Paper 2012/559

Plaintext Awareness in Identity-Based Key Encapsulation

Mark Manulis, Bertram Poettering, and Douglas Stebila

Abstract

The notion of plaintext awareness (PA) has many applications in public key cryptography: it offers unique, stand-alone security guarantees for public key encryption schemes, has been used as a sufficient condition for proving indistinguishability against adaptive chosen ciphertext attacks (INDCCA), and can be used to construct privacy-preserving protocols such as deniable authentication. Unlike many other security notions, plaintext awareness is very fragile when it comes to differences between the random oracle and standard models; for example, many implications involving PA in the random oracle model are not valid in the standard model and vice versa. Similarly, strategies for proving PA of schemes in one model cannot be adapted to the other model. Existing research addresses PA in detail only in the public key setting. This paper gives the first formal exploration of plaintext awareness in the identity-based setting and, as initial work, proceeds in the random oracle model. The focus is laid mainly on identity-based key encapsulation mechanisms (IB-KEMs), for which the paper presents the first definitions of plaintext awareness, highlights the role of PA in proof strategies of INDCCA security, and explores relationships between PA and other security properties. On the practical side, our work offers the first, highly efficient, general approach for building IB-KEMs that are simultaneously plaintext-aware and INDCCA-secure. Our construction is inspired by the Fujisaki-Okamoto (FO) transform, but demands weaker and more natural properties of its building blocks. This result comes from a new look at the notion of gamma-uniformity that was inherent in the original FO transform. We show that for IB-KEMs (and PK-KEMs) this assumption can be replaced with a weaker computational notion, which is in fact implied by one-wayness. Finally, we give the first concrete IB-KEM scheme that is PA and INDCCA-secure by applying our construction to a popular IB-KEM and optimizing it for better performance.

Metadata
Available format(s)
PDF
Category
Public-key cryptography
Publication info
Published elsewhere. International Journal of Information Security
DOI
10.1007/s10207-013-0218-5
Keywords
plaintext awarenessidentity-based encryptionkey encapsulation mechanism
Contact author(s)
douglas @ stebila ca
History
2014-01-27: revised
2012-09-30: received
See all versions
Short URL
https://ia.cr/2012/559
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2012/559,
      author = {Mark Manulis and Bertram Poettering and Douglas Stebila},
      title = {Plaintext Awareness in Identity-Based Key Encapsulation},
      howpublished = {Cryptology ePrint Archive, Paper 2012/559},
      year = {2012},
      doi = {10.1007/s10207-013-0218-5},
      note = {\url{https://eprint.iacr.org/2012/559}},
      url = {https://eprint.iacr.org/2012/559}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.