Threshold private set intersection (t-PSI) protocol enables the secure determination of whether the intersection between two sets meets a specified threshold, facilitating privacy-preserving data collaboration in cloud computing for internet of things (IoT). However, existing t-PSI protocols face challenges in efficiency and scalability. To tackle these issues, we present novel t-PSI protocols for balanced and unbalanced settings, and further develop an augmented version—unbalanced quorum PSI (q-uPSI) protocol. For balanced settings, oblivious key-value store (OKVS) and additively homomorphic encryption (AHE) are used as foundational building blocks, with OKVS decoding and additively homomorphic operations replacing the costly fully homomorphic computations in previous t-PSI protocols, thus achieving linear communication and computation complexities. In unbalanced settings, we achieve sublinear communication and computation complexities with respect to the larger set by replacing certain fully homomorphic operations in the previous protocols with oblivious key-value retrieval (OKVR) and AHE. According to the experimental results, compared to the most advanced protocols available, our balanced t-PSI protocol demonstrates computation reduction from 83 95.8%. The unbalanced t-PSI protocol significantly reduces communication overhead while also improving computation efficiency. For the q-uPSI protocol, taking the number of servers is 10 as an example, we observe substantial communication improvements across all experimental parameters, with at least 83.13% reduction. Additionally, for specific parameters, the q-uPSI protocol achieves computation reduction ranging from 7.2 69.79%. Finally, we validate the security and efficiency of the proposed protocols in cloud IoT scenarios involving interest matching and medical record analysis. All protocols ensure security under the semi-honest adversarial model and provide more efficient solutions for secure IoT data sharing and collaboration in cloud environments.

Federated learning (FL) offers a decentralized approach for collaborative model training, making it a promising solution for data-driven optimization in Industrial Internet of Things (IIoT) environments. However, the sensitive nature of industrial data, combined with privacy concerns and security risks, poses significant challenges for FL deployment in IIoT applications. Specifically, the risks of gradient leakage, malicious client attacks, and insufficient privacy protection hinder the wide adoption of FL in IIoT. To address these challenges, this paper proposes a Robust Privacy-Enhanced Aggregation (RPEA) scheme for federated learning in IIoT, which ensures privacy protection for both model parameters and user data. The RPEA scheme is built on a distributed trust model across two servers, which execute gradient aggregation and model updates without revealing any intermediate results by using secret sharing and secure two-party computation. To further enhance security, we incorporate an l2 norm defense mechanism that protects against gradient boosting attack by securely computing the l2 norm of the gradients and filtering out malicious updates, thus ensuring the robust privacy and integrity of IIoT data. In terms of efficiency, RPEA optimizes both the preprocessing and online computing of l2 norm, significantly reducing both computation and communication overhead. Compared to the baseline method, RPEA achieves approximately a 30-fold speedup in l2 norm computation. Experimental results demonstrate that RPEA effectively defends against gradient inversion and boosting attacks, while maintaining high model accuracy, robustness, and privacy protection in federated learning model aggregation within IIoT environments.

In recent years, federated learning was proposed as a distributed training paradigm centered on privacy preservation that enables multiple participants to train models together without sharing their data. However, despite these advantages, federated learning still presents several potential privacy leakage issues in practical applications. These issues arise from factors such as data leakage during communication, which has attracted widespread attention. The use of a local differential privacy mechanism to perturb the model weights provides an effective way to implement privacy-preserving federated learning. However, the current scheme still suffers from the problem of introducing excessive noise, which in turn affects the proper training of the model. In this paper, we propose a perturbation mechanism called the adaptive piecewise mechanism (APM) by drawing on the design of a piecewise mechanism with a personalized local differential privacy mechanism (PWP). In addition, we mitigate the problem of explosion of the privacy budget of the overall scheme by applying a parameter shuffling mechanism. As a result, the model accuracy of the APM perturbation mechanism was improved by an average of 11.59%, 14.85% and 18.55% on the MNIST, Fashion-MNIST and Cifar-10 datasets, respectively, compared with those of the layer-based adaptive local differential privacy mechanism (LALDP).

With the increasing demand of consumers for food safety, the application of Internet of Things (IoT) in agriculture is more and more extensive, especially the use of technologies such as QR codes and sensors for food information traceability. However, the Internet of Things still faces challenges in ensuring the authenticity of food data transmission and the integrity of food anti-counterfeiting authentication, especially the traditional digital signature algorithm that the Internet of Things relies on is vulnerable to the security threat brought by future quantum computers. In order to solve this problem, we propose a domestic replacement solution for the post-quantum digital signature algorithm SPHINCS-α(an improvement of the standardized post-quantum digital signature scheme SPHINCS+), and use the chinese national standard cryptographic hash function Shang Mi 3 (SM3) to replace its underlying hash function. Finally, we conducted experiments, gave the benchmark test results under three security parameters, and compared the performance with the original scheme using SHA256 and Shake256 hash function. The results prove the feasibility of our method, although there is a small rate drop, but in exchange for a more secure domestic hash function. It provides strong support for the early deployment of post-quantum cryptography algorithm in the Internet of Things environment of sustainable agriculture and industry, and ensures the integrity of the Internet of Things data in the practice of sustainable agriculture.

The progress of deep learning has facilitated the widespread adoption of neural network (NN) inference in real-word applications, particularly in the Internet of Things (IoT). IoT devices, such as smart home appliances and industrial sensors, increasingly rely on NN inference to process data. However, IoT devices usually collect sensitive information, and NN models may contain proprietary algorithms. Therefore, ensuring the privacy of both data and models is essential. In this context, the development of efficient and private NN inference frameworks becomes even more critical. Binary Neural Network (BNN) stands out as a promising solution due to its low computational requirements and energy efficiency, which align well with the resource-constrained nature of many IoT devices. Nevertheless, existing private BNN inference approaches still face challenges in terms of computational and communication overhead. In this paper, we introduce EPBNN, an efficient and private BNN inference framework against a semi-honest adversary in a dealer-based offline-online setting. Our construction relies on secret sharing and advanced cryptographic primitives including function secret sharing (FSS) and lookup table (LUT). Specifically, we propose an LUT-based tailored protocol for maxpool layer, as well as an FSS-based protocol for batch normalization and binary activation layers, which enables an efficient online inference phase and makes EPBNN well-suited for IoT environments. Extensive evaluations demonstrate that EPBNN outperforms the state-of-the-art solution in terms of runtime (1.8-9.3× improvement), communication (up to 3.2× improvement), and round complexity.

As a basic primitive in spatial and multimedia databases, the$k$-nearest neighbors ($k$-NN) query has been widely used in electronic medicine, location-based services and so on. With the boom in cloud computing, it is currently a trend to upload massive data to the cloud server to enjoy its powerful storage and computing resources. Recently, research communities and commercial applications have proposed many schemes to support$k$-NN query on cloud data. However, most of the existing schemes were designed under the assumption that the query users (QUs) are fully trusted and hold the key of the data owner (DO). In this case, even if the queries were encrypted, the QUs can capture the query content from each other, leading to the query privacy leakage. Unfortunately, to the best of our knowledge, few$k$-NN query schemes can ensure data security and result verification under the key confidentiality condition. In this paper, we propose a verifiable and privacy-preserving$k$-NN query scheme with multiple keys (VP$k$NN), in which each QU's partial private key can only decrypt the encrypted query results belonging to its own, but not the encrypted database, the encrypted query data and query results of other QUs. Moreover, our proposal not only answers the query efficiently, but also ensures the privacy of the data, the query and the result, and the verification of the correctness of the results. Finally, the complexity and security are theoretically analyzed, and the practicality and efficiency of our proposed scheme are compared by simulation experiments.

Secure Multi-party Computation (MPC) is a highly active research field, with Private Set Intersection (PSI) being a classic subtopic within it. However, simple intersection computation is insufficient for many real-world scenarios, leading to the development of various PSI variant protocols. In this context, we propose a cloud-based multi-party private set intersection with union protocol, denoted as MPSI-U. This protocol securely computes the intersection of the designated party's set with the union of the sets of all other parties, which can be applied to scenarios such as contact tracing. MPSI-U leverages cloud servers to alleviate the computational burden placed on users, while guaranteeing privacy and security simultaneously for all involved parties with the threshold BGN cryptographic system. Furthermore, a comprehensive formal security analysis of the protocol was conducted under the semi-honest model to prove its resilience against potential security threats. Based on our performance analysis, MPSI-U exhibits favorable characteristics in terms of communication and computation overhead. This enhances the versatility of MPSI-U, rendering it a valuable solution that can be widely applied across various domains and scenarios.

An identity-based matchmaking encryption (IB-ME) scheme proposed at JOC 2021 supports anonymous but authenticated communications in a way that communication parties can both specify the senders or receivers on the fly. IB-ME is easy to be used in several network applications requiring privacy-preserving for its efficient implementation and special syntax. Despite the rigorous security proofs in previous security models, the existing IB-ME schemes are still possibly vulnerable to some potential neglected attacks. Aiming at the above problems, we provide a stronger security definition of authenticity considering new attacks to fit real-world scenarios and then propose a generic construction of IB-ME satisfying the new model. Inspired by the prior IB-ME construction of Chen et al., the proposed scheme is constructed by combining 2-level anonymous hierarchical IBE (HIBE) and identity-based signature (IBS) schemes. In order to upgrade lattice-based IB-ME with better efficiency, we additionally improve a lattice IBS, as an independent technical contribution, to shorten its signature and thus reduce the final IB-ME ciphertext size. By combining the improved IBS and any 2-level adaptively-secure lattice-based HIBE with anonymity, we finally obtain the first lattice-based IB-ME construction achieving privacy and new-proposed stronger authenticity simultaneously.

Most of the current federated learning schemes aimed at safeguarding privacy exhibit vulnerability to collusion attacks and lack a verification mechanism for participants to consolidate the aggregation results of the parameter server, leading to privacy breaches for users and inaccurate model training outcomes. In order to address these issues, we propose a verifiable privacy-preserving federated learning framework against collusion attacks. Primarily, the federated learning scheme is reconfigured utilizing the ElGamal encryption algorithm, which effectively safeguards the data privacy of participants in scenarios involving collusion between certain participants and servers. Additionally, the introduction of the assistant server can realize the joint decryption of the gradient ciphertext by the non-collusive parameter server and assistant server, which can effectively resist the internal attack of a single parameter server model in the process of data upload. Third, this scheme designs a verification mechanism that enables participants to effectively verify the accuracy and integrality of the parameter server's aggregated results, preventing the parameter server from returning incorrect aggregation results to participants. Experimental results and performance analysis demonstrate that our proposed scheme not only fortifies security measures but also upholds the precision of model training, surpassing the security and correctness of many existing methodologies.

Universal composability (UC) is a primary security flavor for designing oblivious transfer (OT) due to its advantage of arbitrary composition. However, the study of UC‐secure OT over lattices is still far behind compared with constructions over prequantum assumptions. Relying on the learning with errors (LWE) assumption, Quach proposes a dual‐mode encryption scheme (SCN’20) for deriving a two‐round OT whose security is provably UC‐secure in the common reference string (CRS) model. Due to its use of a randomized rounding function proposed by Benhamouda et al. (PKC’18), this OT can only be limited to transmitting single‐bit messages. Therefore, conducting trivial repetitions of Quach’s OT when transmitting multibit strings would be very costly. In this work, we put forward a modified dual‐mode encryption cryptosystem under the decisional LWE assumption, from which we can derive a UC‐secure string OT with both full‐fledged dual‐mode security and better efficiency on transmitting strings. The key technique we adopt is a key reconciliation scheme proposed by Jiang et al. (PKC’20), which is utilized to extend the single‐bit symmetric encryption key (produced by the aforementioned rounding function) to a multibit case. Through a comprehensive performance analysis, we demonstrate that our proposal can indeed strike a balance between security and efficiency.

Federated learning is a distributed learning helpful approach for resolving data privacy concerns and eliminating data silos. Homomorphic encryption is a vital technology for preserving user privacy in federated learning, and current studies are mainly concentrated on a single-key environment. However, if one user key is exposed in a single-key environment, it implies that the whole system key has been revealed. To strengthen security, we should allow different participants of federated learning to choose different keys to encrypt their local models. The cloud server should finish model aggregation calculation on ciphertexts under different public keys. Besides, research in this area is insufficient to guarantee mobile users’ data integrity verification and authentication in open channels. Therefore, this article proposes a privacy protection federated learning scheme VPFL based on the BCP cryptosystem, which can verify user identity and data integrity in a multikey environment. First, this scheme employs the BCP cryptosystem with double trapdoors for data encryption and transmission, enhancing the user’s privacy security. Second, a method for verifying user data integrity and identity was created utilizing bilinear aggregate signatures and verifiable secret sharing. It can effectively eliminate some incorrect data of some users. Third, VPFL tolerates users dropping out during training while still guaranteeing high accuracy. Finally, theoretical analysis and experimental evaluation indicate that the proposed scheme is efficient and secure.

As a basic primitive in spatial and multimedia databases, the$k$-nearest neighbors$(k$-NN) query has been widely used in electronic medicine, location-based services, and so on. With the boom in cloud computing, it is currently a trend to upload massive data to the cloud server to enjoy its powerful storage and computing resources. Recently, research communities and commercial applications have proposed many schemes to support$k$-NN query on cloud data. However, most of the existing$k$-NN query schemes were designed under the assumption that the query users (QUs) are fully trusted and hold the key of the acrlong DO. In this case, even if the queries were encrypted, the QUs can capture the query content from each other, leading to the query privacy leakage. Unfortunately, to the best of our knowledge, few$k$-NN query schemes can ensure data privacy under the key-confidentiality condition. In this article, we propose a secure$k$-NN query with multiple keys based on random projection forests (SM$k$NN), in which each QU’s partial strong private key can only decrypt the encrypted query results belonging to its own, but not the encrypted database, the encrypted query data and query results of other QUs. Moreover, our proposal not only answers the query efficiently but also ensures the privacy of data, query, results, and access pattern, and the verification of the correctness of the results. Finally, the complexity and security are theoretically analyzed, and the practicality and efficiency of our proposed scheme are compared by simulation experiments.

Let (D,S,χ,m)-LWEn,q be the LWE problem in matrix form (A,y=As+emodq), where A,s,e are randomly chosen respectively from the seed distribution D over Zqm×n, secret distribution S over Zqn and noise distribution χm over Zm (or Rm), i.e., A←D,s←S,e←χm. For various secret-noise distributions (S,χ), the (D,S,χ,m)-LWEn,q problem is shown to be as hard as some standard worst-case lattice problems, but most of the known results require D to be the uniform distribution over Zqm×n. In this paper, we show that under the standard LWE assumption, the problem (D,S,χ,m)-LWEn,q can still be hard for some distribution D that is not (even computationally indistinguishable from) the uniform distribution over Zqm×n. Specifically, we show that if D is a semi-uniform distribution over Zqm×n (namely, D can be publicly derived from and has a “small difference” to the uniform distribution over Zqm×n), then for appropriate choices of (S,χ), the problem (D,S,χ,m)-LWEn,q is hard under the standard LWE assumption. Moreover, we also show that the semi-uniform MLWE problem is hard under the standard MLWE assumption. As a direct application, our results pave the way to prove the security of public-key encryptions with rounded public keys under the standard (M)LWE assumption.

Convolutional Neural Networks (CNNs) possess extensive applicability across diverse domains, particularly in the realm of image recognition. In light of the advent of machine learning as a service, the utilization of a well-trained CNN model by servers to execute image classification based on user queries has become a significant service, catering to a wide array of applications. Nevertheless, this convenience is accompanied by the inherent risk of data privacy and model privacy disclosure, which can have severe ramifications, particularly in the context of specialized scenarios like medical images and location images. Hence, how to perform classification for CNN with privacy protection emerges as a crucial research concern. Furthermore, the nonlinearity of CNN's activation function renders it unsuitable for homomorphic cryptosystems. In order to address these challenges, we put forth a privacy-preserving CNN classification scheme employing a distributed two trapdoors public-key cryptosystem (DT-PKC). Initially, we introduce a security protocol toolkit encompassing protocols for secure multiplication, secure activation function computing, and average pooling. In addition, we propose a novel continuous and derivative Tanhplus function as an approximation of the Relu function, aiming to enhance the accuracy of classification results. The secure activation function computing protocol utilizes the aforementioned Tanhplus function in conjunction with the proposed homogenization algorithm to compute the activation function. This protocol guarantees more precise and accurate output in the activation function calculation of CNN when operating under ciphertext. Furthermore, the adoption of the DT-PKC cryptosystem not only ensures privacy protection for CNN classification but also provides support for lightweight users and multiple keys. Finally, security analysis and performance evaluations demonstrate that the proposed scheme is secure, practicable, and efficient with high accuracy.

The lattice-based cryptography is one of the most promising candidates in the era of post-quantum cryptography. It is necessary to precisely choose the practical parameters by evaluating the hardness of the underlying hard mathematical problems, such as the shortest vector problem (SVP). Currently, there are two state-of-the-art strategies for solving (approximate) SVP. One is the SVP-solving strategy proposed in G6K[5], which has the least solving time cost but high memory cost requirements; another is to execute progressive BKZ (pBKZ)[8] for pre-processing at first and call the high-dimensional SVP-oracle to find the short vector on the original lattice. Due to the strong pre-processing on the lattice basis, the memory cost of the latter strategy is usually smaller than that of the former strategy, while the time cost of pre-processing is relatively costly. In this paper, we first optimize the pnj-BKZ simulator when the jump value is quite large by giving a refined dimension for free (d4f) estimation. Then, based on our optimized pnj-BKZ simulator, we show a more accurate hardness estimation of LWE by considering technologies such as progressive BKZ pre-processing technology, jump strategy, and d4f technology. Furthermore, based on the sharper pnj-BKZ simulator, we propose an SVP-solving strategy trade-off between G6K and pBKZ, which derives less time cost than pBKZ within less memory compared with G6K. Experimental results show that when solving the TU Darmstadt SVP challenge, our algorithm can save 50%-66% of memory compared with G6K’s default SVP-solving strategy. Moreover, our algorithm speeds up the pre-processing stage by 7-30 times, saving the time cost by 4-6 times compared with the pBKZ default SVP-solving strategy. Using our proposed strategy, we solved the 170-dimensional TU Darmstadt SVP challenge and up to the 176-dimensional ideal lattice challenge.

Abstract Fully homomorphic encryption (FHE) allows direct computations over the encrypted data without access to the decryption. Hence multi-key FHE is well suitable for secure multiparty computation. Recently, Brakerski et al. (TCC 2019 and EUROCRYPT 2020) utilized additively homomorphic encryption to construct FHE schemes with different properties. Motivated by their work, we are attempting to construct multi-key FHE schemes via additively homomorphic encryption. In this paper, we propose a general framework of constructing multi-key FHE, combining the additively homomorphic encryption with specific multiparty computation protocols constructed from encryption switching protocol. Concretely, every involved party encrypts his plaintexts with an additively homomorphic encryption under his own public key. Then the ciphertexts are evaluated by suitable multiparty computation protocols performed by two cooperative servers without collusion. Furthermore, an instantiation with an ElGamal variant scheme is presented. Performance comparisons show that our multi-key FHE from additively homomorphic encryption is more efficient and practical.

Abstract Multi-key fully homomorphic encryption (MFHE) supports arbitrary meaningful computations on encrypted data under different public keys even without access to the secret key, which is well tailored for the secure multiparty computation scenarios. Based on the Gentry–Sahai–Waters scheme (a single-key FHE in Crypto 2013) with the underlying learning with errors problem, MW16 scheme (Eurocrypt 2016) utilizes the method of ‘linear combination procedure’ (LCP) as a subroutine to construct the auxiliary information for the expanded ciphertexts of MFHE scheme. However, every party shares a common random string (CRS) to be distributed by a trusted setup, which is unpractical. Meanwhile, the noise in the auxiliary information is too much compared with the one in fresh ciphertexts. In this paper, we propose a modified MFHE scheme in the plain model, i.e. without CRS, to enhance the practicability of MFHE. Specifically, every involved party generates his own public key independent on a CRS. Then a potential improvement on the LCP is developed to provide auxiliary information, which largely reduces the noise and leads to a smaller modulus for our MFHE. Furthermore, the feasibility of our proposal is also proved by theoretical performance comparisons.

The module learning with errors (MLWE) problem has attracted considerable attention for its tradeoff between security and efficiency. The quantum/classical worst‐case to average‐case hardness for the MLWE problem (or more exactly, a family of problems) has been established, but most of the known results require the seed distribution to be the uniform distribution. In the present paper, we show that, using the noise flooding technique based on the Rényi divergence, the search MLWE problem with uniform B ‐bounded secret distribution for 1 ≤ B ≪ q can still be hard for some seed distributions that are not (even computationally indistinguishable from) the uniform distribution under the standard MLWE assumption. Specifically, we show that if the seed distribution is a semiuniform distribution (namely, the seed distribution can be publicly derived from and has a “small difference” to the uniform distribution), then for suitable parameter choices, the search MLWE problem with uniform bounded secret distribution is hard under the standard MLWE assumption. Moreover, we also show that under the appropriate setting of parameters, the search MLWE problem with uniform bounded noise distribution is at least as hard as the standard MLWE assumption using a different approach than the one used by Boudgoust et al. in [JoC 2023].

The module learning with errors (MLWE) problem has attracted significant attention and has been widely used in building a multitude of lattice‐based cryptographic primitives. The hardness of the MLWE problem has been established for several variants, but most of the known results require the seed distribution (i.e., the distribution of matrix A ) to be the uniform distribution. In this paper, we show that under the Module‐N‐th degree Truncated polynomial Ring Units (NTRU) (MNTRU) assumption, the search MLWE problem can still be hard for some distributions that are not (even computationally indistinguishable from) the uniform distribution. Specifically, we show that if the seed distribution is a semiuniform distribution (namely, the seed distribution can be publicly derived from and has a “small difference” to the uniform distribution), then for appropriate settings of parameters, the search MLWE problem is hard under the MNTRU assumption. Moreover, we also show that under the appropriate settings of parameters, the search learning with errors over rings problem with semiuniform seeds can still be hard under the NTRU assumption due to our results for the search MLWE problem with semiuniform seeds being rank‐preserving.

Abstract As an access control technology of digital material, digital rights management systems have a profound effect on the copyright protection of digital content. To address the threat of key exposure, applying white‐box ciphers is effective to provide a security guarantee for digital rights management systems. SPNbox, proposed at Asiacrypt’16 is such a white‐box cipher that fulfils comprehensive resistance against key exposure for digital rights management systems, including black‐box security on the server‐side and white‐box security on the client‐side. So far, the previous integral cryptanalysis of SPNbox employs a general 2‐round distinguisher without considering the details of SPNbox. The properties of SPNbox are carefully explored and a novel 2‐round integral distinguisher is introduced. On this basis, we propose new competitive 3‐round key recovery attacks with lower complexities. Particularly, the improved attack on 3‐round SPNbox‐32 only requires 2 32 chosen plaintexts, whereas the current best attack necessitates 2 62 chosen plaintexts. In addition, integral attacks on 4‐ and 5‐round SPNbox‐8 are presented for the first time. Thus, the security margin of SPNbox‐8 is narrowed by two rounds. These results indicate that the capability of SPNbox resisting integral cryptanalysis is inferior to the designers' claim.

Since traditional federated learning (FL) algorithms cannot provide sufficient privacy guarantees, an increasing number of approaches apply local differential privacy (LDP) techniques to FL to provide strict privacy guarantees. However, the privacy budget heavily increases proportionally with the dimension of the parameters, and the large variance generated by the perturbation mechanisms leads to poor performance of the final model. In this article, we propose a novel privacy-preserving edge FL framework based on LDP (PPeFL). Specifically, we present three LDP mechanisms to address the privacy problems in the FL process. The proposed filtering and screening with exponential mechanism (FS-EM) filters out the better parameters for global aggregation based on the contribution of weight parameters to the neural network. Thus, we can not only solve the problem of fast growth of privacy budget when applying perturbation mechanism locally but also greatly reduce the communication costs. In addition, the proposed data perturbation mechanism with stronger privacy (DPM-SP) allows a secondary scrambling of the original data of participants and can provide strong security. Further, a data perturbation mechanism with enhanced utility (DPM-EU) is proposed in order to reduce the variance introduced by the perturbation. Finally, extensive experiments are performed to illustrate that the PPeFL scheme is practical and efficient, providing stronger privacy protection while ensuring utility.

Public-key encryption with equality test (PKEET) provides cloud servers with an effective way to check the equality of outsourced encrypted data without decryption. This enables PKEET to attract much attention and be widely researched in cloud computing. However, we claim that the existing PKEET schemes suffer from an inherited problem, called message-consistency unverifiability of testers (MCUT). Applying the MCUT problem, outsourcers can fool cloud servers into outputting incorrect testing results of encrypted data, which negates the practicability of PKEET in cloud computing. We investigate the PKEET literature and find the main reason for the MCUT problem is the independence between the messages inserted in the decryption and testing modules in their ciphertexts. To bridge the technical gap between PKEET and its practical applications, we present a new notion, called PKE with tester verifiable equality test (PKE-TVET), which solves the MCUT problem by allowing testers to verify the message consistency in two modules. We then instantiate the PKE-TVET and give a specific construction in the standard model. In our PKE-TVET scheme, the testing module is integrated into the decryption module so that there is only one message inserted in the ciphertext for both decryption and testing. This special setting lets our scheme directly get rid of the MCUT problem. For better applications in actual scenarios, we further extend the scheme to support authorization and tester designation. Finally, we analyze the tradeoff of parameter sizes and computation costs for the security against MCUT attacks in our PKE-TVET scheme.

Convolutional neural networks (CNNs) have excellent and extensive applications in image recognition. With the continuous exploitation of data value and the proliferation of machine learning-as-a-service, convolutional neural network prediction schemes on privacy preservation have been introduced one after another, which makes much more attention focused on the privacy leakage and services offered to be efficient and light. Therefore, how to improve the convolutional neural prediction scheme on the premise of privacy preservation turns out to be an imperative research issue. In this paper, we propose a privacy-preserving convolutional neural network prediction scheme (PCP-LL) that supports low latency and lightweight users. The scheme starts from the perspective of lossless accuracy from underlying networks. First, we construct a secure activation function computing protocol (SActF) utilizing a commodity-based secure comparison protocol, which reduces the complexity and latency during the activation function computing under ciphertexts compared with common schemes. Second, to further support lightweight users, we introduce a secure output layer protocol (SOut) that enables users to obtain the prediction results without extra decryption after simple operations. Then, the scheme adopts the distributed two trapdoors public-key cryptosystem (DT-PKC) to achieve both data and model security, which well avoids security issues especially such as wiretapping by semi-honest participants commonly in secret sharing schemes. Finally, through relevant evaluations, the scheme not only achieves privacy preservation and low latency, but also supports lightweight users.

Industrial Internet of Things (IIoT) is gradually changing the mode of traditional industries with the rapid development of big data. Besides, thanks to the development of deep learning, it can be used to extract useful knowledge from the large amount of data in the IIoT to help improve production and service quality. However, the lack of large-scale data sets will lead to low performance and overfitting of learning models. Therefore, federated deep learning with distributed data sets has been proposed. Nevertheless, the research has shown that federated learning can also leak the private data of participants. In IIoT, once the privacy of participants in some special application scenarios is leaked, it will directly affect national security and people’s lives, such as smart power grid and smart medical care. At present, several privacy-preserving federated learning schemes have been proposed to preserve data privacy of participants, but security issues prevent them from being fully applied. In this article, we analyze the security of the DeepPAR scheme proposed by Zhang et al., and point out that the scheme is insecure in the re-encryption key generation process, which will cause the leakage of the secret key of participants or the proxy server. In addition, the scheme is not resistant to collusion attacks between the parameter server and participants. Based on this, we propose an improved scheme. The security proof shows that the improved scheme solves the security problem of the original scheme and is resistant to collusion attacks. Finally, the security and accuracy of the scheme is illustrated by performance analysis.

In a traditional health system, it merely depends on doctors’ initiative reports to discover infectious diseases, which causes late responses from the Center for Disease Control (CDC) and therefore may result in snowballed loss of lives and economy. Sometimes, the disease has spread when doctors realize it is infectious, and the CDC has to invest more human and material resources to control it. In this article, we propose a new secure infectious diseases detection system with the help of the IoT-based e-health platform. In our system model, the hospitals collect patients’ electronic health records (EHRs) and outsource the encrypted EHRs to the contracted cloud. The CDC can regularly send a test query to the cloud server to check whether there are patients who have similar symptoms or some increasing signs, which are regarded as signs of infectious diseases. With this system, the CDC can find the small signs of infectious diseases so that it can make appropriate and timely measures to save more lives. To enable the cloud server to perform the required test, we propose a new cryptographic notion, called public-key encryption with DFET (PKE-DFET), with which we can check whether the underlying messages of two ciphertexts are equal or not after ignoring the bits on designated positions without decryption. The cloud server can utilize the PKE-DFET to flexibly count the number of patients with similar symptoms following the CDC’s instructions. We first instantiate the PKE-DFET into a concrete construction, where anyone can be a tester to perform the DFET on ciphertexts. Finally, we extend our PKE-DFET construction to enable it to be flexible in different actual application scenarios.

Lattice-based key exchange protocols have attracted tremendous attention for its post-quantum security. In this work, we construct a Module-LWE-based key exchange protocol using Peikert’s error reconciliation mechanism. Compared with Kyber.KE, our key exchange protocol reduces the total communication cost by 96-byte, i.e., 3.2% ∼ 6.1%, under the different parameter sets, and without reducing the post-quantum security levels. Moreover, our key exchange protocol slightly reduces the probability of session key agreement failure and the time consumed by modular multiplication of numbers and ring elements by approximately 30%. Thus, the key exchange protocol in this paper is more suitable for the lightweight communication systems.

With the rapid development of machine learning in the medical cloud system, cloud-assisted medical computing provides a concrete platform for remote rapid medical diagnosis services. Support vector machine (SVM), as one of the important algorithms of machine learning, has been widely used in the field of medical diagnosis for its high classification accuracy and efficiency. In some existing schemes, healthcare providers train diagnostic models with SVM algorithms and provide online diagnostic services to doctors. Doctors send the patient's case report to the diagnostic models to obtain the results and assist in clinical diagnosis. However, case report involves patients' privacy, and patients do not want their sensitive information to be leaked. Therefore, the protection of patient's privacy has become an important research direction in the field of online medical diagnosis. In this paper, we propose a privacy-preserving medical diagnosis scheme based on multi-class SVMs. The scheme is based on the distributed two trapdoors public key cryptosystem (DT-PKC) and Boneh-Goh-Nissim (BGN) cryptosystem. We design a secure computing protocol to compute the core process of the SVM classification algorithm. Our scheme can deal with both linearly separable data and nonlinear data while protecting the privacy of user data and support vectors. The results show that our scheme is secure, reliable, scalable with high accuracy.

The collection of users’ near-real-time electricity consumption data brings advantages to the operation of smart grids, while raising some security and privacy issues. Multiple privacy preserving data aggregation schemes have been proposed to address these problems. However, most schemes only focus on the aggregation of electricity consumption data without considering the data availability. In addition, although a data aggregation scheme that supports function queries on encrypted data has also been developed, its efficiency is insufficient. In this paper, we first propose an EC-ElGamal encryption algorithm with a double trapdoor decryption mechanism. Through employing the proposed algorithm and the elliptic curve Schnorr signature scheme, an efficient data aggregation scheme supporting privacy protection and function query is proposed for smart grids. This solution allows the control center and users to initiate various function queries on encrypted data. In order to lighten the calculation burden of the control center, we propose another cryptosystem named ElGamal-OU to improve the decryption efficiency, which also supports two independent decryption methods. Finally, the security analysis and performance comparison with related work show that our schemes have advantages in terms of computational, communication and storage overhead.

Abstract Attribute‐based encryption (ABE) is a promising management method that enables fine‐grained access control in large‐scale systems. Revocable ABE (RABE) can support a key revocation mechanism in an ABE system. With the advent of the Internet of Things, users may need to delegate their decryption capacity to other devices, which requires that RABE meet a necessary feature called decryption key exposure resistance (DKER). Although many constructions about RABE from bilinear maps have been proposed, the situation of lattice‐based constructions with DKER is less satisfactory. In order to narrow this gap, this paper propose the first lattice‐based RABE with DKER. First, a formal description of RABE with DKER and the corresponding security models is proposed. Subsequently, a lattice‐based RABE scheme without DKER is constructed and it is proved to be selective indistinguishability under chosen‐plaintext attack (IND‐CPA) security based on Learning with Errors (LWE). To achieve DKER, this paper construct a RABE scheme by using the RABE scheme without DKER and a key extension mechanism as its building blocks. Finally, this paper show that this scheme is selective IND‐CPA security, with the DKER based on LWE.

Abstract Format‐preserving encryption (FPE) allows encrypting plaintexts while preserving a specific format. In Selected Areas in Cryptography 2018, two targeted ciphers were proposed as new FPE schemes. The second scheme was designed with an algorithm called Mix–Swap–Unmix that is shown to be equivalent to a particular matching exchange process under a specific setting. In this comment paper, we prove that the matching exchange process is invalid. As a result, this equivalence does not exist.

Abstract Authenticated key exchange protocol is widely applied in the Internet services. Lattice‐based key exchange protocols turn out to be quantum‐resistant and hence have attracted tremendous attention. A lattice‐based explicit authenticated key exchange protocol is constructed by combining an IND‐CPA key encapsulation mechanism with a strong EUF‐CMA digital signature under the message‐recovery mode. Concrete parameter specifications are suggested under the 102 and 218 bits post‐quantum security, respectively. Compared with the implicit authenticated key exchange derived directly from the key encapsulation mechanism, our proposals reduce the communication costs by 21.7% and 25.7%, respectively, under the same post‐quantum security level. Rough analysis shows that the proposals also obtain some advantages over previous constructions in term of computational efficiency. Moreover, our scheme achieves perfect forward secrecy while the original scheme only satisfies weak forward secrecy.

The healthcare wireless medical sensor network is gradually changing the traditional mode of medical treatments with the rapid development of Internet of Things. Specifically, patients' healthcare data can be continuously collected by medical sensor nodes and transmitted to the medical specialists for disease monitoring, diagnosis and treatments. Recently, due to its advantages of low computational and communication overheads in a multiuser environment, the certificateless aggregate signature (CLAS) scheme has been adopted to prevent the sensitive healthcare data from being tampered and damaged, thereby ensuring the integrity and authenticity of data. In order to further improve the efficiency of CLAS schemes for the sensor nodes with limited resources, several CLAS schemes without bilinear pairing have been proposed. However, security issues prevent them from being fully applied in the practical scenarios. In this article, we analyze the security of a pairing-free CLAS scheme proposed by Liu et al. [IEEE Internet of Things Journal, vol. 7, no. 6, pp. 5256-5266, 2020] by pointing out that their scheme is insecure against adversaries. After that, we introduce an improved scheme to solve the security vulnerability. The security proofs show that our improved scheme is existentially unforgeable against chosen message attacks under the random oracle model. In addition, the length of the aggregate signature in our proposal does not increase with the growth of the number of users, which greatly reduces the communication cost. Finally, the efficiency of our scheme is illustrated through both performance analyses and comparisons of related work.

Private information retrieval (PIR) protocol is a powerful cryptographic tool and has received considerable attention in recent years as it can not only help users to retrieve the needed data from database servers but also protect them from being known by the servers. Although many PIR protocols have been proposed, it remains an open problem to design an efficient PIR protocol whose communication overhead is irrelevant to the database size N . In this paper, to answer this open problem, we present a new communication-efficient PIR protocol based on our proposed single-ciphertext fully homomorphic encryption (FHE) scheme, which supports unlimited computations with single variable over a single ciphertext even without access to the secret key. Specifically, our proposed PIR protocol is characterized by combining our single-ciphertext FHE with Lagrange interpolating polynomial technique to achieve better communication efficiency. Security analyses show that the proposed PIR protocol can efficiently protect the privacy of the user and the data in the database. In addition, both theoretical analyses and experimental evaluations are conducted, and the results indicate that our proposed PIR protocol is also more efficient and practical than previously reported ones. To the best of our knowledge, our proposed protocol is the first PIR protocol achieving O1 communication efficiency on the user side, irrelevant to the database size N .

Public auditing protocol is crucial for the success of cloud computing, as it can ensure the outsourced data in cloud server are not tampered by attackers. Due to its importance, public auditing protocol has received considerable attention in the past years. In 2015, Liu et al. proposed a privacy-preserving public auditing protocol for regenerating-code-based cloud storage (IEEE Transactions on Information Forensics and Security, 10(7):1513-1528, 2015) and claimed it is secure under the considered security model. However, in this article, we will show that their protocol is not as secure as they claimed, i.e., the proxy delegated by the data owner can forge an authenticator for any data block, which obviously invalidates their protocol's security. We hope that by identifying the design flaw, similar weaknesses can be avoided in future protocol design.

Abstract Identity-based revocation system (IBRS) generates the ciphertext with a revoked identity list such that only the non-revoked identities can use their private keys to decrypt this ciphertext. IBRS can be efficiently applied in some practical applications, such as the pay-TV systems when the number of revoked identities are much less than the non-revoked ones. However, since IBRS is based on identity-based cryptography, it also suffers from the inherent key escrow problem where the private key generator (PKG) has full control of each user’s private key. As a consequence, it is hard to judge whether a pirated private key is generated by the PKG or the suspected user. There is no study on IBRS fulfilling accountability in literature to date. In this paper, we introduce the notion of accountable authority IBRS (A-IBRS), which provides accountability in IBRS schemes. In an A-IBRS, the aforementioned problem can be alleviated and resolved. Furthermore, a full black-box A-IBRS can distinguish the creator of a black box between the PKG and the associated user and the dishonest PKG is allowed to access the decryption results of the user private key. We formalize the definition and security models of the full black-box A-IBRS schemes. Then, we present a concrete full black-box A-IBRS scheme with constant-size master public key and private key. Finally, we prove the security of our scheme under the defined security models without random oracle.

Summary Outsourcing datum to the cloud servers is more and more popular for most data owners and enterprises. However, how to ensure the outsourced datum to be kept secure is very important. Especially, how to check the outsourced datum's integrity is a very challenge problem. Until now, there are many cryptographic protocols proposed to solve this problem, such as (dynamic) provable data position protocol, (dynamic) proof of retrievability protocol, etc. Recently, Tian et al proposed a dynamic‐hash‐table‐based public auditing scheme for secure cloud storage, which aims at simultaneously supporting secure dynamic data updating and secure public auditing for cloud storage. However, we find a security flaw in this protocol; concretely, the signature algorithm for the data blocks in their protocol is not secure; the cloud servers can easily modify the outsourced data blocks without detecting. Finally, we give a new protocol by using homomorphic tags based on their protocol and roughly analysis its security.

Internet of Things (IoT) networks are usually distributed in nature. Due to the possible mobility of IoT devices, it is common and critical for each IoT device to keep discovering who is in its neighborhood, referred to as neighbor discovery. Due to the limited battery capacity of IoT devices, it is challenging to design a neighbor discovery protocol (NDP) that can achieve both low duty cycle and low discovery latency. In this article, we build a model called Circle to characterize the process of neighbor discovery in IoT networks. Then, we give a necessary and sufficient condition for neighbor discovery and theoretically prove its correctness. This is the first time in the research community that a necessary and sufficient condition is given for neighbor discovery. According to the necessary and sufficient condition, we analytically derive a lower bound of the worst case discovery latency and demonstrate when the lower bound can be achieved. The analytical model is generic as it can be used to analyze existing NDPs. Based on the Circle model and the analysis, we propose an NDP, which is also called Circle. We compare Circle with the state-of-the-art NDPs in a real testbed, and experimental results show that Circle is superior to the existing state-of-the-art NDPs.

Attribute-based encryption (ABE) can support a fine-grained access control to encrypted data. When the user’s secret-key is compromised, the ABE system has to revoke its decryption privileges to prevent the leakage of encrypted data. Although there are many constructions about revocable ABE from bilinear maps, the situation with lattice-based constructions is less satisfactory, and a few efforts were made to close this gap. In this work, we propose the first lattice-based server-aided revocable attribute-based encryption (SR-ABE) scheme and thus the first such construction that is believed to be quantum resistant. In the standard model, our scheme is proved to be secure based on the hardness of the Learning With Errors (LWE) problem.

Due to the transparency of the wireless channel, users in multiple-key environment are vulnerable to eavesdropping during the process of uploading personal data and re-encryption keys. Besides, there is additional burden of key management arising from multiple keys of users. In addition, profile matching using inner product between vectors cannot effectively filter out users with ulterior motives. To tackle the above challenges, we first improve a homomorphic re-encryption system (HRES) to support a single homomorphic multiplication and arbitrarily many homomorphic additions. The public key negotiated by the clouds is used to encrypt the users’ data, thereby avoiding the issues of key leakage and key management, and the privacy of users’ data is also protected. Furthermore, our scheme utilizes the homomorphic multiplication property of the improved HRES algorithm to compute the cosine result between the normalized vectors as the standard for measuring the users’ proximity. Thus, we can effectively improve the social experience of users.

Data clustering is the unsupervised classification of data records into groups. As one of the steps in data analysis, it has been widely researched and applied in practical life, such as pattern recognition, image processing, information retrieval, geography, and marketing. In addition, the rapid increase of data volume in recent years poses a huge challenge for resource-constrained data owners to perform computation on their data. This leads to a trend that users authorize the cloud to perform computation on stored data, such as keyword search, equality test, and outsourced data clustering. In outsourced data clustering, the cloud classifies users’ data into groups according to their similarities. Considering the sensitive information in outsourced data and multiple data owners in practical application, it is necessary to develop a privacy-preserving outsourced clustering scheme under multiple keys. Recently, Rong et al. proposed a privacy-preserving outsourced k-means clustering scheme under multiple keys. However, in their scheme, the assistant server (AS) is able to extract the ratio of two underlying data records, and key management server (KMS) can decrypt the ciphertexts of owners’ data records, which break the privacy security. AS can even reduce all data records if it knows one of the data records. To solve the aforementioned problem, we propose a highly secure privacy-preserving outsourced k-means clustering scheme under multiple keys in cloud computing. In this paper, noncolluded cloud computing service (CCS) and KMS jointly perform clustering over the encrypted data records without exposing data privacy. Specifically, we use BCP encryption which has additive homomorphic property and AES encryption to double encrypt data records, where the former cryptosystem prevents CCS from obtaining any useful information from received ciphertexts and the latter one protects data records from being decrypted by KMS. We first define five protocols to realize different functions and then present our scheme based on these protocols. Finally, we give the security and performance analyses which show that our scheme is comparable with the existing schemes on functionality and security.

Attribute‐based encryption (ABE) supports fine‐grained sharing of encrypted data so that it can be used in a plenty of application scenarios, and many constructions of ABE scheme have been presented. The first arithmetic circuit ABE system was proposed by Boneh, Gentry, Gorbunov et al . (BGG + 14) in Eurocrypt 2014. It is one of the major candidates for ABE, whose security is based on the learning with errors assumption. In this work, the authorsanalyse three different versions of BGG + 14 ABE with weak attributes, weak variants, and weak modulus. First, they discuss weak attributes of BGG + 14 ABE. A weak attribute is generated with corresponding decryption key, such that whenever a ciphertext is labelled with this weak attribute, 1 bit of the plaintext can be revealed. Second, they discuss the security of three variants of BGG + 14 ABE with simplified pre‐sampled matrices, and show that all of them are not secure under collusion attack. Third, they consider the composite modulus rather than prime modulus in BGG + 14 ABE scheme. They show that, if a small factor of the modulus is known, the set of users able to decrypt is clearly expanded. These analyses give different perspectives on the security of BGG + 14 ABE under different conditions.

Homomorphic encryption is widely used in the scenarios of big data and cloud computing for supporting calculations on ciphertexts without leaking plaintexts. Recently, Li et al. designed a symmetric homomorphic encryption scheme for outsourced databases. Wang et al. proposed a successful key-recovery attack on the homomorphic encryption scheme but required the adversary to know some plaintext/ciphertext pairs. In this paper, we propose a new ciphertext-only attack on the symmetric fully homomorphic encryption scheme. Our attack improves the previous Wang et al.’s attack by eliminating the assumption of known plaintext/ciphertext pairs. We show that the secret key of the user can be recovered by running lattice reduction algorithms twice. Experiments show that the attack successfully and efficiently recovers the secret key of the randomly generated instances with an overwhelming probability.

Certificateless aggregate signatures aggregate n signatures from n different users into one signature. Therefore, a verifier can judge whether all signatures are valid by verifying once. With this advantage, certificateless aggregate signatures are widely used in the environment of limited computing resources. Recently, a novel certificateless aggregate signature scheme was proposed by Kumar et al. This scheme’s security was claimed to be secure against two types of attackers under the random oracle model. In this paper, we indicate that their scheme is unable to achieve this security goal. We show an attack algorithm that the second type of attacker could forge a valid signature under an identity without the private key of the target user. Moreover, we demonstrate that the second type of attacker could forge a valid aggregate signature.

Recently how to audit cloud storage correctly and securely is a very hot research topic for cloud storage. At Infocom 2015, Chen et al. proposed a novel secure cloud storage audit protocol based on distributed string equality checking, which is a very interesting result. In this paper, we give some improvements to their protocol to strengthen its security. In particular, we show that if the data owners reuse pseudorandom function on the same order number of file block when uploading file block’s tag to the cloud, the protocol maybe not secure any more. We also show that there can exist many (mi, ci) pairs which will result in the same inner product sum ∑i=1nmi⋅ci, while mi denotes the file block, ci denotes the challenge value, and n denotes the number of blocks. We emphasis here that the flaw maybe does not lie in the traditional security model of cloud storage auditing protocol, but we think it is actually a serious drawback for current secure cloud storage audit protocols. We emphasis these two flaws can also exist in some famous cloud auditing protocols such as PDP and POR. Finally, we give an improvement to their protocol, and thus also give a way to strengthen the famous PDP and POR protocols.

The knapsack problem is an important problem in computer science and had been used to design public key cryptosystems. Low‐density subset sum algorithms are powerful tools to reduce the security of trapdoor knapsacks to the shortest vector problem (SVP) over lattices. Several knapsack ciphers Chor–Rivest, Okamoto–Tanaka–Uchiyama, and Kate–Goldberg were proposed to defend low‐density attacks by utilising low‐weight knapsack problems. Some evidence was also found on the vulnerabilities of the above three knapsack ciphers to lattice attacks. However, previous lattice‐based cryptanalytic results have been established via a probabilistic approach. The authors investigate some collision‐free properties and derive from the properties a deterministic reduction from the knapsack problems in the Chor–Rivest, Okamoto–Tanaka–Uchiyama, and Kate–Goldberg knapsack ciphers to SVP without imposing any restriction and assumption. To the best of the authors' knowledge, the proposed reduction is the first deterministic reduction from public key cryptographic knapsacks to SVP.

For the decryption of the fully homomorphic encryption (FHE) over the integers with the message space ZQ , Nuida and Kurosawa proposed a Q4λ -multiplicative-degree circuit to compute it at Eurocrypt 2015, where λ is the security parameter and the message size Q is a constant. Since the degree of the decryption circuit is polynomial in Q , the range of the message size Q is limited. In this work, we solve this open problem as long as Q is large enough (larger than λ ). We represent the decryption circuit as a arithmetic polynomial of multiplicative degree 108·λ log3λ , which is independent of the message size Q except a constraint Q>λ . Moreover, the bootstrapping process requires only O(λ·log⁡λ) number of multiplications to implement the decryption circuit, which is significantly lower than O(λ4) of Nuida and Kurosawa’s work. We also show the efficiency of the FHE scheme with message space ZQ compared to the FHE scheme with binary message space. As a result, we have that the former is preferable.

Fully homomorphic encryption supports meaningful computations on encrypted data, and hence, is widely used in cloud computing and big data environments. Recently, Li et al. constructed an efficient symmetric fully homomorphic encryption scheme and utilized it to design a privacy-preserving-outsourced association rule mining scheme. Their proposal allows multiple data owners to jointly mine some association rules without sacrificing the data privacy. The security of the homomorphic encryption scheme against the known-plaintext attacks was established by examining the hardness of solving nonlinear systems. However, in this paper, we illustrate that the security of Li et al.'s homomorphic encryption is overvalued. First, we show that we can recover the first part of the secret key from several known plaintext/ciphertext pairs with the continued fraction algorithm. Second, we find that we can retrieve the second part of the secret key through the Euclidean algorithm for the greatest common divisor problem. Experiments on the suggested parameters demonstrate that in case of more than two homomorphic multiplications, all the secret keys of the randomly instantiated Li et al.'s encryption schemes can be very efficiently recovered, and the success probability is at least 98% for one homomorphic multiplication.

Multivariate public key cryptography is a set of cryptographic schemes built from the NP-hardness of solving quadratic equations over finite fields, amongst which the hidden field equations (HFE) family of schemes remain the most famous. However, the original HFE scheme was insecure, and the follow-up modifications were shown to be still vulnerable to attacks. In this paper, we propose a new variant of the HFE scheme by considering the special equation x2=x defined over the finite field F3 when x=0,1 . We observe that the equation can be used to further destroy the special structure of the underlying central map of the HFE scheme. It is shown that the proposed public key encryption scheme is secure against known attacks including the MinRank attack, the algebraic attacks, and the linearization equations attacks. The proposal gains some advantages over the original HFE scheme with respect to the encryption speed and public key size.

Abstract Proxy re‐encryption (PRE) is a cryptographic primitive that allows a proxy to turn an Alice's ciphertext into a Bob's ciphertext on the same plaintext. At present, there are many different PRE schemes that have been proposed with different properties. However, all of them are based on the logarithm assumption and the large integer factorization assumption except for a bidirectional PRE scheme over lattices. In this paper, we construct the first multi‐use unidirectional PRE scheme based on lattices. In addition, the generation of the PRE key does not interact with two users, and the scheme can resist collusion attacks. Moreover, it is proved chosen plaintext attack secure in the standard model based on the Learning With Errors assumption. Finally, an identity‐based PRE is obtained from the basic construction. Copyright © 2015 John Wiley & Sons, Ltd.

Key-dependent message KDM security should be considered in the design of security protocols, especially for complicated ones, where the messages related to the secret key might be encrypted. In this paper, we present a new method of constructing a KDM secure asymmetric encryption scheme with the notation of hybrid encryption in the standard model; although the notation of hybrid encryption was thought as no help to get rid of dependencies between messages and the secret key. Our result can also be seen as a partial instantiation for a previously well-known KDM secure asymmetric encryption scheme based on random oracle. As we know, this has never been carried out before. And our result indicates a new cryptographic application for the primitive of lossy trapdoor function. Throughout the paper, our main idea is to archive KDM security by making use of both leakage-resilience and auxiliary-input security properties. Copyright © 2014 John Wiley & Sons, Ltd.

ABSTRACT Public key cryptography is an important technique to resolve the security issues in computer communication networks. In some scenarios, a public key cryptosystem with double trapdoor decryption mechanism is desired. Previous known public key cryptosystems with double trapdoor decryption mechanism achieve no standard semantic security goals against adaptive chosen ciphertext attacks and were shown vulnerable to some attacks. In this paper, two new problems, the generalized RSA problem and the computational generalized RSA problem, are introduced, and the equivalence of the standard RSA problem and the computational generalized RSA problem is proven. Accordingly, on the basis of the computational generalized RSA problem, a public key cryptosystem with double trapdoor decryption mechanism, called GenRSA, is presented. We prove the GenRSA's indistinguishability security against adaptive chosen ciphertext attack under the computational generalized RSA intractability assumption and in the random oracle model. Copyright © 2013 John Wiley & Sons, Ltd.

The F5 algorithm [8] is generally believed as one of the fastest algorithms for computing Gröbner bases. However, its termination problem is still unclear. The crux lies in the non-determinacy of the F5 in selecting which from the critical pairs of the same degree. In this paper, we construct a generalized algorithm F5GEN which contain the F5 as its concrete implementation. Then we prove the correct termination of the F5GEN algorithm. That is to say, for any finite set of homogeneous polynomials, the F5 terminates correctly.

ABSTRACT A certificateless public key cryptosystem can make a special contribution to building key distribution and management architecture in resource‐constrained mobile ad hoc networks (MANETs) because it has no separate certificate and no complex certificate management problems. In this paper, we present a virtual private key generator (VPKG)‐based escrow‐free certificateless public key cryptosystem as a novel combination of certificateless and threshold cryptography. Using secret sharing, we build a VPKG whose members collaboratively calculate the partial private key and send it to the user via public channels. The private key of a user is generated jointly by the VPKG and the user. Each of them has “half” of the secret information about the private key of the user. In addition, binding a user's public key with its identity and partial private key, respectively, raises our schemes to the same trust level as is enjoyed in a traditional public key infrastructure. We also show that the proposed scheme is secure against public key replacement attacks and passive attacks. Copyright © 2012 John Wiley & Sons, Ltd.

Murakami and Nasako proposed a knapsack public key cryptosystem in 2008. They claimed that their proposal is secure against some known attacks. In this paper, we propose a cryptanalytic attack on the cryptosystem. We use a heuristic method to show that the secret key can be recovered with lattice reduction algorithms. Hence, their construction is insecure.

A new knapsack type public key cryptosystem is proposed by constructing an easy knapsack problem. The cryptosystem is shown to be secure against Shamir's key recovery attack in that it does not use a super-increasing knapsack sequence in the construction process. The cryptosystem is also invulnerable to low density attack in that it obtains a relatively high density. It is shown that the cryptosystem resists some brute force attacks and the simultaneous Diophantine approximation attack. It only performs n addition operations for the cryptosystem to encrypt a plaintext, and the decryption algorithm only carries out n modular 2 divisions. Therefore, the cryptosystem is efficient with respect to the encryption and the decryption. Furthermore, the cryptosystem is suited for software and hardware implementations.

Several public key cryptosystems and authentication schemes based on the conjugator search and root extraction problems over braid groups have been proposed. However, security analysis showed that it is not necessary to solve the underlying conjugator search problem or the root extraction problem in order to break these public key cryptographic algorithms. Hence, these cryptographic primitives suffer from some security drawbacks. A digital signature scheme based on the root extraction problem over braid groups is proposed. It is proven that the only way for the attacker to forge a signature is to extract the eth root for a given braid in the braid group. It is also shown that given sufficiently many message-signature pairs, the attacker needs to solve an intractable problem, the group factorisation problem, in order to forge a signature. Furthermore, it is pointed out that the attacker cannot learn much useful information by reconstructing braid equations with respect to the public and secret keys. Performance analysis shows that the proposed signature scheme is efficient and practical, and the key sizes are acceptable. The computational overheads to sign a message and to verify a signature are only equivalent to several 1024-RSA modular multiplications.

NTRUSign, a digital signature scheme, is suffering an effective attack. In this correspondence, we insert a new perturbation into NTRUSign primitive. With the new perturbation, each signature value is a linear combination of the private keys, and the combination coefficients have a hidden distribution. By a large number of signatures, the attacker obtains the value of some complicated function of the private keys. It appears as hard problem computing the private keys from this value. Our scheme is smaller in size, presents a higher efficiency, and provides a clearer security proof than NTRUSign with the old perturbation.