Possibility and Impossibility Results for Receiver Selective Opening Secure PKE in the Multi-challenge Setting
| Autor: | Junzuo Lai, Willy Susilo, Zhengan Huang, Rupeng Yang, Man Ho Au, Qiuliang Xu |
|---|---|
| Rok vydání: | 2020 |
| Předmět: |
Scheme (programming language)
050101 languages & linguistics business.industry Computer science 05 social sciences 02 engineering and technology Adversary Encryption Computer security computer.software_genre Open system (systems theory) Upper and lower bounds Public-key cryptography Ciphertext 0202 electrical engineering electronic engineering information engineering 020201 artificial intelligence & image processing 0501 psychology and cognitive sciences business computer Key size computer.programming_language |
| Zdroj: | Advances in Cryptology – ASIACRYPT 2020 ISBN: 9783030648367 ASIACRYPT (1) |
| DOI: | 10.1007/978-3-030-64837-4_7 |
| Popis: | Public key encryption (PKE) schemes are usually deployed in an open system with numerous users. In practice, it is common that some users are corrupted. A PKE scheme is said to be receiver selective opening (RSO) secure if it can still protect messages transmitted to uncorrupted receivers after the adversary corrupts some receivers and learns their secret keys. This is usually defined by requiring the existence of a simulator that can simulate the view of the adversary given only the opened messages. Existing works construct RSO secure PKE schemes in a single-challenge setting, where the adversary can only obtain one challenge ciphertext for each public key. However, in practice, it is preferable to have a PKE scheme with RSO security in the multi-challenge setting, where public keys can be used to encrypt multiple messages. In this work, we explore the possibility of achieving PKE schemes with receiver selective opening security in the multi-challenge setting. Our contributions are threefold. First, we demonstrate that PKE schemes with RSO security in the single-challenge setting are not necessarily RSO secure in the multi-challenge setting. Then, we show that it is impossible to achieve RSO security for PKE schemes if the number of challenge ciphertexts under each public key is a priori unbounded. In particular, we prove that no PKE scheme can be RSO secure in the k-challenge setting (i.e., the adversary can obtain k challenge ciphertexts for each public key) if its secret key contains less than k bits. On the positive side, we give a concrete construction of PKE scheme with RSO security in the k-challenge setting, where the ratio of the secret key length to k approaches the lower bound 1. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|