Identity‐based encryption resilient to continuous key leakage

IET Information SecurityVolume 13, Issue 5 p. 426-434 Research ArticleFree Access Identity-based encryption resilient to continuous key leakage Yanwei Zhou, Yanwei Zhou School of Computer Science, Shaanxi Normal University, Xi'an, People's Republic of China State Key Laboratory of Cryptology, P.O. Box 5159, Beijing, People's Republic of China State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, People's Republic of ChinaSearch for more papers by this authorBo Yang, Corresponding Author Bo Yang byang@snnu.edu.cn School of Computer Science, Shaanxi Normal University, Xi'an, People's Republic of China State Key Laboratory of Cryptology, P.O. Box 5159, Beijing, People's Republic of China State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, People's Republic of ChinaSearch for more papers by this authorYi Mu, Yi Mu Fujian Provincial Key Laboratory of Network Security and Cryptology, Fujian Normal University, Fuzhou, People's Republic of ChinaSearch for more papers by this authorTao Wang, Tao Wang School of Computer Science, Shaanxi Normal University, Xi'an, People's Republic of China State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, People's Republic of ChinaSearch for more papers by this authorXin Wang, Xin Wang School of Computer Science, Shaanxi Normal University, Xi'an, People's Republic of ChinaSearch for more papers by this author Yanwei Zhou, Yanwei Zhou School of Computer Science, Shaanxi Normal University, Xi'an, People's Republic of China State Key Laboratory of Cryptology, P.O. Box 5159, Beijing, People's Republic of China State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, People's Republic of ChinaSearch for more papers by this authorBo Yang, Corresponding Author Bo Yang byang@snnu.edu.cn School of Computer Science, Shaanxi Normal University, Xi'an, People's Republic of China State Key Laboratory of Cryptology, P.O. Box 5159, Beijing, People's Republic of China State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, People's Republic of ChinaSearch for more papers by this authorYi Mu, Yi Mu Fujian Provincial Key Laboratory of Network Security and Cryptology, Fujian Normal University, Fuzhou, People's Republic of ChinaSearch for more papers by this authorTao Wang, Tao Wang School of Computer Science, Shaanxi Normal University, Xi'an, People's Republic of China State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, People's Republic of ChinaSearch for more papers by this authorXin Wang, Xin Wang School of Computer Science, Shaanxi Normal University, Xi'an, People's Republic of ChinaSearch for more papers by this author First published: 01 September 2019 https://doi.org/10.1049/iet-ifs.2018.5203Citations: 2AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract Leakage of private information has become a threat to the security of computing systems. It has become a common security requirement that a cryptography scheme should withstand various leakage attacks, even the continuous leakage attacks. However, in the current constructions on the (continuous) leakage-resilient identity-based encryption (CLR-IBE) scheme, the leakage parameter is a fixed value. Aiming to solve these problems, in this study, the authors show how to construct the CLR-IBE scheme, and the adaptive chosen-ciphertext attacks security of proposed construction can be proved in the standard model. To further improve the practicability of CLR-IBE scheme, they design an improved IBE scheme with continuous leakage amplified property, and the leakage parameter has an arbitrary length. 1 Introduction The security of the traditional cryptography scheme is proved in a weaker security model, in which legitimate participants hold internal respective secret states, such as private keys of a user, which are assumed completely inaccessible to the adversary. However, in the real world, an adversary can learn any additional information on the internal secret states through various leakage attacks, such as side-channel attacks, cold-boot attacks and so on. If an adversary obtains a certain amount of leakage on the internal secret states, then the traditional cryptography schemes will not hold their claimed security. Therefore, leakage-resilient cryptography schemes are important to meet the security requirements in the real world. However, most previous leakage-resilient cryptography schemes [1-13] only consider the bounded leakage attacks and do not allow any continuous leakage. In the real world, the leakage is unbounded, because of the adversary can continuously learn some additional information on the private key of the user, and can trivially break the security of cryptography scheme under the continuous leakage attacks. Thus, to further improve the practicability, a cryptography scheme must keep its original security in the continuous leakage setting. For the past few years, several constructions have captured continuous leakage resilience in their security consideration, such as the continuous leakage-resilient public-key encryption (CLR-PKE) [14-16], the continuous leakage-resilient authentication key exchange (CLR-AKE) [17], the continuous leakage-resilient (CLR) signature [18], the CLR certificate-based encryption (CLR-CBE) [10, 11, 19], the CLR certificateless public-key encryption (CLR-CL-PKE) [20] and so on. In the identity-based setting, CLR identity-based encryption (CLR-IBE) schemes with the semantic security were presented in [21-23]. Furthermore, a CLR-IBE scheme is designed in [24], and its chosen-ciphertext attacks (CCA) security is proved in the selective identity model. That is, the previous CLR-IBE schemes either achieve CPA security or obtain CCA security in the selective identity model. Hence, there is no practical IBE scheme with full CCA security in the literature, which has adopted the continuous leakage model. Specially, in the current constructions on the leakage-resilient cryptography schemes, the leakage parameter is a fixed value. That is, the upper bound of permitted leakage keep unchanged even if the actual applications have different leakage requirements. In other words, in the actual application, we cannot resist the various leakage attacks through fixed leakage upper bound. If the upper bound of allowed leakage is smaller than the total length of actual leakage, then, the corresponding cryptography scheme is unusable. In this paper, we provide a complete solution method for the above problems and show how to construct a CLR-IBE scheme, and its adaptive CCA security is proved, in the standard model, based on a stronger security assumption that depends on the number of private key generation queries made by the adversary. Also, we design a novel construction of CLR-IBE scheme, in which, the upper bound of permitted leakage is depended on the leakage requirements of actual applications. Prior constructions: To resist the leakage attacks, Alwen et al. [25] generalised hash proof systems (HPS) in the identity-based setting and referred to it as identity-based HPS (IB-HPS). Also, they took it as a basic tool to construct CPA secure leakage-resilient IBE (LR-IBE) scheme. That is, based on the IB-HPS, a generic construction of the LR-IBE scheme with CPA security was built. Chow et al. [26] proposed three new systems of IB-HPS with the previous identity-based encryption (IBE) schemes [27-29]. Then, three CPA secure LR-IBE schemes can be obtained from the generic method proposed in [25]. Different from these works [25, 26], Yuen et al. [23] designed a novel CLR-IBE scheme in the auxiliary input model, which can tolerate a more general form of leakage. Among all, these IBE schemes [23, 25, 26] were only proved CPA secure, and these schemes suffer from the undesirable drawback that the leakage parameter and the plaintext length are subject to , where con is a constant value. In this case, when the plaintext length approaches to the con, the size of leakage approaches to 0, vice versa. To improve the security level, Li et al. [30] presented a new LR-IBE scheme based on Gentry's IBE scheme [31], which can achieve CCA security. In addition, by Liu et al.'s [2] conclusion, an LR-IBE scheme with better performance was created by Sun et al. [7], in which, the number of bits leaked is , where q is a big prime order of the underlying group and is the secret parameter. That is, in [7], the leakage parameter and the plaintext message are independent of each other. The above constructions [7, 25, 26, 30] were designed in the bounded-leakage model, and cannot keep their claimed security in the continuous leakage setting. Although, Yuen et al. [23], Lewko et al. [21] and Li et al. [22] proposed three CLR-IBE schemes from the dual system encryption technology, which can only achieve CPA security. The CLR-IBE scheme designed in [24] can only obtain the selective identity CCA security. However, adaptive CCA security is a strong and very useful notion of security for IBE scheme. Therefore, in the actual application environment, the CLR-IBE scheme with adaptive CCA security is indispensable. Our contributions: In the IBE schemes, there exists a bigger gap between the research about how to resist the leakage attacks and the leakage requirements of the real world, because of the bounded leakage resilience is only considered in the current constructions. Also, the existing CLR-IBE schemes either achieve CPA security or obtain selective identity CCA security. In this paper, we focus on the construction of CCA secure CLR-IBE scheme, and the scheme's security is proved, in the standard model, based on the hardness of the decisional augmented bilinear Diffie–Hellman exponent (q -ABDHE) assumption and the following features are the targets of design: (i) we allow continuous leakage on the private key of user; (ii) the round leakage parameter is independent of the plaintext space and has a constant size; (iii) the leakage parameter has arbitrary length, which depends on the leakage requirements of actual applications; and (iv) the adaptive CCA security can be obtained. To achieve the above objectives, we first propose a CLR-IBE scheme with CPA security, and whose security is proved, in the standard model, based on the q -ABDHE assumption. After that, based on our basic construction , we design a CLR-CCA secure IBE scheme , and its security can be proved with the existing method. Finally, a novel continuous leakage-amplified IBE scheme is created, and the upper bound of round leakage parameter can be flexibly controlled and is determined by the practical considerations about how much leakage the cryptosystem needs to tolerate. That is, based on our basic construction (or ), we can develop a CPA (or CCA) secure IBE scheme with continuous leakage amplification. 2 Preliminaries Due to the space limitation, the basic notions such as statistical distance , min-entropy and average conditional min-entropy are omitted in the presentation, and the reader is referred to [2, 32, 33] for the details. Moreover, the formal definition of (continuous) LR-IBE scheme is also omitted, and the reader is referred to [23, 30] for the details. Let denote the security parameter. If S is a string, then denotes its length, while if S is a set then denotes its size and denotes the operation of picking an element s uniformly at random from S. We denote the operation of running with input x and assigning y as a result. We use to denote the set of all functions that are negligible in the security parameter . 2.1 Bilinear groups Let be a probability polynomial time (PPT) group generation algorithm that takes as input a security parameter , and outputs a tuple , such that (i) G and are two cyclic groups of prime order p; (ii) P is a generator of G; (iii) is an efficiently computable bilinear pairing with the following properties: Bilinear: , where and . Non-degeneracy: , where is the generator of . Computable: can be computed efficiently for all . 2.2 Security assumption The security of our constructions is based on a complexity assumption that we call the decisional ABDHE assumption (decisional ABDHE). First, we recall the bilinear Diffie–Hellman exponent (q -BDHE) problem [31], which is described as follows: Given a vector of elements as input (where ), and output . Since the input vector is missing the term , the bilinear map does not seem to help compute . We define the ABDHE (q -ABDHE) problem almost identically: Given a vector of elements as input, and output . Introducing the additional term still does not appear to ease the computation of , since the input vector is missing the term . Now, we use and to denote and , respectively. The decisional version of truncated q -ABDHE problem is defined as one would expect. Let and , then, the advantage of an adversary in solving q -ABDHE problem is defined as where the probability is over the random choice of generators in G, the random choice of in , the random choice of , and the random bits consumed by . Definition 1 (q-ABDHE assumption).For and , the two tuples and are computationally indistinguishable, where , , and . We say that the q -ABDHE assumption holds if, for all PPT adversaries , we have 2.3 Randomness extractor By the notion of [32], for any adversary , we obtain Lemma 1.For three variables and C, if , then we will obtain [32]. Definition 2 (Randomness extractor).For and , as well as the two variables B and subject to the constraint , if we have , then is an average-case -strong randomness extractor. Definition 3 (Universal hash function).For and all distinct , if we have , then the hash function is universal. Example 1.The family of functions is universal, where . All operations are in the prime field [2]. Example 2.Let G be a multiplicative group of prime order p, and . The family of functions is universal, where [2]. Lemma 2 (Leftover hash lemma).Let is a uniform distribution over . For two variables and C, it holds that and [32]. Lemma 3 (Generalised leftover hash lemma).If two variables C and subject to the constraint , then, for and , we have as long as [32]. By Lemma 3, we have that, for an index , the universal hash function can be employed as an average-case strong randomness extractor. 2.4 CCA security model In the leakage-resilient security model, we model the adversary's leakage attacks on the private key , by giving the adversary access to a leakage oracle , and the adversary can query to gain the leakage information about . Definition 4 (Leakage oracle).A leakage oracle is parameterised by a private key , a leakage parameter and a security parameter k. A query to the leakage oracle consists of an efficiently computable leakage function . The leakage oracle checks if the sum of , over all queries received so far, exceeds the leakage parameter and ignores the query if this is the case. The leakage oracle computes the function for at most polynomial steps, and if the computation completes, responds with the output. Otherwise, it responds with the dummy value . Without loss of generality, we can assume that the adversary can access the leakage oracle only once, and obtain at most bits leakage. We require that an IBE scheme must remain the original security even in the leakage setting. Thus, in the leakage-resilient security model of the IBE scheme, the adversary can make an addition query other than the key generation queries and the decryption queries, called it leakage queries. That is, an adversary can obtain a certain amount of leakage on the private key of any identity chosen by itself, but the total length of leakage on the same identity must less than the leakage parameter . According to the previous works [7, 26, 30], our (continuous) leakage-resilient security definition of IBE scheme only allows leakage attacks against the private keys of the various identities, but not the master secret key. Just as noted by the authors [7, 26, 30, 33], we only allow the adversary to make leakage queries before seeing the challenge ciphertext. This is a necessary restriction as otherwise, the adversary could leak the first bit of the message and easily win the distinguishing game. For any adversary , the experiment of LR-CCA security is described as follows: (i) , where and . (ii) , where . (iii) If return 1. Otherwise, return 0. We stress that, denotes the plaintext space, denotes the leakage oracle of the private key of user, denotes the key generation oracle of any identity, denotes the key generation oracle excluding challenge identity , denotes the decryption oracle for any identity ciphertext pair, and denotes the decryption oracle excluding challenge identity and the challenge ciphertext pair . Then, the advantage of the adversary in the experiment is defined as Definition 5.If the advantage of the adversary in the above experiment is negligible, then, the corresponding IBE scheme is -LR-CCA secure. Also, in the leakage queries, the total length of leakage on the private key of the user must less than the leakage parameter . In the abstract of literature [34], Dodis et al. stated that a cryptographic primitive is CLR, if it allows users to refresh their private key, using only fresh local randomness, such that (i) 'The scheme remains functional after any number of key refreshes, although the public key never changes. Thus, the 'outside world' is neither affected by these key refreshes nor needs to know about their frequency. That is, if the public key is unchanged, then any PPT adversary cannot distinguish the original private key and the updated private key.' (ii) 'The scheme remains secure even if the adversary can continuously leak arbitrary information about the current secret key, as long as the amount of leaked information is bounded between any two successive key refreshes. There is no bound on the total amount of information that can be leaked during the lifetime of the system. That is, the original cryptographic primitive has bounded leakage resilience. Then, the continuous leakage attacks can be resisted by performing the additional key update algorithm.' From the above conclusions, we find that the problem of continuous leakage resilience can be reduced to a simpler single-round bounded leakage-resilient problem. That is, a bounded LR-IBE scheme with the key update function can achieve the continuous leakage resilience, if the corresponding key update algorithm with the re-randomisation property, i.e. any PPT adversary cannot distinguish the original private key and the updated private key. Therefore, a CLR-CCA secure IBE scheme can be achieved from an IBE scheme with CCA security and bounded leakage resilience by performing an additional key update algorithm . Thus, we have the formal definition of CLR-CCA security described in the following definition. Definition 6.If the advantage of the adversary in the experiment is negligible, then, the corresponding IBE scheme with key update function is -CLR-CCA secure, where the public parameters and the function keep unchanged while the private key of the user is updated. Also, the total number of bits leaked between each update is bounded by a fixed round leakage parameter , while the total amount of leakage throughout its lifetime is not restricted. We stress that, in the (continuous) LR-CPA security model, the decryption queries for any identity ciphertext pair cannot be submitted by the adversary. That is, the leakage queries and decryption queries can only be performed. Due to the space limitation, the corresponding description is omitted. 3 CLR-CPA secure IBE In the traditional bounded-leakage model, the total leakage of the private key is bounded by some small constant. However, in the real world, an adversary can continuously learn any additional information on the private key of the user through continuous leakage attacks, and can trivially break the security of cryptographic primitives. Thus, to further improve the practicability, an IBE scheme must maintain its claimed security in the continuous leakage setting. Based on the Dodis et al.'s conclusions [34], we need a novel method to push some new randomness into the private key of the user after the decryption operation. To this end, we show how to securely update the private key of the user while the public parameters keep unchanged. That is, we develop an additional key update algorithm , which can create a new private key of the user. Thus, the leakage of the previous private key of the user does not contribute to the new private key. 3.1 Constructions An IBE scheme is constructed in this section, which is secure against continual leakage attacks on the private key of the user. Setup: On input of the security parameter , the setup algorithm is described as follows: (i) Run the group sampling algorithm to obtain , where p is a prime, G and are two groups of order p, P is a generator of G, and is an efficiently computable non-degenerate bilinear map. (ii) Choose and , and then compute . (iii) Let be an advantage case -strong randomness extractor, where denotes the leakage parameter and is a negligible advantage. (iv) Let be the master secret key and set the public parameters as the common input of the following algorithms. Also, let the identity space be and the message space be . Key generation: For any , the key generation algorithm is described as follows: (i) Choose , and compute (ii) Output the private key associated with the identity id and an update trapdoor , where is an update key, and is used in the key update algorithm . Notice that, id can make is different for each user. Key update: The algorithm can push some new randomness into the private key of the user, and make the private key is random in the adversary's view so that the continual leakage attacks are possible to defend. For any identity , as well as any update index , the algorithm is described as follows: (i) Choose , and set Thus, for an update index , we have Output the new private key subject to the constraints (where ) and . Notice that, the new private key satisfies the re-randomisation property. That is, and are two independent and uniform distributions over the space of private key of the user, i.e. for any PPT adversary, we have Encryption: For a plaintext , the encryption algorithm is described as follows: (i) Choose , and compute (ii) Choose , and compute (iii) Output the ciphertext associated with the plaintext M. Decryption: For a ciphertext , the decryption algorithm is described as follows: (i) Output as the plaintext of C, where . (ii) Execute , and the new private key will be used in the next round decryption operation. 3.2 Correctness From the following equation, it is easy for us to see that the decryption algorithm is consistent with the encryption algorithm. 3.3 Proof of security Based on the Dodis et al. 's conclusions [34], we obtain that the CLR-IBE scheme can be obtained from an IBE scheme with the bounded leakage resilience by running an additional key update algorithm. Therefore, in this section, we only proof the bounded leakage-resilient property of our construction, and the continuous leakage resilience is naturally achieved through key update operation. Theorem 1.Under the q -ABDHE assumption (where , the adversary submits at most private key generation queries), for any leakage parameter , our construction is a CLR-IBE scheme with CPA security. Proof.If there exists an adversary who can break the CLR-CPA security of our construction with a non-negligible advantage , then, we can build a simulator who can solve the q -ABDHE assumption with an obvious advantage , where p is a prime order of the underlying group. takes as input a random truncated decision q -ABDHE challenge , where and for an unknown , and is either or a random element of . That is, in the beginning, receives a challenge tuple from the challenger of the q -ABDHE problem. simulates the LR-CPA security game for the adversary as follows: Setup: generates random polynomials of degree q, and sets . It sends the public parameter to the adversary , where is an average case strong randomness extractor, and the master secret key is impliedly set as . Let be the identity space and be the message space. Notice that, since is chosen uniformly at random, Q and are uniformly random and this system public parameter has a distribution identical to that in the actual construction. Test Stage 1: In this stage, the following two kinds of queries are adaptively submitted by the adversary , and the query depends on the previous queries, as well as the corresponding responses. Key generation queries: For the key generation queries of any identity , we consider the following two cases: (i) If , uses to solve truncated decision q -ABDHE immediately. (ii) Otherwise, let denote the -degree polynomial . outputs the corresponding private key . This is a valid private key for the identity id, since Leakage queries: For the leakage queries of any identity , operates the leakage oracle and returns the corresponding answers by using the private key , where is an efficiently computable leakage function submitted by the adversary and the private key can be created with the same method as the key generation queries. In the process of leakage queries, the total length of which all returned from the leakage oracle on the same private key must be less than the leakage parameter . Otherwise, an invalid answer will be outputted. Challenge stage: In this stage, the adversary will submit a challenging identity and two equal length challenge messages to the simulator , where never appeared in a key generation query and appeared in the leakage queries with at most bits leakage. If , uses to solve truncated decision q -ABDHE immediately. Otherwise, computes as in the simulation of private key queries for , and does the following operations: (i) Let , and let , which is a polynomial of degree . Let denotes the coefficient of in . (ii) Choose , and compute where . That is, computes the challenge ciphertext from , and without knowledge of . iii) Send to the adversary as the challenge ciphertext. Notice that, if there exists such that , then we let . Now, we consider the following two cases: (i) If , then , and (where ), since Thus, the challenge ciphertext is a valid encryption ciphertext for and under randomness . Since and are uniformly random, t is uniformly random, and so is a valid, appropriately-distributed challenge ciphertext. (ii) If , then is a uniformly random and independent element of . In this case, the inequalities hold with probability . When this inequality holds, the value of is uniformly random and independent from 's view, since is uniformly random and independent from 's view. Thus, is uniformly random and independent, and can impart no information regarding the bit b. Test Stage 2: In this stage, the simulator calculates the complete private key of any identity (except the challenge identity ) as he did in Test Stage 1. Furthermore, the leakage queries for any identity are unallowed. Output: Eventually, outputs a guess of the random value b picked by . It is easy to see that the simulation is perfect, and the challenge ciphertext is a valid encryption ciphertext of the message if . On the other hand, if , then is a uniformly random message in the 's view, and gives no information about the simulator's choice of b, except the probability .To sum up, assuming that no queried identity equals , for and , we obtain that Therefore, we can obtain that if there exists an adversary who can break the LR-CPA security of our construction with a non-negligible advantage , and then, we can build a simulator who can break the security of decisional version of truncated q -ABDHE assumption with an obvious advantage , where That is, we prove that the advantage of in breaking the decisional version of truncated q -ABDHE assumption is negligibly close to the advantage of in the LR-CPA security game.In the continuous leakage setting, the adversary cannot obtain information on the from th