Abstract This paper presents the first attribute-based signature () scheme supporting signing policies representable by Turing machines (), based on well-studied computational assumptions. Our work supports arbitrarys as signing policies in the sense that the s can accept signing attribute strings of unbounded polynomial length and there is no limit on their running time, description size, or space complexity. Moreover, we are able to achieve input-specific running time for the signing algorithm. All other known expressive schemes could at most support signing policies realizable by either arbitrary polynomial-size circuits or s having a pre-determined upper bound on the running time. Consequently, those schemes can only deal with signing attribute strings whose lengths are a priori bounded, as well as suffers from the worst-case running time problem. On a more positive note, for the first time in the literature, the signature size of our scheme only depends on the size of the signed message and is completely independent of the size of the signing policy under which the signature is generated. This is a significant achievement from the point of view of communication efficiency. Our construction makes use of indistinguishability obfuscation () for polynomial-size circuits and certain -compatible cryptographic tools. Note that, all of these building blocks including for polynomial-size circuits are currently known to be realizable under well-studied computational assumptions.

Group key exchangeis a promising cryptographic protocol that has been studied extensively over the years. However, an overwhelming majority of them involve interaction among users. This makes them unsuitable in a cloud-based outsourced storage systems where users seek to store and share their files with their collaborators who stay offline until they want to access the file. To address this concern, Boyd et al. designed anoffline assisted group key exchange($\textsf {OAGKE}$) protocol that offers forward secrecy. The core component of their$\textsf {OAGKE}$protocol is a variant ofkey encapsulation mechanism($\textsf {KEM}$) calledblinded$\textsf {KEM}$($\textsf {BKEM}$). However, their constructions of$\textsf {BKEM}$are susceptible to quantum attacks. This work proposes an isogeny-based$\textsf {BKEM}$and aforward secure$\textsf {OAGKE}$that is secure against adversaries equipped with quantum computers. Our construction of$\textsf {BKEM}$is based on theCommutative Supersingular Isogeny Diffie-Hellman($\textsf {CSIDH}$) cryptosystem. We provide a formal security proof demonstrating the security of our scheme. Furthermore, we manifest an instantiation of our$\textsf {BKEM}$from$\textsf {CSIDH-512}$parameter set. Finally, we present our isogeny-based$\textsf {OAGKE}$protocol along with its rigorous security analysis.

Abstract With the help of a multi-signature scheme, we can reduce the cost of storage and bandwidth in case of many signers signing the same message. Therefore, multi-signature schemes can be used in bitcoin to reduce the size of a blockchain. In this paper, we propose a lattice-based multi-signature scheme with the following highlighted features. Our lattice-based multi-signature scheme supports signature compression and public key aggregation. The only existing lattice-based multi-signature scheme by Kansal and Dutta (Africacrypt, 2020) that supports both signature compression and public key aggregation has communication and storage cost $\widetilde{\mathcal{O}}(n^2)$, whereas our communication and storage cost is $\mathcal{O}(n)$. Our multi-signature scheme is in the plain public key model where the special registration of the public key is not necessary and it is secure under the rogue key attack. Our multi-signature scheme is secure under the hardness of ring short integer solution problem in the random oracle model.

Abstract A nominative signature (NS) is a cryptographic primitive where two parties collude to produce a signature. It is a user certification system and has applications in a variety of sectors where nominee cannot trust heavily on the nominator to validate the nominee's certificate and only targeted entities are allowed to verify the signature on sensitive data. A new construction for NS from standard assumptions on lattice is provided. The authors’ construction relies on collision‐resistant preimage sampleable function and symmetric key primitives like collision‐resistant pseudorandom function and zero knowledge proof system ZKB ++ for Boolean circuits. The authors provide detailed security analysis and show that their construction achieves security under unforgeability , invisibility , impersonation , and non‐repudiation in the existing model. Furthermore, our construction exhibits non‐transferability . The security under non‐repudiation is achieved in the quantum random oracle model using Unruh transform to ZKB ++ .

Abstract In this paper, we propose a two‐way oblivious pseudorandom function (mOPRF) secure in standard model against malicious parties under the decisional composite residuosity and decisional Diffie–Hellman assumptions. Using this two‐way OPRF, we construct an optimistic mutual private set intersection (PSI) protocol conserving fairness. In our PSI protocol, fairness is obtained by a semi‐trusted arbiter in the sense that it cannot get access to the private information of the two parties, but we believe that it will follow the protocol. To the best of our knowledge, our PSI protocol is the first fair PSI with linear communication and computation complexities and is proven to be secure in standard model against malicious adversaries under decisional q‐Diffie–Hellman inversion, decisional composite residuosity, and decisional Diffie–Hellman assumptions. Apart from that, we present a modified version of the OPRF that requires less number of communication rounds. Copyright © 2016 John Wiley & Sons, Ltd.

Abstract We propose two efficient universally composable adaptivek‐out‐of‐N protocols, secure in the presence of malicious adversary in static corruption model under the Decision Linear and q‐Strong Diffie–Hellman assumptions. Our second scheme additionally requires the hardness of Decision Bilinear Diffie‐Hellman problem. Non‐interactive Groth–Sahai proofs are employed for the verification of pairing product equations. More interestingly, our first scheme facilitates the receiver to verify the correctness of messages recovered. The proposed protocols exhibit significant computational and communication efficiency compared with existing similar schemes in the literature. Copyright © 2016 John Wiley & Sons, Ltd.

Abstract In today's Internet world, security, privacy and efficiency are three prime concerns in designing any cryptographic protocol. Adaptive oblivious transfer with access policy (AOT‐AP) is widely used in oblivious search of privacy preserving databases in which each message is associated with an access policy and only authorized receivers can access the databases. All the existing AOT‐AP protocols assume a trusted third party called issuer apart from a sender and multiple receivers and are secure under the restriction that the issuer never colludes with a collection of receivers. We propose the first issuer‐freeAOT‐AP in universal composable (UC) framework. Our issuer‐free AOT‐AP is UC secure under standard assumptions assuming malicious adversary in static corruption model. More interestingly, our scheme exhibits significant improvements over the existing schemes. Copyright © 2015 John Wiley & Sons, Ltd.

Abstract The functionality of ciphertext‐policy attribute‐based encryption (CP‐ABE) enables the encryptor to encrypt the data for a group of users of his choice by incorporating an access policy over target receivers' attributes into encryption algorithm itself. This makes CP‐ABE systems appealing in several applications where complex access control is at prime concern, but incurs high communication and computation overheads which could impede its practical usage. Another limitation of CP‐ABE is that the ciphertext includes the access policy explicitly and, hence, anyone who has access to the ciphertext can identify all legitimate recipients of that ciphertext. This is not desirable for certain mission‐critical applications such as military operations. In order to alleviate these problems, we add privacy‐preserving property efficiently to CP‐ABE scheme via concealing the access policy partially. The encryption in our construction exploits monotone access policies over receivers' attributes and makes ciphertext size constant. The construction is fully secure and can achieve recipient anonymity as the ciphertext terms do not leak any information about recipients. The full semantic security with anonymity relies on dual‐system encryption technique in composite order bilinear groups. To the best of our knowledge, the proposed scheme is thefirstconstruction in the anonymous ABE literature with the stated functionality. Copyright © 2015 John Wiley & Sons, Ltd.

We propose an efficient adaptive oblivious transfer protocol with hidden access policies. This scheme allows a receiver to anonymously recover a message from a database which is protected by hidden attribute based access policy if the receiver's attribute set satisfies the associated access policy implicitly. The proposed scheme is secure in the presence of malicious adversary under the q-Strong Diffie-Hellman (SDH), q-Power Decisional Diffie-Hellman (PDDH) and Decision Bilinear Diffie-Hellman (DBDH) assumption in full-simulation security model. The scheme covers disjunction of attributes. The proposed protocol outperforms the existing similar schemes in terms of both communication and computation.

In this paper, we present and analyze a variant of Burmester-Desmedt group key agreement protocol (BD) and enhance it to dynamic setting where a set of users can leave or join the group at any time during protocol execution with updated keys. In contrast to BD protocol, let us refer to our protocol as DB protocol. Although the DB protocol is similar to BD protocol, there are subtle differences between them: 1) Key computation in DB protocol is different and simpler than in BD protocol with same complexity of BD protocol; 2) Number of rounds required in our authenticated DB protocol is one less than that in authenticated BD protocol introduced by Katz-Yung; 3) DB protocol is more flexible than BD protocol in the sense that DB protocol is dynamic. The reusability of user's precomputed data in previous session enables the join and leave algorithms of our DB protocol to reduce most user's computation complexities which can be useful in real life applications; and 4) DB protocol has the ability to detect the presence of corrupted group members, although one can not detect who among the group members are behaving improperly.

A self-healing key distribution scheme enables a large group of users (sensor nodes) to establish a session key dynamically over an unreliable, or lossy wireless network. The main property of self-healing ensures that the qualified users can recover the lost session keys on their own from the broadcast packets and some private information, without any additional communication with the group manager, thus decreasing the load on the group manager. The only requirement for a user to recover the lost session keys, is its membership in the group both before and after the sessions in which the broadcast packets containing the keys are sent. Self-healing approach of key distribution is stateless in the sense that a user who has been off-line for some period is able to recover the lost session keys immediately after coming back on-line. This paper presents a new self-healing key distribution scheme with revocation capability that requires constant storage of personal keys for each user and we feel, it is more efficient than the previous schemes in terms of communication complexity. The novelty of this scheme is to use a different and more efficient self-healing mechanism compared to the ones in the literature. The scheme is supported by a proper security analysis in an appropriate security model. It is unconditionally secure and achieves both forward and backward secrecy. Moreover, unlike previous works, proposed self-healing key distribution is not restricted to m sessions in Setup phase.

Recently, Kim et al. proposed a very efficient provably secure group key agreement protocol KLL, security of which relies on the computational Diffie-Hellman (CDH) assumption in the presence of random oracles. In our earlier work, we embed the protocol KLL into password-based environment -yielding the protocol DB-PWD. In this paper, we detect certain flaws in the protocol DB-PWD and take suitable measures to overcome these attacks. We introduce a protocol MDB-PWD -an improved variant of the protocol DB-PWD and analyze its security in the security framework formalized by Bellare et al. in both the ideal cipher model and the random oracle model under CDH assumption.

In this paper, we develop and analyze a new self-healing key distribution scheme with revocation capability, scalable to very large groups in unreliable ad hoc wireless environment. The main emphasis of our proposed scheme is that it has significant improvement in terms of both storage and communication overhead compared to the previous works. The storage overhead of our self-healing key distribution with t revocation capability is O((t + 1) log q), and the communication complexity is O((t+1+j) log q), where q is a large prime and j is the current session number. In contrast to the previous schemes, we use a different and more efficient self-healing technique. On a more positive note, our scheme enables reuse of personal key of a user to next m sessions and consequently, overcomes the restriction of m sessions in setup phase, unlike previous works. Moreover, we analyze our scheme in an appropriate security framework and proved that it is unconditionally secure and achieves both forward secrecy and backward secrecy.