标准模型下可公开验证的匿名IBE方案的安全性分析  

On the Security of Publicly Verifiable Anonymous IBE Scheme in the Standard Model

作　　者：杨启良 周彦伟[1,2] 杨坤伟 王涛[1] YANG Qi-liang;ZHOU Yan-wei;YANG Kun-wei;WANG Tao(School of Computer Science,Shaanxi Normal University,Xi’an,Shaanxi 710062,China;State Key Laboratory of Cryptology,Beijing 100878,China)

机构地区：[1]陕西师范大学计算机科学学院,陕西西安710062 [2]密码科学技术国家重点实验室,北京100878

出　　处：《电子学报》2020年第2期291-295,共5页Acta Electronica Sinica

基　　金：国家重点研发计划(No.2017YFB0802000);国家自然科学基金(No.61802242,No.61572303,No.61772326,No.61872087,No.61802241,No.61702259);陕西省自然科学基础研究计划(No.2018JQ6088);“十三五”国家密码发展基金(No.MMJJ20180217);中央高校基本科研业务费项目(No.GK201803064)。

摘　　要：现有的可公开验证的匿名基于身份的加密(Identity-Based Encryption,IBE)机制声称解决了在静态困难性假设之上构造紧的选择密文安全的IBE机制的困难性问题.然而,本文发现,由于该机制的密文不具备防扩展性,使得任何敌手可基于已知的有效密文生成任意消息的合法加密密文,导致该机制无法满足其所声称的选择密文安全性.我们根据不同的密文相等判定条件分别提出两种方法对原始方案的安全性进行了分析,同时在分析基础上指出原始安全性证明过程中所存在的不足.How to create an identity-based encryption(IBE)scheme with tight chosen-ciphertext attacks(CCA)se-curity based on the static assumption is an open problem.A publicly verifiable anonymous IBE scheme designed in the stand-ard model claimed that the CCA security of proposed scheme was proved based on the classic static assumption.However,in this paper,we demonstrate that the previous IBE scheme cannot achieve the claimed CCA security because the ciphertext was extensile.In other words,a valid encrypted ciphertext can be forged by any adversary from a known ciphertext.To analyze the security of the previous IBE scheme,two methods are proposed based on the criterion of ciphertext equality.Additional-ly,based on the analysis of the previous IBE scheme,we point out the shortcomings of the original security proof.

关 键 词：基于身份的密码学 基于身份的加密 公开可验证 选择密文安全 判定性双线性Diffie-Hellman假设 标准模型 双线性映射 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]