Skip to main content

Table 5 DRE ABB scheme

From: (Identity-based) dual receiver encryption from lattice-based programmable hash functions with high min-entropy

\(\mathsf {CGen}_{\mathsf {DRE}}(1^{\lambda }): \mathbf {U} \overset {\$}{\leftarrow } \mathbb {Z}^{n \times n}_{q}\), output crs=U.
\(\mathsf {Gen}_{\mathsf {DRE}}(\mathsf {crs})\!:\! (\mathbf {A}_{i}, \mathbf {T}_{\mathbf {A}_{i}})\! \overset {\$}{\leftarrow }\! \mathsf {TrapGen}(1^{n}, 1^{m}, q)\), \(\mathbf {B}_{i} \overset {\$}{\leftarrow } \mathbb {Z}^{n \times m}_{q}\) for i = 1,2. Output
pki=(Ai,Bi), \(sk_{i} = \mathbf {T}_{\mathbf {A}_{i}}\phantom {\dot {i}\!}\).
EncDRE(crs,pk1,pk2,m{0,1}n):
1. Generate (vk,sk)←GenOTS(1λ).
2. Compute C1=(A1|B1+Hn,q(vkG), C2=(A2|B2+Hn,q(vkG)).
3. Pick \(\mathbf {s} \overset {\$}{\leftarrow } \mathbb {Z}_{q}^{n}\), \(\widetilde {\mathbf {e}}_{0} \overset {\$}{\leftarrow } \mathcal {D}_{\mathbb {Z}^{n},\alpha q}\), and \(\mathbf {e}_{1,1}, \mathbf {e}_{2,1}, \mathbf {e}_{1,2}, \mathbf {e}_{2,2} \overset {\$}{\leftarrow } \mathcal {D}_{\mathbb {Z}^{m},\alpha ^{\prime } q}\),
compute and return the ciphertext c = (vk,c0,c1,c2,ρ), where
ρ=SigOTS(sk,(c0,c1,c2)) and
\(\mathbf {c}_{0} = \mathbf {U}^{\top }\mathbf {s} + \widetilde {\mathbf {e}}_{0} + \mathbf {m} \cdot \left \lceil \frac {q}{2}\right \rceil \in \mathbb {Z}_{q}^{n}\),
\({\begin {aligned} &\mathbf {c}_{1} = \mathbf {C}_{1}^{\top }\mathbf {s} + \left [ \begin {array}{c} \mathbf {e}_{1,1}\\ \mathbf {e}_{1,2} \end {array} \right ] \in \mathbb {Z}_{q}^{2m},& \mathbf {c}_{2} = \mathbf {C}_{2}^{\top }\mathbf {s} + \left [ \begin {array}{c} \mathbf {e}_{2,1}\\ \mathbf {e}_{2,2} \end {array} \right ] \in \mathbb {Z}_{q}^{2m}. \end {aligned}}\)
DecDRE(crs,pk1,pk2,sk1,c):
1. Run VrfOTS(vk,(c0,c1,c2),ρ), outputs if VrfOTS rejects;
2. \((\mathbf {E}_{1})_{i} \leftarrow \mathsf {SampleLeft}(\mathbf {A}_{1},\mathbf {B}_{1} + H_{n,q}(\mathsf {vk})\cdot \mathbf {G}, (\mathbf {U})_{i}, \mathbf {T}_{\mathbf {A}_{1}},\sigma)\), i[n], to obtain
\(\mathbf {E}_{1} \in \mathbb {Z}_{q}^{2m \times n}\) such that C1·E1=U;
3. Compute \(\mathbf {b} = \mathbf {c}_{0}-\mathbf {E}_{1}^{\top }\mathbf {c}_{1} = ((\mathbf {b})_{1},\cdots,(\mathbf {b})_{n})^{\top } \in \mathbb {Z}^{n}\).
Set (m)i=1 if \(\left |(\mathbf {b})_{i} - \lceil \frac {q}{2}\rceil \right |< \lceil \frac {q}{4}\rceil \), else (m)i=0, i[n].
4. Return the plaintext m=((m)1,,(m)n).