A short public parameter identity-based proxy re-encryption method based on LWE problem

Abstract

The application discloses a short public parameter identity-based proxy re-encryption method based on an LWE problem, a trapdoor matrix, namely a short base on a lattice, is generated through a more simple and efficient trapdoor generation algorithm, the trapdoor matrix is taken as a master secret key MSK, an identity sequence with an l-bit length is divided into l' = l / β blocks through a block technology, the number of public parameter selection is reduced, the size of the master secret key and the public parameter is reduced, the public parameter calculation complexity is reduced, the calculation efficiency is improved, and the storage cost is reduced. The application satisfies adaptive IND-ID-CPA security under a standard model, has unidirectionality and limited multi-hop nature, and can resist collusion attacks.

Description

Technical Field

[0001] This invention relates to the field of network data security technology, and in particular to a short common parameter identity-based proxy re-encryption method based on the LWE problem. Background Technology

[0002] Proxy re-encryption is a convenient and fast method for secure data sharing. It allows data senders to share information with receivers without encrypting or decrypting it. Third parties can directly convert the data into ciphertext that can be decrypted by one or more receivers using a re-encryption key, and the third party is unaware of any plaintext information in the converted ciphertext during the conversion process. This makes proxy re-encryption important in cloud computing environments, ensuring the security and privacy of data in open networks.

[0003] Identity-based proxy re-encryption technology does not use certificates; instead, it directly uses the user's identity (unique identifier) ​​as the public key. This simplifies certificate-based key management in Public Key Infrastructure (PKI) and provides the characteristic of matching identity information with the public key. This scheme generally involves the following six steps:

[0004] (1) Setup(1 n ): Input a security parameter n, output the public parameter PP and the master private key MSK;

[0005] (2) KeyGen(PP,MSK,id): Input public parameter PP, master private key MSK and user identity id, output user id's private key Sid;

[0006] (3)Enc(PP,id,m): Input common parameters PP, user identity id and message m, output ciphertext cid;

[0007] (4) ReKeyGen(PP,id1,id2, ): Input public parameter PP, user identities id1 and id2, and user private key. Output re-encryption key

[0008] (5)ReEnc Enter re-encryption key The encrypted message with user ID1 Output the ciphertext of user ID2

[0009] (6) Dec(cid,Sid): Input the ciphertext cid of the user ID and the private key Sid, and output the plaintext m.

[0010] In 2016, Kunwar et al. first proposed an Lattice-based identity-based proxy re-encryption scheme based on the LWE (Lattice-based Identity-based Proxy Re-encryption) model in their paper "Lattice-based Identity-based Proxy Re-encryption Scheme." The re-encryption key was constructed as SKA→B=SKA-SKB, lacking unidirectionality. Subsequently, Kunwar et al. constructed an identity-based proxy re-encryption scheme with a trapdoor function in their paper "Lattice-based Identity-based Unidirectional Proxy Re-encryption Scheme," generating two private keys for each user: one for decryption and the other for generating the re-encryption key. However, this scheme was not resistant to collusion attacks. Also in 2016, Jiang et al. proposed a multi-hop, unidirectional LWE-based proxy re-encryption scheme in their paper "Lattice-based Multi-use Unidirectional Proxy Re-encryption." In this scheme, the re-encryption key generation did not interact with any user, thus resisting collusion attacks, but it lacked IND-ID-CPA security. In 2019, Jiang et al. proposed an identity-based proxy re-encryption scheme under the Standard Model in their paper "Efficient Identity-based Proxy Re-encryption on Lattice in the Standard Model." However, this scheme, based on the idea in Kunwar et al.'s paper "Lattice based identity based unidirectional proxy re-encryption scheme," lacks unidirectionality in constructing the re-encryption key. In 2021, Wu et al. proposed an adaptive, secure, and verifiable identity-based proxy re-encryption scheme based on the LWE problem in their paper "IB-VPRE: adaptively secure identity-based proxy re-encryption scheme from LWE with re-encryption verifiability." However, this scheme suffers from excessive common parameters and trapdoor storage overhead.

[0011] Given that current identity-based proxy re-encryption schemes based on the learning with errors (LWE) problem are mostly based on random oracle models, they suffer from problems such as lack of one-wayness, inability to resist collusion attacks, lack of IND-ID-CPA security, and excessive storage overhead for public parameters and trapdoors, it is necessary to design a new identity-based proxy re-encryption method to solve these problems. Summary of the Invention

[0012] To address the shortcomings of existing technologies, this invention proposes a short common parameter identity-based proxy re-encryption method based on the LWE problem.

[0013] To achieve the above objectives, the present invention provides the following technical solution:

[0014] A short common parameter identity-based proxy re-encryption method based on the LWE problem is proposed. Based on the decisional LWE hard assumption, an identity-based proxy re-encryption scheme is constructed under the standard model. In this scheme, a trapdoor matrix is ​​generated by a trapdoor generation algorithm and used as the master private key MSK. The identity sequence of length l bits is divided into l′ = l / β blocks by a block-splitting technique.

[0015] Furthermore, the block-based method is as follows: Let the identity ID be an l-bit string, i.e., id∈{-1, 1}. l Divide id into l′ segments, i.e. (b1, b2, ..., b l′ ), where b i (1≤i≤l′) is a string of β=l / l′ bits.

[0016] Furthermore, the identity-based proxy re-encryption scheme includes the following steps:

[0017] S1, Setup(1 n Input the safety parameter n and other parameters m, q, l, k, and perform the following steps:

[0018] (1) Using a trapdoor generation algorithm Generating matrix With the trapdoor

[0019] (2) Uniformly and randomly select l′+1 matrices and

[0020] (3) Uniformly and randomly select a matrix

[0021] (4) Output common parameters PP = {A0, A i B, U} and master private key

[0022] S2, KeyGen(PP,MSK,id): Input public parameters PP, master private key MSK, and identity id = (b1, b2, ..., b l′ And perform the following steps:

[0023] (1) Let

[0024] (2) Using the left sampling algorithm Extract user private key And satisfy F id ·S id =U;

[0025] (3) Output the user's private key

[0026] S3, Enc(PP,id,m): Input common parameters PP, identity id = (b1, b2, ..., bm) l′ ) and message m∈{0,1} l And perform the following steps:

[0027] (1) Let

[0028] (2) Uniformly random selection of vectors

[0029] (3) From {-1, 1} m×m l′ matrices are randomly selected uniformly from the middle. make

[0030] (4) Selecting the noise vector and And calculate

[0031] (5) Let message m∈{0,1} l ,calculate:

[0032]

[0033] (6) Output ciphertext

[0034] S4, ReKeyGen(PP,id) A ,id B ,S A ): Input common parameters PP, identity ID A and ID B and private key S A And perform the following steps:

[0035] (1) Select two noise matrices and

[0036] (2) Uniformly and randomly select a matrix

[0037] (3) Calculate the re-encryption key

[0038]

[0039] (4) Output the re-encryption key

[0040] S5, ReEnc(RK) A→B ,c A ): Enter the re-encryption key RK A→B The encrypted text c of user A A And perform the following steps:

[0041] (1) Calculate the ciphertext c of user B. B =(c B，1 c B，2 ) = [Bits(c A，1 )|(c A，2 )]·RK A→B ;

[0042] (2) Output user B's ciphertext c B ;

[0043] S6、Dec(c id ,S id ): Input ciphertext c id and user private key S id And perform the following steps:

[0044] (1) Calculate plaintext m′=c2-c1·S id For m′ i (i = 1, 2, ..., l), if Let m′ i =1, otherwise, let m′ i =0;

[0045] (2) Output plaintext m′.

[0046] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0047] This invention proposes a short common-parameter identity-based proxy re-encryption method based on the LWE problem. Based on the decisional LWE hardness assumption, it constructs an identity-based proxy re-encryption scheme under the standard model. Through a simpler and more efficient trapdoor generation algorithm, it generates a trapdoor matrix, i.e., a short basis on the lattice, and uses it as the master private key (MSK). By using a block-sharing technique, the l-bit identity sequence is divided into l′ = l / β blocks, reducing the number of common parameters to be selected. The size of both the master private key and the common parameters is reduced, the computational complexity of the common parameters is lowered, computational efficiency is improved, and storage overhead is reduced. This invention satisfies adaptive IND-ID-CPA security under the standard model, possesses unidirectionality and limited multi-hop capability, and can resist collusion attacks. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0049] Figure 1 A flowchart of a short common parameter identity base proxy re-encryption method based on the LWE problem provided in an embodiment of the present invention. Detailed Implementation

[0050] To better understand this technical solution, the method of the present invention will be described in detail below with reference to the accompanying drawings.

[0051] The LWE problem: Given a matrix A, and the product of A and a vector x, plus a certain error e (Ax + e), how to effectively learn an unknown vector? This type of problem is collectively called the LWE problem. This invention proposes a short common parameter identity-based proxy re-encryption method based on the LWE problem. Based on the decisional LWE hardness assumption, it constructs an identity-based proxy re-encryption scheme under the standard model. Specifically, this invention generates a trapdoor matrix using a concise and efficient trapdoor generation algorithm and uses it as the master private key (MSK). Furthermore, it divides the l-bit identity sequence into l′ = l / β blocks using a block-splitting technique, reducing the number of common parameters selected and shrinking the size of the common parameters.

[0052] The block partitioning method is as follows: Let the identity ID be an l-bit string, i.e., id∈{-1, 1}. l Divide id into l′ segments, i.e. (b1, b2, ..., b l′ ), where b i (1≤i≤l′) is a string of B = l / l′ bits.

[0053] like Figure 1As shown, the short common parameter identity-based proxy re-encryption method of the present invention for the LWE problem specifically includes the following steps:

[0054] S1, Setup(1 n ): Input safety parameter n and other parameters m, q, l, k, where m = O(nlog q), q ≥ 2, n ≥ 1. Let l be a positive integer, and perform the following steps:

[0055] (1) Using a trapdoor generation algorithm Generating matrix With the trapdoor To randomly select a matrix, Let be an invertible matrix, where m = w = nk;

[0056] (2) Uniformly and randomly select l′+1 matrices and B is a randomly selected matrix / vector;

[0057] (3) Uniformly and randomly select a matrix U is a randomly selected matrix / vector;

[0058] (4) Output common parameters PP = {A0, A i B, U} and master private key A0、A i B and U are all common parameters;

[0059] S2, KeyGen(PP,MSK,id): Input public parameters PP, master private key MSK, and identity id = (b1, b2, ..., b l′ And perform the following steps:

[0060] (1) Let F id =(A0|A id F is a randomly selected matrix / vector, which can be regarded as an intermediate value for obtaining the user's private key S later.

[0061] (2) Using the left sampling algorithm SampleLeft(A0, T) A0 A id Extracting user private key (U,s) And satisfy F id ·S id =U;

[0062] (3) Output the user's private key

[0063] S3, Enc(PP,id,m): Input common parameters PP, identity id = (b1, b2, ..., bm) l′ ) and message m∈{0,1} l And perform the following steps:

[0064] (1) Let

[0065] (2) Uniformly random selection of vectors

[0066] (3) From {-1, 1} m×m l′ matrices are randomly selected uniformly from the middle. make b i It is a string of β = l / l' bits;

[0067] (4) Selecting the noise vector and And calculate

[0068] (5) Let message m∈{0,1} l ,calculate:

[0069] c1 and c2 are both parts of the ciphertext, and are finally concatenated to form the output ciphertext.

[0070] (6) Output ciphertext

[0071] S4, ReKeyGen(PP,id) A ,id B ,S A ): Input common parameters PP, identity ID A and ID B and private key S A And perform the following steps:

[0072] (1) Select two noise matrices and

[0073] (2) Uniformly and randomly select a matrix

[0074] (3) Calculate the re-encryption key

[0075]

[0076] (4) Output the re-encryption key

[0077] S5, ReEnc(RK) A→B ,c A): Enter the re-encryption key RK A→B The encrypted text c of user A A And perform the following steps:

[0078] (1) Calculate the ciphertext c of user B. B =(c B，1 c B，2 ) = [Bits(c A，1 )|(c A，2 )]·RK A→B ;

[0079] (2) Output user B's ciphertext c B ;

[0080] S6、Dec(c id ,S id ): Input ciphertext c id and user private key S id And perform the following steps:

[0081] (1) Calculate plaintext m′=c2-c1·S id For m′ i (i = 1, 2, ..., l), if Let m′ i =1, otherwise, let m′ i =0;

[0082] (2) Output plaintext m′.

[0083] This invention proposes a short common-parameter identity-based proxy re-encryption method based on the LWE problem. Based on the decisional LWE hardness assumption, it constructs an identity-based proxy re-encryption scheme under the standard model. Through a simpler and more efficient trapdoor generation algorithm, it generates a trapdoor matrix, i.e., a short basis on the lattice, and uses it as the master private key (MSK). By using a block-sharing technique, the l-bit identity sequence is divided into l′ = l / β blocks, reducing the number of common parameters to be selected. The size of both the master private key and the common parameters is reduced, the computational complexity of the common parameters is lowered, computational efficiency is improved, and storage overhead is reduced. This invention satisfies adaptive IND-ID-CPA security under the standard model, possesses unidirectionality and limited multi-hop capability, and can resist collusion attacks.

[0084] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. However, these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A short common parameter identity-based proxy re-encryption method based on the LWE problem, which constructs an identity-based proxy re-encryption scheme under the standard model based on the decisional LWE hard assumption, characterized in that, A trapdoor matrix is ​​generated using a trapdoor generation algorithm and used as the master private key (MSK); the identity sequence of length l bits is divided into l′ = l / β blocks using a block division technique. The block division method is as follows: Let the identity ID be an l-bit string, that is... Divide id into l′ segments, i.e. ,in yes A string of bits; The identity-based proxy re-encryption scheme includes the following steps: S1, Setup(l n Input the safety parameter n and other parameters m, q, l, k, and perform the following steps: (1) Using the trapdoor generation algorithm Generating matrix With the trapdoor ; (2) Uniformly and randomly select l′+1 matrices and ; (3) Uniformly and randomly select a matrix ; (4) Output common parameters and the master private key ; S2, KeyGen(PP, MSK, id): Input public parameters PP, master private key MSK, and identity. And perform the following steps: (1) Let ; (2) Using the left sampling algorithm Extract user private key and satisfy ; (3) Output the user's private key ; S3, Enc(PP,id,m): Input common parameters PP, identity and messages And perform the following steps: (1) Let ; (2) Uniformly random selection of vectors ; (3) From Uniformly randomized selection matrix ,make ; (4) Selecting the noise vector and and calculate ; (5) Order message ,calculate: ; (6) Output ciphertext ; S4, ReKeyGen(PP, id) A id B , S A ): Input common parameters PP, identity ID A and ID B and private key S A And perform the following steps: (1) Select two noise matrices and ; (2) Uniformly and randomly select a matrix ; (3) Calculate the re-encryption key ; (4) Output the re-encryption key ; S5, ReEnc(RK) A→B , c A ): Enter the re-encryption key RK A→B And user A's encrypted text c A And perform the following steps: (1) Calculate user B's ciphertext ; (2) Output user B's ciphertext c B ; S6、Dec(c id , S id ): Input ciphertext c id and user private key S id And perform the following steps: (1) Calculate plaintext ,for ,if Then let Otherwise, let ; (2) Output plaintext .

Images