Non-Transferable Proxy Re-Encryption Scheme

Transcription

1 Title Non-Tansfeable Poxy Re-Encyption Scheme Autho(s) He, Y; Chim, TW; Hui, CK; Yiu, SM Citation The 5th IFIP Intenational Confeence on New Technologies, Mobility and Secuity (NTMS 12), Istanbul, Tukey, 7-10 May In Poceedings of the Intenational Confeence on New Technologies, Mobility and Secuity, 2012, p. aticle no Issued Date 2012 URL Rights Poceedings of the Intenational Confeence on New Technologies, Mobility and Secuity. Copyight I E E E.; 2012 IEEE. Pesonal use of this mateial is pemitted. Howeve, pemission to epint/epublish this mateial fo advetising o pomotional puposes o fo ceating new collective woks fo esale o edistibution to seves o lists, o to euse any copyighted component of this wok in othe woks must be obtained fom the IEEE.; This wok is licensed unde a Ceative Commons Attibution-NonCommecial-NoDeivatives 4.0 Intenational License.

2 Non-Tansfeable Poxy Re-Encyption Scheme Yi-Jun He, Tat Wing Chim, Lucas Chi Kwong Hui, Siu-Ming Yiu Depatment of Compute Science, The Univesity of Hong Kong, Hong Kong {yjhe, twchim, hui, Abstact A poxy e-encyption (PRE) scheme allows a poxy to e-encypt a ciphetext fo Alice (delegato) to a ciphetext fo Bob (delegatee) without seeing the undelying plaintext. Howeve, existing PRE schemes geneally suffe fom at least one of the followings. Some schemes fail to povide the non-tansfeable popety in which the poxy and the delegatee can collude to futhe delegate the decyption ight to anyone. This is the main open poblem left fo PRE schemes. Othe schemes assume the existence of a fully tusted pivate key geneato (PKG) to geneate the e-encyption key to be used by the poxy fo e-encypting a given ciphetext fo a taget delegatee. But this poses two poblems in PRE schemes if the PKG is malicious: the PKG in thei schemes may decypt both oiginal ciphetexts and e-encypted ciphetexts (efeed as the key escow poblem); and the PKG can geneate eencyption key fo abitay delegatees without pemission fom the delegato (we efe to it as the PKG despotism poblem). In this pape, we popose the fist non-tansfeable poxy e-encyption scheme which successfully achieves the nontansfeable popety. We show that the new scheme solved the PKG despotism poblem and key escow poblem as well. Keywods-poxy e-encyption; PKG despotism; nontansfeable popety I. INTRODUCTION A. Poxy Re-encyption The poxy e-encyption [2] allows a thid-paty (the poxy) to e-encypt a ciphetext which has been encypted fo one paty without seeing the undelying plaintext so that it can be decypted by anothe. Fo example: Alice keeps some sensitive files in encypted fom in the file seve; Bob fetches encypted files fom file seve, and then tansmits them to poxy; Alice sends a e-encyption key to the poxy which e-encypts the encypted files and sends Bob the e-encypted ciphetext which can be decypted by Bob with his own pivate key. This scheme aoused much inteest in the encyption community [1], [2], [6], [7], [8], [9], [10], [11], [12], [13], [14] since it could be exploited in a numbe of applications fo achieving bette infomation secuity and pivacy, such as: fowading, encypted files distibution, law-enfocement monitoing, etc.. B. Review of the Tansfeable Poblem A poxy e-encyption scheme is said to be nontansfeable [1] if the poxy and a set of colluding delegatees cannot e-delegate decyption ights to othe paties. On one hand, this is a vey desiable popety. Fo example, use A saves some encypted pivate confidential files on the file seve. If A delegates B the decyption ight fo accessing those files, A may need some guaantee that his files go no futhe. It equies that the delegatee B plus the poxy cannot e-delegate decyption ight to othes. On the othe hand, eseaches [1], [7] ae even not sue that tansfeability can be peventable since the delegatee B can always decypt and fowad the plaintext to anothe paty. Howeve, this appoach equies that the delegatee emains an active, online paticipant. What we want to pevent is the delegatee (plus the poxy) poviding othe paties with a secet value that can be used offline to decypt A s ciphetexts. Again, the delegatee can always send its secet key to anothe paty. But in doing so, the delegatee puts itself in a isky situation. Theefoe, achieving a non-tansfeable PRE scheme, in the sense that the only way fo delegatee to tansfe decyption capabilities to anothe paty is to expose his own secet key, seems to be the main open poblem left fo PRE. C. Limitations of Existing Solutions Libet and Vegnaud [7] indicated that it is quite difficult to pevent the poxy and delegatees fom colluding to do e-delegation and that discouaging collusion athe than peventing illegitimate e-delegation is an easie appoach. Thus, they ty to tace the malicious poxy afte its collusion with one o moe delegatees. No doubt that it woks to dete collusion fom happening. Howeve, it is moe desiable to have a bette way to pevent collusion, not just discouage collusion. Some identity-based PRE schemes [8], [10], [11], [12], [13], [14] assume the existence of a fully tusted pivate key geneato (PKG) which helps to geneate the eencyption key to be used by the poxy fo e-encypting a given ciphetext fo a taget delegatee. Since the eencyption key is geneated using the maste key of the PKG, the poxy and the delegatee(s) cannot futhe delegate the decyption ight to othes without the help of the PKG. Howeve, this ceates two poblems in PRE schemes. Fist, thee is anothe key escow poblem, in which the PKG in thei schemes may be able to decypt both oiginal and e-encypted ciphetexts; And the PKG despotism poblem, in which the PKG itself has the powe of geneating a e-encyption key fo tansfeing decyption ight to a /12/$ IEEE

3 bitay delegatees. Thus those PKG-based PRE schemes just tansfomed the delegatee-poxy-collusion tansfeable poblem to a PKG alone tansfeable poblem. So it is fai to say that they did not solve the tansfeable poblem. Recently, Hayashi et al. [4] tied to achieve the nontansfeability by educing the non-tansfeable popety to a elaxed notion the unfogeability of e-encyption keys against collusion attack (UFReKey-CA), which meas that poxies and delegatees cannot collude to geneate a eencyption key fo some use, but as pointed out in thei pape, they have not succeeded in constucting a scheme that meets the non-tansfeability, because the malicious use can extact the plaintext even without the e-encyption key. D. Ou Contibutions The poposed scheme has the non-tansfeable popety. The e-encyption key is geneated by a key geneating cente (PKG); Delegato paticipants actively to help geneating patial decyption key fo delegatee using pat of his pivate key. Thus delegatee and poxy cannot collude to e-delegate decyption ights since they do not have knowledge of PKG s maste secet o the delegato s pivate key. Without the paticipation of the delegato, PKG is unable to geneate any useful e-encyption key fo delegating decyption ight, thus completely esolves the PKG despotism poblem. PKG cannot decypt the oiginal ciphetext and eencypted ciphetexts as well, thus solving the key escow poblem. II. OUR NON-TRANSFERABLE PRE SCHEME We constuct the Non-Tansfeable PRE scheme based on the basic IBE system poposed in [3]. The main ideas of the scheme ae as follow: Befoe delegation, delegato will send delegatee s identity to PKG. PKG is esponsible fo geneating the e-encyption key, and sending this key and some othe infomation to delegato. Delegato checks the coectness of the e-encyption key, and geneates a patial decyption key making use of the infomation eceived fom PKG. Then, delegato sends the e-encyption key to the poxy, and the patial decyption key to delegatee. The poxy e-encypts the oiginal ciphetext fom delegato, and sends the e-encypted ciphetext to delegatee. The delegatee can decypt the ciphetext using his pivate key and the patial decyption key eceived fom delegato. In the following sections, we let Alice (A) be the delegato, and Bob (B) be the delegatee. Setup: Let G and G T be goups of ode p such that p is a k-bit pime, and let e : G G G T be the bilinea map. H I :{0, 1} Z p, H:{0, 1} Z p, H :G T Z p ae secue hash functions. The PKG selects fou andom geneatos h 1, h 2, h 3, g G and andomly chooses α Z p. It sets g 1 = g α. Define the message space M G T.The public paametes mpk and maste secet key msk ae given by mpk =(g, g 1,h 1,h 2,h 3,H I,H,H, M), msk =(α). Key Geneation: This is a potocol though which a use U with an identity ID can secuely get his patial pivate key fom PKG. On input the public key/maste secet key pai (mpk, msk) and an identity ID A {0, 1} k of entity A, the PKG computes id A = H I (ID A ).Ifid A = α, it abots. Othewise, the potocol poceeds as follow: Set-Secet-Value. Entity A selects A Z p at andom. A is A s secet value. Patial-Pivate-Key-Extact. 1) A sends R = h 1 A to PKG, and gives PKG the following zeo-knowledge poof of knowledge: PK{ A : R = h 1 A } 2) PKG andomly selects A, A,2, A,3 Z p and computes h A =(Rg A ) 1/(α id A), h A,2 =(h 2 g A,2 ) 1/(α ida), h A,3 =(h 3 g A,3 ) 1/(α ida) and sends A s patial pivate key ( A, h A, A,2, h A,2, A,3, h A,3 )toa. Set-Pivate-Key. A computes A,1 = A/ A,h A,1 =(h A) 1/A =(h 1 g A,1 ) 1/(α ida) Then, A s pivate key can be denoted as usk A =( A, A,1,h A,1, A,2,h A,2, A,3,h A,3 ) Similaly, the delegatee B s pivate key is denoted as usk B =( B, B,1,h B,1, B,2,h B,2, B,3,h B,3 ) Set-Public-Key. A publishes he public key upk A = (p A,1,p A,2 ), whee p A,1 = g 1 A, and p A,2 = g AidA. Anyone can veify the validity of upk A by checking if the equality e(g ida,p A,1 )=e(g 1,p A,2 ) holds. Pivate Key Coectness Check: On input (mpk, usk ID ) and an identity ID {0, 1} k, A computes id A = H I (ID A ) and checks whethe e(h A,i,g 1 /g ida )=e(h i g A,i,g) fo i=1,2,3. If coect, output 1. Othewise, output 0. Encyption: To encypt a message m G T using public key, sende checks that whethe the equality e(g ida,p A,1 )=e(g 1,p A,2 ) holds. If not, output and abot encyption. Othewise, sende geneates a unique andomly-selected secet paamete s Z p, and computes id A = H I (ID A ). Finally, sende outputs the ciphetext C whee: C =(C 1,C 2,C 3,C 4,C 5,C 6 ) =(p s A,1 p s A,2, e(g, g) s, m e(g, h 1 ) s, e(g, g) H (m), g sβ+h (m), e(g, h 2 ) s e(g, h 3 ) sβ ).

4 We set β = H(C 1,C 2,C 3,C 4 ). Decyption(delegato): To decypt a ciphetext C = (C 1,C 2,C 3,C 4,C 5,C 6 ) using secet key usk A, delegato A computes β = H(C 1,C 2,C 3,C 4 ) and tests whethe e(c 5,g)=C β 2 C 4 and C 6 = e(c 1,h A,2 h β A,3 ) 1/A C A,2+ A,3β 2. If it is not equal, outputs. ElseA computes m = C 3 e (C 1,h A,1 ) 1/A C A,1 2.Ife(g, g) H (m) = C 4 holds, etun m; othewise etun. The following Re-Encyption pocess is done though an inteactive potocol among delegato A, delegatee B, PKG and Poxy. Re-Encyption Key Geneation: 1) In ou PRE scheme, B is only allowed to decypt messages intended fo A duing some specific time peiod i. To achieve this popety, A geneates a andom value a i Z p fo each time peiod i, whee i 1. a i will be invalid afte the peiod i. A signs B s identity ID B, and sends the signatue σ, ID B,a i to PKG via a secue channel. Delegato Sign: Choose z Z p, and compute U = g z. Compute V = H I (ID B,U). Compute W = g αa+v. The signatue on ID B is σ =(U, W ). 2) PKG veifies the signatue. PKG Veify: Compute V = H I (ID B,U). Accept the signatue iff e(h 1,W) = e(h A 1,g α )e(h 1,g) V. 3) If veification passes, PKG geneates a unique andomly-selected secet paamete y Z p, and computes e-encyption ( key k A B = y,b1 ( α idb α id A + a i y)modp, A 1 = h A 1 g A) = ( ) aiy/(α id B) h B 1 g a B,B2 = h iy 1 and sends k A B, A 1, B 1, B 2 to A. Patial-Decyption-Key Geneation: 1) Delegatee B sends h B to A via a secue and authenticated channel. 2) A checks whethe e(h 1,B 1 )=e(b 2,h B ) to ensue B 1 is a valid value which will help delegatee fo decyption. If coect, output 1, othewise, output 0. 3) A checks whethe ( ) h A id A(id B) A1 ai h A 1 g A = ( ) ka B h A 1 g A to ensue that k A B is a e-encyption key geneated popely fo delegation fom he to B. 4) A sends the e-encyption key k A B to Poxy via an authenticated channel. 5) A computes h B1/ A and B 1 1/ A, and sends them to B as patial decyption key. Table I SECURITY ANALYSIS Popety BBS [2] ID [6] Ateniese [1] Wang [11] Ous Uni-diectional No Yes Yes Yes Yes Non-inteactive No Yes Yes No No Poxy invisibility Yes No Yes # Yes Yes # Oiginal-access Yes Yes Yes No Yes Key optimal Yes No Yes Yes Yes Collusion-safe No No Yes Yes Yes Tempoay Yes! Yes! Yes! No Yes! Non-tansitive No Yes Yes Yes Yes Non-tansfeable No No No No* Yes Non-Key-escow No No Yes Non-PKG-despotism No No Yes ( ) PKG alone can tansfe ( # ) Ateniese [1] can only achieve poxy invisible to delegatee, ou scheme can only achieve poxy invisible to delegato. (!) possible to achieve with additional assumption and ovehead. Re-Encyption: Poxy computes β = H(C 1,C 2,C 3,C 4 ) and tests whethe e(c 5,g)=C β 2 C 4. If it is not equal, output. Else computes C k 1 = C A B 1 = g As(α ida)( α id B α id +a iy) A, and sends (C 1,C 1,C 2,C 3,C 4,C 5 ) to B. Decyption (delegatee): B computes β = H(C 1,C 2,C 3,C 4 ) and tests whethe e(c 5,g) = C β 2 C 4. If it is not equal, output. Else B computes e(c C 1,h (1/ A )(1/ B ) B )C B,1 2 3 (1/ e(c 1,B 1 A )(1/ B ) ) α id B As(α id A)( +a e(g α id i y) A = C,(h1g 1 B,1 ) (α id B ) A )(e(g,g) s ) B,1 3 a i y e(g A s(α id A ),(h 1g B,1 ) (α id B ) A ) = m If e(g, g) H (m) = C 4 holds, etun m; othewise etun. III. COMPARISON WITH EXISTING PROXY RE-ENCRYPTION SCHEMES The main advantage of ou scheme is: It achieved Nontansfeable popety, Non-Key-escow popety and Non- PKG-despotism popety, in which Non-Key-escow popety and Non-PKG-despotism popety ae defined by us especially fo estimating secuity of a PKG involved PRE schemes. To compae some existing poxy e-encyption schemes with ou poposed scheme as fully as possible, we also analyze below some impotant popeties defined in [1]. The compaison esults ae pesented in Table 1. Fo moe analysis details, please efe to the full vesion of ou pape [5]. Ou scheme adds moe ounds of inteaction fo the following easons: Pivate Key Coectness Check is added fo checking the patial pivate key geneated by PKG, since PKG is not fully tusted in ou assumption. In Re-encyption Key Geneation, step 1 and 2 ae added fo PKG to veify delegato and get delegatee s

5 identity, since PKG is esponsible fo geneating eencyption key. Without veification, attacke may impesonate delegato to tick PKG into geneating eencyption key. Patial-Decyption-Key Geneation is added to pevent PKG, poxy and delegatee e-delegating decyption ight fom colluding. With this step, even if PKG, poxy and delegatee s collude, they ae unable to geneate e-encyption key fo e-delegating decyption ight without the oiginal delegato s help. Note that these exta inteaction will not affect the efficiency of ou scheme, since they ae pefomed only once, at initialization time. IV. CONCLUSIONS In this pape, we attempt to solve the open poblem pointed out in NDSS 2005, in poposing a non-tansfeable poxy e-encyption scheme in which the poxy and a delegatee cannot collude to tansfe decyption ights. We also intoduced two impotant popeties, namely Non-Keyescow and Non-PKG-despotism, into the poposed PRE scheme. The pinciple behind ou solution is that instead of pohibiting a paty to popagate infomation, we punish the paty who illegitimately popagates infomation by exposing the impotant secets of the paty. This method is feasible due to the fact that nobody would un the isk of exposing its own secets to do illegal decyption ight tansfe. Thus, ou punish method is moe pacticable and effective than the tacing method in [7] and the unfogeability method in [4], because it can stongly pevent illegal decyption ight tansfe fom happening, but not just tacing the malicious poxy afte the illegal decyption ight tansfe. To the best of ou knowledge, ou pape is the fist pape which pactically solves the tansfeable poblem. ACKNOWLEDGMENT We would like to show ou deepest gatitude to Sheman S.M. Chow, fo all his kindness and help. Without his valuable comment, we could not have solved the difficult pat of this pape. The wok descibed in this pape was patially suppoted by the Geneal Reseach Fund fom the Reseach Gants Council of the Hong Kong Special Administative Region, China (Poject No. RGC GRF HKU E), the NSFC/RGC Joint Reseach Scheme (Poject No. N HKU 722/09), HKU Seed Fundings fo Applied Reseach , and HKU Seed Fundings fo Basic Reseach and [3] V. Goyal. Reducing tust in the pkg in identity based cyptosystems. In CRYPTO, pages , August [4] R. Hayashi, T. Matsushita, T. Yoshida, Y. Fujii, and K. Okada. Unfogeability of e-encyption keys against collusion attack in poxy e-encyption. In Poceedings of the 6th Intenational confeence on Advances in infomation and compute secuity, IWSEC 11, pages , Belin, Heidelbeg, Spinge-Velag. [5] Y.-J. He, T. W. Chim, L. C. K. Hui, and S. M. Yiu. Nontansfeable poxy e-encyption scheme fo data dissemination contol. [6] A. Ivan and Y. Dodis. Poxy cyptogaphy evisited. In NDSS, Febuay [7] B. Libet and D. Vegnaud. Tacing malicious poxies in poxy e-encyption. In Paiing, pages , Septembe [8] T. Matsuo. Poxy e-encyption systems fo identity-based encyption. In Paiing, pages , July [9] K. Niu, X. A. Wang, and M. Q. Zhang. How to solve key escow poblem in poxy e-encyption fom cbe to ibe. In DBTA, pages 95 98, Apil [10] X. A. Wang and X. Y. Yang. Identity based boadcast encyption based on one to many identity based poxy eencyption. In IEEE Intenational Confeence on Compute Science and Infomation Technology, pages 47 50, August [11] X. A. Wang and X. Y. Yang. Poxy e-encyption scheme based on bb2 identity based encyption. In IEEE Intenational Confeence on Compute Science and Infomation Technology, pages , August [12] X. A. Wang and X. Y. Yang. Poxy e-encyption scheme based on sk identity based encyption. In IAS, pages , August [13] X. A. Wang, X. Y. Yang, and F. G. Li. On the ole of pkg fo poxy e-encyption in identity based setting. Cyptology epint Achive, Repot 2008/410, [14] X. A. Wang, X. Y. Yang, and M. Q. Zhang. Poxy eencyption scheme fom ibe to cbe. In DBTA, pages , Apil REFERENCES [1] G. Ateniese, K. Fu, M. Geen, and S. Hohenbege. Impoved poxy e-encyption schemes with applications to secue distibuted stoage. In NDSS, pages 29 43, Febuay [2] M. Blaze, G. Bleume, and M. Stauss. Divetible potocols and atomic poxy cyptogaphy. In EUROCRYPT, pages , June 1998.