DMCA
Circular and leakage resilient public-key encryption under subgroup indistinguishability - (or: Quadratic residuosity strikes back (2010)
| Venue: | In CRYPTO |
| Citations: | 33 - 4 self |
BibTeX
@INPROCEEDINGS{Brakerski10circularand,
author = {Zvika Brakerski and Shafi Goldwasser},
title = {Circular and leakage resilient public-key encryption under subgroup indistinguishability - (or: Quadratic residuosity strikes back},
booktitle = {In CRYPTO},
year = {2010},
pages = {1--20}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
The main results of this work are new public-key encryption schemes that, under the quadratic residuosity (QR) assumption (or Paillier’s decisional composite residuosity (DCR) assumption), achieve key-dependent message security as well as high resilience to secret key leakage and high resilience to the presence of auxiliary input information. In particular, under what we call the subgroup indistinguishability assumption, of which the QR and DCR are special cases, we can construct a scheme that has: • Key-dependent message (circular) security. Achieves security even when encrypting affine functions of its own secret key (in fact, w.r.t. affine “key-cycles ” of predefined length). Our scheme also meets the requirements for extending key-dependent message security to broader classes of functions beyond affine functions using previous techniques of [BGK, ePrint09] or [BHHI, Eurocrypt10]. • Leakage resiliency. Remains secure even if any adversarial low-entropy (efficiently com-putable) function of the secret key is given to the adversary. A proper selection of param-eters allows for a “leakage rate ” of (1 − o(1)) of the length of the secret key.
Keyphrases
subgroup indistinguishability leakage resilient public-key encryption quadratic residuosity strike secret key affine function key-dependent message security high resilience auxiliary input information proper selection affine key-cycles main result leakage resiliency adversarial low-entropy decisional composite residuosity special case new public-key encryption scheme key-dependent message previous technique param-eters allows subgroup indistinguishability assumption predefined length leakage rate quadratic residuosity key leakage
