Self-updatable encryption with short public parameters and its extensions

Abstract

Cloud storage is very popular since it has many advantages, but there is a new threat to cloud storage that was not considered before. Self-updatable encryption that updates a past ciphertext to a future ciphertext by using a public key is a new cryptographic primitive introduced by Lee, Choi, Lee, Park, and Yung (Asiacrypt 2013) to defeat this threat, in which an adversary who obtained a past private key can still decrypt a (previously unread) past ciphertext stored in cloud storage. Additionally, an SUE scheme can be combined with an attribute-based encryption (ABE) scheme to construct a powerful revocable-storage ABE (RS-ABE) scheme introduced by Sahai, Seyalioglu, and Waters (Crypto 2012) that provides the key revocation and ciphertext updating functionality for cloud storage. In this paper, we propose an efficient SUE scheme and its extended schemes. First, we propose an SUE scheme with short public parameters in prime-order bilinear groups and prove its security under a q-type assumption. Next, we extend our SUE scheme to a time-interval SUE (TI-SUE) scheme that supports a time interval in ciphertexts. Our TI-SUE scheme has short public parameters and it is also secure under the q-type assumption. Finally, we propose the first large universe RS-ABE scheme with short public parameters in prime-order bilinear groups and prove its security in the selective revocation list model under a q-type assumption.

Fully Secure Self-Updatable Encryption in Prime Order Bilinear Groups

“…As in [10], [9], we use a full binary tree T to represent time in our SUE scheme by assigning time periods to all tree nodes. In the full binary tree T , each node (internal node or leaf node) is assigned a unique time value by using pre-order tree traversal that recursively visits the root node, the left subtree, and the right subtree; i.e., the root node of T is associated with 0 time value and the right most leaf node of T is associated with 2 dmax+1 − 2 time value where d max is the maximum depth of the tree.…”

“…Table 1 and 2 present the comparison between our fully secure SUE scheme and that of [10], the only SUE scheme with full security available in the literature, in terms of communication together with storage and computation respectively. The other previously known SUE schemes, viz., the prime order constructions of [10], [9] are only selectively secure and hence we do not consider them for efficiency comparison. Let us first concentrate on the communication and …”

“…However, as pointed out by Freeman [7] and Lewko [11], group operations and pairing computations are prohibitively slow in composite order bilinear groups as compared to prime order bilinear groups with an equivalent level of security. Although, SUE in prime order bilinear groups are proposed in [10], [9] under standard assumptions those are only selectively secure. We note that the work of Sahai et al [15] can be viewed as a restricted form of SUE but their constructions are highly customized for ABE.…”

“…As in [10], [9], in order to make the ciphertext and private key sizes of our SUE scheme polylogarithmic in terms of the maximum time period supported by the system, we employ a full binary tree to efficiently manage the time structure in the system. We assign a time value to each node of the full binary tree.…”

“…This is not a trivial task. Unlike [10], [9], the decryption algorithm of our SUE scheme does not involve repeated application of the ciphertext update algorithm to convert a ciphertext associated with a previous time to a ciphertext corresponding to the time associated with the private key used for decryption, resulting in a much faster decryption.…”