New Techniques for Dual System Encryption and Fully Secure HIBE with Short Ciphertexts

Abstract

Abstract. We construct a fully secure HIBE scheme with short ciphertexts. The previous construction of Boneh, Boyen, and Goh was only proven to be secure in the selective model, under a non-static assumption which depended on the depth of the hierarchy. To obtain full security, we apply the dual system encryption concept recently introduced by Waters. A straightforward application of this technique is insufficient to achieve short ciphertexts, since the original instantiation of the technique includes tags that do not compress. To overcome this challenge, we design a new method for realizing dual system encryption. We provide a system in composite order groups (of three primes) and prove the security of our scheme under three static assumptions.

Tools for Simulating Features of Composite Order Bilinear Groups in the Prime Order Setting

“…For example, the systems presented in [27,25,29,28,26] provide diverse and advanced functionalities like identity-based encryption (IBE), hierarchical identity-based encryption (HIBE), and attribute-based encryption with strong security guarantees (e.g. full security, leakage-resilience) proven from static assumptions.…”

“…A reduction to DLIN is only provided for the most basic variant of the subgroup decision assumption, and does not extend (for example) to the general subgroup decision assumption from [3]. Second, the step of translating the proof fails for many schemes, including all of the recent composite order schemes employing the dual system encryption proof methodology [27,25,29,28,26]. These schemes use only canceling and not projecting, and so this is unrelated to the limitations discussed in [30].…”

“…As Freeman points out, "the recent identity-based encryption scheme of Lewko and Waters [27] uses explicitly in its security proof the fact that the group G has two subgroups of relatively prime order". The major obstacle here is not translating the description of the scheme or its assumptions -instead the problem lies in translating a trick in the security proof.…”

“…This includes schemes like [27], which could not be handled by Freeman's methods. Our tools are based in the dual pairing vector space framework initiated by Okamoto and Takashima [31,32].…”

Doubly spatial encryption from DBDH

“…The DBDH assumption is extremely appealing in its simplicity: the assumption is simple to state, the ensuing schemes as well as the proof of security are typically extremely simple too; these schemes have also been standardized [8]. Furthermore, we continue to draw on the techniques developed in these early works: the development of lattice-based (hierarchical) identitybased encryption ((H)IBE) schemes in [11,1,2] parallel corresponding DBDH-based schemes in [10,4,20] and the simplest instantiations of the dual system encryption framework in [16,17] proceed by "embedding" prior DBDH-based schemes into composite-order groups. The fundamental role that the DBDH assumption plays in functional encryption motivates us to understand the limitations on the functionalities that we can realize from the DBDH assumption: namely,…”