Incompressible Ciphertext Expansion Against Key-Leakage Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing public key encryption schemes are not incompressible, allowing adversaries to store a digest of the ciphertext and obtain non-trivial information about the plaintext once the secret key is leaked, compromising message secrecy, and traditional signature schemes enable man-in-the-middle attacks by allowing adversaries to delay message transmission.
Innovation Solution
Construct incompressible public key encryption and signature schemes that force adversaries to store the entire ciphertext or signature to maintain message privacy, even if the decryption key leaks, using techniques such as functional encryption and randomness extraction to ensure security with minimal assumptions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional public key encryption schemes are used, then encryption efficiency is improved, but adversaries can store a digest of the ciphertext and obtain non-trivial information about the plaintext once the secret key is leaked
Solution Approach 1:
The ciphertext is segmented into two parts: a short digest that can be stored efficiently, and a large random pad that provides security. The digest contains enough information to recover the message if the secret key is compromised, while the random pad ensures that storing only the digest without the full ciphertext does not reveal meaningful information about the plaintext.
Solution Approach 2:
A randomness extractor is introduced as an intermediary component that processes the large random pad to generate the short digest. This extractor acts as a mediator between the full ciphertext and the stored digest, ensuring that the digest contains sufficient information for recovery while maintaining security against adversaries who only possess the digest.
2Speed
If hybrid encryption is used to improve efficiency, then encryption speed is improved, but adversaries can store just Enc(pk, s) and first few bits of G(s)⊕m to compromise secrecy
Solution Approach 1:
The encryption output is segmented into a short seed encryption Enc(pk, s) and a masked message portion G(s)⊕m. The short seed can be efficiently stored and processed, while the masked portion provides the security guarantee that adversaries cannot obtain meaningful information without possessing both components.
Solution Approach 2:
The scheme changes the parameters of the encryption output by using a pseudorandom generator G to expand the short seed s into a long pseudorandom string that masks the entire message. This parameter transformation allows efficient storage of the seed while maintaining security through the masking property.
3Device complexity
If traditional signature schemes are used, then signature generation is simplified, but man-in-the-middle attacks are enabled by allowing adversaries to delay message transmission
Solution Approach 1:
The signature scheme incorporates preliminary action by requiring adversaries to store the entire signature in advance before they can perform any verification or delay attacks. This preliminary storage requirement prevents man-in-the-middle attacks because the adversary cannot selectively store or manipulate parts of the signature without possessing the complete signature data.
Data Source
AI summary
The disclosure relates to generating a ciphertext of arbitrary and flexibly large size and ensures that an adversary learns little about the encrypted data, even if the decryption key later leaks, unless substantially the entire ciphertext is stored. Given that communication will be inconveniently large for the adversary to store, the incompressible ciphertexts and signatures can be sent and received with low storage requirements for the honest users. In such a setting, the honest users would not store the entire ciphertext or signature, but instead generate, send, and process the communication bit-by-bit in a streaming fashion.