Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Anonymity from Asymmetry: New Constructions for Anonymous HIBE Ducas L´ eo, Ecole Normale Superieure, Paris February 23, 2010 Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Plan 1 Introduction 2 Anonymous IBE Construction 3 Extension to HIBE and HVE 4 Conclusion Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion 1 Introduction 2 Anonymous IBE Construction 3 Extension to HIBE and HVE 4 Conclusion Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Identity Based Encryption IBE (Identity Based Encryption System) : any string ca be used as a public key, (knowing some public parameters) HIBE (Hierarchical Identity Based Encryption System) : Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Identity Based Encryption IBE (Identity Based Encryption System) : any string ca be used as a public key, (knowing some public parameters) corresponding private keys are derived from a master secret HIBE (Hierarchical Identity Based Encryption System) : Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Identity Based Encryption IBE (Identity Based Encryption System) : any string ca be used as a public key, (knowing some public parameters) corresponding private keys are derived from a master secret HIBE (Hierarchical Identity Based Encryption System) : Public keys are lists of strings, forming a tree Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Identity Based Encryption IBE (Identity Based Encryption System) : any string ca be used as a public key, (knowing some public parameters) corresponding private keys are derived from a master secret HIBE (Hierarchical Identity Based Encryption System) : Public keys are lists of strings, forming a tree A private key for a node allow derivation of private key for all children nodes Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Anonymity for (H)IBE Anonymity : Ciphertext should not reveal information about the public Key used to encrypt Building blocks for search on encrypted data systems. Generalizable to Hidden Vector Encryption systems. Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion (H)IBE construction using pairing Non-anonymous constructions : Boneh & Franklin [BF03] (Bilinear-DH assumption, ROM) Boneh & Boyen [BB04] a.k.a. BB 1 (Bilinear-DH assumption) Waters [Wat05] (Bilinear-DH assumption) Boneh, Boyen & Goh [BBG05] (Bilinear-DH Exponent assumption) Anonymous construction : Boyen & Waters [BW06] (linear assumption) Shi & Waters [SW08] (Composite DH assumption) Seo et al. [SKOS09] (composite DH assumption) Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Non-anonymity of BB 1 Given a bilinear map e : G × G → G t , and a generator g ∈ G . Setup Choose random α, β, γ, δ ∈ Z p , set g 1 = g α , g 2 = g β , h = g γ , f = g δ . Output PP = ( g , g 1 , g 2 , h ) , mk = g α β Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Non-anonymity of BB 1 Given a bilinear map e : G × G → G t , and a generator g ∈ G . Setup Choose random α, β, γ, δ ∈ Z p , set g 1 = g α , g 2 = g β , h = g γ , f = g δ . Output PP = ( g , g 1 , g 2 , h ) , mk = g α β mk · ( h I · f ) r , g r � � Extract (I) Choose random r ∈ Z p . Output d I = Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Non-anonymity of BB 1 Given a bilinear map e : G × G → G t , and a generator g ∈ G . Setup Choose random α, β, γ, δ ∈ Z p , set g 1 = g α , g 2 = g β , h = g γ , f = g δ . Output PP = ( g , g 1 , g 2 , h ) , mk = g α β mk · ( h I · f ) r , g r � � Extract (I) Choose random r ∈ Z p . Output d I = Encrypt (M,I) To encrypt M ∈ G , choose s ∈ Z p and compute C = ( M · e ( g 1 , g 2 ) s , g s , ( h I · f ) s ) Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Non-anonymity of BB 1 Given a bilinear map e : G × G → G t , and a generator g ∈ G . Setup Choose random α, β, γ, δ ∈ Z p , set g 1 = g α , g 2 = g β , h = g γ , f = g δ . Output PP = ( g , g 1 , g 2 , h ) , mk = g α β mk · ( h I · f ) r , g r � � Extract (I) Choose random r ∈ Z p . Output d I = Encrypt (M,I) To encrypt M ∈ G , choose s ∈ Z p and compute C = ( M · e ( g 1 , g 2 ) s , g s , ( h I · f ) s ) e ( g s , h I ′ f ) = e ( g , ( h I f ) s ) iff I = I ′ . With symmetric pairing anonymity is broken Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Contribution Tweak on BB 1 [BB04] IBE to make it provably anonymous with asymmetric pairing. Adapt to the Hierarchical version, giving also an Hidden Vector Encryption System The tweak is also applicable to [BBG05] constructions, giving efficiency trade-off alternative for anonymous HIBE. Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion 1 Introduction 2 Anonymous IBE Construction 3 Extension to HIBE and HVE 4 Conclusion Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion Assumption Given a bilinear map e : G × ˆ G → G t , and a generators g ∈ ˆ g ∈ G , ˆ G . Our assumption : For randoms a , b , c ∈ Z p and T ∈ G It is hard to distinguish between g , g a , g ab , g c , ˆ g a , ˆ g b , g abc � ∈ G 4 × ˆ G 3 × G � D N := g , ˆ g , g a , g ab , g c , ˆ g a , ˆ g b , T ∈ G 4 × ˆ G 3 × G � � D R := g , ˆ Composition of two classic assumption : decisional- BDH and decisional- XDH Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion The tweak Setup Choose random α, β, γ, δ, η ∈ Z p , set g 1 = g α , g 2 = g β , h = g γ , f = g δ , t = g η and analogues g 1 = ˆ g α . . . . Output G 3 and g 2 , ˆ ∈ G 5 × ˆ � � PP = g , g 1 , h , f , t , ˆ g , ˆ h g αβ , ˆ t ) ∈ ˆ G 3 f , ˆ mk = (ˆ g 0 = ˆ Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion The tweak Setup Choose random α, β, γ, δ, η ∈ Z p , set g 1 = g α , g 2 = g β , h = g γ , f = g δ , t = g η and analogues g 1 = ˆ g α . . . . Output G 3 and g 2 , ˆ ∈ G 5 × ˆ � � PP = g , g 1 , h , f , t , ˆ g , ˆ h g αβ , ˆ t ) ∈ ˆ G 3 f , ˆ mk = (ˆ g 0 = ˆ Extract (I) Choose random r , R ∈ Z p . Output � h I ˆ f ) r ˆ g R � g 0 (ˆ t R , ˆ g r , ˆ d I = ˆ Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Introduction Anonymous IBE Construction Extension to HIBE and HVE Conclusion The tweak Setup Choose random α, β, γ, δ, η ∈ Z p , set g 1 = g α , g 2 = g β , h = g γ , f = g δ , t = g η and analogues g 1 = ˆ g α . . . . Output G 3 and g 2 , ˆ ∈ G 5 × ˆ � � PP = g , g 1 , h , f , t , ˆ g , ˆ h g αβ , ˆ t ) ∈ ˆ G 3 f , ˆ mk = (ˆ g 0 = ˆ Extract (I) Choose random r , R ∈ Z p . Output � h I ˆ f ) r ˆ g R � g 0 (ˆ t R , ˆ g r , ˆ d I = ˆ Encrypt (M,I) To encrypt M ∈ G , choose s ∈ Z p and compute g 2 ) s , g s , ( h I f ) s , t s � � C = M · e ( g 1 , ˆ Ducas L´ eo, Ecole Normale Superieure, Paris Anonymity from Asymmetry: New Constructions for Anonymous HIBE
Recommend
More recommend
