Enhanced Security for Existing Public Key Infrastructure
AssigneeNTT Research, Inc.
InventorsDakshita KHURANA, Brent Waters
Life of this patent
Estimating the term…
Abstract
Systems, methods, network devices, and machine-readable media disclosed herein perform chosen ciphertext attack secure encryption given any public key infrastructure that has been established with only chosen plaintext attack security. The resulting chosen ciphertext attack secure encryption makes black-box use of the chosen plaintext attack secure scheme and other underlying primitives, and specifically new public keys do not need to be created or distributed.
Claims12
A method for generating a chosen ciphertext attack (CCA) secure message using a chosen plaintext attack (CPA) encryption scheme, the method comprising:
- receiving a plaintext message for encryption;
- receiving an encryption algorithm, wherein the algorithm comprises computer-readable instructions that when executed are capable of producing a ciphertext that is CPA secure;
- executing a hinting pseudorandom generator on a random seed to generate a pseudorandom encoding of the seed, and computing a one-time pad encryption c of the plaintext message using the pseudorandom encoding;
- generating a set S of equivocal commitments having openings to each bit of the seed, wherein an equivocal commitment is an unkeyed encryption of the seed with usual equivocal properties;
- executing the encryption algorithm on the equivocal commitment openings and a selected part of the pseudorandom encoding to obtain a set of ciphertexts C0;
- generating a set of specific commitments C1 to the equivocal commitment openings and the selected part of the pseudorandom encoding, wherein the commitment is an unkeyed encryption;
- and
- outputting public parameters of the hinting pseudorandom generator, the one-time pad encryption c, the set S of equivocal commitments, the set of ciphertexts C0, and the set of commitments C1 as a CCA secure ciphertext output.
A method for decrypting a ciphertext, the ciphertext having been encrypted according to a chosen ciphertext attack secure adaptation of a chosen plaintext attack (CPA)-secure encryption scheme, the method comprising:
- receiving secret key sk for the CPA-secure encryption scheme;
- receiving a ciphertext comprising hinting pseudorandom generator public parameters, a one-time pad encryption c, a set S of equivocal commitments, a set of ciphertexts C0 and a set of commitments C1;
- recovering a candidate hinting pseudorandom generator seed d bit-by-bit by performing for each i the following steps:
- computing mi by decrypting the ciphertext c0,i in the set C0 using secret key sk;
- setting di=0 if mi is a valid opening to 0 of the equivocal commitment, otherwise setting di=1;
- checking the candidate seed d by executing a check algorithm;
- and
- decrypting the one-time pad component of the ciphertext by using the candidate seed.
A system for generating a chosen ciphertext attack (CCA) secure message using a chosen plaintext attack (CPA) encryption scheme, the system comprising:
- a computer processor configured for:
- receiving a plaintext message for encryption;
- receiving an encryption algorithm, wherein the algorithm comprises computer-readable instructions that when executed are capable of producing a ciphertext that is CPA secure;
- executing a hinting pseudorandom generator on a random seed to generate a pseudorandom encoding of the seed, and computing a one-time pad encryption c of the plaintext message using the pseudorandom encoding;
- generating a set S of equivocal commitments having openings to each bit of the seed, wherein an equivocal commitment is an unkeyed encryption of the seed with usual equivocal properties;
- executing the encryption algorithm on the equivocal commitment openings and a selected part of the pseudorandom encoding to obtain a set of ciphertexts C0;
- generating a set of specific commitments C1 to the equivocal commitment openings and the selected part of the pseudorandom encoding, wherein the commitment is an unkeyed encryption;
- outputting public parameters of the hinting pseudorandom generator, the one-time pad encryption c, the set S of equivocal commitments, the set of ciphertexts C0, and the set of commitments C1 as a CCA secure ciphertext output.
A system for decrypting a ciphertext, the ciphertext having been encrypted according to a chosen ciphertext attack secure adaptation of a chosen plaintext attack (CPA)-secure encryption scheme, the system comprising:
- a computer processor configured for:
- receiving secret key sk for the CPA-secure encryption scheme;
- receiving a ciphertext comprising hinting pseudorandom generator public parameters, a one-time pad encryption c, a set S of equivocal commitments, a set of ciphertexts C0 and a set of commitments C1;
- recovering a candidate hinting pseudorandom generator seed d bit-by-bit by performing for each i the following steps:
- computing mi by decrypting the ciphertext c0,i in the set C0 using secret key sk;
- setting di=0 if m;
- is a valid opening to 0 of the equivocal commitment, otherwise setting di=1;
- checking the candidate seed d by executing a check algorithm;
- and
- decrypting the one-time pad component of the ciphertext by using the candidate seed.
Dependencies are inferred from the claim text.