Transcript 下載/瀏覽

HIBE with Short Public Parameters
Secure in the Full Model
Without Random Oracle
Sanjit Chatterjee and Palash Sarkar
Asiacrypt 2006
投影片製作：張淑慧
1
Outline
• Contributions & Introduction
• HIBE scheme in this paper
• Comparison
• Conclusion
2
Contributions
• Propose a HIBE proved to be secure in the full
model.
• Reduce the number of public parameters.
3
Notation: Hierarchical structure
Public key
(key generation center)
KGC
Level 0
(v1)
(v1,v2)
(v1,v2,…,vh)
Level 1
U’1
Level 2
U’2
Level h
U’h
l blocks
Public key
U1, U2,…, Ul
4
Symbols
 G1 , G2 : cyclic groups of prime order p
 P : generator of G1
 Bilinear map
e : G1  G1  G2
5
Hard Problem
BDH Problem :
Given  P, aP, bP, cP , compute e( P, P) abc
DBDH Problem :
Given  P, aP, bP, cP, Z , decide whether Z  e( P, P) abc
6
HIBE Construction in this paper
Setup(n) :
params  ( P, P, P2 ,U1,U 2 ,,U h ,U1 ,U 2 ,,U l )
 ( P, P1 , P2 ,U1,U 2 ,,U h ,U1 ,U 2 ,,U l )
master-key  P2
7
HIBE Construction in this paper
Notation:
The identity v  ( v1 , v 2 ,  , v j ) in level j
n - bits v k  ( v k ,1 , v k , 2 , , v k ,l ), 1  k  h
v  ( v1 , v 2 , , v k ,  , v j )

n bits
v k ,1 v k , 2

cut
 v k ,l
l smaller blocks
n / l bits
Let v  (v1,v2 , ,vl )
Define Vk (v)  U k  v1U1  v2U 2    vlU l , 1  k  h
 Vk ( v k )  U k  v k ,1U1  v k , 2U 2    v k ,lU l
8
HIBE Construction in this paper
KeyGen : The identity v  ( v1 , v 2 ,, v j ), j  h
r1 , r2 ,, r R Z *p
SK v  (P2  r1V1 ( v1 )  r2V2 ( v 2 )    rjV j ( v j ), r1 P, r2 P,, rj P)
 (d 0 , d1 ,, d j )
ID  ( v1 , v 2 ,, v j )
SK ID  (d 0 , d1 ,, d j )
Encryption
t R Z

*
p
C  M  e( P1 , P2 )t , tP, tV1 ( v1 ), tV2 ( v 2 ), , tV j ( v j )
 (C0 , B1 , B2 ,, B j )
Decryption

C
M  C0 
e( B1 , d1 )e( B2 , d 2 )  e( B j , d j )
e ( d 0 , C0 )
9
Remark :
C0 
e( B1 , d1 )  e( B2 , d 2 )  e( B j , d j )
e(d 0 , C1 )
 M  e( P1 , P2 ) t 
 M  e( P1 , P2 ) 
t
 M  e( P1 , P2 ) t 
e(tV1 ( v1 ), r1 P )  e(tV2 ( v 2 ), r2 P)    e(tV j ( v j ), rj P )
e(P2  r1V1 ( v1 )    rjV j ( v j ), tP)
e(r1V1 ( v1 ), tP)  e(r2V2 ( v 2 ), tP)   e(rjV j ( v j ), tP)
e(P2  r1V1 ( v1 )    rjV j ( v j ), tP)
e(r1V1 ( v1 )    rjV j ( v j ), tP)
e(P2  r1V1 ( v1 )    rjV j ( v j ), tP)
 M  e( P1 , P2 ) t 
1
e(P2 , tP)
 M  e( P1 , P2 ) t 
1
e( P2 , P) t
 M  e( P1 , P2 ) t 
1
e( P2 , P1 ) t
M
10
Theorem.
The HIBE protocol as above is CPA secure
if the DBDH assumption holds.
11
Comparison of HIBE Protocols
Protocol
Waters
Hardness
Random
Pub. Para. Size
Pvt. Para. Size
Ciphertext size
Pairing
Assumption
Oracle
(elts. of G1 )
(elts. of G1 )
(elts. of G1 )
DBHD
No
(n+1)h+3
j +1
j +1
None
j +1
BDHD
No
h+l+3
j +1
j +1
None
j +1
Enc.
Dec.
[20]
This
paper
12
Conclusion
Future research:
Propose HIBE scheme in the full model.
.END.
13
Water’s Encryption Scheme (2005)
Setup(n) : Identity is a n - bit string
params  ( g , g  , g 2 , u, u1 , u2 ,, un )
 ( g , g1 , g 2 , u, u1 , u2 ,, un )
master-key  g 2

14
Water’s Encryption Scheme (2005)
KeyGen : The identity v  (v1v2 , vn ) 2
Set V  {i | vi  1, i  1,2,  , n}
r R Z *p
r
  


r

SK v  g 2   u    ui  , g  (d1 , d 2 )


 iV 


ID  v  (v1v2 , vn ) 2
SK v  (d1 , d 2 )
Encryption
t R Z
Decryption
*
p
t




t
t

C  M  e( g1 , g 2 ) , g ,  u  ui  

 iV  

 (C1 , C2 , C3 )
C
e ( d 2 , C3 )
M  C1 
e(d1 , C2 )
15