On the Construction of Public Key Encryption with Sender Recovery

Abstract

This paper investigates public key encryption that has a desirable feature of allowing the sender of a ciphertext to recover the original plaintext from the ciphertext without relying on a recipient's private decryption key (PKE-SR). We propose two efficient methods for converting KEM/DEM (key encapsulation mechanisms/data encapsulation mechanisms) to PKE-SR. The first method, called pre-KEM seeding, can be applied to a large class of KEM/DEM constructions including those based on the discrete logarithm problem. Following the idea of pre-KEM seeding, we propose an efficient PKE-SR using DHIES, which has only one more additional element of length 160-bit in ciphertext than that of the original DHIES. Furthermore, we show that PKE-SR can be constructed from identity based encryptions using the method of pre-KEM seeding. The second method, called post-KEM converging, is more powerful and can be employed to convert any secure KEM/DEM into a secure PKE-SR. Post-KEM converging takes advantages of an interesting property, called collision accessibility, of sibling intractable hashing. For both methods, added costs in ciphertext length and computation are minimal, making them a particularly attractive "drop-in" replacement in applications where plaintexts need to be recovered efficiently by the sender alone. We further explore the problem of constructing PKE-SR without redundancy and show such a construction for one-bit encryptions.the ciphertext, without relying on the private decryption key of the intended recipient. This notion was first introduced by Wei et al. in [18] and called public key encryption with backward recovery. In this paper we continue this line of research. As backward recovery is implied by decryption by sender, we will instead use the term of public key encryption with sender recovery, or PKE-SR for short.One can think of many practical applications of PKE-SR, thanks to its property of allowing the sender to decrypt a ciphertext by herself alone without the need to use a recipient's private decryption key. One example of such applications is secure email communication. Consider a situation where Alice the sender encrypts a message m under the public key of Bob the receiver and passes the resultant ciphertext c to Bob while keeping an identical copy of the ciphertext in a "Sent" folder on Alice's email server which may physically reside in an insecure computing "cloud". We note that other than the ciphertext, Alice may not keep an additional copy of the original message m. At a later time, Alice realizes that she needs to access m which lies in the "Sent" folder albeit in an encrypted form. By the virtue of traditional public key encryption, the only way to get m back is for Alice to ask Bob to decrypt the ciphertext with Bob's decryption key, which may be impractical or undesirable from either Alice or Bob's point of view. This dilemma is readily avoided if Alice and Bob employ PKE-SR we propose in this article.In [18], Wei et al. define a security model for PKE-SR and present two methods of constru...

Vulnerabilities in Public Key Cryptography

“…In the past decades, symmetric cryptography was the primary technology to encrypt the data, but it lacks in exchanging the secret private key securely. To overcome the drawbacks of the symmetric cryptography, researchers invented public key cryptography [1].…”