Zhang Yuan, Liu Yuan, Guo Yurong, Zheng Shihui, Wang Licheng
State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China.
Entropy (Basel). 2020 Nov 2;22(11):1247. doi: 10.3390/e22111247.
Identity-based encryption (IBE), and its hierarchical extension (HIBE), are interesting cryptographic primitives that aim at the implicit authentication on the users' public keys by using users' identities directly. During the past several decades, numerous elegant pairing-based (H)IBE schemes were proposed. However, most pairing-related security assumptions suffer from known quantum algorithmic attacks. Therefore, the construction of lattice-based (H)IBE became one of the hot directions in recent years. In the setting of most existing lattice-based (H)IBE schemes, each bit of a user's identity is always associated with a parameter matrix. This always leads to drastic but unfavorable increases in the sizes of the system public parameters. To overcome this issue, we propose a flexible trade-off mechanism between the size of the public parameters and the involved computational cost using the blocking technique. More specifically, we divide an identity into l' segments and associate each segment with a matrix, while increasing the lattice modulo slightly for maintaining the same security level. As a result, for the setting of 160-bit identities, we show that the size of the public parameters can be reduced by almost 89.7% (resp. 93.8%) while increasing the computational cost by merely 5.2% (resp. 12.25%) when l' is a set of 16 (resp. 8). Finally, our IBE scheme is extended to an HIBE scheme, and both of them are proved to achieve the indistinguishability of ciphertexts against adaptively chosen identity and chosen plaintext attack (IND-ID-CPA) in the standard model, assuming that the well-known ring learning with error (RLWE) problem over the involved ideal lattices is intractable, even in the post-quantum era.
基于身份的加密（IBE）及其分层扩展（HIBE）是有趣的密码原语，旨在通过直接使用用户身份对用户公钥进行隐式认证。在过去几十年中，人们提出了许多优雅的基于配对的（H）IBE方案。然而，大多数与配对相关的安全假设都遭受已知的量子算法攻击。因此，基于格的（H）IBE构造成为近年来的热门方向之一。在大多数现有的基于格的（H）IBE方案中，用户身份的每一位总是与一个参数矩阵相关联。这总是导致系统公共参数大小急剧但不利地增加。为了克服这个问题，我们使用分块技术提出了一种在公共参数大小和所涉及的计算成本之间灵活的权衡机制。更具体地说，我们将一个身份划分为l'个段，并将每个段与一个矩阵相关联，同时稍微增加格模数以保持相同的安全级别。结果，对于160位身份的设置，我们表明当l'为16（分别为8）时，公共参数的大小可以减少近89.7%（分别为93.8%），而计算成本仅增加5.2%（分别为12.25%）。最后，我们将IBE方案扩展为HIBE方案，并且在标准模型中证明它们两者都能实现针对自适应选择身份和选择明文攻击（IND-ID-CPA）的密文不可区分性，假设在所涉及的理想格上著名的带误差环学习（RLWE）问题是难解的，即使在量子后时代也是如此。
