Threshold encryption is becoming a significant part in modern cryptography and is standing as a central focus of the upcoming NIST competition. An active branch in this field is Threshold Broadcast Encryption (TBE), which integrates threshold settings into the broadcast encryption paradigm. In a TBE scheme, a sender can arbitrarily select a target set of recipients to encrypt a message; decryption is successful if and only if at least t users within that set collaborate, where t represents the predefined threshold. Despite its utility, existing TBE literature is largely restricted to single-message, single-group scenarios. This constraint makes TBE impractical for modern platforms, such as social media and streaming services, which requires to efficiently deliver diverse content to multiple distinct groups of viewers simultaneously.To address this limitation, we first establish formal definitions for a new primitive: Multi-group Threshold Broadcast Encryption (MTBE), which supports the encryption of one or more messages that are sent to multiple target groups. As a proof of concept, we then propose the first Identity-based MTBE construction. Our scheme achieves constant-size ciphertexts, being independent of the number of recipients or groups. We also implement our proposed scheme to give some concrete benchmarks.

Threshold Attribute-based Encryption has attracted significant attention due to its growing importance in practical applications, such as distributed cloud storage or anonymous access control. In a threshold attribute-based encryption scheme, a sender can select a set of attributes and a corresponding threshold t, which is referred to as an access policy, to encrypt a message. Decryption is successful if and only if a user possesses at least t attributes from the specified attribute set. Existing threshold attribute-based encryption schemes typically consider only the setting in which a single message is encrypted under a single access policy. However, in many practical applications, more flexible encryption scenarios are needed, such as encrypting a single message under multiple access policies or encrypting multiple messages under their corresponding access policies. In this work, we first formalize the notion of threshold attribute-based encryption supporting the encryption of multiple messages under multiple access policies. We then propose the first construction of a threshold attribute-based encryption scheme based on the Key Encapsulation Mechanism paradigm that supports such functionality while achieving constant-size ciphertext. Our proposed scheme relies on bilinear pairings and is proven secure in the Generic Bilinear Group Model. As a classical pairing-based construction, it does not provide post-quantum security and is therefore unsuitable for scenarios requiring long-term confidentiality or resilience against harvest-now, decrypt-later attacks.

Attribute-based encryption (ABE) is an important primitive to address the problem of flexible one-to-many encryption. Attribute-based encryption has found many practical applications such as cloud storage systems, file sharing systems, e-Health, pay-TV systems, social networks, etc. However, in almost existing ABE schemes, the efficiency depends heavily on the number of attributes involved in the secret key and the ciphertext. This makes hierarchical access control in ABE, where attributes need to be hierarchically organized, could be inefficient.This paper introduces a novel concept of Levelled Attribute-based Encryption (Levelled ABE) as a solution to address the inefficiencies of standard ABE for hierarchical access control systems, where scalability and key management are critical. Levelled ABE presents a hierarchical attribute framework where attributes are organized into classes, and each attribute is assigned a level number within its class. By introducing this hierarchical structure, Levelled ABE enables finer-grained access control, scalability and more efficient key management. As a proof of concept, this paper also proposes two concrete constructions of Levelled ABE, one for key-policy and the other for ciphertext-policy. These constructions are comparable to existing ABE schemes. The security of the proposed constructions is proved in the generic group model.

In the Identity-based encryption (IBE) scheme user’s public key is exactly the user’s identity, it thus doesn’t need to use expensive certificates in certified public key cryptography. Hierarchical identity-based encryption (HIBE) is the extension of IBE to overcome the bottleneck problem of the Private Key Generator and to increase the security of the IBE scheme. However, similar to IBE scheme, HIBE scheme still doesn’t support flexible one-to-many encrypting. To deal with this problem, Identity-based encryption with wildcards (WIBE) was introduced by Abdalla et al at ICALP conference in 2006. Since then, many WIBE schemes have been introduced in the literature. In this work, we continue in this line of work to introduce a novel WIBE scheme. Our proposed scheme is an improvement of all existing WIBE schemes in term of efficiency.

Attribute-based encryption (ABE) is a cryptographic framework that provides flexible access control by allowing encryption based on user attributes. ABE is widely applied in cloud storage, file sharing, e-Health, and digital rights management. ABE schemes rely on hard cryptographic assumptions such as pairings and others (pairing-free) to ensure their security against external and internal attacks. Internal attacks are carried out by authorized users who misuse their access to compromise security with potentially malicious intent. One common internal attack is the attribute collusion attack, in which users with different attribute keys collaborate to decrypt data they could not individually access. This paper focuses on the ciphertext-policy ABE (CP-ABE), a type of ABE where ciphertexts are produced with access policies. Our first work is to carry out the attribute collusion attack against several existing pairing-free CP-ABE schemes. As a main contribution, we introduce a novel attack, termed the anonymous key-leakage attack, concerning the context in which users could anonymously publish their secret keys associated with certain attributes on public platforms without the risk of detection. This kind of internal attack has not been defined or investigated in the literature. We then show that several prominent pairing-based CP-ABE schemes are vulnerable to this attack. We believe that this work will contribute to helping the community evaluate suitable CP-ABE schemes for secure deployment in real-life applications.

In a proxy re-signature ( PRS) scheme, a semi-trusted proxy is able to transform a signature signed by a user to a new signature of the same message signed by another user, it however cannot sign on any other message on behalf of those users.PRS thus has found many practical applications such as distributed storage, distributed rights management or cloud infrastructure.To our knowledge, all of the PRS schemes without using random oracle (RO for short) need to use the Waters' hash function, which leads to PRS schemes with large key size and inefficient computing time.In this paper, we propose a new bidirectional PRS scheme without using RO and without using the Waters' hash function.Our scheme is therefore the best PRS scheme without using RO to date in term of efficiency.

In modern applications, such as Electronic Voting, e-Health, e-Cash, there is a need that the validity of a signature should be verified by only one responsible person. This is opposite to the traditional digital signature scheme where anybody can verify a signature. There have been several solutions for this problem, the first one is we combine a signature scheme with an encryption scheme; the second one is to use the group signature; and the last one is to use the strong designated verifier signature scheme with the undeniable property. In this paper, we extend the traditional digital signature scheme to propose a new solution for the aforementioned problem. Our extension is in the sense that only a designated verifier (responsible person) can verify a signer’s signature, and if necessary (in case the signer refuses to admit his/her signature) the designated verifier without revealing his/her secret key is able to prove to anybody that the signer has actually generated the signature. The comparison between our proposed solution and the three existing solutions shows that our proposed solution is the best one in terms of both security and efficiency.

Blind signatures play an important role in both electronic cash and electronic voting systems. Blind signatures should be secure against various attacks (such as signature forgeries). The work puts a special attention to secret key exposure attacks, which totally break digital signatures. Signatures that resist secret key exposure attacks are called forward secure in the sense that disclosure of a current secret key does not compromise past secret keys. This means that forward-secure signatures must include a mechanism for secret-key evolution over time periods. This paper gives a construction of the first blind signature that is forward secure. The construction is based on the SIS assumption in the lattice setting. The core techniques applied are the binary tree data structure for the time periods and the trapdoor delegation for the key-evolution mechanism.

Multi-channel broadcast encryption (MCBE) and Attribute-based encryption (ABE) are important primitives used in a broad range of concrete application scenarios such as Pay-TV, e-Health, Cloud Storage, Blockchain and so on. The former allows a sender to efficiently send different messages to arbitrarily chosen sets of users (target sets) at the same time, while the latter supports more sophisticated access control by allowing both the encryption and decryption phases to be based on the user's attributes. Recently, Canard el al. at Theoretical Computer Science'18 proposed a new technique for compacting header size in both MCBE and ABE. However, their technique leads to schemes in secret-key setting which has limited applications in practice. In this paper, we propose a new technique also for compacting header size in both MCBE and ABE, but our technique leads to schemes in public key setting which therefore can overcome the weakness mentioned above of the Canard el al.'s technique. We finally implement our MCBE and ABE schemes to give some concrete benchmarks.

Broadcast encryption ( BE ) allows a sender to encrypt a message to an arbitrary target set of legitimate users and to prevent non-legitimate users from recovering the broadcast information. BE has numerous practical applications such as satellite geolocation systems, file sharing systems, pay-TV systems, e-Health, social networks, cloud storage systems, etc. This paper presents two new decentralized BE schemes. Decentralization means that there is no single authority responsible for generating secret cryptographic keys for system users. Therefore, the scheme eliminates the concern of having a single point of failure as the central authority could be attacked, become malicious, or become unavailable. Recent attacks have shown that the centralized approach could lead to system malfunctioning or to leaking sensitive information. Another achievement of the proposed BE schemes is their performance characteristics that make them suitable for environments with light-weight clients, such as in Internet-of-Things (IoT) applications. The proposed approach improves the performance over existing decentralized BE schemes by simultaneously achieving constant size ciphertext, constant size secret key and fast decryption.

Aggregate signature scheme allows each signer to sign a different message and then all those signatures are aggregated into a single short signature. In contrast, multisignature scheme allows multisigners to jointly sign only one message. Aggregate multisignature scheme is a combination of both aforementioned signature schemes, where signers can choose to generate either a multisignature or an aggregate signature. This combination scheme has many concrete application scenarios such as Bitcoin blockchain, Healthcare, Multicast Acknowledgment Aggregation, and so on. On the other hand, to deal with the problems of expensive certificates in certified public key cryptography and key escrow in identity-based cryptography, the notion of certificateless public key cryptography has been introduced by Riyami and Paterson at Asiacrypt'03. In this paper, we propose the first certificateless aggregate multisignature scheme that achieves the constant-size of signature and is secure in the standard model under a generalization of the Diffie-Hellman exponent assumption. In our scheme, however, the signature is generated with the help of the authority.

In a traditional attribute-based encryption (ABE) system, there is only one central authority who generates and hence knows the secret keys of all users, this problem is known as the key escrow problem. An ABE scheme which can deal with the aforementioned problem is so-called a decentralized (or multi-authority) ABE scheme. There have been several efforts to propose decentralized ABE schemes in the literature, and these schemes can enjoy some interesting properties such as fine-grained access control and full security. However, all of them suffer from two main weaknesses that are large secret key size and slow decryption time. These weaknesses are obviously not desirable for lightweight device applications such as Internet of Things applications. In this paper, we propose two decentralized ciphertext-policy attribute-based encryption schemes. Our proposed schemes have some nice properties such as constant-size secret key, fast decryption, optimized ciphertext size and fine-grained access control. Our schemes, as a result, could be seen as a solution for lightweight device applications. For completeness, we implement our schemes and give some concrete benchmarks.

We address the problem of searching on encrypted data with expressive searching predicate and multi-writer/multi-reader, a cryptographic primitive which has many concrete application scenarios such as cloud computing, email gateway application and so on. In this paper, we propose a public-key encryption with keyword search scheme relied on the ciphertext-policy attribute-based encryption scheme. In our system, we consider the model where a user can generate trapdoors by himself/herself, we thus can remove the Trusted Trapdoor Generator which can save the resource and communication overhead. We also investigate the problem of combination of a public key encryption used to encrypt data and a public-key encryption with keyword search used to encrypt keywords, which can save the storage of the whole system

In the traditional digital signature scheme, anyone can check the validity of a signer's signature. However, in some practical applications, such as e-Voting, e-Health, e-Payment, e-Bidding where the privacy of the signer is required, it is necessary that there is only one responsible person who is able to check the validity of the signer's signature. There exists a few solutions for this problem such as combining the traditional digital signature scheme with an encryption scheme or using the strong designated verifier signature scheme with judgment. In this paper, we propose another solution for this problem, we name one-verifier signature scheme. Compare among three solutions, our proposed solution is the best one in term of efficiency.

Lightweight devices, such as a smartcard associated with a top-box decoder in pay-TV or a SIM card coupled with a powerful (but not totally trusted) smartphone, play an important role in modern applications. The essential requirements for a cryptographic scheme to be truly implemented in lightweight devices are that it should have compact secret key size and support fast decryption. Attribute-based broadcast encryption (ABBE) combines the functionalities of both broadcast encryption and attribute-based encryption in an efficient way, ABBE is therefore a promising cryptographic scheme to be used in practical applications such as mobile pay-TV, satellite transmission, or Internet of Things. Designing an ABBE scheme which can be truly implemented in lightweight devices is still an open question. In this study, the authors solve it by proposing an efficient constant-size private key ciphertext-policy ABBE scheme for disjunctive normal form supporting fast decryption and achieving standard security levels of an ABBE scheme. They concretely show that the authors’ scheme can be truly implemented in a prototype for a smartphone-based cloud storage use case. In particular, they show how to alleviate some parts of their scheme so as to obtain a very practical system, and they give some concrete benchmarks.

Standard Broadcast Encryption (BE) and Attribute-Based Encryption (ABE) aim at sending a content to a large arbitrary group of users at once. Regarding Broadcast Encryption, currently, the most efficient schemes provide constant-size headers, that encapsulate ephemeral session keys under which the payload is encrypted. However, in practice, and namely for pay-TV, providers have to send various contents to different groups of users. Headers are thus specific to each group, one for each channel: as a consequence, the global overhead is linear in the number of channels. Furthermore, when one wants to zap to and watch another channel, one has to get the new header and decrypt it to learn the new session key: either the headers are sent quite frequently or one has to store all the headers, even if one watches one channel only. Otherwise, the zapping time becomes unacceptably long. We consider the encapsulation of several ephemeral keys, for various groups and thus various channels, in one header only, and we call this new primitive Multi-Channel Broadcast Encryption or MCBE: one can hope for a much shorter global overhead and a much shorter zapping time since the decoder already has the information to decrypt any available channel at once. Regarding Attribute-Based Encryption, a scheme with constant-size ciphertext is still a challenging task. In this paper, we introduce a new technique of optimizing the ciphertext-size for both MCBE and ABE schemes. (C) 2018 Elsevier B.V. All rights reserved.

Identity-based cryptography has been introduced by Shamir at Crypto’84 to avoid the use of expensive certificates in certified public key cryptography. In such system, the identity becomes the public key and each user needs to interact with a designated authority to obtain the related private key. It however suffers the key escrow problem since the authority knows the private keys of all users. To deal with this problem, Riyami and Paterson have introduced, at Asiacrypt’03, the notion of certificateless public key cryptography. In this case, there is no need to use the certificate to certify the public key, and neither the user nor the authority can derive the full private key by himself. There have been several efforts to propose a certificateless signature (CLS) scheme in the standard model, but all of them either make use of the Waters’ technique or of the generic conversion technique (proposed by Yum and Lee at ACISP’04) which both lead to inefficient CLS schemes. Besides making use of the Waters’ technique and the generic conversion technique (proposed also by Yum and Lee at ICCSA’04), there exists direct approaches to construct certificateless public key encryption (CLE) scheme in the standard model. In this paper, we introduce a new and direct approach to construct a CLS scheme in the standard model with constant-size of all parameters and having efficient computing time. We also show that the Boneh et al.’s identity-based encryption scheme secured in the standard model at EC’04 can be extended to the certificateless setting. Interestingly, the resulting scheme can be comparable with the existing CLE schemes in term of both efficiency and security.

To deal with the problem of large certificate in Public Key Infrastructure, several techniques have been introduced such as Identity-based cryptography, Implicit certificate, Password-based cryptography and recently Certificateless cryptography at Asiacrypt'03. In a certificateless system, only user with her full private key can decrypt the ciphertext while the authority with her master key cannot. Moreover, there is no need to use the certificate to certify the public key of user. Certificateless public key encryption schemes in the standard model have been proposed in many works. In this paper, we continue this line of research by proposing a new one. When comparing with other certificateless public key encryption schemes in the standard model, our scheme is the best one to date in term of efficiency. However, our scheme only achieves a weak level of security that is the weak selective chosen plaintext Type I adversary under the well-known q-BDHI assumption, and the selective chosen plaintext Type II adversary under a new simple static assumption.

We address the problem of ciphertext-policy attribute-based encryption with fine access control, a cryptographic primitive which has many concrete application scenarios such as Pay-TV, e-Health, Cloud Storage and so on. In this context we improve on previous LSSS based techniques by building on previous work of Hohenberger and Waters at PKC'13 and proposing a construction that achieves ciphertext size linear in the minimum between the size of the boolean access formula and the number of its clauses. Our construction also supports fast decryption. We also propose two interesting extensions: the first one aims at reducing storage and computation at the user side and is useful in the context of lightweight devices or devices using a cloud operator. The second proposes the use of multiple authorities to mitigate key escrow by the authority.