标准模型下抗CPA与抗CCA2的RSA型加密方案  

RSA-type Encryption Schemes Against CPA and CCA2 in Standard Model

作　　者：巩林明 李顺东[2] 窦家维[3] 王道顺[4] GONG Lin-ming;LI Shun-dong;DOU Jia-wei;WANG Dao-shun(School of Computer Science,Xi'an Polytechnic University,Xi'an,Shaanxi 710048,China;School of Computer Science,Shaanxi Normal University,Xi'an,Shaanxi 710062;School of Mathematics and Information Science,Shaanxi Normal University,Xi'an,Shaanxi 710062,China;Department of Computer Science and Technology,Tsinghua University,Beijing 100084,China)

机构地区：[1]西安工程大学计算机科学学院,陕西西安710048 [2]陕西师范大学计算机科学学院,陕西西安710062 [3]陕西师范大学数学与信息科学学院,陕西西安710062 [4]清华大学计算机科学与技术系,北京100084

出　　处：《电子学报》2018年第8期1938-1946,共9页Acta Electronica Sinica

基　　金：国家自然科学基金(No.61272435;61373020);西安工程大学博士科研启动基金(No.107020331)

摘　　要：RSA型加密系统(RSA加密系统及其改进系统的统称)至今仍然被广泛应用于许多注重电子数据安全的电子商务系统中.然而对现有的RSA型加密方案分析发现:(1)只有在随机谕言机模型下抗CCA2攻击的RSA型加密方案,还没有在标准模型下实现IND-CCA2安全的RSA型概率加密方案;(2)没有在标准模型下实现抗CPA且保持乘法同态性的RSA型同态加密方案,而同态性是实现安全多方计算和云计算安全服务的重要性质之一;(3)在实现密文不可区分方面,这些方案除HD-RSA外都是通过一个带hash的Feistel网络引入随机因子的,从而导致这些方案只能在随机谕言机模型下实现IND-CCA2安全.针对以上问题,本文在RSA加密系统的基础上,通过增加少量的有限域上的模指数运算,设计了一个标准模型下具有IND-CPA安全的RSA型概率同态加密方案和一个具有INDCCA2安全的RSA型概率加密方案.这两个方案在实现密文不可区分时,都不再通过明文填充引入随机因子.此外,本文还提出一个RSA问题的变形问题(称作RSA判定性问题).RSA and its modified schemes(which are called by a joint name,RSA-type encryption schemes)are still deployed in many commercial systems where data security is very important.Analyzing RSA-type encryption schemes,we find that:(1)to the best of our knowledge,all these schemes are merely secure against adaptive chosen-ciphertext attack(CCA2)in the random oracle(RO)model,and there is no RSA-type schemes yet that is indistinguishable under adaptive chosen-ciphertext attack in the standard model;(2)there is no RSA-type scheme that is secure against chosen plaintext attack(CPA)but keeping multiplicative homomorphism,whereas encryption schemes with homomorphism are important for secure multi-party computations and secure cloud services;(3)except for the Hybrid Dependent RSA(HD-RSA),all the schemes introduce randomness into ciphertext by a Feistel network with hash functions;hence,this brings all the schemes to achieve IND-CCA2 security merely in RO model.In this paper,we propose two RSA-type encryption schemes that only need a few more modular arithmetic operations.One is indistinguishable against chosen plaintext attack with homomorphism,while another is indistinguishable against adaptive chosen ciphertext attack in standard model.Both schemes are probabilistic without plaintext padding.Furthermore,we propose a new variant RSA problem,which is called RSA decisional problem(denote by DRSA).

关 键 词：RSA密码系统 IND-CCA2安全 标准模型 同态性 概率加密 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]