A construction of encryption protocols over some semidirect products

Shuji Isobe; Eisuke Koizumi

doi:10.1515/jmc-2022-0018

Article Open Access

A construction of encryption protocols over some semidirect products

Shuji Isobe and Eisuke Koizumi

Published/Copyright: March 21, 2023

Published by

Become an author with De Gruyter Brill

Submit Manuscript Author Information

From the journal Journal of Mathematical Cryptology Volume 17 Issue 1

Abstract

In CANDARW ’18, Isobe et al. proposed a secure encryption protocol on non-abelian groups based on the Anshel–Anshel–Goldfeld key exchange protocol. There have remained two weak points on the protocol: one is that the protocol is indistinguishable against adaptive chosen ciphertext attack (IND-CCA) in a slightly restricted sense, what they call IND-rCCA secure, and the other is that the conditions imposed on groups and hashing schemes are too strict to make the protocol practical. In this article, we propose an IND-CCA secure protocol that resolves those problems. The key idea is to employ some specific semidirect product as platform groups, so that we can achieve the exact IND-CCA security from concise conditions on groups and hashing schemes. Our protocol is not dependent on any computational assumptions on abelian subgroups.

Keywords: encryption protocol; semidirect product; Anshel–Anshel–Goldfeld key exchange protocol; indistinguishability against adaptive chosen ciphertext attack

MSC 2010: 94A60; 68P25

1 Introduction

Non-abelian groups have attracted a lot of attention as a potential source of cryptographic primitives for resisting quantum computers. This is partly because many cryptographically hard problems on abelian groups, such as the discrete logarithms, are shown to be efficiently solved by quantum computers, so that the hardness assumptions on them are no longer able to ensure the security of the protocols. Since non-abelian groups have a vast variety of group structures compared to abelian groups, the non-abelian cryptography can be an intriguing research field for not only cryptographers but also group theorists.

Many cryptographic schemes have been proposed on non-abelian groups such as braid groups [1–3], Thompson’s groups [4], Suzuki 2-groups [5,6], and inner automorphism groups, [7,8] so far. There have been few schemes, however, that have rigorous provable security. Vasco et al. [9] proposed a theoretical framework for constructing, on non-abelian groups, an encryption protocol that is indistinguishable against adaptive chosen ciphertext attacks (IND-CCA) in the standard model. However, there have been no practical protocols instantiated from their framework so far. Gu et al. [10] and Hong et al. [11] constructed IND-CCA secure protocols in the random oracle model based on the factorization search problem. Li et al. [12] proposed the notion of index exchangeable families to construct an IND-CCA secure protocol. We note that their protocols use cyclic subgroups in essential ways, although their construction assumes non-abelian groups.

Toward establishing encryption protocols on non-abelian groups with rigorous probable security, Isobe et al. [13] proposed an encryption protocol on non-abelian groups without any computational assumption on abelian subgroups including cyclic groups. The approach is inspired by Cramer and Shoup [14]. The Cramer–Shoup protocol employs the Diffie–Hellman key exchange protocol [15] over prime-order cyclic subgroups. On the other hand, Isobe et al. [13] involved the Anshel–Anshel–Goldfeld (AAG) key exchange protocol [16], which enables us to share a secret key over insecure channels by using non-abelian groups to establish an encryption protocol on non-abelian groups with provable security. However, two weak points have been left to be resolved. One is the validity, or in other words, practicality, of the conditions imposed on groups and hashing schemes. In fact, the conditions are so strict that we have not succeeded in finding groups and hashing schemes that satisfy them yet. The other is the security of the protocol. They proved that the protocol is “IND-rCCA (IND-restricted CCA)” secure, which is weaker than the standard IND-CCA security because, during his attack, the adversary is allowed to query only elements in some specified subset of strings to his oracles.

In this article, we propose a new enhanced protocol that resolves the aforementioned problems. The main framework remains the same, that is, the protocol is based on the Cramer–Shoup’s approach and the AAG key exchange protocol. The key idea is to employ some specific semidirect products as platform groups. This choice of the platform groups enables us to make an exact analysis of the security of the protocol and then to eliminate perplexing conditions on groups and hashing schemes. As a result, our scheme is proved to be IND-CCA secure in the standard model using only reasonable computational assumptions. Explicitly, our computational assumptions are a collision resistant condition on the hash functions, the hardness assumption of a factorization search problem on non-abelian groups and the hardness assumption of a variant of the conjugacy decision problem.

This article is organized as follows: in Section 2, we give definitions of semidirect products and words. Our protocol and the main theorem are stated in Section 3. We prove the main theorem in Section 4 and compare our protocol with several protocols in Section 5. Some properties of semidirect products are widely used to construct our protocol and prove the main theorem. They are proved in Appendix A.

2 Preliminaries

Let N denote the set of positive integers. For N ∈ N , Z N and Z N × denote the residue ring Z / N Z and its group of units, respectively. Z N is regarded as the set { 0 , 1 , … , N − 1 } .

For a finite set V , # V is the number of elements in V . For a probabilistic distribution D over V , we write a ← D V (or a ← D if V is well understood) to denote that a is chosen from V according to the distribution D . In particular, U denotes the uniform distribution on the specified set, and a ← U V denotes the uniform choice of a from V . For any algorithm A , A ( a ) → b or b ← A ( a ) denotes that A outputs b on input a . If A is probabilistic, then A ( a ) is a probabilistic variables on the input a , where the probability is taken over the random tape of A .

For a non-negative real-valued function f : N → R , f is negligible if for any positive real number c > 0 , there exists a number k 0 ∈ N such that f ( k ) < k − c holds for all k ≥ k 0 . A probability function p ( k ) is overwhelming if there exists a negligible function ν ( k ) , together with a number k 0 ∈ N , such that p ( k ) ≥ 1 − ν ( k ) holds for all k ≥ k 0 .

2.1 Semidirect product

For a group G , ord ( G ) denotes the order of G . The symbol e is used for the identity element of groups. Let G 1 and G 2 be two subgroups of a group G . The group G is called a semidirect product of G 1 by G 2 if the following three conditions hold:

G 1 ⊲ G ,
G 1 ∩ G 2 = { e } , and
G = G 1 G 2 , that is, any element h ∈ G can be written in the form h = h 1 h 2 for some h 1 ∈ G 1 and h 2 ∈ G 2 .

We write G = G 1 ⋊ G 2 when G is a semidirect product of G 1 by G 2 .

As platform groups of our encryption protocol, we use a “semidirect product of a semidirect product,” that is, a group G of the form G = ( G 1 ⋊ G 2 ) ⋊ G 3 for some subgroups G 1 , G 2 , and G 3 . In particular, we exclusively consider the case where ord ( G 1 ) = p 1 and ord ( G 2 ) = ord ( G 3 ) = p 2 for some distinct primes p 1 and p 2 . Let g i be a generator of G i for each i = 1 , 2 , 3 , and we write G = ( ⟨ g 1 ⟩ ⋊ ⟨ g 2 ⟩ ) ⋊ ⟨ g 3 ⟩ . The group G has the following properties (S1)–(S3):

⟨ g 1 ⟩ ⊲ ⟨ g 1 ⟩ ⋊ ⟨ g 2 ⟩ and ⟨ g 1 ⟩ ⋊ ⟨ g 2 ⟩ ⊲ G ;
⟨ g 1 ⟩ ∩ ⟨ g 2 ⟩ = { e } and ( ⟨ g 1 ⟩ ⋊ ⟨ g 2 ⟩ ) ∩ ⟨ g 3 ⟩ = { e } ; and
⟨ g 1 ⟩ ⋊ ⟨ g 2 ⟩ = ⟨ g 1 ⟩ ⟨ g 2 ⟩ and G = ⟨ g 1 ⟩ ⟨ g 2 ⟩ ⟨ g 3 ⟩ .

The following proposition exhibits the structure of the semidirect product G . We prove the proposition in Appendix A.1.

Proposition 2.1

There exist α , β ∈ Z p 1 × , and γ ∈ Z p 1 such that

(2.1) α p 2 = β p 2 = 1 ( mod p 1 ) , and

(2.2) g 2 g 1 g 2 − 1 = g 1 α , g 3 g 1 g 3 − 1 = g 1 β , g 3 g 2 g 3 − 1 = g 1 γ g 2 .

Equation (2.1) implies that the orders of α and β in Z p 1 × are either 1 or p 2 . Hence, unless p 2 ∣ p 1 − 1 , we must have α = β = 1 because they cannot have order p 2 in Z p 1 × , and therefore, g 1 g 2 = g 2 g 1 and g 1 g 3 = g 3 g 1 by equation (2.2). In this article, we assume that p 2 ∣ p 1 − 1 and that α ≠ 1 , β ≠ 1 , and γ ≠ 0 . This implies that the generators g 1 , g 2 , and g 3 do not mutually commute.

2.2 Word

Let T = { t 1 , … , t n } be a set of n elements, called a set of formal letters. We consider new formal letters t 1 − 1 , … , t n − 1 and define the set of inverse letters by T − 1 = { t 1 − 1 , … , t n − 1 } , which is assumed to be disjoint from T . We define ( t i − 1 ) − 1 = t i for each letter t i . A finite (possibly empty) sequence w = t i 1 ε 1 ⋯ t i l ε l , where t i j ∈ T and ε j ∈ { 1 , − 1 } , is called a word in T . We often write w ( T ) to denote that w is a word in T . The empty sequence is called the empty word. For any words w 1 and w 2 , [ w 1 , w 2 ] = w 1 w 2 w 1 − 1 w 2 − 1 denotes the commutator of them.

Let G be a group, and let S = ( s 1 , … , s n ) ∈ G n . For a word w in a set T = { t 1 , … , t n } of formal letters, we substitute t i = s i and t i − 1 = s i − 1 into w for each i = 1 , … , n , where s i − 1 denotes the inverse of s i in G , to produce an element, denoted by w ( S ) , of G . When w is the empty word, we set w ( S ) = e . We define g S g − 1 = ( g s 1 g − 1 , … , g s n g − 1 ) for any g ∈ G . The following proposition is easily obtained by direct calculation.

Proposition 2.2

Let G be a group, and let S = ( s 1 , … , s n ) ∈ G n . Then, w ( g S g − 1 ) = g w ( S ) g − 1 holds for any g ∈ G and any word w in T .

In this article, we use two “two-letter sets” T = { t 2 , t 3 } and T ¯ = { t ¯ 2 , t ¯ 3 } and consider only words of the form w ( T ) = [ t 2 , t 3 ] n 1 t 2 n 2 t 3 n 3 and w ( T ¯ ) = [ t ¯ 2 , t ¯ 3 ] n 1 t ¯ 2 n 2 t ¯ 3 n 3 for some n 1 ∈ Z p 1 and n 2 , n 3 ∈ Z p 2 , where p 1 and p 2 are distinct primes.

3 Statement of the result

3.1 Group generation and hashing scheme

We first define a group generation algorithm GGen . It is a probabilistic polynomial-time (PPT) algorithm. Let k denote the security parameter. On input 1 k , the juxtaposition of k copies of the letter 1, GGen outputs a tuple G = ( G , p 1 , p 2 , g 1 , g 2 , g 3 , a 2 , a 3 , b 2 , b 3 ) , where

p 1 = Ω ( 2 k ) and p 2 = Ω ( 2 k ) are distinct primes with p 2 ∣ p 1 − 1 ;
G = ( ⟨ g 1 ⟩ ⋊ ⟨ g 2 ⟩ ) ⋊ ⟨ g 3 ⟩ is a semidirect product generated by g 1 , g 2 , and g 3 with ord ( g 1 ) = p 1 and ord ( g 2 ) = ord ( g 3 ) = p 2 ;
there exist α , β ∈ Z p 1 × , and γ ∈ Z p 1 such that
(3.1) α ≠ 1 , β ≠ 1 , γ ≠ 0 ,

(3.2) α p 2 = β p 2 = 1 ( mod p 1 ) ,

(3.3) g 2 g 1 g 2 − 1 = g 1 α , g 3 g 1 g 3 − 1 = g 1 β , g 3 g 2 g 3 − 1 = g 1 γ g 2
so that g 1 , g 2 , and g 3 do not mutually commute (see Proposition 2.1), and
a 2 , a 3 , b 2 , and b 3 are uniformly and independently chosen from Z p 2 so that the following conditions are fulfilled:
(3.4) a 2 b 3 − a 3 b 2 ≠ 0 ( mod p 2 ) ,

(3.5) [ g 2 a 2 g 3 a 3 , g 2 b 2 g 3 b 3 ] ≠ e , and

(3.6) g 1 ( g 2 a 2 g 3 a 3 ) g 1 − 1 ≠ g 2 a 2 g 3 a 3 , g 1 ( g 2 b 2 g 3 b 3 ) g 1 − 1 ≠ g 2 b 2 g 3 b 3 .

Proposition 3.1 claims that there are overwhelmingly many tuples ( a 2 , a 3 , b 2 , b 3 ) in Z p 2 4 that satisfy equations (3.4)–(3.6). We prove the proposition in Appendix A.2.

Proposition 3.1

The following inequality holds:

Pr [ ( a 2 , a 3 , b 2 , b 3 ) satisfies the conditions (3.4)–(3.4) ∣ ( a 2 , a 3 , b 2 , b 3 ) ← U Z p 2 4 ] ≥ 1 − 8 p 2 .

Set G 0 = ( G , p 1 , p 2 , g 1 ) and S = ( g 2 , g 3 ) , and write G = ( G 0 , S , a 2 , a 3 , b 2 , b 3 ) for ease of writing. As a computational foundation, we should assume that any output G = ( G 0 , S , a 2 , a 3 , b 2 , b 3 ) of GGen ( 1 k ) satisfies the following conditions (I) and (II). If a string g represents an element of G , we identify the string g with the represented element of G , causing no confusion.

(I) The following three polynomial-time deterministic algorithms, Mem , Comp , and Inv , are assigned to the group G :
- – Membership: for any given string g , Mem determines whether or not g ∈ G ;
- – Composition: for any given elements g , g ′ ∈ G , Comp computes the product g g ′ ∈ G ; and
- – Inversion: for any given element g ∈ G , Inv computes the inverse g − 1 ∈ G .
(II) For any PPT algorithm A , the probability
Pr g = g 2 n 2 ′ g 3 n 3 ′ G ← GGen ( 1 k ) , ( n 2 , n 3 ) ← U Z p 2 2 , g = g 2 n 2 g 3 n 3 , ( n 2 ′ , n 3 ′ ) ← A ( 1 k , G , g )
is negligible in k .

Condition (I) is entirely a computational requirement, which means that the elementary group operations can be efficiently done and ensures that the encryption and decryption operations can be efficiently executed. Condition (II) means that the factorization search problem on the subset ⟨ g 2 ⟩ ⟨ g 3 ⟩ is infeasible.

We assign a PPT algorithm GGen † to GGen : on input 1 k , GGen † works as follows:

Execute GGen ( 1 k ) , and obtain a tuple G = ( G 0 , S , a 2 , a 3 , b 2 , b 3 ) .
Set S ¯ = ( a , b ) = ( g 2 a 2 g 3 a 3 , g 2 b 2 g 3 b 3 ) , and output a tuple G † = ( G 0 , S , S ¯ ) .

The algorithm GGen † outputs S ¯ instead of the tuple ( a 2 , a 3 , b 2 , b 3 ) . By Condition (II), it is infeasible to extract the tuple ( a 2 , a 3 , b 2 , b 3 ) from S ¯ = ( g 2 a 2 g 3 a 3 , g 2 b 2 g 3 b 3 ) .

For any k ∈ N and any output G = ( G 0 , S , a 2 , a 3 , b 2 , b 3 ) of GGen ( 1 k ) , we define

G k † = { G † ∣ Pr [ G † ← GGen † ( 1 k ) ] > 0 }

and then define

G † = ⋃ k ∈ N G k † .

We now define a hashing scheme HF associated with the family G † . It specifies the following two items:

A family KS k , G † of non-empty finite key sets indexed by k ∈ N and G † ∈ G k † . We assume that there exists a PPT algorithm, which, on input 1 k and G † , uniformly outputs an element hk of KS k , G † .
A family of hash functions HF hk k , G † : G 5 → Z p 1 indexed by k ∈ N , G † ∈ G k † and hk ∈ KS k , G † . We assume that there exists a deterministic polynomial-time algorithm, which, on input 1 k , G † ∈ G k † , hk ∈ KS k , G † , and ( h 1 , h 2 , h 3 , h 4 , h 5 ) ∈ G 5 , outputs the element HF hk k , G † ( h 1 , h 2 , h 3 , h 4 , h 5 ) ∈ Z p 1 .

We assume that HF satisfies the following target collision resistant condition (H):

For any PPT algorithm A , the function
Adv A TCR ( k ) = Pr h 5 ∗ ∈ ⟨ g 1 ⟩ ∧ ∃ ( u 2 ∗ , u 3 ∗ , u ¯ 2 ∗ , u ¯ 3 ∗ ) ∈ G 4 s.t. U ∗ = ( u 2 ∗ g 2 u 2 ∗ − 1 , u 3 ∗ g 3 u 3 ∗ − 1 ) ∧ U ¯ ∗ = ( u ¯ 2 ∗ a u ¯ 2 ∗ − 1 , u ¯ 3 ∗ b u ¯ 3 ∗ − 1 ) ∧ ( U ∗ , U ¯ ∗ , h 5 ∗ ) ≠ ( U , U ¯ , h 5 ) ∧ HF hk k , G † ( U ∗ , U ¯ ∗ , h 5 ∗ ) = HF hk k , G † ( U , U ¯ , h 5 ) G † ← GGen † ( 1 k ) , hk ← U KS k , G † , ( u 2 , u 3 , u ¯ 2 , u ¯ 3 ) ← U G 4 , h 5 ← U ⟨ g 1 ⟩ U = ( u 2 g 2 u 2 − 1 , u 3 g 3 u 3 − 1 ) , U ¯ = ( u ¯ 2 a u ¯ 2 − 1 , u ¯ 3 b u ¯ 3 − 1 ) , ( U ∗ , U ¯ ∗ , h 5 ∗ ) ← A ( 1 k , G † , hk , U , U ¯ , h 5 )
is negligible in k , where G † = ( G 0 , S , S ¯ ) with G 0 = ( G , p 1 , p 2 , g 1 ) , S = ( g 2 , g 3 ) , and S ¯ = ( a , b ) = ( g 2 a 2 g 3 a 3 , g 2 b 2 g 3 b 3 ) .

3.2 Description of our protocol

We now propose our protocol Σ = ( KGen , Enc , Dec ) .

The key generation algorithm KGen . On input 1 k , execute the following steps:

Execute GGen ( 1 k ) , and obtain a tuple G = ( G 0 , S , a 2 , a 3 , b 2 , b 3 ) , where G 0 = ( G , p 1 , p 2 , g 1 ) and S = ( g 2 , g 3 ) .
Independently and uniformly choose tuples ( x i 1 , x i 2 , x i 3 ) , ( y i 1 , y i 2 , y i 3 ) , ( z i 1 , z i 2 , z i 3 ) ∈ Z p 1 × Z p 2 2 for i = 1 , 2 , and set
w x 1 ( T ) = [ t 2 , t 3 ] x 11 t 2 x 12 t 3 x 13 , w y 1 ( T ) = [ t 2 , t 3 ] y 11 t 2 y 12 t 3 y 13 , w z 1 ( T ) = [ t 2 , t 3 ] z 11 t 2 z 12 t 3 z 13 , w x 2 ( T ¯ ) = [ t ¯ 2 , t ¯ 3 ] x 21 t ¯ 2 x 22 t ¯ 3 x 23 , w y 2 ( T ¯ ) = [ t ¯ 2 , t ¯ 3 ] y 21 t ¯ 2 y 22 t ¯ 3 y 23 , w z 2 ( T ¯ ) = [ t ¯ 2 , t ¯ 3 ] z 21 t ¯ 2 z 22 t ¯ 3 z 23 .
Compute S ¯ = ( a , b ) = ( g 2 a 2 g 3 a 3 , g 2 b 2 g 3 b 3 ) .
Compute x 1 = w x 1 ( S ) , y 1 = w y 1 ( S ) , z 1 = w z 1 ( S ) , x 2 = w x 2 ( S ¯ ) , y 2 = w y 2 ( S ¯ ) , and z 2 = w z 2 ( S ¯ ) , and set X = x 1 x 2 S x 2 − 1 x 1 − 1 , Y = y 1 y 2 S y 2 − 1 y 1 − 1 , and Z = z 1 z 2 S z 2 − 1 z 1 − 1 . Explicitly,
x 1 = [ g 2 , g 3 ] x 11 g 2 x 12 g 3 x 13 , x 2 = [ g 2 a 2 g 3 a 3 , g 2 b 2 g 3 b 3 ] x 21 ( g 2 a 2 g 3 a 3 ) x 22 ( g 2 b 2 g 3 b 3 ) x 23 , X = ( x 1 x 2 g 2 x 2 − 1 x 1 − 1 , x 1 x 2 g 3 x 2 − 1 x 1 − 1 ) ,
for instance.
Uniformly choose a key hk ∈ KS k , G † , where G † = ( G 0 , S , S ¯ ) .
Output pk = ( 1 k , G 0 , S , S ¯ , X , Y , Z , hk ) as a public key and
sk = ( x 1 , x 2 , y 1 , y 2 , z 1 , z 2 , w x 1 , w x 2 , w y 1 , w y 2 , w z 1 , w z 2 )
as a secret key.

The encryption algorithm Enc . Given a message m ∈ ⟨ g 1 ⟩ and a public key pk , execute the following steps:

Independently and uniformly choose a tuple ( r 01 , r 02 , r 03 ) ∈ Z p 1 × Z p 2 2 , and set
w r 0 ( T ) = [ t 2 , t 3 ] r 01 t 2 r 02 t 3 r 03 .
Compute r 0 = w r 0 ( S ) , and set R = r 0 S r 0 − 1 and R ¯ = r 0 S ¯ r 0 − 1 .
Compute c = m r 0 w r 0 ( Z ) − 1 .
Compute v = HF hk k , G † ( R , R ¯ , c ) , where G † = ( G 0 , S , S ¯ ) .
Compute d 1 = r 0 w r 0 ( X ) − 1 , d 2 = r 0 w r 0 ( Y ) − 1 , and d = d 1 d 2 v .
Output C = ( R , R ¯ , c , d ) as a ciphertext.

The decryption algorithm Dec . Given a ciphertext C ∗ , the public key pk , and the secret key sk , execute the following steps:

Check whether or not C ∗ satisfies the following conditions:
1. C ∗ can be parsed as a tuple C ∗ = ( R ∗ , R ¯ ∗ , c ∗ , d ∗ ) belonging to G 6 ; and
2. R ∗ = ( r g 2 ∗ , r g 3 ∗ ) = ( r 2 ∗ g 2 r 2 ∗ − 1 , r 3 ∗ g 3 r 3 ∗ − 1 ) and R ¯ ∗ = ( r ¯ a ∗ , r ¯ b ∗ ) = ( r ¯ 2 ∗ a r ¯ 2 ∗ − 1 , r ¯ 3 ∗ b r ¯ 3 ∗ − 1 ) hold for some r 2 ∗ , r 3 ∗ , r ¯ 2 ∗ , r ¯ 3 ∗ ∈ G .
If this is not the case, then output ⊥ and abort.
Compute v ∗ = HF hk k , G † ( R ∗ , R ¯ ∗ , c ∗ ) .
Compute d 1 ∗ = w x 1 ( R ∗ ) w x 2 ( R ¯ ∗ ) x 2 − 1 x 1 − 1 and d 2 ∗ = w y 1 ( R ∗ ) w y 2 ( R ¯ ∗ ) y 2 − 1 y 1 − 1 .
Check whether or not d ∗ = d 1 ∗ ( d 2 ∗ ) v ∗ holds. If this is not the case, then output ⊥ and abort.
Compute m ∗ = c ∗ z 1 z 2 w z 2 ( R ¯ ∗ ) − 1 w z 1 ( R ∗ ) − 1 , and output m ∗ .

We should make a few remarks on those algorithms. Proposition 3.2 is proved in Appendix A.3, which claims that the elements x i , y i , z i , and r 0 computed in the algorithms KGen and Enc are uniformly distributed over G .

Proposition 3.2

Let S ¯ = ( a , b ) = ( g 2 a 2 g 3 a 3 , g 2 b 2 g 3 b 3 ) be the pair computed in Step K 3 of GGen . Then, the two probabilistic distributions

{ [ g 2 , g 3 ] l 1 g 2 l 2 g 3 l 3 ∣ l 1 ← U Z p 1 , ( l 2 , l 3 ) ← U Z p 2 2 }

and

{ [ a , b ] l 1 a l 2 b l 3 ∣ l 1 ← U Z p 1 , ( l 2 , l 3 ) ← U Z p 2 2 }

are uniform over G.

For g ∈ G , let Orb ( g ) = { h g h − 1 ∣ h ∈ G } denote the conjugacy class of g . The proof of the following proposition is given in Appendix A.4.

Proposition 3.3

Assume that g 1 ( g 2 l 2 g 3 l 3 ) g 1 − 1 ≠ g 2 l 2 g 3 l 3 . Then, one has

Orb ( g 2 l 2 g 3 l 3 ) = { g 1 l 1 g 2 l 2 g 3 l 3 ∣ l 1 ∈ Z p 1 } .

In particular, g ( g 2 l 2 g 3 l 3 ) − 1 ∈ ⟨ g 1 ⟩ holds for any g ∈ Orb ( g 2 l 2 g 3 l 3 ) .

It follows from Proposition 3.3, together with condition (3.6), that one can efficiently check the condition (b) of Step D1 in the algorithm Dec by the following steps:

Compute r g 2 ∗ g 2 − 1 , r g 3 ∗ g 3 − 1 , r ¯ a ∗ a − 1 , and r ¯ b ∗ b − 1 .
Conclude that the condition (b) holds if and only if ( r g 2 ∗ g 2 − 1 ) p 1 = ( r g 3 ∗ g 3 − 1 ) p 1 = ( r ¯ a ∗ a − 1 ) p 1 = ( r ¯ b ∗ b − 1 ) p 1 = e .

In the encryption algorithm Enc , the message space is the cyclic subgroup ⟨ g 1 ⟩ , not the entire group G . We explain the reason in the last paragraph of Section 3.4.

3.3 Cryptographic assumptions

In order to demonstrate the security of our protocol, we need a cryptographic assumption called the decisional simultaneous conjugacy (SDC) assumption, which is a variant of the decisional conjugacy assumption.

For k ∈ N , we define two probabilistic distributions: one is

SDC k = { ( 1 k , G † , U , U ¯ ) ∣ G † ← GGen † ( 1 k ) , u 0 ← U G , U = u 0 S u 0 − 1 , U ¯ = u 0 S ¯ u 0 − 1 }

and the other is

SDC k ′ = ( 1 k , G † , U , U ¯ ) G † ← GGen † ( 1 k ) , ( u 2 , u 3 , u ¯ 2 , u ¯ 3 ) ← U G 4 , U = ( u 2 g 2 u 2 − 1 , u 3 g 3 u 3 − 1 ) , U ¯ = ( u ¯ 2 a u ¯ 2 − 1 , u ¯ 3 b u ¯ 3 − 1 ) ,

where G † = ( G 0 , S , S ¯ ) with G 0 = ( G , p 1 , p 2 , g 1 ) , S = ( g 2 , g 3 ) , and S ¯ = ( a , b ) = ( g 2 a 2 g 3 a 3 , g 2 b 2 g 3 b 3 ) . For any probabilistic algorithm A , we set

Adv A SDC ( k ) = ∣ Pr [ 1 ← A ( η k ) ∣ η k ← SDC k ] − Pr [ 1 ← A ( η k ) ∣ η k ← SDC k ′ ] ∣ .

We say that the SDC assumption holds for GGen if the function Adv A SDC ( k ) is negligible in k for any PPT algorithm A .

3.4 Main theorem

We state our main theorem. Let us define the security notion through a hypothetical security game for the protocol. An adaptive chosen ciphertext attack (CCA) game for an encryption protocol Σ is a hypothetical game between a probabilistic algorithm A (with oracle tape) called an adversary and a challenger C , which is described as follows.

Initialization phase: The challenger C executes KGen on input 1 k and gets a public key pk and a secret key sk . Then, C sends pk to A .

Query phase I (probing): The adversary A is allowed to interact with a decryption oracle. Whenever A sends a query C ∗ to the decryption oracle, the oracle executes Dec ( C ∗ , pk , sk ) and returns the output m ∗ to A . Note that the query C ∗ does not need to be a legitimate ciphertext. If the execution of Dec ( C ∗ , pk , sk ) aborts with no output, the oracle returns a special symbol ⊥ .

Challenge phase: The adversary A chooses two distinct messages m 0 and m 1 and sends them to C . Then, C uniformly chooses μ ∈ { 0 , 1 } and returns C = Enc ( m μ , pk ) back to A as a challenge ciphertext.

Query phase II (guessing): The adversary’s goal is to make a correct guess on the value μ that C has chosen. The adversary A can still interact with the decryption oracle, except that A is not allowed to query the challenge ciphertext C .

Guess phase: The adversary A outputs a bit μ ′ ∈ { 0 , 1 } and halts.

We define the advantage of the adversary A for Σ in indistinguishing by

Adv Σ , A CCA ( k ) = Pr [ μ ′ = μ ] − 1 2 .

The protocol Σ is said to be IND-CCA secure if Adv Σ , A CCA is negligible in k for any PPT adversary A .

We are now ready to state our main result.

Theorem

If the SDC assumption holds for GGen and the condition (H) holds for the hashing family HF , then the proposed protocol Σ is IND-CCA secure. Explicitly, for any PPT adversary A , there are PPT algorithms ℬ 1 and ℬ 2 , together with negligible functions ν 1 and ν 2 , such that

Adv Σ , A CCA ( k ) ≤ Adv ℬ 1 SDC ( k ) + 2 Adv ℬ 2 TCR ( k ) + ν 1 ( k ) + q A ( k ) ν 2 ( k ) ,

where q A is a polynomial such that A makes the oracle queries at most q A ( k ) times during the game.

It should be noted that the theorem would not hold if the message space of the proposed protocol Σ is to be the entire group G . In fact, for any message pair ( m 0 , m 1 ) with m 0 m 1 − 1 ∉ ⟨ g 1 ⟩ and any challenge C = Enc ( m μ , pk ) on them, the adversary can make the correct guess on μ by using the algorithm described just after Proposition 3.3.

4 Proof of main theorem

In this section, we give the proof of the main theorem. Consider any PPT adversary A . Let G 0 be the original CCA game for Σ between A and the challenger C , and let T 0 denote the event that μ ′ = μ holds in Game G 0 . Then, we see that

(4.1) Adv Σ , A CCA ( k ) = Pr [ T 0 ] − 1 2 .

We have to prove that this advantage Adv Σ , A CCA ( k ) is negligible in k .

Let G = ( G 0 , S , a 2 , a 3 , b 2 , b 3 ) be obtained by executing GGen ( 1 k ) at Initialization phase of the game, where G 0 = ( G , p 1 , p 2 , g 1 ) and S = ( g 2 , g 3 ) . We keep the notations used in the description of the algorithms KGen , Enc , and Dec in Section 3.2. We define a sequence G 1 , G 2 , G 2 ′ , G 2 ″ , G 3 , G 4 , G 5 of games, where each game is a slight modification of the previous one. We prove that the advantage Adv Σ , A CCA ( k ) is negligible through several lemmas on those games. In order to show the lemmas, we need several propositions, whose proofs are given in Appendix A.

Let T i denote the event that μ ′ = μ holds in Game G i .

Game G 1 . We replace Steps E3 and E5 of the encryption process in Challenge phase, that is, Steps E3 and E5 of the encryption algorithm are replaced by the following Steps E 3 ′ and E 5 ′ , respectively:

Compute c = m μ w z 1 ( R ) w z 2 ( R ¯ ) z 2 − 1 z 1 − 1 in place of computing c = m μ r 0 w r 0 ( Z ) − 1 .
Compute d 1 = w x 1 ( R ) w x 2 ( R ¯ ) x 2 − 1 x 1 − 1 , d 2 = w y 1 ( R ) w y 2 ( R ¯ ) y 2 − 1 y 1 − 1 , and d = d 1 d 2 v , in place of computing d 1 = r 0 w r 0 ( X ) − 1 , d 2 = r 0 w r 0 ( Y ) − 1 , and d = d 1 d 2 v .

Namely, in Game G 1 , the challenger C uses the secret key, in place of the public key, to encrypt the message m μ . Since the message is correctly encrypted even in this situation, we have the following lemma:

Lemma 4.1

Pr [ T 0 ] = Pr [ T 1 ] .

Proof

It suffices to show that the values c , d 1 , and d 2 computed in Game G 0 are identical to those in Game G 1 , which means that the adversary’s view is identical in both games. In both Games G 0 and G 1 , we have z 1 = w z 1 ( S ) , z 2 = w z 2 ( S ¯ ) , Z = z 1 z 2 S z 2 − 1 z 1 − 1 , and r 0 = w r 0 ( S ) . Furthermore, in both games, we have w t 0 ( T ) = [ t 2 , t 3 ] r 01 t 2 r 02 t 3 r 03 , r 0 = w r 0 ( S ) , R = r 0 S r 0 − 1 , and R ¯ = r 0 S ¯ r 0 − 1 . By Proposition 2.2, the value c for the plaintext m μ in Step E 3 ′ of Game G 1 is

m μ w z 1 ( R ) w z 2 ( R ¯ ) z 2 − 1 z 1 − 1 = m μ r 0 w z 1 ( S ) r 0 − 1 r 0 w z 2 ( S ¯ ) r 0 − 1 z 2 − 1 z 1 − 1 = m μ r 0 z 1 z 2 r 0 − 1 z 2 − 1 z 1 − 1 = m μ r 0 ( z 1 z 2 r 0 z 2 − 1 z 1 − 1 ) − 1 = m μ r 0 ( z 1 z 2 w r 0 ( S ) z 2 − 1 z 1 − 1 ) − 1 = m μ r 0 w r 0 ( Z ) − 1

and is identical to the value of c for m μ in Step E3 of Game G 0 . In a similar manner, one can observe that the values d 1 and d 2 in Step E 5 ′ of Game G 1 are w x 1 ( R ) w x 2 ( R ¯ ) x 2 − 1 x 1 − 1 = r 0 w r 0 ( X ) − 1 and w y 1 ( R ) w y 2 ( R ¯ ) y 2 − 1 y 1 − 1 = r 0 w r 0 ( Y ) − 1 , respectively, and are identical to d 1 and d 2 in Step E5 of Game G 0 . This proves the lemma.□

Game G 2 . We replace Steps E1 and E2 of the encryption process in Challenge phase in Game G 1 by the following Steps E 1 ′ and E 2 ′ , respectively:

Uniformly and independently choose elements r 2 , r 3 , r ¯ 2 , r ¯ 3 ∈ G .
Set R = ( r 2 g 2 r 2 − 1 , r 3 g 3 r 3 − 1 ) and R ¯ = ( r ¯ 2 a r ¯ 2 − 1 , r ¯ 3 b r ¯ 3 − 1 ) .

In Game G 1 , we have set R = r 0 S r 0 − 1 = ( r 0 g 2 r 0 − 1 , r 0 g 3 r 0 − 1 ) and R ¯ = r 0 S ¯ r 0 − 1 = ( r 0 a r 0 − 1 , r 0 b r 0 − 1 ) with r 0 = w r 0 ( S ) , that is, the tuple ( R , R ¯ ) is chosen according to the distribution SDC k . On the other hand, in Game G 2 , the tuple ( R , R ¯ ) is chosen according to the distribution SDC k ′ . Hence, any difference between Games G 1 and G 2 amounts to that between “ SDC k tuples” and “ SDC k ′ tuples.” More precisely, we have the following lemma:

Lemma 4.2

There exists a PPT algorithm ℬ 1 such that ∣ Pr [ T 1 ] − Pr [ T 2 ] ∣ = Adv ℬ 1 SDC ( k ) holds.

Proof

We construct an algorithm ℬ 1 by using the adversary A in a blackbox manner. Assume that G = ( G 0 , S , a 2 , a 3 , b 2 , b 3 ) is obtained by executing GGen on input 1 k , where G 0 = ( G , p 1 , p 2 , g 1 ) , and S = ( g 2 , g 3 ) . The algorithm ℬ 1 works as follows on an input tuple η k = ( 1 k , G † , U , U ¯ ) , where G † = ( G 0 , S , S ¯ ) , S ¯ = ( a , b ) = ( g 2 a 2 g 3 a 3 , g 2 b 2 g 3 b 3 ) , and either U = u 0 S u 0 − 1 and U ¯ = u 0 S ¯ u 0 − 1 with u 0 ← U G (in the case of SDC k ) or U = ( u 2 g 2 u 2 − 1 , u 3 g 3 u 3 − 1 ) and U ¯ = ( u ¯ 2 a u ¯ 2 − 1 , u ¯ 3 b u ¯ 3 − 1 ) with ( u 2 , u 3 , u ¯ 2 , u ¯ 3 ) ← U G 4 (in the case of SDC ′ ).

Execute Steps K2 and K4–K6 of KGen to obtain a public key pk and a secret key sk , where pk = ( 1 k , G 0 , S , S ¯ , X , Y , Z , hk ) , sk = ( x 1 , x 2 , y 1 , y 2 , z 1 , z 2 , w x 1 , w x 2 , w y 1 , w y 2 , w z 1 , w z 2 ) , X = x 1 x 2 S x 2 − 1 x 1 − 1 , Y = y 1 y 2 S y 2 − 1 y 1 − 1 , Z = z 1 z 2 S z 2 − 1 z 1 − 1 , and hk ∈ KS k , G † .
Simulate A on the input pk = ( 1 k , G 0 , S , S ¯ , X , Y , Z , hk ) .
When A enters Challenge phase and sends two distinct messages m 0 , m 1 ∈ ⟨ g 1 ⟩ , uniformly choose μ ∈ { 0 , 1 } and set R = U and R ¯ = U ¯ . Then, execute Steps E 3 ′ , E4, E 5 ′ , and E6 of Challenge phase in Game G 1 . Explicitly, c = m μ w z 1 ( U ) w z 2 ( U ¯ ) z 2 − 1 z 1 − 1 , v = HF hk k , G † ( U , U ¯ , c ) , d 1 = w x 1 ( U ) w x 2 ( U ¯ ) x 2 − 1 x 1 − 1 , d 2 = w y 1 ( U ) w y 2 ( U ¯ ) y 2 − 1 y 1 − 1 , d = d 1 d 2 v , and C = ( U , U ¯ , c , d ) .
Whenever A sends a query C ^ in Query phase I or II to the decryption oracle, execute Query phase I or II in Game G 1 , respectively, using the secret key sk .
When A outputs a bit μ ′ at Guess phase, if μ = μ ′ , then output 1 and halt. Otherwise, output 0 and halt.

By Proposition 3.2, the distribution of the element r 0 = w r 0 ( S ) = [ g 2 , g 3 ] r 01 g 2 r 02 g 3 r 03 computed in Step E2 of Challenge phase in Game G 1 is uniform over G . If η k is chosen according to SDC k , that is, U = u 0 S u 0 − 1 and U ¯ = u 0 S ¯ u 0 − 1 with u 0 ← U G , then the A ’s view in the challenge C = ( U , U ¯ , c , d ) is identical to that in Game G 1 and therefore Pr [ T 1 ] = Pr [ 1 ← ℬ 1 ( η k ) ∣ η k ← SDC k ] . On the other hand, if η k is chosen according to SDC ′ , then the A ’s view in the challenge C = ( U , U ¯ , c , d ) is identical to that in Game G 2 , and therefore Pr [ T 2 ] = Pr [ 1 ← ℬ 1 ( η k ) ∣ η k ← SDC k ′ ] . Hence, ∣ Pr [ T 1 ] − Pr [ T 2 ] ∣ = Adv ℬ 1 SDC ( k ) , and the lemma follows.□

Game G 2 ′ . We replace Step E 1 ′ of Challenge phase in Game G 2 by the following Step E 1 ″ :

Uniformly and independently choose elements r 21 , r 31 , r ¯ 21 , r ¯ 31 ∈ Z p 1 , and compute r 2 = g 1 r 21 , r 3 = g 1 r 31 , r ¯ 2 = g 1 r ¯ 21 , and r ¯ 3 = g 1 r ¯ 31 .

In this game, the challenger C chooses elements r 2 , r 3 , r ¯ 2 , and r ¯ 3 from the subgroup ⟨ g 1 ⟩ instead of the whole group G .

Lemma 4.3

Pr [ T 2 ] = Pr [ T 2 ′ ] .

Lemma 4.3 immediately follows from Proposition 4.4.

Proposition 4.4

Let l 2 , l 3 ∈ Z p 2 be such that g 1 ( g 2 l 2 g 3 l 3 ) g 1 − 1 ≠ g 2 l 2 g 3 l 3 . Then,

D 0 = { g ( g 2 l 2 g 3 l 3 ) g − 1 ∣ g ← U G }

and

D 1 = { g 1 n 1 ( g 2 l 2 g 3 l 3 ) g 1 − n 1 ∣ n 1 ← U Z p 1 }

are the same distributions over G.

The proof of the proposition is given in Appendix A.5.

It follows from equations (3.3) and (3.6) that g 2 , g 3 , a , and b satisfy the assumption of the proposition. Hence, Proposition 4.4 means that the distribution of ( R , R ¯ ) computed in Step E 2 ′ of Game G 2 is the same as that of Game G 2 ′ . This shows Lemma 4.3.

Game G 2 ″ . We replace Step E 1 ″ of Challenge phase in Game G 2 ′ by the following Step E 1 ‴ :

Uniformly and independently choose elements r 21 , r 31 , r ¯ 21 , r ¯ 31 ∈ Z p 1 such that the following equation “does not” hold:
(4.2) [ [ g 1 r ¯ 21 , a ] ( g 1 − r 21 g 2 a 2 g 1 r 21 ) ( g 1 − r 31 g 3 a 3 g 1 r 31 ) a − 1 , b ] = [ [ g 1 r ¯ 31 , b ] ( g 1 − r 21 g 2 b 2 g 1 r 21 ) ( g 1 − r 31 g 3 b 3 g 1 r 31 ) b − 1 , a ] .
Then, compute r 2 = g 1 r 21 , r 3 = g 1 r 31 , r ¯ 2 = g 1 r ¯ 21 , and r ¯ 3 = g 1 r ¯ 31 .

The following proposition implies that condition (4.2) fails with overwhelming probability, which means that Step E 1 ‴ can be correctly done with overwhelming probability.

Proposition 4.5

Equation (4.2) is equivalent to the following equation:

(4.3) ( 1 − α b 2 β b 3 ) { r ¯ 21 ( 1 − α a 2 β a 3 ) − r 21 ( 1 − α a 2 ) − r 31 α a 2 ( 1 − β a 3 ) } = ( 1 − α a 2 β a 3 ) { r ¯ 31 ( 1 − α b 2 β b 3 ) − r 21 ( 1 − α b 2 ) − r 31 α b 2 ( 1 − β b 3 ) } .

Furthermore, the following equation holds:

Pr [ ( r 21 , r 31 , r ¯ 21 , r ¯ 31 ) satisfies t h e E q . ( 4.3 ) ∣ ( r 21 , r 31 , r ¯ 21 , r ¯ 31 ) ← U Z p 1 4 ] = 1 p 1 .

The proof is given in Appendix A.6.

Since Games G 2 ′ and G 2 ″ differ only in the choice of the exponents r 21 , r 31 , r ¯ 21 , r ¯ 31 ∈ Z p 1 , the difference ∣ Pr [ T 2 ′ ] − Pr [ T 2 ″ ] ∣ is at most the statistical difference between the uniform distributions over Z p 1 4 and D 2 ″ , where

D 2 ″ = { r = ( r 21 , r 31 , r ¯ 21 , r ¯ 31 ) ∈ Z p 1 4 ∣ r satisfies the condition of Step E 1 ‴ } = { r = ( r 21 , r 31 , r ¯ 21 , r ¯ 31 ) ∈ Z p 1 4 ∣ r DOES NOT satisfy equation (1.3) } .

Using Proposition 4.5, we see that # D 2 ″ = p 1 4 ( 1 − 1 / p 1 ) = p 1 4 − p 1 3 . Hence, the statistical distance between the uniform distributions over Z p 1 4 and over D 2 ″ is

( p 1 4 − p 1 3 ) 2 1 p 1 4 − 1 p 1 4 − p 1 3 + p 1 3 2 1 p 1 4 − 0 = 1 p 1 ,

and this is negligible in k . Hence, we have the following lemma:

Lemma 4.6

∣ Pr [ T 2 ′ ] − Pr [ T 2 ″ ] ∣ < ν 1 ( k ) for some negligible function ν 1 in k .

Game G 3 . We replace Steps D3, D4, and D5 of the decryption algorithm in Query phases I and II of Game G 2 ″ by the following Steps D 3 ′ , D 4 ′ , and D 5 ′ , respectively:

Compute
R ¯ † = ( w a ( R ∗ ) , w b ( R ∗ ) ) , d 1 † = w x 1 ( R ∗ ) w x 2 ( R ¯ † ) x 2 − 1 x 1 − 1 and d 2 † = w y 1 ( R ∗ ) w y 2 ( R ¯ † ) y 2 − 1 y 1 − 1 .
Check if both equations R ¯ ∗ = R ¯ † and d ∗ = d 1 † ( d 2 † ) v ∗ hold. If this is not the case, then output ⊥ and abort.
Compute m ∗ = c ∗ z 1 z 2 w z 2 ( R ¯ † ) − 1 w z 1 ( R ∗ ) − 1 , and output m ∗ .

For Game G i , let F i be the event that, within the duration of the game, A sends at least one query C ∗ that satisfies the condition of Step D4 but does not satisfy that of Step D 4 ′ .

Lemma 4.7

∣ Pr [ T 2 ″ ] − Pr [ T 3 ] ∣ ≤ Pr [ F 3 ] .

Proof

We note that the adversary’s view is identical in Games G 2 ″ and G 3 as long as the event F 3 does not arise. This implies that the events T 2 ″ ∧ ¬ F 3 and T 3 ∧ ¬ F 3 are identical. So we have

∣ Pr [ T 2 ″ ] − Pr [ T 3 ] ∣ = ∣ ( Pr [ T 2 ″ ∧ F 3 ] + Pr [ T 2 ″ ∧ ¬ F 3 ] ) − ( Pr [ T 3 ∧ F 3 ] + Pr [ T 3 ∧ ¬ F 3 ] ) ∣ = ∣ Pr [ T 2 ″ ∧ F 3 ] − Pr [ T 3 ∧ F 3 ] ∣ = ∣ Pr [ T 2 ″ ∣ F 3 ] − Pr [ T 3 ∣ F 3 ] ∣ Pr [ F 3 ] ≤ Pr [ F 3 ] .

Thus, the lemma follows.□

Game G 4 . We replace Step E 3 ′ of Challenge phase in Game G 3 by the following Step E 3 ″ :

Uniformly choose an element c ∈ ⟨ g 1 ⟩ .

Note that, in Game G 4 , no information about the bit μ chosen by the challenger C is included in the challenge ciphertext C . So the output μ ′ of the adversary A is independent of the choice of μ , and we have

Pr [ T 4 ] = Pr [ μ = 0 ] Pr [ μ ′ = 0 ] + Pr [ μ = 1 ] Pr [ μ ′ = 1 ] = 1 2 ( Pr [ μ ′ = 0 ] + Pr [ μ ′ = 1 ] ) = 1 2 .

This shows the following lemma:

Lemma 4.8

Pr [ T 4 ] = 1 / 2 .

We then introduce another lemma, which means that there is no essential difference between Games G 3 and G 4 .

Lemma 4.9

Pr [ T 3 ] = Pr [ T 4 ] and Pr [ F 3 ] = Pr [ F 4 ] hold.

We now prove the lemma. The adversary A is given a tuple Z = z 1 z 2 S z 2 − 1 z 1 − 1 in Initialization phase. Hence, the behavior of A depends on the product z 0 = z 1 z 2 rather than the tuple ( z 1 , z 2 ) . On the other hand, the value c computed in Step E 3 ′ of Game G 3 varies with the choice of the tuple ( z 1 , z 2 ) even though the product z 0 = z 1 z 2 is fixed. Therefore, our goal is to show that, for any fixed z 0 = z 1 z 2 , the distribution of the value c = m μ w z 1 ( R ) w z 2 ( R ¯ ) z 2 − 1 z 1 − 1 is uniform over ⟨ g 1 ⟩ . We use the following two propositions: Let α , β ∈ Z p 1 × and γ ∈ Z p 1 be as in equations (3.1)–(3.3).

Proposition 4.10

Let ( z 01 , z 02 , z 03 ) , ( z 21 , z 22 , z 23 ) ∈ Z p 1 × Z p 2 2 be any tuples. Then, there exists the unique tuple ( z 11 , z 12 , z 13 ) ∈ Z p 1 × Z p 2 2 which satisfies the following equation:

g 1 z 01 g 2 z 02 g 3 z 03 = ( [ g 2 , g 3 ] z 11 g 2 z 12 g 3 z 13 ) ( [ a , b ] z 21 a z 22 b z 23 ) .

Explicitly, z 11 , z 12 , and z 13 are given by as follows:

(4.4) z 11 = − γ − 1 z 01 + α z 02 − a 2 z 22 − b 2 z 23 β z 03 − a 3 z 22 − b 3 z 23 Δ 2 ( a , b ; z 21 , z 22 , z 23 ) + α z 02 − a 2 z 22 − b 2 z 23 C 23 ( a 2 z 22 + b 2 z 23 , z 03 − a 3 z 22 − b 3 z 23 ) , z 12 = z 02 − a 2 z 22 − b 2 z 23 , z 13 = z 03 − a 3 z 22 − b 3 z 23 ,

where

Δ 2 ( a , b ; z 21 , z 22 , z 23 ) = z 21 { α a 2 C 23 ( b 2 , a 3 ) − α b 2 C 23 ( a 2 , b 3 ) } + A ( a 2 , a 3 ; z 22 ) + α a 2 z 22 β a 3 z 22 A ( b 2 , b 3 ; z 23 ) + α a 2 z 22 C 23 ( b 2 z 23 , a 3 z 22 ) , C 23 ( l 2 , l 3 ) = ( 1 − α l 2 ) ( 1 − β l 3 ) ( 1 − α ) ( 1 − β ) , A ( l 2 , l 3 ; n ) = 1 ( 1 − α ) ( 1 − β ) α l 2 − α l 2 n + α l 2 β l 3 ( α l 2 − 1 ) { 1 − ( α l 2 β l 3 ) n − 1 } 1 − α l 2 β l 3

for l 2 , l 3 , n ∈ Z p 2 .

Proposition 4.11

Let R = ( g 1 r 21 g 2 g 1 − r 21 , g 1 r 31 g 3 g 1 − r 31 ) and R ¯ = ( g 1 r ¯ 21 a g 1 − r ¯ 21 , g 1 r ¯ 31 b g 1 − r ¯ 31 ) , where r 21 , r 31 , r ¯ 21 , and r ¯ 31 do not satisfy equation (4.2). Then, w z 1 ( R ) w z 2 ( R ¯ ) z 2 − 1 z 1 − 1 = g 1 Δ ( z 1 , z 2 , R , R ¯ ) , where

Δ ( z 1 , z 2 , R , R ¯ ) = ( r 21 − r 31 ) ( 1 − α ) ( 1 − β ) z 11 + r 21 ( 1 − α z 12 ) + r 31 α z 12 ( 1 − β z 13 ) + α z 12 β z 13 { z 21 ( r ¯ 21 − r ¯ 31 ) ( 1 − α a 2 β a 3 ) ( 1 − α b 2 β b 3 ) + r ¯ 21 ( 1 − α a 2 z 22 β a 3 z 23 ) + r ¯ 31 α a 2 z 22 β a 3 z 23 ( 1 − α b 2 z 22 β b 3 z 23 ) } .

In particular, substituting (4.4), that is, z 1 = z 0 z 2 − 1 , into this equation, one has

Δ ( z 0 z 2 − 1 , z 2 , R , R ¯ ) = − γ − 1 z 01 ( r 21 − r 31 ) ( 1 − α ) ( 1 − β ) + r 21 ( 1 − α z 02 ) + r 31 α z 02 ( 1 − β z 03 ) + z 21 α z 02 − a 2 z 22 − b 2 z 23 β z 03 − a 3 z 22 − b 3 z 23 { F 1 ( a , b , R , R ¯ ) − F 2 ( a , b , R , R ¯ ) } + α z 02 − a 2 z 22 − b 2 z 23 β z 03 − a 3 z 22 − b 3 z 23 ( 1 − α a 2 z 22 β a 3 z 22 ) ( 1 − α a 2 β a 3 ) ( 1 − α b 2 β b 3 ) F 1 ( a , b , R , R ¯ ) + α z 02 − b 2 z 23 β z 03 − b 3 z 23 ( 1 − α b 2 z 23 β b 3 z 23 ) ( 1 − α a 2 β a 3 ) ( 1 − α b 2 β b 3 ) F 2 ( a , b , R , R ¯ ) ,

where

F 1 ( a , b , R , R ¯ ) = ( 1 − α b 2 β b 3 ) { r ¯ 21 ( 1 − α a 2 β a 3 ) − r 21 ( 1 − α a 2 ) − r 31 α a 2 ( 1 − β a 3 ) } , F 2 ( a , b , R , R ¯ ) = ( 1 − α a 2 β a 3 ) { r ¯ 31 ( 1 − α b 2 β b 3 ) − r 21 ( 1 − α b 2 ) − r 31 α b 2 ( 1 − β b 3 ) } .

The proofs of the propositions are given in Appendices A.7 and A.8, respectively.

Now, what we should show is the following statement: for any z 0 = g 1 z 01 g 2 z 02 g 3 z 03 ∈ G , the distribution

D z = m μ g 1 Δ ( z 0 z 2 − 1 , z 2 , R , R ¯ ) z 21 ← U Z p 1 , z 22 , z 23 ← U Z p 2 , w z 2 ( T ¯ ) = [ t ¯ 2 , t ¯ 3 ] z 21 t ¯ 2 z 22 , t ¯ 3 z 23 , w z 1 ( T ) = [ t 2 , t 3 ] z 11 t 2 z 12 t 3 z 13 , z 1 = w z 1 ( S ) , z 2 = w z 2 ( S ¯ )

is uniform over ⟨ g 1 ⟩ , where z 11 , z 12 , and z 13 are given as in equation (4.4) in Proposition 4.10.

We note that F 1 ( a , b , R , R ¯ ) − F 2 ( a , b , R , R ¯ ) ≠ 0 holds in Game G 3 (see equation (4.3)). For example, the coefficient of z 21 in Δ ( z 0 z 2 − 1 , z 2 , R , R ¯ ) is nonzero. This implies that, for any fixed z 22 , z 23 ∈ Z p 2 and n 0 ∈ Z p 1 , there exists the unique element z 21 ∈ Z p 1 that achieves n 0 = Δ ( z 0 z 2 − 1 , z 2 , R , R ¯ ) . Hence, we have Pr [ g 1 n 0 = g ∣ g ← D z ] = 1 / p 1 for any n 0 ∈ Z p 1 , and it follows that D z is uniform over ⟨ g 1 ⟩ . This proves Lemma 4.9.

Game G 5 . We replace Step D2 of Query phases I and II in Game G 4 by the following Step D 2 ′ :

Compute v ∗ = HF hk k , G † ( R ∗ , R ¯ ∗ , c ∗ ) . If both conditions ( R , R ¯ , c ) ≠ ( R ∗ , R ¯ ∗ , c ∗ ) and v = v ∗ hold, then output reject , and halt.

Let C 5 be the event that C outputs reject in Game G 5 . The occurrence of this event implies that the adversary A was able to find a “collision,” that is, a tuple ( R ∗ , R ¯ ∗ , c ∗ ) ( ≠ ( R ∗ , R ¯ ∗ , c ∗ ) ) , so that HF hk k , G † ( R ∗ , R ¯ ∗ , c ∗ ) = HF hk k , G † ( R , R ¯ , c ) . The probability of this event is negligible by condition (H). Thus, we have the following lemma:

Lemma 4.12

There exists a PPT algorithm ℬ 2 such that Pr [ C 5 ] ≤ 2 Adv ℬ 2 TCR ( k ) holds.

Proof

We construct an algorithm ℬ 2 . On input tuple ζ k = ( 1 k , G † , hk , U , U ¯ , h 5 ) , ℬ 2 works as follows:

(1) Execute Steps K2 and K4 of KGen , and get a public key pk and a secret key sk .
(2) Simulate A on input pk .
(3) When A enters Challenge phase and sends two messages m 0 , m 1 ∈ ⟨ g 1 ⟩ , execute the following procedure:
- (3-1) Uniformly choose μ ∈ { 0 , 1 } , and set R = U , R ¯ = U ¯ and c = h 5 .
- (3-2) Execute Steps E4–E6 in Game G 5 .
(4) Whenever A sends a query C ∗ at Query phase I or II, execute Query phase I or II in Game G 5 , respectively. If some query C 0 ∗ = ( R 0 ∗ , R ¯ 0 ∗ , c 0 ∗ , d 0 ∗ ) satisfies the two conditions of Step D 2 ′ in Game G 5 , then output ( R 0 ∗ , R ¯ 0 ∗ , c 0 ∗ ) and halt.
(5) If A outputs a bit μ ′ at Guess phase, then output μ ′ , and halt.

By the definitions of Adv ℬ 2 TCR ( k ) , we have Adv ℬ 2 TCR ( k ) = Pr [ ( R 0 ∗ , R ¯ 0 ∗ , c 0 ∗ ) ← ℬ 2 ( ζ k ) ] .

Note that the input tuple ζ k satisfies either of the following two properties: (i) F 1 ( a , b , U , U ¯ ) − F 2 ( a , b , U , U ¯ ) ≠ 0 , or (ii) F 1 ( a , b , U , U ¯ ) − F 2 ( a , b , U , U ¯ ) = 0 . In Game G 5 , the challenge C = ( R , R ¯ , c , d ) satisfies F 1 = F 1 ( a , b , R , R ¯ ) ≠ F 2 ( a , b , R , R ¯ ) = F 2 , and Pr [ r ∈ D 2 ″ ∣ r ← U Z p 1 4 ] = 1 − 1 / p 1 holds, where D 2 ″ is defined in the proof of Lemma 4.6. So we have

Adv ℬ 2 TCR ( k ) = Pr [ ( R 0 ∗ , R ¯ 0 ∗ , c 0 ∗ ) ← ℬ 2 ( ζ k ) ∣ F 1 ≠ F 2 ] Pr [ F 1 ≠ F 2 ] + Pr [ ( R 0 ∗ , R ¯ 0 ∗ , c 0 ∗ ) ← ℬ 2 ( ζ k ) ∣ F 1 = F 2 ] Pr [ F 1 = F 2 ] ≥ Pr [ C 5 ] Pr [ F 1 ≠ F 2 ] = Pr [ C 5 ] 1 − 1 p 1 ≥ 1 2 Pr [ C 5 ] .

Hence, the lemma follows.□

Games G 4 and G 5 are identical as long as the event C 5 does not occur since the value v ∗ in Step D 2 ′ is identical to that of Step D2 if C 5 does not arise. This implies that the events F 4 ∧ ¬ C 5 and F 5 ∧ ¬ C 5 are identical. By the similar argument to the proof of Lemma 4.7, we have the following lemma:

Lemma 4.13

∣ Pr [ F 4 ] − Pr [ F 5 ] ∣ ≤ Pr [ C 5 ] .

We finally show that the event F 5 occurs with only negligible probability. Note that this fact requires no computational assumption.

Lemma 4.14

Pr [ F 5 ] ≤ q A ( k ) ν 2 ( k ) for some negligible function ν 2 in k .

For 1 ≤ j ≤ q A ( k ) , let F 5 j denote the occurrence of the event F 5 for the j -th query C ∗ , which means that the j-th query C ^∗ satisfies condition of Step D4 but does not satisfy that of Step D4′. Then, we have

Pr [ F 5 ] ≤ ∑ j = 1 q A ( k ) Pr [ F 5 j ] .

So, it suffices to show that Pr [ F 5 j ] is negligible in k for each fixed j .

For the j -th query C ∗ = ( R ∗ , R ¯ ∗ , c ∗ , d ∗ ) of A , assume that C ∗ does not satisfy the conditions of Step D 4 ′ . Then, either of the following two conditions holds: (i) R ¯ ∗ ≠ R ¯ † or (ii) R ¯ ∗ = R ¯ † and d ∗ ≠ d 1 † ( d 2 † ) v ∗ . If the condition (ii) holds, then we have w x 2 ( R ¯ ∗ ) = w x 2 ( R ¯ † ) and w y 2 ( R ¯ ∗ ) = w y 2 ( R ¯ † ) , and the values d 1 ∗ and d 2 ∗ computed in Step D3 are identical to d 1 † and d 2 † computed in Step D 3 ′ , respectively. So we have d 1 ∗ ( d 2 ∗ ) v ∗ = d 1 † ( d 2 † ) v ∗ ≠ d ∗ . This implies that C ∗ does not satisfy the condition of Step D4. Hence, the event F 5 j occurs if and only if the condition (i) and that of Step D4 both hold, that is, the following conditions hold:

(4.5) R ¯ ∗ ≠ R ¯ † ,

(4.6) d ∗ = w x 1 ( R ∗ ) w x 2 ( R ¯ ∗ ) x 2 − 1 x 1 − 1 ( w y 1 ( R ∗ ) w y 2 ( R ¯ ∗ ) y 2 − 1 y 1 − 1 ) v ∗ = g 1 Δ ( x 1 , x 2 , R ∗ , R ¯ ∗ ) + v ∗ Δ ( y 1 , y 2 , R ∗ , R ¯ ∗ ) = g 1 Δ d ∗ .

Briefly speaking, our goal is to show that “the distribution of Δ d ∗ ” is uniform.

Note that R ∗ and R ¯ ∗ satisfy the condition (b) of Step D1. So, by Proposition 4.4, we can regard that R ∗ = ( g 1 r 21 ∗ g 2 g 1 − r 21 ∗ , g 1 r 31 ∗ g 3 g 1 − r 31 ∗ ) and R ¯ ∗ = ( g 1 r ¯ 21 ∗ a g 1 − r ¯ 21 ∗ , g 1 r ¯ 31 ∗ b g 1 − r ¯ 31 ∗ ) for some r 21 ∗ , r 31 ∗ , r ¯ 21 ∗ , r ¯ 31 ∗ ∈ Z p 1 . We then state the following proposition, whose proof is given in Appendix A.8:

Proposition 4.15

One has

R ¯ ∗ = ( g 1 r ¯ 21 ∗ ( 1 − α a 2 β a 3 ) a , g 1 r ¯ 31 ∗ ( 1 − α b 2 β b 3 ) b ) , R ¯ † = ( w a ( R ∗ ) , w b ( R ∗ ) ) = ( g 1 r 21 ∗ ( 1 − α a 2 ) + r 31 ∗ α a 2 ( 1 − β a 3 ) a , g 1 r 21 ∗ ( 1 − α b 2 ) + r 31 ∗ α b 2 ( 1 − β b 3 ) b ) .

This proposition implies that the inequality (4.5) is equivalent to the following condition:

(4.7) F 1 ( a , b , R ∗ , R ¯ ∗ ) ≠ 0 or F 2 ( a , b , R ∗ , R ¯ ∗ ) ≠ 0 .

(A) Let us evaluate the probability that the event F 5 occurs in Query phase I. Assume that the event F 5 occurs for the j 0 -th query C ∗ = ( R ∗ , R ¯ ∗ , c ∗ , d ∗ ) in Query phase I for any fixed 1 ≤ j 0 ≤ q A ( k ) . Let F 5 j 0 , I denote this event. In the game, the adversary A has been given the tuples X = x 1 x 2 S x 2 − 1 x 1 − 1 and Y = y 1 y 2 S y 2 − 1 y 1 − 1 in Initialization phase. Therefore, the behavior of A depends on the products x 0 = x 1 x 2 and y 0 = y 1 y 2 , not the tuples ( x 1 , x 2 ) and ( y 1 , y 2 ) . On the other hand, the elements d 1 ∗ and d 2 ∗ (and hence, d 1 ∗ ( d 2 ∗ ) v ∗ ) computed in Step D 3 ′ of Game G 5 vary with the choice of the tuples ( x 1 , x 2 ) and ( y 1 , y 2 ) even though their products x 0 = x 1 x 2 and y 0 = y 1 y 2 are fixed.

For any x 0 = g 1 x 01 g 2 x 02 g 3 x 03 and y 0 = g 1 y 01 g 2 y 02 g 3 y 03 ∈ G , we consider the following distribution:

D x 0 , y 0 = Δ d ∗ x 21 , y 21 ← U Z p 1 , x 22 , x 23 , y 22 , y 23 ← U Z p 2 , w x 2 ( T ¯ ) = [ t ¯ 2 , t ¯ 3 ] x 21 t ¯ 2 x 22 , t ¯ 3 x 23 , w y 2 ( T ¯ ) = [ t ¯ 2 , t ¯ 3 ] y 21 t ¯ 2 y 22 , t ¯ 3 y 23 , w x 1 ( T ) = [ t 2 , t 3 ] x 11 t 2 x 12 t 3 x 13 , w y 1 ( T ) = [ t 2 , t 3 ] y 11 t 2 y 12 t 3 y 13 , x 1 = w x 1 ( S ) , x 2 = w x 2 ( S ¯ ) , y 1 = w y 1 ( S ) , y 2 = w y 2 ( S ¯ ) v ∗ = HF hk k , G † ( R ∗ , R ¯ ∗ , c ∗ ) ,

where ( x 11 , x 12 , x 13 ) and ( y 11 , y 12 , y 13 ) are computed in the same way as ( z 11 , z 12 , z 13 ) in equation (4.4). Using Proposition 4.11, we have

(4.8) Δ d ∗ = − γ − 1 x 01 ( r 21 ∗ − r 31 ∗ ) ( 1 − α ) ( 1 − β ) + r 21 ∗ ( 1 − α x 02 ) + r 31 ∗ α x 02 ( 1 − β x 03 ) + x 21 α x 02 − a 2 x 22 − b 2 x 23 β x 03 − a 3 x 22 − b 3 x 23 { F 1 ( a , b , R ∗ , R ¯ ∗ ) − F 2 ( a , b , R ∗ , R ¯ ∗ ) } + α x 02 − a 2 x 22 − b 2 x 23 β x 03 − a 3 x 22 − b 3 x 23 ( 1 − α a 2 x 22 β a 3 x 22 ) ( 1 − α a 2 β a 3 ) ( 1 − α b 2 β b 3 ) F 1 ( a , b , R ∗ , R ¯ ∗ ) + α x 02 − b 2 x 23 β x 03 − b 3 x 23 ( 1 − α b 2 x 23 β b 3 x 23 ) ( 1 − α a 2 β a 3 ) ( 1 − α b 2 β b 3 ) F 2 ( a , b , R ∗ , R ¯ ∗ ) . + v ∗ { − γ − 1 y 01 ( r 21 ∗ − r 31 ∗ ) ( 1 − α ) ( 1 − β ) + r 21 ∗ ( 1 − α y 02 ) + r 31 ∗ α y 02 ( 1 − β y 03 ) } + v ∗ y 21 α y 02 − a 2 y 22 − b 2 y 23 β y 03 − a 3 y 22 − b 3 y 23 { F 1 ( a , b , R ∗ , R ¯ ∗ ) − F 2 ( a , b , R ∗ , R ¯ ∗ ) } + v ∗ α y 02 − a 2 y 22 − b 2 y 23 β y 03 − a 3 y 22 − b 3 y 23 ( 1 − α a 2 y 22 β a 3 y 22 ) ( 1 − α a 2 β a 3 ) ( 1 − α b 2 β b 3 ) F 1 ( a , b , R ∗ , R ¯ ∗ ) + v ∗ α y 02 − b 2 y 23 β y 03 − b 3 y 23 ( 1 − α b 2 y 23 β b 3 y 23 ) ( 1 − α a 2 β a 3 ) ( 1 − α b 2 β b 3 ) F 2 ( a , b , R ∗ , R ¯ ∗ ) = A d ∗ x 21 + B d ∗ y 21 + C d ∗ .

(A-1) When F 1 ( a , b , R ∗ , R ¯ ∗ ) − F 2 ( a , b , R ∗ , R ¯ ∗ ) ≠ 0 , A d ∗ is nonzero. This implies that, for any fixed x 22 , x 23 , y 22 , y 23 ∈ Z p 2 and y 21 , n 0 ∈ Z p 1 , there exists the unique x 21 ∈ Z p 1 such that n 0 = Δ d ∗ holds. In this case, we have Pr [ n 0 = Δ d ∗ ∣ Δ d ∗ ← D x 0 , y 0 ] = 1 / p 1 for any n 0 ∈ Z p 1 , and we see that Pr [ F 5 j 0 , I ] ≤ 1 / p 1 .

(A-2) When F 1 ( a , b , R ∗ , R ¯ ∗ ) = F 2 ( a , b , R ∗ , R ¯ ∗ ) ≠ 0 , we have

Δ d ∗ = − γ − 1 x 01 ( r 21 ∗ − r 31 ∗ ) ( 1 − α ) ( 1 − β ) + r 21 ∗ ( 1 − α x 02 ) + r 31 ∗ α x 02 ( 1 − β x 03 ) + v ∗ { − γ − 1 y 01 ( r 21 ∗ − r 31 ∗ ) ( 1 − α ) ( 1 − β ) + r 21 ∗ ( 1 − α y 02 ) + r 31 ∗ α y 02 ( 1 − β y 03 ) } + α x 02 − a 2 x 22 − b 2 x 23 β x 03 − a 3 x 22 − b 3 x 23 − α x 02 β x 03 ( 1 − α a 2 β a 3 ) ( 1 − α b 2 β b 3 ) F 1 ( a , b , R ∗ , R ¯ ∗ ) + v ∗ ( α y 02 − a 2 y 22 − b 2 y 23 β y 03 − a 3 y 22 − b 3 y 23 − α y 02 β y 03 ) ( 1 − α a 2 β a 3 ) ( 1 − α b 2 β b 3 ) F 1 ( a , b , R ∗ , R ¯ ∗ ) .

Note that α a 2 β a 3 ≠ 1 and that the order of α a 2 β a 3 in Z p 1 × is p 2 . Let us fix x 23 , y 22 , y 23 ∈ Z p 2 and x 21 , y 21 ∈ Z p 1 . Then, for any n 0 ∈ Z p 1 , there exists at most one value x 22 ∈ Z p 2 that achieves n 0 = Δ d ∗ . In particular, in this setting, we have # { n 0 ∈ Z p 1 ∣ ∃ x 22 s.t. n 0 = Δ d ∗ } = p 2 , and we have Pr [ n 0 = Δ d ∗ ∣ Δ d ∗ ← D x 0 , y 0 ] = 1 / p 2 or 0. Hence, we have Pr [ F 5 j 0 , I ] ≤ 1 / p 2 .

(B) We next evaluate the probability that F 5 occurs in Query phase II. In this case, the behavior of A depends on not only the products x 0 = x 1 x 2 and y 0 = y 1 y 2 but also the challenge C = ( R , R ¯ , c , d ) , the output of C in Challenge phase. Hence, for any fixed x 0 = g 1 x 01 g 2 x 02 g 3 x 03 and y 0 = g 1 y 01 g 2 y 02 g 3 y 03 ∈ G , the elements ( x 21 , x 22 , x 23 ) , ( y 21 , y 22 , y 23 ) ∈ Z p 1 × Z p 2 2 need to satisfy d = g 1 Δ ( x 1 , x 2 , R , R ¯ ) + v Δ ( y 1 , y 2 , R , R ¯ ) = g 1 Δ d . We consider the following distribution:

D x 0 , y 0 ′ = Δ d ∗ x 21 , y 21 ← U Z p 1 , x 22 , x 23 , y 22 , y 23 ← U Z p 2 s.t. ; d = g 1 Δ d , w x 2 ( T ¯ ) = [ t ¯ 2 , t ¯ 3 ] x 21 t ¯ 2 x 22 , t ¯ 3 x 23 , w y 2 ( T ¯ ) = [ t ¯ 2 , t ¯ 3 ] y 21 t ¯ 2 y 22 , t ¯ 3 y 23 , w x 1 ( T ) = [ t 2 , t 3 ] x 11 t 2 x 12 t 3 x 13 , w y 1 ( T ) = [ t 2 , t 3 ] y 11 t 2 y 12 t 3 y 13 , x 1 = w x 1 ( S ) , x 2 = w x 2 ( S ¯ ) , y 1 = w y 1 ( S ) , y 2 = w y 2 ( S ¯ ) v ∗ = HF hk k , G † ( R ∗ , R ¯ ∗ , c ∗ ) ,

where ( x 11 , x 12 , x 13 ) and ( y 11 , y 12 , y 13 ) are the same as in D x 0 , y 0 . We write Δ d = A d x 21 + B d y 21 + C d , where A d , B d , and C d are similarly defined as A d ∗ , B d ∗ , and C d ∗ in equation (4.8). We note that F 1 ( a , b , R , R ¯ ) − F 2 ( a , b , R , R ¯ ) ≠ 0 in Game G 5 . This implies that A d ≠ 0 .

Assume that the event F 5 occurs for the j 0 -th query C ∗ = ( R ∗ , R ¯ ∗ , c ∗ , d ∗ ) in Query phase II for any fixed 1 ≤ j 0 ≤ q A ( k ) . Let F 5 j 0 , II denote this event. In the case, since the event C 5 does not occur, v ≠ v ∗ holds.

(B-1) Suppose that F 1 ( a , b , R ∗ , R ¯ ∗ ) − F 2 ( a , b , R ∗ , R ¯ ∗ ) ≠ 0 . Let us fix x 22 , x 23 , y 22 , y 23 ∈ Z p 2 , and l 0 ∈ Z p 1 . We consider the following equations in x 21 and y 21 for some n 0 ∈ Z p 1 :

(4.9) l 0 = A d x 21 + B d y 21 + C d , n 0 = A d ∗ x 21 + B d ∗ y 21 + C d ∗ .

Since v ≠ v ∗ , we have A d B d ∗ − B d A d ∗ ≠ 0 . Hence, for any n 0 ∈ Z p 1 , there exist the unique solution ( x 21 , y 21 ) of equation (4.9). This implies that Pr [ n 0 = Δ d ∗ ∣ Δ d ∗ ← D x 0 , y 0 ′ ] = 1 / p 1 , and we see that Pr [ F 5 j 0 , II ] ≤ 1 / p 1 .

(B-2) Suppose that F 1 ( a , b , R ∗ , R ¯ ∗ ) = F 2 ( a , b , R ∗ , R ¯ ∗ ) ≠ 0 . Let us fix x 23 , y 22 , y 23 ∈ Z p 2 and y 21 ∈ Z p 1 . By the same argument as (A-2), the number of elements x 22 ∈ Z p 2 with n 0 = Δ d ∗ is at most one for any n 0 ∈ Z p 1 . When such x 22 exists, there also exists the unique element x 21 satisfying the first equation of (4.9) for any l 0 ∈ Z p 1 . Since # { n 0 ∈ Z p 1 ∣ ∃ x 22 s.t. n 0 = Δ d ∗ } = p 2 , we have Pr [ n 0 = Δ d ∗ ∣ Δ d ∗ ← D x 0 , y 0 ′ ] = 1 / p 2 or 0. Hence, we have Pr [ F 5 j 0 , II ] ≤ 1 / p 2 .

Summing all up, we have

Pr [ F 5 ] ≤ ∑ j = 1 q A ( k ) Pr [ F 5 j ] ≤ ∑ j = 1 q A ( k ) ( Pr [ F 5 j , I ] + Pr [ F 5 j , II ] ) ≤ 2 q A ( k ) p 2 ,

and this is negligible in k . Hence, Lemma 4.14 follows.

We now deduce that Adv Σ , A CCA ( k ) is negligible in k . Combining these lemmas, we have

Pr [ T 0 ] = Pr [ T 1 ] ≤ Pr [ T 2 ] + Adv ℬ 1 SDC ( k ) = Pr [ T 2 ′ ] + Adv ℬ 1 SDC ( k ) ( Lemmas 4.1, 4.2, and 4.3 ) ≤ Pr [ T 2 ″ ] + Adv ℬ 1 SDC ( k ) + ν 1 ( k ) ( Lemma (4.6) ) ≤ Pr [ T 3 ] + Pr [ F 3 ] + Adv ℬ 1 SDC ( k ) + ν 1 ( k ) ( Lemma 4.7 ) = Pr [ T 4 ] + Pr [ F 4 ] + Adv ℬ 1 SDC ( k ) + ν 1 ( k ) ( Lemma 4.9 ) ≤ 1 2 + Pr [ C 5 ] + Pr [ F 5 ] + Adv ℬ 1 SDC ( k ) + ν 1 ( k ) ( Lemmas 4.8 and 4.13 ) ≤ 1 2 + Adv ℬ 1 SDC ( k ) + 2 Adv ℬ 2 TCR ( k ) + ν 1 ( k ) + q A ( k ) ν 2 ( k ) ( Lemmas 4.12 and 4.14 )

Using equation (4.1), we have

Adv Σ , A CCA ( k ) ≤ Adv ℬ 1 SDC ( k ) + 2 Adv ℬ 2 TCR ( k ) + ν 1 ( k ) + q A ( k ) ν 2 ( k ) .

All the terms in the right-hand side are negligible. Therefore, this inequality proves the theorem.

5 Comparison

We make a few comparisons of our protocol against several protocols, including the protocol in ref. [13] (the Isobe-Iwazaki-Koizumi-Suda (IIKS) protocol). Though the IIKS protocol can apply to any non-abelian groups, in order to make the comparison easy, we assume that the output of the group generation algorithm of the IIKS protocol is of the form ( G , S 1 , W ) , where

the group G is generated by a set { g 1 , … , g l } of l elements,
S = ( g 1 , … , g l ) , and
W = ( t 1 w 11 ⋯ t l w 1 l , … , t 1 w l 1 ⋯ t l w l l ) is a tuple of words.

Table 1 shows a comparison of our protocol with the IIKS protocol and the protocols in ref. [10], which we refer to as the Baba-Kotyada-Teja protocol combined with the Fujisaki-Okamoto transformation (BKT-FO) and the Baba-Kotyada-Teja protocol combined with Boyen’s idea (BKT-B) protocols.

Table 1

Performance and security

	Group operations a		Parameter sizes b			Security
Protocols	Enc	Dec	pk	sk	Ciphertext	Goal/model c
BKT-FO [10]	[ 2 , 4 , 0 ]	[ 2 , 5 , 1 ]	3 ∣ G ∣	2 ∣ G ∣	2 ∣ G ∣ + ∣ M ∣	IND-CCA/ROM
BKT-B [10]	[ 4 , 7 , 0 ]	[ 2 , 4 , 0 ]	3 ∣ G ∣	2 ∣ G ∣	∣ G ∣ + ∣ M ∣	IND-CCA/ROM
IIKS [13]	[ 4 l + 1 , 10 l − 1 , 3 ]	[ 6 l + 1 , 8 l + 3 , 6 ]	15 ∣ G ∣	24 ∣ G ∣	8 ∣ G ∣	IND-rCCA/SM
Ours	[ 17 , 33 , 12 ]	[ 25 , 41 , 18 ]	10 ∣ G ∣	24 ∣ G ∣	6 ∣ G ∣	IND-CCA/SM

a The numbers of [exponentiation, multiplication, inversion] in the platform group G , where operations of hash functions are ignored.

b ∣ G ∣ : the bit length in expressing elements of G . ∣ M ∣ : the bit length in expressing messages.

c SM: the standard model, ROM: the random oracle model.

The platform group of our protocol is generated by three elements g 1 , g 2 , and g 3 . If one applies the group to the IIKS protocol, which means that one sets l = 3 , the number of operations to encrypt and decrypt are smaller than those of our protocol. This is because the form of the words used in our protocol are kind of complicated. However, our protocol has some significant advantages compared to the IIKS one.

The IIKS protocol achieves a weaker security called the IND-rCCA security. In general, in order to check whether or not condition (b) of Step D1 in the decryption algorithm Dec holds, one needs to solve a decisional conjugacy problem, which is not necessarily easy to solve for general non-abelian groups. Due to this reason, in the security proof of the IIKS protocol, the adversary should be assumed to query only ciphertexts that satisfy condition (b) of Step D1. On the other hand, in our protocol, one can easily check it by using some properties of semidirect products, and hence, our protocol can be shown to be IND-CCA secure. We note that our result implies that neither the decisional conjugacy problem is efficiently solvable on general non-abelian groups, nor is the decisional simultaneous conjugacy problem efficiently solvable on the semidirect products. Observe that, using Steps (b1) and (b2) in Section 3.2, one can check whether or not r u ∗ ∈ Orb ( u ) for each u ∈ { g 2 , g 3 , a , b } ; however, it can be hard to check whether or not there exists a single element r ∗ ∈ G such that r u ∗ = r ∗ u r ∗ − 1 holds for all u ∈ { g 2 , g 3 , a , b } .

The IIKS protocol imposes several strict conditions on the platform groups and the hashing schemes (Section III of [13]), including not only computational assumptions but also conditions on the structure of the groups. As mentioned in Section 1, we have not succeeded in finding such groups and hashing schemes yet. In particular, we are not sure whether or not the semidirect products used in our protocol satisfy the conditions. Our protocol imposes only non-constraining reasonable assumptions: a collision-resistant condition on the hash functions and the hardness assumption of a factorization search problem and the decisional simultaneous conjugacy problem.

In comparison to the BKT-FO and the BKT-B protocols, a significant difference is that our protocol is shown to be IND-CCA secure in the standard model, whereas the IND-CCA security of them is proved in the random oracle model. As for computational efficiency, the BKT-FO and the BKT-B protocols are more practical than ours. A reason for this is that the key exchange protocol based on the factorization problem [17], on which the BKT-FO and the BKT-B protocols are based, is more practical in terms of computational efficiency than the AAG protocol that our protocol employs. Aside from the efficiency, there is a structural difference between the factorization problem-based key exchange and the AAG one. The former uses a product of two cyclic subgroups of large order, whereas the latter is not dependent on cyclic subgroups but uses group words to generate commutators as shared keys. It is a future work to establish encryption protocols on non-abelian groups, without resorting to abelian subgroups, which is IND-CCA secure in the standard model and more practical in computational efficiency.

Acknowledgement

The authors would like to thank the anonymous reviewers for their comments on an earlier version of this article.

Funding information: This work was supported by JSPS KAKENHI Grant numbers 19K03612 and 22K03397.
Conflict of interest: The authors state that there is no conflict of interest.

Appendix A Properties of semidirect products

Let G = ( ⟨ g 1 ⟩ ⋊ ⟨ g 2 ⟩ ) ⋊ ⟨ g 3 ⟩ be a semidirect product generated by g 1 , g 2 , g 3 ∈ G with ord ( g 1 ) = p 1 and ord ( g 2 ) = ord ( g 3 ) = p 2 , where p 1 and p 2 are distinct primes with p 2 ∣ p 1 − 1 . We then assume that g 2 g 1 g 2 − 1 ≠ g 1 , g 3 g 1 g 3 − 1 ≠ g 1 , and g 3 g 2 g 3 − 1 ≠ g 2 . In this appendix, we prove the propositions left unproved so far.

A.1 Proof of Proposition 2.1 and several formulas

Using the property (S1) in Section 2.1, we have the following equations for some α , β 1 , γ 1 ∈ Z p 1 and β 2 , γ 2 ∈ Z p 2 :

(A1) g 2 g 1 g 2 − 1 = g 1 α , g 3 g 1 g 3 − 1 = g 1 β 1 g 2 β 2 , g 3 g 2 g 3 − 1 = g 1 γ 1 g 2 γ 2 .

We consider the first equation of (A1). Note that α ≠ 1 follows from the assumption. We have

g 2 l 2 g 1 g 2 − l 2 = g 2 l 2 − 1 ( g 2 g 1 g 2 − 1 ) g 2 − l 2 + 1 = g 2 l 2 − 1 g 1 α g 2 − l 2 + 1 = g 2 l 2 − 2 ( g 2 g 1 α g 2 − 1 ) g 2 − l 2 + 2 = g 2 l 2 − 2 ( g 2 g 1 g 2 − 1 ) α g 2 − l 2 + 2 = g 2 l 2 − 2 g 1 α 2 g 2 − l 2 + 2 = ⋯ = g 2 g 1 α l 2 − 1 g 2 − 1 = g 1 α l 2 .

Using this equation, we obtain

(A2) g 2 l 2 g 1 l 1 g 2 − l 2 = ( g 2 l 2 g 1 g 2 − l 2 ) l 1 = ( g 1 α l 2 ) l 1 = g 1 l 1 α l 2

and

(A3) g 1 l 1 g 2 l 2 g 1 − l 1 = g 1 l 1 g 2 l 2 g 1 − l 1 ( g 2 − l 2 g 2 l 2 ) = g 1 l 1 ( g 2 l 2 g 1 − l 1 g 2 − l 2 ) g 2 l 2 = g 1 l 1 g 1 − l 1 α l 2 g 2 l 2 = g 1 l 1 ( 1 − α l 2 ) g 2 l 2 .

In particular, setting l 1 = 1 and l 2 = p 2 in equation (A2), we have g 1 = g 2 p 2 g 1 g 2 − p 2 = g 1 α p 2 , and α p 2 = 1 mod p 1 follows.

Using equations (A2) and (A3), we inductively have

(A4) ( g 1 l 1 g 2 l 2 ) 2 = g 1 l 1 ( g 2 l 2 g 1 l 1 g 2 − l 2 ) g 2 2 l 2 = g 1 l 1 g 1 l 1 α l 2 g 2 2 l 2 = g 1 l 1 ( 1 + α l 2 ) g 2 2 l 2 ( g 1 l 1 g 2 l 2 ) 3 = ( g 1 l 1 g 2 l 2 ) 2 ( g 1 l 1 g 2 l 2 ) = g 1 l 1 ( 1 + α l 2 ) ( g 2 2 l 2 g 1 l 1 g 2 − 2 l 2 ) g 2 3 l 2 = g 1 l 1 ( 1 + α l 2 + α 2 l 2 ) g 2 3 l 2 ⋯ ( g 1 l 1 g 2 l 2 ) n = g 1 l 1 ( 1 + α l 2 + ⋯ + α ( n − 1 ) l 2 ) g 2 n l 2 = g 1 l 1 ( 1 − α n l 2 ) / ( 1 − α l 2 ) g 2 n l 2 .

We next consider the second equation of (A1). Assume that β 2 ≠ 0 . Then, by equation (A4), we have

e = g 3 g 1 p 1 g 3 − 1 = ( g 3 g 1 g 3 − 1 ) p 1 = ( g 1 β 1 g 2 β 2 ) p 1 = g 1 β 1 ( 1 − α p 1 β 2 ) / ( 1 − α β 2 ) g 2 p 1 β 2 .

Since p 2 ∤ p 1 and p 2 ∤ β 2 , we see p 1 β 2 ≠ 0 mod p 2 . This contradicts the equation above. Hence, g 3 g 1 g 3 − 1 = g 1 β holds for some β ∈ Z p 1 , and β ≠ 1 follows from the assumption.

Similar computations to equations (A2)–(A4) yield the following equations:

(A5) g 3 l 3 g 1 l 1 g 3 − l 3 = g 1 l 1 β l 3 ,

(A6) g 1 l 1 g 3 l 3 g 1 − l 1 = g 1 l 1 ( 1 − β l 3 ) g 3 l 3 ,

(A7) ( g 1 l 1 g 3 l 3 ) n = g 1 l 1 ( 1 + β l 3 + ⋯ + β ( n − 1 ) l 3 ) g 3 n l 3 = g 1 l 1 ( 1 − β n l 3 ) / ( 1 − β l 3 ) g 3 n l 3 .

Setting l 1 = 1 and l 3 = p 2 in equation (A5), we have g 1 = g 3 p 2 g 1 g 3 − p 2 = g 1 β p 2 , and β p 2 = 1 mod p 1 follows.

We now consider the last equation of (A1). Assume that γ 2 = 0 . Then, we have e = g 3 g 2 p 2 g 3 − 1 = ( g 3 g 2 g 3 − 1 ) p 2 = g 1 γ 1 p 2 . Since p 1 ∤ p 2 , γ 1 = 0 mod p 1 follows. This means that g 3 g 2 g 3 − 1 = e , that is, g 2 = e . This contradicts that ord ( g 2 ) = p 2 . So γ 2 ≠ 0 follows.

We inductively have

(A8) g 3 2 g 2 g 3 − 2 = g 3 ( g 3 g 2 g 3 − 1 ) g 3 − 1 = g 3 g 1 γ 1 g 2 γ 2 g 3 − 1 = ( g 3 g 1 g 3 − 1 ) γ 1 ( g 3 g 2 g 3 − 1 ) γ 2 = g 1 β γ 1 ( g 1 γ 1 g 2 γ 2 ) γ 2 = g 1 β γ 1 + γ 1 ( 1 − α γ 2 2 ) / ( 1 − α γ 2 ) g 2 γ 2 2 = g 1 γ 1 C 23 ′ ( 2 ) g 2 γ 2 2 , g 3 3 g 2 g 3 − 3 = g 3 ( g 3 2 g 2 g 3 − 2 ) g 3 − 1 = g 3 g 1 γ 1 C 23 ′ ( 2 ) g 2 γ 2 2 g 3 − 1 = ( g 3 g 1 g 3 − 1 ) γ 1 C 23 ′ ( 2 ) ( g 3 g 2 g 3 − 1 ) γ 2 2 = g 1 β γ 1 C 23 ′ ( 2 ) ( g 1 γ 1 g 2 γ 2 ) γ 2 2 = g 1 β γ 1 C 23 ′ ( 2 ) + γ 1 ( 1 − α γ 2 3 ) / ( 1 − α γ 2 ) g 2 γ 2 3 = g 1 γ 1 C 23 ′ ( 3 ) g 2 γ 2 3 , ⋯ g 3 l 3 g 2 g 3 − l 3 = g 1 γ 1 C 23 ′ ( l 3 ) g 2 γ 2 l 3 ,

where

(A9) C 23 ′ ( l 3 ) = ∑ i = 0 l 3 − 1 β i ( 1 − α γ 2 l 3 − i ) 1 − α γ 2 .

When l 3 = p 2 , since g 2 = g 3 p 2 g 2 g 3 − p 2 = g 1 C 23 ′ ( p 2 ) g 2 γ 2 p 2 , γ 2 p 2 = 1 mod p 2 follows. Hence, we see γ 2 = 1 . This shows that g 3 g 2 g 3 − 1 = g 1 γ g 2 for some γ ∈ Z p 1 , and we have γ ≠ 0 by the assumption. We now complete the proof of Proposition 2.1.

The rest of this subsection is devoted to inducing several formulas, which are implicitly used to prove the other propositions. Substituting γ 1 = γ and γ 2 = 1 into equations (A9) and (A8), we have

C 23 ′ ( l 3 ) = ∑ i = 0 l 3 − 1 β i ( 1 − α ) 1 − α = 1 − β l 3 1 − β , g 3 l 3 g 2 g 3 − l 3 = g 1 γ ( 1 − β l 3 ) / ( 1 − β ) g 2 .

Using equation (A4), we have

(A10) g 3 l 3 g 2 l 2 g 3 − l 3 = ( g 1 γ ( 1 − β l 3 ) / ( 1 − β ) g 2 ) l 2 = g 1 γ C 23 ( l 2 , l 3 ) g 2 l 2 ,

where C 23 ( l 2 , l 3 ) is defined in Proposition 4.10. On the other hand, we have

g 2 l 2 g 3 g 2 − l 2 = g 2 l 2 ( g 3 g 2 l 2 g 3 − 1 ) − 1 g 3 = g 2 l 2 ( g 2 − l 2 g 1 − γ ( 1 − α l 2 ) / ( 1 − α ) ) g 3 = g 1 − γ ( 1 − α l 2 ) / ( 1 − α ) g 3

and

(A11) g 2 l 2 g 3 l 3 g 2 − l 2 = ( g 2 l 2 g 3 g 2 − l 2 ) l 3 = ( g 1 − γ ( 1 − α l 2 ) / ( 1 − α ) g 3 ) l 3 = g 1 − γ C 23 ( l 2 , l 3 ) g 3 l 3 .

By equations (A2), (A3), and (A10), we have

( g 1 l 1 g 2 l 2 g 3 l 3 ) ( g 1 n 1 g 2 n 2 g 3 n 3 ) = g 1 l 1 g 2 l 2 ( g 3 l 3 g 1 n 1 g 3 − l 3 ) ( g 3 l 3 g 2 n 2 g 3 − l 3 ) g 3 l 3 + n 3 = g 1 l 1 g 2 l 2 g 1 n 1 β l 3 g 1 γ C 23 ( n 2 , l 3 ) g 2 n 2 g 3 l 3 + n 3 = g 1 l 1 ( g 2 l 2 g 1 n 1 β l 3 + γ C 23 ( n 2 , l 3 ) g 2 − l 2 ) g 2 l 2 + n 2 g 3 l 3 + n 3 = g 1 l 1 + n 1 α l 2 β l 3 + γ α l 2 C 23 ( n 2 , l 3 ) g 2 l 2 + n 2 g 3 l 3 + n 3 .

Using this equation, we have

(A12) ( g 1 n 1 g 2 n 2 g 3 n 3 ) ( g 1 l 1 g 2 l 2 g 3 l 3 ) ( g 1 n 1 g 2 n 2 g 3 n 3 ) − 1 = g 1 C ( l 1 , l 2 , l 3 ; n 1 , n 2 , n 3 ) g 2 l 2 g 3 l 3 ,

where

C ( l 1 , l 2 , l 3 ; n 1 , n 2 , n 3 ) = n 1 ( 1 − α l 2 β l 3 ) + l 1 α n 2 β n 3 + γ α n 2 C 23 ( l 2 , n 3 ) − γ α l 2 C 23 ( n 2 , l 3 ) .

We finally have

( g 1 l 1 g 2 l 2 g 3 l 3 ) n = g 1 P ( l 1 , l 2 , l 3 ; n ) g 2 l 2 n g 3 l 3 n .

When α l 2 β l 3 ≠ 1 , we have

P ( l 1 , l 2 , l 3 ; n ) = l 1 { 1 − ( α l 2 β l 3 ) n } 1 − α l 2 β l 3 + γ A ( l 2 , l 3 ; n ) ,

where A ( l 2 , l 3 ; n ) is defined in Proposition 4.10. When α l 2 β l 3 = 1 , we have

P ( l 1 , l 2 , l 3 ; n ) = l 1 n + γ ( 1 − n − α l 2 n + α l 2 n ) ( 1 − α ) ( 1 − β ) .

A.2 Proof of Proposition 3.1

A tuple ( a 2 , a 3 , b 2 , b 3 ) fails to satisfy the conditions (3.4)–(3.6) if and only if at least one of the following equations holds:

(A13) a 2 b 3 − a 3 b 2 = 0 mod p 2 ,

(A14) α a 2 ( 1 − α b 2 ) ( 1 − β a 3 ) − α b 2 ( 1 − α a 2 ) ( 1 − β b 3 ) = 0 ,

(A15) 1 − α a 2 β a 3 = 0 or 1 − α b 2 β b 3 = 0 .

We see that

# { ( a 2 , a 3 , b 2 , b 3 ) ∈ Z p 2 4 ∣ ( a 2 , a 3 , b 2 , b 3 ) satisfies the equation (A.13) } = p 2 3 , # { ( a 2 , a 3 , b 2 , b 3 ) ∈ ( Z p 2 × ) 4 ∣ ( a 2 , a 3 , b 2 , b 3 ) satisfies the equation (A.14) } ≤ ( p 2 − 1 ) 3 , # { ( a 2 , a 3 , b 2 , b 3 ) ∈ Z p 2 4 ∣ ( a 2 , a 3 , b 2 , b 3 ) satisfies the equation (A.15) } = 2 p 2 3 − p 2 2 .

Therefore, we have

Pr [ ( a 2 , a 3 , b 2 , b 3 ) satisfies the conditions (3.4)–(3.6) ∣ ( a 2 , a 3 , b 2 , b 3 ) ← U Z p 2 4 ] ≥ 1 − p 2 3 p 2 4 − ( p 2 − 1 ) 3 + { p 2 4 − ( p 2 − 1 ) 4 } p 2 4 − 2 p 2 3 − p 2 2 p 2 4 = 1 − 8 p 2 3 − 10 p 2 2 + 7 p 2 − 2 p 2 4 ≥ 1 − 8 p 2 ,

and the proposition follows.

A.3 Proof of Proposition 3.2

Let w z 1 ( t 2 , t 3 ) = [ t 2 , t 3 ] z 11 t 2 z 12 t 3 z 13 , and w z 2 ( t ¯ 2 , t ¯ 3 ) = [ t ¯ 2 , t ¯ 3 ] z 21 t ¯ 2 z 22 t ¯ 3 z 23 be two words. We then define the two maps f 1 , f 2 : Z p 1 × Z p 2 2 → G by f 1 ( z 11 , z 12 , z 13 ) = w z 1 ( S ) and f 2 ( z 21 , z 22 , z 23 ) = w z 2 ( S ¯ ) . We now show that the maps f 1 and f 2 are both bijective.

We have [ g 2 , g 3 ] z 11 g 2 z 12 g 3 z 13 = g 1 − γ z 11 g 2 z 12 g 3 z 13 . So, for any element g = g 1 n 1 g 2 n 2 g 3 n 3 ∈ G , if we set z 11 = − γ − 1 n 1 , z 12 = n 2 , and z 13 = n 3 , then we have f 1 ( z 11 , z 12 , z 13 ) = g . This shows that f 1 is surjective.

We then have [ a , b ] = g 1 γ ( α a 2 C 23 ( b 2 , a 3 ) − α b 2 C 23 ( a 2 , b 3 ) ) and

[ a , b ] z 21 a z 22 b z 23 = g 1 γ Δ 2 ( a , b ; z 21 , z 22 , z 23 ) g 2 a 2 z 22 + b 2 z 23 g 3 a 3 z 22 + b 3 z 23 ,

where Δ 2 ( a , b ; z 21 , z 22 , z 23 ) is defined in Proposition 4.10. Let g = g 1 n 1 g 2 n 2 g 3 n 3 ∈ G . By condition (3.4), there exists the unique solution ( z 22 , z 23 ) of equations a 2 z 22 + b 2 z 23 = n 2 and a 3 z 22 + b 3 z 23 = n 3 . We then note that the coefficient of z 21 in Δ 2 ( a , b ; z 21 , z 22 , z 23 ) is nonzero by condition (3.5). Therefore, for the solution ( z 22 , z 23 ) , there also exists the unique solution z 21 of equation n 1 = γ Δ 2 ( a , b ; z 21 , z 22 , z 23 ) . The tuple ( z 21 , z 22 , z 23 ) clearly satisfies f 2 ( z 21 , z 22 , z 23 ) = g . This proves that f 2 is surjective.

We note that the cardinalities of Z p 1 × Z p 2 2 and G are p 1 p 2 2 < ∞ . Hence, f 1 and f 2 are also bijective, and the proposition follows.

A.4 Proof of Proposition 3.3

Equation (A12) implies that Orb ( g 2 l 2 g 3 l 3 ) ⊆ { g 1 c 1 g 2 l 2 g 3 l 3 ∣ c 1 ∈ Z p 1 } . In particular, if g 1 ( g 2 l 2 g 3 l 3 ) g 1 − 1 = g 1 1 − α l 2 β l 3 g 2 l 2 g 3 l 3 ≠ g 2 l 2 g 3 l 3 , the coefficient of n 1 in C ( l 1 , l 2 , l 3 ; n 1 , n 2 , n 3 ) is not zero. So we have Orb ( g 2 l 2 g 3 l 3 ) = { g 1 c 1 g 2 l 2 g 3 l 3 ∣ c 1 ∈ Z p 1 } .

A.5 Proof of Proposition 4.4

Since g 1 n 1 ( g 2 l 2 g 3 l 3 ) g 1 − n 1 = g 1 n 1 ( 1 − α l 2 β l 3 ) g 2 l 2 g 3 l 3 and 1 − α l 2 β l 3 ≠ 0 by the assumption of the proposition, we have

{ g 1 n 1 ( g 2 l 2 g 3 l 3 ) g 1 − n 1 ∣ n 1 ∈ Z p 1 } = { g 1 l 1 g 2 l 2 g 3 l 3 ∣ l 1 ∈ Z p 1 } = Orb ( g 2 l 2 g 3 l 3 ) .

For any c 1 ∈ Z p 1 , if we set n 1 = c 1 / ( 1 − α l 2 β l 3 ) , then we have g 1 n 1 ( g 2 l 2 g 3 l 3 ) g 1 − n 1 = g 1 c 1 g 2 l 2 g 3 l 3 . This implies that Pr [ g 1 n 1 ( g 2 l 2 g 3 l 3 ) g 1 − n 1 = g 1 c 1 g 2 l 2 g 3 l 3 ∣ n 1 ← U Z p 1 ] = 1 / p 1 . On the other hand, for any fixed c 1 ∈ Z p 1 and ( n 2 , n 3 ) ∈ Z p 2 2 , if we set

n 1 = c 1 − γ α n 2 C 23 ( l 2 , n 3 ) + γ α l 2 C 23 ( n 2 , l 3 ) 1 − α l 2 β l 3 ,

then we have ( g 1 n 1 g 2 n 2 g 3 n 3 ) ( g 2 l 2 g 3 l 3 ) ( g 1 n 1 g 2 n 2 g 3 n 3 ) − 1 = g 1 c 1 g 2 l 2 g 3 l 3 . This implies that Pr [ g ( g 2 l 2 g 3 l 3 ) g − 1 = g 1 c 1 g 2 l 2 g 3 l 3 ∣ g ← U G ] = 1 / p 1 . Hence, Proposition 4.4 follows.

A.6 Proof of Proposition 4.5

By direct computation, we have

[ g 1 r ¯ 21 , a ] ( g 1 − r 21 g 2 a 2 g 1 r 21 ) ( g 1 − r 31 g 3 a 3 g 1 r 31 ) a − 1 = g 1 r ¯ 21 ( 1 − α a 2 β a 3 ) g 1 − r 21 ( 1 − α a 2 ) g 2 a 2 g 1 − r 31 ( 1 − β a 3 ) g 2 − a 2 = g 1 F 1 ( a , b , R , R ¯ ) / ( 1 − α b 2 β b 3 )

and

[ g 1 F 1 ( a , b , R , R ¯ ) / ( 1 − α b 2 β b 3 ) , b ] = g 1 ( 1 − α b 2 β b 3 ) F 1 ( a , b , R , R ¯ ) / ( 1 − α b 2 β b 3 ) = g 1 F 1 ( a , b , R , R ¯ ) .

By a similar computation as above, we have

[ [ g 1 r ¯ 31 , b ] ( g 1 − r 21 g 2 b 2 g 1 r 21 ) ( g 1 − r 31 g 3 b 3 g 1 r 31 ) b − 1 , a ] = g 1 F 2 ( a , b , R , R ¯ ) .

Since the coefficient of r ¯ 21 in equation (4.3) is nonzero, for any fixed ( r 21 , r 31 , r ¯ 31 ) ∈ Z p 1 3 , there exists the unique solution r ¯ 21 such that equation (4.3) holds. This implies that the number of solutions ( r 21 , r 31 , r ¯ 21 , r ¯ 31 ) ∈ Z p 1 4 of equation (4.3) is p 1 3 , and the proposition follows.

A.7 Proof of Proposition 4.10

The uniqueness of the tuple ( z 11 , z 12 , z 13 ) follows since the map f 1 defined in Appendix A.3 is bijective. We have

[ g 2 , g 3 ] z 11 g 2 z 12 g 3 z 13 [ a , b ] z 21 a z 22 b z 23 = g 1 − γ z 11 g 2 z 12 g 3 z 13 g 1 γ Δ 2 ( a , b ; z 21 , z 22 , z 23 ) g 2 a 2 z 22 + b 2 z 23 g 3 a 3 z 22 + b 3 z 23 = g 1 Δ 0 ( z 1 , z 2 ) g 2 z 12 + a 2 z 22 + b 2 z 23 g 3 z 13 + a 3 z 22 + b 3 z 23 ,

where

Δ 0 ( z 1 , z 2 ) = − γ z 11 + γ α z 12 β z 13 Δ 2 ( a , b ; z 21 , z 22 , z 23 ) + γ α z 12 C 23 ( a 2 z 22 + b 2 z 23 , z 13 ) .

Comparing the indices of this equation with those of g 1 z 01 g 2 z 02 g 3 z 03 , we have equation (4.4), and the proposition holds.

A.8 Proof of Propositions 4.11 and 4.15

By direct computation, we have

R = ( g 1 r 21 g 2 g 1 − r 21 , g 1 r 31 g 3 g 1 − r 31 ) = ( g 1 r 21 ( 1 − α ) g 2 , g 1 r 31 ( 1 − β ) g 3 ) , R ¯ = ( g 1 r ¯ 21 a g 1 − r ¯ 21 , g 1 r ¯ 31 b g 1 − r ¯ 31 ) = ( g 1 r ¯ 21 ( 1 − α a 2 β a 3 ) a , g 1 r ¯ 31 ( 1 − α b 2 β b 3 ) b ) .

The latter equation implies that the first equation of Proposition 4.15 holds. We then have w z 1 ( R ) = g 1 Δ 1 ′ ( z 1 , R ) g 2 z 12 g 3 z 13 and w z 2 ( R ¯ ) = g 1 Δ 2 ′ ( z 2 , R ¯ ) g 2 a 2 z 22 + b 2 z 23 g 3 a 3 z 22 + b 3 z 23 , where

Δ 1 ′ ( z 1 , R ) = { − γ + ( r 21 − r 31 ) ( 1 − α ) ( 1 − β ) } z 11 + r 21 ( 1 − α z 12 ) + r 31 α z 12 ( 1 − β z 13 ) , Δ 2 ′ ( z 2 , R ¯ ) = γ Δ 2 ( a , b ; z 21 , z 22 , z 23 ) + z 21 ( r ¯ 21 − r ¯ 31 ) ( 1 − α a 2 β a 3 ) ( 1 − α b 2 β b 3 ) + r ¯ 21 ( 1 − α a 2 z 22 β a 3 z 23 ) + r ¯ 31 α a 2 z 22 β a 3 z 23 ( 1 − α b 2 z 22 β b 3 z 23 ) .

Hence, we obtain w z 1 ( R ) w z 2 ( R ¯ ) z 2 − 1 z 1 − 1 = g 1 Δ ( z 1 , z 2 , R , R ¯ ) . Noting that w a ( R ∗ ) = g 1 Δ 1 ′ ( a , R ∗ ) a and w b ( R ∗ ) = g 1 Δ 1 ′ ( b , R ∗ ) b , we see that the second equation of Proposition 4.15 holds.

References

[1] Anshel I, Anshel M, Fisher B, Goldfeld D. New key agreement protocols in Braid Group cryptography. In: Proceedings of CT-RSA 2001, LNCS 2020. Springer; 2001. p. 13–27. 10.1007/3-540-45353-9_2Search in Google Scholar

[2] Gu L, Pan Y, Dong M, Ota K. Noncommutative lightweight signcryption for wireless sensor networks. Int J Distributed Sensor Netw. 2013;9(3).10.1155/2013/818917Search in Google Scholar

[3] Ko KH, Lee SJ, Cheon JH, Han JW, Kang J, Park C. New public-key cryptosystem using Braid groups. In: Proceedings of CRYPTO 2000, LNCS 1880, Springer; 2000. p. 166–83. 10.1007/3-540-44598-6_10Search in Google Scholar

[4] Shpilrain V, Ushakov A. Thompson’s group and public key cryptography. In: Proceedings of ACNS 2005, LNCS 3531. Springer; 2005. p. 151–63. 10.1007/11496137_11Search in Google Scholar

[5] Lempken W, van Trung T, Magliveras SS, Wei W. A public key cryptosystem based on non-abelian finite groups. J Cryptol. 2009;22:62–74. 10.1007/s00145-008-9033-ySearch in Google Scholar

[6] Magliveras SS, Stinson DR, van Trung T. New approaches to designing public key cryptosystems using one-way functions and trapdoors in finite groups. J Cryptol. 2002;15:285–97. 10.1007/s00145-001-0018-3Search in Google Scholar

[7] Mahalanobis A. A simple generalization of the ElGamal cryptosystem to non-abelian groups. Comm. Algebra. 2008;36:3878–89. 10.1080/00927870802160883Search in Google Scholar

[8] Paeng S-H, Ha K-C, Kim JH, Chee S, Park C. New public key cryptosystem using finite non abelian groups. In: Proceedings of CRYPTO 2001. LNCS 2139. Springer; 2001. p. 470–85. 10.1007/3-540-44647-8_28Search in Google Scholar

[9] Vasco MIG, Martínez C, Steinwandt R, Villar JL. A new Cramer–Shoup like methodology for group based provably secure encryption schemes. In: Proceedings of TCC 2005. LNCS 3378. Springer; 2005. p. 495–509. 10.1007/978-3-540-30576-7_27Search in Google Scholar

[10] Gu L, Wang L, Ota K, Dong M, Cao Z, Yang Y. New public key cryptosystems based on non-abelian factorization problems. Security Comm. Netw. 2013;6:912–22. 10.1002/sec.710Search in Google Scholar

[11] Hong H, Wang L, Shao J, Yan J, Ahmad H, Wei G, et al. A Miniature CCA public key encryption scheme based on non-abelian factorization problem in finite groups of lie type. Comput J. 2019;62:1840–8. 10.1093/comjnl/bxz068Search in Google Scholar

[12] Li J, Wang L, Zhang Z, Niu X. Novel constructions of Cramer–Shoup like cryptosystems based on index exchangeable family. In: Proceedings of ASIA CCS 2016;2016. p. 895–900. 10.1145/2897845.2897920Search in Google Scholar

[13] Isobe S, Iwazaki J, Koizumi E, Suda A. A construction of Cramer–Shoup like encryption protocols based on the Anshel–Anshel–Goldfeld key exchange protocol. In: Proceedings of 2018 Sixth International Symposium on Computing and Networking Workshops (CANDARW);2018. p. 410–6. 10.1109/CANDARW.2018.00082Search in Google Scholar

[14] Cramer R, Shoup V. Design and analysis of practical public-key encryption schemes against adaptive chosen ciphertext attack. SIAM J Comput. 2003;33:167–226. 10.1137/S0097539702403773Search in Google Scholar

[15] Diffie W, Hellman ME. New direction in cryptography. IEEE Trans Inform Theory. 1976;IT-22:644–54. 10.1109/TIT.1976.1055638Search in Google Scholar

[16] Anshel I, Anshel M, Goldfeld D. An algebraic method for public-key cryptography. Math. Res. Lett. 1999;6:287–91. 10.4310/MRL.1999.v6.n3.a3Search in Google Scholar

[17] Baba S, Kotyada S, Teja R. A non-abelian factorization problem and an associated cryptosystem. Cryptol. ePrint Archive. 2011; Paper 2011/048. Search in Google Scholar

Received: 2022-05-01

Revised: 2022-11-30

Accepted: 2023-02-15

Published Online: 2023-03-21

This work is licensed under the Creative Commons Attribution 4.0 International License.

Articles in the same Issue

https://doi.org/10.1515/jmc-2022-0018

Keywords for this article

encryption protocol; semidirect product; Anshel–Anshel–Goldfeld key exchange protocol; indistinguishability against adaptive chosen ciphertext attack

Creative Commons

BY 4.0