Unbounded HIBE with Tight Security

Abstract

We propose the first tightly secure and unbounded hierarchical identity-based encryption (HIBE) scheme based on standard assumptions. Our main technical contribution is a novel proof strategy that allows us to tightly randomize user secret keys for identities with arbitrary hierarchy depths using low entropy hidden in a small and hierarchy-independent master public key.The notion of unbounded HIBE is proposed by Lewko and Waters (Eurocrypt 2011). In contrast to most HIBE schemes, an unbounded scheme does not require any maximum depth to be specified in the setup phase, and user secret keys or ciphertexts can be generated for identities of arbitrary depths with hierarchy-independent system parameters.While all the previous unbounded HIBE schemes have security loss that grows at least linearly in the number of user secret key queries, the security loss of our scheme is only dependent on the security parameter, even in the multi-challenge setting, where an adversary can ask for multiple challenge ciphertexts. We prove the adaptive security of our scheme based on the Matrix Decisional Diffie-Hellman assumption in prime-order pairing groups, which generalizes a family of standard Diffie-Hellman assumptions such as k-Linear.

Authenticated Key Exchange and Signatures with Tight Security in the Standard Model

“…Game H 2,c,1 : In H 2,c,1 , instead of generating a random t in O Mac , we choose t from Span(B B 0 ) (if hm j+1 = 0) or Span(B B 1 ) (if hm j+1 = 1). This is the same step as Lemma 17 of [29]. By basis for Z 3k q basis for Span(B ⊥ )…”

“…To overcome this issue, we borrow recent techniques from tightly-secure hierarchical identitybased encryption schemes [28,29] to construct a new MAC scheme that can be proven tightly secure under adaptive corruptions. Our construction is based on pairings and general random self-reducible matrix Diffie-Hellman (MDDH) assumptions [18].…”

Chopsticks: Fork-Free Two-Round Multi-signatures from Non-interactive Assumptions

“…By its random self-reducibility [EHK + 13, Lemma 1], the 2-fold U 3,1 -Matrix-DDH (MDDH) assumption (namely, the uDDH3 assumption) is tightly equivalent to the U 3,1 -MDDH assumption. By Lemma 1 in [LP20], U 3,1 -MDDH is tightly equivalent to U 1 -MDDH that is the DDH assumption. Hence, the DDH and uDDH3 assumptions are tightly equivalent.…”

Boosting CPA to CCA2 for Leakage-Resilient Attribute-Based Encryption by Using New QA-NIZK

“…On the other hand, in [15], [27], [28], the authors showed a CPA-to-CCA2 transformation for (not leakageresilient) IBE schemes by using a simulation-sound (tagbased) QA-NIZK argument for linear subspaces. At first glance, thanks to the public verifiability of the QA-NIZK argument, their approach seems to provide LR-CCA2-secure schemes by only replacing the CPA-secure schemes with LR-CPA-secure ones.…”