Anonymous communication system provides a secure environment without leaking metadata, which has many application scenarios in IoT

Internet of Things (IoT) has emerged as a set of interconnected technologies like Wireless Sensors Networks (WSN) and Radio Frequency Identification (RFID), that provide identification, computation, and mutual information exchange among the connected devices all over the world. The key idea of the IoT is to obtain information about our environment to understand and control and act on it [DMR16].

Identity-Based Encryption (IBE) is a type of public-key encryption where the public key is an arbitrary string that uniquely defined the user (for example an email address or a telephone number). The Private-key Generator (PKG) who has knowledge of a master secret key generates the private key for the corresponding identities. This concept was first introduced by Shamir [Sha84] and then in 2001, Boneh and Franklin [BF01] proposed the first practical IBE scheme based on bilinear map. The idea of Hierarchical Identity-Based Encryption (HIBE), which is an extension of IBE where each level can issue private keys for identites of the next level, was first proposed in the work of Gentry and Silverberg [GS02]. Since then, there have been many efficient constructions of HIBE, ranging from classical setting [BB04, BBG05, Wat05] to post-quantum setting [ABB10a, CHKP10, SRB14] just to name a few.

The concept of “Anonymous” IBE offers an additional privacy guarantee to standard IBE schemes where the ciphertexts do not leak the identity of the recipients. AIBE is a promising solution to anonymous communications and it can be applied to many realistic scenarios that provide privacy-preserving and security under cloud environment. It can also bring a secure environment without leaking metadata which has many application scenarios in the aforementioned distributed IoT system [JLL⁺18]. However, the first AIBE construction of Boneh and Frankl in [BF01] is just anonymous in the random oracle model and it was a challenging problem to achieve anonymous IBE in the standard model until [BW06b]. In [BW06a], Boyen and Waters proposed the first secure anonymous HIBE scheme without random oracles. More recently, the HIBE constructions in the post-quantum setting [ABB10a, SRB14] are proven to be anonymous secure in the standard model in the mean of a ciphertext encrypted for a target identity is indistinguishable from a random element in the ciphertext space which helps hide this identity from any malicious attacker.

Although this strong unconditional privacy seems very attractive from the user’s point of view, it can potentially be a dangerous tool against public safety if there is no way to revoke such privacy when illegal behavior is detected. For example, in the case where the email filtering system has to filter out all encrypted email from members are suspected of illegal activity, standard anonymous IBE and HIBE prevent the system reveal the recipients of those ciphertexts. Traceability can provide a solution to this problem in which an additional traceability function can detect specific identities in ciphertexts and all the others remain anonymous.

In 2019, Blazy et al. [BBP19] first considered the traceability for identity-based encryption and constructed an Anonymous Identity Based Encryption (AIBET) scheme in the standard model but under the matrix Diffie Hellman (MDDH) assumption. Two security notions are formally defined in [4] are anonymity and ciphertext indistinguishability. Anonymity requires that someone without an associated user secret key or tracing key should not be able to guess the targeted identity. The notion of indistinguishability requires that no one can distinguish between a valid ciphertext and a random string from the ciphertext space even having access to the tracing key of the target identity. Recent, in [LTT⁺21], Liu et al. proposed a lattice-based construction for AIBET which is based on the anonymous IBE by Katsumata and Yamada [KY16]. However, they do not address the notion of indistinguishability which is the main difference between an AIBET and a standard anonymous IBE. Note that the role of the tracer and the Private-key Generator PKG are distinguishable where the tracer has less power than the PKG. For example, it could be a gateway that checks whether an email for a suspected illegal user is passed. Even if the tracers are corrupted, the privacy and the confidentiality of the system will still remain intact.

An instance of our AHIBET yields a lattice-based construction of AIBET that can be easily converted to a construction over ideal lattices using the techniques in [BFRS18], which outperforms the AIBET by Liu et al. [LTT⁺21]¹¹1In fact, the public parameter in Liu et al. [LTT⁺21] will be a factor of $dl$ greater than ours where $d$ is some fixed constant (e.g., d=2 or 3) and $l=\lceil n^{1/d}\rceil$ for $n$ the security parameter..

We exploit the power of lattice trapdoors in [MP12, CHKP10] combining with the HIBE construction by Agrawal et al. [ABB10a] to achieve our AHIBET.

In [ABB10a], each identity $\mathsf{id}$ is assigned a matrix $\mathbf{F}_{\mathsf{id}}$ and message $\mathbf{m}$ is encrypted following the dual-Regev scheme:

In our scheme, we use one dual-Regev part to encrypt the message and another one to encapsulate the random tag to allow the ciphertext to reveal the recipients’ identity from the tracing key holder.

In [MP12], the authors introduced a so-called $\mathbf{G}$-trapdoor where $\mathbf{G}$ is a gadget matrix in $\mathbb{Z}_{q}^{n\times\omega}$. A $\mathbf{G}$-trapdoor for matrix $\mathbf{F}$ is a matrix $\mathbf{R}\in\mathbb{Z}^{(m-\omega)\times\omega}$ such that $\mathbf{F}=[\mathbf{A}|\mathbf{A}\mathbf{R}+\mathbf{H}\mathbf{G}]$ for some invertible matrix $\mathbf{H}\in\mathbb{Z}^{n\times n}_{q}$ where $\mathbf{A}\in\mathbb{Z}^{n\times(m-\omega)}_{q}$. The authors called it “strong trapdoor” since a good basis $\mathbf{T}_{\mathbf{F}}\in\mathbb{Z}^{m\times m}$ for $\Lambda_{q}^{\perp}(\mathbf{F})$ can be obtained from the knowledge of the matrix $\mathbf{R}$ but the reverse is hard. Moreover, with either $\mathbf{R}$ or $\mathbf{T}_{\mathbf{F}}$, one can easily generate a low norm matrix $\mathbf{D}_{\mathbf{F}}\in\mathbb{Z}^{n\times t}_{q}$ satisfying $\mathbf{F}.\mathbf{D}_{\mathbf{F}}=\mathbf{U}$ with respect to a given random matrix $\mathbf{U}\in\mathbb{Z}_{q}^{n\times t}$ using the sampling algorithms from [ABB10a] and [MP12]. Since $\mathbf{D}_{\mathbf{F}}$ is a kind of weaker trapdoor than $\mathbf{T}_{\mathbf{F}}$, we can use such matrices $\mathbf{R}$, $\mathbf{T}_{\mathbf{F}}$ and $\mathbf{D}_{\mathbf{F}}$ as the three levels of trapdoors $\mathsf{MSK}$, $\mathsf{SK}_{\mathsf{id}}$, $\mathsf{Tsk}_{\mathsf{id}}$ respectively for a traceable identity-based encryption where the matrix $\mathbf{F}$ is associated to an identity $\mathsf{id}=(\mathsf{id}_{1},\ldots,\mathsf{id}_{\ell})$, namely, $\mathbf{F}=\mathbf{F}_{\mathsf{id}}=[\mathbf{A}|\mathbf{A}_{1}+\mathsf{FRD}(\mathsf{id}_{1})\mathbf{G}|\ldots|\mathbf{A}_{\ell}+\mathsf{FRD}(\mathsf{id}_{\ell})\mathbf{G}]$ for the public matrices $\mathbf{A},\mathbf{A}_{1},\ldots,\mathbf{A}_{\ell}$ and the full-rank difference encoding function $\mathsf{FRD}$. However, such trapdoors do not guarantee the anonymity and even the secrecy of messages across the hierarchy of identities. For example, knowing $\mathbf{D}_{\mathbf{F}_{\mathsf{id}_{1}}}$ and $\mathbf{D}_{\mathbf{F}_{[\mathsf{id}_{1}|\mathsf{id}_{2}]}}$, one can easily find a low norm matrix $\mathbf{T}$ of the same size as $\mathbf{D}_{\mathbf{F}_{\mathsf{id}_{1}|\mathsf{id}_{2}}}$ such that $\mathbf{F}_{[\mathsf{id}_{1}|\mathsf{id}_{2}]}\mathbf{T}=\mathbf{0}$, which reveals information of the messages. Therefore, we use a collision resistance hash function $\mathsf{H}$ to construct a matrix $\mathbf{F}^{\prime}_{\mathsf{id}}=[\mathbf{A}|\mathbf{A}_{0}+\mathsf{FRD}(\mathsf{H}(\mathsf{id}))\mathbf{G}]$ and use the sampling algorithms to generate the tracing key $\mathbf{D}_{\mathbf{F}^{\prime}_{\mathsf{id}}}$ of the identity $\mathsf{id}$ such that $\mathbf{F}^{\prime}_{\mathsf{id}}\mathbf{D}_{\mathbf{F}^{\prime}_{\mathsf{id}}}=\mathbf{U}$. Such tracing keys are determined uniquely by the identities and independent of the secret keys, which ensures the anonymity and secrecy of the messages.

• •

  Let $\lambda$ be the security parameter, $d$ be the hierarchy depth and identities are vector $\mathsf{id}=(\mathsf{id}_{1},\dots,\mathsf{id}_{\ell})$ ($1\leq\ell\leq d$) where all components $\mathsf{id}_{i}$ are in $\mathbb{Z}^{n}\setminus{\{\mathbf{0}\}}$.

• •

  Let $\mathsf{FRD}:\mathbb{Z}^{n}_{q}\longrightarrow\mathbb{Z}^{n\times n}_{q}$ be a full-rank difference encoding (FRD) from [ABB10a] s.t. for all distinct $\mathbf{u},\mathbf{v}\in\mathbb{Z}^{n}_{q}$, $\mathsf{FRD}(\mathbf{u})-\mathsf{FRD}(\mathbf{v})\in\mathbb{Z}^{n\times n}_{q}$ is an invertible matrix.

• •

  Let $\mathsf{H}:(\mathbb{Z}^{n}_{q})^{*}\longrightarrow\mathbb{Z}^{n}_{q}$ be a collision resistant hash function.

• •

  For an integer $q>2$, $x\in\mathbb{Z}_{q}$, the algorithm $\mathsf{Round}(x)$ returns $0$ if $x$ is closer to $0$ than to $\left\lfloor\displaystyle{\frac{q}{2}}\right\rfloor$ modulo $q$; otherwise, it returns $1$.

In the construction of the AHIBET scheme, we assume each identity $\mathsf{id}$ can only be given exactly one tracing key $\mathsf{Tsk}_{\mathsf{id}}$.

Setup($\lambda,d$)

On input security parameter $\lambda$ and a maximum hierarchy depth $d$, set the parameters $(n,m,q,\omega,\bar{\sigma},\tau,\alpha,r)$ as in section 3.1, the algorithm does:

1. 1.

   Sample uniformly random matrices $\mathbf{A}\leftarrow\mathbb{Z}_{q}^{n\times m}$, $\mathbf{A}_{2},\dots,\mathbf{A}_{d}\leftarrow\mathbb{Z}_{q}^{n\times\omega}$ and $\mathbf{R}_{0},\mathbf{R}_{1}\leftarrow\mathcal{D}^{m\times\omega}_{\mathbb{Z},\omega(\sqrt{\log n})}$.

2. 2.

   Set $\mathbf{A}_{0}\leftarrow\mathbf{A}\mathbf{R}_{0}\in\mathbb{Z}^{n\times\omega}_{q}$, $\mathbf{A}_{1}\leftarrow\mathbf{A}\mathbf{R}_{1}\in\mathbb{Z}^{n\times\omega}_{q}$ and choose $\mathbf{U}_{1},\mathbf{U}_{2}\leftarrow\mathbb{Z}^{n\times\lambda}_{q}$ uniformly at random.

3. 3.

   Output the master public key and the master secret key

   $$\mathsf{MPK}=(\mathbf{A},\mathbf{A}_{0},\mathbf{A}_{1},\dots,\mathbf{A}_{d},\mathbf{U}_{1},\mathbf{U}_{2})\leavevmode\nobreak\ ,\leavevmode\nobreak\ \mathsf{MSK}=(\mathbf{R}_{0},\mathbf{R}_{1}).$$

Extract($\mathsf{MPK},\mathsf{MSK},\mathsf{id}$)

On input the master pubic key $\mathsf{MPK}$, the master secret key $\mathsf{MSK}$ and an identity $\mathsf{id}$ of level $1$, the algorithm generates secret key for $\mathsf{id}$ as follows:

1. 1.

   Compute $\mathbf{F}_{\mathsf{id}}=[\mathbf{A}|\mathbf{A}_{1}+\mathsf{FRD}(\mathsf{id})\mathbf{G}]\in\mathbb{Z}^{n\times(m+\omega)}_{q}$.

2. 2.

   Sample $\mathbf{T}_{\mathsf{id}}\leftarrow\mathsf{SampleBasisRight}(\mathbf{F}_{\mathsf{id}},\mathbf{R}_{1},\mathsf{FRD}(\mathsf{id}),\sigma_{1})\in\mathbb{Z}^{(m+\omega)\times(m+\omega)}_{q}$ s.t. $\mathbf{F}_{\mathsf{id}}\mathbf{T}_{\mathsf{id}}=0$.

3. 3.

   Output $\mathsf{SK}_{\mathsf{id}}\leftarrow\mathbf{T}_{\mathsf{id}}$.
   

Derive($\mathsf{MPK},\mathsf{SK}_{\mathsf{id}},(\mathsf{id}|\mathsf{id}_{\ell})$)

On input the master pubic key $\mathsf{MPK}$, a secret key $\mathsf{SK}_{\mathsf{id}}$ corresponding to an identity $\mathsf{id}=(\mathsf{id}_{1},\dots,\mathsf{id}_{\ell-1})$ at depth $\ell-1$ and an identity $\mathsf{id}|\mathsf{id}_{\ell}=(\mathsf{id}_{1},\dots,\mathsf{id}_{\ell-1},\mathsf{id}_{\ell})$ of level $\ell>1$, the algorithm generates secret key for $\mathsf{id}$ as follows:

1. 1.

   Set $\mathbf{F}_{\mathsf{id}|\mathsf{id}_{\ell}}=[\mathbf{F}_{\mathsf{id}}|\mathbf{A}_{\ell}+\mathsf{FRD}(\mathsf{id}_{\ell})\mathbf{G}]\in\mathbb{Z}^{n\times(m+\ell\omega)}_{q}$ with $\mathbf{F}_{\mathsf{id}}=[\mathbf{A}|\mathbf{A}_{1}+\mathsf{FRD}(\mathsf{id}_{1})\mathbf{G}|\dots|\mathbf{A}_{\ell-1}+\mathsf{FRD}(\mathsf{id}_{\ell-1})\mathbf{G}]$.

2. 2.

   Sample $\mathbf{T}_{\mathsf{id}|\mathsf{id}_{\ell}}\leftarrow\mathsf{SampleBasisLeft}(\mathbf{F}_{\mathsf{id}},\mathbf{A}_{\ell}+\mathsf{FRD}(\mathsf{id}_{\ell})\mathbf{G},\mathsf{SK}_{\mathsf{id}},\sigma_{\ell})$ s.t. $\mathbf{F}_{\mathsf{id}|\mathsf{id}_{\ell}}\mathbf{T}_{\mathsf{id}|\mathsf{id}_{\ell}}=0$.

3. 3.

   Output $\mathsf{SK}_{\mathsf{id}|\mathsf{id}_{\ell}}\leftarrow\mathbf{T}_{\mathsf{id}|\mathsf{id}_{\ell}}$.
   

TskGen($\mathsf{MPK},\mathsf{MSK},\mathsf{id}$)

On input the master pubic key $\mathsf{MPK}$, the master secret key $\mathsf{MSK}$ and an identity $\mathsf{id}=(\mathsf{id}_{1},\dots,\mathsf{id}_{\ell})$, the algorithm generates the tracing key for $\mathsf{id}$ as follows:

1. 1.

   Compute $\mathbf{F}^{\prime}_{\mathsf{id}}=[\mathbf{A}|\mathbf{A}_{0}+\mathsf{FRD}(\mathsf{H(\mathsf{id})})\mathbf{G}]\in\mathbb{Z}^{n\times(m+\omega)}_{q}$.

2. 2.

   Sample $\mathbf{D}^{\prime}_{\mathsf{id}}\leftarrow\mathsf{SampleBasisRight}(\mathbf{F}^{\prime}_{\mathsf{id}},\mathbf{R}_{0},\mathsf{FRD}(\mathsf{H}(\mathsf{id})),\sigma_{1})\in\mathbb{Z}^{(m+\omega)\times(m+\omega)}_{q}$ s.t. $\mathbf{F}^{\prime}_{\mathsf{id}}\mathbf{D}^{\prime}_{\mathsf{id}}=0$.

3. 3.

   Sample $\mathbf{D}_{\mathsf{id}}\leftarrow\mathsf{SamplePre}(\mathbf{F}^{\prime}_{\mathsf{id}},\mathbf{D}^{\prime}_{\mathsf{id}},\mathbf{U}_{2},\sigma_{1})\in\mathbb{Z}^{(m+\omega)\times\lambda}_{q}$.

4. 4.

   Output $\mathsf{Tsk}_{\mathsf{id}}\leftarrow\mathbf{D}_{\mathsf{id}}$.
   

Encrypt($\mathsf{MPK},\mathsf{id},\mathbf{m}$)

On input the master pubic key $\mathsf{MPK}$, the algorithm encrypts the message $\mathbf{m}\in\{0,1\}^{\lambda}$ for identity $\mathsf{id}=(\mathsf{id}_{1},\dots,\mathsf{id}_{\ell})$ at depth $\ell$ as follows:

1. 1.

   Compute $\mathbf{F}_{\mathsf{id}}=[\mathbf{A}|\mathbf{B}_{\mathsf{id}}]=[\mathbf{A}|\mathbf{A}_{1}+\mathsf{FRD}(\mathsf{id}_{1})\mathbf{G}|\dots|\mathbf{A}_{\ell}+\mathsf{FRD}(\mathsf{id}_{\ell})\mathbf{G}]\in\mathbb{Z}^{n\times(m+\ell\omega)}_{q}$.

2. 2.

   Sample $\mathbf{k}\leftarrow\{0,1\}^{\lambda}$.

3. 3.

   Sample a uniformly random vector $\mathbf{s}\leftarrow\mathbb{Z}^{n}_{q}$.

4. 4.

   Choose noise vectors $\mathbf{e}_{0}\leftarrow\mathcal{D}^{m}_{\mathbb{Z},r}$, $\mathbf{e}_{1}\leftarrow\mathcal{D}^{\ell\omega}_{\mathbb{Z},2r\tau}$ $\mathbf{e}_{2}\leftarrow\mathcal{D}^{\lambda}_{\mathbb{Z},r},\ \mathbf{e}_{3}\leftarrow\mathcal{D}^{\lambda}_{\mathbb{Z},2r\tau},\ \mathbf{e}_{4}\leftarrow\mathcal{D}^{\omega}_{\mathbb{Z},2r\tau}$.

5. 5.

   Set

   $$\mathbf{c}_{0}^{T}=\mathbf{s}^{T}\mathbf{A}+\mathbf{e}_{0}^{T},\ \ \ \ \ \mathbf{c}_{1}^{T}=\mathbf{s}^{T}\mathbf{B}_{\mathsf{id}}+\mathbf{e}_{1}^{T},\ \ \ \ \ \mathbf{c}_{2}^{T}=\mathbf{s}^{T}\mathbf{U}_{1}+\mathbf{e}_{2}^{T}+\mathbf{m}^{T}\left\lfloor\frac{q}{2}\right\rfloor,$$

   and

   $$\mathbf{c}_{3}^{T}=\mathbf{s}^{T}\mathbf{U}_{2}+\mathbf{e}_{3}^{T}+\mathbf{k}^{T}\left\lfloor\frac{q}{2}\right\rfloor,\ \ \ \ \ \mathbf{c}_{4}^{T}=\mathbf{s}^{T}(\mathbf{A}_{0}+\mathsf{FRD}(\mathsf{H}(\mathsf{id}))\mathbf{G})+\mathbf{e}_{4}^{T}.$$

6. 6.

   Output $\mathsf{CT}=(\mathbf{c}_{0},\mathbf{c}_{1},\mathbf{c}_{2},\mathbf{c}_{3},\mathbf{c}_{4},\mathbf{k})$.
   

Decrypt($\mathsf{MPK},\mathsf{CT},\mathsf{SK}_{\mathsf{id}}$)

On input the master pubic key $\mathsf{MPK}$, a ciphertext $\mathsf{CT}$ and a secret key $\mathsf{SK}_{\mathsf{id}}$ where $\mathsf{id}=(\mathsf{id}_{1},\dots,\mathsf{id}_{\ell})$ is an identity at depth $\ell$, the algorithm does:

1. 1.

   Parse $\mathsf{CT}=(\mathbf{c}_{0},\mathbf{c}_{1},\mathbf{c}_{2},\mathbf{c}_{3},\mathbf{c}_{4},\mathbf{k})$; Output $\perp$ if $\mathsf{CT}$ doesn’t parse.

2. 2.

   Set $\mathbf{F}_{\mathsf{id}}=[\mathbf{A}|\mathbf{A}_{1}+\mathsf{FRD}(\mathsf{id}_{1})\mathbf{G}|\dots|\mathbf{A}_{\ell}+\mathsf{FRD}(\mathsf{id}_{\ell})\mathbf{G}]$ and recover $\mathbf{s}$ via $\mathsf{Invert}(\mathsf{SK}_{\mathsf{id}},\mathbf{F}_{\mathsf{id}},[\mathbf{c}_{0}^{T}|\mathbf{c}_{1}^{T}])$.

3. 3.

   Recover $\tilde{\mathbf{k}}\leftarrow\mathsf{Round}(\mathbf{c}_{3}^{T}-\mathbf{s}^{T}\mathbf{U}_{2})$; Return $\perp$ if $\tilde{\mathbf{k}}\neq\mathbf{k}$.

4. 4.

   Compute $\mathbf{m}\leftarrow\mathsf{Round}(\mathbf{c}_{2}^{T}-\mathbf{s}^{T}\mathbf{U}_{1})$.

5. 5.

   Output $\mathbf{m}$.
   

TkVer($\mathsf{MPK},\mathsf{id},\mathsf{Tsk}_{\mathsf{id}},\mathsf{CT}$)

On input the master pubic key $\mathsf{MPK}$, the algorithm uses the tracing key $\mathsf{Tsk}_{\mathsf{id}}=\mathbf{D}_{\mathsf{id}}$ corresponding to the identity $\mathsf{id}$ to check whether a ciphertext $\mathsf{CT}$ is encrypted for the given identity $\mathsf{id}$:

1. 1.

   Parse $\mathsf{CT}=(\mathbf{c}_{0},\mathbf{c}_{1},\mathbf{c}_{2},\mathbf{c}_{3},\mathbf{c}_{4},\mathbf{k})$; Output $\perp$ if $\mathsf{CT}$ doesn’t parse.

2. 2.

   Compute $\tilde{\mathbf{k}}\leftarrow\mathsf{Round}(\mathbf{c}_{3}^{T}-[\mathbf{c}_{0}^{T}|\mathbf{c}_{4}^{T}]\mathbf{D}_{\mathsf{id}})$.

3. 3.

   If $\tilde{\mathbf{k}}=\mathbf{k}$ then output $1$; else output $0$.