Paper 2025/1384

Silent Threshold Encryption with One-Shot Adaptive Security

Abstract

Threshold encryption enables a sender to encrypt a message towards $n$ recipients, such that any $t+1$ parties can decrypt the message, whereas any subset of size $t$ cannot. Silent threshold encryption additionally requires that all recipients can generate their public keys independently of each other, without engaging in an interactive distributed key generation protocol. In this work, we consider a relaxed notion of silent threshold encryption with \emph{soft} thresholds. In this setting, we choose parameters $c \in (0,1)$ and $\epsilon >0$, and we only require that $(c - \epsilon)n$ parties cannot, while $(c + \epsilon)n$ parties can decrypt the message. We present a simple blueprint for constructing efficient silent threshold encryption schemes for soft thresholds. Our construction has ciphertexts and recipient public keys, whose sizes are independent of $n$. As an exemplary data point, tolerating $t < n/3$ corruptions and encrypting $1$ MB results in a ciphertext of size $1.072$ MB. When instantiating our construction for the same parameters in a plausibly post-quantum secure manner, we have a ciphertext size of $1.431$ MB. Our construction is proven secure in the presence of \emph{one-shot adaptive corruptions}, a novel notion introduced in this work that conceptually lays between static and fully adaptive corruptions. We believe that the notion itself and our associated proof techniques are of independent interest. In comparison to prior works for the exact threshold setting, we have smaller recipient public keys, we do not rely on strong assumptions, such as indistinguishability obfuscation, or the generic group model, we are plausibly post-quantum secure, and we prove security for a non-trivial notion of adaptive corruptions.