Threshold encryption is becoming a significant part in modern cryptography and is standing as a central focus of the upcoming NIST competition. An active branch in this field is Threshold Broadcast Encryption (TBE), which integrates threshold settings into the broadcast encryption paradigm. In a TBE scheme, a sender can arbitrarily select a target set of recipients to encrypt a message; decryption is successful if and only if at least t users within that set collaborate, where t represents the predefined threshold. Despite its utility, existing TBE literature is largely restricted to single-message, single-group scenarios. This constraint makes TBE impractical for modern platforms, such as social media and streaming services, which requires to efficiently deliver diverse content to multiple distinct groups of viewers simultaneously.To address this limitation, we first establish formal definitions for a new primitive: Multi-group Threshold Broadcast Encryption (MTBE), which supports the encryption of one or more messages that are sent to multiple target groups. As a proof of concept, we then propose the first Identity-based MTBE construction. Our scheme achieves constant-size ciphertexts, being independent of the number of recipients or groups. We also implement our proposed scheme to give some concrete benchmarks.

Attribute-based encryption (ABE) is an important primitive to address the problem of flexible one-to-many encryption. Attribute-based encryption has found many practical applications such as cloud storage systems, file sharing systems, e-Health, pay-TV systems, social networks, etc. However, in almost existing ABE schemes, the efficiency depends heavily on the number of attributes involved in the secret key and the ciphertext. This makes hierarchical access control in ABE, where attributes need to be hierarchically organized, could be inefficient.This paper introduces a novel concept of Levelled Attribute-based Encryption (Levelled ABE) as a solution to address the inefficiencies of standard ABE for hierarchical access control systems, where scalability and key management are critical. Levelled ABE presents a hierarchical attribute framework where attributes are organized into classes, and each attribute is assigned a level number within its class. By introducing this hierarchical structure, Levelled ABE enables finer-grained access control, scalability and more efficient key management. As a proof of concept, this paper also proposes two concrete constructions of Levelled ABE, one for key-policy and the other for ciphertext-policy. These constructions are comparable to existing ABE schemes. The security of the proposed constructions is proved in the generic group model.

Attribute-based encryption (ABE) is a cryptographic framework that provides flexible access control by allowing encryption based on user attributes. ABE is widely applied in cloud storage, file sharing, e-Health, and digital rights management. ABE schemes rely on hard cryptographic assumptions such as pairings and others (pairing-free) to ensure their security against external and internal attacks. Internal attacks are carried out by authorized users who misuse their access to compromise security with potentially malicious intent. One common internal attack is the attribute collusion attack, in which users with different attribute keys collaborate to decrypt data they could not individually access. This paper focuses on the ciphertext-policy ABE (CP-ABE), a type of ABE where ciphertexts are produced with access policies. Our first work is to carry out the attribute collusion attack against several existing pairing-free CP-ABE schemes. As a main contribution, we introduce a novel attack, termed the anonymous key-leakage attack, concerning the context in which users could anonymously publish their secret keys associated with certain attributes on public platforms without the risk of detection. This kind of internal attack has not been defined or investigated in the literature. We then show that several prominent pairing-based CP-ABE schemes are vulnerable to this attack. We believe that this work will contribute to helping the community evaluate suitable CP-ABE schemes for secure deployment in real-life applications.

We introduce a novel framework, termed RMGANs, that merges Relativistic Generative Adversarial Networks (RGANs) with Margin Losses. This framework capitalizes on the strengths of both RGANs’ discriminators, which assess the realism of real and fake data, and the advantages of Margin Losses, well-known for their ability to create distinct class separation. We apply this combination to the problem of semi-supervised learning (SSL). Our study delves into the architecture of RMGANs, provides a mathematical analysis to assess the impact of margin utilization on RMGAN losses, and offers guidance on choosing hyper-parameters. We also conduct experiments across the MNIST and CIFAR-10 datasets. The empirical results clearly demonstrate RMGANs’ effectiveness in achieving higher accuracy compared to the state-of-the-art work (MarginGAN) in the SSL fashion.

Spatial encryption (SE), which involves encryption and decryption with affine/vector objects, was introduced by Boneh and Hamburg at Asiacrypt 2008. Since its introduction, SE has been shown as a versatile and elegant tool for implementing many other important primitives such as (Hierarchical) Identity-based Encryption ((H)IBE), Broadcast (H)IBE, Attribute-based Encryption, and Forward-secure cryptosystems. This paper revisits SE toward a more compact construction in the lattice setting. In doing that, we introduce a novel primitive called Delegatable Multiple Inner Product Encryption (DMIPE). It is a delegatable generalization of Inner Product Encryption (IPE) but different from the Hierarchical IPE (HIPE) (Okamoto and Takashima at Asiacrypt 2009). We point out that DMIPE and SE are equivalent in the sense that there are security-preserving conversions between them. As a proof of concept, we then successfully instantiate a concrete DMIPE construction relying on the hardness of the decisional learning with errors problem. In turn, the DMIPE design implies a more compact lattice-based SE in terms of sizes compared with SEs converted from HIPE (e.g., Xagawa’s HIPE at PKC 2013) using the framework by Chen et al. (Designs, Codes, and Cryptography, 2014). Furthermore, we demonstrate that one can also use SE to implement the Allow-/Deny-list encryption, which subsumes, e.g., puncturable encryption (Green and Miers at IEEE S &P 2015).

Download This Paper Open PDF in Browser Add Paper to My Library Share: Permalink Using these links will ensure access to this page indefinitely Copy URL Copy DOI

Unique ring signatures (URS) were introduced by Franklin and Zhang (FC 2012) as a unification of linkable and traceable ring signatures. In URS, each member within a ring can only produce, on behalf of the ring, at most one signature for a message. Applications of URS potentially are e–voting systems and e–token systems. In blockchain technology, URS have been implemented for mixing contract. However, existing URS schemes are based on the Discrete Logarithm Problem, which is insecure in the post-quantum setting. In this paper, we design a new lattice-based URS scheme where the signature size is logarithmic in number of ring members. The proposed URS exploits a Merkle tree-based accumulator as building block in the lattice setting. Our scheme is secure under the Short Integer Solution and Learning With Rounding assumptions in the random oracle model.

Linkable ring signatures is a useful cryptographic tool for constructing applications such as ones relative to electronic voting (e-voting), digital cashes (e-cashes) as well as cloud computing. Equipped with linkable ring signatures, e-voting, e-cash systems can simultaneously enjoy the privacy and the unreusability properties thanks to the anonymity and the linkability of linkable ring signatures. Likewise, cloud servers can enjoy a privacy-preserving ability, a flexible access control and an efficient security management with linkable ring signatures. Moreover, linkable ring signatures built in the identity-based setting would help to remove the expense of using the conventional public key infrastructure and also could be applied to the user management. This primitive hence would be suitable for huge-scale applications. In this paper, we present the first identity-based linkable ring signatures (IdLRS) in both integer lattice and ideal lattice setting. The proposed IdLRS is proved secure in the random oracle model and based on the hardness of the short integer solution and ring short integer solution assumption. We also implement the proposed idLRS as a proof of concept and then do some experiments to evaluate the running times and the sizes.

A signcryption, which is an integration of a public key encryption and a digital signature, can provide confidentiality and authenticity simultaneously. Additionally, a signcryption associated with equality test allows a third party (e.g., a cloud server) to check whether or not two ciphertexts are encrypted from the same message without knowing the message. This application plays an important role especially in computing on encrypted data. In this paper, we propose the first lattice-based signcryption scheme equipped with a solution to testing the message equality in the standard model. The proposed signcryption scheme is proven to be secure against insider attacks under the learning with errors assumption and the intractability of the short integer solution problem. As a by-product, we also show that some existing lattice-based signcryptions either is insecure or does not work correctly.

Blockchain is a distributed ledger in which a database is distributed across numerous users. Blockchain technologies have recently come to the forefront of the research and industrial communities as they bring potential benefits for many industries. A ring signature is a special type of digital signature which has been widely adopted to protect anonymity and privacy in many cryptocurrencies and blockchain applications. Especially, a unique ring signature offers a special feature enabling the ability to determine whether a signer produces two different ring signatures of the same message with respect to the same ring. The signature size of the previous constructions of unique ring signature is large and grows linearly/sublinearly with the number of ring members. In this paper, we propose a more efficient unique ring signature with logarithmic size. We prove that our scheme is secure under the Decisional Diffie-Hellman and Discrete Logarithm Assumptions, and provide an implementation with a comparison with previous constructions.

Puncturable encryption (PE), proposed by Green and Miers at IEEE S&P 2015, is a kind of public key encryption that allows recipients to revoke individual messages by repeatedly updating decryption keys without communicating with senders. PE is an essential tool for constructing many interesting applications, such as asynchronous messaging systems, forward-secret zero round-trip time protocols, public-key watermarking schemes and forward-secret proxy re-encryptions. This paper revisits PEs from the observation that the puncturing property can be implemented as efficiently computable functions. From this view, we propose a generic PE construction from the fully key-homomorphic encryption, augmented with a key delegation mechanism (DFKHE) from Boneh et al. at Eurocrypt 2014. We show that our PE construction enjoys the selective security under chosen plaintext attacks (that can be converted into the adaptive security with some efficiency loss) from that of DFKHE in the standard model. Basing on the framework, we obtain the first post-quantum secure PE instantiation that is based on the learning with errors problem, selective secure under chosen plaintext attacks (CPA) in the standard model. We also discuss about the ability of modification our framework to support the unbounded number of ciphertext tags inspired from the work of Brakerski and Vaikuntanathan at CRYPTO 2016.

The modulus switching technique has been used in some cryptographic applications as well as in cryptanalysis. For cryptanalysis against the learning with errors (LWE) problem and the learning with rounding (LWR) problem, it seems that one does not know whether the technique is really useful or not. This work supplies a complete view of the impact of this technique on the decoding attack, the dual attack and the primal attack against both LWE and LWR. For each attack, the authors give the optimal formula for the switching modulus. The formulas get involved the number of LWE/LWR samples, which differs from the known formula in the literature. They also attain the corresponding sufficient conditions saying when one should utilise the technique. Surprisingly, restricted to the LWE/LWR problem that the secret vector is much shorter than the error vector, they also show that performing the modulus switching before using the so-called rescaling technique in the dual attack and the primal attack make these attacks worse than only exploiting the rescaling technique as reported by Bai and Galbraith at the Australasian conference on information security and privacy (ACISP) 2014 conference. As an application, they theoretically assess the influence of the modulus switching on the LWE/LWR-based second round NIST PQC submissions.

Blind signatures play an important role in both electronic cash and electronic voting systems. Blind signatures should be secure against various attacks (such as signature forgeries). The work puts a special attention to secret key exposure attacks, which totally break digital signatures. Signatures that resist secret key exposure attacks are called forward secure in the sense that disclosure of a current secret key does not compromise past secret keys. This means that forward-secure signatures must include a mechanism for secret-key evolution over time periods. This paper gives a construction of the first blind signature that is forward secure. The construction is based on the SIS assumption in the lattice setting. The core techniques applied are the binary tree data structure for the time periods and the trapdoor delegation for the key-evolution mechanism.

Public key encryption with equality test (PKEET) enables the testing whether two ciphertexts encrypt the same message. Identity -based encryption with equality test (IBEET) simplify the certificate management of PKEET, which leads to many potential applications such as in smart city applications or Wireless Body Area Networks. Lee et al. (ePrint 2016) proposed a generic construction of IBEET scheme in the standard model utilising a 3-level hierachy IBE together with a one-time signature scheme, which can be instantiated in lattice setting. Duong et al. (ProvSec 2019) proposed the first direct construction of IBEET in standard model from lattices. However, their scheme achieve CPA security only. In this paper, we improve the Duong et al.'s construction by proposing an IBEET in standard model which achieves CCA2 security and with smaller ciphertext and public key size.

A blind ring signature scheme is a combination of a ring signature and a blind signature, which allows not only any member of a group of signers to sign on a message on behalf of the group without revealing its identity but also the user who possesses the message to blind it before sending to the group to be signed. Blind ring signature schemes are essential components in e-commercial, e-voting etc. In this paper, we propose the first blind ring signature scheme based on lattices. More precisely, our proposed scheme is proven to be secure in random oracle model under the hardness of the short integer solution (SIS) problem.

Identity-based encryption with equality test supporting flexible authorization (IBEET-FA) allows the equality test of underlying messages of two ciphertexts while strengthens privacy protection by allowing users (identities) to control the comparison of their ciphertexts with others. IBEET by itself has a wide range of useful applicable domain such as keyword search on encrypted data, database partitioning for efficient encrypted datamanagement, personal health record systems, and spam filtering in encrypted email systems. The flexible authorization will enhance privacy protection of IBEET. In this paper, we propose an efficient construction of IBEET-FAsystem based on the hardness of learning with error (LWE) problem. Our security proof holds in the standard model.

At CRYPTO 2017, Roşca, Sakzad, Stehlé and Steinfeld introduced the Middle–Product LWE (MPLWE) assumption which is as secure as Polynomial-LWE for a large class of polynomials, making the corresponding cryptographic schemes more flexible in choosing the underlying polynomial ring in design while still keeping the equivalent efficiency. Recently at TCC 2019, Lombardi, Vaikuntanathan and Vuong introduced a variant of MPLWE assumption and constructed the first IBE scheme based on MPLWE. Their core technique is to construct lattice trapdoors compatible with MPLWE in the same paradigm of Gentry, Peikert and Vaikuntanathan at STOC 2008. However, their method cannot directly offer a Hierarchical IBE construction. In this paper, we make a step further by proposing a novel trapdoor delegation mechanism for an extended family of polynomials from which we construct, for the first time, a Hierachical IBE scheme from MPLWE. Our Hierarchy IBE scheme is provably secure in the standard model.

Since its birth by Chaum, blind signatures have become one of the fundamental components in the so-called e-cash or e-voting. The scheme ensures a message to be blinded before being signed. Among all lattice-based signatures submitted to NIST post-quantum cryptographic standardization, Dilithium is a very promising candidate. The scheme has some advantages such as simple to implement securely, conservative with parameters and minimal in total size of public key and signature. In this paper, we propose a blind signature scheme based on the framework of Dilithium in order to take advantages of Dilithium. The proposed scheme is blind and one-more unforgeable secure in the random oracle model under the hardness of the module Learning with Errors problem MLWE and the module short integer solution problem MSIS.

Public key encryption with equality test (PKEET) allows the testing of equality of underlying messages of two ciphertexts. PKEET is a potential candidate for many practical applications like efficient data management on encrypted databases. Identity-based encryption scheme with equality test (IBEET), which was introduced by Ma (Information Science 2016), can simplify the certificate management of PKEET. Potential applicability of IBEET leads to intensive research from its first instantiation. Ma's IBEET and most of the constructions are proven secure in the random oracle model based on number-theoretic hardness assumptions which are vulnerable in the post-quantum era. Recently, Lee et al. (ePrint 2016) proposed a generic construction of IBEET schemes in the standard model and hence it is possible to yield the first instantiation of IBEET schemes based on lattices. Their method is to use a 3-level hierarchical identity-based encryption (HIBE) scheme together with a one-time signature scheme. In this paper, we propose, for the first time, a concrete construction of an IBEET scheme based on the hardness assumption of lattices in the standard model and compare the data sizes with the instantiation from Lee et al. (ePrint 2016). Further, we have modified our proposed IBEET to make it secure against insider attack.

The typical approach in attacking an LWR _m,n,q,p(χ _s) instance parameterized by four integers m, n, q, p (q ≥ p) and a probability distribution χ _s is just by simply regarding it as a Learning with Errors (LWE) modulo q instance and then trying to adapt known LWE attacks to this LWE instance. In this paper, we show that for an LWR _m,n,q,p(χ _s) instance whose parameters satisfy a certain sufficient condition, one can use the BDD strategy to recover the secret with higher advantages if one transforms the LWR instance to an LWE modulo q' instance with q' chosen appropriately instead of an LWE modulo q instance. The optimal modulus q' used in our BDD attack is quite close to p as well as typically smaller than q. Especially, our experiments confirm that our BDD attack is much better in solving search-LWR in terms of root Hermite factor, success probability and even running time either in case the ratio log (q)/ log (p) is big or/and the dimension n is sufficiently large.