Proof of Retrievability (POR) is an important cryptographic primitive that has attracted considerable attention in the research community for its ability to enable users to audit the integrity of outsourced files on cloud servers without retrieving them. A POR scheme with public verifiability further enhances usability by allowing users to delegate the auditing task to a third party, making it highly desirable for a wide range of applications. However, most existing publicly verifiable POR schemes derive their security from the computational hardness of discrete logarithm or factoring, making them vulnerable to quantum attacks. Although it is possible to construct quantum-resistant POR schemes with public verifiability upon hash trees or general lattices, the resulting schemes often exhibit performance limitations when compared to existing constructions, thereby limiting their deployment in real-world applications. In this work, we address this gap by constructing a publicly verifiable POR scheme on structured lattices. We show that our scheme is provably secure in the random oracle model under the Ring-LWE and Ring-SIS assumptions. We provide an implementation of our scheme and the experimental results show that its performance is comparable to certain well-known constructions based on traditional assumptions.

The cloud has become pervasive, and we ask: how can we protect cloud data against the cloud itself? For secure user-to-user communication via a cloud server, End-to-End encryption has been formally studied, building on existing TLS channels without requiring new primitives. However, enabling user-to-same-user secure outsourced data storage–solving the analogous problem of “privacy from the server” while (1) relying on existing infrastructure and (2) supporting user mobility, remains open. Existing proposals, like password-protected secret sharing, target the same goal but are incompatible with existing cloud storage services. Specifically, they lack the simplicity needed to directly utilize existing cloud storage without requiring changes on the cloud side. Here, we propose a novel system for securely storing private data in existing cloud storage with the help of a key server (necessary, given the requirements). In our system, user data is secure against threats from the cloud server, the key server, and illegitimate users. Only the legitimate user can access the data on any device using a correct passphrase. Most importantly, our system does not require the storage server to support any newly programmable operations. Moreover, leveraging the existing App login, our system requires only one passphrase, which never leaves the user’s device and remains hidden from both servers. The security is proved under formal models, and its efficiency is demonstrated by experiments conducted on Amazon S3. Notably, a preliminary variant, based on our principles, was deployed by Snapchat in their My Eyes Only module, serving hundreds of millions of users!

A threshold signature scheme distributes the ability to generate signatures through distributed key generation and signing protocols. A threshold signature scheme should be functionally interchangeable, meaning that a signature produced by a threshold scheme should be verifiable by the same algorithm used for non-threshold signatures. To resist future attacks from quantum adversaries, lattice-based threshold signatures are desirable. However, the performance of existing lattice-based threshold signing protocols is still far from practical. This paper presents the first lattice-basedt-out-of-nthreshold signature scheme with functional interchangeability that has been implemented. To build ant-out-of-naccess structure for arbitraryt≤n, we first present a novelt-out-of-nversion of the SPDZ MPC protocol. For high concrete efficiency, we avoid using the MPC protocol to evaluate hash operations. Moreover, we design an efficient distributed rejection sampling protocol. As a consequence, the online phase of our distributed signing protocol takes only 0.5 seconds in the two-party setting and 7.3 seconds in the 12-party setting according to our implementation. As a byproduct, our scheme also presents a periodic key refreshment mechanism and offers proactive security.