A threshold key encapsulation mechanism (TKEM) facilitates the secure distribution of session keys among multiple participants, allowing key recovery through a threshold number of shares. TKEM has gained significant attention, especially for decentralized systems, including blockchains. However, existing constructions often rely on trusted setups, which pose security risks such as a single point of failure and are limited by fixed participant numbers and thresholds. To overcome this issue, we propose a dynamic TKEM with a transparent setup, allowing for a flexible selection of both recipients and thresholds without relying on trusted third parties in the setup phase. In addition, our construction does not rely on pairing operations, which are less efficient compared to exponentiation. We prove the selective chosen-ciphertext security of our construction under the decisional Diffie-Hellman assumption, zero-knowledge, and soundness of a non-interactive zero-knowledge (NIZK) proof system. We also show that our scheme satisfies decapsulation consistency when the underlying NIZK system is sound. Our proof-of-concept implementation highlights the practicality and efficiency of this approach, further advancing the field of threshold cryptography.

This is our first IET Information Security special issue from the Internation Conference on Information Security and Cryptology, which was held from December 1 to December 3, Seoul, South Korea, 2021. The aim of ICISC 2021 was to provide an international forum for the latest results of research, development, and applications within the field of information security and cryptography. In ICISC 2021, we received 63 submissions and were able to accept 23 papers for the presentation at the conference. Among accepted and presented papers at ICISC 2021, we selected six papers with high review scores and recommended them for publication in the special issue of IET information Security (via at least 30% extension). It is worth noting that the review and the selection process were successfully conducted by programme committee (PC) members, including reviewers dispatched from IET Information Security, and each paper underwent a blind review by at least three PC members. The special issue contains six papers on topic areas, including lattice-based protocol constructions (Topic A), lattice-based analysis algorithms (Topic B), efficient quantum circuit constructions (Topic C), and analysis on symmetric-key primitives (Topic D). Paper 1 by P. Ren, X. Gu, and Z. Wang investigates how to construct a quantum-safe password-authenticated key exchange (PAKE) as a cryptographic primitive that can establish secure remote communications between a client and a server. They suggest a new PAKE protocol based on module lattices with a rigorous security proof in the random oracle model. Taking the flexibility of the module learning with errors problem, they elaborately select 3 parameter sets to meet different application scenarios. Specifically, they show that their recommended PAKE implementation achieves 177-bit post-quantum security with a generous margin to cope with later improvement in the cryptanalysis. Their performance results indicate that the MLWE-PAKE is quite practical: compared with the latest Yang-PAKE, their PAKE reduces the communication cost and the running time by 36.8% and 13.8%, respectively. Paper 2 by V. Farzaliyev, J. Willemson, and J. K. Kaasik investigates Mix-networks as a general tool for building anonymous communication systems. They focus on the application case of post-quantum electronic voting where the number of votes to be mixed may reach hundreds of thousands or even millions. They propose an improved architecture for lattice-based post-quantum mix-nets featuring more efficient zero-knowledge proofs while maintaining established security assumptions. Their implementation scales up to 100,000 votes, still leaving a lot of room for future optimisation. Paper 3 by K. Yamamura, Y. Wang, and E. Fujisaki investigates an enumeration algorithm that is used as a subroutine for the BKZ algorithm, which is one of the most practical reduction algorithms. It is a critical issue to reduce the computational complexity of the enumeration algorithm. First, they improve the mechanism, called Primal Projective Reordering (PPR) method, over the previous reordering method proposed by Wang in ACISP 2018. Next, they propose a Dual Projective Recording method in dual lattice, and also they propose a condition to decide whether the reordering method should be adapted or not. Finally, they propose an improved BKZ algorithm with the reordering methods and our proposed condition. Preliminary experimental results show that their proposed reordering methods can successfully reduce the number of enumeration algorithm search nodes compared to the predecessor, for example, PPR reduces around 9.6% on average in 30-dimensional random lattices, and DPR reduces around 32.8% on average in 45-dimensional random lattices. Paper 4 by J. Lee, S. Lee, Y. S. Lee, and D. Choi suggests an efficient quantum circuit design of a given cryptographic algorithm in terms of reducing T-depth for time complexity efficiency. They propose a novel technique for reducing T-depth (and T-count) when some quantum circuits located between two Toffoli gates are interchangeable with a controlled phase gate (CP gate). They apply their technique to five types of quantum adders, reducing T-depth by more than 33%. They also present new SHA-256 quantum circuits, which have a critical path with only three quantum adders, while the critical paths of quantum circuits in the previous works consist of seven or 10 quantum adders. According to their four version of SHA-256 quantum circuit, T-depth of the proposed SHA-256 quantum circuit with the Width (the number of qubits) 797 is 16,055, which is remarkably reduced by about 85%. Another proposed quantum circuit only requires 768 qubits, which is the smallest width, to the best of their knowledge. Finally, one other version is the most time-efficient circuit with an overall Toffoli depth (and T-depth) that is less than 5000. Paper 5 by Y. Lee, J. Kang, D. Chang, and S. Hong presents preimage attacks on a round-reduced variant of GIMLI-HASH, in which the message-absorbing phase used 5-round GIMLI and the squeezing phase used 9-round GIMLI. They call this variant as 5-9-round GIMLI-HASH. Their preimage attack on 5-9-round GIMLI-HASH requires 294.44 time complexity and 297 memory complexity. Also, this method can be reached up to round shifted 10-round GIMLI in the squeezing phase. Their first attack requires the memory for storing several precomputation tables in GIMLI SP-box operations. In their second attack, they take a time-memory trade-off approach, reducing memory requirements for precomputation tables but increasing computing time for solving SP-box equations by the SAT solver. This attack requires 266.17 memory complexity and 296+ε time complexity, where ε is the time complexity for solving SP-box equations. Their experiments using the CryptoMiniSat SAT solver show that the maximum time complexity for ε is about 220.57 9-round GIMLI. Paper 6 by S. Lim and D. G. Han examines a differential fault attack on the PIPO, a lightweight block cipher, which was proposed in ICISC 2020. The PIPO was designed for providing robust security strength while having less overhead when using the side-channel analysis countermeasure. A differential fault attack is a type of side-channel analysis that induces fault in cryptographic operations and utilises difference information that occurs. They proposed a single-bit flip-based differential fault attack on PIPO, where, through 64 fault ciphertexts, their proposed attack has a 98.9% probability of recovering the correct secret key of PIPO 64/128. They evaluated the proposed attack not only through simulations but also through electromagnetic fault injection. All of the papers selected for this Special Issue show that further improvements of information security and cryptography are made in the topic areas of post-quantum cryptography and security analysis on block ciphers. Especially, various experimental results by authors will clearly show the reader how advanced their results are, compared to the current research works related to six selected papers. In the meanwhile, there are still many challenges in this field that require future research attentions, such as efficient construction of lattice-based cryptographic primitives, analysis on lattice-based reduction algorithms, and more realistic quantum attacks against post-quantum cryptographic primitives and their underlying complexity assumptions. We hope to see more advanced research results on these topics in the near future. We appreciate all of the authors for their contributions to this Special Issue, 'Selected papers from the 24th International Conference on Information Security and Cryptology (ICISC 2021)'. We would also like to extend the appreciation to the anonymous reviewers who have provided insightful comments and suggestions in improving the quality of the manuscripts. Special thanks go to the Editors-in-Chief and the Deputy Editor of IET Information Security for giving us this great opportunity. Jong Hwan Park received the B.S. degree in the Department of Mathematics from Korea University, Seoul, Korea, in 1999, and the M.S. and Ph.D. degrees in the Graduate School of Information Security from Korea University, Seoul, Korea, in 2004 and 2008, respectively. From 2009 to 2011, he served as a research professor from Kyung Hee University, and from 2011 to 2013, he served as a research professor in Korea University. From 2013 to 2019, he served as an assistant professor in the Department of Computer Science, Sangmyung University, Seoul, Korea. Since 2020, he has served as an associate professor. His research areas include functional encryption, lattice-based cryptographic primitives, broadcast encryption, and various zero-knowledge-based cryptographic protocols.

NTRU was the first practical public key encryption scheme constructed on a lattice over a polynomial-based ring and has been considered secure against significant cryptanalytic attacks over the past few decades. However, NTRU and its variants suffer from several drawbacks, including difficulties in achieving worst-case correctness error in a moderate modulus, inconvenient sampling distributions for messages, and relatively slower algorithms compared to other lattice-based schemes. In this work, we propose a new NTRU-based key encapsulation mechanism ($\mathsf {KEM}$), called$\mathsf {NTRU+}$, which overcomes nearly all existing drawbacks.$\mathsf {NTRU+}$is constructed based on two new generic transformations:$\mathsf {ACWC}_{2}$and$\overline {\mathsf {FO}}^{\perp }$(a variant of the Fujisaki-Okamoto transform).$\mathsf {ACWC}_{2}$is used to easily achieve worst-case correctness error, while$\overline {\mathsf {FO}}^{\perp }$is used to achieve chosen-ciphertext security without re-encryption. Both$\mathsf {ACWC}_{2}$and$\overline {\mathsf {FO}}^{\perp }$are defined using a randomness-recovery algorithm and an encoding method. In particular, our simple encoding method, the semi-generalized one-time pad ($\mathsf {SOTP}$), allows us to sample a message from a natural bit-string space with an arbitrary distribution. We provide four parameter sets for$\mathsf {NTRU+}$and present implementation results using NTT-friendly rings over cyclotomic trinomials.

Self-updatable encryption (SUE) is a new kind of public-key encryption, motivated by cloud computing, which enables anyone (i.e. cloud server with no access to private keys) to update a past ciphertext to a future ciphertext by using a public key. The main applications of SUE are revocable-storage attribute-based encryption (RS-ABE) that provides an efficient and secure access control to encrypted data stored in cloud storage. In this setting, there is a new threat such that a revoked user still can access past ciphertexts given to him by a storage server. RS-ABE solves this problem by combining user revocation and ciphertext updating functionalities. We propose the first SUE and RS-ABE schemes secure against a relevant form of chosen-ciphertext security (CCA). Due to the fact that some ciphertexts are easily derived from others, we employ a different notion of CCA that avoids easy challenge related messages. Specifically, we define “time extended challenge” CCA security for SUE which excludes ciphertexts that are easily derived from the challenge (over time periods) from being queried on. We then propose an efficient SUE scheme with such CCA security, and we also present an RS-ABE scheme with this CCA security.

Biometric data is user-identifiable and therefore methods to use biometrics for authentication have been widely researched. Biometric cryptosystems allow for a user to derive a cryptographic key from noisy biometric data and perform a cryptographic task for authentication or encryption. The fuzzy extractor is known as a prominent biometric cryptosystem. However, the fuzzy extractor has a drawback in that a user is required to store user-specific helper data or receive it online from the server with additional trusted channel, to derive a correct key. In this paper, we present a new biometric-based key derivation function (BB-KDF) to address the issues. In our BB-KDF, users are able to derive cryptographic keys solely from their own biometric data: users do not need any other user-specific helper information. We introduce a security model for the BB-KDF. We then construct the BB-KDF and prove its security in our security model. We then propose an authentication protocol based on the BB-KDF. Finally, we give experimental results to analyze the performance of the BB-KDF. We show that our proposed BB-KDF is computationally efficient and can be deployed on many different kinds of devices.

Abstract Threshold public‐key encryption can control decryption abilities of an authorized user group in such a way that each user of the group can produce only a decryption share and at least t of them should collect decryption shares to recover a message. We present a new threshold public‐key encryption that is secure against selectively chosen ciphertext attacks. Semantic security against chosen ciphertext adversaries is the de facto level of security for public‐key encryption deployed in practice because many encryption systems are broken in a model of chosen ciphertext security. The security of the proposed system is formally proved without random oracles under a new assumption. We also provide proof of the intractability of our assumption in the generic group model. Copyright © 2012 John Wiley & Sons, Ltd.

Predicate encryption is a public-key encryption that supports attribute-hiding as well as payload-hiding and achieves high flexibility in terms of access control. Since Katz, Sahai, and Waters first proposed the predicate encryption scheme in 2008, several predicate encryption schemes have been published. Unfortunately these are impractical as they require$O(n)$pairing computations for decryption with considerably large sized public parameters, secret key, and ciphertext, where$n$is the dimension of the attribute/predicate vectors. In this paper, we propose a very efficient predicate encryption scheme that requires only$n$exponentiation plusthreepairing computations for decryption with shorter sized public parameters, secret key, and ciphertext. The proposed scheme is proven selective attribute-secure against chosen-plaintext attacks in the standard model under the Asymmetric Decisional Bilinear Diffie-Hellman assumptions.

We present an anonymous hierarchical identity based encryption (HIBE) scheme that not only achieves constant-size ciphertext, but also works in bilinear groups with prime order. In contrast to our work, all previous anonymous HIBE schemes either have ciphertext size linear in the depth of the hierarchy or work in bilinear groups with a composite order. Our construction is more efficient than previous schemes in terms of ciphertext size and decryption cost. We give provable security of our construction, consisting of confidentiality and anonymity, without random oracles. To gain anonymity, we introduce a novel and simple method called “double exponent” technique, which gives an anonymous HIBE scheme more compact than the result at CRYPTO 2006. Our method is quite general in that it works on both symmetric and asymmetric bilinear maps. The simple method might also be of independent interest to gain anonymity of attributes in constructing searchable encryption schemes on encrypted data.

Predicate encryption has received considerable attention in applications where private and sensitive data about users can be stored in untrusted database (DB) servers. It allows users to store encrypted data at DB servers, and yet retain the ability to search those databases without revealing anything else about the encrypted data. Hidden Vector Encryption (HVE) is a type of predicate encryption that supports the fine-grained conjunctive combination of equality queries, comparison queries, and subset queries on encrypted data. The currently known HVE schemes, which are all pairing-based, either work in composite-order groups or require a token size of O(ℓ) and O(ℓ) pairing computations for one search query with ℓ conjuncts. In this paper, we present a new HVE scheme that not only works in prime-order groups but also requires a token size of O(1) and only O(1) pairing computations regardless of ℓ. Our HVE construction also yields a more efficient, anonymous, identity-based encryption scheme than existing schemes, which is secure in the standard model. To achieve our goal, we introduce novel techniques for both hiding attributes in prime-order groups and reducing the number of pairing computations to O(1). Our techniques are quite general so that they can be applied to both symmetric and asymmetric bilinear maps.

Recently, Baek et al. proposed an efficient public key encryption scheme with keyword search based on the scheme of Boneh et al., However, the security model of Baek et al. seriously limits the ability of the adversary.

Multi-receiver Identity-Based Key Encapsulation Mechanism (mIB-KEM) allows a sender to distribute messages for a set of receivers using the receiver's identity as a public key. Recently, Chatterjee and Sarkar [12] suggested a new mIB-KEM which has sublinear-size ciphertexts and private keys simultaneously. They demonstrated that their scheme is secure against chosen plaintext (or ciphertext) attacks without random oracles. In this paper, we show that their scheme is not secure in that a revoked user can easily decrypt cipher-texts. We next propose a new mIB-KEM which overcomes the security flaw identified in the construction of Chatterjee and Sarkar.