Privacy‐preserving multireceiver ID‐based encryption with provable security

Abstract

Multireceiver identity (ID) based encryption and ID-based broadcast encryption allow a sender to use the public identities of multiple receivers to encrypt messages so that only the selected receivers or a privileged set of users can decrypt the messages. It can be used for many practical applications such as digital content distribution, pay-per-view and multicast communication. For protecting the privacy of receivers or providing receiver anonymity, several privacy-preserving (or anonymous) multireceiver ID-based encryption and ID-based broadcast encryption schemes were recently proposed, in which receiver anonymity means that nobody (including any selected receiver), except the sender, knows who the other selected receivers are. However, security incompleteness or flaws were found in these schemes. In this paper, we propose a new privacy-preserving multireceiver ID-based encryption scheme with provable security. We formally prove that the proposed scheme is semantically secure for confidentiality and receiver anonymity. Compared with the previously proposed anonymous multireceiver ID-based encryption and ID-based broadcast encryption schemes, the proposed scheme has better performance and robust security.In the following, we redefine the security notions of receiver anonymity including ANON-IND-sID-CPA and ANON-IND-sID-CCA security games in [11] that take into consideration a multireceiver setting.

Anonymous Multi-Receiver Identity-Based Authenticated Encryption with CCA Security

“…As a result, their proof does not cover all possible attackers. The comment is similar to that of [21].…”

“…The cryptanalysis on Wang et al's scheme [25] has been shown in [17,29]. In the same year, Tseng et al proposed an AMRIBE scheme and claimed that their scheme is CCA secure in both confidentiality and anonymity [21,22]. However, we found that they demonstrated the security without considering all possible attackers.…”

“…The scheme of [25] and the first scheme of [31] are CCA secure in confidentiality and anonymity against outsider attacks; however, the authors of [17,29] and [28], respectively, have shown that they are not with anonymity against insider attacks. In addition, we demonstrate that there exist some problems in the proofs of the schemes [21][22][23][26][27][28], where the details are shown in the Appendix. Our scheme is the first one that can achieve the CCA security under the random oracle model against outside attackers and inside attackers simultaneously.…”

“…In this section, we compare the proposed scheme to [10,11,14,16,[18][19][20][21]23,[25][26][27][28][29] and [31] in performance and security. According to [39][40][41] and [42], we can obtain that T p ≈ 5T e , T s ≈ 29T m , T e ≈ 240T m , T h ≈ 23T m and T a ≈ 0.12T m , shown in Table 2, which summarizes the comparison in the computation cost of encryption/decryption and the ciphertext length for multiple receivers.…”

“…This research will aim at anonymous multi-receiver ID-based encryption, which can be regarded as anonymous dynamic broadcast ID-based encryption. In this manuscript, we will discuss dynamic and ID-based schemes [10,11,14,16,[18][19][20][21]23,[25][26][27][28][29]31] and compare them to our work.…”