Revisiting HRA and CCA Security in Lattice-Based Proxy Re-Encryption

Haotian Yin; Jie Zhang; Yuji Dong; Eng Gee Lim; Dominik Wojtczak

Paper 2025/704

Revisiting HRA and CCA Security in Lattice-Based Proxy Re-Encryption

Haotian Yin

, School of Advanced Technology, Xi'an Jiaotong-Liverpool University, Suzhou, 215123, China

Jie Zhang, School of Advanced Technology, Xi'an Jiaotong-Liverpool University, Suzhou, 215123, China

Yuji Dong, School of Internet of Things, Xi'an Jiaotong-Liverpool University, Suzhou, 215400, China

Eng Gee Lim, School of Advanced Technology, Xi'an Jiaotong-Liverpool University, Suzhou, 215123, China

Dominik Wojtczak, Department of Computer Science, University of Liverpool, Liverpool, L69 3BX, UK

Abstract

Proxy re-encryption (PRE) enables a semi-trusted proxy to transform ciphertexts between users without learning their plaintexts. In lattice-based PRE, honest re-encryption attack (HRA) security has become a common security goal. However, the relation between HRA and chosen-ciphertext (CCA) security, and the mechanisms needed to achieve HRA security, remain poorly understood. We first clarify the relation between the security notions. We formulate derivative-closure chosen-ciphertext security (DCL-CCA) and show that it implies HRA security at any fixed constant hop depth, including single-hop. We then introduce recorded-provenance chosen-ciphertext security (REC-CCA). For correct PRE schemes, REC-CCA preserves recorded provenance and implies both DCL-CCA and HRA security without a fixed depth bound. We next identify two attacks on linear re-encryption schemes that fail to hide correlations across honest transcripts. The first reconstructs the re-encryption functionality from distinct honest input--output pairs. The second uses repeated re-encryptions to average away fresh noise before reconstruction. Under the reusable-key convention, we obtain an HRA attack on the construction of Susilo et al. (ESORICS'21). For the construction of Fan and Liu (ACNS'19), we obtain a conditional attack under the noise-bearing interpretation of their re-encryption specification and the stated polynomial-noise and modulus-to-noise regime. Finally, building on stateful source-bound masking, we give a feasibility result for standard public-key PRE in the idealised continuous-Gaussian arithmetic model of Micciancio and Suhl (CiC'25). Our stateful, unidirectional, single-hop PRE scheme combines gadget key switching with Reused-\(A\) LWE. It achieves HRA security against static corruption for a public H2H delegation DAG fixed after registration. The resulting instantiation uses a polynomial modulus and a source pad only a constant factor wider than the decisional-LWE error width. Thus, in this setting, HRA security does not require superpolynomial statistical noise flooding.

Note: Update definitions and proofs; add a new construction

Metadata

Available format(s): PDF
Category: Public-key cryptography
Publication info: Preprint.
Keywords: Proxy re-encryption HRA security CCA security Learning with errors Key switching
Contact author(s): haotian yin23 @ student xjtlu edu cn
History: 2026-08-17: last of 4 revisions; 2025-04-18: received; See all versions
Short URL: https://ia.cr/2025/704
License: CC BY

BibTeX

@misc{cryptoeprint:2025/704,
      author = {Haotian Yin and Jie Zhang and Yuji Dong and Eng Gee Lim and Dominik Wojtczak},
      title = {Revisiting {HRA} and {CCA} Security in Lattice-Based Proxy Re-Encryption},
      howpublished = {Cryptology {ePrint} Archive, Paper 2025/704},
      year = {2025},
      url = {https://eprint.iacr.org/2025/704}
}