Appendix: Review of standard definitions
Public-key encryption with keyword search
A non-interactive PEKS scheme [12] consists of four PPT algorithms as follows:
-
\(\mathsf {KeyGen}(\kappa )\): take as input a security parameter \(\kappa \), output a public/secret key pair \((pk, sk)\). Let \(W\) be the set of all possible keywords.
-
\(\mathsf {Encrypt}(pk, w)\): take as input a public key \(pk\) and a keyword \(w \in W\), output a ciphertext \(s\).
-
\(\mathsf {TokenGen}(sk, w)\): take as input a secret key \(sk\) and a keyword \(w \in W\), output a token \(t_w\).
-
\(\mathsf {Test}(t_w, s)\): take as input a token \(t_w\) and a ciphertext \(s \leftarrow \mathsf {Encrypt}(pk, w')\), output 1 if \(w' = w\) and 0 otherwise.
The IND-PEKS-CPA security for PEKS schemes is defined by the following experiment:
Setup:
\(\mathcal {CH}\) runs \(\mathsf {KeyGen}(\kappa )\) to generate \((pk, sk)\) and gives \(\mathcal {A}\) the public key \(pk\).
Phase 1:
\(\mathcal {A}\) can adaptively make token queries \(\langle w \rangle \). \(\mathcal {CH}\) responds with \(t_w \leftarrow \mathsf {TokenGen}(sk, w)\).
Challenge:
\(\mathcal {A}\) outputs two distinct keywords \(w_0^*, w_1^* \in W\) subject to the restriction that they had not been asked for tokens in Phase 1. \(\mathcal {CH}\) picks a random bit \(b\) and sends \(c^* \leftarrow \mathsf {Encrypt}(pk, w_b^*)\) to \(\mathcal {A}\) as the challenge ciphertext.
Phase 2:
\(\mathcal {A}\) can adaptively make more token queries \(\langle w \rangle \) subject to the restriction that \(w \ne w_0^*, w_1^*\). \(\mathcal {CH}\) responds the same way as in Phase 1.
Guess:
\(\mathcal {A}\) outputs a guess \(b'\) for \(b\) and succeeds if \(b' = b\). We denote this event by \({\mathsf {SuccA}}\) and define \(\mathcal {A}\)’s advantage as \(\mathrm {Adv}_{\mathcal {A}, \text {PEKS}}^{\text {IND-CPA}}(\kappa ) \mathop {=}\limits ^{def }|\Pr [{\mathsf {SuccA}}] - 1/2|\).
Definition 8.1
A PEKS scheme is \((t, q_w, \epsilon )\) IND-PEKS-CPA secure if for all \(t\)-time adversaries making at most \(q_w\) token queries have advantage at most \(\epsilon \) in the above experiment.
The IND-PEKS-CCA security for PEKS schemes can be defined by a similar experiment by giving the adversary access to an additional test oracle which can determine if \(c\) is an encryption of \(w\). To avoid triviality, test queries \(\langle c^*, w_0^* \rangle \) and \(\langle c^*, w_1^* \rangle \) are not allowed in Phase 2.
Definition 8.2
A PEKS scheme is \((t, q_w, q_t, \epsilon )\) IND-PEKS-CCA secure if for all \(t\)-time adversaries making at most \(q_w\) token queries and at most \(q_t\) test queries have advantage at most \(\epsilon \) in the IND-PEKS-CCA experiment.
Hierarchical identity-based encryption
Hierarchical identity-based encryption (HIBE) [29, 34] is a generalization of IBE [9] to identities supporting hierarchical structures. In an HIBE scheme, identities are hierarchical and take the form \(id = (id_1, id_2, \dots )\). Each user in the hierarchy can act as a local key-generation authority for all subordinate hierarchical identities. An HIBE scheme consists of five PPT algorithms as follows:
-
\(\mathsf {KeyGen}(\kappa , \ell )\): take as input a security parameter \(\kappa \) and a parameter \(\ell \) for the maximum depth of the HIBE, output a master public/secret key pair \((mpk, msk)\). Let \(I\) be the identity space, \(M\) be the message space, and \(C\) be the ciphertext space. We assume \(mpk\) is used as an implicit input for algorithms \(\mathsf {Extract}\), \(\mathsf {Derive}\), as well as \(\mathsf {Decrypt}\),
-
\(\mathsf {Extract}(msk, id)\): take as input \(msk\) and an identity \(id \in I\), output a decryption key \(dk_{id}\).Footnote 8
-
\(\mathsf {Derive}(dk_{id}, id')\): take as input a decryption key \(dk_{id}\) for identity \(id = (id_1, \dots , id_{j-1})\) of depth \(j-1\) and an identity \(id' = (id_1, \dots , id_j)\) of depth \(j\), output a decryption key \(dk_{id'}\) for \(id'\).
-
\(\mathsf {Encrypt}(mpk, id, m)\): take as input \(mpk\), an identity \(id \in I\), and a message \(m \in M\), output a ciphertext \(c \in C\).
-
\(\mathsf {Decrypt}(dk_{id}, c)\): take as input a decryption key \(dk_{id}\) for identity \(id\) and a ciphertext \(c \in C\), output a message \(m \in M\) or a reject symbol \(\bot \) indicating \(c\) is invalid.
The basic security notion for HIBE schemes is indistinguishability against adaptive chosen-plaintext attack (IND-HIBE-CPA), which is defined by the following experiment:
Setup:
\(\mathcal {CH}\) runs \(\mathsf {KeyGen}(\kappa , \ell )\) to generate \((pk, sk)\) and gives \(\mathcal {A}\) the master public key \(mpk\).
Phase 1:
\(\mathcal {A}\) can adaptively make decryption key extraction queries \(\langle id \rangle \). \(\mathcal {CH}\) responds with \(dk_{id} \leftarrow \mathsf {Extract}(msk, id)\).
Challenge:
\(\mathcal {A}\) outputs two distinct messages \(m_0^*\), \(m_1^*\) and an identity \(id^*\) subject to the restriction that any prefix of \(id^*\) had not been queried for decryption keys in Phase 1. \(\mathcal {CH}\) randomly picks a bit \(b\) and sends \(c^* \leftarrow \mathsf {Encrypt}(mpk, id^*, m_b^*)\) to \(\mathcal {A}\) as the challenge ciphertext.
Phase 2:
\(\mathcal {A}\) can adaptively make more decryption key extraction queries \(\langle id \rangle \) subject to the restriction that \(id\) is not a prefix of \(id^*\). \(\mathcal {CH}\) responds the same way as in Phase 1.
Guess:
\(\mathcal {A}\) outputs a guess \(b'\) for \(b\) and succeeds if \(b' = b\). We denote this event by \({\mathsf {SuccA}}\) and define \(\mathcal {A}\)’s advantage as \(Adv _{\mathcal {A}, \text {HIBE}}^{\text {IND-CPA}}(\kappa ) \mathop {=}\limits ^{def }|\Pr [{\mathsf {SuccA}}]- 1/2|\).
Definition 8.3
A HIBE scheme is \((t, q_k, \epsilon )\) IND-HIBE-CPA secure if for all \(t\)-time adversaries making at most \(q_k\) decryption key extraction queries have advantage at most \(\epsilon \) in the above experiment.
Selective-identity IND-HIBE-CPA security can be defined similarly. The difference is that the adversary has to commit a target identity \(id^*\) before seeing \(mpk\) and is not allowed to query decryption keys for any prefix of \(id^*\) throughout the experiment.
Orthogonal to security, anonymity is introduced to capture identity privacy, which ensures the ciphertext reveals no information about the recipient’s identity. To allow a fine-grained treatment, Abdalla et al. [2] defined anonymity regarding to a set \(L\) of levels, meaning that in the anonymous experiment the adversary is challenged to distinguished two distinct identities differing only at levels \(l \in L\). For ease of notation, we will write \(l\) rather than \(\{l\}\) when \(L = \{l\}\) is a singleton set. Let \(\mathsf {diff}(\cdot , \cdot )\) be a function outputting the set of levels at which the two input identities differ. We recall the definition of anonymity for HIBE schemes as follows:
Setup:
\(\mathcal {CH}\) runs \(\mathsf {KeyGen}(\kappa )\) to generate \((pk, sk)\) and gives \(\mathcal {A}\) the master public key \(mpk\).
Phase 1:
\(\mathcal {A}\) can adaptively make decryption key queries \(\langle id \rangle \). \(\mathcal {CH}\) responds with \(dk_{id} \leftarrow \mathsf {Extract}(msk, id)\).
Challenge:
\(\mathcal {A}\) outputs a message \(m^*\) and two distinct identities \(id_0^*\), \(id_1^*\) subject to the restrictions that any prefix of \(id_0^*\) and \(id_1^*\) had not been asked for decryption keys and \(\mathsf {diff}(id_0^*, id_1^*) \subset L\). \(\mathcal {CH}\) picks a random \(b \in \{0,1\}\) and gives \(c^* \leftarrow \mathsf {Encrypt}(mpk, id_b^*, m^*)\) to \(\mathcal {A}\) as the challenge ciphertext.
Phase 2:
\(\mathcal {A}\) can adaptively make more decryption key extraction queries for any identity \(id\) subject to the restriction that \(id\) is not a prefix of \(id_0^*\) or \(id_1^*\). \(\mathcal {CH}\) responds the same way as in Phase 1.
Guess:
\(\mathcal {A}\) outputs a guess \(b'\) for \(b\) and succeeds if \(b'=b\). We denote this event by \({\mathsf {SuccA}}\) and define \(\mathcal {A}\)’s advantage as \(Adv _{\mathcal {A}, \text {HIBE}}^{\text {ANO-CPA}}(\kappa ) \mathop {=}\limits ^{def }|\Pr [{\mathsf {SuccA}}]- 1/2|\).
Definition 8.4
A HIBE scheme is \((t, q_k, \epsilon )\) ANO-HIBE-CPA \([L]\)-anonymous if for all \(t\)-time adversaries making at most \(q_k\) decryption key extraction queries have advantage at most \(\epsilon \) in the above experiment.
When considering anonymity for HIBE schemes in the presence of chosen-ciphertext attack, we obtain the ANO-PEKS-CCA security [3], which is defined by a similar experiment as above by giving the adversary additional access to a decryption oracle subject the natural restriction that decryption queries \(\langle id_0^*, c^* \rangle \) and \(\langle id_1^*, c^* \rangle \) are not allowed in Phase 2.
Definition 8.5
A HIBE scheme is \((t, q_k, q_d, \epsilon )\) ANO-HIBE-CCA \([L]\)-anonymous if for all \(t\)-time adversaries making at most \(q_k\) decryption key extraction queries and at most \(q_d\) decryption queries have advantage at most \(\epsilon \) in the ANO-HIBE-CCA experiment.
Signatures
A signature scheme consists of three PPT algorithms as follows:
-
\(\mathsf {KeyGen}(\kappa )\): take as input a security parameter \(\kappa \), output a verification key \(vk\) and a signing key \(sk_\sigma \). Let \(M\) be the message space.
-
\(\mathsf {Sign}(sk_\sigma , m)\): take as input a signing key \(sk_\sigma \) and a message \(m \in M\), output a signature \(\sigma \).
-
\(\mathsf {Verify}(vk, m, \sigma )\): take as input a verification key \(vk\), a message \(m\), and a signature \(\sigma \), output \(1\) indicates “acceptance” and \(0\) indicates “rejection”.
For the correctness of a signature scheme, we require that for all \((vk,sk_\sigma ) \leftarrow \mathsf {KeyGen}(\kappa )\) and all \(m \in M\), \(\mathsf {Verify}(vk, m, \mathsf {Sign}(sk_\sigma ,m)) = 1\) always holds. If \((\sigma , m)\) satisfies \(\mathsf {Verify}(vk, m, \sigma ) = 1\), then \(\sigma \) is said to be a valid signature of message \(m\) under the verification key \(vk\).
A strong notion of security for signature schemes is strong existential unforgeability under adaptive chosen-message attack (sEUF-CMA), which is defined by the following experiment:
Setup:
\(\mathcal {CH}\) runs \(\mathsf {KeyGen}(\kappa )\) to generate \((vk, sk_\sigma )\) and gives \(\mathcal {A}\) the verification key \(vk\).
Forgery:
\(\mathcal {A}\) may do one of the following:
-
\(\mathcal {A}\) adaptively make signing queries \(\langle m_i \rangle \), and is then given in return \(\sigma _i \leftarrow \mathsf {Sign}(sk_\sigma , m_i)\). After this, \(\mathcal {A}\) outputs \((m^*, \sigma ^*)\).
-
\(\mathcal {A}\) outputs \((m^*, \sigma ^*)\) without making any signing queries. In this case \((m_i, \sigma _i)\) are undefined.
We denote the event that \(\mathcal {A}\) outputs \((m^*, \sigma ^*)\) such that \(\mathsf {Verify}(vk, m^*, \sigma ^*) = 1\) but \((m^*, \sigma ^*) \ne (m_i, \sigma _i)\) (if \((m_i, \sigma _i)\) are defined) as \({\mathsf {SuccA}}\), and define \(\mathcal {A}\)’s advantage as \(\mathrm {Adv}_{\mathcal {A}, \text {SIG}}^{\text {sEUF-CMA}} \mathop {=}\limits ^{def }\Pr [{\mathsf {SuccA}}]\).
Definition 8.6
A signature scheme is \((t, q_s, \epsilon )\) sEUF-CMA secure if for all \(t\)-time adversaries making at most \(q_s\) signing queries have advantage at most \(\epsilon \) in the above experiment. Particularly, a signature scheme is one-time strongly unforgeable if it is \((t, 1, \epsilon )\) sEUF-CMA secure.