size of pk minus the size of the public key pk e of the underlying encryption scheme.…”

“…In the random oracle model [17], specific IND-CCA-secure public-key encryption schemes have been presented where signing can be added with no public-key overhead [53,36,57]. In the standard model, encryption schemes have been presented that allow signing with a public-key overhead lower than that of the "Cartesian product" solution of just adding a separate signing key [53,61], with the best results, from [61], using IBE or combining encryption and signature schemes of [29,25].…”