DDH与DCR驱动的防泄漏PKE新构造：1/2-o(1)安全性与IND-CCA潜力

5 浏览量更新于2024-07-15 收藏 394KB PDF 举报

本文探讨了防哈希系统（Hash Proof Systems, HPS）和一次性有损过滤器（One-Time Lossy Filter, OT-LF）在设计选择密文安全公钥加密（Leakage-Resilient Chosen-Ciphertext Secure, LR-CCA）方案中的应用。作者提出了一种新颖的通用构造，这种构造允许PKE方案抵抗来自HPS和OT-LF的LR-CCA攻击，这对于保护数据隐私至关重要。 HPS和OT-LF的有效构造被证明是从DDH（Decisional Diffie-Hellman）和DCR（Decisional Composite Residuosity）假设出发实现LR-CCA安全性的实用途径。通常，许多现有的LR-CCA安全的实用PKE方案，如Cramer-Shoup方案的变体，虽然依赖于HPS，但其泄漏率最多只有1/4-o(1)，即泄漏量与密钥大小之间的比率非常小，但仍存在一定的信息泄露风险。作者的新型构造通过优化设计，能够提升这一阈值，将泄漏率降低至1/2-o(1)，这是一个显著的进步，意味着更少的信息会被暴露给潜在的攻击者。这种改进对于保护用户隐私，尤其是那些高度敏感的数据传输，具有重要意义。此外，这个研究不仅提供了对抗LR-CCA攻击的实用解决方案，而且也开辟了构建无泄漏（IND-CCA secure）PKE方案的新路径，这是独立于现有技术的一个有价值贡献。这意味着可以从理论到实践，设计出既能抵抗恶意攻击又能有效控制信息泄露的加密系统。这篇论文的研究成果对于提高公钥加密系统的安全性，尤其是在面临选择密文攻击威胁的环境中，具有深远的影响，并为密码学领域的进一步发展提供了新的思考角度和技术手段。

384 B. Qin and S. Liu

hardness of subset membership problem requires that elements in V are indis-

tinguishable from those in C\V.

In our construction, the secret key is just sk from the HPS, and the HPS and

OT-LF are integrated into a ciphertext CT,

CT =(C, s, Ψ = Ext(K, s) ⊕ M, Π = LF

Fpk,t

(K),t

via K = HPS.Pub(pk,C,w)=HPS.Priv(sk, C) (it holds for all C ∈V).

The encapsulated key K functions in two ways. (1) It serves as an input,

together with a random string s,toextractorExt(K, s) to mask and hide the

plaintext M to deal with key leakage. (2) It serves as the input of LF

Fpk,t

(·)

to check the well-formedness of the ciphertext. Tag t =(t

) is determined

by t

=(C, s, Ψ) and a random t

. LF

Fpk,t

(K) can also be considered as an

authentication code, which is used to authenticate the tag t =((C, s, Ψ),t

)

with the authentication key K.

In the security proof, some changes are made to the generation of the challenge

ciphertext CT

∗

=(C

∗

,Ψ

∗

,Π

∗

): C

∗

is sampled from C\V and the tag t

∗

is made lossy by computing a proper t

with trapdoor Ftd. A PPT adversary

cannot tell the changes due to the hardness of subset membership problem and

the indistinguishability of lossy tags and injective ones. Conditioned on CT

∗

the encapsulated key K

∗

= HPS.Priv(sk, C

∗

) still maintains a high min-entropy

since Π

∗

= LF

Fpk,t

∗

) works in lossy mode and only little information is

released. When a PPT adversary chooses an invalid ciphertext CT in the sense

that C ∈C\Vfor decryption query, the corresponding tag t is injective with

overwhelming probability. Then LF

Fpk,t

(·) is injective and Π preserves the high

min-entropy of K = HPS.Priv(sk, C). Hence invalid ciphertexts will be rejected

by the decryption oracle with overwhelming probability. On the other hand,

the information of pk has already determined K = HPS.Priv(sk, C) for all C ∈

V. Thus the decryption oracle does not help the adversary to gain any more

information about K

∗

.ThenanextractorcanbeappliedtoK

∗

to totally mask

the information of challenge plaintext, and a large min-entropy of K

∗

conditioned

on pk and Π

∗

implies a high tolerance of key leakage.

Thanks to eﬃcient constructions for HPS and OT-LF under the DDH and

DCR assumptions, the instantiations are practically eﬃcient. More precisely,

|K|≈L/2, where L is the length of the secret key of HPS. Due to the lossiness

of the OT-LF and the property of the HPS, the min-entropy conditioned on the

public key and challenge ciphertext, approaches (1/2−o(1))L. Hence the leakage

rate approaches 1/2.

2 Preliminaries

Notation. Let [n]denotetheset{1,...,n}.Letκ ∈ N denote the security

parameter and 1

denote the string of κ ones. If s is a string, then |s| denotes its

length, while if S is a set then |S| denotes its size and s ← S denotes the operation

of picking an element s uniformly at random from S.Wedenotey ← A(x)the

剩余19页未读，继续阅读

weixin_38576779

粉丝: 9
资源: 927

DDH与DCR驱动的防泄漏PKE新构造：1/2-o(1)安全性与IND-CCA潜力

最新资源