基于格的可证明安全无用户私钥加密方案

Provably Secure Private-Keyless Encryption on Lattice

  • 摘要: 针对公钥加密方案涉及繁琐私钥管理问题,无用户私钥加密通过将传统用户私钥替代为一次性解密凭证,从而简化了私钥更新、撤销等相关复杂管理操作,避免了用户安全存储私钥的代价,成为该问题的有效解决方案之一。据此,本文提出了一种理想格下的无用户私钥加密概念、方案及其安全性要求。首先,给出了无用户私钥加密的形式化定义和可验证的凭证构造方法,通过由第三方可信机构验证用户身份后颁发一次性解密凭证,从而降低了私钥存储代价并简化了私钥管理流程,并可支持对用户访问数据权限的实时判决。其次,引入密文刷新机制,由初始密文参数可直接生成当前时刻的刷新密文,建立了同一时刻下凭证与刷新密文的对应关系,仅需刷新部分密文,降低密文刷新计算开销。此外,本文给出了无用户私钥加密安全性要求,包括选择时间攻击下的凭证和刷新密文的不可伪造性、时效性安全以及语义安全,并描述了这些安全性要求的对应关系。最后,本文利用环上短整数解和带学习误差困难问题给出了标准模型下并借助R-SIS谕言机实现了该无用户私钥加密方案在理想格下的实例分析,由安全性证明可知,所提实例满足凭证和刷新密文的不可伪造性、时效性安全以及语义安全。

     

    Abstract: To tackle the cumbersome issue of private key management, the public-key encryption system that operates without user private keys, referred to as Private-KeyLess Encryption (PKLE), substitutes traditional user private keys with one-time decryption credentials. This substitution streamlines intricate management processes such as private key updates and revocations, while also eliminating the costs associated with users securely storing their private keys. Such a private-keyless mechanism has emerged as one of the effective solutions to the aforementioned problem. Building on this, this paper introduces the concept, scheme, and security requirements of PKLE within the framework of ideal lattices. Firstly, this paper formulates the definition of PKLE and proposes a construction method for verifiable credentials. Such credentials serve as "one-time decryption keys" issued by a trusted third party upon verification of the user's identity. They not only reduce the costs associated with private key storage and simplify private key management processes but also support real-time decisions regarding users' data access requirements. Secondly, a ciphertext refreshing mechanism is introduced to establish a correspondence between the verifiable credential and the refreshed ciphertext, where the ciphertext is generated at the time of credential issuance. This mechanism enables the direct conversion of initial ciphertext parameters into refreshed ciphertext corresponding to arbitrary time point, with only partial ciphertext requiring refreshment. As a result, it reduces the computational overhead associated with ciphertext refreshing. Additionally, this paper formulates the security requirements for the PKLE scheme, involving unforgeability of credentials and refreshed ciphertexts under chosen-time attacks, timeliness security, and semantic security. The interrelationships among these security requirements are also elaborated. Finally, leveraging the hardness of the Ring-Small Integer Solution (R-SIS) and Learning With Errors (R-LWE) problems, an instantiation analysis of the PKLE scheme over ideal lattices is conducted in the standard model with the aid of the R-SIS oracle. Security proofs demonstrate that the presented scheme satisfies the unforgeability of credentials and refreshed ciphertexts, timeliness security, and semantic security as required.

     

/

返回文章
返回