Abstract Quantum commitment schemes remain challenging to deploy in practice due to the high cost and fragility of quantum communication. Although recent advances have leveraged quantum channels to improve security and efficiency, these schemes often require substantial quantum interaction, limiting their practicality. To address these challenges, we follow the emerging paradigm of quantum-computation classical-communication (QCCC) protocols, which minimize quantum communication while preserving robust security guarantees. In this work, we construct a QCCC commitment scheme that achieves statistically hiding and computationally collapse-binding-a strong binding notion previously attainable only via collapsing hash functions, which are believed to be stronger than quantum collision-resistant hash functions. In order to circumvent the obstacle of quantum rewinding for an entirely quantum adversary, our construction introduces a novel cryptographic primitive, the quantum inaccessible entropy generator (qIEG), as a quantum analogue of the classical IEG framework developed by Haitner et al. [STOC ’09]. Notably, our approach relies on potentially weaker assumptions, marking a significant step toward practically deployable and theoretically robust quantum commitments in communication-constrained quantum settings.

Abstract Collision resistance is one of the most fundamental properties in cryptography. With the development of quantum computing, significant attention has been directed toward understanding the quantum query complexity of collision-finding problems in hash functions. The quantum query complexity of collision-finding in general non-uniform random functions remained an open problem until the recent work of Peng et al. (ASIACRYPT 2025), who nearly resolved it by introducing a novel parameter $$\gamma$$ γ . Based on this parameter, they established an upper bound of $$O(\gamma ^{1/6})$$ O ( γ 1 / 6 ) and a matching lower bound of $$\tilde{\Omega }(\gamma ^{1/6})$$ Ω ~ ( γ 1 / 6 ) . However, the quantum query complexity of finding multi-collisions in non-uniform random functions has remained open. A s -collision to a function f is a set of distinct input $$x_1,\dots , x_s$$ x 1 , ⋯ , x s such that $$f(x_1)=f(x_2)\dots =f(x_s)$$ f ( x 1 ) = f ( x 2 ) ⋯ = f ( x s ) . In this work, we address this challenge by similarly introducing a new generalized parameter $$\gamma _s$$ γ s . Based on this parameter, we establish nearly tight bounds—an upper bound of $$O(\gamma _s)$$ O ( γ s ) and a lower bound of $$\tilde{\Omega }(\gamma _s)$$ Ω ~ ( γ s ) —thereby nearly resolving this open problem. Moreover, although the existing results for 2-collisions do not generalize straightforwardly to the case of s -collision ( $$s>2$$ s > 2 ), we demonstrate that the result of Peng et al. can be viewed as a special case of our more general framework. This clearly establishes our work as a direct generalization of their contribution.

Abstract One-way quantum state generators (), which serve as the quantum analog of one-way functions (), have attracted significant interest due to their potential applications and the reduced assumption requirements compared to . This paper explores the applications of structured and presents several results: We construct efficiently samplable, statistically far but computationally indistinguishable pairs of distributions ( pairs) from secretly-verifiable with somewhat injectivity, which has implications for quantum commitment schemes; We demonstrate that somewhat injective can be derived from almost regular ; We also focus on a specific type of , termed , and prove that the existence of a single-copy-secure hard-core predicate for these is both necessary and sufficient for constructing pairs; Moreover, we propose a simple quantum commitment scheme based on the decisional assumption, offering improved parameter choices and flexibility over classical schemes. These findings contribute to the understanding and potential applications of in quantum cryptography.

The frequent security incidents of contracts indicate a pressing need to ensure contract security from deployment to running stages, but the state-of-the-art (SOTA) analysis methods cannot work well for three requirements.(i) Identify contract defective code snippets, while generating exploit call sequences to help developers fix them.(ii) Monitor abnormal call behaviors, especially for multiple continuous transactions.(iii) Validate numerous unexploitable detection results automatically because manual verification is labor-intensive.To tackle these problems, we propose SymX, a symbolic executionbased security analysis art accounting for contract development and running stages.The experiment results demonstrate that it can accurately identify 90.22% of contracts and 98.04% of call transactions, as well as validate misreports as intended, which is superior to SOTAs, thereby protecting contracts better during the contract lifecycle.Currently, SymX is available at https://github.com/Secbrain/SymX.

Abstract The semi-classical One-Way to Hiding (SC-O2H) lemma given by Ambainis et al. (CRYPTO 2019) is a crucial technique to solve the reprogramming problem in the quantum random oracle model (QROM), which can lead to quadratically better bounds for many cases involving guessing games. To achieve tighter bounds, Bindel et al. (TCC, 2019) introduced the double-sided One-Way to Hiding (DS-O2H) lemma, which avoids the loss of query times suffered by the SC-O2H lemma. However, the potential of the DS-O2H lemma to provide better bounds for guessing games has not been considered by far. In this paper, a new double-sided O2H lemma is proposed. By using it, we for the first time give fully tight bounds for several cases involving guessing games. In summary, we show the following results in the QROM: (i) The hardness of inverting a random oracle with the leakage of a one-way injective function can be tightly reduced to the hardness of inverting the involved one-way injective function. (ii) Duman et al. (PKC 2023) introduced the randomness recoverability and defined two transformations $$\textsf {ACWC}_0$$ ACWC 0 and $$\textsf {ACWC}$$ ACWC relative to random oracles. For $$\textsf {ACWC}_0$$ ACWC 0 , we prove that its security can be tightly reduced to the security of the underlying public key encryption (PKE) scheme with the randomness recoverability. For $$\textsf {ACWC}$$ ACWC , we design a variant $$\textsf {ACWC}_1$$ ACWC 1 , and prove that its security can be tightly reduced to the security of the underlying PKE scheme with the unique randomness recoverability (a property slightly stronger than randomness recoverability). (iii) The security of the modular Fujisaki-Okamoto () transformation introduced by Hofheinz et al. (TCC 2017), can be tightly reduced to the security of the underlying PKE scheme with the unique randomness recoverability. Additionally, assuming the underlying PKE scheme is unique randomness recoverable, we prove the security of -like transformations "Image missing" (TCC, 2017) in the QROM, and as far as we know, our proof is tighter than the currently best proof.

Multi-client delegatable computation over outsourced data is an important research area in the context of cloud computing. The main target of it is to produce a function value taken data owned by different users as input while assuring the correctness of the derived result efficiently verifiable. Multi-key homomorphic signature (MK-HS), which allows for computations over signed data originating from multiple users while providing authenticity for the output value, is considered as an elegant primitive to fulfill the above functionality. However, we figure out several deficiencies in the context of MK-HS: (1) the model of MK-HS inevitably induces the participation of a large set of distinct public keys during the procedures of evaluation and verification, which leads to high communication and computation complexity; (2) current MK-HS schemes based on standard assumptions cannot prevent insider corruption attack; (3) the signature succintness of existing MK-HS constructions is far from optimal. In this work, we aim to seek a more appropriate approach for realizing multi-client delegatable computation. Our main result is the introduction of a new model we callmessage-oriented key-homomorphic signatures($\mathsf {moKHS}$). This model provides more lightweight definitions and inherently resists to insider corruption attacks. Besides, we provide a$\mathsf {moKHS}$construction based on standard lattices which supports circuits of bounded polynomial depth, and it achieves weak security and input-independent efficiency (in an amortized sense). Furthermore, we present a transformation to obtain an adaptively-secure one from any weakly-secure$\mathsf {moKHS}$scheme. Notably, the signature obtained by our$\mathsf {moKHS}$scheme achievesoptimalsuccinctness in the sense that its size is independent of both the number of users involved in the computation and the input size of the program. All these improvements show that$\mathsf {moKHS}$is a more preferable candidate for applications of delegating computation involving multiple users.

Abstract Unique shortest vector problem (uSVP) plays an important role in lattice based cryptography. Many cryptographic schemes based their security on it. For the cofidence of those applications, it is essential to clarify the complexity of uSVP with different parameters. However, proving the NP-hardness of uSVP appears quite hard. To the state of the art, we are even not able to prove the NP-hardness of uSVP with constant parameters. In this work, we gave a lower bound for the hardness of uSVP with constant parameters, i.e. we proved that uSVP is at least as hard as gap shortest vector problem (GapSVP) with gap of $$O(\sqrt{n/\log (n)})$$ O ( n / log ( n ) ) , which is in $$NP \cap coAM$$ N P ∩ c o A M . Unlike previous works, our reduction works for paramters in a bigger range, especially when the constant hidden by the big-O in GapSVP is smaller than 1. Graphical abstract

Smart grid is gaining more and more attention as one of the typical applications of Internet of Things. However, in a distributed environment, how to guarantee the privacy of users in electricity trading while ensuring the efficiency of the transactions is one of the urgent issues to be solved. In this article, we propose a distributed attribute-based signature (DABS) scheme for distributed electricity trading, which can support users' free choice of trade objects without revealing their real identities. We construct a signature generation and verification method by taking advantage of the open and hard-to-tamper properties of blockchain to achieve signature verifiability independent of dynamic changes in attributes.To improve the update efficiency, we propose an improved scheme that enables the update complexity to be reduced from$O(n)$to$O(\log n)$, where$n$is the number of users. Finally, performance analysis and simulation experiments demonstrate the security and practicality of the DABS.

With the economic development of Ethereum, the frequent security incidents involving smart contracts running on this platform have caused billions of dollars in losses. Consequently, there is a pressing need to identify the vulnerabilities in contracts, while the state-of-the-art (SOTA) detection methods have been limited in this regard as they cannot overcome three challenges at the same time. (i) Meet the requirements of detecting the source code, bytecode, and opcode of contracts simultaneously; (ii) reduce the reliance on manual pre-defined rules/patterns and expert involvement; (iii) assist contract developers in completing the contract lifecycle more safely,e.g., vulnerability repair and abnormal monitoring. With the development of machine learning (ML), using it to detect the contract runtime execution sequences (called instances) has made it possible to address these challenges. However, the lack of datasets with fine-grained sequence labels poses a significant obstacle, given the unreadability of bytecode/opcode. To this end, we propose a method named VulHunter that extracts the instances by traversing the Control Flow Graph built from contract opcodes. Based on the hybrid attention and multi-instance learning mechanisms, VulHunter reasons the instance labels and designs an optional classifier to automatically capture the subtle features of both normal and defective contracts, thereby identifying the vulnerable instances. Then, it combines the symbolic execution to construct and solve symbolic constraints to validate their feasibility. Finally, we implement a prototype of VulHunter with 15K lines of code and compare it with 9 SOTA methods on five open source datasets including 52,042 source codes and 184,289 bytecodes. The results indicate that VulHunter can detect contract vulnerabilities more accurately (90.04% accurate rate and 85.60% F1 score), efficiently (only took 4.4 seconds per contract), and robustly (0% analysis failed rate) than the SOTA methods. Also, it can focus on specific metrics such as precision and recall by employing different baseline models and hyperparameters to meet the various user requirements,e.g., vulnerability discovery and misreport mitigation. More importantly, compared with the previous ML-based arts, it can not only provide classification results, defective contract source code statements, key opcode fragments, and vulnerable execution paths, but also eliminate misreports and facilitate more operations such as vulnerability repair and attack simulation during the contract lifecycle.

Abstract In this paper, we further explore the properties of the verifiable random functions in both a black-box and a non-black-box manner. The results are mainly following two parts: $\bullet $ Black-Box Barrier: It is set up for an impossibility result of black-box reduction from verifiable random functions to injective one-way functions and indistinguishability obfuscators, where the verifiable random functions are suggested to be domain-invariant (i.e. the support of the distribution of keys and the domain of the evaluation space are independent of the underlying building blocks). Our result illustrates how the non-domain-invariant constructions circumvent the black-box barriers for constructing verifiable random functions and sheds light on why it is so difficult to give a domain-invariant instantiation. $\bullet $ Non-Black-Box Construction: On the other hand, the verifiable unpredictable functions are constructed from a given primitive by a non-black-box technique called the hitting-set generator. To show it's a somewhat useful technique for constructing the verifiable unpredictable functions, we further derive a limitation of the black-box barrier by proving the barrier still holds between the given primitive and verifiable unpredictable functions. Our results not only analyse the properties of verifiable random functions theoretically, but also reveal the limitation of indistinguishability obfuscators in a black-box manner, and show the advantages by adopting non-black-box techniques.

Abstract Homomorphic message authentication codes (MACs) allow a user to outsource data to an untrusted server and verify the correctness of returned computation results over the outsourced data. Many cloud applications need delegation computations over outsourced data with dual capabilities. On one hand, they need to keep the outsourced data secret such that the server cannot trace and infer any sensitive information from the computation results. On the other hand, the user should be able to efficiently verify the computation results. Unfortunately, the state-of-the-art homomorphic MAC schemes are not so desirable due to either poor privacy or low verification efficiency. In this paper, we first put forward a new cryptographic primitive called privacy-preserving homomorphic MACs (PHMAC) that simultaneously provides data privacy and efficient verification. Then, we present a PHMAC construction capable for the evaluation of polynomials of fixed degree $d\geq 1$, in which the tag does not reveal any information of underlying authenticated data while being verifiable in constant time (in an amortized sense). As an application, we give a generic construction of homomorphic authenticated encryption (HAE) from proposed PHMAC and homomorphic encryption. Benefited from the functionalities of underlying PHMAC scheme, the derived HAE enjoys stronger authenticity and supports larger classes of functions than that of Lai et al. (Verifiable Computation on Outsourced Encrypted Data. In Computer Security—ESORICS 2014—19th European Symposium on Research in Computer Security, Wroclaw, Poland, September 7–11, Part I, pp. 273–291. Springer, Berlin). Such HAE enables verifiable delegation computations over growing outsourced encrypted data in an efficient way.

Healthcare blockchains provide an innovative way to store healthcare information, execute healthcare transactions, and build trust for healthcare data sharing and data integration in a decentralized open healthcare network environment. Although the healthcare blockchain technology has attracted broad interests and attention in industry, government and academia, the security and privacy concerns remain the focus of debate when deploying blockchains for information sharing in the healthcare sector from business operation to research collaboration. This article focuses on the security and privacy requirements for medical data sharing using blockchain, and provides a comprehensive analysis of the security and privacy risks and requirements, accompanied by technical solution techniques and strategies. First, we discuss the security and privacy requirements and attributes required for electronic medical data sharing by deploying the healthcare blockchain. Second, we categorize existing efforts into three reference blockchain usage scenarios for electronic medical data sharing, and discuss the technologies for implementing these security and privacy properties in the three categories of usage scenarios for healthcare blockchain, such as anonymous signatures, attribute-based encryption, zero-knowledge proofs, verification techniques for smart contract security. Finally, we discuss other potential blockchain application scenarios in healthcare sector. We conjecture that this survey will help healthcare professionals, decision makers, and healthcare service developers to gain technical and intuitive insights into the security and privacy of healthcare blockchains in terms of concepts, risks, requirements, development and deployment technologies and systems.

Abstract Signcryption originally proposed by Zheng (CRYPTO′97) is a useful cryptographic primitive that provides strong confidentiality and integrity guarantees. This article addresses the question whether it is possible to homomorphically compute arbitrary functions on signcrypted data. The answer is affirmative and a new cryptographic primitive, homomorphic signcryption (HSC) with public plaintext‐result checkability is proposed that allows both to evaluate arbitrary functions over signcrypted data and makes it possible for anyone to publicly test whether a given ciphertext is the signcryption of the message under the key. Two notions of message privacy are also investigated: weak message privacy and message privacy depending on whether the original signcryptions used in the evaluation are disclosed or not. More precisely, the contributions are two‐fold: (i) two different definitions of HSC with public plaintext‐result checkability is provided for arbitrary functions in terms of syntax, unforgeability and message privacy depending on if the homomorphic computation is performed in a private or in a public evaluation setting, (ii) two HSC constructions are proposed: one for a public evaluation setting and another for a private evaluation setting and security is formally proved.

Blockchain technology, whose most successful application is Bitcoin, enables non-repudiation and non-tamperable online transactions without the participation of a trusted central party. As a global ledger, the blockchain achieves the consistency of replica stored on each node through a consensus mechanism. A well-designed consensus mechanism, on one hand, needs to be efficient to meet the high frequency of online transactions. For example, the existing electronic payment systems can handle over 50,000 transactions per second (TPS), while Bitcoin can only handle an average of about 3TPS. On the other hand, it needs to have good security and high fault tolerance; that is, in the case when some nodes are captured by adversaries, the network can still operate normally. In this article, we establish a reputation system, called RTChain, to be integrated into the e-commerce blockchain to achieve a distributed consensus and transaction incentives. The proposed scheme has the following advantages. First, an incentive mechanism is used to influence the consensus behavior of nodes and the transaction behavior of users, which in turn influence the reputation scores of both nodes and users. That is, when a node correctly processes a transaction, it will receive the corresponding reputation value as a reward, and the reputation value will be reduced as punishment not only when the node is dishonest and violates the consensus agreement but also the transaction is not completed as required. Just like electronic transactions in the real world, the higher the reputation of the user, the more likely it is to be selected as the transaction partner. A user with a low reputation will be gradually eliminated in our system because it is difficult to complete the transaction. Second, RTChain uses a verifiable random function to generate the leader in each round, which guarantees fairness for all participants and, unlike PoW, does not consume a large amount of computing resources. Then our consensus mechanism selects the nodes with high reputation scores to reduce the number of nodes participating in the consensus, thus improving the consensus efficiency, so that RTChain’s throughput can reach 4,000TPS. Third, we built a reputation chain to implement the distributed storage and management of reputation. Finally, our consensus mechanism is secure against existing attacks, such as flash attacks, selfish mining attacks, eclipse attacks, and double spending attacks, and allows nodes that participate in the consensus to fail, as long as the reputation of the failure node does not exceed one-third of the total reputation. We build a prototype of RTChain, and the experimental results show that RTChain is promising and deployable for e-commerce blockchains.

Abstract Linearly homomorphic signatures (LHSs) allow any entity to linearly combine a set of signatures and to provide authentication service for the corresponding (combined) data. The public key of the current known LHSs from lattices in the standard model requires $O(l)$ matrices and $O(k)$ vectors, where $l$ is the length of file identifier and $k$ is the maximum data set size that linear functions support. In this paper, we construct two lattice-based LHS schemes with provable security in the standard model and both schemes can authenticate vectors defined over finite field. First, we present a basic LHS scheme satisfying selective security, based on the full-rank difference hash functions. Second, we modify the chameleon hash function constructed by (Cash, D., Hofheinz, D., Kiltz, E. and Peikert, C. (2010) Bonsai Trees, or How to Delegate a Lattice Basis. In Proc. EUROCRYPT 10, Monaco/French Riviera, May 30 to June 3, pp. 523–552. Springer, Berlin) to construct a linearly homomorphic chameleon hash function (LHCHF), which can be applied to all transformations from selectively secure LHS scheme that authenticates vectors defined over finite field $\mathbb{F}_{p}$ ($p=poly(n)$) to fully secure one, except for a new one that authenticates vectors defined over a small field. Starting from LHCFH and the basic scheme as above, we obtain a fully secure LHS scheme. Both schemes can be used to sign multiple files and have relatively short public keys consisting of $O(1)$ matrices and $O(k)$ vectors.

Abstract Modular exponentiation, as a fundamental operation used in many public-key cryptosystems, has always be considered to be very time-consuming. It is difficult for some devices with limited computation capability, such as mobile devices and low-cost radio frequency identification (RFID) tags, to perform large-scale modular exponentiations. In cryptosystems, one typical case of modular exponentiation is that the modulus is a composite number. For instance, in RSA algorithm, the modulus is the product of two distinct prime numbers. In this paper, we investigate how to securely and efficiently outsource composite modular exponentiations and put forward two secure outsourcing algorithms for composite modular exponentiations based on single untrusted cloud. The first algorithm, named MCExp, is designed for outsourcing single composite modular exponentiation, i.e. $u^a$ mod $N$. The second algorithm, named SMCExp, is designed for outsourcing simultaneous composite modular exponentiation, i.e. $\prod ^{n}_{i=1}u^{a_i}_{i}$ mod $N$. Different from algorithms based on two untrusted servers, the proposed algorithms are very practical because they avoid the strong assumption that there must exist two servers without collusion. The proposed algorithms not only protect the privacy of the exponent and the base simultaneously, but also enable users to verify the correctness of the result returned by the cloud with high probability. Compared with using the square-and-multiply algorithm, the user can achieve higher efficiency by using the proposed algorithms. Besides, we prove the security of our algorithms and conduct several experiments to demonstrate the efficiency of the proposed algorithms. Finally, we show that the proposed algorithms can be used to construct the secure outsourcing algorithms for Shamir’s identity-based signature and identity-based multi-signature.

Homomorphic signature is an extremely important public key authentication technique for network coding to defend against pollution attacks. As a public key cryptographic primitive, it also encounters the same problem of how to confirm the relationship between some public key pk and the identity ID of its owner. In the setting of distributed network coding, the intermediate and destination nodes need to use the public key of source node S to check the validity of vector-signature pairs. Therefore, the binding of S and its corresponding public key becomes crucial. The popular and traditional solution is based on certificates which are issued by a trusted certification authority (CA) center. However, the generation and management of certificates is extremely cumbersome. Hence, in recent work, Lin et al. proposed a new notion of identity-based homomorphic signature, which intends to avoid using certificates. But the key escrow problem is inevitable for identity-based primitives. In this article, we propose another new notion (for network coding): certificateless homomorphic signature (CLHS), which is a compromise for the above two techniques. In particular, we first describe the definition and security model of certificateless homomorphic signature. Then based on bilinear map and the computational Diffie-Hellman (CDH) assumption, give a concrete implementation and detailedly analyze its security. Finally, performance analysis illustrates that our construction is practical.

With the thriving of mobile app markets, third-party libraries are pervasively used in Android applications. The libraries provide functionalities such as advertising, location, and social networking services, making app development much more productive. However, the spread of vulnerable and harmful third-party libraries can also hurt the mobile ecosystem, leading to various security problems. Therefore, third-party library identification has emerged as an important problem, being the basis of many security applications such as repackaging detection, vulnerability identification, and malware analysis. Previously, we proposed a novel approach to identifying third-party Android libraries at a massive scale. Our method uses the internal code dependencies of an app to recognize library candidates and further classify them. With a fine-grained feature hashing strategy, we can better handle code whose package and method names are obfuscated than historical work. We have developed a prototypical tool called LibD and evaluated it with an up-to-date dataset containing 1,427,395 Android apps. Our experiment results show that LibD outperforms existing tools in detecting multi-package third-party libraries with the presence of name-based obfuscation, leading to significantly improved precision without the loss of scalability. In this paper, we extend our early work by investigating the possibility of employing effective and scalable library detection to boost the performance of large-scale app analyses in the real world. We show that the technique of LibD can be used to accelerate whole-app Android vulnerability detection and quickly identify variants of vulnerable third-party libraries. This extension paper sheds light on the practical value of our previous research.

We propose a fully homomorphic encryption (FHE) scheme that encrypts matrices. Our scheme supports homomorphic matrix addition, multiplication and Hadamard product. In PKC 2015, Hiromasa et al. constructed the only FHE scheme that encrypts matrices and supports homomorphic matrix addition and multiplication. Compared with their work, the advantages of our scheme are the following: (1) Small ciphertext size: For a plaintext matrix M∈{0,1}r×r⁠, the size of ciphertext matrix is r×(n+r)⁠, in contrast to (n+r)×(n+r)⌈logq⌉ in their work. (2) Standard assumption: The security is based on LWE assumption merely, while the security of scheme in their work depends additionally on some special kind of circular security assumption. (3) Supporting homomorphic matrix Hadamard product. We show how to apply the proposed scheme to optimize the bootstrapping procedure of Alperin-Sheriff and Peikert, in a way similar to the work of Hiromasa, Abe and Okamoto. Due to smaller ciphertext matrices, the bootstrapping key of our optimized bootstrapping procedure is smaller than that in the work of Hiromasa, Abe and Okamoto by a factor of (n/r+1)⌈logq⌉⁠.

Fully data using only public information. So far, most FHE schemes are CPA secure. In PKC 2017, Canetti et al. extended the generic transformation of Boneh, Canetti, Halevi and Katz to turn any multi-key identity-based FHE scheme into a CCA1-secure FHE scheme. Their main construction of multi-key identity-based FHE is from probabilistic indistinguishability obfuscation (PIO) and statistical trapdoor encryption. We show that the above multi-key identity-based FHE is not secure by giving an attack. Then we give a solution to avoid the attack and redesign a more succinct and efficient multi-key identity-based FHE scheme. Compared with the scheme of Canetti et al., ours has smaller secret key of one identity and more efficient homomorphic operations. Thus we obtain a more efficient CCA1 secure FHE scheme.

Outsourcing medical data and their search services to a third party cloud have been a popular trend for many medical practices, because using healthcare cloud services can help cut down the cost of Electronic Health Records (EHR) systems in terms of front-end ownership cost and IT maintenance burdens. Healthcare cloud applications need searchable encryption with the following two capabilities for protecting data privacy and access privacy: (1) the healthcare providers need to share the encrypted data with authorized users and enable querying over encrypted data, and (2) they also need to keep the query keywords and associated search operations private such that healthcare data hosting service providers cannot gain access to unauthorized content or trace and infer sensitive data stored in the healthcare cloud. This survey paper describes the notion of searchable encryption (SE) in the context of healthcare applications and characterize the SE use cases into four scenarios in healthcare. Then we provide a comprehensive overview of the four representative SE techniques: searchable symmetric encryption (SSE), public key encryption with keyword search (PEKS), attribute-based encryption with keyword search (ABKS), and proxy re-encryption with keyword search (PRES) according to different EHR retrieving scenarios and requirements. We categorize and compare the different SE schemes in terms of their security, efficiency, and functionality. The survey is designed to benefit both experienced researchers in the computer science (CS) field and non-specialists who are domain scientists or healthcare professionals with limited CS and information security background. Thus, we are in favor of technological overview of the state of art searchable encryption models and the underlying key techniques, instead of detailed proofs and constructions of the respective SE algorithms. We describe how the existing SE schemes relate to and differ from one another, and point out the connections between the SE techniques and the security and privacy requirements of healthcare applications and the open research problems.

With the thriving of the mobile app markets, third-party libraries are pervasively integrated in the Android applications. Third-party libraries provide functionality such as advertisements, location services, and social networking services, making multi-functional app development much more productive. However, the spread of vulnerable or harmful third-party libraries may also hurt the entire mobile ecosystem, leading to various security problems. The Android platform suffers severely from such problems due to the way its ecosystem is constructed and maintained. Therefore, third-party Android library identification has emerged as an important problem which is the basis of many security applications such as repackaging detection and malware analysis. According to our investigation, existing work on Android library detection still requires improvement in many aspects, including accuracy and obfuscation resilience. In response to these limitations, we propose a novel approach to identifying third-party Android libraries. Our method utilizes the internal code dependencies of an Android app to detect and classify library candidates. Different from most previous methods which classify detected library candidates based on similarity comparison, our method is based on feature hashing and can better handle code whose package and method names are obfuscated. Based on this approach, we have developed a prototypical tool called LibD and evaluated it with an update-to-date and large-scale dataset. Our experimental results on 1,427,395 apps show that compared to existing tools, LibD can better handle multi-package third-party libraries in the presence of name-based obfuscation, leading to significantly improved precision without the loss of scalability.

The introduction of verifiable computation came as a result of the increasingly common phenomenon of "outsourcing" computation to untrusted servers and also to the growing desire of weak clients to outsource computational tasks to more powerful computation services like in cloud computing. Verifiable computation enables a computer to offload the computation of some function, to other perhaps untrusted cloud servers, while maintaining verifiable results. The servers evaluate the function and return the result with a proof that the computation of the function was carried out correctly. In the previous setting of verifiable computation, there is only one data provider. But in practice, there exist scenarios such as a network of sensors where each sensor collects data (e.g. air temperature in a certain area of a city) and stores them on servers. A control unit performs computation (e.g. the average air temperature of the city in certain period) on the outsourced data on the cloud (e.g. Amazon Cloud). When the control unit receives the results, it wants to verify the correctness of the computation results returned by the servers. For this scenario, we define a novel two-server multiclient verifiable computation service framework for outsourced data. An efficient construction is proposed, whose security is based on the existence of one-way functions. There are two advantages in our construction: (1) The size of the proof vouching for the correctness of computation result is independent with the number of data providers. (2) The verification only needs two equality tests executed by one who wants to get the computation result. We also experimentally analyze our construction and show our construction is very efficient in practice.

Outsource encrypted data has attracted attentions from industry and academics for storing sensitive data in third party clouds. Many cloud applications need privacy preserving multiple keywords search services over encrypted data with dual capabilities. On one hand, they need to keep the query keywords and associated search operations private such that data hosting service providers cannot trace and infer sensitive data stored in the third party data hosting servers. On the other hand, they need to support multiple keywords search to significantly improve the search efficiency. However, current keyword search protocols for encrypted data are not practical with poor privacy and low efficiency. In this paper, we propose a new oblivious multiple keywords search (OMKS) service, which provides privacy for both users and cloud storage service provider and supports efficient multiple keywords search. Compared to previous oblivious keyword search (OKS) protocols, our protocols maintain strong privacy, i.e., database security and query privacy, and effectively support disjunctive and conjunctive keywords search. The analysis and experiments show that OMKS protocols significantly reduce the storage and communication overhead. Moreover, the computation overhead of conjunctive search is not increased with the number of query keywords such that it can performs highly efficient conjunctive keywords search.

Network coding is a routing technique that differs from traditional ‘store-and-forward’ mechanisms. It allows intermediate nodes to modify packets in transit. It is well known that network coding can increase throughput and improve robustness in network. However, it is the messages mixing feature that makes network coding susceptive to pollution attacks. To address this problem, homomorphic message authentication codes (MACs) have been proposed. The existing homomorphic MAC schemes adopt inner product to authenticate a message with a tag over a field Fq⁠. In practical instantiations, the size of the field Fq is normally chosen (or desired) to be small (typically set as 28) to limit computational and communication overheads. In these settings, an adversary will break the schemes with probability at least 1/q (typically 1/28⁠). The security is not guaranteed in this case. To waver the limitations and enhance the security, multiple tags are adopted for each message, that certainly incurs large key size overhead and is not preferred in applications. A scheme of homomorphic MAC with preferring security and shorter keys is much expected, and till now, to our knowledge, is not successfully constructed. This work solves this problem by presenting a new homomorphic MAC scheme for authentication in network coding. The proposed scheme allows us to authenticate a message in a linear space over a field of moderate size and at the same time, achieves a reliable security with a short key. The construction is based on a recently invented somewhat public-key notion: algebraic one-way function, by Catalano et al. (TCC 2013). Compared to the existing schemes, our scheme possesses the advantages that it achieves stronger security with much shorter keys, and is practical in applications. Hence resolve the longstanding problem.

Outsource encrypted data is a popular trend for storing sensitive data in third party clouds. Many cloud applications need privacy preserving data encryption services with two capabilities: On one hand, they need querying over encrypted data in Web based data hosting services. On the other hand, they also need to keep the query keywords and associated search operations private such that data hosting service providers cannot gain access to unauthorized content or trace and infer sensitive data stored in the third party data hosting servers. In this paper we present a novel service oriented framework for verifiable searchable asymmetric encryption, called PVSAE. PVSAE offers strong support for outsourced encrypted data with two formal security properties in terms of IND-CKA security and search pattern privacy. Our framework supports two concrete PVSAE schemes. The first scheme l-PVSAE is based on the l-dimensional vectors and achieves strong security notions, namely statistical IND-CKA security and statistical search pattern privacy. The second scheme 3-PVSAE is a light-weight version based on 3-dimensional vectors. 3-PVSAE maintains the strong security properties and offers higher efficiency for search over encrypted data compared with existing verifiable searchable asymmetric encryption schemes. We experimentally evaluate the proposed PVSAE schemes and show that they not only offer strong security but also are practical and deployable.

In this paper, we present a pollution attack on the homomorphic message authentication code scheme PMAC, which was proposed, by Cheng, Jiang, and Zhang in [IEEE Journal on Selected Areas in Communications/Supplement 2013; 319: 291-298]. In particular, Cheng et al. claimed that their main contribution lies in that, compared with the existing scheme, such as SpaceMac, PMAC can achieve a reliable security 1/qi?ź instead of 1/q for SpaceMac, where q is usually set as a small number in practical applications and i?ź is a flexible parameter chosen by users to improve their security level. However, by presenting a pollution attack, we prove that PMAC can only achieve the security at most 1/q no matter how large i?ź is. Our attack shows that it may be dangerous to directly use PMAC in the peer-to-peer live streaming systems. Moreover, we also point out a basic but fatal error in their proof of theorem 1 and hope that by identifying the design flaw, similar mistakes can be avoided in future design of homomorphic message authentication code. Copyright © 2016 John Wiley & Sons, Ltd.

Abstract The circular security of public key encryptions has been drawn great attentions in recent years. The relationship of notions between circular securities and standard ones such as chosen plaintext security (CPA‐security) and chosen ciphertext security (CCA‐security) deserve to be clarified. For any integer n > 0 and n ≠ 2, whether the notions of n‐circular securities can be implied by that of their standard correspondences, such as CPA or CCA security in public key setting, has largely remained open. Koppula, Ramchen, and Waters in TCC'15 recently made a separation in CPA case by proposing a CPA secure scheme that is not n‐circular secure based on the recent candidate constructions of indistinguishable obfuscation. In this work, we consider the CCA case. In particular, inspired by the indistinguishable‐obfuscation‐based construction of Koppula et al., we obtain the following results: We make a separation between the n‐circular CCA security and CCA security for anyn>0. Specifically, we propose a hybrid encryption scheme that achieves the CCA security but fails even in the n‐circular CPA security. Hence, that makes a separation between the CCA security and the n‐circular CCA security (and even the n‐circular CPA security). By revising the previous construction, we also present a CCA secure (hybrid encryption) scheme, which allows an adversary to recover all secret keys when obtaining an encrypted key cycle. Hence, that implies that: if a key cycle arises in a system, then a passive adversary might be able to recover all secret keys even if CCA‐secure encryptions are used. The results in this work, together with that of Koppula et al., confirm that notions of circular securities are stronger than their standard correspondences. Copyright © 2016 John Wiley & Sons, Ltd.

Querying over encrypted data is gaining increasing popularity in cloud-based data hosting services. Security and efficiency are recognized as two important and yet conflicting requirements for querying over encrypted data. In this article, we propose an efficient private keyword search (EPKS) scheme that supports binary search and extend it to dynamic settings (called DEPKS ) for inverted index--based encrypted data. First, we describe our approaches of constructing a searchable symmetric encryption (SSE) scheme that supports binary search. Second, we present a novel framework for EPKS and provide its formal security definitions in terms of plaintext privacy and predicate privacy by modifying Shen et al.’s security notions [Shen et al. 2009]. Third, built on the proposed framework, we design an EPKS scheme whose complexity is logarithmic in the number of keywords. The scheme is based on the groups of prime order and enjoys strong notions of security, namely statistical plaintext privacy and statistical predicate privacy. Fourth, we extend the EPKS scheme to support dynamic keyword and document updates. The extended scheme not only maintains the properties of logarithmic-time search efficiency and plaintext privacy and predicate privacy but also has fewer rounds of communications for updates compared to existing dynamic search encryption schemes. We experimentally evaluate the proposed EPKS and DEPKS schemes and show that they are significantly more efficient in terms of both keyword search complexity and communication complexity than existing randomized SSE schemes.

Abstract An encryption scheme is key‐dependent message chosen plaintext attack (KDM‐CPA) secure if it is secure even against an attacker who has access to encryptions of messages that depend on the secret key. Such situations naturally occur in some scenarios such as formal calculus, hard‐disk encryption, or multi‐party protocols. However, up to now, there are not many schemes that achieve KDM‐CPA security, let alone KDM chosen ciphertext attack (KDM‐CCA) security. The constructions proposed by Camenisch, Chandran, and Shoup (Eurocrypt 2009), and Hofheinz (Eurocrypt 2013) are the only two general constructions that can be proved to be KDM‐CCA secure in the standard model. Besides, Qin, Liu, and Huang (ACISP 2013) also presented another concrete implementation. In particular, they showed how to obtain KDM‐CCA security from the classic Cramer–Shoup cryptosystem (based on the decisional Diffie–Hellman assumption) w.r.t. a new ensemble of functions (we call QLH ensemble). Since the Cramer–Shoup scheme has short ciphertext size and higher computational efficiency, they obtain practical KDM‐CCA security w.r.t. a reasonably large ensemble. In this paper, we study the KDM‐CCA security of other cryptosystems proposed by Cramer and Shoup (Eurocrypt 2002). In particular, we prove that the schemes, based on decisional composite residuosity (DCR) and quadratic residuosity (QR) assumptions, respectively, also achieve KDM‐CCA security w.r.t. the QLH ensemble. On the one hand, because the DCR‐based and QR‐based schemes of Cramer et al. are fairly practical, we also obtain practical KDM‐CCA security based on DCR and QR assumptions, respectively. On the other hand, compared with the result of Qin et al., we need not tailor the original schemes of Cramer et al. because themselves have natural “compatibility” for the message space and the secret key space. Copyright © 2014 John Wiley & Sons, Ltd.

An encryption scheme is key-dependent message chosen plaintext attack (KDM-CPA) secure means that it is secure even if an adversary obtains encryptions of messages that depend on the secret key. However, there are not many schemes that are KDM-CPA secure, let alone key-dependent message chosen ciphertext attack (KDM-CCA) secure. So far, only two general constructions, due to Camenisch, Chandran, and Shoup (Eurocrypt 2009), and Hofheinz (Eurocrypt 2013), are known to be KDM-CCA secure in the standard model. Another scheme, a concrete implementation, was recently proposed by Qin, Liu and Huang (ACISP 2013), where a KDM-CCA secure scheme was obtained from the classic Cramer-Shoup (CS) cryptosystem w.r.t. a new family of functions. In this paper, we revisit the KDM-CCA security of the CS-scheme and prove that, in two-user case, the CS-scheme achieves KDM-CCA security w.r.t. richer ensembles, which covers the result of Qin et al. In addition, we present another proof about the result in (QLH13) by extending our approach used in two-user case to n-user case, which achieves a tighter reduction to the decisional Diffie-Hellman (DDH) assumption.

ABSTRACT Security and privacy are widely recognized as important requirements for access and management of electronic health record (EHR) data. In this paper, we argue that EHR data need to be managed with customizable access control in both spatial and temporal dimensions. We present a role‐based and time‐bound access control (RBTBAC) model that provides more flexibility in both roles (spatial capability) and time (temporal capability) dimensions to control the access of sensitive data. Through algorithmic combination of role‐based access control and time‐bound key management, our RBTBAC model has two salient features. First, we have developed a privacy‐aware and dynamic key structure for role‐based privacy aware access and management of EHR data, focusing on the consistency of access authorization (including data and time interval) with the activated role of user. In addition to role‐based access, a path‐invisible EHR structure is built for preserving privacy of patients. Second, we have employed a time tree method for generating time granule values, offering fine granularity of time‐bound access authorization and control. Our initial experimental results show that tree‐like time structure can improve the performance of the key management scheme significantly, and RBTBAC model is more suitable than existing solutions for EHR data management because it offers high‐efficiency and better security and privacy. Copyright © 2013 John Wiley & Sons, Ltd.

BigTable is a distributed storage system that is designed to manage large-scale structured data. Deploying BigTable in a public cloud is an economic storage solution to small businesses and researchers who need to deal with data processing tasks over large amount of data but often lack capabilities to obtain their own powerful clusters. As one may not always trust the public cloud provider, one important security issue is to ensure the integrity of data managed by BigTable running at the cloud. In this paper, we present iBigTable, an enhancement of BigTable that provides scalable data integrity assurance. We explore the practicality of different authenticated data structure designs for BigTable, and design a set of security protocols to efficiently and flexibly verify the integrity of data returned by BigTable. More importantly, iBigtable preserves the simplicity, applicability and scalability of BigTable, so that existing applications over BigTable can interact with iBigTable seamlessly with minimum or no change of code (depending on the mode of iBigTable). We implement a prototype of iBigTable based on HBase, an open source BigTable implementation. Our experimental results show that iBigTable imposes reasonable performance overhead while providing integrity assurance.

As an important cryptographic primitive, designated confirmer signatures are introduced to control the public verifiability of signatures. That is, only the signer or a semi-trusted party, called designated confirmer, can interactively assist a verifier to check the validity of a designated confirmer signature. The central security property of a designated confirmer signature scheme is called invisibility, which requires that even an adaptive adversary cannot determine the validity of an alleged signature without direct cooperation from either the signer or the designated confirmer. However, in the literature researchers have proposed two other related properties, called impersonation and transcript simulatability, though the relations between them are not clear. In this paper, we first explore the relations among these three invisibility related concepts and conclude that invisibility, impersonation and transcript simulatability forms an increasing stronger order. After that, we turn to study the invisibility of two designated confirmer signature schemes recently presented by Zhang et al. and Wei et al. By demonstrating concrete and effective attacks, we show that both of those two scheme fail to meet invisibility, the central security property of designated confirmer signatures.

Deniability is a privacy property that ensures protocol participants can later deny taking part in a particular protocol run. A deniable authentication protocol enables an intended receiver to identify the source of a given message, but not prove the identity of the sender to a third party even if the intended receiver is willing to reveal his secret-key. In this paper, we present an efficient ID-based deniable authentication protocol from pairings. The proposed protocol satisfies the correctness, authentication and deniability properties.

Ring authenticated encryption has the following security requirements: semantic-security, recipient-designation, verification-dependence, verification-convertibility, recipient-ambiguity, recipient-verifiability, signer-ambiguity and signer-verifiability. Ring authenticated encryption can be used to enhance user privacy. In this paper, based on Boneh and Frankliny's ID-based encryption scheme and Zhang and Kim's ID-based ring signature scheme, we propose an ID-based ring authenticated encryption scheme. We also show that the proposed scheme satisfies the correctness property and all security requirements.