Fast Proxy Re-Encryption for Publish/Subscribe Systems
© 2017 ACM. We develop two IND-CPA-secure multihop unidirectional Proxy Re-Encryption (PRE) schemes by applying the Ring-LWE (RLWE) key switching approach from the homomorphic encryption literature. Unidirectional PRE is ideal for secure publish-subscribe operations where a publisher encrypts inform...
| Main Authors: | , , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | English |
| Published: |
Association for Computing Machinery (ACM)
2021
|
| Online Access: | https://hdl.handle.net/1721.1/136343 |
| _version_ | 1826190198083420160 |
|---|---|
| author | Polyakov, Yuriy Rohloff, Kurt Sahu, Gyana Vaikuntanathan, Vinod |
| author2 | Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science |
| author_facet | Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Polyakov, Yuriy Rohloff, Kurt Sahu, Gyana Vaikuntanathan, Vinod |
| author_sort | Polyakov, Yuriy |
| collection | MIT |
| description | © 2017 ACM. We develop two IND-CPA-secure multihop unidirectional Proxy Re-Encryption (PRE) schemes by applying the Ring-LWE (RLWE) key switching approach from the homomorphic encryption literature. Unidirectional PRE is ideal for secure publish-subscribe operations where a publisher encrypts information using a public key without knowing upfront who the subscriber will be and what private key will be used for decryption. The proposed PRE schemes provide a multihop capability, meaning that when PRE-encrypted information is published onto a PRE-enabled server, the server can either delegate access to specific clients or enable other servers the right to delegate access. Our first scheme (which we call NTRU-ABD-PRE) is based on a variant of the NTRU-RLWE homomorphic encryption scheme. Our second and main PRE scheme (which we call BV-PRE) is built on top of the Brakerski-Vaikuntanathan (BV) homomorphic encryption scheme and relies solely on the RLWE assumption. We present an open-source C++ implementation of both schemes and discuss several algorithmic and software optimizations. We examine parameter selection tradeoffs in the context of security, runtime/latency, throughput, ciphertext expansion, memory usage, and multihop capabilities. Our experimental analysis demonstrates that BV-PRE outperforms NTRU-ABD-PRE in both single-hop and multihop settings. The BVPRE scheme has a lower time and space complexity than existing IND-CPA-secure lattice-based PRE schemes and requires small concrete parameters, making the scheme computationally efficient for use on low-resource embedded systems while still providing 100 bits of security. We present practical recommendations for applying the PRE schemes to several use cases of ad hoc information sharing for publish-subscribe operations. |
| first_indexed | 2024-09-23T08:36:35Z |
| format | Article |
| id | mit-1721.1/136343 |
| institution | Massachusetts Institute of Technology |
| language | English |
| last_indexed | 2024-09-23T08:36:35Z |
| publishDate | 2021 |
| publisher | Association for Computing Machinery (ACM) |
| record_format | dspace |
| spelling | mit-1721.1/1363432023-09-28T20:15:37Z Fast Proxy Re-Encryption for Publish/Subscribe Systems Polyakov, Yuriy Rohloff, Kurt Sahu, Gyana Vaikuntanathan, Vinod Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory © 2017 ACM. We develop two IND-CPA-secure multihop unidirectional Proxy Re-Encryption (PRE) schemes by applying the Ring-LWE (RLWE) key switching approach from the homomorphic encryption literature. Unidirectional PRE is ideal for secure publish-subscribe operations where a publisher encrypts information using a public key without knowing upfront who the subscriber will be and what private key will be used for decryption. The proposed PRE schemes provide a multihop capability, meaning that when PRE-encrypted information is published onto a PRE-enabled server, the server can either delegate access to specific clients or enable other servers the right to delegate access. Our first scheme (which we call NTRU-ABD-PRE) is based on a variant of the NTRU-RLWE homomorphic encryption scheme. Our second and main PRE scheme (which we call BV-PRE) is built on top of the Brakerski-Vaikuntanathan (BV) homomorphic encryption scheme and relies solely on the RLWE assumption. We present an open-source C++ implementation of both schemes and discuss several algorithmic and software optimizations. We examine parameter selection tradeoffs in the context of security, runtime/latency, throughput, ciphertext expansion, memory usage, and multihop capabilities. Our experimental analysis demonstrates that BV-PRE outperforms NTRU-ABD-PRE in both single-hop and multihop settings. The BVPRE scheme has a lower time and space complexity than existing IND-CPA-secure lattice-based PRE schemes and requires small concrete parameters, making the scheme computationally efficient for use on low-resource embedded systems while still providing 100 bits of security. We present practical recommendations for applying the PRE schemes to several use cases of ad hoc information sharing for publish-subscribe operations. 2021-10-27T20:34:57Z 2021-10-27T20:34:57Z 2017 2019-07-09T15:50:41Z Article http://purl.org/eprint/type/JournalArticle https://hdl.handle.net/1721.1/136343 en 10.1145/3128607 ACM Transactions on Privacy and Security Creative Commons Attribution-Noncommercial-Share Alike http://creativecommons.org/licenses/by-nc-sa/4.0/ application/pdf Association for Computing Machinery (ACM) Other repository |
| spellingShingle | Polyakov, Yuriy Rohloff, Kurt Sahu, Gyana Vaikuntanathan, Vinod Fast Proxy Re-Encryption for Publish/Subscribe Systems |
| title | Fast Proxy Re-Encryption for Publish/Subscribe Systems |
| title_full | Fast Proxy Re-Encryption for Publish/Subscribe Systems |
| title_fullStr | Fast Proxy Re-Encryption for Publish/Subscribe Systems |
| title_full_unstemmed | Fast Proxy Re-Encryption for Publish/Subscribe Systems |
| title_short | Fast Proxy Re-Encryption for Publish/Subscribe Systems |
| title_sort | fast proxy re encryption for publish subscribe systems |
| url | https://hdl.handle.net/1721.1/136343 |
| work_keys_str_mv | AT polyakovyuriy fastproxyreencryptionforpublishsubscribesystems AT rohloffkurt fastproxyreencryptionforpublishsubscribesystems AT sahugyana fastproxyreencryptionforpublishsubscribesystems AT vaikuntanathanvinod fastproxyreencryptionforpublishsubscribesystems |