Anonymous Multireceiver Identity-Based Encryption against Chosen-Ciphertext Attacks with Tight Reduction in the Standard Model

Tseng, Yi-Fan; Fan, Chun-I

doi:https://doi.org/10.1155/2021/5519721

Security and Communication Networks

On this page

Abstract Introduction Preliminaries Conclusion Data Availability Conflicts of Interest Acknowledgments References Copyright Related Articles

Research Article | Open Access

Volume 2021 | Article ID 5519721 | https://doi.org/10.1155/2021/5519721

Anonymous Multireceiver Identity-Based Encryption against Chosen-Ciphertext Attacks with Tight Reduction in the Standard Model

Yi-Fan Tseng¹and Chun-I Fan^2,3,4

Academic Editor: Stelvio Cimato

Received17 Feb 2021

Revised06 Apr 2021

Accepted24 May 2021

Published15 Jun 2021

Abstract

Multireceiver identity-based encryption is a cryptographic primitive, which allows a sender to encrypt a message for multiple receivers efficiently and securely. In some applications, the receivers may not want their identities to be revealed. Motivated by this issue, in 2010, Fan et al. first proposed the concept of anonymous multireceiver identity-based encryption (AMRIBE). Since then, lots of literature studies in this field have been proposed. After surveying the existing works, however, we found that most of them fail to achieve provable anonymity with tight reduction. A security proof with tight reduction means better quality of security and better efficiency of implementation. In this paper, we focus on solving the open problem in this field that is to achieve the ANON-IND-CCA security with tight reduction by giving an AMRIBE scheme. The proposed scheme is proven to be IND-MID-CCA and ANON-MID-CCA secure with tight reduction under a variant of the DBDH assumption. To the best of our knowledge, this is the first scheme proven with tight reducible full CCA security in the standard model.

1. Introduction

Identity-based encryption (IBE) is a large class of public key encryption in modern cryptography. The concept of IBE was first proposed by Shamir [1] in 1984, and the first practical construction was independently proposed by Boneh and Franklin [2] and Cocks [3] in 2001. In an IBE scheme, a user can use any string as her/his public key, such as national identifier number and e-mail address.

It is a natural question to ask how to design a multireceiver IBE to encrypt a message with better efficiency compared with individually encrypting to each user in terms of either computation cost or communication cost. Such a cryptographic primitive is popular in advanced applications such as video conferencing, pay-per-view TV [4–8], and distance education. The notion of multireceiver identity-based encryption (MRIBE) was first considered by Beak et al. [9] in 2005. In an MRIBE scheme, the input of the encryption algorithm is a set of identities rather than a single identity. A user who is selected in the set is able to decrypt the ciphertext. MRIBE then drew the attention of the research community, and lots of results [10, 11] have been proposed.

Another notion similar to MRIBE is identity-based broadcast encryption (IBBE) [12–14]. An IBBE scheme is usually designed in the sense of key encapsulation mechanism (KEM), where the encryption algorithm takes as input only a set of identities and outputs a header and an encryption key. To encrypt a message, one then uses the encryption key with a data encryption mechanism (DEM), such as DES and AES. A user whose identity is selected in the set can use her/his private key together with the header to recover the encryption key. On the other hand, an encryption scheme can be regarded as a key encapsulation mechanism by simply setting a ciphertext as the header and the corresponding plaintext as the encryption key. In this paper, we will treat MRIBE and IBBE as the identical notion.

In some situations, such as ordering sensitive TV programs, the customers may expect that their identities are not revealed. In consideration of privacy-preserving, Fan et al. [15] first introduced the concept of anonymous multireceiver ID-based encryption (AMRIBE) in 2010. Anonymity is defined as that no one should know the identities of the receivers except the encryptor. They also proposed a multireceiver ID-based encryption scheme using Lagrange interpolating polynomials. Unfortunately, their scheme was pointed out to be flawed by Chien [16] in 2012. In Fan et al. scheme, anyone given a ciphertext is able to reveal the receivers. Chien further indicated that the security model defined in [15] does not cover all of the multireceiver scenarios. He also proposed an improved AMRIBE scheme in [16]. Since then, many results of AMRIBE have been proposed [17–25].

After examining these AMRIBE schemes, we found that there is no AMRIBE scheme achieving full-ID security with tight reduction against chosen-ciphertext attacks. Filling the gap is significant for the researches of AMRIBE in terms of both theoretical and practical aspects.

Most of the existing AMRIBEs are only proven to be secure in the weaker “selective-ID” model, where the attacker must commit a target receiver set that it will attack at the beginning of the security game. The selective-ID model might not be appropriate for the attack model in a realistic environment, since the attackers should be able to adaptively choose their target after learning some information of the system. This characteristic is captured by another stronger model called “full-ID” model, where the attacker chooses the target at the challenge phase rather than at the beginning. In [26, 27], Boneh and Boyen show that a selective-ID secure IBE can also be proven to be full-ID secure. Roughly speaking, a challenger can make a guess on which identity, said , will be targeted at the challenge phase before it starts the simulation. If the adversary makes a query with or does not activate the challenge phase with , then the simulation is aborted. However, the proof strategy makes the reduction “lossy,” i.e., the reduction is not tight. Let be the number of allowed identities, then the reduction will lose a factor of . That is, if the adversary wins the security game with advantage , then the challenger only guarantees to solve the underlying hard problem with advantage (actually the analysis should take the running times into consideration. Here, we simply assume that the running times of the adversary and the challenger are asymptotically equivalent). More details can be referred to [26, 28].

A lossy reduction is not merely a theoretic problem; it also relates to the efficiency and efficacy of the entire system. We give a simple example for the (informal) analysis as follows. If we want to build an IBE system based on the DBDH assumption with 80-bit security level, and assume , then we need to adopt a DBDH-hard group whose order is due to the lossiness. This will make the entire system inefficient since we need a longer bit representation for the group of larger order [29]. Therefore, achieving tight reduction is a significant goal for an encryption scheme, since it affects both security and efficiency. The tight reduction allows one to construct an encryption scheme with the same security level as the underlying hard assumption. We refer the readers to [30] for more detailed examples.

The consequence of a lossy reduction will be much more worse when it comes to more complex primitives, such as AMRIBE. In the security game of AMRIBE, an adversary activates the challenge phase with receivers, where can be any positive number smaller than the number of the total possible identities. Assume that we set an identity to be an -bits string, then a challenger needs to guess the target receiver set from different combinations. This makes the scheme impractical, since either the bit length of the representation for the underlying group will be exponentially large, or the reduction will be successful only with negligible advantage in the security proof.

1.1. Contributions

For both practical and theoretical reasons mentioned above, in this paper, we propose the first AMRIBE scheme achieving full-ID security in confidentiality and anonymity with tight reduction. It is worth noting that the security of our scheme is proven in the standard model, i.e., without random oracles. The random oracle model [31] is a heuristic and idealized model used to help people to prove the security of cryptographic primitives. In the security proofs, one usually models a cryptographic hash function as a random oracle. However, there are schemes proven secure in the random oracle models while being insecure when implementing the random oracle with any hash function in the real world [32, 33]. To the best of our knowledge, our scheme is the first and only one to achieve IND-MID-CCA/ANON-MID-CCA security (the abbreviation of “Indistinguishability under full-multi-ID chosen-ciphertext attacks” and “Anonymity under full-multi-ID chosen-ciphertext attacks”) with tight reduction in the standard model. Besides, compared with other existing schemes, the encryption cost is low. Therefore, our scheme fits the scenario that a sender needs frequently to send messages for large amount of users, such as e-mail systems with receiver anonymity.

1.2. Organization

The remainder of this paper is organized as follows. Section 2 presents some preliminaries, specifically our security notions and the complexity assumptions that will be used in the security proofs. In Section 3, we introduce our AMRIBE scheme. Section 4 provides security proofs for the confidentiality and anonymity of our proposed scheme. Next, we show the comparison between our scheme and the existing works in properties and performances in Section 5. Finally, Section 6 concludes our work and provides future research directions.

2. Preliminaries

2.1. Notations

In this paper, we use multiplicative group representation. For where , we mean the successive integer set from to , i.e., . Furthermore, for an integer , denotes the integer set . For a set , by “” we mean “choose uniformly from ”. For an algorithm , by “,” we denote “ is the output of ”. For a bit-string , we denote the -th bit of as .

2.2. Bilinear Mapping

Definition 1. Let , and be three multiplicative cyclic groups of prime order . A bilinear map (pairing) satisfies the following properties in which is a generator of , respectively.(i)Bilinearity: .(ii)Nondegeneracy: if , the identity element of , then either is the identity of or is the identity of .(iii)Computability: there exists an efficient algorithm to compute the function .

In this paper, we use type 3 pairings [34, 35], where and no efficient computable isomorphisms between are known.

2.3. Complexity Assumptions

The security of the proposed scheme is based on a variant of the decisional bilinear Diffie–Hellman (DBDH) problem, called DBDH-3 problem [36–39]. Let , and be three multiplicative cyclic groups of prime order , where is a generator of , respectively. Let be a type 3 pairing.

Definition 2. (a variant of DBDH problem in type 3 pairing groups—DBDH-3). Given , where decide whether or a random element in .

We say that an algorithm that outputs a bit has the advantage in solving the DBDH-3 problem if

Definition 3. (the DBDH-3 assumption). We say that the -DBDH-3 assumption holds if no -time algorithm has advantage at least in solving the DBDH-3 problem. We occasionally drop for simplicity.

2.4. Anonymous Multireceiver Identity-Based Encryption

An AMRIBE scheme consists of the following algorithms:(i): this algorithm takes as input a security parameter and outputs the master secret key and the system parameter . Note that all algorithms except Setup will implicitly take param as one of the inputs, and thus, we will omit the term param for simplicity.(ii): this algorithm takes as inputs the master secret key and an identity and then outputs the private key for user .(iii): this algorithm takes as inputs an identity set for any positive and a message and then outputs a ciphertext .(iv): this algorithm takes as inputs a ciphertext and a private key for and then outputs a message or a dedicated error symbol .

Correctness. For all :(i)If , then (ii)If , then

2.4.1. Confidentiality

Next, we will give the security definition for confidentiality. Consider the following game played between a challenger and an adversary . The security game consists of four phases as follows: Setup: generates the system parameter and sends it to . Phase 1: is allowed to make queries from the following oracles: : makes a query with an identity , and returns the private key to : makes a query with a ciphertext and an identity , and returns the result of Challenge: the adversary submits two messages with the same length and a target identity set for any positive integer , with the restriction that all identities in should not be submitted to oracle in Phase 1. then randomly chooses and generates . Finally, is returned to . Phase 2: is allowed to make queries as in Phase 1, except for queries with and queries with . Guess: finally, outputs a bit and wins the game if .

One can observe that the above game is modelled for the security notion IND-MID-CCA. The security games for IND-sMID-CCA and IND-MID-CPA can be obtained by forcing to commit before Setup and disallowing to query oracle, respectively. The advantage of winning the game is defined as

We say that an AMRIBE scheme is -IND-MID-CCA secure if all -time adversaries have at most advantage in winning the above IND-MID-CCA game.

2.4.2. Anonymity

Next, we define the anonymity for an AMRIBE. Consider the following game played between a challenger and an adversary . The security game consists of four phases as follows: Setup: generates the system parameter and sends it to . Phase 1: is allowed to make queries from the following oracles: : makes a query with an identity , and returns the private key to : makes a query with a ciphertext and an identity , and returns the result of Challenge: the adversary submits a message , a target identity set , and an identity set for any positive integer , with the restriction that all identities in should not be submitted to oracle in Phase 1. then randomly chooses , sets , and generates . Finally, is returned to . Phase 2: is allowed to make queries as in Phase 1, except for queries with and queries with . Guess: finally, outputs a bit and wins the game if .

The above game is modelled for the security notion ANON-MID-CCA (the security games for ANON-sMID-CCA and ANON-MID-CPA can be obtained by forcing to commit ID^∗ before Setup and disallowing to query Decrypt oracle, respectively). The advantage of winning the game is defined as follows:

We say that an AMRIBE scheme is -ANON-MID-CCA secure if all -time adversaries have at most advantage in winning the above ANON-MID-CCA game.

Remark 1. Note that this definition is actually modelled against insider adversaries, since is allowed to query the private key for , and the encrypted message is chosen by .

Remark 2. The ANON-MID-CCA game defined above is slightly different from some existing works, such as [19, 20, 22]. In their definition, submits two different identity sets , where , with the restriction that all have not been queried to oracle. In our model, one can image that and , and thus, , where is minimal. Actually, our model may be a stronger model since we allow an adversary to query as much private keys as possible, as long as the trivial way to win the game is prevented from the adversary.

2.5. Tight Security Reduction

In this section, we introduce the notion of tight security reduction. To prove the security of a cryptographic primitive, we usually construct a reduction between the security of the primitive and a well-studied hard assumption. That is, if there is an algorithm breaks the security of the primitive, then there exists an algorithm that makes black-box use of to solve the hard problem. Assume that the algorithm breaks the primitive with advantage in time , and the algorithm breaks the assumption with advantage in time . In a conventional sense [40], a reduction is said to be tight if and . Another weaker notion of tight reduction is defined in [30, 41]. The quality of a reduction can also be measured by the ratio between and . Let

In the above equation, “” is the “loss” for the reduction. A reduction is efficient if the loss is polynomially bounded. If is constant, then the reduction is said to be weakly tight. From this definition, we can see why an efficient (or ideally, tight) reduction is important. We briefly explain the reason. Assume that , then we have

If is exponentially large, then may be negligible; even if the adversary’s advantage is nonnegligible, we cannot base the security of our protocol on the underlying complexity assumptions.

3. Anonymous Multireceiver Identity-Based Encryption with Tight Reduction

In this section, we demonstrate a novel AMRIBE scheme with tight reduction. The proposed AMRIBE scheme is, to the best of our knowledge, the first such scheme with full security under tight reduction in the standard model.

3.1. The Proposed AMRIBE with Tight Reduction

Let , and be three cyclic multiplicative groups with prime order and be the generators of , respectively. In this scheme, we adopt type 3 pairing, i.e., . The proposed scheme consists of the following algorithms:

: taking as input a security parameter , KGC performs as follows:(1)Choose .(2)Choose two cryptographic hash functions and , where is a positive integer.(3)Compute .(4)For , choose and compute .(5)Choose , and compute .(6)Publish the system parameter

and keep secret the master secret key .

: taking as input the master secret key and an identity , KGC computes the private key for as follows. For convenience, given an identity , where the corresponding hash value is , we define a function .(1)Choose (2)Compute (3)Set the private key

: taking as input an identity set for a positive integer and a message , the sender performs as follows. For convenience, given an identity , where the corresponding hash value is , we define a function .(1)Choose .(2)For , compute .(3)Compute for , and .(4)Compute , and .(5)The ciphertext is .

: taking as input a ciphertext and a private key , a user performs as follows. For , compute and . Then the user computes and checks whether . If the equality holds, then output . If the equality does not hold for all , then output .

Correctness. Assume that (say ) and . Note that since the discrete logarithms of both sides are equal. We haveand thus

Besides, the integrity of the ciphertext and the message can be verified by whether .

Remark 3. In the computations of (), it seems that lots of scalar operations for () must be performed. However, we can construct an index set , where before computing (). We then compute (). Therefore, we can compute () using only at most cheap group operations.

4. Security Proofs

Theorem 1. The proposed AMRIBE scheme is -IND-MID-CCA secure in the standard model if the -DBDH-3 assumption holds, where and ( is the maximum number of queries and is the time required for a pairing).

Proof. Given , the challenger simulates the following game for the adversary :
Setup: performs as follows:(1)Choose two cryptographic hash functions and , where is the length of an identity.(2)Set .(3)For , choose and compute .(4)Choose , and compute .(5)Set the master secret key .(6)Send the system parameterPhase 1: in this phase, is allowed to make queries from and oracles. Since knows the master secret key , it can easily answer and queries as the same way as the proposed scheme.
Challenge: sends and a set of receivers for a positive integer to , where are two distinct messages with the same length, and has not been queried in Phase 1 for . Then performs as follows:(1)Choose compute (2)Compute (3)Set (4)For , let , compute (5)Compute , and (6)Output the challenge ciphertext Phase 2: makes the same queries as Phase 1. However, is unable to query and for .
Guess: finally, outputs a bit and wins the game if . Then, outputs 1 if wins the game; otherwise, outputs 0.
Perfect simulation: since has full control on the master secret key , oracle and oracle can be simulated perfectly. As for the challenge ciphertext , we implicitly set . If , then we have that(i)(ii)(iii)(iv)For (v)Therefore, the challenge ciphertext is well formed. If is a random element in , then the distribution of is independent from ’s view, and thus, the advantage will be 0.
Probability analysis: we then analyse the advantage that breaks the DBDH-3 assumption. If , we have . If is a random element in , we have . Therefore, we haveTime complexity: let be the maximum numbers of the queries. Since in each query, needs to perform at most pairings, where is the size of the receiver set, we have that , where is the time required for a paring.
Tightness analysis: according to the definition given in Section 2.5, a reduction is said to be tight if and . From the above analysis, we have that and . Since the DBDH-3 problem is an assume-to-be-hard problem, we have , where is the security parameter and is an exponential function in . On the other hand, and , where and are polynomials of . Therefore, we know that .

One may wonder that, since the reduction algorithm is able to generate a private key for any ID and accept any IDs for the challenge ciphertext, whether it is possible that the reduction algorithm generates a private key for and decrypt to check if . Note that our proof strategy is slightly similar to that of [28]. The challenge ciphertext is structured such that, if we decrypt with the private key for , the decryption procedure will succeed no matter the value of is. In the decryption algorithm, we recover the message . In the reduction algorithm, we can see that both are valid no matter the value of is. Thus, if we compute , then we will have . It leads that

Theorem 2. The proposed AMRIBE scheme is -ANON-MID-CCA secure in the standard model if the -DBDH-3 assumption holds, where and ( is the maximum number of queries and is the time required for a pairing).

Proof. Given , the challenger simulates the following game for the adversary :
Setup: performs as follows.(1)Choose two cryptographic hash functions and , where is a positive integer.(2)Set .(3)For , choose and compute .(4)Choose , and compute .(5)Set the master secret key .(6)Send the system parameterPhase 1: in this phase, is allowed to make queries from and oracles. Since knows the master secret key , it can easily answer and queries as the same way as the proposed scheme.
Challenge: sends , , and a set of identities for a positive integer to , where has not been queried in Phase 1 for . Then performs as follows:(1)Choose compute (2)Compute (3)Set (4)For , let , compute (5)Compute , where (6)Output the challenge ciphertext Phase 2: makes the same queries as Phase 1. However, is unable to query and for .
Guess: finally outputs a bit and wins the game if . Then outputs 1 if wins the game; otherwise outputs 0.
Perfect simulation: since has full control on the master secret key , oracle and oracle can be simulated perfectly. As for the challenge ciphertext , we implicitly set . If , then we have that(i)(ii)(iii)(iv)For (v)Therefore, the challenge ciphertext is well formed. If is a random element in , then the distribution of is independent from ’s view, and thus, the advantage will be 0.
Probability analysis: we then analyse the advantage that breaks the DBDH-3 assumption. If , we have . If is a random element in , we have . Therefore, we haveTime complexity: let be the maximum numbers of the queries. Since in each query, needs to perform at most pairings, where is the size of the receiver set, we have that , where is the time required for a paring.
Tightness analysis: according to the definition given in Section 2.5, a reduction is said to be tight if and . From the above analysis, we have that and . Since the DBDH-3 problem is an assume-to-be-hard problem, we have , where is the security parameter and is an exponential function in . On the other hand, and , where and are polynomials of . Therefore, we know that .

5. Comparisons

In this section, we give comparisons of our schemes with the existing schemes in both properties and efficiency. The notations used in this section are shown in Table 1, and the comparisons for the properties and performances between our scheme and the existing works are shown in Tables 2 and 3, respectively. For convenience, we set the following scenario to quantize the efficiency. When a sender wants to share a file with receivers, she/he first encrypts a symmetric key using the algorithm of an AMRIBE scheme and then encrypts the file with this symmetric key. The “Encryption cost” means the computation cost to generate the ciphertext for the symmetric key, and the “Ciphertext Length” is the bit length of the ciphertext for the symmetric key. When a receiver wants to recover the shared file, she/he first recovers the symmetric key using the algorithm of the AMRIBE scheme and then recovers the shared file. The “Decryption Cost” in the following tables means the computation cost to recover the symmetric key. In the comparison of computation cost, we mainly consider the costs of some heavy operations, such as scalar operation in and pairing, and omit some lightweight operations, such as hash function and symmetric encryption. The reason is that the former is much more costly than the latter. To better evaluate the efficiency, we may assume that the number of receivers for a ciphertext to be and an identity is a string with bits. From [42], we have that and bits in prime order groups of 128-bit security level. Besides, we consider the implementation of a Map-To-Point function given in [2] as the Map-To-Point function used in these papers, and we have . Some of the existing schemes use a symmetric encryption function to encrypt the message. For convenience, we assume that the message length and the symmetric key length are 256 bits. Also we assume that the lengths of the outputs of hash functions and symmetric encryption function in these schemes are 256 bits.

Here, we compare the proposed AMRIBE schemes with the existing AMRIBE schemes [15, 18, 43–50], whose CCA security has been claimed by their authors. The results are shown in Tables 2 and 3. The computation costs for decryption shown in Table 3 are evaluated in the worst case. That is, a receiver must try all ciphertext components for successful decryption if necessary.

From Table 2, one can observe that our scheme is the first one achieving full security against chosen-ciphertext attacks with tight reduction in the standard model. As we mentioned in the Introduction, those properties are significant in both theoretic and practical points of view. Besides, from Table 3, we can see that, compared with other existing schemes, the encryption cost is low. Therefore, our scheme fits the scenario that a sender needs frequently to send messages for large amount of users, such as e-mail systems with receiver anonymity. However, the efficiency of the proposed scheme can be further improved in decryption cost, i.e., the decryption is almost the slowest among the existing schemes. Another disadvantage is that ours can only be implemented in groups supporting type 3 pairings, which is an additional requirement compared to other schemes.

The symbol “” in Table 2 means that the scheme is claimed to achieve CCA security, but some problem is found. All the cryptanalysis for these schemes can be found in [17, 49, 51, 52], except for [18, 19]. We will give the cryptanalysis for [18, 19] in Section 5.1.

Although the authors of [53] have claimed that their scheme achieves IND-CCA security, they did not prove the anonymity. Therefore, their work is not included in Tables 2 and 3.

Note that we do not list the schemes of [54, 55] in our comparison table because their schemes do not meet the basic requirement of identity-based encryption. In [54], Chen et al. proposed two schemes, and in both of their schemes, KeyGen algorithm needs a receiver set as one of the inputs. However, it is impossible for a user to know the receiver set which will be decided in the future. There are two possibilities: one is that the KGC must be online to generate private keys when a user needs to decrypt and the other is that all the ciphertext must be encrypted for a fixed group. Both assumptions are not practical and against the basic requirements of IBE. The problems of schemes in [55] are the same as that of [54].

Some of the existing schemes [25, 56] are claimed to be CCA secure; however, they actually achieve only CPA security. The reason is that, in their proofs, the partitioning paradigm is used. That is, all the identities will be separated into two disjoint groups, say group A and group B. The challenger can only generate private keys for IDs of group A, while generate challenge ciphertexts for IDs of group B. When an adversary queries private keys with IDs of group B or challenge ciphertexts with IDs of group A, the challenger aborts the simulation. Therefore, if an adversary is only allowed to make decryption queries with IDs of group A, then that is actually equivalent to CPA security only.

5.1. Anonymity Analysis on He et al.’s AMRIBE Scheme

In 2016, He et al. proposed generic construction of AMRIBE [18], which is the preliminary version of [19]. The generic constructions given in the two papers are the same. Due to the page limitation, we give only a high-level overview on the cryptanalysis of He et al.’s AMRIBE scheme. We refer the readers to [18, 19] for more details. The idea of our cryptanalysis is similar to that in [49], where Zhang et al. presented an algorithm for an insider adversary to break the anonymity of the scheme of Zhang and Takagi [50].

In He et al.’s scheme, the component associated with the encrypted message in a ciphertext is with the form . The message is encrypted in with the encryption algorithm of an IND-CPA secure IBE scheme, i.e., , and is used for a selected receiver to confirm whether herself is one of the receivers. However, in order to prove the IND-MID-CCA security, the scheme is designed such that , which means an insider adversary is able to recover after successful decryption. Therefore, given an identity , an insider adversary can easily check whether is also one of the receivers by checking if there exists , such that .

6. Conclusion

Multireceiver identity-based encryption is a one-to-many encryption mechanism which encrypts a message to multiple receivers at the same time efficiently and securely. Such encryption is useful in many applications, e.g., pay-per-view TV, video conferencing, and distance education. Under certain circumstances, users may wish to protect their identities from revealing. To deal with this issue, Fan et al. first proposed the notion of anonymous multireceiver identity-based encryption and gave a concrete AMRIBE scheme. Since then, lots of research studies on these topics have been proposed.

In this paper, we give a novel fully secure AMRIBE scheme. To the best of our knowledge, it is the first and only scheme that achieves the IND-MID-CCA and the ANON-MID-CCA security in the standard model with tight reduction. Moreover, compared with other existing schemes, the encryption cost is low. Therefore, our scheme fits the scenario that a sender needs frequently to send messages for large amount of users, such as e-mail systems with receiver anonymity. There are still some improvements that can be made to our schemes in the future. For instance, the efficiency of the proposed AMRIBE with tight reduction may be further improved, especially in the decryption cost. Besides, due to the thread of the supreme computing power of quantum computers, the researches of postquantum cryptographic primitives are becoming significant. Lots of postquantum ID-based schemes [57–59] are proposed in the literature as well. Hence, another direction for our future research could be figuring out an AMRIBE scheme achieving tight security and CCA security in postquantum setting.

Data Availability

No data were used to support this study.

Conflicts of Interest

The authors declare that they have no conflicts of interest.

Acknowledgments

This work was partially supported by the Ministry of Science and Technology of Taiwan under grants MOST 110-2218-E-110-007-MBK, MOST 109-2221-E-110-044-MY2, MOST 110-2923-E-110-001-MY3, MOST 108-2218-E-004-002-MY2, MOST 109-2221-E-004-011-MY3, and MOST 109-3111-8-004-001. It also was financially supported by the Information Security Research Center at National Sun Yat-sen University in Taiwan and the Intelligent Electronic Commerce Research Center from The Featured Areas Research Center Program within the framework of the Higher Education Sprout Project by the Ministry of Education (MOE) in Taiwan.

References

A. Shamir, “Identity-based cryptosystems and signature schemes,” in Proceedings of CRYPTO 84 on Advances in Cryptology, pp. 47–53, Springer-Verlag, New York, NY, USA, 1985.
View at: Publisher Site | Google Scholar
D. Boneh and M. Franklin, “Identity-based encryption from the Weil pairing,” in Proceedings of the 21st Annual International Cryptology Conference on Advances in Cryptology, CRYPTO ’01, pp. 213–229, Springer-Verlag, London, UK, August 2001.
View at: Publisher Site | Google Scholar
C. Cocks, “An identity based encryption scheme based on quadratic residues,” in Proceedings of the 8th IMA International Conference on Cryptography and Coding, pp. 360–363, Springer-Verlag, London, UK, December 2001, http://dl.acm.org/citation.cfm?id=647995.742435.
View at: Publisher Site | Google Scholar
T. Arul, Channel Switching-Triggered Charging for Pay-TV over IPTV, Darmstadt University of Technology, Darmstadt, Germany, 2017, http://tuprints.ulb.tu-darmstadt.de/6680/PhD Thesis.
T. Arul and A. Shoufan, “Consumer opinions on short-interval charging for pay-tv over IPTV,” in Proceedings of the 26th International Conference on Advanced Information Networking and Applications Workshops, pp. 147–153, WAINA, Fukuoka, Japan, March 2012.
View at: Publisher Site | Google Scholar
T. Arul and A. Shoufan, “Subscription-free pay-tv over IPTV,” Journal of Systems Architecture, vol. 64, pp. 37–49, 2016.
View at: Publisher Site | Google Scholar
Y. Liu, J. Duan, Q. Tang, and Y. Zhang, “A simple and efficient re-scrambling scheme for dtv programs,” IEEE Transactions on Multimedia, vol. 16, no. 1, pp. 137–146, 2014.
View at: Publisher Site | Google Scholar
M. G. Msgna, K. Markantonakis, K. Mayes, and R. N. Akram, “Subscriber centric conditional access system for pay-tv systems,” in Proceedings of the 2013 IEEE 10th International Conference on e-Business Engineering, pp. 450–455, Coventry, UK, September 2013.
View at: Publisher Site | Google Scholar
J. Baek, R. Safavi-Naini, and W. Susilo, “Efficient multi-receiver identity-based encryption and its application to broadcast encryption,” in Proceedings of the 8th International Conference on Theory and Practice in Public Key Cryptography, PKC’05, pp. 380–397, Springer-Verlag, Berlin, Germany, 2005.
View at: Publisher Site | Google Scholar
C.-D. Jung, S.-B. Yoon, C. Sur, and K. H. Rhee, “Efficient multi-receiver identity-based encryption scheme from bilinear pairing,” The Journal of the Korean Institute of Information and Communication Engineering, vol. 11, no. 1, 2007.
View at: Google Scholar
L. Wang and C.-K. Wu, “Efficient identity-based multicast scheme from bilinear pairing,” IEEE Proceedings - Communications, vol. 152, no. 5, pp. 877–882, 2005.
View at: Publisher Site | Google Scholar
C. Delerablée, “Identity-based broadcast encryption with constant size ciphertexts and private keys,” in Proceedings of the Advances in Cryptology–ASIACRYPT, pp. 200–215, Springer, Berlin, Germany, 2007.
View at: Google Scholar
X. Du, Y. Wang, J. Ge, and Y. Wang, “An ID-based broadcast encryption scheme for key distribution,” IEEE Transactions on Broadcasting, vol. 51, no. 2, pp. 264–266, 2005.
View at: Publisher Site | Google Scholar
R. Sakai and J. Furukawa, “Identity-based broadcast encryption,” Tech. Rep., Cryptology ePrint Archive, Berlin, Germany, 2007, https://eprint.iacr.org/2007/217Report 2007/217.
View at: Google Scholar
C. I. Fan, L. Y. Ling-Ying Huang, and P. H. Pei-Hsiu Ho, “Anonymous multireceiver identity-based encryption,” IEEE Transactions on Computers, vol. 59, no. 9, pp. 1239–1249, 2010.
View at: Publisher Site | Google Scholar
H.-Y. Chien, “Improved anonymous multi-receiver identity-based encryption,” The Computer Journal, vol. 55, no. 4, pp. 439–446, 2012.
View at: Publisher Site | Google Scholar
C.-I. Fan and Y.-F. Tseng, “Anonymous multi-receiver identity-based authenticated encryption with CCA security,” Symmetry, vol. 7, no. 4, pp. 1856–1881, 2015, http://www.mdpi.com/2073-8994/7/4/1856.
View at: Publisher Site | Google Scholar
K. He, J. Weng, M. H. Au, Y. Mao, and R. H. Deng, “Generic anonymous identity-based broadcast encryption with chosen-ciphertext security,” in Proceedings, Part II, of the 21st Australasian Conference on Information Security and Privacy, vol. 9723, pp. 207–222, Springer-Verlag, New York, NY, USA, 2016.
View at: Google Scholar
K. He, J. Weng, Y. Mao, and H. Yuan, “Anonymous identity-based broadcast encryption technology for smart city information system,” Personal and Ubiquitous Computing, vol. 21, no. 5, pp. 841–853, 2017.
View at: Publisher Site | Google Scholar
J. Lai, Y. Mu, F. Guo, and R. Chen, “Fully privacy-preserving ID-based broadcast encryption with authorization,” The Computer Journal, vol. 60, no. 12, pp. 1809–1821, 2017.
View at: Publisher Site | Google Scholar
J. Lai, Y. Mu, F. Guo, W. Susilo, and R. Chen, “Anonymous identity-based broadcast encryption with revocation for file sharing,” in Proceedings of the Information Security and Privacy, pp. 223–239, Springer International Publishing, Cham, Switzerland, 2016.
View at: Publisher Site | Google Scholar
J. Lai, Y. Mu, F. Guo, W. Susilo, and R. Chen, “Fully privacy-preserving and revocable ID-based broadcast encryption for data access control in smart city,” Personal and Ubiquitous Computing, vol. 21, no. 5, pp. 855–868, 2017.
View at: Publisher Site | Google Scholar
P. Xu, J. Li, W. Wang, and H. Jin, “Anonymous identity-based broadcast encryption with constant decryption complexity and strong security,” in Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, ASIA CCS ’16, pp. 223–233, ACM, New York, NY, USA, 2016.
View at: Publisher Site | Google Scholar
J. Zhang and J. Mao, “Anonymous multi-receiver broadcast encryption scheme with strong security,” International Journal of Embedded Systems, vol. 9, no. 2, pp. 177–187, 2017.
View at: Publisher Site | Google Scholar
F.-C. Zhou, M.-Q. Lin, Y. Zhou, and Y.-X. Li, “Efficient anonymous broadcast encryption with adaptive security,” KSII Transactions on Internet and Information Systems, vol. 9, no. 11, pp. 4680–4700, 2015.
View at: Publisher Site | Google Scholar
D. Boneh and X. Boyen, “Efficient selective-ID secure identity-based encryption without random oracles,” in Proceedings of the Advances in Cryptology - EUROCRYPT 2004, volume 3027 of LNCS, pp. 223–238, Springer-Verlag, 2004.
View at: Publisher Site | Google Scholar
D. Boneh and X. Boyen, “Secure identity based encryption without random oracles,” in Advances in Cryptology–CRYPTO 2004, M. Franklin, Ed., pp. 443–459, Springer, Berlin, Germany, 2004.
View at: Publisher Site | Google Scholar
C. Gentry, “Practical identity-based encryption without random oracles,” in Advances in Cryptology-EUROCRYPT 2006, S. Vaudenay, Ed., pp. 445–464, Springer, Berlin, Germany, 2006.
View at: Google Scholar
N. Attrapadung, “Dual system encryption framework in prime-order groups via computational pair encodings,” in Proceedings, Part II, of the 22Nd International Conference on Advances in Cryptology—ASIACRYPT 2016, vol. 10032, pp. 591–623, Springer-Verlag, New York, NY, USA, 2016.
View at: Publisher Site | Google Scholar
C. Bader, T. Jager, Y. Li, and S. Schäge, “On the impossibility of tight cryptographic reductions,” in Advances in Cryptology – EUROCRYPT 2016, Marc Fischlin and Coron Jean-Sébastien, Eds., pp. 273–304, Springer, Berlin, Germany, 2016.
View at: Publisher Site | Google Scholar
M. Bellare and P. Rogaway, “Random oracles are practical,” in Proceedings of the 1st ACM Conference on Computer and Communications Security, CCS ’93, pp. 62–73, ACM, New York, NY, USA, 1993.
View at: Publisher Site | Google Scholar
M. Bellare, A. Boldyreva, and A. Palacio, “An uninstantiable random-oracle-model scheme for a hybrid-encryption problem,” in Advances in Cryptology - EUROCRYPT 2004, C. Cachin and J. L. Camenisch, Eds., pp. 171–188, Springer, Berlin, Heidelberg, 2004.
View at: Google Scholar
R. Canetti, O. Goldreich, and S. Halevi, “The random oracle methodology, revisited,” Journal of the ACM, vol. 51, no. 4, pp. 557–594, 2004.
View at: Publisher Site | Google Scholar
S. D. Galbraith, K. G. Paterson, and N. P. Smart, “Pairings for cryptographers,” Discrete Applied Mathematics, vol. 156, no. 16, pp. 3113–3121, 2008, http://www.sciencedirect.com/science/article/pii/S0166218X08000449.
View at: Publisher Site | Google Scholar
N. P. Smart and F. Vercauteren, “On computable isomorphisms in efficient asymmetric pairing-based systems,” Discrete Applied Mathematics, vol. 155, no. 4, pp. 538–547, 2007, http://www.sciencedirect.com/science/article/pii/S0166218X06003271.
View at: Publisher Site | Google Scholar
S. Chatterjee and A. Menezes, “On cryptographic protocols employing asymmetric pairings - the role of Ψ revisited,” Discrete Applied Mathematics, vol. 159, no. 13, pp. 1311–1322, 2011, http://www.sciencedirect.com/science/article/pii/S0166218X11001648.
View at: Publisher Site | Google Scholar
S. Chatterjee and P. Sarkar, “Practical hybrid (hierarchical) identity-based encryption schemes based on the decisional bilinear diffie-hellman assumption,” International Journal of Applied Cryptography, vol. 3, no. 1, pp. 47–83, 2013.
View at: Publisher Site | Google Scholar
C.-I. Fan, V. S.-M. Huang, and H.-M. Ruan, “Arbitrary-state attribute-based encryption with dynamic membership,” IEEE Transactions on Computers, vol. 63, no. 8, pp. 1951–1961, 2014.
View at: Publisher Site | Google Scholar
J. H. Park and D. H. Lee, “An efficient ibe scheme with tight security reduction in the random oracle model,” Designs, Codes and Cryptography, vol. 79, no. 1, pp. 63–85, 4 2016.
View at: Publisher Site | Google Scholar
J. Katz and N. Wang, “Efficiency improvements for signature schemes with tight security reductions,” in Proceedings of the 10th ACM Conference on Computer and Communications Security, CCS ’03, pp. 155–164, ACM, New York, NY, USA, 2003.
View at: Publisher Site | Google Scholar
N. Attrapadung, J. Furukawa, T. Gomi, G. Hanaoka, H. Imai, and R. Zhang, “Efficient identity-based encryption with tight security reduction,” in Cryptology and Network Security, D. Pointcheval, Yi Mu, and K. Chen, Eds., pp. 19–36, Springer, Berlin, Germany, 2006.
View at: Google Scholar
A. Guillevic, “Comparing the pairing efficiency over composite-order and prime-order elliptic curves,” in Proceedings of the Applied Cryptography and Network Security, pp. 357–372, Banff, Canada, 2013.
View at: Publisher Site | Google Scholar
Y.-M. Tseng, Y.-H. Huang, and H.-J. Chang, “CCA-secure anonymous multi-receiver ID-based encryption,” in Proceedings of the 2012 26th International Conference on Advanced Information Networking and Applications Workshops, pp. 177–182, Fukuoka-shi, Japan, March 2012.
View at: Publisher Site | Google Scholar
Y.-M. Tseng, Y.-H. Huang, and H.-J. Chang, “Privacy-preserving multireceiver ID-based encryption with provable security,” International Journal of Communication Systems, vol. 27, no. 7, pp. 1034–1050, 2012.
View at: Publisher Site | Google Scholar
Y.-M. Tseng, T.-T. Tsai, S.-S. Huang, and H.-Y. Chien, “Efficient anonymous multi-receiver ID-based encryption with constant decryption cost,” in Proceedings of the 2014 International Conference on Information Science, pp. 131–137, Auckland, New Zealand, April 2014.
View at: Publisher Site | Google Scholar
H. Wang, “Provably secure anonymous multi-receiver identity-based encryption with shorter ciphertext,” in Proceedings of the 2014 IEEE 12th International Conference on Dependable, Autonomic and Secure Computing, pp. 85–90, Dalian, China, August 2014.
View at: Publisher Site | Google Scholar
H. Wang, Y. Zhang, H. Xiong, and B. Qin, “Cryptanalysis and improvements of an anonymous multi-receiver identity-based encryption scheme,” IET Information Security, vol. 6, no. 1, pp. 20–27, 2012.
View at: Publisher Site | Google Scholar
B. Zhang, T. Sun, and D. Yu, “ID-based anonymous multi-receiver key encapsulation mechanism with sender authentication,” in Proceedings of the Algorithms and Architectures for Parallel Processing, pp. 645–658, Springer, Cham, Switzerland, October 2014.
View at: Publisher Site | Google Scholar
J. Zhang and J. Mao, “An improved anonymous multi-receiver identity-based encryption scheme,” International Journal of Communication Systems, vol. 28, no. 4, pp. 645–658, 2015.
View at: Publisher Site | Google Scholar
M. Zhang and T. Takagi, “Efficient constructions of anonymous multireceiver encryption protocol and their deployment in group e-mail systems with privacy preservation,” IEEE Systems Journal, vol. 7, no. 3, pp. 410–419, 2013.
View at: Publisher Site | Google Scholar
H. Li and L. Pang, “Cryptanalysis of Wang et al. improved anonymous multi‐receiver identity‐based encryption scheme,” IET Information Security, vol. 8, no. 1, pp. 8–11, 2014.
View at: Publisher Site | Google Scholar
J. Zhang and Y. Xu, “Comment on anonymous multi-receiver identity-based encryption scheme,” in Proceedings of the 2012 Fourth International Conference on Intelligent Networking and Collaborative Systems, pp. 473–476, Bucharest, Romania, September 2012.
View at: Publisher Site | Google Scholar
L. Pang, L. Guo, Q. Pei, J. Gui, and Y. Wang, “A new ID-based multi-recipient public-key encryption scheme,” Chinese Journal of Electronics, vol. 22, no. 1, pp. 89–92, 2013.
View at: Google Scholar
Z. Chen, S. Li, C. Wang, and Y. Shen, “Two constructions of multireceiver encryption supporting constant keys, short ciphertexts, and identity privacy,” International Journal of Network Security, vol. 14, no. 9, 2012.
View at: Google Scholar
L. Zhang, Q. Wu, and Y. Mu, “Anonymous identity-based broadcast encryption with adaptive security,” in Proceedings of the Cyberspace Safety and Security, pp. 258–271, Springer International Publishing, Cham, Switzerland, November 2013.
View at: Publisher Site | Google Scholar
A. Muthulakshmi, R. Anitha, S. Rohini, and K. Princy, “Identity based privacy preserving dynamic broadcast encryption for multi-privileged groups,” in Recent Trends in Computer Networks and Distributed Systems Security, S. M. Thampi, A. Y. Zomaya, T. Strufe, M. Jose, A. Calero, and Tony Thomas, Eds., pp. 272–282, Springer, Berlin, Germany, 2012.
View at: Publisher Site | Google Scholar
S. Agrawal, D. Boneh, and X. Boyen, “Efficient lattice (h)ibe in the standard model,” in Advances in Cryptology–EUROCRYPT 2010, H. Gilbert, Ed., pp. 553–572, Springer, Berlin, Germany, 2010.
View at: Publisher Site | Google Scholar
Z. Li, C. Ma, and D. Wang, “Towards multi-hop homomorphic identity-based proxy re-encryption via branching program,” IEEE Access, vol. 5, pp. 16214–16228, 2017.
View at: Publisher Site | Google Scholar
Z. Li, C. Ma, and D. Wang, “Achieving multi-hop pre via branching program,” IEEE Transactions on Cloud Computing, vol. 8, no. 1, pp. 45–58, 2020.
View at: Publisher Site | Google Scholar

Copyright

Copyright © 2021 Yi-Fan Tseng and Chun-I Fan. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

PDF Download Citation

Download other formats

Order printed copies

Views

607

Downloads

529

Citations