fmouhart/thesis
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Beginning of group encryption part

Browse Source
This commit is contained in:
Fabrice Mouhartem
2018-05-02 17:46:56 +02:00
parent 04d67f0622
commit 644846cbf1
2 changed files with 375 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

374
chap-GE-LWE.tex
View File

@@ -0,0 +1,374 @@
\section{Syntax and Definitions of Group Encryption} \label{GE-model}
We use the syntax and the security model of Kiayias, Tsiounis and Yung \cite{KTY07}.
The group encryption (\textsf{GE}) primitive involves a sender, a verifier, a group manager~(\textsf{GM}) that manages the group of receivers and an opening
authority~(\textsf{OA}) which is capable of identifying ciphertexts' recipients.
In the syntax of \cite{KTY07}, a $\GE$ scheme is specified by the description of a
relation $R$ as well as a tuple
$\GE=\bigl(\mathsf{SETUP},\mathsf{JOIN},\langle
\mathcal{G}_r,R,\mathsf{sample}_{R}
\rangle,\mathsf{ENC},\mathsf{DEC},\mathsf{OPEN},\langle
\mathcal{P},\mathcal{V} \rangle \bigr)$ of algorithms or protocols.
In details, $\mathsf{SETUP}$ is a set of initialization procedures that all take (implicitly or explicitly) a security parameter $1^\lambda$ as input. We call them
$\mathsf{SETUP}_{\mathsf{init}}(1^\lambda)$,
$\mathsf{SETUP}_{\mathsf{GM}}(\param)$ and
$\mathsf{SETUP}_{\mathsf{OA}}(\param)$. The first one of these procedures
generates a set of public parameters $\param$ (like the KTY construction \cite{KTY07}, we rely on a common reference string even when using interaction between
provers and verifiers). The latter two procedures are used to produce key pairs
$(\pk_{\GM},\sk_{\GM})$, $(\pk_{\OA},\sk_{\OA})$ for the $\GM$ and the
$\OA$. In the following, $\param$ is incorporated in the inputs of all algorithms although we sometimes omit to explicitly write it.
$\mathsf{JOIN}=(\mathsf{J}_{\mathsf{user}},\mathsf{J}_{\GM})$ is an interactive protocol between the $\GM$ and the prospective user.
After the execution of $\mathsf{JOIN}$, the $\GM$ stores the public key $\pk$ and its certificate $\crt_{\pk}$ in a public directory
$\mathsf{database}$.
As in \cite{KY05}, we will restrict this
protocol to have minimal interaction and consist of only two messages: the first one is the user's public key $\pk$ sent by $\mathsf{J}_{\mathsf{user}}$ to $\mathsf{J}_{\GM}$
and the latter's response is a certificate $\crt_{\pk}$ for $\pk$ that makes the user's group membership effective. We do not require the user to prove
knowledge of his private key $\sk$ or anything else about it. In our construction, valid keys will be publicly recognizable and users will not have to prove
their validity. By avoiding proofs of knowledge of private keys, the security proof never has to
rewind the adversary to extract those private keys, which allows supporting concurrent joins as
advocated by Kiayias and Yung \cite{KY05}. If applications demand it, it is possible to add
proofs of knowledge of private keys in a modular way but our security proofs do not require
rewinding the adversary in executions of $\mathsf{JOIN}$. \\
\indent
Algorithm $\mathsf{sample}_{R}$ allows sampling pairs $(x,w)\in R$ (made of a public value $x$ and a witness $w$) using keys $(\pk_{R},\sk_{R})$ produced by
$\mathcal{G}_r(1^\lambda)$ which samples public/secret parameters for the relation $R$. Depending on the relation, $\sk_{R}$ may be the empty string (as in the scheme \cite{KTY07} and ours which both involve publicly samplable relations). The testing procedure $R(x,w)$ uses $\pk_{R}$ to
return $1$ whenever $(x,w)\in R$. To encrypt a witness $w$ such that $(x,w) \in R$ for some public $x$, the sender fetches the pair $(\pk,\crt_{\pk})$
from $\mathsf{database}$ and runs the randomized encryption algorithm. The latter takes as input $w$, a label $L$, the receiver's pair $(\pk,\crt_{\pk})$ as
well as public keys $\pk_{\GM}$ and $\pk_{\OA}$. Its output is a ciphertext
$\Psi \leftarrow \mathsf{ENC}(\pk_{\GM},\pk_{\OA},\pk,\crt_{\pk},w,L)$.
On input of the same elements, the certificate $\crt_{\pk}$, the ciphertext $\Psi$ and the random coins $coins_{\Psi}$ that were used to produce $\Psi$, the
non-interactive algorithm $\mathsf{PP}$ generates a proof $\pi_{\Psi}$ that there exists a certified receiver whose public key was registered in $\mathsf{database}$ and
who is able to decrypt $\Psi$ and obtain a witness $w$ such that $(x,w) \in R$. The verification algorithm $\mathcal{V}$ takes as input $\Psi$, $\pk_{\GM}$,
$\pk_{\OA}$, $\pi_{\Psi}$ and the description of $R$ and outputs $0$ or $1$. Given $\Psi$, $L$ and the receiver's private key $\sk$, the output of
$\mathsf{DEC}$ is either a witness $w$ such that $(x,w) \in R$ or a rejection symbol $\bot$. Finally,
$\mathsf{OPEN}$ takes as input a ciphertext/label pair $(\Psi,L)$ and the OA's secret key $\sk_{\OA}$ and returns a receiver's public key $\pk$.\\
\indent
The model of \cite{KTY07} considers four properties termed correctness, message security, anonymity and soundness.
In the security definitions, stateful oracles capture the adversary's
interaction with the system. In the soundness game, the KTY model requires
that pk belongs to the language of valid public keys. Here, we are implicitly assuming that the space
of valid public keys is dense (all matrices are valid keys, as is the case in our scheme).
In the upcoming definitions, we sometimes use the notation
\[ \langle \mathsf{output}_A |\mathsf{output}_B \rangle \allowbreak \leftarrow \langle A(\mathsf{input}_A),B(\mathsf{input}_B) \rangle (\mathsf{common\textrm{-}input}) \]
to denote the execution of a protocol between $A$ and $B$ obtaining their own outputs from their respective inputs.
\medskip
\paragraph{Correctness.}
The correctness property
requires that the following experiment returns $1$ with overwhelming
probability.
\begin{center}
\procedure{Experiment $\Expt^{\mathrm{correctness}}(\lambda)$}{
\mathsf{param} \leftarrow
\mathsf{SETUP}_{\mathsf{init}}(1^\lambda); (\pk_{R},\sk_{R})
\gets \mathcal{G}_r (\lambda); (x,w) \leftarrow \mathsf{sample}_{R}
(\pk_{R},\sk_{R}); \\
(\pk_{\GM},\sk_{\GM}) \leftarrow \mathsf{SETUP}_{\GM}(\mathsf{param}); (\pk_{\OA},\sk_{\OA}) \leftarrow \mathsf{SETUP}_{\OA}(\mathsf{param}); \\
\langle \pk,\sk,\crt_{\pk} | \pk,\crt_{\pk} \rangle \leftarrow \langle \mathsf{J}_{\mathsf{user}},\mathsf{J}_{\GM}(\sk_{\GM}) \rangle (\pk_{\GM}); \\
\Psi \leftarrow
\mathsf{ENC}(\pk_{\GM},\pk_{\OA},\pk,\crt_{\pk},w,L);\\
\pi_{\Psi} \leftarrow \mathcal{P}(\pk_{\GM},\pk_{\OA},\pk,\crt,w,L,\Psi,coins_{\Psi}); \\
\pcif \bigl( (w \neq \mathsf{DEC}(\sk,\Psi,L)) \vee ( \pk \neq
\mathsf{OPEN}(\sk_{\OA},\Psi,L )) \\ \quad \qquad \vee (\mathcal{V}(\Psi,L,\pi_{\Psi},\pk_{\GM},\pk_{\OA})=0)
\bigr) \pcthen\\
\pcind \pcreturn 0\\
\pcelse\\
\pcind \pcreturn 1;
}
\end{center}
\paragraph{Message Secrecy.}
The message secrecy property is defined by an experiment where the adversary has access to oracles
that may be stateful (and maintain a state across queries) or
stateless:
%These oracles are the following:
\begin{itemize}
\item[-] $\mathsf{DEC}(\sk)$: is a stateless oracle for the user decryption function
$\mathsf{DEC}$. When this oracle is restricted not to decrypt a
ciphertext-label pair $(\Psi,L)$, we denote it by
$\mathsf{DEC}^{\neg \langle \Psi, L \rangle}$.
\item[-] $\mathsf{CH}_{\mathsf{ror}}^b(\lambda,\pk,w,L)$: is a
real-or-random challenge oracle which is called \textit{once}. It
returns $(\Psi,coins_{\Psi})$ such that $\Psi \leftarrow
\mathsf{ENC}(\pk_{\GM},\pk_{\OA},\pk,\crt_{\pk},w,L)$ if $b=1$
whereas, if $b=0$, $\Psi \leftarrow
\mathsf{ENC}(\pk_{\GM},\pk_{\OA},\pk,\crt_{\pk},w',L)$ encrypts a
random plaintext of
length $O(\lambda)$ uniformly sampled in the plaintext space. In both cases, $coins_{\Psi}$ denote the random
coins used to generate $\Psi$.
\item[-]
$\mathsf{PROVE}_{\mathsf{PP},\mathsf{PP}'}^b(\pk_{\GM},\pk_{\OA},\pk,\crt_{\pk},\pk_{R},x,w,\Psi,L,coins_{\Psi})$:
is a stateful oracle that can be invoked a polynomial number times. If $b=1$, it replies by running the real prover $\mathsf{PP}$ on the inputs to
create an actual proof $\pi_{\Psi}$. If $b=0$, the oracle runs a
simulator $\mathsf{PP}'$ that uses the same inputs as $\mathsf{PP}$ except witness
$w,coins_{\Psi}$ and generates a simulated proof.
\end{itemize}
These oracles are used in an experiment where the adversary controls
the $\GM$, the $\OA$ and all members except the honest receiver. The
adversary $\adv$ embodies the dishonest $\GM$ that certifies the honest
receiver in an execution of $\mathsf{JOIN}$. It is granted access to an oracle $\mathsf{DEC}$ which decrypts on behalf of that receiver. In the
challenge phase, it transmits a state information $\mathsf{aux}$ to itself and invokes the challenge oracle for a label and a
pair $(x,w) \in R$ of its choice. After the challenge phase, it
can also query the $\mathsf{PROVE}$ oracle many times
and finally attempts to guess the challenger's bit $b$.\\
\indent As pointed out in \cite{KTY07,CLY09}, designing an efficient
simulator $\mathsf{PP}'$ (for executing $\mathsf{PROVE}_{\mathsf{PP},\mathsf{PP}'}^b(.)$
when $b=0$) is part of the security proof.
\begin{definition} \label{security-def}
A $\GE$ scheme satisfies \textit{message security}
if, for any PPT adversary $\adv$, the experiment below returns $1$
with probability at most $1/2 + \mathsf{negl}(\lambda)$.
\begin{center}
\procedure{Experiment $\Expt_{\adv}^{\mathrm{sec}}(\lambda)$}{
\param \leftarrow \mathsf{SETUP}_{\mathsf{init}}(1^\lambda); (\mathsf{aux},\pk_{\GM},\pk_{\OA}) \leftarrow \adv(\param); \\
\langle \pk,\sk,\crt_{\pk} | \mathsf{aux} \rangle
\leftarrow \langle \mathsf{J}_{\mathsf{user}},\adv(\mathsf{aux}) \rangle
(\pk_{\GM}); \\
(\mathsf{aux},x,w,L,\pk_{R}) \leftarrow
\adv^{\mathsf{DEC}(\sk,.)}(\mathsf{aux});\\
\pcif (x,w) \not\in R \pcthen\\
\pcind\pcreturn 0;\\
b\sample \{0,1\}; ( \Psi,coins_{\Psi} ) \leftarrow \mathsf{CH}_{\mathsf{ror}}^b(\lambda,\pk,w,L) ; \\
b' \leftarrow
\adv^{\mathsf{PROVE}_{\mathsf{PP},\mathsf{PP}'}^b(\pk_{\GM},\pk_{\OA},\pk,\crt_{\pk},\pk_{R},x,w,\Psi,L,coins_{\Psi}),\mathsf{DEC}^{\neg
\langle \Psi, L \rangle}(\sk,.)}(\mathsf{aux},\Psi) ; \\
\pcif b=b' \pcthen\\ \pcind\pcreturn 1 \\\pcelse\\ \pcind \pcreturn 0;
}
\end{center}
\end{definition}
\paragraph{Anonymity.}
In the experiment modeling the anonymity property, the adversary
controls the entire system except the opening authority and two well-behaved users.
The challenger thus introduces two honest users' public keys $\pk_0,\pk_1$ in $\mathsf{database}$ and thus obtains certificate for both $\pk_0,\pk_1$ from the adversarially-controlled $\GM$.
For a pair $(x,w) \in R$ of its choice, the adversary obtains an encryption of $w$ under $\pk_b$ for some $b\in \bit$ chosen by the challenger.
The adversary is provided with decryption oracles w.r.t. both keys $\pk_0,\pk_1$. In addition, it has the following oracles at disposal:
\begin{itemize}
\item[-] $\mathsf{CH}_{\mathsf{anon}}^b(\pk_{\GM},\pk_{\OA},\pk_0,\pk_1,w,L)$: is a
challenge oracle that is only queried once by the adversary. It
returns a pair $(\Psi,coins_{\Psi})$ consisting of a ciphertext
$\Psi \leftarrow
\mathsf{ENC}(\pk_{\GM},\pk_{\OA},\pk_b,\crt_{\pk_b},w,L)$ and the
coin tosses $coins_{\Psi}$ that were used to generate $\Psi$.
\item[-]
$\mathsf{USER}(\pk_{\GM})$: is a stateful oracle that obtains certificates from the adversary by simulating two
executions of $\mathsf{J}_{\mathsf{user}}$ to introduce two honest users
in the group. It uses a string $\mathsf{keys}$ where the outputs $(\pk_0,\sk_0,\crt_{\pk_0})$, $(\pk_1,\sk_1,\crt_{\pk_1})$ of honest users
are written as long as the adversarially-supplied certificates $\{\crt_{\pk_d}\}_{d=0}^1$ are valid w.r.t. $\pk_{\GM}$ (i.e., invalid certificates are ignored
by the oracle and no entry is introduced in $\mathsf{keys}$ for them).
\item[-]
$\mathsf{OPEN}(\sk_{\OA},.)$: is a stateless oracle that simulates
the opening algorithm and, on input of a $\GE$
ciphertext, returns the receiver's public key.
\end{itemize}
The reason why
the $\mathsf{USER}$ oracle is needed is that both honest users' public keys $\pk_0, \pk_1$ must have been properly
certified by the adversarially-controlled $\mathsf{GM}$ before the challenge phase because the adversary subsequently obtains
proofs generated using $(\pk_b,\crt_{\pk_b})$.
\begin{definition} \label{anonymity-def}
A $\GE$ scheme satisfies \textit{anonymity} if, for any PPT adversary $\adv$, the experiment below returns $1$
with a probability not exceeding $1/2 + \mathsf{negl}(\lambda)$.
\begin{center}
\procedure{Experiment $\Expt_{\adv}^{\mathrm{anon}}(\lambda)$}{
\param \leftarrow
\mathsf{SETUP}_{\mathsf{init}}(1^\lambda); (\pk_{\OA},\sk_{\OA})
\leftarrow \mathsf{SETUP}_{\mathsf{OA}}( \param); \\
(\mathsf{aux},\pk_{\GM}) \leftarrow \adv(\param,\pk_{\OA});
\mathsf{aux} \leftarrow
\adv^{\mathsf{USER}(\pk_{\GM}),\mathsf{OPEN}(\sk_{\OA},.)}
(\mathsf{aux}) ; \\
\pcif \mathsf{keys} \neq (\pk_0,\sk_0,\crt_{\pk_0},\pk_1,\sk_1,\crt_{\pk_1})(\mathsf{aux}) \pcthen\\
\pcreturn 0;\\
(\mathsf{aux},x,w,L,\pk_{R}) \leftarrow
\adv^{\mathsf{OPEN}(\sk_{\OA},.),
\mathsf{DEC}(\sk_0,.),\mathsf{DEC}(\sk_1,.)}(\mathsf{aux}); \\
\pcif (x,w) \not\in R \pcthen\\
\pcind \pcreturn 0; \\
b\sample \{0,1\}; ( \Psi,coins_{\Psi} ) \leftarrow \mathsf{CH}_{\mathsf{anon}}^b(\pk_{\GM},\pk_{\OA},\pk_0,\pk_1,w,L) ; \\
b' \leftarrow
\adv^{\mathcal{P}(\pk_{\GM},\pk_{\OA},\pk_b,\crt_{\pk_b},x,w,\Psi,L,coins_{\Psi},}
\\ ^{\mathsf{OPEN}^{\neg \langle \Psi,L \rangle
}(\sk_{\OA},.),\mathsf{DEC}^{\neg \langle \Psi, L
\rangle}(\sk_0,.),\mathsf{DEC}^{\neg
\langle \Psi, L \rangle}(\sk_1,.))}(\mathsf{aux},\Psi) ; \\
\pcif b=b' \pcthen\\
\pcind \pcreturn 1\\
\pcelse\\
\pcind \pcreturn 0;
}
\end{center}
\end{definition}
\paragraph{Soundness.}
Here, the adversary creates the group of receivers by interacting with the honest GM.
Its goal is to produce a ciphertext $\Psi$ and a convincing proof
that $\Psi$ is valid w.r.t. a relation $R$ of its choice but
either: (1) The opening of $\Psi$ reveals a receiver's public key $\pk$ that
does not belong to any group member; (2) The output $\pk$ of
$\mathsf{OPEN}$ is not a valid public key (\textit{i.e.}, $\pk \not\in
\mathcal{PK}$, where $\mathcal{PK}$ is the language of valid public keys); (3) The ciphertext $C$ is not in the space
$\mathcal{C}^{x,L,\pk_{R},\pk_{\GM},\pk_{\OA},\pk}$ of valid
ciphertexts. This notion is formalized by a game where the adversary
is given access to a user registration oracle
$\mathsf{REG}(\sk_{\GM},.)$ that simulates $\mathsf{J}_{\GM}$. This oracle
maintains a list $\mathsf{database}$ where registered public keys and
their certificates are stored.
\begin{definition} \label{soundness-def}
A $\GE$ scheme is \textit{sound} if, for any PPT adversary $\adv$, the experiment below returns $1$
with negligible probability.
\begin{center}
\procedure{Experiment $\Expt_{\adv}^{\mathrm{soundness}}(\lambda)$}{
\param \leftarrow
\mathsf{SETUP}_{\mathsf{init}}(1^\lambda); (\pk_{\OA},\sk_{\OA})
\leftarrow \mathsf{SETUP}_{\OA}( \param); \\
(\pk_{\GM},\sk_{\GM}) \leftarrow \mathsf{SETUP}_{\GM}( \param); \\
(\pk_{R},x,\Psi,\pi_{\Psi},L,\mathsf{aux}) \leftarrow
\adv^{\mathsf{REG}(\sk_{\GM},.)}(\param,\pk_{\GM},\pk_{\OA},\sk_{\OA});
\\
\pcif \mathcal{V}( \Psi,L,\pi_{\Psi},\pk_{\GM},\pk_{\OA})=0 \pcthen\\
\pcind \pcreturn 0; \\
\pk \leftarrow \mathsf{OPEN}(\sk_{\OA},\Psi,L); \\
\pcif \big( (\pk \not\in \mathsf{database} ) \vee (\pk \not \in \mathcal{PK})
\vee (\Psi \not \in
\mathcal{C}^{x,L,\pk_{R},\pk_{\GM},\pk_{\OA},\pk}) \big)\pcthen\\
\pcind \pcreturn 1\\
\pcelse \\
\pcind \pcreturn 0;
}
\end{center}
\end{definition}
The model of Kiayias \textit{et al.} \cite{KTY07} requires
that $\pk$ belongs to the language of valid public keys, so that the adversary is considered to defeat the soundness property when
$(\Psi,L)$ opens to a key outside the language (i.e.,
$\pk \not \in \mathcal{PK}$). In our scheme, we will assume that the space
of valid public keys is dense in that all matrices of a given dimension are valid public keys, which have an underlying private key.
We nevertheless use the same definition as \cite{KTY07} in order to emphasize that we are not relaxing the model in any way.
\section{Building Blocks}
\subsection{The Agrawal-Boneh-Boyen IBE Scheme} \label{ap:ABB-IBE}
\subsubsection{Identity-Based Encryption.} \label{ap:IBE}
An IBE scheme is a tuple of efficient algorithms $(\mathsf{Setup}, \mathsf{Extract}_\mathsf{PP}, \mathsf{Encrypt}_\mathsf{PP},$ $\mathsf{Decrypt}_\mathsf{PP})$ such that
\begin{description}
\item[\textsf{Setup}$(1^\lambda)$:] On security parameter $\lambda$, this algorithm outputs public parameters $\mathsf{PP}$ and a master secret key $\textsf{msk}$.
\item[\textsf{Extract}$_\mathsf{PP}(\textsf{msk}, \ID)$:] Takes as input a master secret key $\textsf{msk}$ and an identity $\ID$ and outputs a secret key $\sk_\ID$.
\item[\textsf{Encrypt}$_\mathsf{PP}(\ID, M)$:] Given an identity $\ID$ and a message $M$, it outputs a ciphertext $C$.
\item[\textsf{Decrypt}$_\mathsf{PP}(\sk_\ID, C)$:] Given a secret key $\sk_\ID$ and a ciphertext $C$, outputs either a decryption error symbol $\bot$, or a message $M$.
\end{description}
\noindent Correctness requires that, for any pair $(\mathsf{PP}, \textsf{msk}) \gets \Setup(1^\lambda)$, any $\ID$ and any message $M$, we have
$\mathsf{Decrypt}_\mathsf{PP}\bigl(\textsf{Extract}_\mathsf{PP}(\textsf{msk}, \ID), \mathsf{Encrypt}_\mathsf{PP}(\ID, M)\bigr) = M.$
Our proofs rely on the semantic security of the scheme against selective adversaries (\textsf{IND-sID-CPA})
but also on the stronger property of ciphertext pseudo-randomness. %in Lemma~\ref{ABB-deux}.
Informally, this notions demands that the adversary be unable to distinguish an
encryption of a message of its choice from a random element of the ciphertext space $\mathcal{C}$. Notice that this property implies \textsf{IND-sID-CPA} security.
\begin{definition}
\label{de:pseudorand-cipher}
An IBE scheme has pseudo-random-ciphertexts if no PPT adversary $\adv$ with access to private key extraction oracle \textsf{Extract$_\mathsf{PP}(\textsf{msk}, \cdot)$} has non-negligible advantage
$ \advantage{\mathrm{ROR}}{\adv}{\lambda} = | \Pr\bigl[ \mathbf{Expt}_{\adv}^\mathrm{ROR} = 1 \bigr] - \frac 1 2 | $ in the game described in Figure~\ref{fig:expt-ror}
\begin{figure}
\centering
\procedure{Experiment $\Expt^{\mathrm{ROR}}_{\adv}(\lambda)$}{
\ID^\star \gets \adv(\textsf{id}, \lambda); (\mathsf{PP}, \textsf{msk}) \gets \mathsf{Setup}(1^\lambda);~\\
M \gets \adv^{\mathsf{Extract}_\mathsf{PP}(\textsf{msk}, \cdot)}_\textsf{Ch}(\mathsf{PP});\\
b \sample U(\bit);\\
\pcif b = 1 \pcthen\\
\pcind C^\star \gets \mathsf{Encrypt}_\mathsf{PP}(M, \ID^\star) \\
\pcelse\\
\pcind C^\star \gets U(\mathcal{C});\\
b' \gets \adv^{\mathsf{Extract}_\mathsf{PP}(\textsf{msk}, \cdot)}(\textsf{guess},C^\star);\\
\pcif b = b' \pcthen\\
\pcind \pcreturn 1\\
\pcelse \\
\pcind \pcreturn 0
}
\caption{Security experiment for the pseudo-random-ciphertext property for an IBE}
\label{fig:expt-ror}
\end{figure}
\end{definition}
\subsubsection{The ABB System.} \label{ap:ABB-desc}
Agrawal, Boneh and Boyen described~\cite{ABB10} a compact IBE scheme in the standard model which allows encrypting multi-bit messages.
%In
%the description hereunder, algorithms \textsf{Extract}, \textsf{Encrypt} and \textsf{Decrypt} have implicit access to the public param
%eters $\mathsf{PP}$ defined in the \textsf{Setup} algorithm.
\begin{description}
\item[\textsf{Setup}$(1^\lambda)$:] Given a security parameter $\lambda$, choose parameters
$q, n, \sigma, \alpha$ and define $k =\lfloor \log q \rfloor$, $\bar{m}= nk$, $m = 2 \bar{m}$ and choose a noise distribution $\chi$ for $\LWE$.
\begin{enumerate}
\item Compute $(\bar{\mathbf A}, \mathbf{T}_{\bar{\mathbf{A}}}) \gets \TrapGen(1^n, 1^m, q)$.
\item Define $\mathbf{G} = \mathbf{I}_n \otimes [1|2|\ldots |2^{k-1}] \in \ZZ_q^{n \times \bar{m}}$. Sample matrices $\mathbf B \sample U(\ZZ_q^{ n \times \bar{m}}) $,
$ \mathbf U \sample U(\Zq^{n \times m})$.
\item Let $\mathsf{FRD}: \Zq^n \to \Zq^{n \times n}$ be the full-rank difference mapping from~\cite{ABB10}.
\end{enumerate} Output
$
\mathsf{PP}= \bigl(\bar{\mathbf A}, \mathbf B, \mathbf U \bigr)$ and $\textsf{msk} = \mathbf{T}_{\bar{\mathbf A}}$.
\item[\textsf{Extract}$_\mathsf{PP}(\textsf{msk}, \ID)$:] Given $\textsf{msk} = \mathbf{T}_{\bar{\mathbf A}}$ and an identity $\ID \in \Zq^n$, do as follows: \smallskip
\begin{enumerate}
\item Define the matrix $\mathbf B_\ID = \mathbf B + \mathsf{FRD}(\ID) \cdot \mathbf G \in \Zq^{n \times \bar{m}}$.
%\item Use $\mathbf T_A$ to compute a delegated basis $\mathbf T_\ID$ for the dual lattice of the matrix $\mathbf B_{\mathbf A, \ID} = \left[ \mathbf A \mid \mathbf B_\ID \right]$.
\item Let $\mathbf B_{\mathbf A, \ID} = \left[ \mathbf A \mid \mathbf B_\ID \right] \in \ZZ_q^{n \times (m + \bar{m})}$, use $\mathbf T_A$ to compute a delegated basis $\mathbf T_\ID$ for the lattice $\Lambda^\perp(\mathbf B_{\mathbf A, \ID})$.
\item Use $\mathbf T_\ID$ to sample a small-norm matrix $\mathbf E_\ID \in \ZZ^{(m+ \bar{m}) \times m}$ satisfying the equality $\mathbf B_{\mathbf A, \ID} \cdot \mathbf E_\ID = \mathbf U \bmod q$.
\item Output $\sk_\ID = \mathbf E_\ID \in \ZZ^{(m+ \bar{m}) \times m}$. \smallskip \smallskip
\end{enumerate}
\item[\textsf{Encrypt}$_\mathsf{PP}(\ID,\mathbf m)$:] Given an identity $\ID$ and a message $\mathbf m \in \bit^m$, \smallskip
\begin{enumerate}
\item Compute the matrix $\mathbf B_\ID = \mathbf B + \mathsf{FRD}(\ID) \cdot \mathbf G \in \Zq^{n \times \bar{m}}$.
Sample vectors $\mathbf s \sample U(\Zq^n), \mathbf x, \mathbf y \sample \chi^m$, $\mathbf R \sample D_{\ZZ,\sigma}^{m \times \bar{m}}$ and compute
$\mathbf z = \mathbf R^\top \cdot \mathbf y \in \ZZ^m$.
\item Compute
\begin{equation} \label{eq:ABB-c}
\begin{cases}
\mathbf c^{(1)} = \bar{\mathbf A}^\top \cdot \mathbf s + \mathbf y \bmod q,\\
\mathbf c^{(2)} = \mathbf B_\ID^\top \cdot \mathbf s + \mathbf z \bmod q,\\
\mathbf c^{(3)} = \mathbf U^\top \cdot \mathbf s + \mathbf x + \mathbf m \cdot \left\lfloor \dfrac{q}{2} \right\rfloor.
\end{cases}
\end{equation}
\item Output $\mathbf c = \bigl(\mathbf c^{(1)},\mathbf c^{(2)},\mathbf c^{(3)}\bigr) \in \ZZ_q^m \times \ZZ_q^{\bar{m}} \times \ZZ_q^m$. \smallskip \smallskip
\end{enumerate}
\item[\textsf{Decrypt}$_\mathsf{PP}(\sk_\ID, \mathbf c)$:] Given $\sk_\ID = \mathbf E_\ID$ and $\mathbf c=\bigl(\mathbf c^{(1)},\mathbf c^{(2)},\mathbf c^{(3)}\bigr) \in \ZZ_q^m \times \ZZ_q^{\bar{m}} \times \ZZ_q^m$, compute and output
% \begin{equation} \label{eq:ABB-dec}
$ \mathbf m' = \left\lfloor \left( \mathbf c^{(3)} - \mathbf E_\ID \cdot \begin{bmatrix} \mathbf c^{(1)} \\ \mathbf c^{(2)} \end{bmatrix} \right) \cdot \left\lfloor \dfrac{q}{2} \right\rfloor^{-1} \right\rceil \in \bit^m .$
% \end{equation}
\end{description}
\smallskip
\begin{theorem}[{\cite[Th. 23]{ABB10}}] \label{ABB-pseudorand-prop}
The ABB IBE scheme has pseudo-random ciphertexts if the $\LWE_{n,q,\chi}$ assumption holds.
\end{theorem}
%**************************************************

1
macros.tex
View File

@@ -19,6 +19,7 @@
\newcommand{\QANIZK}{\textsf{QA-NIZK}\xspace}
\newcommand{\PKE}{\textsf{PKE}\xspace}
\newcommand{\OT}{\textsf{OT}\xspace}
\newcommand{\GE}{\textsf{GE}\xspace}
%% Common
\newcommand{\Setup}{\ensuremath{\mathsf{Setup}}\xspace}
\newcommand{\Keygen}{\ensuremath{\mathsf{Keygen}}\xspace}