CCA-secure revocable identity-based encryption schemes with decryption key exposure resistance (Q1626131)

Summary: Key revocation functionality is important for identity-based encryption (IBE) to manage users dynamically. Revocable IBE (RIBE) realises such revocation functionality with scalability. In PKC 2013, \textit{J. H. Seo} and \textit{K. Emura} [Lect. Notes Comput. Sci. 7778, 216--234 (2013; Zbl 1314.94092) first considered decryption key exposure resistance (DKER) as a new realistic threat, and proposed the first RIBE scheme with DKER. Their RIBE scheme is adaptively secure against chosen plaintext attacks (CPA), and there is no concrete RIBE scheme adaptively secure against chosen ciphertext attacks (CCA) even without DKER so far. In this paper, we first propose three constructions of adaptively CCA-secure RIBE schemes with DKER. The first and second schemes are based on an existing transformation, which is called a BCHK transformation, that a CPA-secure hierarchical IBE scheme can be transformed into a CCA-secure scheme. The third scheme is constructed via the KEM/DEM framework. Specifically, we newly propose a revocable identity-based key encapsulation mechanism (RIB-KEM), and we show a generic construction of a CCA-secure RIBE scheme from the RIB-KEM and a data encapsulation mechanism (DEM). The third scheme is more efficient than the first and second ones in terms of the ciphertext size.