![](bg6.png)
and terminates, and if it is 1, executes Trapdoor,
FrontTest and BackTest algorithms and outputs 0 or
1.
Challenge: Algorithm A generates a pair of two key-
words w
0
and w
1
and sends them to the algorithm B
with a public key pk
∗
. Algorithm B generates the
challenge ciphertext C
∗
and returns it to A as follows.
1. If the public key pk
∗
is not in the list of O
KG
, then
returns ⊥. If it is in the list, picks the correspond-
ing secret key x
∗
.
2. Takes the coin
∗
corresponding to the given pub-
lic key, and if coin
∗
= 1, outputs failure and ter-
minates, and if coin
∗
= 0, picks b ∈ {0,1} and
compute the challenge ciphertext C
∗
= (c
∗
1
,c
∗
2
) =
(g
γ
,H(w
b
) · v
x
∗
)
Test Query 2: Algorithm B works in the same way
as Test Query 1. However, if the input is w
0
or w
1
,
returns ⊥.
Output: A outputs a guess b
0
∈ {0, 1} that indicates
whether the challenge ciphertext C
∗
is Enc(P, pk
∗
,w
0
)
or Enc(P, pk
∗
,w
1
). Algorithm B outputs 1 if b
0
is the
same as b picked in Challenge (i.e., v = e(g,g)
αβγ
).
Otherwise, B outputs 0 (i.e., v is a random value).
In this simulation challenge, if coin
∗
= 0, v =
e(g,g)
αβγ
and w
0
= w
b
for the challenge ciphertext
generated by Algorithm B, it is a correct ciphertext
for A, since the test algorithm holds as follows.
T = (t
1
,t
2
) = (g
r
,e(h, pk
∗
)
r
· H(w
0
)
−1
)
C
IT S
= c
∗
2
·t
2
= e(h, pk
∗
)
γ+r
e(h
−αx
∗
,c
∗
1
·t
1
) = C
IT S
A can output the correct b
0
with a probability of
ε. Therefore, if b = b
0
holds, B can distinguish v =
e(g,g)
αβγ
with ε. On the other hand, if v is a ran-
dom value, A can only distinguish the correct b
0
that
is equal to b with probability 1/2.
Next, we consider that B can distinguish v =
e(g,g)
αβγ
with a probability of at least ε
0
. We analyze
the probability that B does not terminate the simula-
tion. We define the following three events.
- E
1
: B does not terminate in Update KeyGen Query
- E
2
: B does not terminate in Test Query
- E
3
: B does not terminate in Challenge
The probability of the occurrence of E
1
is (1 − δ)
q
rk
.
The probability of the occurrence of E
2
is (1 − δ)
q
te
.
The probability of the occurrence of E
3
is δ. There-
fore, we can compute (1 − δ)
q
rk
+q
te
δ as the probabil-
ity that B does not terminate the simulation . Since
the probability is 1/e(q
rk
+q
te
+1) when we optimize
to a maximum, B solves the DBDH problem with a
probability of at least ε/e(q
rk
+ q
te
+ 1).
Theorem 2. Dual-server scheme is indistinguishable
against KGA assuming DBDH is intractable.
Enc and Trapdoor in dual-server scheme are
equivalent, and the security models of IND-KGA and
IND-CKA are the same except that B returns a trap-
door instead of a ciphertext in Challenge. Therefore,
the proof of Theorem 2 is the same as the proof of
Theorem 1, and we omit the details of the proof.
5 CONCLUSION
In this paper, we have proposed two Exposure Re-
silient Public-Key Encryption with Keyword Search
against KGA. Both schemes (i.e., single-server and
dual-server schemes) guarantee security against KGA
by slightly modifying the test algorithm so that it can-
not be executed without the server’s secret key. Fur-
thermore, the damage of key exposure is minimized
by periodically updating the key. The second scheme
even tolerates corruption of a server, which is realized
by dividing the power of a single server into front and
back servers. To construct a scheme with less compu-
tational cost will be our challenging future work.
REFERENCES
Ateniese, G., Fu, K., Green, M., and Hohenberger, S.
(2006). Improved proxy re-encryption schemes with
applications to secure distributed storage. In ACM
Transactions on Information and System Security, Vol.
9, No. 1, pages pp. 1–30.
Blaze, M., Bleumer, G., and Strauss, M. (1998). Divert-
ible protocols and atomic proxy cryptography. In
Advances in Cryptology, EUROCRYPT’98, pages pp.
127–144.
Boneh, D., Crescenzo, G. D., Ostrovsky, R., and Per-
siano, G. (2004). Public key encryption with keyword
search. In Advances in Cryptology, EUROCRYPT
2004, pages pp. 506–522.
Chen, R., Mu, Y., Yang, G., Guo, F., and Wang, X. (2015).
A new general framework for secure public key en-
cryption with keyword search. In Information Security
and Privacy, Vol. 9144, pages pp 59–76.
Chen, R., Mu, Y., Yang, G., Guo, F., and Wang, X.
(2016). Dual-server public-key encryption with key-
word search for secure cloud storage. In IEEE Transa-
cions on Information Forensics and Security, Vol. 11,
No. 4, pages pp. 789–798.
Matsuzaki, N., Anada, H., and Watanabe, Y. (2017). Key-
updatable public-key encryption with keyword search
: The case of public-key update model. In Computer
Security Symposium 2017.
Wang, H. and Cao, Z. (2009). A fully secure unidirectional
and multi-use proxy re-encryption scheme. Master’s
thesis, Department of Computer Science and Engi-
neering, Shanghai Jiao Tong University.
Exposure Resilient Public-key Encryption with Keyword Search against Keyword Guessing Attack
697