In Diffie-Hellman key exchange, the commutativity of power operations is instrumental in the agreement of keys. Viewing commutativity as a law in abelian groups, we propose Diffie-Hellman key exchange in the group action framework (Brassard-Yung, Crypto'90; Ji-Qiao-Song-Yun, TCC'19), for actions of non-abelian groups with laws. The security of this protocol is shown, following Fischlin, Günther, Schmidt, and Warinschi (IEEE S&P'16), based on a pseudorandom group action assumption. A concrete instantiation is proposed based on the monomial code equivalence problem.

Proof-of-Stake (PoS) blockchain protocols have gained increasing prominence in recent years due to their energy efficiency. In PoS systems, users stake tokens to become validators. Those who stake more tokens are elected to propose new blocks with higher probabilities and possess greater voting power in consensus decisions. At first glance, threshold signatures appear to be a promising mechanism for aggregating multiple block attestations in PoS blockchain protocols. However, traditional threshold signatures treat each participant equally in signature generation, disregarding the differing weights of participants. This lack of weight consideration poses a challenge in PoS blockchains, where validators inherently have varying levels of influence. To address this issue, a weighted threshold signature scheme is necessary—one that accounts for the distinct weights of signers, reflecting their respective voting power in PoS blockchains. Despite this need, no existing weighted threshold signature schemes are resistant to attacks by quantum computing. To fill this gap in the literature, we propose the first lattice-based weighted threshold signature scheme, proven secure under the module short integer solution (MSIS) assumption in the random oracle model. Furthermore, we demonstrate the integration of this novel scheme into PoS blockchain protocols for block attestation. Finally, we implement our weighted threshold signature scheme and present its efficiency evaluation.

Homomorphic permutation is fundamental to privacy-preserving computations based on batch-encoding homomorphic encryption. It underpins nearly all homomorphic matrix operations and predominantly influences their complexity. Permutation decomposition as a potential approach to optimize this critical component remains underexplored. In this paper, we propose novel decomposition techniques to optimize homomorphic permutations, advancing homomorphic encryption-based privacy-preserving computations. We start by defining an ideal decomposition form for permutations and propose an algorithm searching for depth-1 ideal decompositions. Based on this, we prove the full-depth ideal decomposability of permutations used in specific homomorphic matrix transposition (HMT) and multiplication (HMM) algorithms, allowing them to achieve asymptotic improvement in speed and rotation key reduction. As a demonstration of applicability, substituting the HMM components in the best-known inference framework of encrypted neural networks with our enhanced version shows up to a 3.9× reduction in latency. We further devise a new method for computing arbitrary homomorphic permutations, specifically those with weak structures that cannot be ideally decomposed. We design a network structure that deviates from the conventional scope of decomposition and outperforms the state-of-the-art technique under a limited rotation key budget, achieving a speed-up of up to 1.69 ×.

The Classic McEliece key encapsulation mechanism (KEM), a candidate in the fourth-round post-quantum cryptography (PQC) standardization process by the National Institute of Standards and Technology (NIST), stands out for its conservative design and robust security guarantees. Its deployment is impeded by exceptionally large public and secret keys. Modern GPUs offer abundant parallelism and global memory, making them well suited to such key sizes and to high-throughput cryptographic workloads. However, there has not been a systematic implementation of Classic McEliece on GPU platforms. This paper presents the first high-performance implementation of Classic McEliece on NVIDIA GPUs. Firstly, we present the first GPU-based implementation of Classic McEliece, utilizing a “CPU-GPU” heterogeneous approach and a kernel fusion strategy. We significantly reduce global memory accesses, optimizing memory access patterns. This results in encapsulation and decapsulation performance of 28,628,195 ops/s and 3,051,701 ops/s, respectively, for McEliece348864. Secondly, core operations like Additive Fast Fourier Transforms (AFFT), and Transpose AFFT (TAFFT) are optimized. We introduce the concept of the (T)AFFT stepping chain and propose two universal schemes: Memory Access Stepping Strategy (MASS) and Layer-Fused Memory Access Stepping Strategy (LFMASS), which achieve a speedup of 30.56% and 38.37%, respectively, compared to the native GPU-based McEliece6960119 implementation. Thirdly, extensive experiments on the NVIDIA RTX4090 show significant performance gains, achieving up to 344× higher encapsulation and 125× higher decapsulation compared to the official CPU-based AVX implementation, decisively outperforming existing ARM Cortex-M4 and FPGA implementations.

Energy-efficient proof-of-stake (PoS) consensus protocols in blockchain have gained much attention from academia and industry recently. Despite their potential advantages, PoS protocols have not been extensively deployed in the existing digital currency market due to inherent security concerns, e.g., long-range attacks. Such attacks enable an adversary to rewrite the entire transaction history of a blockchain, severely compromising its immutability. The puncturable signature provides an efficient solution against long-range attacks due to secret key leakage. More specifically, a signer can update the secret key with chosen messages selectively, while the public key is unchanged. Unfortunately, the existing puncturable signature schemes suffer from either updating the public key repeatedly or large key size, which makes them unsuitable for PoS protocols. To resolve these drawbacks, we adopt a different approach to performing key puncture operations and propose a generic puncturable signature construction from delegated (key-policy) constrained signatures. We present a concrete puncturable signature scheme over lattices that is proven secure based on the short integer solution (SIS) assumption in the standard model.

Puncturable encryption (PE), introduced by Green and Miers at IEEE S$&$P 2015, allows recipients to update their decryption keys to revoke decryption capability for selected messages without communicating with senders. In general, it allows users to control which ciphertexts their keys may decrypt. The notion of PE has been found very useful in many applications, such as asynchronous messaging systems, group messaging systems, public-key watermarking schemes, secure cloud emails, and many more. In this paper, we introduce a new primitive called hierarchical identity-based puncturable encryption (HIBPE) that enhances the concept of PE by allowing more general key delegation and flexible key puncture. It enhances the capability of the data owner for multi-level encrypted data sharing within a group of users by delegating the decryption keys of the users in higher-levels to generate decryption keys for the users in lower-levels. Moreover, it allows users to puncture (update) their decryption keys on tags so that a decryption key punctured on a tag can no longer decrypt ciphertexts under this tag. In addition, to control access to the users' data, the higher-level users can further puncture the delegated keys (for lower-level users) with some tags such that the part of the owner's data is labeled by the punctured tags will no longer be accessible by the lower-level users. These features offer an efficient and flexible solution for encrypted data sharing as well as data-access control mechanisms in a hierarchical setting. We propose the formal definition and security model for HIBPE schemes and provide a concrete HIBPE scheme based on the hardness of the learning with errors problem in the standard model. Further, we provide a generic construction of forward secure hierarchical identity-based encryption (fs-HIBE) from HIBPE, which enables the first quantum-safe construction of fs-HIBE in the standard model. Moreover, this is the first fs-HIBE construction by exploring the concept of PE. The proposed fs-HIBE provides quantum-safe protection for secret keys from exposure in multi-level encrypted data sharing by evolving the keys with time.

Homomorphic Proxy Re-Encryption (HPRE) is an extension of Proxy Re-Encryption (PRE) which combines the advantages of both Homomorphic Encryption (HE) and PRE. A HPRE scheme allows arbitrary evaluations to be performed on ciphertexts under one (the delegator's) public key and, using a re-encryption key, it transforms the resulting ciphertext to a new ciphertext under another (the delegatee's) public key. Prior HPRE schemes are either CPA-secure or CCA-secure but only support partial homomorphic operations. We propose a generic construction of single-hop HPRE scheme which supports fully homomorphic operations. The proposed scheme is proven secure in our new index-based CCA-HPRE model. Our technique is to give a generic transformation that turns any multi-identity identity-based FHE (IBFHE) scheme with key switching into Fully Homomorphic Encryption (FHE) with key switching from which we can obtain the proposed single-hop HPRE scheme. We also present a concrete instantiation of multi-identity IBFHE with key switching from learning with errors (LWE) in the standard model.

Public key encryption with equality test (PKEET) enables the testing whether two ciphertexts encrypt the same message. Identity-based encryption with equality test (IBEET) simplify the certificate management of PKEET, which leads to many potential applications such as in smart city applications or Wireless Body Area Networks. Lee et al. (ePrint 2016) proposed a generic construction of IBEET scheme in the standard model utilising a 3-level hierachy IBE together with a one-time signature scheme, which can be instantiated in lattice setting. Duong et al. (ProvSec 2019) proposed the first direct construction of IBEET in standard model from lattices. However, their scheme achieve CPA security only. In this paper, we improve the Duong et al.'s construction by proposing an IBEET in standard model which achieves CCA2 security and with smaller ciphertext and public key size.

Abstract Blind signatures are an important and useful tool in designing digital cash schemes and electronic voting protocols. Ring signatures on the other hand provide the anonymity of the signer within the ring of users. In order to fit to some real-life applications, it is useful to combine both protocols to create a blind ring signature scheme, which utilizes all of their features. In this paper, we propose, for the first time, a post-quantum blind ring signature scheme. Our scheme is constructed based on multivariate public key cryptography, which is one of the main candidates for post-quantum cryptography.

Abstract Hierarchical identity-based signature (HIBS) plays a core role in a large community as it significantly reduces the workload of the root private key generator. To make HIBS still available and secure in post-quantum era, constructing lattice-based schemes is a promising option. In this paper, we present an efficient HIBS scheme in polynomial rings. Although there are many lattice-based signatures proposed in recent years, to the best of our knowledge, our HIBS scheme is the first ring-based construction. In the center of our construction are two new algorithms to extend lattice trapdoors to higher dimensions, which are non-trivial and of independent interest. With these techniques, the security of the new scheme can be proved, assuming the hardness of the Ring-SIS problem. Since operations in the ring setting are much faster than those over integers and the new construction is the first ring-base HIBS scheme, our scheme is more efficient and practical in terms of computation and storage cost when comparing to the previous constructions.

Multivariate public key cryptography is one of the main candidates for post‐quantum cryptography. Rainbow, an improved (multi‐layer) version of unbalanced oil and vinegar (UOV), is one of the most famous multivariate signature schemes that is a promising candidate for NIST standardisation. At INDOCRYPT 2017, Beullens and Preneel introduced a new variant LUOV of UOV. Their idea is to generate a UOV scheme over the binary field and then lift it into a bigger field and hence dramatically reduce the public key size. In this study, the authors first theoretically deduce the choice for the subfield L (which is different from ) which results in smaller signature sizes (up to 40%). Moreover, they extend the idea to Rainbow and theoretically yield the optimal choice for the subfield L over which a Rainbow is generated before being lifted to K . As a result, they can reduce the public key size of the obtained Rainbow scheme up to at least 36%.

The modulus switching technique has been used in some cryptographic applications as well as in cryptanalysis. For cryptanalysis against the learning with errors (LWE) problem and the learning with rounding (LWR) problem, it seems that one does not know whether the technique is really useful or not. This work supplies a complete view of the impact of this technique on the decoding attack, the dual attack and the primal attack against both LWE and LWR. For each attack, the authors give the optimal formula for the switching modulus. The formulas get involved the number of LWE/LWR samples, which differs from the known formula in the literature. They also attain the corresponding sufficient conditions saying when one should utilise the technique. Surprisingly, restricted to the LWE/LWR problem that the secret vector is much shorter than the error vector, they also show that performing the modulus switching before using the so‐called rescaling technique in the dual attack and the primal attack make these attacks worse than only exploiting the rescaling technique as reported by Bai and Galbraith at the Australasian conference on information security and privacy (ACISP) 2014 conference. As an application, they theoretically assess the influence of the modulus switching on the LWE/LWR‐based second round NIST PQC submissions.