A Simple Public-Key Cryptosystem with a Double Trapdoor Decryption Mechanism and Its Applications

Bresson, Emmanuel; Catalano, Dario; Pointcheval, David

doi:10.1007/978-3-540-40061-5_3

Cited by 255 publications

(220 citation statements)

References 23 publications

Supporting

Mentioning

219

Contrasting

Unclassified

Order By: Relevance

“…We also broaden the set of constructions of trapdoor DDH groups. We propose a new construction based on composite residuosity in Z * N 2 (similar considerations have been made by [BCP03], albeit not in the formalism of TDDH groups), and identify under which hardness assumptions this group satisfies our definition. A drawback of this construction is that it lacks what we call perfect soundness, meaning that the algorithm solving the DDH problem with the trapdoor can sometimes err and declare valid a non-DH tuple.…”

Section: Contributions Of This Workmentioning

confidence: 93%

“…This group was first considered by Bresson, Catalano, and Pointcheval [BCP03], who noticed that when the factorization of N is publicly available, this constitutes a gap group, i.e. a group where the CDH problem is hard and the DDH problem is easy.…”

Section: A Tddh Group Based On Composite Residuositymentioning

confidence: 99%

“…In particular, on input a random tuple (X, Y, Z) ∈ (QR N 2 ) 3 , there is a negligible probability that Solve BCP accepts and yet (X, Y, Z) / ∈ DH G (this probability can easily be seen to be O(1/N ) [BCP03]). Moreover, given the trapdoor τ = (p, q), and two random elements (X, Y ) ∈ (QR N 2 ) 2 , it is easy to generate Z such that (X, Y, Z) / ∈ DH G and yet Solve BCP accepts on input (X, Y, Z): simply compute x = PDlog G (X) and y = PDlog G (Y ) and output G x y mod N .…”

Section: Theorem 1 Assuming That the Ddh Problem (Without The Factormentioning

confidence: 99%

See 2 more Smart Citations

New Constructions and Applications of Trapdoor DDH Groups

Seurin

2013

Public-Key Cryptography – PKC 2013

View full text Add to dashboard Cite

Abstract. Trapdoor Decisional Diffie-Hellman (TDDH) groups, introduced by Dent and Galbraith (ANTS 2006), are groups where the DDH problem is hard, unless one is in possession of a secret trapdoor which enables solving it efficiently. Despite their intuitively appealing properties, they have found up to now very few cryptographic applications. Moreover, among the two constructions of such groups proposed by Dent and Galbraith, only a single one based on hidden pairings remains unbroken. In this paper, we extend the set of trapdoor DDH groups by giving a construction based on composite residuosity. We also introduce a more restrictive variant of these groups that we name static trapdoor DDH groups, where the trapdoor only enables to solve the DDH problem with respect to a fixed pair (G, G x ) of group elements. We give two constructions for such groups whose security relies respectively on the RSA and the factoring assumptions. Then, we show that static trapdoor DDH groups yield elementary constructions of convertible undeniable signature schemes allowing delegatable verification. Using our constructions of static trapdoor DDH groups from the RSA or the factoring assumption, we obtain slightly simpler variants of the undeniable signature schemes of respectively Gennaro, Rabin, and Krawczyk (J. Cryptology, 2000) and Galbraith and Mao (CT-RSA 2003). These new schemes are conceptually more satisfying since they can strictly be viewed as instantiations, in an adequate group, of the original undeniable signature scheme of Chaum and van Antwerpen (CRYPTO '89).

show abstract

Section: Contributions Of This Workmentioning

confidence: 93%

Section: A Tddh Group Based On Composite Residuositymentioning

confidence: 99%

Section: Theorem 1 Assuming That the Ddh Problem (Without The Factormentioning

confidence: 99%

See 1 more Smart Citation

New Constructions and Applications of Trapdoor DDH Groups

Seurin

2013

Public-Key Cryptography – PKC 2013

View full text Add to dashboard Cite

show abstract

“…While our DDH-based realization only enables efficient decryption when the inner product x, y is contained in a sufficiently small interval, we show how to eliminate this restriction using Paillier's cryptosystem in the same way as in [21,20]. We thus obtain the first solution based on the Composite Residuosity assumption, which was previously an open problem (even in the case of selective security).…”

Section: Overview Of Techniquesmentioning

confidence: 97%

“…To this end, we use Paillier's cryptosystem [50] and the property that, for an RSA modulus N = pq, the multiplicative group Z * N 2 contains a subgroup of order N (generated by (N + 1)) in which the discrete logarithm problem is easy. We also rely on the observation [21,20] that combining the Paillier and Elgamal encryption schemes makes it possible to decrypt without knowing the factorization of N = pq.…”

Section: Constructions Based On Pailliermentioning

confidence: 99%

Fully Secure Functional Encryption for Inner Products, from Standard Assumptions

Agrawal

Libert

Stehlé

2016

Lecture Notes in Computer Science

192

158

View full text Add to dashboard Cite

Abstract. Functional encryption is a modern public-key paradigm where a master secret key can be used to derive sub-keys SKF associated with certain functions F in such a way that the decryption operation reveals F (M ), if M is the encrypted message, and nothing else. Recently, Abdalla et al. gave simple and efficient realizations of the primitive for the computation of linear functions on encrypted data: given an encryption of a vector y over some specified base ring, a secret key SKx for the vector x allows computing x, y . Their technique surprisingly allows for instantiations under standard assumptions, like the hardness of the Decision Diffie-Hellman (DDH) and Learning-with-Errors (LWE) problems. Their constructions, however, are only proved secure against selective adversaries, which have to declare the challenge messages M0 and M1 at the outset of the game. In this paper, we provide constructions that provably achieve security against more realistic adaptive attacks (where the messages M0 and M1 may be chosen in the challenge phase, based on the previously collected information) for the same inner product functionality. Our constructions are obtained from hash proof systems endowed with homomorphic properties over the key space. They are (almost) as efficient as those of Abdalla et al. and rely on the same hardness assumptions. In addition, we obtain a solution based on Paillier's composite residuosity assumption, which was an open problem even in the case of selective adversaries. We also propose LWE-based schemes that allow evaluation of inner products modulo a prime p, as opposed to the schemes of Abdalla et al. that are restricted to evaluations of integer inner products of short integer vectors. We finally propose a solution based on Paillier's composite residuosity assumption that enables evaluation of inner products modulo an RSA integer N = p · q. We demonstrate that the functionality of inner products over a prime field is powerful and can be used to construct bounded collusion FE for all circuits.

show abstract

Privacy‐friendly weighted‐reputation aggregation protocols against malicious adversaries in cloud services

Zhang

Xia

et al. 2014

Int J Communication

View full text Add to dashboard Cite

Reputation systems are used for evaluating trustworthiness of the users based on their feedback (i.e., votes) about each other. Such systems are particularly important for cloud service providers, as they allow them to collect and aggregate feedback on the past behavior of users. Weighted-reputation aggregation is a protocol, where the vote server has a weight vector E W D ¹w 1 ; w 2 ; ; w n º for all voters, each voter has a vote score y i , and they cooperate to compute P n iD1 w i y i . We call it 'privacy-friendly', if the respective inputs are kept private. In other words, a privacy-friendly weighted aggregation protocol is a secure evaluation for functionality WV W E W ; y 1 ; ; y n Á 7 ! P n iD1 w i y i ; ?; ; ? . In this work, we propose two privacy-friendly weighted-reputation aggregation protocols: one in semi-honest model and another one in malicious model. The latter protocol uses the cryptographic primitives of homomorphic encryption, verifiable encryption, and the proof of knowledge of a discrete logarithm. Our protocols need only two rounds of communications, which is very efficient in practice. Our protocols are secure against the collusion of at most n 2 malicious adversaries.

show abstract

A Simple Public-Key Cryptosystem with a Double Trapdoor Decryption Mechanism and Its Applications

Cited by 255 publications

References 23 publications

New Constructions and Applications of Trapdoor DDH Groups

New Constructions and Applications of Trapdoor DDH Groups

Fully Secure Functional Encryption for Inner Products, from Standard Assumptions

Privacy‐friendly weighted‐reputation aggregation protocols against malicious adversaries in cloud services

Contact Info

Product

Resources

About