Homomorphic signcryption with public plaintext‐result checkability

IET Information SecurityVolume 15, Issue 5 p. 333-350 ORIGINAL RESEARCH PAPEROpen Access Homomorphic signcryption with public plaintext-result checkability Shimin Li, Westone Cryptologic Research Center, Westone Information Industry Inc., Beijing, China State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, ChinaSearch for more papers by this authorBei Liang, Corresponding Author lbei@chalmers.se Yanqi Lake Beijing Institute of Mathematical Sciences and Applications, Beijing, China Correspondence Bei Liang, Yanqi Lake Beijing Institute of Mathematical Sciences and Applications, Beijing, 101408, China. Email: lbei@chalmers.seSearch for more papers by this authorAikaterini Mitrokotsa, Department of Computer Science and Engineering, Chalmers University of Technology, Gothenburg, Sweden School of Computer Science, University of St. Gallen, St. Gallen, SwitzerlandSearch for more papers by this authorRui Xue, State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, ChinaSearch for more papers by this author Shimin Li, Westone Cryptologic Research Center, Westone Information Industry Inc., Beijing, China State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, ChinaSearch for more papers by this authorBei Liang, Corresponding Author lbei@chalmers.se Yanqi Lake Beijing Institute of Mathematical Sciences and Applications, Beijing, China Correspondence Bei Liang, Yanqi Lake Beijing Institute of Mathematical Sciences and Applications, Beijing, 101408, China. Email: lbei@chalmers.seSearch for more papers by this authorAikaterini Mitrokotsa, Department of Computer Science and Engineering, Chalmers University of Technology, Gothenburg, Sweden School of Computer Science, University of St. Gallen, St. Gallen, SwitzerlandSearch for more papers by this authorRui Xue, State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, ChinaSearch for more papers by this author First published: 02 May 2021 https://doi.org/10.1049/ise2.12026AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onEmailFacebookTwitterLinked InRedditWechat Abstract Signcryption originally proposed by Zheng (CRYPTO′97) is a useful cryptographic primitive that provides strong confidentiality and integrity guarantees. This article addresses the question whether it is possible to homomorphically compute arbitrary functions on signcrypted data. The answer is affirmative and a new cryptographic primitive, homomorphic signcryption (HSC) with public plaintext-result checkability is proposed that allows both to evaluate arbitrary functions over signcrypted data and makes it possible for anyone to publicly test whether a given ciphertext is the signcryption of the message under the key. Two notions of message privacy are also investigated: weak message privacy and message privacy depending on whether the original signcryptions used in the evaluation are disclosed or not. More precisely, the contributions are two-fold: (i) two different definitions of HSC with public plaintext-result checkability is provided for arbitrary functions in terms of syntax, unforgeability and message privacy depending on if the homomorphic computation is performed in a private or in a public evaluation setting, (ii) two HSC constructions are proposed: one for a public evaluation setting and another for a private evaluation setting and security is formally proved. 1 INTRODUCTION Often in secure communications, one may want to send a message that is not only concealed (i.e., readable only by the intended receiver) but also authenticated (i.e., possible to verify that the message originates from the indicated sender) and it has not been modified while being transferred. Signcryption originally proposed by Zheng [1] is a useful cryptographic primitive that can provide strong confidentiality as well as authentication guarantees. Unlike naively combining two different cryptographic primitives (encryption and digital signatures), signcryption results in faster computation and shorter message expansion. It can be viewed as the public-key version of the symmetric-key primitive known as authenticated encryption. More precisely, let us consider an example for signcryption in the two-user setting. In this case, the sender (Alice) generates her own secret signing and public verification key pair ( s k S , p k S ) and the receiver (Bob) generates his own secret decryption and public encryption key pair s k R , p k R . The sender performs the signcryption algorithm by taking as input its secret key s k S , the receiver's public key p k R , and a message m and outputs a signcryption ciphertext C to the receiver. After receiving the signcryption C, the receiver performs unsigncryption on C by using his secret key s k R and the sender's public key p k S , and outputs either m or ⊥, which indicates that the message was not encrypted or signed properly. Motivated by the ground-breaking work of how to homomorphically perform arbitrary computations over encrypted data, known as fully homomorphic encryption (FHE) (e.g. [2-5]) as well as how to compute functions on signed data known as homomorphic signatures (HS) (e.g. [6-9]); we address the question whether it is possible to homomorphically compute arbitrary functions on signcrypted data in this article. 1.1 Our Motivation Rezeibagha et al. [10] introduced the concept of an additive homomorphic signcryption and gave a concrete construction, which is proven to be secure against chosen plaintext attacks (IND-CPA) and achieves weak unforgeability under the DDH assumption and the CDH assumption, respectively. However, the notion of homomorphic signcryption (HSC) proposed in [10], is only limited in additive operations and is not general to capture homomorphic evaluations for any function. Furthermore, Rezaeibagha et al.’s additive HSC scheme allows only private verification of the derived (homomorphically computed) signcryptions, that is, the verification can only be performed by the intended receiver. Moreover, it only achieves weak unforgeability, which requires that the adversary is not allowed to perform signcryption queries to the challenger. In this article, we go beyond the additive homomorphic signcryption notion and introduce new primitive homomorphic signcryptions for any function, which allows computations for any function (arbitrary circuits) on the signcrypted data and provides public plaintext-result checkability for the derived signcryptions. We also investigate how to define the message privacy notion in the homomorphic evaluation setting. Informally, an example of performing computations on signcrypted data can be described as follows (depicted in Figure 1). The sender (Alice) has a dataset m1, …, mk of size k, for instance, the weights of k persons. For convenience, we write m ⃗ ≔ ( m 1 , … , m k ) . She independently signcrypts each data mi associated with a tag and an index using her secret key s k S and the receiver's (Bob) public key s k R . Namely, Alice signcrypts the triple (‘weight’, mi, i) for i = 1, …, k and obtains k independent signcryptions c1, …, ck, where i is the index of mi in the dataset and ‘weight’ serves as a tag that names the dataset. For simplicity, we write c ⃗ ≔ ( c 1 , … , c k ) . However, restricted by limited computational resources and space, Alice uploads her signcryptions c ⃗ to a powerful server and delegates the (expensive and complicated) computation of the function f to the server using an evaluation key e k. To compute a function f, the server employs the algorithm E v a l u a t e that uses c ⃗ and f to derive a signcryption cf,y on the triple: “ w e i g h t ” , y : = f ( m 1 , … , m k ) , 〈 f 〉 , where 〈f〉 is a string describing the function f uniquely. Note that E v a l u a t e does not require access to the original dataset m ⃗ but only works on the signcryptions themselves. FIGURE 1Open in figure viewerPowerPoint An example of using the homomorphic signcryption scheme Then, the server may send the derived signcryption cf,y to Bob. Bob using his secret key s k R together with Alice's public key p k S can obtain the message y. Given the pair (y, cf,y), anyone can check with the public verification key v k that the server correctly applied f to the dataset by verifying that cf,y is a valid signcryption on a given triple “ w e i g h t ” , f ( m ⃗ ) , 〈 f 〉 , without performing the expensive computations of the function f on the original dataset m ⃗ , to compute the value y. The verification on a pair (y, cf,y) achieves public plaintext-result checkability by allowing anyone to test whether a derived signcryption cf,y is a signcryption of the result y which is the correct output of the computation f over Alice's data that is, y = f ( m ⃗ ) . We describe the precise definitions of the syntax and the security later. 1.2 Our contributions In this article, we introduce for the first time the notion of homomorphic signcryption with public plaintext-result checkability that can evaluate arbitrary circuits over signcrypted data. We also define security notions in terms of both unforgeability and message privacy. We give two definitions for HSC depending on whether the homomorphic computation process is performed publicly (i.e., by anyone who has access to the public information) or privately (i.e., only by the one knowing the secret evaluation key), while in both cases the plaintext-result-checkability is performed publicly. For each case of public or private evaluation, we provide a construction and prove its security regarding unforgeability as well as message privacy. Next, let us briefly describe the two important properties – namely, public plaintext-result-checkability and message privacy, which our homomorphic signcryption enjoys. Public Plaintext-Result Checkability. It is to be noted that in a traditional signcryption scheme, by employing the unsigncryption algorithm (that uses the receiver's secret key) on the signcrypted data, either the original message m ⃗ or ⊥ is returned *. We notice that the signcryption allows a specific user having access to the receiver's secret key, to test whether a given signcryption originates from the given message under the sender's public key. In our homomorphic signcryption primitive, we go beyond the plaintext-result checkability for a specified user, and provide a functionality of public plaintext-result checkability that anyone can test whether a (either derived or original) signcryption is the signcryption of a given message (possibly the outcome of a function) under the sender's public key. Looking ahead, we will see that such public plaintext-result checkability is achieved by a verification algorithm. Message Privacy. Message privacy in the original (traditional) signcryption [1] means that even if the sender's private key is leaked to an attacker, the attacker cannot tell which message the signcryption challenge c* is corresponding to, m0 or m1 that are chosen by the attacker. In our proposed HSC, we achieve a notion of message privacy, which guarantees that even if we publish the pair (cf,y, y), where cf,y certifies y as the output of some computation f over a dataset m ⃗ , no information is revealed about the data m ⃗ , beyond what is revealed by y and f. Our definition for message privacy is presented in a way that given signcryptions on m ⃗ b (where b ∈{0, 1} and thus m ⃗ b is one of two different datasets m ⃗ 0 , m ⃗ 1 ), the attacker cannot tell from which dataset the derived signcryptions cf,y came from, f ( m ⃗ 0 ) or f ( m ⃗ 1 ) for some function f known to the attacker. However, to achieve a formal definition of message privacy for our HSC is a challenging problem because the public verification algorithm is able to operate on the signcryptions of messages for any function of the adversary's choice, which makes it easy for an adversary to find a function f * such that f * ( m ⃗ 0 ) ≠ f * ( m ⃗ 1 ) . More precisely, if the original signcryptions c ⃗ b over messages m ⃗ b are exposed to an adversary and the homomorphic operation and verification process are public algorithms, it is trivial for an adversary to distinguish the original dataset only from the information of c ⃗ b by performing a function f * on c ⃗ b to get the derived signcryption c ˆ on the message f * ( m ⃗ b ) . By testing the matching of c ˆ with f ( m ⃗ 0 ) or f ( m ⃗ 1 ) via the public verification process, the attacker can tell which c ⃗ b comes from, m ⃗ 0 or m ⃗ 1 . In consequence to avoid such a trivial attack described above, we define two notions of message privacy–namely weak message privacy and standard message privacy for HSC with public verification. In the notion of weak message privacy, we assume that the original signcryptions c ⃗ b on the dataset m ⃗ b are not published (while the final signcryption is published), in which case the homomorphic operation is public. In the standard message privacy, we require c ⃗ b to be exposed to the adversary but the homomorphic operation is privately performed by the challenger, rather than being available to the adversary. 1.3 Challenges in designing an HSC To describe some challenges faced when designing an HSC scheme, let us consider a naive HSC scheme, which simply outputs the concatenation of a message x and a signature σ, that is, x‖σ as the signcryption of x; where σ is a signature on x using an HS scheme. The publicly homomorphic evaluation for HSC on different elements x‖σ proceeds by using the evaluation algorithm of HS to homomorphically compute the signature σf,y for y = f ( x ⃗ ) in a straightforward manner. This appears to satisfy the unforgeability of HSC due to the unforgeability of HS. Furthermore, from the definition of the weak message privacy for HSC that the adversary will be given the derived signcryption σf,y but not get access to the original signcryption x‖σ, it seems that the message x is not revealed. However, this is only true when the underlying HS is context-hiding, which means the derived signature σf,y does not leak any information about x ⃗ . In other words, if the underlying HS is unforgeable and context-hiding, then the concatenation of a message and the corresponding signature is a trivial way to build a weak message private HSC scheme. Nevertheless, if given an HS that satisfies the basic homomorphism requirement, but not context hiding (which is an additionally advanced requirement, since to achieve it, either an additional assumption, i.e., existence of NIZKPoK (non-interactive zero-knowledge proof of knowledge), or a context-hiding homomorphic trapdoor function is needed [7]), a challenging question is how to address the issue of maintaining no leakage on x ⃗ from σf,y. In this article, we propose a construction of HSC with weak message privacy in a public evaluation setting from HS scheme without the context-hiding property. A similar intuition can be given for HSC schemes with private evaluation. In this case, we might consider a scheme similar to the one described above, but in which we set the signcryption to be the ciphertext of x‖σ under a public key encryption (PKE) scheme, denoted as cx,σ. Then, the evaluation key will correspond to the private key for the PKE, and the evaluator simply decrypts, and evaluates the HRs using the appropriate function f to obtain a derived signature σf,y, and then releases the result y = f ( x ⃗ ) concatenated with σf,y. Note that despite given access to the original signcrytion cx,σ, the adversary still cannot learn the plaintext x since the employed PKE scheme is secure. Then as given above, this scheme appears to satisfy the normal message privacy for HSC with private evaluation. Unfortunately, such an assertion still relies on the context-hiding property of the underlying HS. The problem of building an HSC scheme with message privacy in a private evaluation setting arises when assuming the HS scheme is unforgeable but not context-hiding. 1.4 Summary of our constructions Let us now describe our solution for constructing HSC from an HS scheme without the context-hiding property. At first, we provide a construction of a homomorphic signcryption scheme with public plaintext-result-checkability in a public evaluation setting achieving unforgeability and weak message privacy, assuming the existence of HSsHS, PKE, indistinguishability obfuscation and statistical simulation-soundness non-interactive zero-knowledge proof (SSS-NIZK) for NP languages. The core idea of our construction is to apply the sequential composition method by signing the message using the underlying HS scheme first, then encrypting the concatenation of the message and the signature. The evaluation algorithm of the HS scheme naturally provides a way to homomorphically derive a signature σf,y from the signature σ x ⃗ of the data x ⃗ , which certifies that y is the correct output of the computation f over the signed data x ⃗ . Nevertheless, the challenge is how to perform homomorphic evaluation over the encrypted signature (signcryption) c x ⃗ ≔ E n c ( σ x ⃗ ) of the data x ⃗ without the decryption key. We employ indistinguishability obfuscation to resolve this problem by embedding the secret decryption key in an obfuscated programme, whose functionality is to decrypt the input signcryption so as to recover the underlying signatures first, and then from them to derive the signature σf,y that corresponds to the message y = f ( x ⃗ ) . Anyone can verify the tuple (f, y, σf,y) using the HS's public verification algorithm, thus testing whether y is the correct output of the computation f over x ⃗ . For an outsider adversary, who does not know the receiver's secret key, unforgeability can be achieved from the existential unforgeability property of the underlying HS scheme directly. Moreover, it is shown that our construction achieves weak message privacy, which requires that given not only the signcryptions on a number of messages derived from two different datasets for some function known to the attacker but also access to an unsigncryption oracle and the secret signcryption key, the attacker is not able to tell which dataset the derived signatures came from. We then show how to use an HS together with a public key functional encryption (FE) to construct a homomorphic signcryption scheme with public plaintext-result-checkability in a private evaluation setting with unforgeability and message privacy. Employing the same sequential composition method of signing then encrypting, we instantiate with an HS scheme as before, while the underlying encryption is replaced with a public functional encryption scheme. To perform homomorphic evaluation over the encrypted signature (signcryption) c x ⃗ ≔ E n c ( σ x ⃗ ) of the data x ⃗ in case of having no access to the decryption key, we take advantage of the functional secret key for a function whose functionality is the following: if the message-signature pair ( x ⃗ , σ x ⃗ ) (i.e. underlay in c x ⃗ ) is verified, then it returns a function value y resulting from the function f applied on x ⃗ , as well as a signature σy,f that is derived from the original signatures σ x ⃗ over the plaintext data x ⃗ for a function f. This is achieved by employing the evaluation algorithm of HS and certifying the result value y. Furthermore, to publicly verify the validity of the signcryption cy,f on the data y, we use the function secret key for another function, whose functionality is to directly check the validity of (f, y, σf,y) by using the HS's public verification algorithm. For an outsider adversary, unforgeability can be achieved from the unforgeability of underlying HS directly. Moreover, we define the notion of message privacy of HSC in a private evaluation setting, which requires that given not only the signcryptions on a number of messages derived from two different datasets for some function known to the attacker, but also the original signcryption on both two datasets and access to the signcryption and evaluation oracles, the attacker is not able to tell which dataset the derived signatures came from. We prove that message privacy is preserved based on the IND-CPA security of the base functional encryption scheme. Implementation and practical aspects. Due to the building blocks that our constructions are based on, it is inevitable to discuss the practicality of obfuscation and function encryption. As far as we know, there are several articles [11-16] investigating the practicality of programme obfuscation focussing on implementing and evaluating the performance of the obfuscators. Although the initial results required significant amounts of time to implement programme obfuscation [11, 12, 14], there are some recent advances that are very promising. More precisely, Cousins et al. [16] implemented obfuscation for conjunction programme satisfying distributional virtual black box (VBB) security. The obfuscation for a 64-bit conjunction programme takes 6.7 h and the evaluation takes only 3.5 s. Except software-only-based approaches to implement programme obfuscation, there are also some significant advances in hardware-based approaches. Nayak et al. [15] employed a hardware-based approach to implement it which achieves simulation-secure obfuscation for RAM programs, and improves performance significantly making an important step towards deploying obfuscation technology in practice. Furtheremore, Lewi et al. [13] also implemented the Boneh et al. [17] multi-input functional encryption scheme for 2-input comparison functions and 3-input DNF (3DNF) functions. Taking 3DNF function on 16-bit inputs with security parameter 80 as an example, it takes about 12 min to compute the encryption for three 16-bit inputs, yielding the overall ciphertexts with a size of 2.5 GB. Moreover, evaluating the 3DNF function value from the overall ciphertexts only takes 3 min. Thus, in light of the promising future on the practicality of programme obfuscation and functional encryption, we believe that our proposed homomorphic signcryption schemes are very promising and advance significantly the area of signcryption. 1.5 Application: certified data analysis Working with sensitive data is often a balancing act between confidentiality and integrity concerns. One question on big data is how to release some socially beneficial results on private data, while minimising the information revealed about individuals. The nature of homomorphic signcryptions is that they provide public plaintext-result-checkability, confidentiality and integrity and they are very useful in a wide variety of settings involving data processing by untrusted entities. As an example, consider the National Institute of Health (NIH) as the role of the curator which has some sensitive medical information from a set of subjects, which various research groups (analysts) wish to examine in detail to draw conclusions from. This separation between a curator and an analyst reflects a common application scenario in large-scale studies on sensitive data, where the raw data is often hosted by a single organisation, and the data may be used multiple times by different groups for different purposes. The curator signcrypts the collected data m ⃗ and distributes the signcrypted data c ⃗ to various analysts for processing, so that the underlying sensitive data is authenticated and remain confidential. Some of these groups may have the intention to lie about the outcomes of their analysis. However, using homomorphic signcryptions, they can publish their analysis strategy (a function f), the claimed outcome of the analysis y = f(x), and a signcryption cf,y that certifies the correctness of the outcome. This information can be released publicly and verified by anyone using a verification key published by the NIH. When performing the verification, the verifier neither needs to have access to the underlying data nor needs to communicate with the NIH or the research groups that performed the computation. Furthermore, if such signcryptions are made to be messaged private, then it is assured that they do not reveal additional information about the underlying data beyond the analysis results. 1.6 Related work Homomorphic Signcryption. Homomorphic signcryption initially introduced by Rezaeibagha et al. [10, 18] was limited in capturing only additive homomorphic operations on the signcrypted messages. Thus, it did not address the problem of constructing a fully homomorphic signcryption, whose homomorphic operation is able to perform any function or circuit of polynomial size. On the other hand, Rezaeibagha et al. studied the homomorphic signcryption within the framework of standard signcryption, where the unsigncryption can be seen as a verification algorithm designed to be performed only by a specific user having the unsigncryption key to test whether a given ciphertext is the signcryption of a given message. Therefore, in Rezaeibagha et al.’s approach message privacy is defined in the same flavour of the original signcryption scheme. In contrast, our work focusses on settling these two weaknesses on Rezaeibagha et al.’ homomorphic signcryption. We not only go beyond the plaintext-result checkability for a specified user, and provide a public verification algorithm to achieve public plaintext-result checkability such that anyone can test whether a given ciphertext is the signcryption of a given message under the sender's public key; but also beyond the additive homomorphic signcryption notion and present a homomorphic signcryption for any function. Linearly Homomorphic Authenticated Encryption with Public Verifiability. Linearly homomorphic authenticated encryption with public verifiability (LAEPuV), introduced by Catalano et al. [19], is a primitive approach that allows to authenticate computations on encrypted data, with the additional property that the correctness of the computations can be publicly verified. Catalano et al. have also provided an instantiation for LAEPuV in the random oracle model based on Paillier's cryptosystem. Struck et al. [20] proposed some improvements on Catalano et al.’s instantiated scheme by avoiding false negatives during the verification algorithm. Syntactically, our notion of homomorphic signcryption bears resemblance with the primitive of LAEPuV [19] on the aspect of allowing both the homomorphic operation on the encrypted data and the decryption of the ciphertext resulted from the homomorphic evaluation. However, using our homomorphic signcryption scheme, the data is signcrypted. The main difference between our homomorphic signcryption and LAEPuV relies on the verification algorithm. More precisely, in LAEPuV [19, 20] the verification algorithm is defined as V e r i f y ( v k , i d , c , f ) and requires that the condition V e r i f y ( v k , i d , c , f ) = 1 is equivalent to ∃ m , s . t . D e c r y p t ( s k , i d , c , f ) = m. Such a correctness requirement implies that if the verification is successful, the verifier is convinced that c is an encryption of some message, but without knowing to which message c corresponds to. In contrast, the verification algorithm in our homomorphic signcryption is defined as V e r i f y ( p k , t a g , m ′ , c ′ , f ) , which is employed to check the matching of a message m′ with the corresponding signcryption c′. This also explains why we have different security requirements from LAEPuV. The latter only considers IND-CCA security, since their verification algorithm does not need the message as input, and in some sense it resembles the security model of an encryption scheme. However in our case, the verification algorithm itself takes the message as input, thus, we should consider the plaintext checkable attack. Therefore, we define not only the privacy for the message but also the unforgeability for the signcryption. Furthermore, although the two instantiations of LAEPuV [19, 20] are very efficient (since the homomorphic operation on the encrypted message in LAEPuV is a linear function), their security is proved in the random oracle model. On the contrary, the security of our proposed signcryption primitive is proved in the standard model and can be employed for a more general function, that is, for any polynomial size circuit, which leads to sacrificing some efficiency. Publicly Verifiable Computation. Intuitively, it seems that our homomorphic signcryptio