SpringerLink
Log in

Leakage-Resilient Inner-Product Functional Encryption in the Bounded-Retrieval Model

  • Conference paper
  • First Online:
Information and Communications Security (ICICS 2020)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 12282))

Included in the following conference series:

  • 1083 Accesses

Abstract

We propose a leakage-resilient inner-product functional encryption scheme (IPFE) in the bounded-retrieval model (BRM). This is the first leakage-resilient functional encryption scheme in the BRM. In our leakage model, an adversary is allowed to obtain at most l-bit knowledge from each secret key. And our scheme can flexibly tolerate arbitrarily leakage bound l, by only increasing the size of secret keys, while kee** all other parts small and independent of l.

Technically, we develop a new notion: Inner-product hash proof system (IP-HPS). IP-HPS is a variant of traditional hash proof systems. Its output of decapsulation is an inner-product value, instead of the encapsulated key. We propose an IP-HPS scheme under DDH-assumption. Then we show how to make an IP-HPS scheme to tolerate \(l'\)-bit leakage, and we can achieve arbitrary large \(l'\) by only increasing the size of secret keys. Finally, we show how to build a leakage-resilient IPFE in the BRM with leakage bound \(l=\frac{l'}{n}\) from our IP-HPS scheme.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
EUR 32.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or Ebook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (Canada)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (Canada)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (Canada)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free ship** worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Notes

  1. 1.

    [10] showed how to construct an IPFE scheme from projective hash functions. But in their construction, the projective hash function is considered as a building block which is not related to the functionality in IPFE. And the way they build the construction is just like building an IPFE scheme from a PKE scheme. So it is difficult to build connection between the leakage-resilience of IPFE and the smoothness of hash functions.

  2. 2.

    In [56], it said that they discovered leakage-resilient functional encryption scheme for regular languages based on composite-order pairing groups in continual memory leakage (CML) model. However, in a functional encryption scheme for regular languages, a secret key \(\mathrm {sk}_M\) is associated with a deterministic finite automata M, and a ciphertext \(\mathrm {ct}\) encrypts a message m and is associated with an arbitrary length string w. A user holds \(\mathrm {sk}_M\) is able to decrypt the ciphertext \(\mathrm {ct}\) if and only if M accepts the string w. Notice that the decryption result is still m or nothing, so it actually can be viewed as a ABE scheme for wider classes of functionality.

References

  1. Abdalla, M., Bourse, F., De Caro, A., Pointcheval, D.: Simple functional encryption schemes for inner products. In: Katz, J. (ed.) PKC 2015. LNCS, vol. 9020, pp. 733–751. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46447-2_33

    Chapter  Google Scholar 

  2. Abdalla, M., Gay, R., Raykova, M., Wee, H.: Multi-input inner-product functional encryption from pairings. In: Coron, J.-S., Nielsen, J.B. (eds.) EUROCRYPT 2017. LNCS, vol. 10210, pp. 601–626. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-56620-7_21

    Chapter  Google Scholar 

  3. Agrawal, S., Libert, B., Stehlé, D.: Fully secure functional encryption for inner products, from standard assumptions. In: Robshaw, M., Katz, J. (eds.) CRYPTO 2016. LNCS, vol. 9816, pp. 333–362. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53015-3_12

    Chapter  Google Scholar 

  4. Akavia, A., Goldwasser, S., Vaikuntanathan, V.: Simultaneous hardcore bits and cryptography against memory attacks. In: Reingold, O. (ed.) TCC 2009. LNCS, vol. 5444, pp. 474–495. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-00457-5_28

    Chapter  MATH  Google Scholar 

  5. Alwen, J., Dodis, Y., Naor, M., Segev, G., Walfish, S., Wichs, D.: Public-key encryption in the bounded-retrieval model. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 113–134. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-13190-5_6

    Chapter  MATH  Google Scholar 

  6. Alwen, J., Dodis, Y., Wichs, D.: Leakage-resilient public-key cryptography in the bounded-retrieval model. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 36–54. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-03356-8_3

    Chapter  MATH  Google Scholar 

  7. Ananth, P., Sahai, A.: Functional encryption for turing machines. In: Kushilevitz, E., Malkin, T. (eds.) TCC 2016. LNCS, vol. 9562, pp. 125–153. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49096-9_6

    Chapter  Google Scholar 

  8. Apon, D., Döttling, N., Garg, S., Mukherjee, P.: Cryptanalysis of indistinguishability obfuscations of circuits over ggh13. In: LIPIcs-Leibniz International Proceedings in Informatics, vol. 80. Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik (2017)

    Google Scholar 

  9. Baltico, C.E.Z., Catalano, D., Fiore, D., Gay, R.: Practical functional encryption for quadratic functions with applications to predicate encryption. In: Katz, J., Shacham, H. (eds.) CRYPTO 2017. LNCS, vol. 10401, pp. 67–98. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-63688-7_3

    Chapter  Google Scholar 

  10. Benhamouda, F., Bourse, F., Lipmaa, H.: CCA-secure inner-product functional encryption from projective hash functions. In: Fehr, S. (ed.) PKC 2017. LNCS, vol. 10175, pp. 36–66. Springer, Heidelberg (2017). https://doi.org/10.1007/978-3-662-54388-7_2

    Chapter  Google Scholar 

  11. Boneh, D., Franklin, M.: Identity-based encryption from the weil pairing. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, pp. 213–229. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-44647-8_13

    Chapter  Google Scholar 

  12. Boneh, D., Sahai, A., Waters, B.: Functional encryption: definitions and challenges. In: Ishai, Y. (ed.) TCC 2011. LNCS, vol. 6597, pp. 253–273. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-19571-6_16

    Chapter  Google Scholar 

  13. Boyle, E., Segev, G., Wichs, D.: Fully leakage-resilient signatures. In: Paterson, K.G. (ed.) EUROCRYPT 2011. LNCS, vol. 6632, pp. 89–108. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-20465-4_7

    Chapter  Google Scholar 

  14. Brakerski, Z., Goldwasser, S.: Circular and leakage resilient public-key encryption under subgroup indistinguishability. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223, pp. 1–20. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-14623-7_1

    Chapter  Google Scholar 

  15. Brakerski, Z., Kalai, Y.T., Katz, J., Vaikuntanathan, V.: Overcoming the hole in the bucket: public-key cryptography resilient to continual memory leakage. In: 2010 IEEE 51st Annual Symposium on Foundations of Computer Science, pp. 501–510. IEEE (2010)

    Google Scholar 

  16. Brakerski, Z., Lombardi, A., Segev, G., Vaikuntanathan, V.: Anonymous IBE, Leakage resilience and circular security from new assumptions. In: Nielsen, J.B., Rijmen, V. (eds.) EUROCRYPT 2018. LNCS, vol. 10820, pp. 535–564. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-78381-9_20

    Chapter  Google Scholar 

  17. Cash, D., Ding, Y.Z., Dodis, Y., Lee, W., Lipton, R., Walfish, S.: Intrusion-resilient key exchange in the bounded retrieval model. In: Vadhan, S.P. (ed.) TCC 2007. LNCS, vol. 4392, pp. 479–498. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-70936-7_26

    Chapter  Google Scholar 

  18. Chen, Y., Gentry, C., Halevi, S.: Cryptanalyses of candidate branching program obfuscators. In: Coron, J.-S., Nielsen, J.B. (eds.) EUROCRYPT 2017. LNCS, vol. 10212, pp. 278–307. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-56617-7_10

    Chapter  Google Scholar 

  19. Cheon, J.H., Han, K., Lee, C., Ryu, H., Stehlé, D.: Cryptanalysis of the multilinear map over the integers. In: Oswald, E., Fischlin, M. (eds.) EUROCRYPT 2015. LNCS, vol. 9056, pp. 3–12. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46800-5_1

    Chapter  Google Scholar 

  20. Chow, S.S., Dodis, Y., Rouselakis, Y., Waters, B.: Practical leakage-resilient identity-based encryption from simple assumptions. In: Proceedings of the 17th ACM Conference on Computer anD Communications Security, pp. 152–161. ACM (2010)

    Google Scholar 

  21. Coron, J.-S., Lee, M.S., Lepoint, T., Tibouchi, M.: Cryptanalysis of GGH15 multilinear maps. In: Robshaw, M., Katz, J. (eds.) CRYPTO 2016. LNCS, vol. 9815, pp. 607–628. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53008-5_21

    Chapter  Google Scholar 

  22. Cramer, R., Shoup, V.: Universal hash proofs and a paradigm for adaptive chosen ciphertext secure public-key encryption. In: Knudsen, L.R. (ed.) EUROCRYPT 2002. LNCS, vol. 2332, pp. 45–64. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-46035-7_4

    Chapter  Google Scholar 

  23. Di Crescenzo, G., Lipton, R., Walfish, S.: Perfectly secure password protocols in the bounded retrieval model. In: Halevi, S., Rabin, T. (eds.) TCC 2006. LNCS, vol. 3876, pp. 225–244. Springer, Heidelberg (2006). https://doi.org/10.1007/11681878_12

    Chapter  Google Scholar 

  24. Dodis, Y., Goldwasser, S., Tauman Kalai, Y., Peikert, C., Vaikuntanathan, V.: Public-key encryption schemes with auxiliary inputs. In: Micciancio, D. (ed.) TCC 2010. LNCS, vol. 5978, pp. 361–381. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-11799-2_22

    Chapter  Google Scholar 

  25. Dodis, Y., Haralambiev, K., López-Alt, A., Wichs, D.: Cryptography against continuous memory attacks. In: 2010 IEEE 51st Annual Symposium on Foundations of Computer Science, pp. 511–520. IEEE (2010)

    Google Scholar 

  26. Dodis, Y., Haralambiev, K., López-Alt, A., Wichs, D.: Efficient public-key cryptography in the presence of key leakage. In: Abe, M. (ed.) ASIACRYPT 2010. LNCS, vol. 6477, pp. 613–631. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-17373-8_35

    Chapter  MATH  Google Scholar 

  27. Dodis, Y., Kalai, Y.T., Lovett, S.: On cryptography with auxiliary input. In: Proceedings of the Forty-First Annual ACM Symposium on Theory of Computing, pp. 621–630. ACM (2009)

    Google Scholar 

  28. Dziembowski, S.: Intrusion-resilience via the bounded-storage model. In: Halevi, S., Rabin, T. (eds.) TCC 2006. LNCS, vol. 3876, pp. 207–224. Springer, Heidelberg (2006). https://doi.org/10.1007/11681878_11

    Chapter  Google Scholar 

  29. Dziembowski, S., Pietrzak, K.: Intrusion-resilient secret sharing. In: 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS 2007), pp. 227–237. IEEE (2007)

    Google Scholar 

  30. Dziembowski, S., Pietrzak, K.: Leakage-resilient cryptography. In: 2008 49th Annual IEEE Symposium on Foundations of Computer Science, pp. 293–302. IEEE (2008)

    Google Scholar 

  31. Faust, S., Kiltz, E., Pietrzak, K., Rothblum, G.N.: Leakage-resilient signatures. In: Micciancio, D. (ed.) TCC 2010. LNCS, vol. 5978, pp. 343–360. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-11799-2_21

    Chapter  Google Scholar 

  32. Garg, S., Gentry, C., Halevi, S., Raykova, M., Sahai, A., Waters, B.: Candidate indistinguishability obfuscation and functional encryption for all circuits. SIAM J. Comput. 45(3), 882–929 (2016)

    Article  MathSciNet  Google Scholar 

  33. Gentry, C., Halevi, S.: Hierarchical identity based encryption with polynomially many levels. In: Reingold, O. (ed.) TCC 2009. LNCS, vol. 5444, pp. 437–456. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-00457-5_26

    Chapter  Google Scholar 

  34. Goldwasser, S., Kalai, Y., Popa, R.A., Vaikuntanathan, V., Zeldovich, N.: Reusable garbled circuits and succinct functional encryption. In: Proceedings of the Forty-Fifth Annual ACM Symposium on Theory of Computing, pp. 555–564. ACM (2013)

    Google Scholar 

  35. Gorbunov, S., Vaikuntanathan, V., Wee, H.: Functional encryption with bounded collusions via multi-party computation. In: Safavi-Naini, R., Canetti, R. (eds.) CRYPTO 2012. LNCS, vol. 7417, pp. 162–179. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-32009-5_11

    Chapter  Google Scholar 

  36. Goyal, V., Pandey, O., Sahai, A., Waters, B.: Attribute-based encryption for fine-grained access control of encrypted data. In: Proceedings of the 13th ACM Conference on Computer and Communications Security, pp. 89–98. ACM (2006)

    Google Scholar 

  37. Halderman, J.A., et al.: Lest we remember: cold-boot attacks on encryption keys. Commun. ACM 52(5), 91–98 (2009)

    Article  Google Scholar 

  38. Horwitz, J., Lynn, B.: Toward hierarchical identity-based encryption. In: Knudsen, L.R. (ed.) EUROCRYPT 2002. LNCS, vol. 2332, pp. 466–481. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-46035-7_31

    Chapter  Google Scholar 

  39. Katz, J., Vaikuntanathan, V.: Signature schemes with bounded leakage resilience. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 703–720. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-10366-7_41

    Chapter  Google Scholar 

  40. Kelsey, J., Schneier, B., Wagner, D., Hall, C.: Side channel cryptanalysis of product ciphers. In: Quisquater, J.-J., Deswarte, Y., Meadows, C., Gollmann, D. (eds.) ESORICS 1998. LNCS, vol. 1485, pp. 97–110. Springer, Heidelberg (1998). https://doi.org/10.1007/BFb0055858

    Chapter  Google Scholar 

  41. Kocher, P., Jaffe, J., Jun, B.: Differential power analysis. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 388–397. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-48405-1_25

    Chapter  Google Scholar 

  42. Kocher, P.C.: Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and other systems. In: Koblitz, N. (ed.) CRYPTO 1996. LNCS, vol. 1109, pp. 104–113. Springer, Heidelberg (1996). https://doi.org/10.1007/3-540-68697-5_9

    Chapter  Google Scholar 

  43. Lewko, A., Rouselakis, Y., Waters, B.: Achieving leakage resilience through dual system encryption. In: Ishai, Y. (ed.) TCC 2011. LNCS, vol. 6597, pp. 70–88. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-19571-6_6

    Chapter  Google Scholar 

  44. Micali, S., Reyzin, L.: Physically observable cryptography. In: Naor, M. (ed.) TCC 2004. LNCS, vol. 2951, pp. 278–296. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-24638-1_16

    Chapter  MATH  Google Scholar 

  45. Naor, M., Segev, G.: Public-key cryptosystems resilient to key leakage. SIAM J. Comput. 41(4), 772–814 (2012)

    Article  MathSciNet  Google Scholar 

  46. Nisan, N., Zuckerman, D.: Randomness is linear in space. J. Comput. Syst. Sci. 52(1), 43–52 (1996)

    Article  MathSciNet  Google Scholar 

  47. Nishimaki, R., Yamakawa, T.: Leakage-resilient identity-based encryption in bounded retrieval model with nearly optimal leakage-ratio. In: Lin, D., Sako, K. (eds.) PKC 2019. LNCS, vol. 11442, pp. 466–495. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-17253-4_16

    Chapter  Google Scholar 

  48. O’Neill, A.: Definitional issues in functional encryption. IACR Cryptology ePrint Archive 2010, 556 (2010)

    Google Scholar 

  49. Pietrzak, K.: A leakage-resilient mode of operation. In: Joux, A. (ed.) EUROCRYPT 2009. LNCS, vol. 5479, pp. 462–482. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-01001-9_27

    Chapter  Google Scholar 

  50. Sahai, A., Waters, B.: Fuzzy identity-based encryption. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 457–473. Springer, Heidelberg (2005). https://doi.org/10.1007/11426639_27

    Chapter  Google Scholar 

  51. Shi, E., Waters, B.: Delegating capabilities in predicate encryption systems. In: Aceto, L., Damgård, I., Goldberg, L.A., Halldórsson, M.M., Ingólfsdóttir, A., Walukiewicz, I. (eds.) ICALP 2008. LNCS, vol. 5126, pp. 560–578. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-70583-3_46

    Chapter  Google Scholar 

  52. Wang, H., Chen, K., Liu, J.K., Hu, Z.: Leakage-resilient chosen-ciphertext secure functional encryption from garbled circuits. In: Su, C., Kikuchi, H. (eds.) ISPEC 2018. LNCS, vol. 11125, pp. 119–140. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-99807-7_8

    Chapter  Google Scholar 

  53. Waters, B.: Efficient identity-based encryption without random oracles. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 114–127. Springer, Heidelberg (2005). https://doi.org/10.1007/11426639_7

    Chapter  Google Scholar 

  54. Waters, B.: Ciphertext-policy attribute-based encryption: an expressive, efficient, and provably secure realization. In: Catalano, D., Fazio, N., Gennaro, R., Nicolosi, A. (eds.) PKC 2011. LNCS, vol. 6571, pp. 53–70. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-19379-8_4

    Chapter  Google Scholar 

  55. Waters, B.: A punctured programming approach to adaptively secure functional encryption. In: Gennaro, R., Robshaw, M. (eds.) CRYPTO 2015. LNCS, vol. 9216, pp. 678–697. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-48000-7_33

    Chapter  Google Scholar 

  56. Yu, Z., Au, M.H., Xu, Q., Yang, R., Han, J.: Leakage-resilient functional encryption via pair encodings. In: Liu, J.K.K., Steinfeld, R. (eds.) ACISP 2016. LNCS, vol. 9722, pp. 443–460. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-40253-6_27

    Chapter  Google Scholar 

  57. Yuen, T.H., Chow, S.S.M., Zhang, Y., Yiu, S.M.: Identity-based encryption resilient to continual auxiliary leakage. In: Pointcheval, D., Johansson, T. (eds.) EUROCRYPT 2012. LNCS, vol. 7237, pp. 117–134. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-29011-4_9

    Chapter  Google Scholar 

  58. Zhang, J., Chen, J., Gong, J., Ge, A., Ma, C.: Leakage-resilient attribute based encryption in prime-order groups via predicate encodings. Des. Codes Crypt. 86(6), 1339–1366 (2018). https://doi.org/10.1007/s10623-017-0399-4

    Article  MathSciNet  MATH  Google Scholar 

  59. Zhang, L., Chen, Y., Zhang, J., He, M., Yiu, S.-M.: From quadratic functions to polynomials: generic functional encryption from standard assumptions. In: Carlet, C., Guilley, S., Nitaj, A., Souidi, E.M. (eds.) C2SI 2019. LNCS, vol. 11445, pp. 142–167. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-16458-4_10

    Chapter  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Department of Computer Science, The University of Hong Kong, Kowloon, HKSAR, China

    Linru Zhang, **angning Wang, Yuechen Chen & Siu-Ming Yiu

Authors
  1. Linru Zhang
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. **angning Wang
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Yuechen Chen
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Siu-Ming Yiu
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Siu-Ming Yiu .

Editor information

Editors and Affiliations

  1. Technical University of Denmark, Kongens Lyngby, Denmark

    Weizhi Meng

  2. Hamburg University of Technology, Hamburg, Germany

    Dieter Gollmann

  3. Technical University of Denmark, Kongens Lyngby, Denmark

    Christian D. Jensen

  4. Singapore University of Technology and Design, Singapore, Singapore

    Jianying Zhou

Appendices

A Proof of Theorem 3

Correctness and Valid/Invalid Ciphertext Indistinguishiability. For any \(\varvec{z},\varvec{y}\) with length \(n+1\) and n respectively, and for any correctly generated \(\mathrm {mpk},\mathrm {msk},\mathrm {sk}_{\varvec{y}}\) from the above algorithms, if \((C,D,\{E_i\}_{i=1}^{n+1},\varvec{z})\) is generated by \(\mathrm {Encap}(\varvec{z})\), then correctness is proved by calculating \(\log _g(E_{\varvec{y}})\):

$$\begin{aligned} E_{\varvec{y}}&=\frac{\prod _{i=1}^{n+1}E_i^{y_i^*z_i}}{C^{\mathrm {sk}_{\varvec{y}}(1)}D^{\mathrm {sk}_{\varvec{y}}(2)}}=\frac{\prod _{i=1}^{n+1}g^{x_i^*y_i^*}g^{rs_iy_i^*}h^{rt_iy_i^*}}{g^{r\langle \varvec{s},\varvec{y}^*\rangle }h^{r\langle \varvec{t}, \varvec{y}^*\rangle }}=\prod _{i=1}^{n+1}g^{x_i^*y_i^*}=\prod _{i=1}^{n}g^{x_iy_i}=g^{\langle \varvec{x},\varvec{y}\rangle }. \end{aligned}$$

For the valid/invalid ciphertext indistinguishability, we show how to use an adversary \(\mathcal {A}\), which can distinguish valid and invalid ciphertexts, to construct an adversary \(\mathcal {B}\), which can distinguish whether \(c=ab\) or c is randomly chosen from \(\mathbb {Z}_p\). \(\mathcal {B}\) receives a DDH tuple \((g,g^a,g^b,g^c)\), then it sets \(C=g^a\), \(h_i=g^b\) and \(E_i=g^{\frac{x^*_i}{z_i}}g^{\frac{c}{z_i}}\), where i is randomly chosen from [n], and sends \(\mathrm {mpk}\) and the challenge ciphertext to \(\mathcal {A}\). If \(\mathcal {A}\) outputs it is a valid ciphertext, then \(\mathcal {B}\) outputs \(c=ab\). Otherwise, \(\mathcal {B}\) outputs that c is randomly chosen from \(\mathbb {Z}_p\).

0-Universality of \(\varPi _1\). We show that the decapsulation function of \(\varPi _1\) is a 0-universal hash family. Fix any \((\mathrm {mpk},\mathrm {msk})\) produced by \(\mathrm {Setup}(1^\lambda ,1^n)\), a set of linear independent vectors \(\{\varvec{y}_i\}_{i=1}^n\) and \(\varvec{z}\), let \(\mathrm {ct}=(C,D,\{E_i\}_{i=1}^{n+1},\varvec{z})\leftarrow \mathrm {Encap}^*(\varvec{z})\). From our construction of \(\mathrm {Encap}^*\) we have \(C=g^r, D=h^r, E_i=g^{\frac{x_i^*}{z_i}}h_i^{\frac{r'}{z_i}}\), where \(r,r'\) are uniformly sampled from \(\mathbb {Z}_p\) with \(r\ne r'\). Then, for any secret key \(\mathrm {sk}_{\varvec{y}}=(\langle \varvec{s},\varvec{y}^*\rangle ,\langle \varvec{t},\varvec{y}^*\rangle ,u)\), it’s a random variable generated from \(\mathrm {KeyGen}(\mathrm {msk},\varvec{y})\) with \(\varvec{y}\in \{\varvec{y}_i\}_{i=1}^n\). Then we can obtain (Assume \(h=g^w\)):

$$\begin{aligned} \begin{aligned} \mathrm {Decap}(\mathrm {ct},\mathrm {sk}_{\varvec{y}})&= \log _g\left( \frac{\prod _{i=1}^{n+1}E_i^{y_i^*z_i}}{C^{\mathrm {sk}_{\varvec{y}}(1)}D^{\mathrm {sk}_{\varvec{y}}(2)}}\right) = \log _g\left( \frac{\prod _{i=1}^{n+1}g^{x_i^*y_i^*}g^{r's_iy_i^*}h^{r't_iy_i^*}}{g^{r\langle \varvec{s},\varvec{y}^*\rangle }h^{r\langle \varvec{t},\varvec{y}^*\rangle }}\right) \\&= \log _g \left( \frac{g^{\langle \varvec{x},\varvec{y} \rangle }g^{r'\langle \varvec{s},\varvec{y}^* \rangle }h^{r'\langle \varvec{t},\varvec{y}^* \rangle }}{g^{\langle \varvec{s},\varvec{y}^* \rangle }h^{\langle \varvec{t},\varvec{y}^*\rangle }}\right) = \log _g \left( g^{\langle \varvec{x},\varvec{y} \rangle }g^{(r'-r)\langle \varvec{s},\varvec{y}^* \rangle }h^{(r'-r)\langle \varvec{t},\varvec{y}^* \rangle }\right) \\&= \log _g \left( g^{\langle \varvec{x},\varvec{y} \rangle +(r'-r)(\langle \varvec{s},\varvec{y}^*\rangle +w\langle \varvec{t},\varvec{y}^*\rangle )}\right) = \langle \varvec{x},\varvec{y} \rangle +(r'-r)\langle \varvec{s}+w\varvec{t},\varvec{y}||u\rangle \end{aligned} \end{aligned}$$
(1)

Note that if \(\mathrm {sk}_{\varvec{y}}\) is fixed, the randomness of \(\mathrm {Decap}(\mathrm {ct}, \mathrm {sk}_{\varvec{y}})\) is only from \(\mathrm {ct}\), i.e. from \(r'-r\), which is uniformly random over \(\mathbb {Z}_p\setminus \{0\}\). Further, we can define a hash function family \(\mathcal {H}=\{\mathrm {Decap}(\mathrm {ct},\cdot )|\mathrm {ct}\leftarrow \mathrm {Encap}^*(\varvec{z})\}\). To obtain universality of \(\mathcal {H}\), we need to show that given \(\mathrm {msk},\mathrm {mpk}\) and \(\varvec{y}\), for any fixed \(\mathrm {sk}_{\varvec{y}},\mathrm {sk}'_{\varvec{y}}\) both generated from \(\mathrm {KeyGen}(\mathrm {msk},\varvec{y})\), with \(\mathrm {sk}_{\varvec{y}}\ne \mathrm {sk}'_{\varvec{y}}\), the following probability is tiny: \(\mathbf {Pr}_{\mathrm {ct}\leftarrow \mathrm {Encap}^*(\varvec{z})}[\mathrm {Decap}(\mathrm {ct},\mathrm {sk}_{\varvec{y}})=\mathrm {Decap}(\mathrm {ct},\mathrm {sk}'_{\varvec{y}})]\).

In fact we can prove that this probability is 0. Let \(u'\) be the associated u in \(\mathrm {sk}'_{\varvec{y}}\). Note that by our construction of \(\mathrm {KeyGen}\), \(\mathrm {sk}_{\varvec{y}}\ne \mathrm {sk}'_{\varvec{y}}\) implies \(u\ne u'\). By our construction of \(\mathrm {Setup}\), the \((n+1)\)-th entry of \(\varvec{s}+w\varvec{t} \ne 0\). Then, for any \(\mathrm {sk}_{\varvec{y}}\ne \mathrm {sk}'_{\varvec{y}}\), \(\langle \varvec{s}+w\varvec{t},\varvec{y}||u\rangle \ne \langle \varvec{s}+w\varvec{t},\varvec{y}||u'\rangle \). By \(r\ne r'\), we know that \(\mathbf {Pr}_{\mathrm {ct}\leftarrow \mathrm {Encap}^*(\varvec{z})}[\mathrm {Decap}(\mathrm {ct},\mathrm {sk}_{\varvec{y}})=\mathrm {Decap}(\mathrm {ct},\mathrm {sk}'_{\varvec{y}})]=0\). We conclude that \(\mathcal {H}\) is a 0-universal hash family.

B Proof of Theorem 5

Proof

The correctness of decryption follows by the correctness of decapsulation in \(\varPi _2\). We use a series of games to analyze the security:

  • Game 0: Define Game 0 to be the IND-security game with leakage l. In the challenge stage of Game 0, the challenger computes \(\mathrm {ct}_{\varvec{x}_b} \leftarrow \mathrm {Encrypt}(\mathrm {mpk},\varvec{x}_b)\) which we parse \(\mathrm {ct}_{\varvec{x}_b}=(c_1,c_2)\), where \(c_1=\mathrm {ct}_{\varvec{z}},c_2=\varvec{k}+\varvec{x}_b\).

  • Game 1: We modify the challenge stage, so that the challenger uses the secret keys \(\{\mathrm {sk}_{\varvec{y}_i},i\}_{i=1}^t, t \le n\) queried by \(\mathcal {A}\) in Query 1, together with some new keys \(\mathrm {sk}_{(\varvec{y}_{t+1},t+1)},...,\mathrm {sk}_{(\varvec{y}_{n},n)}\) generated by running \(\varPi _2.\mathrm {KeyGen}(\mathrm {msk},\varvec{y}_{t+j},t+j), j \in [n-t]\) with the same random numbers as \(\mathrm {sk}_{(\varvec{y}_i,i)}, i \in [t]\), where \(\varvec{y}_{t+1},...,\varvec{y}_n\) are randomly chosen subject to the condition that \(Y=[\varvec{y}_1,...,\varvec{y}_n]\) is an \(n \times n\) invertible matrix. It computes \((c_1,\varvec{k}_1)\leftarrow \mathrm {Encap}(\varvec{z})\), then finds \(\varvec{k}_2\) such that \(\varvec{k}_2^T=[\mathrm {Decap}(c_1,\mathrm {sk}_{(\varvec{y}_1,1)}),...,\) \(\mathrm {Decap}(c_1,\mathrm {sk}_{(\varvec{y}_n,n)})]Y^{-1}\), and computes \(c_2=\varvec{k}_2+\varvec{x}_b\). The difference between Game 0 and Game 1 is only the use of \(\varvec{k}_1\) versus \(\varvec{k}_2\). However, by the correctness of Decapsulation, we have \(\varvec{k}_1\ne \varvec{k}_2\) with negligible probability, given that \(\varvec{y}_1,...,\varvec{y}_n\) are linear independent. So Game 0 and Game 1 are statistically indistinguishable.

  • Game 2: We modify the challenge stage again, so that the challenger uses \(\mathrm {Encap}^*\) to compute the ciphertext. It computes \(c_1\leftarrow \mathrm {Encap}^*(\varvec{z})\), then finds \(\varvec{k}_2\) such that \(\varvec{k}_2^T=[\mathrm {Decap}(c_1,\mathrm {sk}_{(\varvec{y}_1,1)}),...,\) \(\mathrm {Decap}(c_1,\mathrm {sk}_{(\varvec{y}_n,n)})]Y^{-1}\), and computes \(c_2=\varvec{k}_2+\varvec{x}_b\). We claim that Game 1 and Game 2 are computationally indistinguishable by the valid/invalid ciphertext indistinguishability of IP-HPS. Although the valid/invalid ciphertext indistinguishability game does not have leakage queries, it allows the adversary to learn at most n secret keys. The total number of leakage queries the adversary have made in Query 1 is at most n, and all secret keys have been queried by the adversary were generated by the same randomness \(\mathcal {R}\). Therefore, indistinguishability between Game 1 and Game 2 holds even if the adversary sees all the full secret keys \(\mathrm {sk}_{\varvec{y}}\) that the adversary have made leakage queries in Query 1.

  • Game 3: The challenge ciphertext \(\mathrm {ct}_{\varvec{x}_b}=(c_1,c_2)\) is computed by: \(c_1\leftarrow \mathrm {Encap}^*(\varvec{z}), c_2 \leftarrow U_{\mathcal {K}}\). We claim that Game 2 and Game 3 are statistically indistinguishable by the \(l'\)-leakage-smoothness of IP-HPS. Indeed, for a fixed value of \(\mathrm {mpk},\mathrm {msk}\), and \(i \in [n]\), the only things in Game 2 correlated to \(\mathrm {sk}_{\varvec{y}_i}\) are the outputs of leakage query with size \(l\le \frac{l'}{n}\) bits. So the outputs of leakage queries of \(\{\mathrm {sk}_{\varvec{y}_i}\}_{i=1}^n\) are at most \(l'\) bits. Recall the definition of \(l'\)-leakage-smoothness, by making all leakage queries together as a single randomized function \(f(\mathcal {Y})\) with \(\mathcal {Y} = \{\mathrm {sk}_{\varvec{y}_i}\}_{i=1}^n\), \(\varvec{k}_2\) is indistinguishable from choosing a completely independent random variable from \(U_{\mathcal {K}}\).

Therefore Game 0 and Game 3 are indistinguishable by any PPT adversary. And the advantage of any adversary in Game 3 is 0, since the challenge ciphertext in Game 3 is independent of the bit b. \(\square \)

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Zhang, L., Wang, X., Chen, Y., Yiu, SM. (2020). Leakage-Resilient Inner-Product Functional Encryption in the Bounded-Retrieval Model. In: Meng, W., Gollmann, D., Jensen, C.D., Zhou, J. (eds) Information and Communications Security. ICICS 2020. Lecture Notes in Computer Science(), vol 12282. Springer, Cham. https://doi.org/10.1007/978-3-030-61078-4_32

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-61078-4_32

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-61077-7

  • Online ISBN: 978-3-030-61078-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation