New Constructions of Identity-Based Dual Receiver Encryption from Lattices

Abstract

Dual receiver encryption (DRE), being originally conceived at CCS 2004 as a proof technique, enables a ciphertext to be decrypted to the same plaintext by two different but dual receivers and becomes popular recently due to itself useful application potentials such secure outsourcing, trusted third party supervising, client puzzling, etc. Identity-based DRE (IB-DRE) further combines the bilateral advantages/facilities of DRE and identity-based encryption (IBE). Most previous constructions of IB-DRE are based on bilinear pairings, and thus suffers from known quantum algorithmic attacks. It is interesting to build IB-DRE schemes based on the well-known post quantum platforms, such as lattices. At ACISP 2018, Zhang et al. gave the first lattice-based construction of IB-DRE, and the main part of the public parameter in this scheme consists of 2 n + 2 matrices where n is the bit-length of arbitrary identity. In this paper, by introducing an injective map and a homomorphic computation technique due to Yamada at EUROCRYPT 2016, we propose another lattice-based construction of IB-DRE in an even efficient manner: The main part of the public parameters consists only of 2 p n 1 p + 2 matrices of the same dimensions, where p ( ≥ 2 ) is a flexible constant. The larger the p and n, the more observable of our proposal. Typically, when p = 2 and n = 284 according to the suggestion given by Peikert et al., the size of public parameters in our proposal is reduced to merely 12% of Zhang et al.’s method. In addition, to lighten the pressure of key generation center, we extend our lattice-based IB-DRE scheme to hierarchical scenario. Finally, both the IB-DRE scheme and the HIB-DRE scheme are proved to be indistinguishable against adaptively chosen identity and plaintext attacks (IND-ID-CPA).

A Pairing Free Provable Public Key Dual Receiver Encryption Scheme

“…Based on the results obtained in [3], a suggestion of two extended constructions for identity based DRE and PK-DRE based on lattice was introduced in [4]. The work in [5] presented the notion of hierarchical ID-DRE. However, as mentioned above, the lattice based DRE schemes encounter the problem of large key size and do not corroborate public demonstrability.…”

An Efficient Public-Key Dual-Receiver Encryption Scheme

“…Based on this result, Liu et al [11] proposed two generic constructions for PK-DRE and identity-based DRE by using (weak) lattice-based programmable hash functions with high min-entropy. Recently, Liu et al [12] improved the result in [10] and proposed the concept of hierarchical identity-based DRE along with a concrete scheme. However, none of the above lattice-based schemes support public verifiability, and all of them suffer from the large key size problem.…”

“…Since then, many PK-DRE schemes with different properties have been proposed. Generally speaking, the existing PK-DRE schemes can be classified into two categories according to the underlying complexity assumptions, namely pairing-based [6]- [9] and lattice-based [10]- [12]. The former one is usually preferable for practical use for the following reasons.…”

“…As mentioned in [7], public verifiability is useful in many applications, such as threshold decryption. • The key size of lattice-based schemes is usually quite large, and it is even as large as several megabytes in some cases [12]. This situation hinders the use of latticebased PK-DRE in some storage-limited settings, such as internet of things.…”