Predicate encryption against master-key tampering attacks

Liu, Yuejun; Zhang, Rui; Zhou, Yongbin

doi:10.1186/s42400-019-0039-6

Cybersecurity

Table 1 Games in the security proof

From: Predicate encryption against master-key tampering attacks

G_res:	Replace the restriction R_N(X,Y^∗)=0 with $R_{p_{2}}(X, Y^*) = 0$.
G₀:	$(\text {MSK}, \text {PP}, g_{2}, \hat {\mathbf {h}})\leftarrow \mathbf {SetupSF}(\lambda)$
	$\text {CT}_{Y}^{} \leftarrow \mathbf {EncryptSF}\left (\text {PP}, Y^{}, \textit {M}_{b}, g_{2}, \hat {\mathbf {h}}\right) $
G_k,1:	$\hat {\alpha }_{j} \xleftarrow {\$} \mathbb {Z}_{N}, \text {SK}_{j} \leftarrow \left \{\begin {array}{ll} \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, {\mathbf 0}, 3, \hat {\alpha }_{j}\right) & \text {if } j < k \\ \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \hat {\mathbf {h}}, 1, 0\right) & \text {if } j = k \\ \mathbf {KeyGen}\left (\phi _{i}(\alpha), X_{j}\right) & \text {if } j > k \\ \end {array}\right.$
G_k,2:	$\hat {\alpha }_{j} \xleftarrow {\$} \mathbb {Z}_{N}, \text {SK}_{j} \leftarrow \left \{\begin {array}{ll} \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \mathbf {0}, 3, \hat {\alpha }_{j}\right) & \text {if } j < k \\ \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \hat {\mathbf {h}}, 2, \hat {\alpha }_{j}\right) & \text {if } j = k \\ \mathbf {KeyGen}\left (\phi _{i}(\alpha), X_{j}\right) & \text {if } j > k \\ \end {array}\right.$
G_k,3:	$\hat {\alpha }_{j} \xleftarrow {\$} \mathbb {Z}_{N}, \text {SK}_{j} \leftarrow \left \{\begin {array}{ll} \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \mathbf {0}, 3, \hat {\alpha }_{j}\right) & \text {if } j \le k\\ \mathbf {KeyGen}\left (\phi _{i}(\alpha), X_{j}\right) & \text {if } j > k\\ \end {array}\right.$
$\mathbf {G}_{q_{1}+1}$:	$\text {SK}_{j} \leftarrow \mathbf {KeyGenSF}(\phi _{i}(\alpha), X_{j}, g_{2}, \hat {\mathbf {h}}, 1, 0) $
$\mathbf {G}_{q_{1}+2}$:	$\hat {\alpha } \xleftarrow {\$} \mathbb {Z}_{N} $
	$\text {SK}_{j} \leftarrow \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \hat {\mathbf {h}}, 2, \hat {\alpha }\right) $
$\mathbf {G}_{q_{1}+3}$:	$\text {SK}_{j} \leftarrow \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \mathbf {0}, 3, \hat {\alpha }\right) $
G_final:	$M \xleftarrow {\$} \mathcal {M}, \text {CT}_{Y}^{} \leftarrow \mathbf {EncryptSF}\left (\text {PP}, Y^{}, \textit {M}, g_{2}, \hat {\mathbf {h}}\right) $

Back to article page

G_res:	Replace the restriction R_N(X,Y^∗)=0 with \(R_{p_{2}}(X, Y^*) = 0\).
G₀:	\((\text {MSK}, \text {PP}, g_{2}, \hat {\mathbf {h}})\leftarrow \mathbf {SetupSF}(\lambda)\)
	\(\text {CT}_{Y}^{} \leftarrow \mathbf {EncryptSF}\left (\text {PP}, Y^{}, \textit {M}_{b}, g_{2}, \hat {\mathbf {h}}\right) \)
G_k,1:	\(\hat {\alpha }_{j} \xleftarrow {\$} \mathbb {Z}_{N}, \text {SK}_{j} \leftarrow \left \{\begin {array}{ll} \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, {\mathbf 0}, 3, \hat {\alpha }_{j}\right) & \text {if } j < k \\ \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \hat {\mathbf {h}}, 1, 0\right) & \text {if } j = k \\ \mathbf {KeyGen}\left (\phi _{i}(\alpha), X_{j}\right) & \text {if } j > k \\ \end {array}\right.\)
G_k,2:	\(\hat {\alpha }_{j} \xleftarrow {\$} \mathbb {Z}_{N}, \text {SK}_{j} \leftarrow \left \{\begin {array}{ll} \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \mathbf {0}, 3, \hat {\alpha }_{j}\right) & \text {if } j < k \\ \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \hat {\mathbf {h}}, 2, \hat {\alpha }_{j}\right) & \text {if } j = k \\ \mathbf {KeyGen}\left (\phi _{i}(\alpha), X_{j}\right) & \text {if } j > k \\ \end {array}\right.\)
G_k,3:	\(\hat {\alpha }_{j} \xleftarrow {\$} \mathbb {Z}_{N}, \text {SK}_{j} \leftarrow \left \{\begin {array}{ll} \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \mathbf {0}, 3, \hat {\alpha }_{j}\right) & \text {if } j \le k\\ \mathbf {KeyGen}\left (\phi _{i}(\alpha), X_{j}\right) & \text {if } j > k\\ \end {array}\right.\)
\(\mathbf {G}_{q_{1}+1}\):	\(\text {SK}_{j} \leftarrow \mathbf {KeyGenSF}(\phi _{i}(\alpha), X_{j}, g_{2}, \hat {\mathbf {h}}, 1, 0) \)
\(\mathbf {G}_{q_{1}+2}\):	\(\hat {\alpha } \xleftarrow {\$} \mathbb {Z}_{N} \)
	\(\text {SK}_{j} \leftarrow \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \hat {\mathbf {h}}, 2, \hat {\alpha }\right) \)
\(\mathbf {G}_{q_{1}+3}\):	\(\text {SK}_{j} \leftarrow \mathbf {KeyGenSF}\left (\phi _{i}(\alpha), X_{j}, g_{2}, \mathbf {0}, 3, \hat {\alpha }\right) \)
G_final:	\(M \xleftarrow {\$} \mathcal {M}, \text {CT}_{Y}^{} \leftarrow \mathbf {EncryptSF}\left (\text {PP}, Y^{}, \textit {M}, g_{2}, \hat {\mathbf {h}}\right) \)