子群中完全安全的基于身份的广播加密英文

Fu lly S e c u r e Id e n t it y-b a s e dBr o a d c a s t En c r y p t io n in t h eS u b g r o u p sZhang Leyou1,2,Hu Y upu2,Wu Qing31Department of Mathematical Science,Xidian University,Xi'an710071,P.R.China2Key Laboratory of Computer Networks and Information Security,Ministry of Education,Xidian Univers ity,Xi'an 710071,P.R.China3School of automation,Xi’an Ins titute of Posts and Telecommunications,Xi’an710121,P.R.ChinaAbstr act:In this paper,we show how to use the dual techniques in the subgroups to give a secure identity-based broadcast encryption(IBBE)scheme with constant-size ciphertexts.Our scheme achieves the full security(adaptive security)under three static(i.e. non q-based)assumptions.It is worth noting that only recently Waters gives a short ciphertext broadcast encryption system that is even adaptively secure under the simple assumptions.One feature of our methodology is that it is relatively simple to leverage our techniques to get adaptive security.Key wor ds:identity-based broadcast encryption; dual system encryption;f ull secur ity;static assumption;subgroup;provable securityI.INTRODUCTIONIdentity-based encryption(IBE)was introduced by Shamir[1].It allows for a party to encrypt a message using the recipient’s identity as a public key.The ability to use identities as public keys avoids the need to distribute public key certi cates.So it can simplify many applications of public key encryption(PKE)and is currently an active research area.Identity-based broadcast encryption(IBBE) [2-6]is a generalization of IBE.One public key can be used to encrypt a message to any possible identity in IBE schemes.But in an IBBE scheme, one public key can be used to encrypt a message to any possible group of S identities.In Refs.[2, 4],the proposed scheme was based on random oracles.In addition,the size of the ciphertexts grows linearly with the number of the users.The well known construction of IBBE was proposed by Delerablée[3].This construction achieved constant size private keys and constant size ciphertexts. However the security of her main scheme achieved only selective-identity security(a weak security) and relied on the random oracles.In Refs.[5-6], two schemes with full security were proposed respectively.But they were impractical in real-life practice since their security relied on the complex assumptions which were dependent on the depth of users set and the number of queries made by an短文attacker.In addition,the work in Ref.[6]had the sublinear-size ciphertexts.Moreover,the authors in Ref.[6]used a sub-algorithm at the Encrypt phase to achieve full security which increased the computations cost.These motivate us to construct a new efficient scheme which can achieve a strong security-full security with constant size cipertexts.Recently,a new technique is applied to IBE.It is called Dual Encryption Technique.In a dual system [7-8],ciphertexts and keys can take on two forms:normal or semi-functional.Semi-functional ciphertexts and keys are not used in the real system since they are only used in the security proof.A normal key can decrypt normal or semi-functional ciphertexts,and a normal ciphertext can be decrypted by normal or semi-functional keys.However,when a semi-functional key is used to decrypt a semi-functional ciphertext,decryption will fail.More speci cally,the semi-functional components of the key and ciphertext will interact to mask the blinding factor by an additional random term.Waters [7]first proposed a broadcast encryption scheme based on this new technique.However,the proposed scheme is not based on identity and also inefficient since its cost of decryption is dependent on depth of users set.In this paper,we present a new construction.Our construction will use the composite order groups of order N=p 1p 2p 3and identities in Z N .The keys construction will be carried out in the subgroups 1p G and 3p G .2p G will be sem i-f unctional space which is not used in the real system.Our scheme achieves O(1)-size ciphertexts and full security which is stronger than selective-identity security.In addition,we show that its security does not rely on the random oracles and is achieved under three static assumptions.II.PRELIMINARIESp osite Or der Bilinear GroupsComposite order bilinear groups were used inRefs.[7-9].In this paper,the output is (N=p 1p 2p 3,G,G 1,e),where p 1,p 2,p 3are distinct primes,G and 1G are cyclic groups of order N.A bilinear map e is a map 1:e G G G ×→with the following properties:(i)Bilinearity:for all ,u v ∈G ,a,b ∈N Z ,we have (,)a b e u v =(,)a b e u v ;(ii)Non-degeneracy:g G ∈such that (,)e g g has order N in 1G ;(iii)Co mpu tab ility:th ere is an eff icient algorithm to compute (,)e u v for all ,u v ∈G .B.Static Har dness AssumptionIn this section,we give our complex assumption.These assumptions have been used in Refs.[8-9].Assum p tion 1(Subgroup decision pr oblem for 3primes)Given (N=p 1p 2p 3,G ,1G ,e),select randomly 1p g G ∈,33p X G ∈,121p p T G ∈,12p T G ∈and set D=(N,G ,1G ,e,g ,3X ).It is hard to distinguish 1T from 2T .The advantage of an algorithm is de ned as112|Pr[(,)1]Pr[(,)1]|Adv A D T A D T ===.Defin ition 1Assumption 1holds if 1A dv is negligible.Assumption 2Given (N=p 1p 2p 3,G ,1G ,e),pick randomly 11,p g X G ∈,2,X 22p Y G ∈,333,p X Y G ∈,set D =(N,G ,1G ,e ,g ,12323,,X X X YY ).Then select1T G ∈,132p p T G ∈at random.It is hard to distinguish 1T from 2T .The advantage of an algorithm is de ned as212|Pr[(,)1]Pr[(,)1]|Adv A D T A D T ===.Definition 2Assumption 2holds if 2Adv is negligible.Assumption 3Given (N=p 1p 2p 3,G ,1G ,e ),pick randomly 1p g G ∈,2,X 222,p Y Z G ∈,33p X G ∈,,N s Z α∈,set D=(N ,G ,1G ,e ,g ,2322,,,s g X X g Y Z α).Thencompute 1(,)s T e g g α=and pick randomly 21T G ∈.It is hard to distinguish 1T from 2T .The advantage of an algorithm is de ned as312|Pr[(,)1]Pr[(,)1]|Adv A D T A D T ===.Defin ition 3Assumption 3holds if 3A dv is negligible.C.I BBEAn identity-based broadcast encryption scheme (I BBE)with the secu rity parameter and th e短文1021,(,')(,)jsID jj j i e C d e d d C =≠∏=01011,((),)(()(),)iijiisID k r i ii ssI D I D r k i iij i j j i e h ug R e g h u R R g α===≠′∏∏∏011011,((),)((),)(,)((),)(,)((),)iiijiis sI D ID k r k i i ii i s sID ID k r k k k i i iji j j i e h u g e h u R e g g e h u g e R g e R g α====≠′=∏∏∏∏=1kv .Note:In the previous equation,the orthogonality property of 123,,p p p G G G is used.It is described simply as follows.Lem ma 1[8]When ,iji p j p h G h G ∈∈for i j ≠,(,)i j e h h is the identity element in 1G .By using this lemma,one can obtain0011,((),)(,)((),)1jis sID ID k kk i i i iji j j i e h u R e R g e R g ==≠′===∏∏.B.Ef ciency AnalysisOur construction achieves O(1)-size ciphertexts.The private key of construction pr ivate key is linear in the maximal size of S.In addition,(,)e g g a can be precomputed,so there no pair computations at the p hase of Encryp tion.Fur thermore,the security of the proposed scheme is reduced to the static assumptions.These assumptions are more natural than those in the existing schemes.Table I and 2give the comparisons of efficiency with other schemes.In Table I,all schemes achieve full security.Table I Comparisons of Ef ciencyschemes Hardness PK size pk size Ciphertextsize [5]TBDHE O (λ)O (|S |)O(1)[6]1st BDHE O (m)O (|S |)O(1)[6]2nd BDHE O (m)O (1)O(1)[6]3r d BDHE O (m)O (1)Sublinear of |S|OursStaticO (m)O (|S |)O(1)Table II Comparisons of Securityschemes R.O.StaticassumptionSecurity model [3]Yes No selective [4]Yes Yes full [5]No No full [6]No No full OursNoYesfullNote:λis a security parameter.m and |S|denote the maximal size of the set of receivers and the size of receivers for one encryption.R.O.denotes the random oracles.C.Secur ity An alysisIn this section,we will prove the security of the proposed scheme.We first define semi-functional keys and sem i-f unctional ciph ertexts.Let 2g denote a generator of 2p G .Semi-functional keys:At first,a normal key 0111(,',,,,,,)i i s d d d d d d +L L is obtained using the Extract algorithm.Then some random elements 00,,j γγγ′for 1,,j s =L and j i ≠are chosen in N Z .The semi-functional keys are set as follows.002d d g γ=,2d d g γ′′=,2jj j d d g γ=,1,,j s =L ,j i ≠.Sem i-fu n ctio n al cip h er t ext s:At f irst,anormal semi-functional ciphertext 012(,,)C C C ′′′isobtained using the Encrypt algorithm.Then two random elements λ1,λ2are chosen in N Z .The semi-functional ciphertexts are set as follows.00C C ′=,1112C C g λλ′=λ1λ2,2222C C g λ′=λ2.We organize our proof as a sequence of games.The first game defined will be the real identity-based encryption game and the last one will be one in which the adversary has no advantage unconditionally.We will show that each game is indistinguishable from the next (under three complexity assumptions).We rst de ne the games as:Game real :This is a real IBBE security game.For 0≤i ≤q ,the Game i is de ned as follows.Game i :Let Ωdenote the set of private keys which the adversary queries during the games.Thisgame is a real IBBE security game with the two exceptions:(1)The challenge ciphertext will be a semi-functional ciphertext on the challenge set *S .(2)The rst i keys will be semi-functional private keys.The rest of keys in Ωwill be normal.Note:In game 0,the challenge ciphertext is semi-functional.In game q ,the challenge ciphertexts and all keys are semi-functional.Game nal :This game is same with game q except that the challenge ciphertext is a semi-functional encryption of random group element of 1G .We will show that these games are indistin-guishable in a set of Lemmas.Let Adv game A denote the advantage in the real game.Lem ma 2Suppose that there exists an algorithm A such th at Adv realga me A 0Adv ga me A =ε.Th en we can build an algorithm B with advantage εin breaking Assumption 1.Pr oof Our algorithm B begins by receiving 3,,g X T where 1p g G ∈,33p X G ∈.It works as follows:Setup B chooses random elements 1,,,,l a a a L N b Z ∈an d sets ia i u g =,b h g =f or 1i l .It send s the p ub lic key s P K={1,,,,l g h u u L ,(,)a v e g g =}to A.Query Phase 1The adversary A issues a private key q uer y f or iden tity ID i ∈S (||S s l =).B answers as follows:It selects randomly 00,,,,1,j r t t t j s j i ′≠in N Z .Th e n it s et s 0111(,',,,,,,)iID i i s d d d d d d d +=L L =0111331313133((),,,,,,,).i i i s ID t t t t tt r r r arrr s ii i g huX g X u X u X u X u X +′+=L L It is a valid simulation to A.Ch a llen ge Th e adversar y A o utpu ts two challenge message 01,M M and a challenge set *S ={**1,,s ID ID L }.Then the ciphertext 012(,,)C C C C =is formed as*1012(,),,s iii a ID b a C M e T g C T C T γ=+∑===,γ{0,1}∈.Query phase 2The adversary continues to issue queries q j ,where q i is the following:y Extraction query (ID i ),as in phase 1with the constraint that ID i *S .Gu ess Finally,the adv er sary A outp uts aguess γ′∈{0,1}and wins the game if γ′=γ.I f 12p p T G ∈,th en 012(,,)C C C C =i s a se mi -functional ciphertext.If 1p T G ∈,012(,,)C C C C =is a normal ciphertext.Hence B can use A ’s guess to break Assumption 1with advantage ε.Lem m a 3S up p os e t hat th er e e xis ts an algorithm A that makes at most q queries and such t h at 1Adv k ga me A Adv kga me A =εf o r 1k q .Then we can build an algorithm B with advantage εin breaking Assumption 2.Pr oof Our algorithm B begins by receiving 12323,,,,g X X X YY T where 1p g G ∈,33p X G ∈.It works as follows:Setu p B chooses random elements 1,,,,l a a a L N b Z ∈a n d s et s ia i u g =,b h g =f o r 1i l .I t s en ds the p ublic keys PK={1,,,,l g h u u L ,(,)a v e g g =}to A.Quer y Phase 1Consider a private key query for i-th identity ID i ∈S (||S s l =).B answers as follows:(1)i k <,B will constr uct a semi-functional key.It selects randomly 00,,,j N r t t t Z ′∈,1,j s .j i ≠Then it sets 0111(,',,,,,,)iID i i s d d d d d d d +=L L 0112323232311(()(),(),(),,(),i ii ID r r art rt t t ii g hu YY g Y Y u Y Y u Y Y ′=L 123231(),,())i s r t r ts i u YYu YY ++L .It is a valid simulation to A.(2)i k >,B runs the Extract algorithm to obtain the normal key.(3)i k =,B f irst pick 0,,j t t 1,j s j i ≠in N Z at random.Then it sets0111(,',,,,,,)iID i i s d d d d d d d +=L L 11111133333((),,(),,(),(),,())kk k k k i s sa a aID b t t a t a t a t g T X T T X T X T X T X +++=L L .If 13p p T G ∈,this is a normal key.If T G ∈,this is a semi-functional key.Challen ge Th e ad ver sar y A o utp uts two challenge message 01,M M and a challenge set *S ={**1,,s ID ID L }.Then the ciphertext 012(,,)C C C C =is formed as 012(,),a C M e X X g γ=*1112(),s iii a ID b C X X =+∑=212C X X =,where γ{0,1}∈.Quer y phase 2The adversary continues to issue queries q j ,where q i is the following:y Extraction query (ID i ),as in phase 1with the constraint that ID i *S .短文Guess Finally,the adversary A outputs a guess γ′∈{0,1}and wins the game if γ′=γ.I f 13p p T G ∈,then B h as perf ectly simulated Gam e k-1.I f T G ∈,B has p er fectly simu lated Gam e k .Hence B can use A ’s guess to break Assumption 2with advantage ε.Lem m a 4Su pp o se th at ther e ex ists an algorithm A that makes at most q queries and such th at Adv q game A Adv f in alga me A =εf o r 1k q .Then we can build an algorithm B with advantage εin breaking Assumption 3.Pr oof Our algorithm B begins by r eceiving 2322,,,,a s g g X X g Y Z where 1p g G ∈,2,X 222,p Y Z G ∈,33p X G ∈,,N a s Z ∈.It works as follows:Setup B chooses random elements 1,,,l N a a b Z ∈L and sets ia i u g =,b h g =for 1i l .It sends the public keys PK={1,,,,l g h u u L ,2(,)a v e g X g =}to A.Qu ery Ph ase 1Consider a private key query for an identity ID i ∈S (||S s =≤l).B answers as follows:B selects randomly 0000,,,,,,,j j N r t t t z z z Z ′∈1,j s ≤≤.j i ≠≤≤Then it sets 0111(,',,,,,,)iID i i s d d d d d d d +=L L 00100111112333221233312122(()(),(),(),,(),(),,()).i i ii sii s z ID z z r a r t r t t i r z z z r t t r t s i i g X Z hu X g Z X u Z X u Z X u Z X u Z X ++′′+=L LThis is a semi-functional key.Challenge The adversary A outputs two challengemessages 01,M M an d ach alleng e set *S ={**1,,s ID ID L }.Then the ciphertext 012(,,)C C C C =is formed as*10122,(),s iii a ID b s s C M T C g Y C g Y γ=+∑===,{0,1}γ∈.Query phase 2The adversary continues to issuequeries q j ,where q i is the following:y Extraction query (ID i ),as in phase 1with theconstraint that ID i *S .Guess Finally,the adversary Aoutputs a guess γ′∈{0,1}and wins the game if γ′=γ.I f (,)as T e g g =,th en 012(,,)C C C C =is a vali dsemi-functional ciphertext.If T is random elementin 1G ,012(,,)C C C C =is a valid semi-functionalciphertext for a random message.Hence B can useA ’s guess to break Assumption 3with advantage ε.Theor em 1If Assumption 1,2and 3hold,then our IBBE is IND-ID-CPA secure.Pr oof If Assumption 1,2and 3hold,by the sequence of games and Lemma 2,3and 4,the adversary ’s ad vantage in the real gam e mu st be negligible.Hence our IBBE is IND-ID-CPA secure.V .CONCLUSIONSWe have given a new construction of IBBE in the subgroups.The proposed scheme has short size ciphertexts and achieves full security.In the standard model,we use dual techniques to prove the security of our new scheme under some simple hardness assumptions.Ackn owledgem entsThis paper was partially supported by the Nature Science Foundation of China under grant 60970119,60803149and the National Basic Research Program of China(973)under grant 2007CB311201.References[1]SHAMIR A.Identity-based Cryptosystems and SignatureSchemes[C]//Proceedings of Advances in Cryptology-Crypto,Lecture Notes in Computer Science,Berlin:Springer-V erlag press,1984,196:47–53.[2]MU Yi,SUSILO W,LIN Yanxia,et al.Identity-based Authenticated Broadcast Encryption and Distributed Authenticated Encryption[C]//Proceedings of the 9th Asian Computing Science Conference,Lecture Notes in Computer Science,Berlin:Springer-V erlag prss,2004,3321:169–181.[3]DELERABL E C.Identity-Based Broadcast Encryption with Constant Size Ciphertexts and Private Keys[C]//Proceedings of Advances in Cryptology-ASIACRYPT,Lecture Notes in Computer Science,volume 4833,Berlin:Springer-V erlag,2007:200–215.[4]DU Xinjun,W ANG Ying,GE Jianhua,et al.An ID-based Broadcast Encryption Scheme for Key Distribution[J].IEEE Transctions on Broadcasting,2005,51(2):264–266.[5]REN Yanli,GU Dawu.Fully CCA2Secure Identitybased Broadcast Encryption without Random Oracles[J].Information Processing Letters,2009,109:527–533. [6]GENTRY C,W ATERS B.Adaptive Security in BroadcastEncryption Systems[C]//Proceedings of Advances in Cryptology-Eurocry pt,Lecture Notes in Computer Science,Berlin:Springer-V erlag Press,2009,5479:171–188.[7]WA TERS B.Dual System Encryption:Realizing FullySecure Ibe and Hibe under Simple Assumptions[C]// Proceedings of Advances in Cryptology-Crypto,Lecture Notes in Computer Science,Berlin:Springer-Verlag Press, 2009,5677:619–636.(The full paper appeared Cryptology ePrint Archive Report2009/385)[8]LEWKO A,WATERS B.New Techniques for DualSystem Encryption and Fully Secure HIBE with Short Ci phertexts[C]//Proceedings of the7th Theory of Crypt ography Conferen ce2010,L ecture Notes in Computer Science,Berlin:Springer-Verlag Press,2010, 5978:455–479.[9]KA TZ J,SAHAI A,W ATERS B.Predicate EncryptionSupporting Disjunctions,Polynomial Equations,and Inner Products[C]//Proceedings of Advances in Cryptology-EUROCRYPT2008,Lecture Notes in Computer Science, Berlin:Springer-V erlag Press,2008,4965:146–162.BiographiesZhang Leyou,received his Ph.D.from theXidian University in2009.Now he i s anAssociate Professo r in the dep artmen t o fMathematical science of Xidian University.His current research interests include network security,computer security,and cryptography.He has published more than twenty papers in international and domestic journals and conferences.Hu Y upu,received his Ph.D.from the XidianUniversity in1999.Now he is a Professor inthe School of T elecommunications Engineeringof Xidian University.His current research interests include information security and cryptography.He has published more than a hundred papers in international and domestic journals and conferences.He is a Member of China Institute of Communications and a Director of Chinese Association for Cryptologic Research.W u Qing,received her Ph.D.from the XidianUniversity in2009.Now she is an AssociateProfessor in the school of automation of Xi’aninstitute of posts and telecommunication.Her current research interests include information security and applied mathematics.She has published more than twenty papers in international and domestic journals andconferences.。