格上基于身份哈希证明系统的新型构造

隐私保护是当前大数据信息时代所亟待解决的重要安全问题。而密码学是实现对内容和身份等隐私信息进行有效保护的关键理论和技术基础之一。基于身份哈希证明系统（Identity-based hash proof system）是一个基本的密码学原型,能够用来构造多种对隐私信息进行保护的密码方案。本文通过分析得知,已有基于格的基于身份哈希证明系统的密文尺寸较大,会对所构造密码方案的效率产生较大的影响。如何降低基于格的基于身份哈希证明系统的密文尺寸,是一个有意义的研究问题。为此,本文首先基于标准带错误学习（Learning with errors,简记为LWE）困难假设,在标准模型下构造了一个新的哈希证明系统,并利用随机格上离散高斯分布与光滑参数的性质,证明其是光滑（Smooth）的;再在随机谕言机（Random oracle）的作用下,利用Gentry等人所提出的原像抽样函数提取身份私钥,从而得到一个光滑并且密文尺寸较小的基于身份哈希证明系统。作为对所构造新型哈希证明系统的扩展,本文也在标准模型下提出一个可更新的哈希证明系统。最后,详细分析本文所提出新型构造的效率,并与已有相关构造进行对比。     

抗泄露的(分层)身份基密钥封装机制

在真实应用环境中,冷启动、边信道等物理攻击方式的出现,使得敌手能够获得参与者内部私有状态的泄露信息,从而导致传统可证明安全的密码机制在有泄露的环境下已无法继续保持其原有的安全性,因此更多的密码学研究者开始致力于抗泄露密码机制的研究.混合加密技术同时具备了对称加密和非对称加密的优势,由于身份基密钥封装机制(Identity-Based Key-Encapsulation Mechanism,IB-KEM)是身份基混合加密机制的重要组成部分,近年来得到了广泛关注.为满足真实环境的抗泄露性需求,抗泄露IB-KEM被提出;然而现有的构造在计算、传输和存储等方面均存在不足.针对上述不足,本文提出了选择密文攻击(Chosen-Ciphertext Attacks,CCA)安全的抗泄露IB-KEM的通用构造,并基于底层IB-KEM的选择明文攻击(Chosen-Plaintext Attacks,CPA)安全性对通用构造的CCA安全性进行了形式化证明.此外,为展示本文通用构造的实用性及普遍性,分别设计了 IB-KEM和分层身份的身份基密钥封装机制(Hierarchical Identity-Based Key-Encapsulation Mechanism,HIB-KEM)的具体实例,并在选择身份的安全模型下,基于判定的双线性Diffie-Hellman假设和双线性Diffie-H ellman指数假设对本文实例的CPA安全性分别进行了证明.最后,为了实现抵抗连续泄露攻击的目标,本文研究了各实例的密钥更新算法.相较于已有CCA安全的抗泄露IB-KEM,本文构造在计算、传输和存储等方面具有一定的优势.     

CCA安全的抗连续泄露的广播密钥封装机制

传统公钥基础设施中的证书复杂管理和身份基密码体制中的密钥托管等问题在基于证书的密码体制下得到了很好的解决,因此无证书密码体制近年来得到了广泛关注.此外,在现实应用中,攻击者基于冷启动、边信道等各种各样的泄露攻击获得密码机制内部敏感状态(如秘密钥等)的泄露信息,导致在传统理想模型下被证明安全的密码机制不再具有相应的安全性.此外,由于广播通信模式具有较高的消息通信效率,多个具有广播通信功能的密码原语相继被提出.针对基于证书密钥封装机制对泄露容忍性和广播通信等性能的需求,提出抗泄露的基于证书的广播密钥封装机制的实例化构造,并基于判定的Diffie-Hellman困难性假设对其选择密文攻击下的安全性进行了证明.此外,为进一步增强该构造的实用性,研究了广播密钥封装机制的连续泄露容忍性,通过定期更新用户密钥的方式实现了对连续泄露攻击的抵抗目标.与现有工作的分析对比表明,该构造在保证安全性可证明的基础上,不仅实现了抵抗泄露攻击和广播通信的功能,而且拥有较高的计算效率.     

基于证书的抗泄露的安全加密方案

近期实践表明密码系统容易受到各种攻击而泄漏密钥等相关秘密信息, 泄漏的秘密信息破坏了以前的已证明安全的方案, 因此设计抗泄漏的密码学方案是当前密码研究领域的一个热点研究方向。设计一个基于证书的加密方案, 总的设计思想是使用一个基于证书的哈希证明系统, 这个证明系统包含一个密钥封装算法, 用这个密钥封装算法结合一个提取器去加密一个对称加密所用的密钥, 那么得到的加密方案就是可以抵抗熵泄漏并且是安全的。对方案的安全性分析和抗泄漏性能分析, 表明本方案在抵抗一定量的密钥泄漏和熵泄漏时可以保持安全性。     

Aleakage-resilient certificateless public key encryption scheme with CCA2 security

In recent years, much attention has been focused on designing provably secure cryptographic primitives in the presence of key leakage. Many constructions of leakage-resilient cryptographic primitives have been proposed. However, for any polynomial time adversary, most existing leakage-resilient cryptographic primitives cannot ensure that their outputs are random, and any polynomial time adversary can obtain a certain amount of leakage on the secret key from the corresponding output of a cryptographic primitive. In this study, to achieve better performance, a new construction of a chosen ciphertext attack 2 (CCA2) secure, leakage-resilient, and certificateless public-key encryption scheme is proposed, whose security is proved based on the hardness of the classic decisional Diffie-Hellman assumption. According to our analysis, our method can tolerate leakage attacks on the private key. This method also achieves better performance because polynomial time adversaries cannot achieve leakage on the private key from the corresponding ciphertext, and a key leakage ratio of 1/2 can be achieved. Because of these good features, our method may be significant in practical applications.     

无证书抗私钥泄漏的加密方案

针对大量的边信道攻击和冷启动攻击泄漏密码系统的秘密信息进而导致传统密码方案不安全的问题,提出了一种能在私钥泄漏情况下保持安全的无证书加密方案。基于q-ABDHE困难问题假设,从理论上证明了方案的安全性;通过提取器的使用实现了抗泄漏特性。理论分析表明提出的方案容许私钥的相对泄漏率可以达到1/8。     

密钥弹性泄漏安全的通配模板层次委托加密机制

传统的密码方案假定密钥对可能的攻击者来说是完全隐藏的(只有算法是公开的),敌手无法获得有关密钥的任何信息.但在实际系统中,攻击者可在噪声信道或由侧信道攻击获得有关密钥的部分信息.密钥弹性泄漏安全的加密方案通过改进密码算法达到在密钥存在可能部分泄漏情况下的语义安全性.设计了一个抗密钥弹性泄漏的可委托层次模板加密方案.在该方案中,用户身份关联到含有通配符的身份模板,并可以实现再次密钥委托.该方案是抗泄漏的层次身份加密方案(hierarchical identity-based encryption,简称HIBE)和隐藏向量加密方案(hidden vector encryption,简称HVE)的一般扩展,可有效地抵抗密钥弹性泄漏,并达到自适应语义安全性.同时给出该方案的安全性证明和系统抗泄漏性能,分析显示,该方案具有较好的密钥泄漏容忍性.     

可容忍信息泄露的指定验证者签名方案

指定验证者签名(DVS)克服了传统的数字签名中可公开验证的缺点,可防止验证者向第三方表明他获得了签名方发布的数字签名。但传统的密码方案的安全性依赖理想的假设,即攻击者不能获得保密的密钥的信息,而边信道攻击表明攻击者可以获得部分的秘密信息,因此有必要设计可以容忍信息泄露的指定验证者签名方案。基于“或”证明的技术,把Okamoto认证方案推广到指定验证者签名的情形,并在给定的泄露界下,证明了所提出的指定验证者签名方案在相对泄露模型下是安全的。     

Key continual-leakage resilient broadcast cryptosystem from dual system in broadcast networks

In order to tolerate possible leakage of secret keys, leakage-resilient cryptosystem models a class of attractive leakage output by allowing an adversary to provide any computable leakage function and learning the partial keys or other possible internal states from the output of function. In this work, we present an adaptively secure broadcast encryption resilient to key continual leakage in the standard model. Our scheme provides the tolerance of continual leakage, in which any user can generate multiple private keys per user by periodically updating the key. We use the dual system encryption mechanism to implement the leakage resilience and adaptive security, and intrinsically set an algorithm to refresh a key and produce a same distributed new key. We also give the evaluation of the leakage bound and leakage fraction, and the simulations show that our scheme can tolerate about 71% leakage fraction with 3.34 × 10^-52 failure probability in standard 80-bit security level when we adjust the leakage factor to allow the private key to be 100 Kb.     

Practical continuous leakage-resilient CCA secure identity-based encryption

Leakage of private information including private keys of user has become a threat to the security of computing systems. It has become a common security requirement that a cryptographic scheme should withstand various leakage attacks. In the real life, an adversary can break the security of cryptography primitive by performing continuous leakage attacks. Although, some research on the leakage-resilient cryptography had been made, there are still some remaining issued in previous attempts. The identity-based encryption (IBE) constructions were designed in the bounded-leakage model, and might not be able to meet their claimed security under the continuous-leakage attacks. In the real applications, the leakage is unbounded. That is, a practical cryptography scheme should keep its original security in the continuous leakage setting. The previous continuous leakageresilient IBE schemes either only achieve chosen-plaintext attacks security or the chosen-ciphertext attacks (CCA) security is proved in the selective identity model. Aiming to solve these problems, in this paper, we show how to construct the continuous leakage-resilient IBE scheme, and the scheme’s adaptive CCA security is proved in the standard model based on the hardness of decisional bilinear Diffie-Hellman exponent assumption. For any adversary, all elements in the ciphertext are random, and an adversary cannot obtain any leakage on the private key of user from the corresponding given ciphertext. Moreover, the leakage parameter of our proposal is independent of the plaintext space and has a constant size.     

Strongly simulation-extractable leakage-resilient NIZK

This paper defines strongly simulation-extractable (sSE) leakage resiliency (LR), which is a new notion for non-interactive zero-knowledge (NIZK) proof system. For an sSE-NIZK proof system, there exists a probabilistic polynomial-time extractor that can always extract a correct witness from any valid proof generated by the adversary, who can obtain proofs of true statements previously given by the simulator. The proof generated by the adversary may depend on a statement–tag pair which has already been used by the simulator. Furthermore, if the adversary can also learn leakage on witnesses and randomness which can explain the proofs generated by the simulator, then the sSE-NIZK proof system is said to satisfy the property of LR. In ASIACRYPT 2010, Dodis, Haralambiev, López-Alt, and Wichs proposed the definitions of true simulation-extractable (tSE) NIZK proof system and sSE-NIZK proof system and gave their constructions. The tSE-NIZK proof system is the same as the sSE-NIZK proof system except that the proof generated by the adversary cannot depend on a statement–tag pair which was used by the simulator. As an extension of the tSE-NIZK proof system, Garg, Jain, and Sahai defined a new notion for NIZK proof system called tSE-LR in CRYPTO 2011 and provided the construction of tSE-LR-NIZK proof system. We extend the notion of tSE-LR-NIZK proof system and construct it by improving the construction of tSE-LR-NIZK proof system. An sSE-LR-NIZK proof system is applicable to construct a fully leakage-resilient signature scheme which is strongly existentially unforgeable, while a tSE-LR-NIZK proof system is applicable to construct one which just satisfies the weak existentially unforgeability. Although there has already been a great deal of research proposed for cryptographic primitives in the leakage models, as far as we know, this is the first fully leakage-resilient signature scheme that is strongly existentially unforgeable.     

改进的抗自适应泄漏公钥加密方案

Halevi提出的抗自适应泄漏公钥加密(PKE)方案(TCC 2011会议论文集)只能抵抗选择明文攻击,不能抵抗选择密文攻击(CCA)。为此,利用双加密技术和非交互的零知识证明系统对其进行改进,基于CCA安全的抗自适应泄漏的形式化定义,给出一个新的PKE方案。理论分析结果表明,与原方案相比,新方案具有相同的密钥长度和抗泄漏量,并且安全性更高。     

弹性泄漏的公钥加密研究进展

由于冷启动攻击和边信道攻击导致密码系统部分信息泄漏,设计弹性泄漏密码系统成了当前密码学领域的研究热点。介绍弹性泄漏密码学的研究背景和意义,系统地分析和阐述弹性泄漏加密研究现状。总结现有文献中几种弹性泄漏安全模型,对弹性泄漏的加密现已取得成果进行比较详细的介绍与分析。介绍几种经典的弹性泄漏加密方案并对其弹性泄漏原理进行分析。指出可以进一步研究的方向。     

可证安全的抗泄露无证书混合签密机制

传统的基于双线性映射的混合签密方案存在着计算效率较低的不足,同时,无法抵抗信息泄露对方案所造成的危害,针对上述不足,在不使用双线性映射的基础上,提出了安全、高效的抗泄露无证书混合签密机制,并在随机谕言机模型下,基于计算性Diffie-Hellman问题和离散对数问题对该机制的机密性和不可伪造性进行了证明.同时,分析了该方案的公开验证性、前/后向安全性和不可否认性等安全属性;与传统的无证书混合签密机制相比,该机制不仅具有更优的计算效率,而且在秘密信息存在一定泄露的前提下,依然保持其所声称的安全性,即该方案还具有抵抗秘密信息泄露的能力.     

紧安全的环签名构造

对于一个密码方案而言,如何在安全证明中降低归约损失、实现紧归约是一个重要的问题。因为一般来说归约损失越大,就需要更大的参数来保证方案的理论安全强度,而在部署一个紧安全的密码方案的时候,则不需要牺牲效率来弥补归约损失。在这篇文章中,我们关注紧安全的环签名构造。环签名在2001年由Rivest等人首次提出,它允许用户在隐藏自己身份的同时进行签名,任何人都不能破坏环签名的匿名性,同时敌手不能冒充任意一个环成员生成相应的有效签名。虽然目前已有多种环签名的构造方案,但证明过程中的归约损失是高效实现的一大阻碍。在本文中,我们基于DDH假设在随机预言机模型下提出了一种环签名方案,其中安全证明的归约损失仅为常数,因此称为紧安全的环签名构造。在构造中,我们令每个用户的公钥由两个子公钥构成,用户私钥为其中一个子公钥对应的子私钥,再基于Goh与Jarecki提出的紧安全的EDL签名方案,我们利用标准的CDS变换构造了一个1/N-DDH非交互零知识证明系统,从而证明用户拥有有效的私钥,得到相应的环签名方案。得益于这种特殊的构造,在安全证明中我们不必使用分叉引理,也不必猜测敌手的目标公钥,从而实现了紧安全归约。此外,我们的方案可以用来构造附加其他性质的环签名方案,如可链接环签名,同时对于其他匿名签名方案的紧安全设计也具有启发意义。     

可编辑且可追责的区块链方案

随着区块链所承载信息种类和应用场景的不断增加,出于信息监管、隐私保护、数据更新等方面的目的,需要对记录在区块链上的数据进行删除、更新等操作。针对这些需求,基于公开可验证秘密共享、零知识证明、变色龙哈希等技术,本文提出了一个可编辑且可追责的区块链方案。在本方案中,变色龙哈希函数将替换原始区块链中的哈希函数,由领导者将变色龙哈希的陷门密钥通过公开可验证秘密共享分发给多个用户,从而避免由某一方独自持有陷门密钥所带来的中心化问题。持有密钥份额的用户将验证网络中出现的编辑请求,并对编辑请求进行投票。当大多数用户同意进行编辑时,将通过哈希排序的方式在用户中选举出编辑者,编辑者将恢复出变色龙哈希密钥进而进行编辑。为了实现编辑过程的可追责性,全体用户都可以对编辑后的内容进行验证,监管方可以实现相关责任方的追责。本方案还通过零知识证明技术,实现了在密钥分发与验证追责阶段,可以验证密钥份额正确性。安全性分析表明方案满足陷门安全性、可编辑性、可追责性,且陷门子密钥分发时不需要经过秘密通道。仿真实验结果表明,在系统参数已经生成完毕的情况下,方案的运行时间均为毫秒量级。而参数生成算法仅执行一次,而且可以预先执行,因此参数生成算法对方案的整体运行效率影响不大,本方案依然具有较好的运行效率。     

Lossy trapdoor functions from homomorphic reproducible encryption

Reproducible public-key encryption (reproducible PKE) provides an alternative way of encryption, which is called a reproduction algorithm, in addition to normally applying the encryption algorithm with the message and the randomness — applying the reproduction algorithm with the message, the secret key, and a ciphertext (possibly encrypted under a different public key).In this work, we show how to construct lossy trapdoor functions from homomorphic reproducible PKE, generalizing the DDH-based construction given by Peikert and Waters (STOC 2008). We also show that reproducible PKE can be constructed from standard number-theoretic assumptions, including DDH, QR, and DCR, and from smooth projective hash proof systems.     

LR-FEAD: leakage-tolerating and attribute-hiding functional encryption mechanism with delegation in affine subspaces

In large-scale networks, such as cloud computing and Internet of Things, functional encryption mechanism provides a flexible and powerful cryptographic primitive in constructing the secure transmission and communication protocols. However, as the side-channel attacks in open environments, the attacker can gain partial sensitive information from the pre-defined system by virtue of the time, power analysis, cold-boot attacks, etc. In this work, we design a leakage-resilient functional encryption scheme, which tolerates amount of bounded master-key leakage and user private-key leakage. In our scheme, encryption policies are specified as point vectors and decryption roles are defined as affine subspaces. Role delegation is implemented by specifying the affine transformation over subspaces. Our scheme achieves payload hiding and attribute hiding in the sense that the attacker is able to specify any efficiently computable leakage functions and learns the function outputs taking the master/private keys as inputs. Also, our scheme can tolerate the continual leakage for master key and private key, since we can periodically update the master key and the private key to generate a new and re-randomized key with the same distribution to the previous keys. We construct the scheme in composite-order bilinear groups and prove the security with dual system encryption methodology. We also analyze and discuss the performance of allowable leakage bound, leakage ratio and possible leakage probability. Our scheme has flexible applications in secure data communication and authorization delegation in open cloud computing systems.     

Chameleon Hashes Without Key Exposure Based on Factoring

Chameleon hash is the main primitive to construct a chameleon signature scheme which provides nonrepudiation and non-transferability simultaneously. However, the initial chameleon hash schemes suffer from the key exposure problem： non-transferability is based on an unsound assumption that the designated receiver is willing to abuse his private key regardless of its exposure. Recently, several key-exposure-free chameleon hashes have been constructed based on RSA assumption and SDH （strong Diffie-Hellman） assumption. In this paper, we propose a factoring-based chameleon hash scheme which is proven to enjoy all advantages of the previous schemes. In order to support it, we propose a variant Rabin signature scheme which is proven secure against a new type of attack in the random oracle model.