# Hierarchical Identity-Based Online/Offline Encryption Scheme with Leakage Resilience

Authors: Qihong Yu; Jiguo Li; Sai Ji
Journal: Security and Communication Networks
 (2022)

---

## Abstract

The adversary is able to obtain some secret information from side channel attacks, which further damages the security for the system. To resolve this issue, we provide a hierarchical identity-based online/offline encryption scheme which resists side channel attacks. In our scheme, most encryption operations are preprocessed in the offline stage and only a small amount of lightweight calculation needs to be performed in the online stage for generating ciphertext. The presented scheme greatly reduces the workload of online encryption and is suitable for the resource-constrained device. The security of the proposed scheme is proved by the dual system technique. The leakage performance analysis shows that the presented scheme is resilient to leakage for almost the whole symmetric key.


---

## Body

## 1. Introduction

In recent years, many side channel attacks [1–5] have been presented. The adversary is able to obtain some secret information of the system by measuring timing, energy consumptions, and other characteristics from the cryptosystems. Cold start attack [6] is a special form of side channel attacks. The adversary gets part information from internal storage after the machine is shut down. Under these side channel attacks, if some secret information is exposed, the security for the whole cryptosystem is broken. Therefore, the research on leakage-resilient encryption scheme has attracted the attention of many cryptography researchers.


### 1.1. Related Work

Micali and Reyzin [7] first proposed the model “only computing leaks (OCL).” In the OCL model, an attacker selects an effective and computable function and inputs the internal state and key and outputs some secret information. The complexity of the leakage function is unlimited. The only limitation is that the part which is not involved in the current operation does not leak secret information. Dziembowski and Pietrzak [8, 9] presented two leakage-resilient stream cipher schemes in the OCL model.Considering that the leakage not only occurs in the calculation process, Akavia et al. [10] presented the bounded leakage model (BLM). In BLM, the leakage function does not expose the whole private key. BLM does not solve the problem that the length of the leaked information obtained by the attacker is longer than the private key information and the amount of useful information is relatively small. To resolve the problem, Naor and Segev [11] presented “entropy bounded leakage model,” in which the entropy about leakage information is limited.Because it can reduce the burden of the key generation center, the hierarchical identity-based encryption (HIBE) schemes have been widely used and attracted the attention of many researchers. Guo et al. [12] proposed an efficient HIBE scheme with high computational efficiency by reasonably reducing the use of parameters. Langrehr and Pan [13] gave two tightly secure HIBE schemes by the matrix Diffie–Hellman assumption. Takayasu [14] presented an efficient adaptively secure revocable hierarchical identity-based encryption (RHIBE) with compact ciphertexts. Emura et al. [15] gave a generic construction about RHIBE by using HIBE and the complete subtree method.The hierarchical structure is conducive to protecting the confidentiality of data, and it is suitable for IoT systems, smart home systems, distributed data systems, cloud storage systems, etc. Private key delegation can also reduce the burden on the root private key generator (PKG).We use Figure1 to illustrate the hierarchical structure of the national medical diagnosis system. For the national medical system, the root node (the Ministry of Health, which is abbreviated as MH) generates the public key information of the user and acts as the root private key generation center to generate the private key of the secondary node (the Department of Health which is abbreviated as DH and the national hospital which is abbreviated as NH). The secondary node is responsible for generating the private key of the health bureau (HB) and the private key of the city hospital (CH). The third level city node is responsible for generating the private key of the town health center (THC) and the private key of the township hospital (TH). The medical management organization can delegate the private key to the staff, and each hospital can also delegate the private key to the doctors.Figure 1
The hierarchical structure of the national medical diagnosis system.For example, one user with the identity of “A1 City: Hospital B1” can delegate the private key to the user with the identity “A1 City: Hospital B1: C1 Doctor” but cannot delegate the private key to the user with the identity of “A1 City: Hospital B2: C1 Doctor.”The delegation solves the problem that the key generation center is overloaded. In fact, thek−1th layer’s user with the identity vector Ik−1=ID1,ID2,...,IDk−1 generates the private key of the kth layer’s user with the identity vector Ik=ID1,ID2,...,IDk−1,IDk.Generally speaking, the “delegation” algorithm is given explicitly or implicitly for the HIBE schemes. The most HIBE schemes explicitly give the delegation algorithm. For example, the “Delegate” algorithm of the paper [12] is the delegation algorithm, and the “Del” algorithm of the paper [13] is the delegation algorithm. In addition, some HIBE schemes implicitly give the delegation algorithm. For example, the subalgorithm “Delegation Key Generation” of the algorithm “GenSK” in the paper [14] acts as the delegation algorithm. The “GenSK” algorithm of the paper [15] has key delegation function. In fact, the two methods are essentially the same. From Figure 1, we can see that the root user (the root key generation center, for short root KGC) mainly runs the private key generation algorithm, and the other level nodes (the subkey generation center) generally only run the private key delegation algorithm.In order to improve the encryption efficiency, Guo et al. [16] first presented an identity-based online/offline encryption system. They repartitioned encryption processing into two phases: offline phase and online phase. For the offline phase, most encryption preprocessing is carried out and offline ciphertext is produced. In the online stage, a small amount of offline ciphertext is processed to obtain the encrypted ciphertext. Later, some online/offline encryption schemes are presented [17–20]. However, these schemes do not consider the problem of key leakage. Zhang et al. [21] put forward a leakage-resilient identity-based online/offline encryption scheme that is proposed by using the private key extension technique.


### 1.2. Our Motivations and Contributions

Based on the scheme [22], this paper proposes a leakage-resilient identity-based hierarchical online/offline encryption (LR-HIOOE) scheme. By binary extractor technology [23], our scheme can resist the leakage of the symmetric key used for message encryption in the system.OurLR-HIOOE includes six algorithms: Setup, KeyGen, Delegation, Encoff, Encon, and Decryption. The specific description of these algorithms is given in Section 3.1. Here, we only use them to explain the idea of our scheme which is shown in Figure 2.Figure 2
The idea of our LR-HIOOE.Encryption consists of two phases. A large number of complex operations are carried out in the offline stage, and a small number of simple calculations are carried out in the online stage. It is very suitable for resource-constrained scenes. Offline phase operations are outsourced to cloud service providers (CSP). The online phase operation is completed by the encryptor himself on the lightweight device.In essence, the binary extractor can transform the input source with a certain entropy into a more uniform output. The binary extractor is a component of many cryptographic primitives. Now, it has become an important tool for designing cryptography schemes against side channel attacks. In such cases, the proof of leakage resilience usually relies on the result that leakage information allowed for every call of the extractor is bounded. Medved and Standaert [24] and Chen et al. [25] show that the hardware implementation of the binary extractor can ensure that bounded leakage is allowed in the case of limited number of measurements. This also gives the reason why the binary extractor can be used as a leakage-resilient cryptography component. Our scheme uses the binary extractor to achieve leakage resilience.Waters [26] presented the dual system technique. The private key and ciphertext have two appearances: semifunctional appearance and normal appearance. The normal key correctly decrypts two kinds of ciphertext. The semifunctional private key only decrypts the normal ciphertext correctly. Inspired by the works [27–31], we present the syntax description and security model of LR-HIBOOE. To the best of our knowledge, there is no LR-HIBOOE scheme by using the binary extractor in the literature. We propose the first LR-HIBOOE scheme by using the binary extractor. Our scheme is proved to be secure and leakage-resilient by dual system encryption technology. Overall, the binary extractor provides leakage resilience, and the dual system encryption technology provides security.


## 1.1. Related Work

Micali and Reyzin [7] first proposed the model “only computing leaks (OCL).” In the OCL model, an attacker selects an effective and computable function and inputs the internal state and key and outputs some secret information. The complexity of the leakage function is unlimited. The only limitation is that the part which is not involved in the current operation does not leak secret information. Dziembowski and Pietrzak [8, 9] presented two leakage-resilient stream cipher schemes in the OCL model.Considering that the leakage not only occurs in the calculation process, Akavia et al. [10] presented the bounded leakage model (BLM). In BLM, the leakage function does not expose the whole private key. BLM does not solve the problem that the length of the leaked information obtained by the attacker is longer than the private key information and the amount of useful information is relatively small. To resolve the problem, Naor and Segev [11] presented “entropy bounded leakage model,” in which the entropy about leakage information is limited.Because it can reduce the burden of the key generation center, the hierarchical identity-based encryption (HIBE) schemes have been widely used and attracted the attention of many researchers. Guo et al. [12] proposed an efficient HIBE scheme with high computational efficiency by reasonably reducing the use of parameters. Langrehr and Pan [13] gave two tightly secure HIBE schemes by the matrix Diffie–Hellman assumption. Takayasu [14] presented an efficient adaptively secure revocable hierarchical identity-based encryption (RHIBE) with compact ciphertexts. Emura et al. [15] gave a generic construction about RHIBE by using HIBE and the complete subtree method.The hierarchical structure is conducive to protecting the confidentiality of data, and it is suitable for IoT systems, smart home systems, distributed data systems, cloud storage systems, etc. Private key delegation can also reduce the burden on the root private key generator (PKG).We use Figure1 to illustrate the hierarchical structure of the national medical diagnosis system. For the national medical system, the root node (the Ministry of Health, which is abbreviated as MH) generates the public key information of the user and acts as the root private key generation center to generate the private key of the secondary node (the Department of Health which is abbreviated as DH and the national hospital which is abbreviated as NH). The secondary node is responsible for generating the private key of the health bureau (HB) and the private key of the city hospital (CH). The third level city node is responsible for generating the private key of the town health center (THC) and the private key of the township hospital (TH). The medical management organization can delegate the private key to the staff, and each hospital can also delegate the private key to the doctors.Figure 1
The hierarchical structure of the national medical diagnosis system.For example, one user with the identity of “A1 City: Hospital B1” can delegate the private key to the user with the identity “A1 City: Hospital B1: C1 Doctor” but cannot delegate the private key to the user with the identity of “A1 City: Hospital B2: C1 Doctor.”The delegation solves the problem that the key generation center is overloaded. In fact, thek−1th layer’s user with the identity vector Ik−1=ID1,ID2,...,IDk−1 generates the private key of the kth layer’s user with the identity vector Ik=ID1,ID2,...,IDk−1,IDk.Generally speaking, the “delegation” algorithm is given explicitly or implicitly for the HIBE schemes. The most HIBE schemes explicitly give the delegation algorithm. For example, the “Delegate” algorithm of the paper [12] is the delegation algorithm, and the “Del” algorithm of the paper [13] is the delegation algorithm. In addition, some HIBE schemes implicitly give the delegation algorithm. For example, the subalgorithm “Delegation Key Generation” of the algorithm “GenSK” in the paper [14] acts as the delegation algorithm. The “GenSK” algorithm of the paper [15] has key delegation function. In fact, the two methods are essentially the same. From Figure 1, we can see that the root user (the root key generation center, for short root KGC) mainly runs the private key generation algorithm, and the other level nodes (the subkey generation center) generally only run the private key delegation algorithm.In order to improve the encryption efficiency, Guo et al. [16] first presented an identity-based online/offline encryption system. They repartitioned encryption processing into two phases: offline phase and online phase. For the offline phase, most encryption preprocessing is carried out and offline ciphertext is produced. In the online stage, a small amount of offline ciphertext is processed to obtain the encrypted ciphertext. Later, some online/offline encryption schemes are presented [17–20]. However, these schemes do not consider the problem of key leakage. Zhang et al. [21] put forward a leakage-resilient identity-based online/offline encryption scheme that is proposed by using the private key extension technique.


## 1.2. Our Motivations and Contributions

Based on the scheme [22], this paper proposes a leakage-resilient identity-based hierarchical online/offline encryption (LR-HIOOE) scheme. By binary extractor technology [23], our scheme can resist the leakage of the symmetric key used for message encryption in the system.OurLR-HIOOE includes six algorithms: Setup, KeyGen, Delegation, Encoff, Encon, and Decryption. The specific description of these algorithms is given in Section 3.1. Here, we only use them to explain the idea of our scheme which is shown in Figure 2.Figure 2
The idea of our LR-HIOOE.Encryption consists of two phases. A large number of complex operations are carried out in the offline stage, and a small number of simple calculations are carried out in the online stage. It is very suitable for resource-constrained scenes. Offline phase operations are outsourced to cloud service providers (CSP). The online phase operation is completed by the encryptor himself on the lightweight device.In essence, the binary extractor can transform the input source with a certain entropy into a more uniform output. The binary extractor is a component of many cryptographic primitives. Now, it has become an important tool for designing cryptography schemes against side channel attacks. In such cases, the proof of leakage resilience usually relies on the result that leakage information allowed for every call of the extractor is bounded. Medved and Standaert [24] and Chen et al. [25] show that the hardware implementation of the binary extractor can ensure that bounded leakage is allowed in the case of limited number of measurements. This also gives the reason why the binary extractor can be used as a leakage-resilient cryptography component. Our scheme uses the binary extractor to achieve leakage resilience.Waters [26] presented the dual system technique. The private key and ciphertext have two appearances: semifunctional appearance and normal appearance. The normal key correctly decrypts two kinds of ciphertext. The semifunctional private key only decrypts the normal ciphertext correctly. Inspired by the works [27–31], we present the syntax description and security model of LR-HIBOOE. To the best of our knowledge, there is no LR-HIBOOE scheme by using the binary extractor in the literature. We propose the first LR-HIBOOE scheme by using the binary extractor. Our scheme is proved to be secure and leakage-resilient by dual system encryption technology. Overall, the binary extractor provides leakage resilience, and the dual system encryption technology provides security.


## 2. Preliminaries

### 2.1. Minimum Entropy and Statistical Distance

Definition 1.
If random variablesU and V are in a finite domain ℧, 1/2∑σ∈℧PrU=σ−PrV=σ=SDU,V is regarded as their statistical distance for U and V.Definition 2.
The uncertainty measure of random variablesU is called minimum entropy, which is H∞U=−LogmaxuPrU=u. Given variable V, the uncertainty measure of random variables U is called conditional minimum entropy, which is H˜∞U|V=−LogEv←VmaxuPrU=u|V=v.Conclusion 1.
(see [23]): given three random variables U, V, and W in which V is λ bit length, there is H˜∞U|V,W≥H˜∞U|W−λ. In the paper, λ denotes the leakage amount.


### 2.2. Binary Extractor

Definition 3.
On the condition that as long asU∈0,1η and H∞U>k, there is SDExtU,Q,Q,D,Q≤ε,where ε can be ignored, D is uniform distribution of 0,1ζ and Q is uniform distribution of 0,1ξ, the binary function Ext:0,1η×0,1ξ⟶0,1ζ is called a k,ε-strong binary extractor [23].


### 2.3. Bilinear Group of Composite Order

For the algorithm which generates a bilinear group of composite order [28], it takes the system security parameter λ as input. It generates the bilinear group Ω=N=p1p2p3,G,GT,e of composite order, where p1,p2, and p3 are three λ-bit length primes. The order of cyclic groups G and GT is N. Bilinear map e meets the following two conditions.(1)
Bilinearity: For anyg,h∈G and a,b∈ZN, we get that ega,hb=eg,hab.(2)
Non degeneracy:∃g∈G such that eg,g≠1.Gp1,Gp2, and Gp3 are used to represent subgroups with orders p1,p2, and p3 in G. For example, if hi∈Gpi, hj∈Gpj, and i≠j, ehi,hj becomes an identity element of GT. Further, if h1∈Gp1, h2∈Gp2, and g is a generator of G, gp1p2 generates Gp3, gp1p3 generates Gp2, and gp2p3 generates Gp1. So, there exists α1,α2 such that h1=gp2p3α1, h2=gp1p3α2, and eh1,h2=egp2p3α1,gp1p3α2, =egα1,gp3α2p1p2p3=1. Thus, Gp1,Gp2, and Gp3 are orthogonal.Three assumptions are given to prove the security of our scheme.Assumption 1.
For a composite order bilinear group generation algorithmΨ: Ω=N=p1p2p3,G,GT,e←Ψ, g←Gp1,X3←Gp3, D=Ω,g,X3,T1←Gp1p2, and T2←Gp1, the advantage that algorithm A distinguishes T1 from T2 is Adv1Ψ,Aλ=PrAD,T1=1−PrAD,T2=1
If the advantagesAdv1Ψ,Aλ of any probabilistic polynomial algorithm can be ignored, it is said that the algorithm Ψ satisfies Assumption 1.
T1 expresses the product for certain element in Gp1 and certain element in Gp2, which are called the part of Gp1 and the part of Gp2, respectively.Assumption 2.
For a composite order bilinear group generation algorithmΨ: Ω=N=p1p2p3,G,GT,e←Ψ, g,X1←Gp1,X2,Y2←Gp2,X3,Y3←Gp3, D=Ω,g,X1X2,X3,Y2Y3, T1←G, and T2←Gp1p3, the advantage that algorithm A distinguishes T1 from T2 is Adv2Ψ,Aλ=PrAD,T1=1−PrAD,T2=1.
If the advantagesAdv2Ψ,Aλ of any probabilistic polynomial algorithm can be ignored, it is said that the algorithm Ψ satisfies Assumption 2.Assumption 3.
For a composite order bilinear group generation algorithmΨ: Ω=N=p1p2p3,G,GT,e←Ψ,α,s←ZN, g←Gp1,X2,Y2,Z2←Gp2,X3←Gp3, D=Ω,g,gαX2,X3,gsY2,Z2 , T1←eg,gαs, and T2←GT, the advantage that algorithm A distinguishes T1 from T2 is Adv3Ψ,Aλ=PrAD,T1=1−PrAD,T2=1.
If the advantagesAdv3Ψ,Aλ of any probabilistic polynomial algorithm can be ignored, it is said that the algorithm Ψ satisfies Assumption 3.


## 2.1. Minimum Entropy and Statistical Distance

Definition 1.
If random variablesU and V are in a finite domain ℧, 1/2∑σ∈℧PrU=σ−PrV=σ=SDU,V is regarded as their statistical distance for U and V.Definition 2.
The uncertainty measure of random variablesU is called minimum entropy, which is H∞U=−LogmaxuPrU=u. Given variable V, the uncertainty measure of random variables U is called conditional minimum entropy, which is H˜∞U|V=−LogEv←VmaxuPrU=u|V=v.Conclusion 1.
(see [23]): given three random variables U, V, and W in which V is λ bit length, there is H˜∞U|V,W≥H˜∞U|W−λ. In the paper, λ denotes the leakage amount.


## 2.2. Binary Extractor

Definition 3.
On the condition that as long asU∈0,1η and H∞U>k, there is SDExtU,Q,Q,D,Q≤ε,where ε can be ignored, D is uniform distribution of 0,1ζ and Q is uniform distribution of 0,1ξ, the binary function Ext:0,1η×0,1ξ⟶0,1ζ is called a k,ε-strong binary extractor [23].


## 2.3. Bilinear Group of Composite Order

For the algorithm which generates a bilinear group of composite order [28], it takes the system security parameter λ as input. It generates the bilinear group Ω=N=p1p2p3,G,GT,e of composite order, where p1,p2, and p3 are three λ-bit length primes. The order of cyclic groups G and GT is N. Bilinear map e meets the following two conditions.(1)
Bilinearity: For anyg,h∈G and a,b∈ZN, we get that ega,hb=eg,hab.(2)
Non degeneracy:∃g∈G such that eg,g≠1.Gp1,Gp2, and Gp3 are used to represent subgroups with orders p1,p2, and p3 in G. For example, if hi∈Gpi, hj∈Gpj, and i≠j, ehi,hj becomes an identity element of GT. Further, if h1∈Gp1, h2∈Gp2, and g is a generator of G, gp1p2 generates Gp3, gp1p3 generates Gp2, and gp2p3 generates Gp1. So, there exists α1,α2 such that h1=gp2p3α1, h2=gp1p3α2, and eh1,h2=egp2p3α1,gp1p3α2, =egα1,gp3α2p1p2p3=1. Thus, Gp1,Gp2, and Gp3 are orthogonal.Three assumptions are given to prove the security of our scheme.Assumption 1.
For a composite order bilinear group generation algorithmΨ: Ω=N=p1p2p3,G,GT,e←Ψ, g←Gp1,X3←Gp3, D=Ω,g,X3,T1←Gp1p2, and T2←Gp1, the advantage that algorithm A distinguishes T1 from T2 is Adv1Ψ,Aλ=PrAD,T1=1−PrAD,T2=1
If the advantagesAdv1Ψ,Aλ of any probabilistic polynomial algorithm can be ignored, it is said that the algorithm Ψ satisfies Assumption 1.
T1 expresses the product for certain element in Gp1 and certain element in Gp2, which are called the part of Gp1 and the part of Gp2, respectively.Assumption 2.
For a composite order bilinear group generation algorithmΨ: Ω=N=p1p2p3,G,GT,e←Ψ, g,X1←Gp1,X2,Y2←Gp2,X3,Y3←Gp3, D=Ω,g,X1X2,X3,Y2Y3, T1←G, and T2←Gp1p3, the advantage that algorithm A distinguishes T1 from T2 is Adv2Ψ,Aλ=PrAD,T1=1−PrAD,T2=1.
If the advantagesAdv2Ψ,Aλ of any probabilistic polynomial algorithm can be ignored, it is said that the algorithm Ψ satisfies Assumption 2.Assumption 3.
For a composite order bilinear group generation algorithmΨ: Ω=N=p1p2p3,G,GT,e←Ψ,α,s←ZN, g←Gp1,X2,Y2,Z2←Gp2,X3←Gp3, D=Ω,g,gαX2,X3,gsY2,Z2 , T1←eg,gαs, and T2←GT, the advantage that algorithm A distinguishes T1 from T2 is Adv3Ψ,Aλ=PrAD,T1=1−PrAD,T2=1.
If the advantagesAdv3Ψ,Aλ of any probabilistic polynomial algorithm can be ignored, it is said that the algorithm Ψ satisfies Assumption 3.


## 3. Syntax and Security Model of LR-HIBOOE

### 3.1. Syntax of LR-HIBOOE

The presentedLR-HIBOOE consists of the following six algorithms:Setup: given security parameterλ, the algorithm generates system public parameter PK and master private key MSK. Setupλ⟶PK,MSK.KeyGen: given master private keyMSK, public parameter PK, and identity vector I=ID1,…,IDj, the private key generator generates the private key SKI. KeyGenPK,MSK,I⟶SKI.Delegation: the algorithm inputs system public parameterPK, the private key SKI of identity vector I=ID1,…,IDj, and identity IDj+1 and outputs the private key SKI′ of identity vector I′=I,IDj+1 with j+1 layer. DelegationPK,SKI,IDj+1⟶SKI′.Encoff: given system public parameter PK, the algorithm outputs the offline ciphertext CT′. EncoffPK⟶CT′.Encon: the algorithm inputs system public parameter PK, the identity vector I, the offline ciphertext CT′, and the message M and produces the final ciphertext CT. EnconPK,M,I,CT′⟶CT.Decryption: the algorithm inputsPK, SKI, and the final ciphertext CT and outputs the message M. DecryptionPK,SKI,CT=M.We use Figures3 and 4 to show the technology roadmap of our LR-HIBOOE. Figure 3 shows the relations about the main algorithms of HIBOOE without leakage resilience. Figure 4 shows the relations about the main algorithms of LR-HIBOOE. In the offline encryption, we refresh the symmetric key by using an extractor.Figure 3
The relations about the main algorithms of HIBOOE without leakage resilience.Figure 4
The relations about the main algorithms of LR-HIBOOE.The adversary can obtain the confidential information of the cryptography system through side channel attacks, which leads to the disclosure of the system’s secret information, such as the private key information. For example, in a timing attack, the adversary can obtain relevant parameter information through the execution time of the algorithm. When the secret information is leaked, it will mainly cause a certain loss of the private key entropy. That is, the probability that the adversary guesses the private key is greater than the probability of the random guess. When the leaked information reaches a certain amount, the adversary can guess the entire private key. In order to prevent the adversary from guessing the whole private key, it is necessary to make up for the lost entropy. There are usually two ways. One is to extend the private key appropriately so that even if some entropy is lost, certain “entropy” can be retained, which will make it difficult for the adversary to guess the private key correctly. This method will make the private key longer, increase the storage cost, and increase the computing cost. The second way is to make up for the lost entropy in time, which requires an additional function “binary extractor” to rerandomize the private key and make up for the lost entropy of the private key. This method does not increase the storage cost of the system, and the computing cost is almost unchanged. In our scheme, the extractor rerandomizes the symmetric key. It is used to compensate for the entropy loss of the symmetric key which is used to encrypt the plaintext.


### 3.2. Security Model of LR-HIBOOE

The following gameGameR which is played by the attacker and the challenger is used to describe the security of our LR-HIBOOE scheme.GameR:Initialize: the challenger calls the algorithm “Setup” to obtain the public parameterPK and master key and gives PK to the attacker. We use W to record private keys that are given to the attacker. The initial value of set W is empty.Phase 1: the attacker makes some queries as follows:Private key query. the adversary gives the identity vectorI to the challenger. Then, the challenger calls the private key generation algorithm to obtain SKI and send it to the attacker. The challenger puts it into the set W.Private key delegation query: a private keySKI in W and an identity ID are given to the challenger by the attacker. The challenger calls the algorithm delegation to obtain the corresponding private key SKI′ (I′=I,IDj+1) and send it to the attacker. The challenger puts it into the set W.Leakage query: in terms of private keySKI∗ for the identity vector I∗, the challenger obtains the corresponding symmetric key K of SKI∗ and sends it to the attacker. The attacker selects a function f which is called as leakage function. The challenger sends fSKI∗ to the attacker. Let ξ represent the length of the output value of fSKI∗.Challenge: the attacker sends the messageM0 or M1 and a certain identity vector I∗ to the challenger, where I∗ and each prefix vector of I∗ are not in W. The challenger obtains the private key SKI∗ and randomly selects υ∈0,1 to encrypt Mυ. The challenger sends the attacker the ciphertext CT.Phase 2: for the attacker, he makes the private key inquiry and the private key delegation inquiry with the restraint that the required identity vector cannot be a prefix vector ofI∗. In addition, the attacker cannot make leakage query.Guess: the attacker gives the guessν′ about ν. If ν=ν′, the attacker wins the game GameR.The scheme is said to be secure on the condition that the advantage which is gained by any attacker in the above game is ignored.


## 3.1. Syntax of LR-HIBOOE

The presentedLR-HIBOOE consists of the following six algorithms:Setup: given security parameterλ, the algorithm generates system public parameter PK and master private key MSK. Setupλ⟶PK,MSK.KeyGen: given master private keyMSK, public parameter PK, and identity vector I=ID1,…,IDj, the private key generator generates the private key SKI. KeyGenPK,MSK,I⟶SKI.Delegation: the algorithm inputs system public parameterPK, the private key SKI of identity vector I=ID1,…,IDj, and identity IDj+1 and outputs the private key SKI′ of identity vector I′=I,IDj+1 with j+1 layer. DelegationPK,SKI,IDj+1⟶SKI′.Encoff: given system public parameter PK, the algorithm outputs the offline ciphertext CT′. EncoffPK⟶CT′.Encon: the algorithm inputs system public parameter PK, the identity vector I, the offline ciphertext CT′, and the message M and produces the final ciphertext CT. EnconPK,M,I,CT′⟶CT.Decryption: the algorithm inputsPK, SKI, and the final ciphertext CT and outputs the message M. DecryptionPK,SKI,CT=M.We use Figures3 and 4 to show the technology roadmap of our LR-HIBOOE. Figure 3 shows the relations about the main algorithms of HIBOOE without leakage resilience. Figure 4 shows the relations about the main algorithms of LR-HIBOOE. In the offline encryption, we refresh the symmetric key by using an extractor.Figure 3
The relations about the main algorithms of HIBOOE without leakage resilience.Figure 4
The relations about the main algorithms of LR-HIBOOE.The adversary can obtain the confidential information of the cryptography system through side channel attacks, which leads to the disclosure of the system’s secret information, such as the private key information. For example, in a timing attack, the adversary can obtain relevant parameter information through the execution time of the algorithm. When the secret information is leaked, it will mainly cause a certain loss of the private key entropy. That is, the probability that the adversary guesses the private key is greater than the probability of the random guess. When the leaked information reaches a certain amount, the adversary can guess the entire private key. In order to prevent the adversary from guessing the whole private key, it is necessary to make up for the lost entropy. There are usually two ways. One is to extend the private key appropriately so that even if some entropy is lost, certain “entropy” can be retained, which will make it difficult for the adversary to guess the private key correctly. This method will make the private key longer, increase the storage cost, and increase the computing cost. The second way is to make up for the lost entropy in time, which requires an additional function “binary extractor” to rerandomize the private key and make up for the lost entropy of the private key. This method does not increase the storage cost of the system, and the computing cost is almost unchanged. In our scheme, the extractor rerandomizes the symmetric key. It is used to compensate for the entropy loss of the symmetric key which is used to encrypt the plaintext.


## 3.2. Security Model of LR-HIBOOE

The following gameGameR which is played by the attacker and the challenger is used to describe the security of our LR-HIBOOE scheme.GameR:Initialize: the challenger calls the algorithm “Setup” to obtain the public parameterPK and master key and gives PK to the attacker. We use W to record private keys that are given to the attacker. The initial value of set W is empty.Phase 1: the attacker makes some queries as follows:Private key query. the adversary gives the identity vectorI to the challenger. Then, the challenger calls the private key generation algorithm to obtain SKI and send it to the attacker. The challenger puts it into the set W.Private key delegation query: a private keySKI in W and an identity ID are given to the challenger by the attacker. The challenger calls the algorithm delegation to obtain the corresponding private key SKI′ (I′=I,IDj+1) and send it to the attacker. The challenger puts it into the set W.Leakage query: in terms of private keySKI∗ for the identity vector I∗, the challenger obtains the corresponding symmetric key K of SKI∗ and sends it to the attacker. The attacker selects a function f which is called as leakage function. The challenger sends fSKI∗ to the attacker. Let ξ represent the length of the output value of fSKI∗.Challenge: the attacker sends the messageM0 or M1 and a certain identity vector I∗ to the challenger, where I∗ and each prefix vector of I∗ are not in W. The challenger obtains the private key SKI∗ and randomly selects υ∈0,1 to encrypt Mυ. The challenger sends the attacker the ciphertext CT.Phase 2: for the attacker, he makes the private key inquiry and the private key delegation inquiry with the restraint that the required identity vector cannot be a prefix vector ofI∗. In addition, the attacker cannot make leakage query.Guess: the attacker gives the guessν′ about ν. If ν=ν′, the attacker wins the game GameR.The scheme is said to be secure on the condition that the advantage which is gained by any attacker in the above game is ignored.


## 4. Construction of LR-HIBOOE

Assuming that the maximum layer depth isl, in the offline encryption stage, each layer needs some random numbers to generate an offline ciphertext and carry some additional information. In the online encryption stage, only l integer operations are needed to get the corresponding ciphertext. Our LR-HIBOOE scheme contains the following algorithms.Setup: the algorithm runsΨ to obtain a bilinear group G with order N=p1p2p3. We use l to represent the maximum depth of identity vector in LR-HIBOOE. Let ℳ denote message space and ℳ=2m. H denotes a hash function H:0,1∗⟶0,1m. The algorithm randomly selects X3∈Gp3,h,u1,…,ul∈Gp1, α∈ZN and gets system public parameter PK=N,H,g,h,eg,gα,u1,…,ul,X3, where g is a generator of Gp1. The master private key is MSK=α.KeyGen: private key generator (PKG) inputs system public parametersPK and identity vector ID1,...,IDj. PKG randomly selects R3,R3′,Rj+1,…,Rl∈Gp3 and r∈ZN. PKG generates private key K1=grR3,K2=gαu1ID1⋯ujIDjhrR3′,, Ej+1=uj+1rRj+1,…,El=ulrRlDelegation: the delegation algorithm inputs the private keyK1,K2,Ej+1,…,El of the identity vector ID1,…,IDj. The algorithm randomly selects r′,t′∈ZN and R˜j+2,…,R˜l,R˜3,R˜3′∈Gp3. The algorithm generates the private key about the identity vector ID1,…,IDj+1: K1˜=K1gr′R˜3,K2˜=K2u1ID1⋯ujIDjhr′Ej+1IDj+1uj+1r′IDj+1R˜3′,, K3˜=t′, Ej+2˜=Ej+2uj+2r′R˜j+2,…,El˜=Elulr′R˜l.Encoff: the algorithm randomly selects s,t,x1,x2,…,xl∈ZN. It calculates K=eg,gαs, C1=u1x1…ulxlhs,, C2=gs, C3,1=u1st,C3,2=u2st,…,C3,l=ulst, C4=HC3,1,C3,2,…,C3,l, C5=ExtK,C4. It gains the ciphertext CT′=K,C1,C2,C3,1…,C3,l,C5,t,x1,x2,…,xl.Encon: given the message M, identity vector I=ID1,…,IDj and CT′, it sets t1=t−1ID1−x1,t2=t−1ID2−x2,…,tj=t−1IDj−xj,tj+1=t−1xj+1,…,tl=t−1xl. The algorithm calculates C6=C5⊕M. The final ciphertext is(1)CT=C1,C2,C3,1…,C3,l,C6,t1,t2,…,tl.Decryption: if the identity vectors of ciphertext and private key areID1,…,IDj. The decryption process is as follows:(2)eK2,C2eK1,C1C3,1t1C3,2t2⋯Cl,2tl=egαu1ID1⋯ulIDlhrR3′,gsegrR3,u1x1⋯ulxlhsu1stt−1ID1−x1⋯ujstt−1IDj−xjuj+1st−t−1xj+1⋯ulst−t−1xl=eg,gαseu1ID1⋯ujIDjh,grseg,u1ID1⋯ujIDjhrs=eg,gαs=K,M=C6⊕ExtK,HC3,1,C3,2,…,C3,l.We show the specific operations of our leakage-resilient scheme (LR-HIBOOE) in Figure 5. As a comparison, we also give the specific operations of the scheme without leakage resilience (HIBOOE).Figure 5
The main operations of our leakage-resilient scheme.


## 5. Security Proof

By constructing semifunctional private key and ciphertext, we prove the security of ourLR-HIBOOE scheme.Semifunctional ciphertext: we randomly select a generatorg2 of Gp2. For identity vector I=ID1,…,IDj, we randomly select y,v1,v2,…,vl,zc∈ZN and calculate K=eg,gαs, C1^=u1x1⋯ulxlhsg2yzc,, C2^=gsg2y, C3,1^=u1stg2ytv1,C3,2^=u2stg2ytv2,…,C3,l^=ulstg2ytvl, C4^=HC3,1,C3,2,…,C3,l, C5^=ExtK,C4, t1=t−1ID1−x1,t2=t−1ID2−x2,…,tj=t−1IDj−xj,, tj+1=t−1IDj+1,…,tl=t−1IDl, and C6^=C5^⊕M. The semifunctional ciphertext is CT^=C1^,C2^,C3,1^,…,C3,l^,C6^,t1,t2,…,tl.Semifunctional private key: for the normal private keyK1,K2,Ej+1,…,El, we select the random numbers γ,zk,zj+1,…,zl∈ZN and generate the semifunctional private key:(3)K1^=K1g2γ=grg2γR3,K2^=K2g2γzk=gαu1ID1…ujIDjhrg2γzkR3′,Ej+1^=Ej+1g2γzj+1=uj+1rg2γzj+1Rj+1,…,El^=Elg2γzl=ulrg2γzlRl.The semifunctional private key correctly decrypts the normal ciphertext via the normal private key. The normal private key correctly decrypts the semifunctional ciphertext. If the semifunctional private key decrypts the semifunctional ciphertext, we have(4)eK2^,C2^eK1^,C1^C3,1^t1C3,2^t2…C3,l^tl=egαu1ID1…ujIDjhrg2γzkR3′,gsg2yegrg2γR3,u1x1…ulxlhsg2yzcu1stt−1ID1−x1g2ytv1…ujstt−1IDj−xjuj+1st−t−1xj+1g2ytvj+1…ulst−t−1xlg2ytvl=eg,gαseg2,g2yγzk−zc−v1ID1−x1−⋯−vjIDj−xj+vj+1xj+1+⋯+vlxl.Ifzk=zc+v1ID1−x1+⋯+vjIDj−xj−vj+1xj+1−⋯−vlxl, the ciphertext can be decrypted correctly. At this time, we call the semifunctional private key as nominal one. Although it contains components of G2, it correctly decrypts the ciphertext.OurLR-HIBOOE scheme is proved to be secure through some games as follows:GameR. This game is given in Section 3.2.GameR′. The only difference between GameR and GameR′ is the way that they respond to the private key inquiry. In GameR′, the challenger obtains a private key through the private key generation algorithm, while the challenger obtains a private key through the private key delegation algorithm in GameR.GameRestricted. The game is similar to GameR′. The only restriction is that the attacker cannot query the prefix vector of the challenging identity vector modulo p2. This restriction also applies to the following games:We useq to indicate the number of private key inquiries.Gamek (k∈1,q). The game is similar to GameRestricted. The ciphertext which is sent to the attacker is the semifunctional one. The first k private key responses are semifunctional ones, and the rest private key responses are normal ones. In particular, in Game0, the challenge ciphertext is in semifunctional form, and the private key is in normal form. In Gameq, all private keys and challenge ciphertexts are in semifunctional form.GameF. The only difference between GameF and Gameq is the ciphertext. In GameF, the challenge ciphertext is a semifunctional one about any random message, while in Gameq, the ciphertext is a ciphertext about either of the two submitted messages.The next five lemmas are given to illustrate that the series of games are not indistinguishable from the point of the attacker.Lemma 1.
From the point of any attackerA, we have GameRAdvA=GameR′AdvA.Proof.
The distribution of private keys is exactly the same from the private key generation algorithm and private key delegation algorithm. Therefore, in the view of the attacker, this is not fundamentally different. Thus, the attacker can only gain the same advantage in the two games.Lemma 2.
If there is an algorithmA who obtains the advantage ε in differentiating GameR′ from GameRestricted, i.e., GameR′AdvA−GameRestrictedAdvA=ε. An algorithm ℬ is designed to destroy Assumption 2 over the same advantage ε.Proof.
In consideration ofg,X1X2,X3,Y2Y3, the attacker A and the algorithm ℬ simulate the game GameR′. A has a probability ε to obtain the identity vector I and I∗ on the condition that I≠I∗modN. ℬ calculates a=gcdI−I∗,N to get one factor of N. Let b=N/a. Because a is divided by p2 and N=ab=p1p2p3, there are three cases as follows:(1)
a and b are p1 and p2p3, respectively.(2)
a and b are p2 and p1p3, respectively(3)
a and b are p3 and p1p2, respectively.Case 1.
ℬ calculates Y2Y3a and Y2Y3b. If Y2Y3a=1, a=p1. Otherwise, if Y2Y3b=1, b=p1. If eTa,X1X2=1, ℬ can conclude that T does not contain a component of Gp2. Otherwise, T does contain the component of Gp2.Case 2.
ℬ calculates X1X2a and X1X2b. If they are not unit elements and do not meet Case 1, it meets Case 2. ℬ calculates ga and gb. If ga=1, a=p1p3. Otherwise, if gb=1, b=p1p3. Without loss of generality, we suppose that b=p1p3 and a=p2. In case Tb is a unit element, ℬ can conclude that T contains the component of Gp2. Otherwise, T does not contain the component of Gp2.Case 3.
ℬ calculates X3a and X3b. If X3a=1, a=p3. Otherwise, if X3b=1, b=p3.
We suppose thata=p3. If eTa,Y2Y3 is a unit element, ℬ can conclude that T does not contain the component of Gp2. Otherwise, T contains the component of Gp2. Thus, ℬ breaks Assumption 2 over the advantage which is larger than ε/2.Lemma 3.
If there is an algorithmA who achieves the advantage ε in differentiating Game0 from GameRestricted, i.e., GameRestrictedAdvA−Game0AdvA=ε. One algorithm ℬ is designed to destroy Assumption 1 over the same advantage ε.Proof.
In consideration ofg,X3,T, the attacker A and the algorithm ℬ simulate the game Game0 or GameRestricted. ℬ randomly selects a,a1,…,al,b∈ZN. ℬ computes u1=ga1,…,ul=gal and h=gb. ℬ sends the public parameters PK=N,H,g,h,eg,gα,u1,…,ul,X3 to the attacker A. For the entity vector I=ID1,…,IDj which is given by the attacker A, ℬ selects randomly r,t,w,vj1,…,vl∈ZN. ℬ computes K1=grX3t,K2=gαu1ID1…ujIDjhrX3w,Ej+1=uj+1rX3vj+1,…,El=ulrX3vl.
For the messageM0, M1 and the challenged entity vector I∗=ID1∗,…,IDj∗ which are given by the attacker A, ℬ randomly selects t,x1,x2,…,xl∈ZN and b∈0,1. ℬ computes K=eT,gα, C1=Ta1x1+a2x2+…+alxl+b, C2=T, C3,1=Ta1t,C3,2=Ta2t,…,C3,l=Talt, C4=HC3,1,C3,2,…,C3,l, C5=ExtK,C4, t1=t−1ID1∗−x1,t2=t−1ID2∗−x2,…,tj=t−1IDj∗−xj,tj+1=t−1xj+1,…,tl=t−1xl, and C6=C5⊕Mb. ℬ gets the ciphertext:(5)CT=C1,C2,C3,1…,C3,l,C6,t1,t2,…,tl.
This implicitly setsgs as the Gp1 component of T. Supposing that T∈Gp1p2, the ciphertext is one semifunctional form, where zc=a1x1+…+alxl+b. A simulates Game0. As for T∈Gp1, the ciphertext is one normal ciphertext. The attacker simulates GameRestricted. Therefore, the algorithm ℬ breaks Assumption 1 and obtains advantage ε.Lemma 4.
If there exists an algorithmA which gains the advantage ε in differentiating Gamei from Gamei−1, i.e., Gamei−1AdvA−GameiAdvA=ε. One algorithm ℬ is designed to destroy Assumption 2 over the same advantage ε.Proof.
In consideration ofg,X1X2,X3,Y2Y3,T, ℬ randomly selects a,a1,…,al,b∈ZN. ℬ sends the parameters u1=ga1,…,ul=gal,h=gb,eg,ga to the attacker A.
The attackerA asks the private key about the pth identity vector ID1,…,IDj.
Whenp<i, ℬ is given one semifunctional private key. ℬ selects random number r,z,t,zj+1,…,zl∈ZN and calculates K1=grY2Y3t,K2=gαu1ID1…ujIDjhrY2Y3z,Ej+1=uj+1rY2Y3zj+1,…,El=ulrY2Y3zl, where g2γ=Y2t. The semifunctional key is evenly distributed.
Whenp>i, ℬ produces one normal private key. ℬ selects random number r,t,w,zj+1,…,zl∈ZN and calculates K1=grX3t,K2=gαu1ID1…ujIDjhrX3w,Ej+1=uj+1rX3zj+1,…,El=ulrX3zl.
Whenp=i, the algorithm ℬ sets zk=a1ID1+…+ajIDj+b. ℬ selects random number r,w,wj+1,…,wl∈ZN and calculates K1=T,K2=gαTzkX3w,Ej+1=uj+1rTwj+1,…,El=ulrTwl.
Supposing thatT∈Gp1p3, the private key has normal form, where gr is the Gp1 component of T. As for T∈G, the private key takes on semifunctional form.
Challenge. For two messageM0, M1 and the challenged entity vector I∗=ID1∗,…,IDj∗ which are given by the attacker A, ℬ randomly selects t,x1,x2,…,xl∈ZN and b∈0,1. ℬ calculates K=eX1X2,gα, C1=X1X2a1x1+a2x2+...+alxl+b, C2=X1X2, C3,1=X1X2a1t,C3,2=X1X2a2t,…,C3,l=X1X2alt, C4=HC3,1,C3,2,…,C3,l, C5=ExtK,C4, t1=t−1ID1∗−x1,t2=t−1ID2∗−x2,…,tj=t−1IDj∗−xj,tj+1=t−1xj+1,…,tl=t−1xl, and C6=C5⊕Mb. ℬ obtains the ciphertext CT=C1,C2,C3,1…,C3,l,C6,t1,t2,…,tl.
It indirectly makes thatgsg2y=X1X2 and zc=a1x1+a2x2+…+alxl+b. Because the ith entity vector cannot be a prefix modulo p2 of the challenged entity vector I∗=ID1∗,…,IDj∗, i.e. ID1∗,…,IDj∗≠x1,x2,…,xj, the attacker A thinks that zc,zk are randomly distributed.
zc and zk have an important relationship. When ℬ needs to judge whether the private key of ith entity vector is semifunctional one, it generates one semifunctional ciphertext.
Becausezk=zc+v1ID1−x1+…+vjIDj−xj−vj+1xj+1−…−vlxl, even if the private key of ith entity vector is semifunctional, the decryption can succeed, which is equivalent to generate a nominally semifunctional private key.
IfT∈Gp1p3, ℬ simulates Gamei−1. If T∈G, ℬ simulates Gamei. Therefore, ℬ breaks Assumption 2 and obtains advantage ε.Lemma 5.
Supposing that there exists an attackerA who gains the advantage ε in distinguishing Gameq and GameF, i.e., GameqAdvA−GameFAdvA=ε. One algorithm ℬ is designed to destroy Assumption 3 over the same advantage ε.Proof.
In consideration ofg,gαX2,X3,gsY2,Z2,T, ℬ randomly selects a,a1,…,al,b∈ZN and sends the public parameters u1=ga1,…,ul=gal,h=gb, eg,ga=egαX2,g to the attacker A.
When the attackerA makes one private key inquiry about the identity vector ID1,…,IDj, ℬ selects random number c,r,t,w,z,zj+1,…,zl,wj+1,…,wl∈ZN and calculates K1=grZ2zX3t,K2=gαX2u1ID1⋯ujIDjhrX3wZ2c,Ej+1=uj+1rY2Y3zj+1X3wj+1,…,El=ulrY2Y3zlX3wl.
Challenge. For the messageM0, M1 and the challenged entity vector I∗=ID1∗,…,IDj∗ which are given by the attacker A, ℬ randomly selects t,x1,x2,…,xl∈ZN and b∈0,1. ℬ calculates K=T, C1=gsY2a1x1+a2x2+…+alxl+b, C2=gsY2a1ID1+a2ID2+…+ajxj+b, C3,1=gsY2a1t,C3,2=gsY2a2t,…,C3,l=gsY2alt, C4=HC3,1,C3,2,…,C3,l, C5=ExtK,C4, t1=t−1ID1∗−x1,t2=t−1ID2∗−x2,…,tj=t−1IDj∗−xj,tj+1=t−1xj+1,…,tl=t−1xl, and C6=C5⊕Mb. ℬ obtains the ciphertext CT=C1,C2,C3,1…,C3,l,C6,t1,t2,…,tl.
This implicitly sets thatzc=a1x1+⋯+alxl+b. What is more, zc is only related to module p2. Because u1=ga1,…,ul=gal,h=gb are only the elements of Gp1, a1,…,al,b modulo p1 are not related to zc=a1x1+⋯+alxl+bmodulo p2.
In caseT=eg,gas, the challenge ciphertext about the message Mb is semifunctional form. In the case, T is one random number in GT, and the challenge ciphertext is about one random message and is semifunctional. Therefore, the algorithm ℬ breaks Assumption 3 over advantage ε.Theorem 1.
As long as Assumptions1–3 hold, our scheme is fully secure.Proof.
Lemmas1–5 show that the advantages gained by attackers in the game GameR and GameF are the same and can be ignored. In addition, b is hidden in the game GameF. In this way, the advantage of the attacker to break the proposed scheme is ignored.
Specifically, letεii∈1,2,3 denote the advantage that the attacker breaks assumption ii∈1,2,3.
In view of Lemmas1–5, the difference of the advantage that the attacker may gain in different games is as follows:(6)GameRAdvA=GameR′AdvA,GameR′AdvA−GameRestrictedAdvA≤ε2,GameRestrictedAdvA−Game0AdvA≤ε1,Gamei−1AdvA−GameiAdvA≤ε2,GameqAdvA−GameFAdvA≤ε3.
Furthermore, we haveGameRAdvA−GameFAdvA≤ε2+ε1+ε2+ε3. Thus, any attacker only gains negligible advantages.


## 6. Analysis of Leakage Resilience

Theorem 2.
The relative leakage rate of the encapsulated key of our scheme isρ=Leak/LogN≈1.Proof.
From the real security game, we knowH˜∞A|VIEW=LogN. If the leakage information obtained by the attacker through the leakage query is λ bits; that is, Leak has 2λ values. Then, from Conclusion 1 it can be obtained that H˜∞A|Leak,VIEW≥H˜∞A|VIEW−λ=LogN−λ.
Therefore, if the extractor isLogN−λ,ε strong, it can be obtained that SDExtk,s∗,s∗,Leak,VIEW,U,s∗,Leak,VIEW≤ε,where U is uniformly distributed. In fact, when the extractor is good enough, the leakage λ can approach LogN. Then, C6=Mb⊕Exteg,gαs,HC3,1,C3,2,…,C3,l and uniform distribution are indistinguishable. Therefore, the leakage ratio of the encapsulated key ρ=Leak/LogN≈LogN/LogN=1. Thus, Theorem 2 holds.


## 7. Efficiency Evaluation and Experimental Simulation

We use Table1 to show the comparisons between our scheme and the schemes [21, 22]. We mainly compared the offline encryption, online encryption, decryption, and some other aspects. Let l denote the maximum number of the level. Let P denote the pairing operation in G. Let G and ZN denote the length of G and ZN, respectively. Let Me denote the exponential operation in G. Let m denote the multiplication operation in G or ZN. Let E denote the operation time of extractor function. In the scheme [21], n is a parameter which determines the leakage [21, 22] rate.Table 1
The comparisons between our scheme and the schemes.
SchemesOnline encryptionOffline encryptionDecryptionThe length of ciphertextHierarchyLR[21]1m+1Men+4Men+2Pn+4G+1ZNNoYes[22]lm2l+3Me2P+l+1Mel+2G+l+1ZNYesNoOurslm+E2l+3Me2P+l+1Mel+2G+l+1ZNYesYesIt can be seen from Table1 that our scheme and the scheme [22] have the same calculation efficiency about offline encryption and decryption. In the online encryption phase, our scheme has one more extractor operation than the scheme [22]. In particular, the operation time of the extractor is relatively short, so the overall time about online encryption of our scheme and that of the scheme [22] is almost the same. Compared with the literature [21], their scheme has no hierarchal function, which is equivalent to the special case of our scheme when l=1. The efficiency of the scheme [21] is affected by parameter n (n is a parameter which determines the leakage rate). Therefore, under the same conditions, our scheme is more efficient than the scheme [21]. In the paper [21], they obtain the leakage resilience through the private key extension technology. In our scheme, we use the extractor to rerandomize the private key to obtain the leakage resilience. These are two different ideas.The experimental platform is a PC with 64 bit operating system Windows 10, 3.40 GHz main frequency, 8.00 G RAM and Intel (R) Core (™) i7-6700 CPU. Based on Java Pairing Based Cryptography Library 2.0.0 [32], we use Eclipse 4.4.1 for simulation software. The 160 bit composite order elliptic curve y2=x3+x is selected for our experiment. When the maximum level is 10, the online encryption time is 0.018 seconds, the offline encryption time is 0.460 seconds, and the decryption time is 0.39 seconds.


## 8. Conclusions

In this article, we provide an online/offline identity-based hierarchal encryption scheme with leakage resilience which is presented. By using the dual system technique, we prove the security of the scheme. The use of the binary extractor provides the leakage resilience. The entropy leakage ratio of the encapsulated symmetric key is close to 1. Because leakage-resilient cryptography is a relatively new research direction in cryptography, there are still many problems worthy of further research. For example, we will focus on the construction of efficient and leakage-resilient cryptography scheme.



---

*Source: 6849761-2022-11-30.xml*