Public-Key Encryption in the Bounded-Retrieval Model

Abstract

Abstract.We construct the first public-key encryption scheme in the Bounded-Retrieval Model (BRM), providing security against various forms of adversarial "key leakage" attacks. In this model, the adversary is allowed to learn arbitrary information about the decryption key, subject only to the constraint that the overall amount of "leakage" is bounded by at most bits. The goal of the BRM is to design cryptographic schemes that can flexibly tolerate arbitrarily leakage bounds (few bits or many Gigabytes), by only increasing the size of secret key proportionally, but keeping all the other parameters -including the size of the public key, ciphertext, encryption/decryption time, and the number of secret-key bits accessed during decryption -small and independent of . As our main technical tool, we introduce the concept of an IdentityBased Hash Proof System (IB-HPS), which generalizes the notion of hash proof systems of Cramer and Shoup [CS02] to the identity-based setting. We give three different constructions of this primitive based on: (1) bilinear groups, (2) lattices, and (3) quadratic residuosity. As a result of independent interest, we show that an IB-HPS almost immediately yields an Identity-Based Encryption (IBE) scheme which is secure against (small) partial leakage of the target identity's decryption key. As our main result, we use IB-HPS to construct public-key encryption (and IBE) schemes in the Bounded-Retrieval Model.

Leakage Resilient Fully Homomorphic Encryption

“…The model is described in, for example, the works [15,16]. Since an adversary can choose its leakage function after seeing the public key(s), in effect we consider functions that leak on the public and secret keys together.…”

“…Since an adversary can choose its leakage function after seeing the public key(s), in effect we consider functions that leak on the public and secret keys together. This framework has been previously considered for non-homomorphic public key and identity based encryption schemes based on bilinear groups, lattices, and quadratic residuosity [16,26,29]. Additionally, both RPKE and "dual Regev", schemes based on DLWE, can be made leakage resilient; Akavia, Goldwasser, and Vaikunatanathan achieve adaptive leakageresilient RPKE [15], and Dodis, Goldwasser, Kalai, Peikert, and Vaikuntanathan construct leakage-resilient "dual Regev" [19].…”

“…This has been an active topic of research over the past 15 years (see [15,16,17,18,19,20,21,22,23,24,25,26,13,14] and the references therein), resulting in many different leakage models, and cryptographic primitives such as public key encryption schemes and signature schemes secure in each model.…”

Efficient Leakage-Resilient Signature Schemes in the Generic Bilinear Group Model

“…Which means that designing algorithms such that their description already provides security against those attacks. Leakage-resilient cryptography is an increasingly active area in recent years and many leakage models have been proposed, such as only computation leaks information (OCLI) [19,21,27, 24], memory leakage [1,17], bounded retrieval [2,3,14], and auxiliary input models [15,21,20,34], etc. In this work, we design leakage-resilient signature schemes based on the following two leakage models:…”

Identity-Based Encryption Resilient to Continual Auxiliary Leakage

“…To sum up these two models, l is defined as a fraction of the key (either in terms of the bit size or the entropy). The bounded retrieval model (e.g., see [2,8]), on the other hand, treats the leakage l as a system parameter. The size of the secret key can be increased to allow l bits of leakage, without affecting the public key size, communication and computation efficiency.…”