Douglas Stebila

Plaintext awareness in identity-based key encapsulation

Relationships between security notions and results of generic transformations for IB-KEMs.

Abstract

The notion of plaintext awareness (PA) has many applications in public key cryptography: it offers unique, stand-alone security guarantees for public key encryption schemes, has been used as a sufficient condition for proving indistinguishability against adaptive chosen ciphertext attacks (INDCCA), and can be used to construct privacy-preserving protocols such as deniable authentication. Unlike many other security notions, plaintext awareness is very fragile when it comes to differences between the random oracle and standard models; for example, many implications involving PA in the random oracle model are not valid in the standard model and vice versa. Similarly, strategies for proving PA of schemes in one model cannot be adapted to the other model. Existing research addresses PA in detail only in the public key setting.

This paper gives the first formal exploration of plaintext awareness in the identity-based setting and, as initial work, proceeds in the random oracle model. The focus is laid mainly on identity-based key encapsulation mechanisms (IB-KEMs), for which the paper presents the first definitions of plaintext awareness, highlights the role of PA in proof strategies of INDCCA security, and explores relationships between PA and other security properties.

On the practical side, our work offers the first, highly efficient, general approach for building IB-KEMs that are simultaneously plaintext-aware and INDCCA-secure. Our construction is inspired by the Fujisaki-Okamoto (FO) transform, but demands weaker and more natural properties of its building blocks. This result comes from a new look at the notion of gamma-uniformity that was inherent in the original FO transform. We show that for IB-KEMs (and PK-KEMs) this assumption can be replaced with a weaker computational notion, which is in fact implied by one-wayness. Finally, we give the first concrete IB-KEM scheme that is PA and INDCCA-secure by applying our construction to a popular IB-KEM and optimizing it for better performance.

Keywords: plaintext awareness, identity-based encryption, key encapsulation mechanism

Reference

Mark Manulis, Bertram Poettering, Douglas Stebila. Plaintext awareness in identity-based key encapsulation. International Journal of Information Security, 13(1):25-49. February 2014. © Springer.

Download

BibTeX

@article{IJIS:ManPoeSte14,
 	Author = {Mark Manulis and Bertram Poettering and Douglas Stebila},
 	Doi = {10.1007/s10207-013-0218-5},
 	Journal = {International Journal of Information Security},
 	Month = {February},
 	Number = {1},
 	Pages = {25--49},
 	Publisher = {Springer},
 	Title = {Plaintext awareness in identity-based key encapsulation},
 	Volume = {13},
 	Year = {2014}
 }

Funding

• Australian Research Council (ARC) Discovery Project grant DP130104304
• Australia’s Department of Innovation, Industry, Science and Research (DIISR)
• German Academic Exchange Service (DAAD) grant 53361649
• German Research Foundation (DFG) grant MA 4096
• Center of Advanced Security Research Darmstadt (CASED)
• European Center for Security and Privacy by Design (EC SPRIDE)