Publicly verifiable ciphertexts

  • Authors:
  • Juan González Nieto;Mark Manulis;Bertram Poettering;Jothi Rangasamy;Douglas Stebila

  • Affiliations:
  • Queensland University of Technology, Brisbane, QLD, Australia. E-mails: {j.gonzaleznieto, stebila}@qut.edu.au;University of Surrey, Guildford, UK. E-mail: mark@manulis.eu;Royal Holloway, University of London, Egham, UK. E-mail: bertram.poettering@rhul.ac.uk;Society for Electronic Transactions and Security, Chennai, India. E-mail: jothi.rangasamy@gmail.com;Queensland University of Technology, Brisbane, QLD, Australia. E-mails: {j.gonzaleznieto, stebila}@qut.edu.au

  • Venue:
  • Journal of Computer Security - Advances in Security for Communication Networks
  • Year:
  • 2013

Quantified Score

Hi-index 0.00

Visualization

Abstract

In many applications where encrypted traffic flows from an open public domain to a protected private domain there exists a gateway that bridges these two worlds, faithfully forwarding all incoming traffic to the receiver. We observe that the notion of indistinguishability against adaptive chosen-ciphertext attacks IND-CCA2, which is a mandatory goal in face of active attacks in a public domain, can be relaxed to indistinguishability against chosen-plaintext attacks IND-CPA once the ciphertexts passed the gateway. The latter then acts as an IND-CCA2/CPA filter by first checking the validity of an incoming IND-CCA2-secure ciphertext, transforming it if valid into an IND-CPA-secure ciphertext, and finally forwarding it to the recipient in the private domain. Non-trivial filtering can result in reduced decryption costs on the recipient's side.We identify a class of encryption schemes with publicly verifiable ciphertexts that admit generic constructions of IND-CCA2/CPA filters with non-trivial verification. These schemes are characterized by existence of public algorithms that can distinguish ultimately between valid and invalid ciphertexts. To this end, we formally define public verifiability of ciphertexts for general encryption schemes, key encapsulation mechanisms and hybrid encryption schemes, encompassing public-key, identity-based and tag-based encryption flavours. We further analyze the security impact of public verifiability and discuss generic transformations and concrete constructions that enjoy this property.