Achieving Multi-Hop PRE via Branching Program

Proxy re-encryption (<inline-formula><tex-math notation="LaTeX">$\mathsf {PRE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PRE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq1-2764082.gif"/></alternatives></inline-formula>) is a fundamental cryptographic primitive in secure data sharing and e-mail forwarding, etc. To our knowledge, most existing efficient lattice-based <inline-formula><tex-math notation="LaTeX">$\mathsf {PRE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PRE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq2-2764082.gif"/></alternatives></inline-formula> schemes focus on the construction of single-hop, key-private, multi-bit and chosen-ciphertext attack (<inline-formula><tex-math notation="LaTeX">$\text{CCA}$</tex-math><alternatives><mml:math><mml:mtext>CCA</mml:mtext></mml:math><inline-graphic xlink:href="wang-ieq3-2764082.gif"/></alternatives></inline-formula>), etc. Few works of literature discussed the detailed multi-hop construction over lattices. Very recently, Chandran et al. (PKC'14) proposed a lattice-based <inline-formula><tex-math notation="LaTeX">$\mathsf {PRE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PRE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq4-2764082.gif"/></alternatives></inline-formula> scheme that builds upon the key switching mechanism of Brakerski (CRYPTO'12), and pointed out that their scheme can achieve multi-hop <inline-formula><tex-math notation="LaTeX">$\mathsf {PRE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PRE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq5-2764082.gif"/></alternatives></inline-formula> scheme by the ideal circuit family for a directed graph <inline-formula><tex-math notation="LaTeX">$G$</tex-math><alternatives><mml:math><mml:mi>G</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq6-2764082.gif"/></alternatives></inline-formula>. In this paper, we are still working along this line and achieving multi-hop <inline-formula><tex-math notation="LaTeX">$\mathsf {PRE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PRE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq7-2764082.gif"/></alternatives></inline-formula> via the branching program (<inline-formula><tex-math notation="LaTeX">$\mathsf {BP}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">BP</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq8-2764082.gif"/></alternatives></inline-formula>), which is one type of NC1 circuit and can be used to compute encrypted data. To our knowledge, we proposed the first multi-hop <inline-formula><tex-math notation="LaTeX">$\mathsf {PRE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PRE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq9-2764082.gif"/></alternatives></inline-formula> scheme via <inline-formula><tex-math notation="LaTeX">$\mathsf {BP}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">BP</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq10-2764082.gif"/></alternatives></inline-formula> which supports homomorphic evaluation. We also analyze the security of our scheme under decisional learning with errors (<inline-formula><tex-math notation="LaTeX">$\mathsf {LWE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">LWE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq11-2764082.gif"/></alternatives></inline-formula>) assumption.