Paper 2025/1297

On the Relations between Matchmaking Public Key Encryption and Public Key Authenticated Encryption with Keyword Search

Abstract

Ateniese et al. (CRYPTO 2019/JoC 2021) introduced a cryptographic primitive which they call matchmaking encryption (ME), and Identity-based ME (IB-ME) is its identity-based variant. IB-ME supports an equality matching where a sender (encryptor) indicates a receiver's (decryptor's) identity (rcv) in addition to their own ID ($\sigma$), and a receiver indicates a sender's identity (snd) in addition to the own identity ($\rho$). A ciphertext is decrypted if $(\sigma,\rho)=$(snd,rcv). In this paper, we pay attention to the search condition of public key authenticated encryption with keyword search (PAEKS) (Huang-Li, Information Sciences 2017) is reminiscent of the equality matching. We introduce a public key variant of ME which we call PK-ME, and propose a generic construction of PK-ME from PAEKS. As a conceptual contribution, our work lies in revealing a connection between ME and public key searchable encryption, which were independently researched so far. Due to the generic construction of PAEKS (Li-Boyen, IACR CiC 2024), we can instantiate the proposed generic construction from pairings or lattices. We also introduce a weaker version of authenticity and show that it can be instantiated from several complexity assumptions. Finally, we discuss the advantage/disadvantage of PK-ME compared to IB-ME.

Note: An extended abstract appeared at the 24th International Conference on Cryptology and Network Security (CANS) 2025. In this full version, we introduce a weaker version of authenticity that can be achieved by only the TI security, and demonstrate that our generic construction with weak authenticity can be instantiated from several complexity assumptions such as pairing-free computational/decisional Diffie-Hellman, pairings, integer factorizations, lattices, and isogenies.