384 B. Qin and S. Liu
hardness of subset membership problem requires that elements in V are indis-
tinguishable from those in C\V.
In our construction, the secret key is just sk from the HPS, and the HPS and
OT-LF are integrated into a ciphertext CT,
CT =(C, s, Ψ = Ext(K, s) ⊕ M, Π = LF
Fpk,t
(K),t
c
),
via K = HPS.Pub(pk,C,w)=HPS.Priv(sk, C) (it holds for all C ∈V).
The encapsulated key K functions in two ways. (1) It serves as an input,
together with a random string s,toextractorExt(K, s) to mask and hide the
plaintext M to deal with key leakage. (2) It serves as the input of LF
Fpk,t
(·)
to check the well-formedness of the ciphertext. Tag t =(t
a
,t
c
) is determined
by t
a
=(C, s, Ψ) and a random t
c
. LF
Fpk,t
(K) can also be considered as an
authentication code, which is used to authenticate the tag t =((C, s, Ψ),t
c
)
with the authentication key K.
In the security proof, some changes are made to the generation of the challenge
ciphertext CT
∗
=(C
∗
,s
∗
,Ψ
∗
,Π
∗
,t
∗
c
): C
∗
is sampled from C\V and the tag t
∗
is made lossy by computing a proper t
c
with trapdoor Ftd. A PPT adversary
cannot tell the changes due to the hardness of subset membership problem and
the indistinguishability of lossy tags and injective ones. Conditioned on CT
∗
,
the encapsulated key K
∗
= HPS.Priv(sk, C
∗
) still maintains a high min-entropy
since Π
∗
= LF
Fpk,t
∗
(K
∗
) works in lossy mode and only little information is
released. When a PPT adversary chooses an invalid ciphertext CT in the sense
that C ∈C\Vfor decryption query, the corresponding tag t is injective with
overwhelming probability. Then LF
Fpk,t
(·) is injective and Π preserves the high
min-entropy of K = HPS.Priv(sk, C). Hence invalid ciphertexts will be rejected
by the decryption oracle with overwhelming probability. On the other hand,
the information of pk has already determined K = HPS.Priv(sk, C) for all C ∈
V. Thus the decryption oracle does not help the adversary to gain any more
information about K
∗
.ThenanextractorcanbeappliedtoK
∗
to totally mask
the information of challenge plaintext, and a large min-entropy of K
∗
conditioned
on pk and Π
∗
implies a high tolerance of key leakage.
Thanks to efficient constructions for HPS and OT-LF under the DDH and
DCR assumptions, the instantiations are practically efficient. More precisely,
|K|≈L/2, where L is the length of the secret key of HPS. Due to the lossiness
of the OT-LF and the property of the HPS, the min-entropy conditioned on the
public key and challenge ciphertext, approaches (1/2−o(1))L. Hence the leakage
rate approaches 1/2.
2 Preliminaries
Notation. Let [n]denotetheset{1,...,n}.Letκ ∈ N denote the security
parameter and 1
κ
denote the string of κ ones. If s is a string, then |s| denotes its
length, while if S is a set then |S| denotes its size and s ← S denotes the operation
of picking an element s uniformly at random from S.Wedenotey ← A(x)the
剩余19页未读，继续阅读
weixin_38576779
- 粉丝: 9
- 资源: 927
我的内容管理
展开
最新资源
- 多模态联合稀疏表示在视频目标跟踪中的应用
- Kubernetes资源管控与Gardener开源软件实践解析
- MPI集群监控与负载平衡策略
- 自动化PHP安全漏洞检测：静态代码分析与数据流方法
- 青苔数据CEO程永：技术生态与阿里云开放创新
- 制造业转型： HyperX引领企业上云策略
- 赵维五分享：航空工业电子采购上云实战与运维策略
- 单片机控制的LED点阵显示屏设计及其实现
- 驻云科技李俊涛：AI驱动的云上服务新趋势与挑战
- 6LoWPAN物联网边界路由器：设计与实现
- 猩便利工程师仲小玉：Terraform云资源管理最佳实践与团队协作
- 类差分度改进的互信息特征选择提升文本分类性能
- VERITAS与阿里云合作的混合云转型与数据保护方案
- 云制造中的生产线仿真模型设计与虚拟化研究
- 汪洋在PostgresChina2018分享：高可用 PostgreSQL 工具与架构设计
- 2018 PostgresChina大会：阿里云时空引擎Ganos在PostgreSQL中的创新应用与多模型存储
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
