Encryption Public-Key, Identity-Based, Attribute-Based

I. Public key encryption and security concepts Eve 2 Use encryption to prevent eavesdropping and achieve confidentiality.

Public key encryption 3 Bob  generates pair of public key pk B and secret key sk B  makes pk B public  decrypts with sk B Alice  encrypts message m with pk B  sends encrypted message/ciphertext c

Public-key encryption schemes 4

Negligible functions 5

Security concepts 6 Security concepts must specify  goals of adversary  resources of adversary  additional information available to adversary.  adversaries should learn almost nothing about plaintext given a ciphertext  adversaries will be probabilistic polynomial time algorithms.  adversaries known complete specifications of encryption schemes (Kerckhoff’s principle)  additional information formalized with chosen plaintext and chosen ciphertext attacks

The CPA game 7

8

CPA security 9

The CCA game 10

CCA security 11 Observation CPA security does not imply CCA security.

PKC and reality 12 Certification Authority (CA)

Certificates and certification authorities 13  require significant organizational and technical overhead  require complex data management  their complexity can become a threat to security

Public key vs. identity-based encryption 14  PKE requires special pairs of keys, not all bit strings can be public keys  in IBE every bit string or identity can be public key  identities can already be certified, e.g. passport numbers  may simplify necessary infrastructure  IBE introduced in 1984 by A. Shamir  first fully functional realization in 2001 by Boneh, Franklin  can be generalized to attribute-based encryption

Identity-based enryption 15 Private Key Generator

Identity-based enryption 16

Identity-based enryption 17 Private Key Generator

Security concepts 18 Security concepts must specify  goals of adversary  resources of adversary  additional information available to adversary.  adversaries should learn almost nothing about plaintext given a ciphertext  adversaries will be probabilistic polynomial time algorithms.  adversaries known complete specifications of encryption schemes (Kerckhoff’s principle)  additional information formalized with chosen plaintext and chosen ciphertext attacks

IBE security – additional requirements 19  adversaries should learn almost nothing about plaintext given a ciphertext  adversaries will be probabilistic polynomial time algorithms.  adversaries known complete specifications of encryption schemes (Kerckhoff’s principle)  additional information formalized with chosen plaintext and chosen ciphertext attacks  adversary may know private keys to many identities Challenge Exponentially (in n) many private keys depend on master secret msk of polynomial (in n) length.

The CPA game 20

The CCA game 21

IBE security 22

Power of PKG 23 Private Key Generator PKG is  very powerful  attractive target for attacks Possible solutions  secure protocols  distributed realization

PKG via secure protocols 24 Private Key Generator

Distributed PKG 25

Boneh-Franklin IBE and pairings 26  uses one basic primitive – bilinear pairings  concrete realization with groups on elliptic curves  examples are Weil, Tate, Eta, Ate pairing  but can be described with generic pairings  share this feature with most techniques in IBC

Boneh-Franklin IBE and pairings 27

Simplified Boneh-Franklin IBE 28

Boneh-Franklin IBE - correctness 29

Boneh-Franklin IBE 30

Boneh-Franklin IBE - correctness 31