Practical chosen-ciphertext secure Hierarchical Identity-Based Broadcast Encryption

Abstract

We focus on practical Hierarchical IdentityBased Broadcast Encryption (HIBBE) with semantic security against adaptively chosen-ciphertext attacks (CCA2) in the standard model. We achieve this goal in two steps. First, we propose a new HIBBE scheme that is secure against chosenplaintext attacks (CPA). Compared with the existing HIBBE scheme that is built from composite-order bilinear groups, our construction is based on prime-order bilinear groups. The much better efficiency of group operations in prime-order bilinear groups makes our proposed HIBBE scheme more practical. Then, we convert it into a CCA2-secure scheme at the cost of a one-time signature. Instead of extending one user hierarchy in the Canetti-Halevi-Katz approach from CPA-secure (l + 1)-Hierarchical Identity-Based Encryption [(l + 1)-HIBE] to CCA2-secure l-HIBE, our construction merely adds one on-the-fly dummy user in the basic scheme. B Qianhong WuWe formally prove the security of these two schemes in the standard model. Comprehensive theoretical analyses and experimental results demonstrate that the proposed HIBBE schemes achieve desirable performance.

Revocable hierarchical identity-based broadcast encryption

“…However, the scheme is constructed on composite bilinear group. To improve the efficiency of HIBBE, Liu et al [21] presented a practical chosenciphertext secure HIBBE scheme. Since then, several subsequent works focused on improving efficiency or security of HIBBE [22][23][24][25] .…”

“…The .t; ; n/-decisional n-wBDHI assumption holds in G if there is no algorithm that has advantage of at least in solving the decisional n-wBDHI problem in polynomial time t [21] .…”

An Efficient Broadcast Encryption Supporting Designation and Revocation Mechanisms

“…The simulator B randomly picks σ ∈ {0, 1}, and simulates the Encrypt algorithm to acquire C R * and the ciphertext of m σ as follows: with the known G t , the ciphertext C R * = (C 0 , C 1 ) can be computed as Eq. (9).…”

“…They proposed an adaptive Chosen-ciphertext attacks (CCA) secure scheme based on standard assumptions, which has ciphertexts that are shorter than those of the previous CCA secure schemes. Besides these above-mentioned schemes, there are some other researches about designation mechanism over BE on efficiency [6,7] and security [8,9] .…”

An Efficient and Secure Data Sharing Method Using Asymmetric Pairing with Shorter Ciphertext to Enable Rapid Learning in Healthcare

“… Hierarchical broadcast encryption: this variant of BE is constructed on pairing based cryptographic primitive that enables key delegation property to subsequent descendants in the hierarchical system. This was first proposed by [ 20 ] for identity-based BE scheme. The later scheme is IND-CCA secure with constant ciphertext size in standard model.…”