Practical and Secure Integrated PKE+PEKS with Keyword Privacy

Francesco Buccafurri

, Gianluca Lax

, Rajeev Anand Sahu

and Vishal Saraswat

DIIES Department, University of Reggio Calabria, Reggio Calabria, Italy

C.R.Rao Advanced Institute of Mathematics Statistics and Computer Science, Hyderabad, India

Keywords:

PKE+PEKS, Searchable Encryption, Perfect Keyword Privacy, Asymmetric Pairings (Type 3), Provable

Security, Standard Model, SXDH, E-governance, Privacy in the Cloud.

Abstract:

Public-key encryption with keyword search (PEKS) schemes are useful to delegate searching capabilities on

encrypted data to a third party, who does not hold the entire secret key, but only an appropriate token which

allows searching operations but preserves data privacy. We propose an efﬁcient and practical integrated public-

key encryption (PKE) and public-key encryption with keyword search (PEKS) scheme (PKE+PEKS) which

we prove to be secure in the strongest security notion for PKE+PEKS schemes. In particular, we provide

a uniﬁed security proof of its joint CCA-security in standard model. The security of our scheme relies on

Symmetric eXternal Difﬁe-Hellman (SXDH) assumption which is a much simpler and more standard hardness

assumption than the ones used in most of the comparable schemes. Ours is the ﬁrst construction to use

asymmetric pairings which enable an extremely fast implementation useful for practical applications. Finally

we compare our scheme with other proposed integrated PKE+PEKS schemes and provide a relative analysis

of its efﬁciency.

1 INTRODUCTION

(Boneh et al., 2004) gave the ﬁrst formal construction

of “searchable encryption” in public key setting and

called it public key encryption with keyword search

(PEKS), popularly known as BDOP scheme. The ba-

sic advantage of this primitive is that it allows one

to delegate to a third party the capability of “search-

ing on public key encrypted data” without impact-

ing privacy. PEKS basically enables a search func-

tion to a public key encryption (PKE) scheme and

hence a PEKS is directly related to an underlying

PKE scheme and both are used together. We call

such a combination integrated PKE and PEKS and

denote it as PKE+PEKS. For a PKE+PEKS scheme

the privacy must be simultaneously achieved for both

the message (that is, data) and the keyword, that is,

IND-PKE-CCA and IND-PEKS-CCA. But achieving

the security based on two independent CCA-secure

schemes is not trivial. So a uniﬁed security model for

the joint CCA-security of PKE+PEKS is desired.

1.1 Related Work

(Abdalla et al., 2005) deﬁned computational, sta-

tistical and perfect variations of consistency for a

PEKS scheme and proposed a transform of an anony-

mous identity-based encryption (IBE) scheme to a

PEKS scheme. (Baek et al., 2006) formally de-

ﬁned a combined scheme for PKE and PEKS based

on the BDOP-PEKS and a variation of ElGamal en-

cryption scheme with the randomness reuse tech-

nique (Kurosawa, 2002). (Crescenzo and Saraswat,

2007) constructed a PEKS scheme which, unlike all

other schemes, is not based on bilinear forms. Vari-

ous groups (Boyen and Waters, 2006; Fuhr and Pail-

lier, 2007; Zhang and Imai, 2007; Baek et al., 2008;

Abdalla et al., 2010) have studied the design and efﬁ-

ciency of the PEKS schemes while (Lu et al., 2009;

Shmueli et al., 2010; Ibraimi et al., 2011) have studied

the application aspects of PEKS.

(Boneh et al., 2004) formalized the security pre-

cisely for the PEKS scheme with IND-PEKS-CPA

notion. (Baek et al., 2008) combined PKE and PEKS

with a joint security notion but their notion cov-

ered only data privacy and not the keyword privacy.

(Zhang and Imai, 2007) ﬁrst extended the security no-

tion to achieveboth data privacy and keywordprivacy.

The security notion for data security is IND-PKE-

CCA, which is achieved in their scheme using a tag-

based CCA-secure PKE scheme, and for keyword

privacy the notion is IND-PEKS-CPA, which they

448

Buccafurri F., Lax G., Sahu R. and Saraswat V..

Practical and Secure Integrated PKE+PEKS with Keyword Privacy.

DOI: 10.5220/0005577104480453

In Proceedings of the 12th International Conference on Security and Cryptography (SECRYPT-2015), pages 448-453

ISBN: 978-989-758-117-5

 2015 SCITEPRESS (Science and Technology Publications, Lda.)

have achieved using a CPA-secure PEKS scheme.

But their construction suffers from double key size,

which increases key-maintenance overheads unnec-

essarily during the practical implementations. But

none of the above works prove joint security of a

PKE+PEKS scheme in strongest notion, that is, ‘IND-

PKE+PEKS-CCA security’. (Abdalla et al., 2010) in-

troduced a new combined CCA-security notion on the

standard model with a privilege to the adversary to ac-

cess both decryption oracle and test oracle. Following

the idea of (Dodis and Katz, 2005), they constructed

a PKE+PEKS scheme by combining two schemes, a

tag-based CCA-secure PKE scheme and a tag-based

CCA-secure PEKS scheme. But their construction

suffers from double key size and an increase in the

computational overhead of the resulting PKE+PEKS.

Recently, (Chen et al., 2014) gave a generic construc-

tion of a PKE+PEKS scheme from an anonymous

IBE and one-time signatures using a single key for

both PKE and PEKS operations.

1.2 Our Contribution

As discussed above that a PEKS scheme joins PKE

to provide it a searchable functionality, hence com-

bining both the schemes in a secure manner is of

great interest. Attempts for the security of PEKS

were started with the IND-PEKS-CPA notion of secu-

rity on random oracle (Boneh et al., 2004), where the

‘keyword’ is considered as a plaintext. Though there

have been lot of research on searchable encryption,

the only fully secure schemes (Abdalla et al., 2010;

Chen et al., 2014) are too inefﬁcient to be practical

enough to be used in implementation. We propose a

state of art efﬁcient, computationally and bandwidth-

wise, fully secure practical scheme which, we believe,

can be used in real applications.

At the heart of our scheme are asymmetric pair-

ings (Type 3) which enables our scheme to have

very short ciphertexts and extremely fast implemen-

tation. Typically, compared with symmetric pairings,

for Type 3 pairings, the estimated bit sizes of group el-

ements, over which most of the computation is done

and are communicated, are four times smaller for 256-

bit (AES) security (Chen et al., 2012).

We also give a relatively uniﬁed model for the

joint security of PKE+PEKS scheme. We note that

a scheme with a security proof in the random oracle

model implies no security in the real world (Canetti

et al., 2004), security of our scheme is proved in

the standard model and hence our scheme achieves

practical security. We will provide a full security anal-

ysis and will envisage a few suitable applications in

the full version of this paper.

2 PRELIMINARIES

We denote by y ← A(x) the operation of running a ran-

domized or deterministic algorithm A(x) and storing

the output to the variable y. If X is a set, then v

← X

denotes the operation of choosing an element v of X

according to the uniform random distribution on X.

We say that a given function f : N → [0, 1] is negli-

gible in n if f(n) < 1/p(n) for any polynomial p for

sufﬁciently large n. For a group G and g ∈ G, we write

G = hgi if g is a generator of G. We let G

, G

and

be multiplicative cyclic groups of the same prime

order q and e : G

× G

→ G

be a pairing deﬁned as

follows.

Deﬁnition 1. A map e : G

× G

→ G

is called a

cryptographic bilinear map or a pairing if it satisﬁes

the following properties:

1. Bilinearity: For all (g

) ∈ G

× G

and for all

a,b ∈ Z

, e(g

) = e(g

)

2. Non-Degeneracy: There exists (g

) ∈ G

× G

such that e(g

) 6= 1, the identity of G

3. Computability: There exists an efﬁcient algorithm

to compute e(g

) ∈ G

, for all (g

) ∈ G

A pairing e : G

× G

→ G

is called a symmetric

or a Type-1 pairing if G

= G

otherwise it is called

asymmetric. Asymmetric pairings are further catego-

rized into Type 2 and Type 3 pairings. If there exists

an efﬁciently computable isomorphism between G

and G

, the pairing is referred to as Type 2, whereas

if there is no efﬁciently computable isomorphism be-

tween G

and G

, the pairing is referred to as Type-3.

2.1 Dual Pairing Vector Space

Let g ∈ G and (g

) ∈ G

× G

. For a vector

v = (v

,... ,v

) ∈ Z

we deﬁne a vector of group

elements as g

:= (g

,... ,g

). For vectors v =

,... ,v

),w = (w

,... ,w

) ∈ Z

and for any a ∈ Z

we further deﬁne the following properties on such a

vector space,

)

:= g

= (g

,... ,g

);

:= g

v+w

= (g

,... ,g

)

e(g

) :=

∏

i=1

e(g

) = e(g

)

v·w

Deﬁnition 2. Two bases D := {d

} and

∗

= {d

∗

} of Z

are dual orthonormal if

for all 1 ≤ j 6= k ≤ 4,

· d

∗

= 0 (mod q) and d

· d

∗

= ψ (mod q)

where ψ

← Z

PracticalandSecureIntegratedPKE+PEKSwithKeywordPrivacy

449

For such dual bases, for all (g

) ∈ G

× G

e(g

∗

) = 1 whenever j 6= k.

Theorem 1 ((Okamoto and Takashima, 2010)). We

can efﬁciently select two random dual orthonormal

bases D := {d

} and D

∗

= {d

∗

}

of Z

2.2 Symmetric eXternal Difﬁe-Hellman

(SXDH) Assumption

Let G

and G

be multiplicative cyclic groups as

stated above, with g

∈ G

and g

∈ G

Deﬁnition 3. Let G be a multiplicative cyclic group

and g a generator. Let a,b,c ∈ Z

∗

be randomly chosen

and kept secret. Given g, g

∈ G, the decisional

Difﬁe-Hellman problem (DDHP) in the group G is to

decide if g

= g

Deﬁnition 4. The DDH assumption holds in a group

G if there is no efﬁcient algorithm which can solve

DDHP in G.

Deﬁnition 5. Given two cyclic groups G

and G

, we

say the Symmetric eXternal Difﬁe-Hellman (SXDH)

assumption holds if DDH assumption is true in both

the groups G

and G

3 INTEGRATED PKE AND PEKS

SCHEME (PKE+PEKS)

Here we give a formal deﬁnition of an integrated

public-key encryption (PKE) and public-key en-

cryption with keyword search (PEKS) scheme

(PKE+PEKS) based on the works of (Boneh et al.,

2004; Baek et al., 2008; Chen et al., 2014).

In PEKS, three parties called sender, receiver and

server are involved. The sender is a party that creates

and sends encrypted keywords, which we call PEKS

ciphertexts. The server is a party that receives PEKS

ciphertexts and performs search upon receiving trap-

doors from the receiver. The receiver is a party that

creates trapdoors and sends them to the server to ﬁnd

the data that it wants.

3.1 Formal Deﬁnition of PKE+PEKS

A PKE+PEKS scheme comprises of six algorithms:

Setup, KeyGen, Encrypt, Decrypt, TokenGen and Test.

G ← Setup(1

): This is the system initialization al-

gorithm run by the receiver which takes as input a

security parameter 1

and outputs public parameters

Params G := (q, G

,e) where G

i, G

= hg

i and G

are cyclic groups of prime

order q, and e : G

× G

→ G

is a Type 3 pairing.

(pk

,sk

) ← KeyGen(G): This is the key genera-

tion algorithm run by a user X which takes as in-

put the public parameters G and outputs a key pair

(pk

,sk

). For the receiver X = R, the key pair is

its (public key, private key) pair (pk

,sk

) and for

a sender X = S, the key pair is its (veriﬁcation key,

signing key) pair (vk

,sk

U ← Encrypt(G, pk

,sk

,m,w): This is a random-

ized algorithm run by the sender and takes input

Params G, the receiver’s public key pk

, the sender’s

signing key sk

, a message m and keyword w and

outputs the joint PKE+PEKS ciphertext U.

m ← Decrypt(G, pk

,sk

,U) This is a determinis-

tic algorithm run by the receiver and takes input

Params G, the receiver’s public key pk

and the se-

cret key sk

and a ciphertext U and outputs a mes-

sage m or ⊥.

← TokenGen(G, pk

,sk

,w) This is a random-

ized algorithm run by the receiver and takes input

Params G, the receiver’s public key pk

and the se-

cret key sk

and a keyword w and outputs a token t

which it gives to the server.

b ← Test(G, pk

,U) This is a deterministic algo-

rithm run by the server and takes input Params G, the

receiver’s public key pk

, a token t

and a ciphertext

U and outputs a bit b ∈ {0,1} or ⊥.

Where the context is clear, the inputs Params and

the keys will be assumed to be implicit and we will

not write them explicitly in the algorithms.

3.2 Security Model for PKE+PEKS

Joint Data and Keyword Privacy for PKE+PEKS

schemes is deﬁned via the following experiment.

Setup: On input a security parameter 1

, the chal-

lenger C runs KeyGen(1

) to generate the public pa-

rameter Params G and the system key pair (pk,sk)

and gives the adversary A the public key pk.

Phase 1: A can adaptively make three types of

queries:

• Decryption query hui: C responds with m ←

Decrypt(sk,u).

• Token query hwi: C responds with t

←

TokenGen(sk,w).

• Test query hu, wi: C responds with Test(u,t

)

where t

← TokenGen(sk, w).

Challenge: A outputs two messages m

∗

and m

∗

and

two keywords w

∗

and w

∗

. C picks two random bits

a,b and sends u

∗

← Encrypt(pk,m

∗

) to A as the

challenge ciphertext.

Phase 2: A can adaptively make more queries as in

Phase 1 subject to the restrictions that it is not al-

SECRYPT2015-InternationalConferenceonSecurityandCryptography

450

lowed to make

• Decryption query hu

∗

• Token queries hw

∗

i and hw

∗

i, and

• Test queries hu

∗

i and hu

∗

C responds the same way as in Phase 1.

Guess: A outputs its guess (a

) for (a,b).

Deﬁnition 6 (Data Privacy). The adversary succeeds

in breaking the data privacy if a

= a and we say that

a PKE+PEKS scheme has data privacy if there is no

PPT adversary with a non-negligible advantage in 1

in the above experiment.

Deﬁnition 7 (Keyword Privacy). The adversary suc-

ceeds in breaking the keyword privacy if b

= b

and we say that a PKE+PEKS scheme has keyword

privacy if there is no PPT adversary with a non-

negligible advantage in 1

in the above experiment.

Deﬁnition 8. We say a PKE+PEKS scheme is jointly

CCA-secure if it has keyword privacy and data

privacy simultaneously.

Remark 1. The joint CCA-security notion deﬁned

by us embodies both IND-PKE-CCA security and

IND-PEKS-CCA security for PKE+PEKS in the joint

sense and is stronger than previous ones considered

in (Baek et al., 2006; Zhang and Imai, 2007), both of

which are insecure in our joint CCA-security notion

as analyzed in Section 1.

4 PROPOSED SCHEME

We present here our efﬁcient and CCA secure

integrated PKE+PEKS scheme motivated by the short

IBE and IBS schemes of (Chen et al., 2012). As de-

scribed in Section 3, our scheme consists of the fol-

lowing algorithms: Setup, KeyGen, Encrypt, Decrypt,

TokenGen, and Test.

Setup: A receiver R wishing to receive

joint PKE+PEKS messages generates G :=

(q,G

,e) where G

= hg

i, G

= hg

and G

are cyclic groups of prime order q and

e : G

× G

→ G

is a Type 3 pairing. The receiver

then chooses two cryptographic hash functions

H : {0,1}

∗

→ Z

and J : {0, 1}

∗

→ G

. Finally, R

publishes G, H and J as the public parameters of the

system. (These may be considered as part R’s public

key, but for sake of clarity we keep these separate.)

KeyGen: To generate keys for the system, the re-

ceiver does the following:

• samples random dual orthonormal bases D

and D

∗

where D = {d

} and D

∗

} so that for all 1 ≤ j ≤ 4, d

·d

∗

= ψ;

• picks α

← Z

;

• computes g

:= e(g

)

αd

·d

∗

;

• sets the public key pk

= {g

}; and

• sets the master secret sk

= {α,g

∗

Encrypt: To encrypt a message m ∈ G

with a

keyword w ∈ {0,1}

∗

for the receiver R, a sender S

does the following:

• samples random dual orthonormal bases E and E

∗

where E = {e

} and E

∗

= {e

∗

}

so that for all 1 ≤ j ≤ 4, e

· e

∗

= φ;

• picks β

← Z

;

• computes g

:= e(g

)

βe

·e

∗

;

• sets the signing key sk

= (β,g

∗

); and

• sets the veriﬁcation key vk

= (g

• sets vk = J(vk

), picks x,y

← Z

and computes

• ID

= H(0kvk) and ID

= H(1kw)

• C

= (C

:= m· (g

)

:= g

x(d

+ID

)

• C

= (C

:= vk· (g

)

:= g

x(d

+ID

)

• t = H(C

)

• σ = g

(β+yt)e

∗

−ye

∗

and ﬁnally declares the ciphertext U =

(vk

,σ).

Decrypt: To decrypt the ciphertext U =

), the receiver does the following:

• obtains h

, h

and h

from u

;

• computes t = H(u

); and

• checks whether e(u

+te

) = g

• If the above equality does not hold then outputs ⊥.

Otherwise it obtains C

from u

and

• computes vk = J(u

) and sets ID

= H(0kvk);

• computes the corresponding decryption key

= g

αd

∗

+(ID

·d

∗

−d

∗

)

;

• Finally it outputs m ←

e(C

,SK

)

TokenGen: To generate a token t

for the keyword

w, the receiver

• computes ID

= H(1kw);

• picks r

← Z

and computes t

= g

αd

∗

+r(ID

·d

∗

−d

∗

)

and gives to the server t

Test: To test whether the ciphertext U =

) includes the keyword w or not

using the token t

, the server does the following:

• obtains h

, h

and h

from u

;

• computes t = H(u

); and

• checks whether e(u

+te

) = g

PracticalandSecureIntegratedPKE+PEKSwithKeywordPrivacy

451

• If the above equality does not hold then outputs 0.

• Otherwise it obtains C

from u

and checks

whether

e(C

)

= J(u

)

• If yes then outputs 1, else outputs 0.

4.1 Correctness of the Proposed Scheme

Theorem 2. The presented scheme is correct.

Proof. The decryption is correct since

e(C

,SK

) = e(g

x(d

+ID

)

αd

∗

+r(ID

∗

−d

∗

)

= e(g

)

αxd

·d

∗

e(g

)

xrID

·d

∗

−d

·d

∗

)

= g

αx

and

e(C

,SK

)

m· (g

)

αx

= m.

The testing is correct since

e(C

) = e(g

x(d

+ID

)

αd

∗

+r(ID

·d

∗

−d

∗

)

= e(g

)

x(d

+ID

)(αd

∗

+r(ID

·d

∗

−d

∗

))

= e(g

)

x(α+rID

)(d

·d

∗

+ID

·d

∗

)−xID

·d

∗

−d

·d

∗

)

= e(g

)

x(α+rID

)ψ−xID

= e(g

)

xαψ

= g

xα

and

e(C

)

vk· (g

)

xα

= vk = J(u

5 SECURITY ANALYSIS

In this section, we analyze the security of our scheme.

We here give a proof sketch of the security of our

scheme. Note that the generic proof is quite compli-

cated and causes security degradation and in the full

version of this paper we will give a direct proof which

is conceptually simpler and provides tight bounds.

Note that the basic IBE scheme that we use in

our scheme was proved to be ANO-IBE-CCA anony-

mous (Chen et al., 2012) based on the SXDH as-

sumption. The signature scheme that we use is a

modiﬁcation of the signature scheme in (Chen et al.,

2012) which was obtained using a Naor-transform

of the IBE in (Chen et al., 2012) and is proved

to be sEUF-CMA secure based on the SXDH as-

sumption. Straight-forward modiﬁcations of proof

in (Chen et al., 2012) will also show the security

of our signature scheme under the same assumption.

Thus proceeding as in (Chen et al., 2014), we can also

prove that our scheme is jointly CCA-secure, that is,

our scheme is both IND-PKE-CCA and IND-PEKS-

CCA and has keyword privacy and data privacy si-

multaneously.

6 EFFICIENCY ANALYSIS

We compare the efﬁciency of our Integrated

PKE+PEKS scheme with the existing PEKS

schemes (Baek et al., 2006; Zhang and Imai, 2007;

Chen et al., 2014) in Table 1, and show that our

scheme is more efﬁcient than these schemes. In

each of the four phases: Encryption, Decryption,

Token Gen. and Test, we compare the total number

of bilinear pairings (P), exponentiations and inverse

in Z

denoted as E(Z

) and I(Z

), exponentiations

and multiplications in G

denoted as E(G

) and

M(G

), exponentiations and multiplications in G

denoted as E(G

) and M(G

) and exponentiations

and multiplications in G

denoted as E(G

) and

M(G

). Our scheme uses asymmetric pairings so we

have considered operations in all the three different

groups, G

, G

and G

, while for schemes using

symmetric pairings, we have counted operations in

groups G

and G

, considering |G

| ≈ |G

7 CONCLUSION AND FUTURE

WORK

We have proposed an integrated public-key en-

cryption (PKE) and public-key encryption with

keyword search (PEKS) scheme (PKE+PEKS) which

is efﬁcient, computationally and bandwidth-wise,

and secure in the strongest sense for PKE+PEKS

schemes. In the full version of this paper, we will

provide a full security analysis of our scheme in

a relatively uniﬁed model for the joint security of

PKE+PEKS scheme in standard model. Further, we

will provide a more detailed efﬁciency analysis and

comparison with existing similar schemes. Finally we

will envisage a few suitable applications for practical

implementation of our scheme.

ACKNOWLEDGEMENT

This work has been partially supported by the

TENACE PRIN Project (n. 20103P34XC) funded by

the Italian Ministry of Education, University and Re-

search, and by the Program “Programma Operativo

SECRYPT2015-InternationalConferenceonSecurityandCryptography

452

Table 1: Efﬁciency Comparison.

Operation Scheme P E(Z

) I(Z

) E(G

) M(G

) E(G

) M(G

) E(G

) M(G

)

Encryption

(Baek et al., 2006) 1 0 0 2 0 - - 1 0

(Zhang and Imai, 2007) 2 0 0 2 1 - - 6 1

(Chen et al., 2014) 5 0 1 7 2 - - 5 2

Our scheme 0 0 0 2 0 1 0 1 2

Decryption

(Baek et al., 2006) 0 0 0 1 0 - - 0 0

(Zhang and Imai, 2007) 0 0 0 0 0 - - 2 1

(Chen et al., 2014) 3 0 1 3 2 - - 0 1

Our scheme 2 0 0 1 0 0 0 0 1

TokenGen

(Baek et al., 2006) 0 0 0 1 0 - - 0 0

(Zhang and Imai, 2007) 0 0 0 1 1 - - 0 0

(Chen et al., 2014) 0 0 1 1 1 - - 0 0

Our scheme 0 0 0 0 0 0 0 0 0

Test

(Baek et al., 2006) 1 0 0 0 0 - - 0 0

(Zhang and Imai, 2007) 1 0 0 0 0 - - 1 1

(Chen et al., 2014) 4 1 0 2 2 0 0 2 3

Our scheme 2 0 0 1 0 0 0 1 0

Overall

comparison

(Baek et al., 2006) 2 0 0 4 1 - - 1 0

(Zhang and Imai, 2007) 3 0 0 3 2 - - 9 3

(Chen et al., 2014) 12 1 3 13 7 - - 7 6

Our scheme 4 0 0 4 0 1 0 2 3

Nazionale Ricerca e Competitivit`a” 2007-2013, Dis-

tretto Tecnologico CyberSecurity funded by the Ital-

ian Ministry of Education, University and Research.

REFERENCES

Abdalla, M., Bellare, M., Catalano, D., Kiltz, E., Kohno, T.,

Lange, T., Malone-Lee, J., Neven, G., Paillier, P., and

Shi, H. (2005). Searchable encryption revisited: Con-

sistency properties, relation to anonymous ibe, and ex-

tensions. In CRYPTO, volume 3621 of LNCS, pages

205–222.

Abdalla, M., Bellare, M., and Neven, G. (2010). Robust en-

cryption. In TCC, volume 5978 of LNCS, pages 480–

497.

Baek, J., Safavi-Naini, R., and Susilo, W. (2006). On the

integration of public key data encryption and public

key encryption with keyword search. In ISC, volume

4176 of LNCS, pages 217–232.

Baek, J., Safavi-Naini, R., and Susilo, W. (2008). Public key

encryption with keyword search revisited. In ICCSA,

volume 5072 of LNCS, pages 1249–1259.

Boneh, D., Di Crescenzo, G., Ostrovsky, R., and Per-

siano, G. (2004). Public key encryption with keyword

search. In EuroCrypt, volume 3027 of LNCS, pages

506–522.

Boyen, X. and Waters, B. (2006). Anonymous hierarchical

identity-based encryption (without random oracles).

In CRYPTO, volume 4117 of LNCS, pages 290–307.

Canetti, R., Goldreich, O., and Halevi, S. (2004). The ran-

dom oracle methodology, revisited. Journal of the

ACM (JACM), 51(4):557–594.

Chen, J., Lim, H., Ling, S., Wang, H., and Wee, H. (2012).

Shorter ibe and signatures via asymmetric pairings. In

Pairing, volume 7708 of LNCS, pages 122–140.

Chen, Y., Zhang, J., Lin, D., and Zhang, Z. (2014). Generic

constructions of integrated pke and peks. Designs,

Codes and Cryptography, pages 1–34.

Crescenzo, G. D. and Saraswat, V. (2007). Public key en-

cryption with searchable keywords based on jacobi

symbols. In IndoCrypt, volume 4859 of LNCS, pages

282–296.

Dodis, Y. and Katz, J. (2005). Chosen-ciphertext security of

multiple encryption. In TCC, volume 3378 of LNCS,

pages 188–209.

Fuhr, T. and Paillier, P. (2007). Decryptable searchable en-

cryption. In ProvSec, pages 228–236.

Ibraimi, L., Nikova, S., Hartel, P., and Jonker, W. (2011).

Public-key encryption with delegated search. In

ACNS, pages 532–549.

Kurosawa, K. (2002). Multi-recipient public-key encryp-

tion with shortened ciphertext. In PKC, pages 48–63.

Lu, W., Swaminathan, A., Varna, A. L., and Wu, M.

(2009). Enabling search over encrypted multimedia

databases. In IS&T/SPIE Electronic Imaging, pages

725418–725418. International Society for Optics and

Photonics.

Okamoto, T. and Takashima, K. (2010). Fully secure func-

tional encryption with general relations from the deci-

sional linear assumption. In CRYPTO, volume 6223

of LNCS, pages 191–208.

Shmueli, E., Vaisenberg, R., Elovici, Y., and Glezer, C.

(2010). Database encryption: an overview of con-

temporary challenges and design considerations. ACM

SIGMOD Record, 38(3):29–34.

Zhang, R. and Imai, H. (2007). Generic combination of

public key encryption with keyword search and pub-

lic key encryption. In CANS, volume 4856 of LNCS,

pages 159–174.

PracticalandSecureIntegratedPKE+PEKSwithKeywordPrivacy

453