Universal Re-encryption for Mixnets

Abstract

We introduce a new cryptographic technique that we call universal re-encryption. A conventional cryptosystem that permits re-encryption, such as ElGamal, does so only for a player with knowledge of the public key corresponding to a given ciphertext. In contrast, universal reencryption may be performed without knowledge of public keys. We demonstrate an asymmetric cryptosystem with universal re-encryption that is half as efficient as standard ElGamal in terms of both computation and storage. While technically and conceptually simple, universal re-encryption leads to new types of functionality in mixnet architectures. Conventional mixnets are often called upon to enable players to communicate with one another through channels that are externally anonymous, i.e., that hide information permitting traffic-analysis. Universal re-encryption permits a mixnet of this kind to be constructed in which servers hold no public or private keying material, and may therefore dispense with the cumbersome requirements of key generation, key distribution, and private-key management. We describe two practical mixnet constructions, one involving asymmetric input ciphertexts, and another with hybrid-ciphertext inputs.

Accountable Metadata-Hiding Escrow: A Group Signature Case Study

“…We randomize a key by computing C(1; r * r ) for a random r (this can be computed using ⊗ by square-and-multiply). Encryption corresponds to computing C(m; r + s) by multiplying a freshly randomized public key C(1; r + s) with the ciphertext C(m; 0), i.e., the message encrypted with randomness zero-see also [11].…”

Efficient Unidirectional Proxy Re-Encryption

“…Another notion with a similar name is universal re-encryption [GJJS04], in which the ciphertexts are re-randomized, but the underlying public keys are not changed as in PRE.…”

A Scalable and Untraceable Authentication Protocol for RFID

“…There have been many papers which are hash-based [2,4,3,5,7,9,14,15,17], pseudonym-based [1,12], zero knowledge-based [16] using PUF(Physical Unclonable Function), and tree-based protocol [8] using pseudonym generator that attempts to address the security concerns raised as using RFID tags, but it is believed that there is no perfect protocol that avoids all of the threats with reasonably low cost until now. Hash Lock Scheme [14](denoted by "HLS") is based on one-way hash function; HLS is traceable.…”

“…Ohkubo et al protocol [9](denoted by "OSK") is untraceable, but unscalable. Wong et al [6] and Tuyls et al protocol [16] can be traceable; and also, pseudonym-based protocols [1,12] can be traceable after A collects all of the pseudonyms.…”