[Paper Review] A Restrained Paillier Cryptosystem and Its Applications for Access Control of Common Secret

Xiaojuan Dong, Weiming Zhang+3 more|arXiv (Cornell University)|Dec 19, 2019

Cryptography and Data Security15 references4 citations

TL;DR

This paper proposes a Restrained-Paillier cryptosystem that restricts the decryption power of the strong private key in modified Paillier schemes by introducing mixed ciphertexts through additive and multiplicative homomorphism. The strong key can decrypt the mixed ciphertext to reveal the multiplicative ciphertext but cannot recover the plaintext, enabling secure access control for shared secrets and key management protocols with provable security and low computational overhead.

ABSTRACT

The modified Paillier cryptosystem has become extremely popular and applied in many fields, owning to its additive homomorphism. This cryptosystem provides weak private keys and a strong private key. A weak private key only can decrypt ciphertexts under the corresponding public key. The strong private key can decrypt all ciphertexts even under different public keys. When the modified Paillier cryptosystem is applied in a system, the member, often the system administrator, has the strong private key and can decrypt all ciphertexts. If this system administrator is attacked or compromised, the security of the application system absolutely break down. Thus, it is important to stop the decryption of the strong private key. To address this issue, we propose an restrained version of the modified Paillier cryptosystem (Restrained-Paillier), by endowing the multiplicative homomorphism. We perform the additive encryption on the multiplicative ciphertext and generate the mixed ciphertext, which can not be decrypted by the strong private key. Based on this Restrained-Paillier, we develop two applications. Firstly, we realize access control of common secret of two owners. In our scheme, only one owner cannot access secret. Secondly, we present three protocols for identity distribution and key management, identity authentication and private key recovery. Security analysis shows that the Restrained-Paillier cryptosystem can resist the chosen plaintext attack. The experimental results illustrate the utility and efficiency of the proposed protocols.

Motivation & Objective

• To address the critical security risk posed by the exposure of the strong private key in modified Paillier cryptosystems, which can compromise all encrypted data.
• To prevent the system administrator (holding the strong key) from decrypting plaintexts even if compromised, by restricting the key's decryption capability to only multiplicative ciphertexts.
• To design a cryptosystem that supports both additive and multiplicative homomorphism while ensuring that only weak keys can decrypt plaintexts.
• To develop practical protocols for identity distribution, key management, authentication, and private key recovery based on the new cryptosystem.
• To evaluate the efficiency and security of the proposed protocols in terms of computation and communication overhead.

Proposed method

• The Restrained-Paillier cryptosystem combines additive and multiplicative homomorphism by first encrypting a message multiplicatively and then applying additive encryption to the result, forming a mixed ciphertext.
• The strong private key λ can decrypt the mixed ciphertext to recover the multiplicative ciphertext but cannot decrypt the multiplicative ciphertext to obtain the plaintext.
• The plaintext is only recoverable via the corresponding weak private key θ associated with the multiplicative ciphertext.
• The system uses a modified Paillier setup in the group of quadratic residues modulo N², with a carefully chosen generator g derived from a random a ∈ Zₙ* satisfying a mod N ≠ 1.
• The key generation process ensures that λ is split into shares, but the core mechanism relies on the structural limitation of λ’s decryption scope to mixed ciphertexts.
• Protocols for access control of common secrets, identity distribution, key management, authentication, and private key recovery are built on the homomorphic properties and access restrictions of the mixed ciphertexts.

Experimental results

Research questions

• RQ1 Can the decryption power of the strong private key in the modified Paillier cryptosystem be effectively restricted to prevent full data exposure if compromised?
• RQ2 Can a hybrid ciphertext format be constructed using additive and multiplicative homomorphism such that only weak keys can decrypt the plaintext?
• RQ3 Can secure and efficient protocols for identity management and access control be built on the restricted decryption model?
• RQ4 What is the computational and communication overhead of the proposed protocols compared to standard Paillier-based schemes?
• RQ5 Does the Restrained-Paillier cryptosystem remain secure against chosen-plaintext attacks under the proposed constraints?

Key findings

• The Restrained-Paillier cryptosystem successfully prevents the strong private key λ from decrypting plaintexts, even when it can decrypt mixed ciphertexts to obtain multiplicative ciphertexts.
• The access control protocol for common secrets ensures that only both owners together can recover the secret, as neither alone can access it.
• The identity distribution and key management protocol (IdDis & KeyMan) has a computational cost of 34.172ms for 512-bit N, increasing to 130.623ms for 2048-bit N.
• The private key recovery protocol (PrivKeyRec) is significantly more efficient, with a cost of 0.296ms for 512-bit N and 4.324ms for 2048-bit N.
• The identity authentication protocol (IdAuth) has a communication cost of 1534.70 bytes for 2048-bit N, with a computation time of 190.095ms on the requester side.
• The communication overhead of the ACCS protocol is the highest among the four protocols, while PrivKeyRec has the lowest, indicating a trade-off between functionality and bandwidth.