Public-Key Encryption with Lazy Parties

Abstract

In a public-key encryption scheme, if a sender is not concerned about the security of a message and is unwilling to generate costly randomness, the security of the encrypted message can be compromised. In this work, we characterize such lazy parties, who are regraded as honest parties, but are unwilling to perform a costly task when they are not concerned about the security. Specifically, we consider a rather simple setting in which the costly task is to generate randomness used in algorithms, and parties can choose either perfect randomness or a fixed string. We model lazy parties as rational players who behave rationally to maximize their utilities, and define a security game between the parties and an adversary. Since a standard secure encryption scheme does not work in the setting, we provide constructions of secure encryption schemes in various settings.

Repeated Games for Generating Randomness in Encryption

“…We present a round-efficient scheme based on a mechanism of repeated games. Specifically, we construct a secure two-round scheme in the setting for which a three-round scheme was presented in [9]. The scheme is the first two-round scheme in the setting where the receiver may know the value of a message to be sent.…”

“…The scheme is the first two-round scheme in the setting where the receiver may know the value of a message to be sent. Since non-interactive schemes cannot be secure [9], the scheme achieves the optimal round complexity.…”

“…Our security model is based on the study of [9]. We define a variant of chosen plaintext attack (CPA) game of encryption schemes.…”

“…There are many studies using game-theoretic analysis for cryptographic primitives, including secret sharing [10]- [19], two-party protocols [20]- [22], public-key encryption [9], leader election [23], [24], Byzantine agreement [25], delegation of computation [26]- [30], and protocol design [31], [32]. Among them, repeated games have been introduced only in rational secret sharing [33].…”

“…The problem of such rationality was studied in [9] for public-key encryption schemes. For the first step to understand the behavior of such rational parties, the author considered a simple setting in which rational senders and receivers can choose either good randomness and bad randomness.…”