Abstract In structure-preserving cryptography, every building block shares the same bilinear groups. These groups must be generated for a specific, a priori fixed security level, and thus, it is vital that the security reduction in all involved building blocks is as tight as possible. In this work, we present the first generic construction of structure-preserving signature schemes whose reduction cost is independent of the number of signing queries. Its chosen-message security is almost tightly reduced to the chosen-plaintext security of a structure-preserving public-key encryption scheme and the security of Groth–Sahai proof system. Technically, we adapt the adaptive partitioning technique by Hofheinz (Eurocrypt 2017) to the setting of structure-preserving signature schemes. To achieve a structure-preserving scheme, our new variant of the adaptive partitioning technique relies only on generic group operations in the scheme itself. Interestingly, however, we will use non-generic operations during our security analysis. Instantiated over asymmetric bilinear groups, the security of our concrete scheme is reduced to the external Diffie–Hellman assumption with linear reduction cost in the security parameter, independently of the number of signing queries. The signatures in our schemes consist of a larger number of group elements than those in other non-tight schemes, but can be verified faster, assuming their security reduction loss is compensated by increasing the security parameter to the next standard level.

Abstract Attribute-based encryption (ABE) is a form of public-key encryption that allows fine-grained access control on encrypted data. Blind key-generation (BKG) attribute-based encryption (Rial,Designs, Codes and Cryptography 2016) is a variant in which the master authority issues secret keys without learning any information about the attributes associated to them. This extra functionality makes it an appealing building block for several applications. In this work, we extend the generic framework of ABE based on pair encodings (Attrapadung,Eurocrypt 2014) to support blind key-generation. In particular, we define two new notions of pair encodings that we coinBKG-compatibleandalgebraicpair encoding. We show that every encoding satisfies the former without loss of generality, whereas the latter is satisfied by all existing pair encodings from the literature. We then show how to enhance any ABE based on a BKG-compatible pair encoding to achieve honest-but-curious blind key-generation. In the case of algebraic encodings, our protocol admits a very efficient version, secure against malicious parties. The main advantage of our work is generality. Our protocol is designed over the recent and most advanced modular frameworks of ABE that can handle a rich variety of predicates.

Abstract In this paper, we analyze the security of subset-resilient hash function families, which is first proposed as a requirement of a hash-based signature scheme called HORS. Let $${\mathcal {H}}$$ H be a family of functions mapping an element to a subset of size at most k . ( r , k )-subset resilience guarantees that given a random function H from $${\mathcal {H}}$$ H , it is hard to find an $$(r+1)$$ ( r + 1 ) -tuple $$(x,x_1,\ldots ,x_r)$$ ( x , x 1 , … , x r ) such that (1) H ( x ) is covered by the union of $$H(x_i)$$ H ( x i ) and (2) x is not equal to any $$x_i$$ x i . Subset resilience and its variants are related to nearly all existing stateless hash-based signature schemes, but the power of this security notion is lacking in research. We present three results on subset resilience. First, we show a generic quantum attack against subset resilience, whose time complexity is smaller than simply implementing Grover’s search. Second, we show that subset-resilient hash function families imply the existence of distributional collision-resistant hash function families. Informally, distributional collision resistance is a relaxation of collision resistance, which guarantees that it is hard to find a uniform collision for a hash function. This result implies a comparison among the power of subset resilience, collision resistance, and distributional collision resistance. Third, we prove the fully black-box separation from one-way permutations.

Abstract In some digital signature schemes, the signer needs to maintain a dynamic state while signing messages. These are called stateful signature schemes. Although stateful signature schemes are commonly used as cryptographic primitives, they do not fit the standard definition of a signature scheme in cryptography. In this work, formal and general definitions for stateful signature schemes are given. In the definitions of security notions, various scenarios are considered where the adversaries have different levels of control over the signing oracle in terms of messages and states. After that, generic constructions of stateful signature schemes with different security levels are provided. In addition, some black‐box constructions of stateful signature schemes that can be instantiated by primitives under any assumptions are given. Note that the constructions in this work are proven to be secure in standard models.

The problem of fair exchange consists of interchanging goods between two parties that do not trust each other. Despite known impossibility results, recent works leverage the block-chain and zero-knowledge proofs to implement zero-knowledge contingent payment (zkCP) systems that make fair exchange of digital goods possible. Implementing these systems in a secure and efficient way is a big challenge, as evidenced by several unsuccessful attempts from the literature. Campanelli et al. (ACM CCS 2017) discovered a vulnerability on an existing zkCP proposal based on SNARKs (succinct non-interactive arguments of knowledge) and suggested several repairs. Fuchsbauer (ACM CCS 2019) found a flaw in the mentioned countermeasures. In particular, he showed that witness-indistinguishability (WI) is not sufficient for the zkCP schemes proposed by Campanelli et al. to be secure. In this work, we observe that a slightly stronger notion of WI, that we coin trapdoor subversion WI (tS-WI), rules out Fuchsbauer's attack. We formally define security properties for CP systems and show that, under tS-WI, Campanelli et al.'s proposal indeed satisfies these properties. Additionally, we explore alternative approaches to implement ZK (other than SNARKs) and develop a prototype, using it to demonstrate their potential. Our new ideas result in a protocol to sell ECDSA signatures with contingent payment that can be executed in less than $150$ milliseconds over a LAN network.

This paper proposes a generic construction that yields encryption schemes that are secure against adaptive chosen ciphertext attacks. In particular, we focus on combining weak encryption schemes with proofs of knowledge made non-interactive through the use of a hash function. This type of conversion yields encryption schemes that allow anybody to verify the integrity of the ciphertexts. A typical example is a combination of ElGamal encryption with the Schnorr proof of knowledge, but a straightforward combination requires a stronger assumption than the random oracle assumption to prove the security. We first generalize a class of encryption schemes and proofs of knowledge to key-encapsulation schemes and signature schemes, and then present a secure way of combining them so that the security of the resulting scheme can be proven solely in the random oracle model.

This paper studies several of the properties necessary for public-key-based escrow schemes, and observes that previous schemes lack some important properties. Focusing on the type of communication typified by email, we construct a novel and simple scheme that provides ‘warrant bounds’, ‘admissibility’, ‘surveillance switching’, ‘non-directive monitoring’, ‘off-line agency’ and many other useful properties all at the same time.