Forward-Secure Certificate-Based Encryption and
its Generic Construction
Yang Lu and Jiguo Li
College of Computer and Information Engineering, Hohai University
Nanjing, Jiangsu Province, China
Email: {luyangnsd, ljg1688}@163.com
Abstract—In this paper, we introduce a new asymmetric
encryption paradigm called Forward-Secure Certificate-
Based Encryption. It preserves the advantages of certificate-
based encryption (CBE) such as implicit certificate and no
private key escrow. At the same time it also inherits the
properties of the forward-secure public key encryption. In a
forward-secure CBE scheme, all users’ private keys are
updated at regular periods throughout the lifetime of the
system; exposure of a user’s private key corresponding to a
given time period does not enable an adversary to break the
security of the ciphertext sent to this user for any prior time
period. We first provide the formal definition for forward-
secure CBE and its security model. Then we propose a
generic construction of forward-secure CBE and prove it to
be secure against chosen plaintext attacks in the standard
model. We also describe how this construction can be
enhanced to achieve security against adaptive chosen-
ciphertext attacks both in the standard model and in the
random oracle model. Finally, a concrete forward-secure
CBE scheme is constructed.
Index Terms—asymmetric encryption, certificate-based
encryption, forward-security, generic construction
I. INTRODUCTION
In traditional public key cryptography (PKC), a Public
Key Infrastructure (PKI) is used to provide an assurance
to the user about the relationship between a public key
and the identity of the holder of the corresponding private
key by certificates. However, the need for PKI supporting
certificates is considered the main difficulty in the
deployment and management of traditional PKC. To
simplify the management of the certificates, Shamir [1]
introduced identity-based cryptography (IBC) in which
the public key of each user is derived directly from
certain aspects of its identity, such as an IP address or an
e-mail address, and the corresponding private key is
generated by a trusted third party called Private Key
Generator (PKG). For a long while it was an open
problem to obtain a secure and efficient identity based
encryption (IBE) scheme. Until 2001, Boneh and
Franklin [2] presented the first practical and provably
secure IBE scheme using the bilinear pairings on elliptic
curves. The main practical benefit of IBC lies in greatly
reduction of need for public key certificates. However,
the PKG can generate the private keys of all its users, so
private key escrow becomes an inherent problem in IBC.
Moreover, private keys must be sent to the users over
secure channels. It makes private key distribution a
daunting task. To fill the gap between traditional PKC
and IBC, Al-Riyami and Paterson proposed a new
paradigm called certificateless public key cryptography
(CL-PKC) [3] in 2003. CL-PKC eliminates the key-
escrow problem inherent in IBC. At the same time, it
preserves the advantage of IBC which is the absence of
digital certificates and their heavy management overhead.
In CL-PKC, a trusted third party called Key Generating
Center (KGC) is involved in the process of issuing a
partial secret key for each user. The user independently
generates its public/private key pair and combines the
partial secret key from the KGC with its private key to
generate the actual decryption key. By way of contrast to
the PKG in IBC, the KGC does not have access to the
user’s decryption key. Therefore, CL-PKC solves the key
escrow problem. However, due to the lack of public key
certificate, CL-PKC is pointed out that it suffers from
public key replacement attack and Denial-of-Decryption
attack. Moreover, CL-PKC suffers the same key
distribution problem as IBC because partial secret keys
must be sent to the users over secure channels.
In Eurocrypt 2003, Gentry [5] introduced the notion of
certificate-based encryption (CBE), which combines IBE
and traditional PKI-supported PKE while preserving
some of their most attractive features. CBE provides an
implicit certificate mechanism for a traditional PKI and
allows a periodical update of certificate status. As
traditional PKIs, each user in CBE generates his own
public/private key pair and requests a long-lived
certificate from the CA. This long-lived certificate has all
the functionalities of a traditional PKI certificate. But,
CA generates the long-lived certificate as well as short-
lived certificates (i.e., certificate status). A short-lived
certificate can be pushed only to the owner of the
public/private key pair and acts as a partial decryption
key. This additional functionality provides an implicit
certificate so that the sender is not required to obtain
fresh information on certificate status and the receiver
can only decrypt the ciphertext using his private key
along with an up-to-date short-lived certificate from its
CA. The feature of implicit certificate allows us to
eliminate third-party queries for the certificate status and
simplify the public key revocation problem so that CBE
does not need infrastructures like CRL [6] and OCSP [7].
Therefore, CBE can be used to construct an efficient PKI
requiring fewer infrastructures. Furthermore, there is no
剩余7页未读，继续阅读
资源评论
