Abstract Encryption is the most direct technique to protect data confidentiality when users outsource their data to the cloud. Typically, ciphertexts are stored in the cloud, while cryptographic keys are managed by a key management server (KMS). However, this approach introduces new challenges in securely managing both keys and ciphertexts. Specifically, two crucial issues remain unresolved. One is that the simultaneous leakage of data encryption key and ciphertexts stored in cloud can directly compromise user data. Another is that if the cloud and KMS collude, they can trivially retrieve user data. In this work, we propose a Password-protected Encrypted Cloud Storage scheme PECS that is resilient to the aforementioned leakage and collusion attacks. In PECS, the users can encrypt/decrypt their data using only a password without storing any key material, and neither the cloud nor KMS learns any information about the user data or keys. Technically, we introduce a re-encryption mechanism performed by the cloud to prevent an adversary from obtaining the original ciphertexts. Furthermore, the user encrypts key wrap before sending it to the cloud, under a pair of password-derived secret and public key. Both the data encryption keys and password are protected from being exposed by the servers through an oblivious pseudorandom function (OPRF). Provable security and efficiency of PECS are demonstrated through comprehensive analyses.

Abstract Smart home platforms predominantly adopt the broker-mediated publish/subscribe model (e.g., MQTT) for seamless device-app coordination. However, this architecture introduces a fundamental privacy-functionality conflict: the broker requires plaintext metadata (topic strings) for message routing, which inadvertently exposes fine-grained user behavioral patterns to semi-trusted service providers. Furthermore, existing systems lack rigorous cryptographic enforcement for app permissions, leaving the ecosystem vulnerable to over-privileged or malicious apps. While conventional Attribute-Based Encryption (ABE) provides fine-grained read-side access control, it cannot enforce writer-bound policies and remains computationally prohibitive for resource-constrained IoT nodes. In this paper, we propose SHERLOC, a practical and privacy-preserving framework that reconciles secure message routing with fine-grained privilege control. SHERLOC introduces two core primitives: (1) Secret Queue Telemetry Transport (SQTT), which leverages a novel trapdoor-based matching mechanism to support multi-level wildcard routing while ensuring topic indistinguishability and resistance against inside keyword-guessing attacks (IKGA); and (2) Outsourced Inner-Product Access Control Encryption (OS-IPACE), an attribute-hiding scheme that enforces dual no-read and no-write security for apps by offloading intensive pairing operations to a local hub without compromising data secrecy. We provide formal security proofs reducing SHERLOC’s privacy guarantees to the SXDH assumption. Experimental results from a full-scale prototype, comprising ESP32-based devices and Android apps, demonstrate that SHERLOC incurs millisecond-level latency and maintains compatibility with legacy MQTT brokers without altering protocol semantics, making it a robust and deployable solution for modern smart home environments.

Abstract Multi-factor authentication (MFA) is extensively employed in mobile applications to enhance security, including Internet of Vehicles, healthcare systems, smart homes, etc. Traditional MFA requires users to present specific factors, which can be inconvenient if certain factors are unavailable. To address this, $ (t, n) $-threshold MFA (T-MFA) allows users to select any $ t $ out of $ n $ registered factors for authentication. However, existing T-MFA solutions face four key issues: (i) reliance on $ n-1 $ devices, which may be impractical; (ii) susceptibility to denial of service when the mandatory factor fails; (iii) limited factor types, reducing user flexibility; and (iv) increasing client-side computational costs with higher $ t $. In this work, we propose a veritable $ (t, n) $-threshold multi-factor authenticated key exchange protocol that addresses these challenges. Utilizing oblivious programmable pseudorandom functions (OPPRF) as main tools, we eliminate dependence on multiple devices, mandatory factors, and restricted factor types, achieving what we called veritable. We present a new construction of batched OPPRF to reduce client-side costs from $ O(t) $ to $ O(1) $, with 2 exponentiations cost by the client and $ t+1 $ by the server. We implement it with JavaScript to validate its flexibility and efficiency, making it highly suitable for mobile device applications.

Abstract The breaches of the blockchain wallet keys greatly harm the security of blockchain transactions. To protect the secret keys, the known solutions, such as hierarchical deterministic wallets proposed in BIP32 or stealth addresses adopted in Monero, have been extensively researched. However, most of the existing works assume the key is safe, in the sense that it cannot be stolen or damaged, which is not true in practice. Moreover, current key revocation mechanisms either rely on centralized authorities, compromising decentralization, or require economic incentives to ensure nodes remain consistantly online. In this paper, we introduce Cocoon, the first blockchain wallet scheme that supports stealth addresses and provides a wallet revocation mechanism without the need for certificates. Cocoon not only ensures the privacy of wallet secret keys but also can individually revoke compromised keys with high performance. Our contributions are three-fold: First, we present the formal model and the related security definitions. Next, we give a generic construction based on the hierarchical identity-based signature, identity-based key encapsulation mechanism and non-interactive zero-knowledge proof. We then extend the scheme to the hierarchical setting for diverse scenarios. Finally, we give the implementation, and the results show that the scheme is practical.

Abstract Threshold signatures are essential for fault-tolerant applications among groups of users, such as in blockchain transactions. SM2 is a digital signature standard in China and ISO, yet its threshold variant is less developed compared to international alternatives such as ECDSA. Specifically, modern threshold signatures offer identifiable abort (ID-abort) and non-interactive online signing, but these features make threshold-SM2 costly, limiting its real-world application. In this paper, we introduce a fast threshold-SM2 with ID-abort and non-interactive online signing. We design a technology for ID-abort by checking hard-to-verify pseudononces based on their mappings in a group. By putting the message-independent computations to a presigning phase, we achieve a non-interactive online signing. We prove that our threshold-SM2 is secure in the dishonest majority model and implement it using Golang. Theoretical analysis and experimental results demonstrate that our threshold-SM2 provides rich functionalities with good performance, significantly reducing computational and communication costs compared to the state-of-the-art threshold-SM2 by Liang and Chen (FCS’ 24).

Cloud-edge computing has been widely-adopted for large-scale data sharing and processing. In practical data sharing systems, data are very sensitive and typically encrypted, such as health records. Unauthorized users may attempt to decrypt ciphertexts to recover the data. Due to mistakes or malice, some users might try to share sensitive information with others who do not have access. Clearly, strong access control should be employed to restrict the read and write privilege of users. There was a rich literature on mandatory fine-grained information flow control for such scenarios, but three important issues remain. First, payload privacy was often neglected. Most of the known solutions focused on the protection ciphertext header, but ignored the payload, i.e. encrypted data, which may leak information by a malicious sender. Second, no guarantee of the encrypted data. Ill-formed ciphertexts, e.g. encrypted garbage data, can pass the global policy check, causing decryption failures or disseminating bad information, hence are incapable of content distribution. Finally, the heavy computation cost of sender authentication impedes the practical deployment. In this work, we introduce Hodor, a robust fine-grained information flow control scheme that not only guards the transmission channel with mandatory fine-grained access control for massive data, but also protects whole data traffic, checks ciphertext well-formedness, and efficiently authenticates the sender. In particular, Hodor considers full data traffic protection of both the ciphertext header and encrypted payload to resist information leakage, completely verifies the consistency between the claimed access structure and the actual access structure, and achieves efficient sender authentication with a succinct challenge-response protocol. We present a formal model and give detailed proofs. We also implement and evaluate Hodor using various optimization techniques to boost its performance. The results demonstrate the efficiency and practicality of Hodor for cloud-edge data sharing.

Attribute-based encryption (ABE) has emerged as a new paradigm for access control in cloud computing. However, despite the many promising features of ABE, its deployment in real-world systems is still limited, partially due to the expensive cost of its underlying mathematical operations, which often grow linearly with the size and complexity of the system's security policies. This becomes particularly challenging in data-intensive applications, where multiple users may simultaneously access and manipulate large volumes of data, resulting in high levels of concurrency and demand for computing resources, which are too heavy even for high-end servers. Further exacerbating the issues are the functionality and security requirements of a cloud, as they introduce additional computations to both the client and the server. Therefore, in this work, we introduce$ \mathsf{GPABE} $, the first GPU-based parallelization framework for ABE to facilitate its batch processing in cloud computing. By analyzing ABE's major computational workload, we identify multiple arithmetic modules that are common in the design of pairing-based ABEs. Based on the analysis, we further propose to decompose the ABE algorithm into computation graph, which can be efficiently implemented on the GPU platform. Our graph representation bridges the gap between ABE's high-level design and their low-level implementation on GPUs, and is applicable to a variety of popular schemes in the realm of ABE. We then implement$ \mathsf{GPABE} $as a heterogeneous computing server, with several optimization techniques to improve its throughput. Finally, we evaluate the GPU implementation of several ABE schemes using$ \mathsf{GPABE} $. The results show a speedup of least 51.0× and at most 253.6× for the throughput of ABE algorithms, compared to their state-of-the-art CPU implementations, which preliminarily demonstrated the effectiveness of$ \mathsf{GPABE} $.

Abstract Honey vaults are useful tools for password management. A vault usually contains usernames for each domain, and the corresponding passwords, encrypted with a master password chosen by the owner. By generating decoy vaults for incorrect master password attempts, honey vaults force attackers with the vault’s storage file to engage in online verification to distinguish the real vaults, thus thwarting offline guessing attacks. However, sophisticated attackers can acquire additional information, such as personally identifiable information (PII) and partial passwords contained within the vault from various data breaches. Since many users tend to incorporate PII in their passwords, attackers may utilize PII to distinguish the real vault. Furthermore, if attackers may learn partial passwords included in the real vault, it can exclude numerous decoy vaults without the need for online verification. Indeed, both leakages pose serious threats to the security of the existing honey vault schemes. In this paper, we explore two attack variants of the inspired attack scenario, where the attacker gains access to the vault’s storage file along with acquiring PII and partial passwords contained within the real vault, and design a new honey vault scheme. For security assurance, we prove that our scheme is secure against one of the aforementioned attack variants. Moreover, our experimental findings suggest enhancements in security against the other attack. In particular, to evaluate the security in multiple leakage cases where both the vault’s storage file and PII are leaked, we propose several new practical attacks (called PII-based attacks), building upon the existing practical attacks in the traditional single leakage case where only the vault’s storage file is compromised. Our experimental results demonstrate that certain PII-based attacks achieve a 63–70% accuracy in distinguishing the real vault from decoys in the best-performing honey vault scheme (Cheng et al. in Incrementally updateable honey password vaults, pp 857–874, 2021). Our scheme reduces these metrics to 41–50%, closely approaching the ideal value of 50%.

Abstract The non-transferability of a designated confirmer signature scheme allows a signer to control the verification ability of a signature, hence protecting the signer’s privacy. However, a designated confirmer signature is insufficient when the secret keys are damaged and incapable of collaborative signature generation. In this paper, we circumvent these limitations by introducing the notion of designated confirmer threshold signature. First, we present a formal security model, then give a generic construction, which utilizes threshold signature schemes, encryption schemes and $$\Sigma$$ Σ -protocols. Instantiating this generic construction, we have two specific schemes, based on threshold Schnorr and threshold ECDSA, respectively. We further design two efficient $$\Sigma$$ Σ -protocols for efficient proofs. We also implement these schemes, and the experiment results show that our schemes are practical with rich functionalities. Finally, we demonstrate interesting applications for blockchains, such as verifiable asset auctions in blockchain and traditional electronic bidding.

Abstract A ring signature is a variant of normal digital signature and protects the privacy of a specific signer in the sense that a ring signature can be verified, but the signer’s identity can only be traced to a limited set. The concept was further enhanced to threshold setting to distribute signing ability among several signers. Since threshold ring signature was introduced, it was a hard problem whether one can have efficient constructions for it. In this paper, we introduce a new generic construction of threshold ring signature, named GTRS, based on canonical identification of a specific form. Our signature consists of a polynomial (represented by $$n - t + 1$$ n - t + 1 coefficients) and a single response, resulting in significantly shorter threshold ring signatures. Instantiating the generic construction with specific DL-based components, e.g. Schnorr identification and a novel vector argument of knowledge developed in this paper, we obtain GTRS-EC, which is shorter than all existing threshold ring signatures without any trusted setup.

Abstract SM9 was established in 2016 as a Chinese official identity-based cryptographic (IBC) standard, and became an ISO standard in 2021. It is well-known that IBC is suitable for Internet of Things (IoT) applications, since a centralized processing of client data (e.g. IoT cloud) is often done by gateways. However, due to limited computation resources inside IoT devices, the performance of SM9 becomes a bottleneck in practical usage. The existing SM9 implementations are often CPU-based, with relatively low latency and low throughput. Consequently, a pivotal challenge for SM9 in large-scale applications is how to reduce the latency while maximizing throughput for numerous concurrent inputs. After a systematic analysis of the SM9 algorithms, we apply optimization techniques including precomputation, resource caching and parallelization to reduce the overhead of SM9. In this work, we introduce the first practical implementation of SM9 and its underlying curve on GPU. Our GPU implementation combines multiple algorithms and low-level optimizations tailored for GPU’s single instruction, multiple threads architecture in order to achieve high throughput for SM9. Based on these, we propose , a high-performance Cryptography as a Service (CaaS) for SM9. adopts a heterogeneous computing architecture that flexibly schedules the inputs across two implementation platforms: a CPU for the low-latency processing of sporadic inputs, and a GPU for the high-throughput processing of batch inputs. According to our benchmark, only takes a few milliseconds to process a single SM9 request in idle mode. Moreover, when operating in its batch processing mode, can generate 2,038,071 private keys, 248,239 signatures or 238,001 ciphertexts per second. The results show that scales seamlessly across inputs of different sizes, preliminarily demonstrating the efficacy of our solution.

Abstract Atomic Cross-Chain Swap (ACCS) is one important topic in cryptocurrency, where users can securely and trustlessly exchange assets between two different blockchains. However, most known ACCS schemes assume specific scripting functionalities of the underlying blockchains, such as Hash Time Locked Contracts (HTLC). In addition, these schemes are typically only applicable to certain digital signature schemes, like Schnorr or Elliptic Curve Digital Signature Algorithm (ECDSA) signatures. In this paper, we propose a generic ACCS scheme, independent from the underlying blockchains. To the best of our knowledge, this is the first solution of this kind. Our results are as follows. First, we define a formal system model of ACCS. Next, we present a generic ACCS scheme meets our model. This scheme admits atomicity in cross-chain swaps without the need for a Trusted Third Party (TTP) and protects users’ privacy. Finally, by using the Non-Interactive Zero-Knowledge (NIZK) proof protocol as a tool, we instantiate our generic scheme for Elliptic Curve Discrete Logarithm Problem-based (ECDLP-based) signatures. In addition, we implement our scheme, and the experimental results show that our protocol outperforms the existing ACCS schemes, such as the HTLC-based schemes.

Version Control System (VCS) plays an essential role in software supply chain, as it manages code projects and enables efficient collaboration. For a private repository, where source code is a high-profile asset and needs to be protected, VCS’ security is extremely important. Traditional (unencrypted or encrypted) VCS solutions rely on a trusted service provider to host the code and enforce access control, which is not realistic enough for real-world threats. If the service provider peep in or the hackers break into the repository, the read & write privilege to the sensitive code is totally lost. Therefore, we consider whether one can relax the assumption on the server by introducing acovert adversary, namely, it may act maliciously, but will not misbehave if it can be caught doing so. However, protecting sensitive code and enforcing access control on a covert adversarial server is a challenging task. Existing encryption-based VCS solutions failed to address this challenge, as they offered limited access control functionalities, introduced heavy key management overhead or storage overhead. Moreover, the crucial feature of compression of the source files were missing in an encrypted and versioned storage. To address these problems, we introduceGringotts, an end-to-end encrypted VCS, tailored for read & write access control, version control and source file compression. We present a formal model and propose a scheme with detailed analysis. We also implement and evaluateGringottson top-10 most starred code projects on GitHub. The results demonstrate thatGringottsintroduces low latency (less than 0.3 s) for commit encryption and decryption, supports fine-grained access control and rich version control functionalities with practical performance.

Searchable symmetric encryption (SSE) schemes allow a client to store encrypted data with a storage provider and retrieve corresponding documents without revealing the content or search keywords to the provider. However, achieving efficient SSE schemes often comes at the cost of statistical information leakage, including search, access and size patterns. The known solutions from fully homomorphic encryption or oblivious RAM often admit poor performances due to significant computational and communication overheads. Additionally, the demand for rich search expressiveness, such as Boolean queries, further complicates the design. In this paper, we introduce NEMO, a novel SSE achieving a good balance between efficiency, security and query expressiveness. NEMO utilizes function secret sharing (FSS) and replicated secret sharing-based multi-party computation (MPC) protocol, but is highly optimized for large database. For functionality, NEMO supports arbitrary Boolean queries and enables dynamic updates in a multi-user setting. For security, NEMO achieves minimal leakage by eliminating all search, access, and size patterns, while only allowing the leakage of Boolean formulas in queries. Regarding efficiency, we propose a new FSS for multi-point functions, effectively batching multiple distributed point functions, and an infix-to-postfix conversion algorithm for Boolean formula to reduce the communication rounds in the MPC protocol. A proof-of-concept implementation of NEMO demonstrates its efficiency, with a search latency of approximately 622 ms for a conjunction query with 8 keywords, even with a dataset exceeding 1 million documents.

Abstract As a promising service paradigm, cloud computing has attracted lots of enterprises and individuals to outsource big data to public cloud. To facilitate secure data using and sharing, ciphertext-policy attribute-based encryption (CP-ABE) is a suitable solution, which can provide fine-grained access control and encryption functionalities simultaneously. However, some serious challenges are still remaining toward achieving flexible and controllable access policy update in CP-ABE, which essentially impede the powerful access control ability of CP-ABE from long-term and large-scale deployment in real systems. In this work, we propose a novel scheme named policy updatable CP-ABE for encrypted data sharing scenes. The proposed scheme features the following achievements: (i) it supports fine-grained update algorithms with no restriction on update time; (ii) the cloud server can effectively verify update ciphertexts, so the integrity of original data would not be compromised intentionally or accidentally during the update and (iii) most operations of encryption and policy update are securely outsourced to cloud servers, leaving extremely low overheads for data owners and users. We formally define its security model and prove it is adaptively secure. Also, we implement the proposed scheme using the Charm framework. The experiment results demonstrate that it is efficient and practical.

Personally identifiable information (PII) refers to any information that links to an individual. Sharing PII is extremely useful in public affairs yet hard to implement due to the worries about privacy violations. Building a PII retrieval service over multi-cloud, which is a modern strategy to make services stable where multiple servers are deployed, seems to be a promising solution. However, three major technical challenges remain to be solved. The first is the privacy and access control of PII. In fact, each entry in PII can be shared to different users with different access rights. Hence, flexible and fine-grained access control is needed. Second, a reliable user revocation mechanism is required to ensure that users can be revoked efficiently, even if few cloud servers are compromised or collapse, to avoid data leakage. Third, verifying the correctness of received PII and locating a misbehaved server when wrong data are returned is crucial to guarantee user's privacy, but challenging to realize. In this paper, we propose Rainbow, a secure and practical PII retrieval scheme to solve the above issues. In particular, we design an important cryptographic tool, called Reliable Outsourced Attribute Based Encryption (ROABE) which provides data privacy, flexible and fine-grained access control, reliable immediate user revocation and verification for multiple servers simultaneously, to support Rainbow. Moreover, we present how to build Rainbow with ROABE and several necessary cloud techniques in real world. To evaluate the performance, we deploy Rainbow on multiple mainstream clouds, namely, AWS, GCP and Microsoft Azure, and experiment in browsers on mobile phones and computers. Both theoretical analysis and experimental results indicate that Rainbow is secure and practical.

The immutability of blockchains is critical for cryptocurrencies, but an imperative need arises for the redaction of on-chain data due to privacy-protecting laws like GPDR. Recently, Ateniese et al. (EuroS&P 2017) proposed an elegant solution to this problem based on chameleon hash functions, followed by many subsequent works. While these works offered a solution to the permissioned blockchain, the approaches were not efficient enough for the permissionless setting, in terms of either security (which may cause inconsistent historical transactions) or performance (only up to a few hundred nodes). In this paper, we investigate this problem and present Wolverine, a redactable permissionless blockchain. First, we present a formal redactable blockchain model, carefully considering transaction consistency. Next, towards a practical scheme, we introduce the novel concept of non-interactive chameleon hash (NITCH). NITCHs dynamically distribute a trapdoor key among a group and each party in the group can compute its partial share without communicating with others. Anyone who possesses enough shares can then find a valid hash collision. To prevent the static group from being compromised after a sufficiently long time, we provide a generic transform from NITCHs to decentralized random beacons (DRBs) and design a committee evolution protocol based on DRBs that refresh the group after every fixed interval of time. Based on NITCH and the committee evolution protocol, we construct Wolverine which offers important features such as scalability, transaction consistency, and public accountability. Finally, we demonstrate the practicality of Wolverine by giving a proof-of-concept implementation based on Bitcoin in Golang.

Cloud-edge computing is a new paradigm for data sharing. Many computation tasks are assigned to multiple edge nodes to mitigate the computing burden of the cloud and data is also outsourced to them to provide real-time services for IoT devices. However, two major issues remain, namely data privacy and real-world deployment. According to the data privacy rights and principles that stated by General Data Protection Regulation (GDPR), data access control, restriction of data processing and finding inaccuracy data are critical issues that should be tackled in cloud-edge computing. Besides, since there are various types of devices and many of them are resource-constrained, how to efficiently apply deployment in cloud-edge computing is challenging for practice. In this work, we propose a new cryptographic primitive Controllable Outsourced Attribute-Based Proxy Re-Encryption (COAB-PRE) and a universal WebAssembly-based implementation framework for cross-platform deployment. In particular, COAB-PRE achieves bilateral and distributed access control whereby data producers and data consumers can both specify policies the other party must satisfy without a centralized access control server. The property, that we called controllable delegation, restricts the data processing on the edge nodes. COAB-PRE also supports comprehensive verifiability to find out a wrong result produced by the edge nodes and locate the misbehaved one. Moreover, we further discussed the potential property of COAB-PRE and put forward an improved scheme with high efficiency on devices. We also implemented our scheme using the approach and deployed it on different devices for experiment. All theoretical and experimental results indicate that our solution is secure and practical, and our implementation is suitable for cloud-edge computing.

Abstract Gaussian sampling over the integers is one of the fundamental building blocks of lattice-based cryptography. Among the extensively used trapdoor sampling algorithms, it is ineluctable until now. Under the influence of numerous side-channel attacks, it is still challenging to construct a Gaussian sampler that is generic, efficient, and resistant to timing attacks. In this paper, our contribution is three-fold. First, we propose a secure, efficient exponential Bernoulli sampling algorithm. It can be applied to Gaussian samplers based on rejection samplings. We apply it to FALCON, a candidate of round 3 of the NIST post-quantum cryptography standardization project, and reduce its signature generation time by 13–14%. Second, we develop an isochronous Gaussian sampler based on rejection sampling. Our Algorithm can securely sample from Gaussian distributions with different standard deviations and arbitrary centers. We apply it to PALISADE (S&P 2018), an open-source lattice-based cryptography library. During the online phase of trapdoor sampling, the running time of the G-lattice sampling algorithm is reduced by 44.12% while resisting timing attacks. Third, we improve the efficiency of the COSAC sampler (PQC 2020). The new COSAC sampler is 1.46x–1.63x faster than the original and has the lowest expected number of trials among all Gaussian samplers based on rejection samplings. But it needs a more efficient algorithm sampling from the normal distribution to improve its performance.

With more and more data moving to the cloud, privacy of user data have raised great concerns. Client-side encryption/decryption seems to be an attractive solution to protect data security, however, the existing solutions encountered three major challenges: low security due to encryption with low-entropy PIN, inconvenient data sharing with traditional encryption algorithms, and poor usability with dedicated software/plugins that require certain types of terminals. This work designs and implements WebCloud, a practical browser-side encryption solution, leveraging modern Web technologies. It solves all the above three problems while achieves several additional remarkable features: robust and immediate user revocation, fast data processing with offline encryption and outsourced decryption. Notably, our solution works on any device equipped with a Web user agent, including Web browsers, mobile and PC applications. We implement WebCloud based on ownCloud for basic file management utility, and utilize WebAssembly and Web Cryptography API for complex cryptographic operations integration. Finally, comprehensive experiments are conducted with many well-known browsers, Android and PC applications, which indicates that WebCloud is cross-platform and efficient. As an interesting by-product, the design of WebCloud naturally embodies a dedicated and practical ciphertext-policy attribute-based key encapsulation mechanism (CP-AB-KEM) scheme, which can be useful in other applications.

Searchable Symmetric Encryption (SSE) is a key tool for secure data processing. To date, most of the SSEs were studied alone, while an SSE supporting update operations over encrypted data remained a challenging problem due to various statistical attacks and multi-user environments. In this article, we proposeSeUpdate, the first SSE scheme that simultaneously achieves keyword search and controlled update over encrypted data, with flexible read (search) and write (update) access control policies among multiple users. InSeUpdate, users do not need to share secret keys and a single query enables one to efficiently search all his authorized data. We formally define a security model, and prove our scheme have both forward and backward security. We note that the write permission of an SSE is realized for the first time. We further extend the basic scheme with dynamic access policy update and support of a large number of files. We also implementSeUpdateand some related work. The theoretical and experimental analyses demonstrate our scheme and its extension are practical and efficient.

Metadata plays an essential role in facilitating data organizing, finding, and understanding, but it also contains lots of sensitive information about the data and the data users, e.g., the location where a picture was taken. In practice, when sensitive data is encrypted before being uploaded to untrusted public clouds, an oblivious dilemma comes: if the metadata is totally encrypted, and its functionalities no longer exist; otherwise, sensitive information may be leaked. Hence, a secure and flexible mechanism for processing different fields (marked private or public for different scenario needs) of metadata simultaneously is desirable. We searched the literature for methods of achieving such a goal, it turned out that this was not explicitly considered or reasonably solved before. Therefore, in this paper, we investigate the problem of constructing privacy-enhancing metadata, namely, 1) flexible and tamper-resistant metadata setting, 2) owner-enabled secure search authorization with explicit metadata. Based on the concept of public key encryption with keyword search (PEKS), we propose a novel Authorized Keyword Search over Encrypted Data with Metadata scheme (MD-AKS), which firstly well addressed the above demands. We formalize the security model and prove the security of MD-AKS scheme. Our work maximizes the flexibility of metadata setting in two aspects: the associated metadata can be set as an arbitrary string and the costs of clients are independent of explicit metadata’s complexity. We implement MD-AKS, the theoretical comparison and experiment results further demonstrate the usability and scalability.

As an innovative technique for cloud storage services, attribute based encryption (ABE) enables fine-grained access control over encrypted data in many cloud computing applications. However, there exist two main drawbacks that restrict the development of ABE. One is that most of the existing user revocation mechanisms cannot achieve high efficiency, immediacy and robustness simultaneously. Another is that the decryption of ABE contains expensive pairing operations which often grow with the complexity of access policy. In this work, we propose a practical server-aided revocable fine-grained access control mechanism with the help of cloud’s storage, computing and management capabilities, which not only achieves efficient fine-grained attribute based access control, but also actualizes immediate and robust user revocation. Moreover, most of the complicated operations in decryption are outsourced to the public cloud server, leaving one exponentiation for the users. At last, we implement our proposed mechanism with$\mathsf{Charm}$Charmframework. The benchmark results demonstrate the high efficiency and practicality of our proposed mechanism.

Many enterprises and individuals prefer to outsource data to public cloud via various pricing approaches. One of the most widely-used approaches is the pay-as-you-go model, where the data owner hires public cloud to share data with data consumers, and only pays for the actually consumed services. To realize controllable and secure data sharing, ciphertext-policy attribute-based encryption (CP-ABE) is a suitable solution, which can provide fine-grained access control and encryption functionalities simultaneously. But there are some serious challenges when applying CP-ABE in pay-as-you-go. First, the decryption cost in ABE is too heavy for data consumers. Second, ABE ciphertexts probably suffer distributed denial of services (DDoS) attacks, but there is no solution that can eliminate the security risk. At last, the data owner should audit resource consumption to guarantee the transparency of charge, while the existing method is inefficient. In this work, we propose a general construction named fully accountable ABE (FA-ABE), which simultaneously solves all the challenges by supporting all-sided accountability in the pay-as-you-go model. We formally define the security model and prove the security in the standard model. Also, we implement an instantiate construction with the self-developed library$\mathsf{ libabe}$. The experiment results indicate the efficiency and practicality of our construction.

Leakages during the signing process, including partial key exposure and partial (or complete) randomness exposure, may be devastating for the security of digital signatures. In this work, we investigate the security of lattice-based Fiat-Shamir signatures in the presence of randomness leakage. To this end, we present a generic key recovery attack that relies on minimum leakage of randomness, and then theoretically connect it to a variant of Integer-LWE (ILWE) problem. The ILWE problem, introduced by Bootle et al. at Asiacrypt 2018, is to recover the secret vector s given polynomially many samples of the form (a, 〈a〉, s)+e) ϵ ℤn+1, and it is solvable if the error e ϵ ℤ is not superpolynomially larger than the inner product (a, s). However, in our variant (we call the variant FS-ILWE problem in this paper), a ϵ ℤnis a sparse vector whose coefficients are NOT independent any more, and e is related to a and s as well. We prove that the FS-ILWE problem can be solved in polynomial time, and present an efficient algorithm to solve it. Our generic key recovery method directly implies that many lattice-based Fiat-Shamir signatures will be totally broken with one (deterministic or probabilistic) bit of randomness leakage per signature. Our attack has been validated by experiments on two NIST PQC signatures Dilithium and qTESLA. For example, as to Dilithium-III of 125-bit quantum security, the secret key will be recovered within 10 seconds over an ordinary PC desktop, with about one million signatures. Similarly, key recovery attacks on Dilithium under other parameters and qTESLA will be completed within 20 seconds and 31 minutes respectively. In addition, we also present a non-profiled attack to show how to obtain the required randomness bit in practice through power analysis attacks on a proof-of-concept implementation of polynomial addition. The experimental results confirm the practical feasibility of our method.

Abstract As the only approved Identity-Based Encryption scheme in China that is also standardized by ISO, SM9-IBE has been widely adopted in many real-world applications. However, similar to other IBE standard algorithms, SM9-IBE currently lacks revocation mechanism, which is vital for a real system. Worse still, we find that existing revocable techniques may not be suitable and efficient when applying to SM9-IBE. Given the widespread use of SM9-IBE, an efficient and robust user revocation mechanism becomes an urgent issue.In this work, we propose a dedicated server-aided revocation mechanism, which for the first time achieves the secure, immediate and robust user revocation for SM9-IBE. Provided with a compact system model, the proposed method leverages an existing server to perform all heavy workloads during user revocation, thus leaving no communication and computation costs for the key generation center and users. Moreover, the mechanism supports key-exposure resistance, meaning the user revocation mechanism is robust even if the revocation key leaks. We then formally define and prove the security. At last, we present theoretical comparisons and an implementation in terms of computational latency and throughput. The results indicate the efficiency and practicability of the proposed mechanism.

Sharing digital medical records on public cloud storage via mobile devices facilitates patients (doctors) to get (offer) medical treatment of high quality and efficiency. However, challenges such as data privacy protection, flexible data sharing, efficient authority delegation, computation efficiency optimization, are remaining toward achieving practical fine-grained access control in the Electronic Medical Record (EMR) system. In this work, we propose an innovative access control model and a fine-grained data sharing mechanism for EMR, which simultaneously achieves the above-mentioned features and is suitable for resource-constrained mobile devices. In the model, complex computation is outsourced to public cloud servers, leaving almost no complex computation for the private key generator (PKG), sender and receiver. Additionally, the communication cost of the PKG and users is optimized. Moreover, we develop an extensible library called libabe that is compatible with Android devices, and the access control mechanism is actually deployed on realistic environment, including public cloud servers, a laptop and an inexpensive mobile phone with constrained resources. The experimental results indicate that the mechanism is efficient, practical and economical.

SPHINCS was recently proposed as a stateless, quantum-resilient hash-based signature scheme. However, one possible limitation of SPHINCS is its signing speed, namely, the best known implementation merely produces a few hundred of signatures per second, which is not good enough, e.g., for a social website with a huge amount of users. Aiming at improving the singing throughput, we present highly parallel and optimized implementations of SPHINCS, which can be deployed on various multi-core platforms. As a first step, we give an elementary implementation on ×86/64 processors, which proves the effectiveness and correctness of our implementations. To obtain a significantly higherthroughput, we implement SPHINCS on Graphics Processing Units (GPUs). Furthermore, we develop a few general and hardware-specific techniques to take full advantage of the computing power of targeted platforms. We instantiate the underlying hash functions with three primitives. Our comprehensive benchmark shows that our work outperforms all the state-of-the-art implementations of SPHINCS regarding throughput with reasonable latency, and has scalability on multiple cores and multiple GPU cards. For instance, forthe key generation algorithm instantiated with ChaCha running on a GeForce GTX 1080, we obtain 5152 signatures per second which is 7.88x speedup fasterthan a recent FPGA implementation. When upgrade to TITAN Xp, 6,651 signatures are generated in one second. With four TITAN Xp GPUs, the obtained throughput satisfies vast majority scenarios.

Many real world attacks often target the implementation of a cryptographic scheme, rather than the algorithm itself, and a system designer has to consider new models that can capture these attacks. For example, if the key can be tampered by physical attacks on the device, the security of the scheme becomes totally unclear. In this work, we investigate predicate encryption (PE), a powerful encryption primitive, in the setting of tampering attacks. First, we show that many existing frameworks to construct PE are vulnerable to tampering attacks. Then we present a new security notion to capture such attacks. Finally, we take Attrapadung’s framework in Eurocrypt’14 as an example to show how to “compile" these frameworks to tampering resilient ones. Moreover, our method is compatible with the original pair encoding schemes without introducing any redundancy.

Authenticated key exchange (AKE) is one of the most important applications in applied cryptography, where a user interacts with a server to set up a session key where pre-registered information (aka. authentication factor), such as a password or biometrics, of the user is stored. While single-factor AKE is widely used in practice, higher security concerns call for multi-factor AKE (MFAKE) schemes, e.g., combining both passwords and biometrics simultaneously. However, in some casually designed schemes, security is even weakened in the sense that leakage of one authentication factor will defeat the whole MFAKE protocol. Furthermore, an inevitable by-product arise that the usability of the protocol often drop greatly. To summarize, the existing multi-factor protocols did not provide enough security and efficiency simultaneously. In this paper, we make one step ahead by proposing a very efficient MFAKE protocol. We define the security model and give the according security analysis. We also implement our protocol on a smartphone and a cloud server. The theoretic comparisons and the experimental results show that our scheme achieves both security and usability.

Efficient cryptographic implementations with desired side-channel attacks (SCA) resistance are highly required, especially for those resources-constrained devices. In this paper, we propose a very compact AES hardware implementation scheme provably secure against 1st-order SCAs. Basically, our scheme is inspired by ideas of Redundant Tower Field (RTF for short) circuit due to Ueno et al. and of private circuits due to Ishai, Sahai and Wagner (ISW for short), and is therefore named ISW-RTF. In terms of security, practical attacks on real leakages from prototype implementation show that ISW-RTF scheme is secure against 1st-order attacks and 2nd-order zero-offset attacks as well. Results of t-test leakage detection of these leakages also verify this observation. In terms of efficiency, compared with the state-of-the-art 1st-order masking scheme, our scheme outperforms at least 55.08% decreases in area, and 34.87% decreases in area-time product on three popular FPGA/ASIC devices. To the best of our knowledge, the proposed ISW-RTF scheme is the most compact one provably secure against SCA.

We propose two ciphertext-policy attribute-based key encapsulation mechanism (CP-AB-KEM) schemes that for the first time achieve both outsourced encryption and outsourced decryption in two system storage models and give corresponding security analysis. In our schemes, heavy computations are outsourced to Encryption Service Providers (ESPs) or Decryption Service Providers (DSPs), leaving only one modular exponentiation computation for the sender or the receiver. Moreover, we propose a general verification mechanism for a wide class of ciphertext-policy (cf. key-policy) AB-KEM schemes, which can check the correctness of the outsourced encryption and decryption efficiently. Concretely, we introduce a stronger version of verifiability (cf.  [1] ) and a new security notion for outsourced decryption called exculpability, which guarantees that a user cannot accuse DSP of returning incorrect results while it is not the case. With all these mechanisms, any dispute between a user and an outsource computation service provider can be easily resolved, furthermore, a service provider will be less motivated to give out wrong results. Finally, we implement our schemes in Charm  [2] , and the results indicate that the proposed schemes/mechanisms are efficient and practical.

Most cryptographic implementations are vulnerable to side-channel attacks. Among the countermeasures, masking is the most popular one. In the field of provable secure masking schemes, it is a tough task to design a masking scheme for the multiplication with related multiplicands. Among all the corresponding solutions, the one proposed by Coronet al.in FSE 2013 achieves the best efficiency. Furthermore, in CRYPTO 2015, we claim that this scheme can be extended to secure any quadratic functions and therefore enables secure evaluation of S-box, which significantly outperforms any other methods. In this paper, we further promote the efficiency of Coron’s scheme by decreasing the random generations according to two observations. First, by modifying each pair of intermediate values on two sides of a diagonal line, half of all the required random values can be removed. Second, some randomness can be reused. All random values in one out of two lines can be replaced with the same random value. According to these two observations, we propose two new schemes. The first proposal improves the original scheme with a 50% randomness reduction and satisfies a stronger compositional security notion${d}$-SNI, while the second proposal improves the original scheme with a 50%–75% randomness reduction and satisfies a weaker compositional security notion${d}$-TNI. We give the security proof for both schemes. Moreover, we give an example of the masked Advanced Encryption Standard (AES) inversion circuits where both the first and second proposals are applied, significantly outperforming the original AES inversion with a 43%–57% saving of random generations. This indicates that our proposals can be used to build secure and efficient implementations of cryptographic algorithms.

Abstract For secure data sharing in the public cloud, attribute‐based encryption was introduced to simultaneously achieve data confidentiality and fine‐grained access control. In order to update access control of the attribute‐based encrypted data from delegation, attribute‐based proxy re‐encryption (AB‐PRE) was proposed accordingly. Most previous AB‐PRE schemes require that the proxy executes the re‐encryption honestly. However, the public cloud as a proxy may not meet the requirement because the encrypted data are delegated to the public cloud and out of control for data owners. In this paper, we introduce verifiability for AB‐PRE to check the correctness of the re‐encryption executed by the proxy. By introducing a commitment scheme and a key derivation function, we propose a generic construction of unidirectional single‐hop AB‐PRE with verifiable re‐encryption (AB‐VPRE) for both key‐policy and ciphertext‐policy settings, and the access structure can be monotonic and non‐monotonic. We prove the security and the verification soundness of our constructed AB‐VPRE scheme in the standard model and provide three instantiations. Compared with previous work on AB‐PRE, our proposed AB‐VPRE schemes require less computation and can efficiently detect the malicious behaviors of the proxy. Copyright © 2016 John Wiley & Sons, Ltd.

Abstract In side‐channel attacks, information about any intermediate data except the target data will be considered as noise, namely, the “algorithmic noise.” Algorithmic noise is always assumed to be independent of the target data. As a result, it is thought to be an equivalence of physical noise. Numerous investigations are built on this intuitive assumption. In this paper, we claim that this assumption is not always true and find the algorithm (e.g., SIMON) for which the algorithmic noise is dependent on the target data. On this condition, we reconsider the issue of success rate estimation and build a modified statistical model to accurately estimate the success rate when the algorithmic noise is dependent on the target data. Finally, experimental results for SIMON algorithm validate the soundness of our methodology. It is also worth mentioning that SIMON is a candidate proposed by the National Security Agency as the standard light‐weight block cipher. Copyright © 2016 John Wiley & Sons, Ltd.

Most of the known attribute-based encryption (ABE) schemes focused on the data contents privacy and the access control, but less attention was paid to the privilege control and the identity privacy problem. Recently in IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY (TIFS) (DOI:10.1109/TIFS.2014.2368352), Junget al.proposed an anonymous attribute-based encryption scheme for access privilege and anonymity, which exhibited a lot of interesting ideas and gave the proof in the standard model. However, after carefully revisiting the scheme, we found that any valid user can compute the system-wide master key and their proof has some mistakes, hence, it fails to meet their security definitions.

To tackle with physical attacks to real world cryptosystems, leakage resilient cryptography was developed. In this setting, the adversary is allowed to have access to the internal state of a cryptographic system, thus violates the black-box reduction used in cryptography. Especially when considering continual memory leakage (CML), i.e., there is no predetermined bound on the leakage of the internal information, the task is extremely tough. In this paper, we solve this problem by introducing a new primitive called updatable hash proof system (UHPS). A UHPS can be viewed as a special Hash proof system (HPS), which served as a fundamental tool in constructing public key encryption (PKE) schemes in both leakage-free and leaky settings. A remarkable property of UHPS is that by simply substituting the HPS component with a UHPS component in a PKE scheme, one obtains a new PKE scheme secure in the CML setting. Moreover, the resulting PKE scheme enjoys the same advantage of the original HPS-based PKE, for instance, still “compatible” with known transforms [ 8 , 20 , 24 , 32 ]. We then give instantiations of UHPS from widely-accepted assumptions, including the symmetric external Diffie-Hellman assumption and the d-linear assumption. Interestingly, we notice that when instantiated with concrete assumptions, the resulting chosen-ciphertext secure PKE scheme is by far the most efficient.

Attribute-based encryption (ABE) is a promising technique for fine-grained access control of encrypted data in a cloud storage, however, decryption involved in the ABEs is usually too expensive for resource-constrained front-end users, which greatly hinders its practical popularity. In order to reduce the decryption overhead for a user to recover the plaintext, Green et al. suggested to outsource the majority of the decryption work without revealing actually data or private keys. To ensure the third-party service honestly computes the outsourced work, Lai et al. provided a requirement of verifiability to the decryption of ABE, but their scheme doubled the size of the underlying ABE ciphertext and the computation costs. Roughly speaking, their main idea is to use a parallel encryption technique, while one of the encryption components is used for the verification purpose. Hence, the bandwidth and the computation cost are doubled. In this paper, we investigate the same problem. In particular, we propose a more efficient and generic construction of ABE with verifiable outsourced decryption based on an attribute-based key encapsulation mechanism, a symmetric-key encryption scheme and a commitment scheme. Then, we prove the security and the verification soundness of our constructed ABE scheme in the standard model. Finally, we instantiate our scheme with concrete building blocks. Compared with Lai et al.'s scheme, our scheme reduces the bandwidth and the computation costs almost by half.

Pay-TV broadcasting system is an extensively deployed application that charges users based on their subscription. To ensure security for the Pay-TV broadcasting application, a conditional access system (CAS) is designed to control TV channel/program access to only the authorized subscribers. Several key management schemes with a four-level hierarchical key structure have been proposed. In this paper, we point out a severe security weakness of these schemes against collusion attacks. Then we propose a new CAS scheme with a three-level hierarchical key structure using ciphertext-policy attribute-set-based encryption (ASBE), an extension of ciphertext-policy attribute-based encryption (CP-ABE). Our scheme achieves scalable, flexible, fine-grained, and most importantly, collusion-resistant access control for Pay-TV broadcasting applications. The proposed scheme is designed to support all operations in Pay-TV applications. We then provide a detailed analysis on security and performance of our scheme. We also implement the scheme and it is showed to be both efficient and flexible for Pay-TV broadcasting applications.

In a decentralized attribute-based encryption (ABE) system, any party can act as an authority by creating a public key and issuing private keys to different users that reflect their attributes without any collaboration. Such an ABE scheme can eliminate the burden of heavy communication and collaborative computation in the setup phase of multiauthority ABE schemes, thus is considered more preferable. Recently in IEEE Transactions Parallel Distributed Systems, Han et al. proposed an interesting privacy-preserving decentralized key-policy ABE scheme, which was claimed to achieve better privacy for users and to be provably secure in the standard model. However, after carefully revisiting the scheme, we conclude that their scheme cannot resist the collusion attacks, hence fails to meet the basic security definitions of the ABE system.

Denial of Service (DoS) attacks are serious threats for network societies. For dealing with DoS attacks, Jakobsson and Juels first proposed the notion of useful client puzzles (UCPs) which simultaneously decrease servers' burden and increase clients'. In ACM CCS'04, Diament, Lee, Keromytis, and Yung introduced the decryption-based UCPs. In this paper, we give a general framework for constructing such UCPs which is based on identity-based cryptography along with well-analyzed symmetric key authenticated encryption techniques (without random oracles). By using this framework, we can flexibly construct various UCPs according to different types of system requirements. We also give some instantiations: the first is a UCP based on the Boneh-Boyen Identity based encryption scheme, with provable security in the standard model. Another one is a UCP based on the Boneh-Gentry-Hamburg identity-based encryption scheme, which doesn't require pairings.