Efficient (Anonymous) Compact HIBE from Standard Assumptions

Abstract

Abstract. We present two hierarchical identity-based encryption (HIBE) schemes, denoted as H1 and H2, from Type-3 pairings with constant sized ciphertexts. Scheme H1 achieves anonymity while H2 is non-anonymous. The constructions are obtained by extending the IBE scheme recently proposed by Jutla and Roy (Asiacrypt 2013). Security is based on the standard decisional Symmetric eXternal Diffie-Hellman (SXDH) assumption. In terms of provable security properties, previous direct constructions of constant-size ciphertext HIBE had one or more of the following drawbacks: security in the weaker model of selective-identity attacks; exponential security degradation in the depth of the HIBE; and use of non-standard assumptions. The security arguments for H1 and H2 avoid all of these drawbacks. These drawbacks can also be avoided by obtaining HIBE schemes by specialising schemes for hierarchical inner product encryption; the downside is that the resulting efficiencies are inferior to those of the schemes reported here. Currently, there is no known anonymous HIBE scheme having the security properties of H1 and comparable efficiency. An independent work by Chen and Wee describes a non-anonymous HIBE scheme with security claims and efficiency similar to that of H2; we note though that in comparison to H2, the Chen-Wee HIBE scheme has larger ciphertexts and less efficient encryption and decryption algorithms. Based on the current state-of-the-art, H1 and H2 are the schemes of choice for efficient implementation of (anonymous) HIBE constructions.

Efficient identity-based encryption with Hierarchical key-insulation from HIBE

“…The overview of the bug To the authors' credit, the SW18 scheme is the same as our first construction instantiated by [46]. It means that the flaw is due to the proof methodology they employed, not their construction.…”

“…Proof of [52] The HKIBE challenge ciphertext ct id ,t can be regarded as a ciphertext for (id , T [L−1,0] (t )) in the HIBE scheme proposed by [46]. The randomness of the challenge ciphertext ct id ,t := C (id ,T [L−1,0] (t )) is correlated to the randomness of level-helper keys hk ( ) id,T (t) for the key-insulation query on (id , t, ) such that > .…”

“…To be precise, an instantiation from[46], which is a special case of[17], is the same as Shikata and Watanabe's scheme[52]. It means that their scheme turns out to be secure, and we successfully fix the bug in their security proof 5.…”

Privacy Protection and Data Security in Cloud Computing: A Survey, Challenges, and Solutions

“…Because of static assumption, a nested two-system encryption parameter was adopted to prove complete security. Reference [75] proposed a hierarchical identity-based encryption (HIBE) scheme which was represented by scheme H1 and H2. In terms of provable security attributes, the direct construction of ciphertext of HIBE has one or more shortcomings, such as the security of selective identity attacks.…”

“…• Constructing new ABE schemes: identity-based encryption scheme can be constructed by bilinear pairing, quadratic residue, lattice theory. ABE is widely regarded as the generalization and extension of IBE, but it only consists bilinear pairs which have limitations in efficiency [75].…”