Delegation of Decryption Rights With Revocability From Learning With Errors

The notion of decryption rights delegation was initially introduced by Blaze <italic>et al.</italic> in EUROCRYPT 1998. It, defined as <italic>proxy re-encryption</italic>, allows a semi-trusted proxy to convert a ciphertext intended for a party to another ciphertext of the same plaintext, without knowledge of the underlying plaintext and decryption key. It has been explored to many real-world applications, e.g., encrypted email forwarding. However, the intrinsic all-or-nothing share feature of proxy re-encryption yields a limitation that the share cannot be revoked. This may hinder the scalability of its applications in practice. In this paper, for the first time, we define the concept of revocability in terms of decryption rights delegation. The novel concept enables data owner to revoke the shared decryption rights when needed. Inspired by the seminal lattice-based proxy re-encryption proposed in PKC 2014, we design a concrete lattice-based construction which satisfies the notion. In our construction, we make use of binary-tree structure to implement the revocation of decryption rights, so that the update of re-encryption key is reduced to <inline-formula> <tex-math notation="LaTeX">$O(logN)$ </tex-math></inline-formula> (instead of <inline-formula> <tex-math notation="LaTeX">$O(N)$ </tex-math></inline-formula>), where <inline-formula> <tex-math notation="LaTeX">$N$ </tex-math></inline-formula> is the maximum number of delegatee. Furthermore, the security of our scheme is based on the standard learning with errors problem (LWE problem), which could be reduced to the worst-case hard problems (such as GapSVP and SIVP) in the context of lattices. The scheme is chosen ciphertext secure in the standard model. As of independent interest, our scheme achieves both backward and forward security, which means that once a user is revoked after a time period <inline-formula> <tex-math notation="LaTeX">$\mathbf {t}$ </tex-math></inline-formula>, it cannot gain access to all encrypted files before and after <inline-formula> <tex-math notation="LaTeX">$\mathbf {t}$ </tex-math></inline-formula>.