Improved Searchable Public Key Encryption with Designated Tester

1. Improved Searchable Public Key Encryption with Designated Tester Author : Hyun Sook Rhee, Jong Hwan Park, Willy Susilo, Dong Hoon Lee Presenter: Li-Tzu Chang

2. Outline • Introduction • Preliminaries • Definition • Our security model • Bilinear pairings • A new DPEKS scheme • Conclusion Improved Searchable Public Key Encryption with Designated Tester

3. 關鍵字的暗門 加密過的訊息 傳回使用者 所需的文件 訊息接收者 訊息傳送者 伺服器 Introduction • PEKS scheme Improved Searchable Public Key Encryption with Designated Tester

4. Introduction • In Baek et al.'s security model, an attacker is only provided with trapdoors, but cannot get the relation between a encrypted mail and a trapdoor. • An attacker in the model has to reveal her secret key to a third party. Improved Searchable Public Key Encryption with Designated Tester

5. Outline • Introduction • Preliminaries • Definition • Our security model • Bilinear pairings • A new DPEKS scheme • Conclusion Improved Searchable Public Key Encryption with Designated Tester

6. Preliminaries-Definition • GlobalSetup(λ): Takes a security parameter λ, generates a global parameter GP. • KeyGenServer(GP): Takes as input GP. Output the public/secret pair (pkS , skS) of server S. • KeyGenReceiver(GP): Takes as input GP, generates public/secret pair (pkR , skR) of receiver R. • dPEKS(GP , pkR , pkS , w): Takes as input GP, a receiver's public key pkR, a server's public key pkS, and a keyword w.Return a ciphertext C of w. • Trapdoor(GP , skR , w): Takes as input GP, a receiver's secret key skRand a keyword w. Generate a trapdoor Tw. • dTest(GP , C , skS , Tw): Takes as input GP, C, a server's secret key skS, and a trapdoor Tw. Output “yes” if w = w'and “no” otherwise, where C = dPEKS(GP, pkR , pkS. ,w'). Improved Searchable Public Key Encryption with Designated Tester

7. Outline • Introduction • Preliminaries • Definition • Our security model • Bilinear pairings • A new DPEKS scheme • Conclusion Improved Searchable Public Key Encryption with Designated Tester

8. Preliminaries - Our security model • Game1:the server is the attacker A1 B pks pkR challenge Trapdoor and Test queries C* Trapdoor queries Improved Searchable Public Key Encryption with Designated Tester

9. Preliminaries - Our security model • Game2:the outer attacker A2 B pkR pkS challenge dTest queries C* dTest queries Improved Searchable Public Key Encryption with Designated Tester

10. Outline • Introduction • Preliminaries • Definition • Our security model • Bilinear pairings • A new DPEKS scheme • Conclusion Improved Searchable Public Key Encryption with Designated Tester

11. Preliminaries- Bilinear pairing • Bilinear pairings • G1 : cyclic additive group generated by P whose order is a prime q. • G2 : cyclic multiplicative group of the same order q. • e : G1 × G1 → G2 with the following properties: • Computable: there is an efficient algorithm to compute e(P,Q) for all P,Q∈ G1 Improved Searchable Public Key Encryption with Designated Tester

12. Outline • Introduction • Preliminaries • Definition • Our security model • Bilinear pairings • A new DPEKS scheme • Conclusion Improved Searchable Public Key Encryption with Designated Tester

13. KeyGenServer(GP): • Takes as inpute GP, chooses a random exponent sks and compute. Output (pks,sks) to the server S and publish pks. • KeyGenReceiver(GP): • Takes as inoute GP, chooses a random exponent skR and computeOutput (pks,skR) to the receiver R and publish pkR. A new DPEKS scheme • Global Setup: • Given a security parameter λ, it return a global parameter , where are random values. Improved Searchable Public Key Encryption with Designated Tester

14. A new DPEKS scheme • dPEKS(GP,pkR,pks,w): • Takes as input GP, receiver’s public key ,a server’s public key , and a keyword w. • This algorithm checks if • If any of these conditions is false, this algorithm stops. Otherwise, this algorithm chooses a random value and compute a ciphertext Improved Searchable Public Key Encryption with Designated Tester

15. A new DPEKS scheme • Trapdoor(GP,skR,w): • Takes as input GP, a receiver’s secret key skR, a keyword w, Compute and output . • dTest(GP,C,sks,Tw): • Takes as input GP, C=[A,B], a secret key of server sks, and a trapdoor Tw. This algorithm checks if . If the above equalities are satisfied, then output “yes”; otherwise, output “no”. Improved Searchable Public Key Encryption with Designated Tester

16. Outline • Introduction • Preliminaries • Definition • Our security model • Bilinear pairings • A new DPEKS scheme • Conclusion Improved Searchable Public Key Encryption with Designated Tester

17. Conclusion • In our enhanced security model, an attacker publishes only her public key without revealing her secret key. • An attacker is also allowed to obtain the relation between non-target ciphertexts and a trapdoor. Improved Searchable Public Key Encryption with Designated Tester