Traceable Receipt-free Encryption (TREnc) is a verifiable public-key encryption primitive introduced at Asiacrypt 2022. A TREnc allows randomizing ciphertexts in transit in order to remove any subliminal information up to a public trace that ensures the non-malleability of the underlying plaintext. A remarkable property of TREnc is the indistingui-shability of the randomization of chosen ciphertexts against traceable chosen-ciphertext attacks (TCCA). This property can support applications like voting, and it was shown that receipt-free non-interactive voting, where voters are unable to convince any third party of the content of their vote, can be generically built from a TREnc. While being a very promising primitive, the few existing TREnc mechanisms either require a secret coin CRS or are fairly demanding in time and space requirements. Their security proofs also come with a linear security degradation in the number of challenge ciphertexts. We address these limitations and offer two efficient public coin TREnc mechanisms tailored for the two common tallying approaches in elections: homomorphic and mixnet-based. The TCCA security of our mechanisms also enjoys an almost-tight reduction to SXDH, based on a new randomizable technique of independent interest in the random oracle model. A Rust implementation of our TREnc mechanisms demonstrates that we can verifiably encrypt 64 bits in less than a second, and full group elements in around 30 ms., which is sufficient for most real-world applications. While comparing with other solutions, we show that our approaches lead to the most efficient non-interactive receipt-free voting system to date.
The Raindrop block cipher is an award-winning algorithm of the recent Cryptographic Algorithm Design Competition in China. It employs a Feistel structure and has three versions Raindrop128-128, Raindrop128-256 and Raindrop256, which have a 128-bit block size with a 128- or 256-bit user key and a 256-bit block size with a 256-bit user key, respectively. In this paper, we observe that Raindrop can be transformed to an equivalent cipher with two rounds less than Raindrop (for each version), due to the position of the round key XOR operation. We also observe that when conducting impossible differential cryptanalysis of Raindrop, both inactive and active bit differences on plaintext and ciphertext as well as a few intermediate states may be exploited for some refined sorting conditions on plaintexts and ciphertexts to filter out preliminary satisfying plaintext/ciphertext pairs efficiently, and finally we exploit a few 12-round impossible differentials of Raindrop128 and Raindrop256 to make key-recovery attacks on 19-round Raindrop128-128, 21-round Raindrop128-256 and 20-round Raindrop256. Our attacks are better than any previously published cryptanalytic results on Raindrop in terms of the numbers of attacked rounds.
