2
$\begingroup$

I've found the following encryption scheme

UserA: $$sk_A, pk_A = sk_A \cdot G$$

UserB: $$sk_B, pk_B = sk_B \cdot G$$

Enc: UserA

$$u \in \mathbb{Z}_q^* \\ Y = u \cdot pk_B \\ S = H(U) \oplus m \\ C = (S, Y)$$

Dec: UserB

$$Y \cdot sk_B^{-1} = u \cdot pk_B \cdot sk_B^{-1} = u \cdot sk_B \cdot G \cdot sk_B^{-1} = u \cdot G = U \\ m = H(U) \oplus S$$

Who proposed this encryption method? I saw the application of this encryption in the paper "Blockchain-Based Lightweight Message Authentication for Edge-Assisted Cross-Domain Industrial Internet of Things", but couldn't find the source. I would like to know the cryptanalysis of this encryption scheme.

$\endgroup$
4
  • $\begingroup$ It is a standard random ephemeral fresh key hiding with DLog, then, the key hashed to xor the message. Quite secure for short messages as long as DLog is hard and the random source is good. See a similar and better in ECIES, however, you did not linked the paper... $\endgroup$
    – kelalaka
    Nov 27, 2023 at 8:55
  • $\begingroup$ Thank you very much for your answer, Sir. Do you have a paper recommendation similar to this scheme, I can't find this encryption scheme based on the DLog hard problem, most of them are based on CDH hard problem. I'd love to learn about cryptanalysis and security reduction for this type of encryption scheme.I searched ECIES, but it contains Key derivation、symmetric encryption, which is still a bit different from the scheme. Therefore, ECIES’s security reduction should be very different from the encryption scheme in the question. $\endgroup$ Nov 27, 2023 at 14:04
  • $\begingroup$ Just remove the encryption part from ECIES, you are almost there... $\endgroup$
    – kelalaka
    Nov 27, 2023 at 14:24
  • $\begingroup$ $u$ should be random in $\mathbb Z_q^*$, sometime written $\in_R\mathbb Z_q^*$. That very classic asymmetric cipher follows simply from Diffie-Hellman key exchange and hashing. It's also a (rather, improved) variation of ElGamal encryption, thus I guess it was known by 1985, but I don't know who proposed it, when and for what kind of groups. Notice that it's not CCA2-secure. $\endgroup$
    – fgrieu
    Nov 27, 2023 at 16:57

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.