1. Introduction
The Joye–Libert cryptosystem was introduced in [
1,
2] as a generalisation of the Goldwasser–Micali public key encryption scheme [
3,
4]. The main advantage of the Joye–Libert scheme compared to Goldwasser–Micali is that the first supports a larger message space, and thus it considerably decreases the expansion of the ciphertext. Regarding security, the authors prove that inverting the encryption function is equivalent to breaking the quadratic residuosity problem modulo
, where
p and
q are prime numbers. Another important security result is that the scheme is semantically secure if the gap
-residue assumption modulo
n holds. We underline that the Joye–Libert cryptosystem is partially homomorphic with respect to message addition and supports ciphertext randomization.
In this paper, we aim to find a way to improve decryption times for the Joye–Libert scheme. Therefore, we introduce two variants of the system: an unbalanced version and a multiprime one. In the first version, we show how to decrease the size of
p, while keeping the system secure and implicitly decreasing the complexity of decryption. The only cryptosystem related to this version is called the unbalanced RSA [
5]. Just like our version, the scope is to reduce
p, while keeping the system secure.
In the multiprime version, we increase the number of factors while keeping the size of the modulus constant, and we manage to prove that inverting encryption is equivalent to a vectorial form of the quadratic residuosity assumption. We can find only one related cryptosystem in the literature: the multiprime RSA [
6,
7]. The philosophy behind the multiprime RSA is the same as ours—it uses parallelism to speed up decryption. A bonus of the multiprime Joye–Libert is that we can also use multiple threads to improve encryption time, while in the case of RSA this is not possible.
In the final section of our paper, we analyze the complexity of the two novel variants. Then we compare the decryption time complexities for all versions of the Joye–Libert scheme. If parallelization is possible, then the multiprime variant is to be preferred since it has faster encryption and decryption. Otherwise, the unbalanced version should be used.
Previous work. Note that a preliminary version of this proposal was presented in [
8].
Structure of the paper. In
Section 2, we provide the notations used in our paper. Then, we recall several definitions needed to describe our proposals. The original Joye–Libert scheme is detailed in
Section 3. In
Section 4 and
Section 5, we present two novel versions of the Joye–Libert scheme. A performance analysis of the Joye–Libert variants is provided in
Section 6. Conclusions and open problems are given in
Section 7.
2. Preliminaries
Notations. In this paper, represents a security parameter. By , we denote the size of n in bits. The action of selecting a random element x from a sample space X is denoted by . The assignment operator initialises variable x with value y. Let E be an event, then represents the likelihood of E occurring. Probabilistic polynomial-time algorithms are referred to as PPT algorithms. In this paper, the set of natural numbers is denoted by . To simplify notations, we denote the set by . Multidimensional vectors are represented as .
2.1. Computational Complexity
In this subsection, we present the reader with computational complexities of multiplication, exponentiation and modular inverse. These complexities are needed in order to determine the efficiency of our proposed schemes. Note that the asymptotic values are given in
Table 1 and are taken from [
9,
10]. To simplify our presentation, we use the notation
for the complexity of the multiplication algorithm. Note that while discussing the complexity of performing an exponentiation, we assume that the exponent’s length is
k bits.
2.2. Number Theoretic Prerequisites
The Joye–Libert encryption scheme is based on a generalisation of the Legendre symbol, namely the
-th power residue symbol. Note that the Legendre symbol is obtained when
, and for simplicity, we further denote it by
. We recall the definition of the
-th power residue symbol and some of its properties, as stated in [
11].
Definition 1. Let p be an odd prime such that . Then, the symbolis called the -th power residue symbol modulo p, where , where . Lemma 1. The -th power residue symbol satisfies the following properties
If , then ;
;
;
and .
Let . We further denote by the Jacobi symbol of an integer a modulo an integer n. and denote the set of integers modulo n with Jacobi symbol 1, and respectively, the set of quadratic residues modulo n.
2.3. Public Key Encryption
The three PPT algorithms specific to a public key encryption (PKE) scheme are: Setup, Encrypt and Decrypt. Given as input a security parameter, the Setup algorithm outputs the public key and the corresponding secret key. To encrypt a message, Encrypt also needs the public key as input in order to output the correlated ciphertext. To recover the original message, the Decrypt algorithm takes as input the secret key and the ciphertext. Note that if decryption fails, Decrypt returns an invalidity symbol.
Definition 2 (Indistinguishability under Chosen Plaintext Attacks—ind-cpa) The security model against chosen plaintext attacks for a PKE scheme is described using the following game:
: In this phase, challenger C first computes the public key, while keeping the corresponding secret key to himself. Then C sends only the public key to adversary A.
: Adversary A chooses two equal length messages and sends them to C. After flipping a coin , the challenger encrypts and sends to A the resulting ciphertext.
: In this phase, the adversary outputs a guess . A wins the security game if .
The advantage of an adversary A attacking a PKE scheme is defined aswhere the probability is computed over the random bits used by C and A. A PKE scheme isind-cpasecure if for any PPT adversary A, the advantage is negligible. 3. The Joye–Libert PKE Scheme
The Joye–Libert encryption scheme was initially introduced in [
1]. Its security was improved in [
2]. The authors proved that inverting the encryption function is as hard as the quadratic residuosity assumption. Joye et al. also showed that in the standard model, the
ind-cpa security of the PKE is equivalent to the gap
-residuosity assumption. We shortly present the algorithms of the Joye–Libert cryptosystem.
Setup(): Set an integer . Randomly generate two distinct large prime numbers p, q such that and . Output the public key , where and . The corresponding secret key is .
Encrypt(): To encrypt a message , we choose and compute . Output the ciphertext c.
Decrypt(): Compute the value and find m such that the relation holds. Efficient methods to recover m can be found in a subsequent section.
4. The Unbalanced Joye–Libert PKE Scheme
In the unbalanced Joye–Libert scheme, we reduce the size of p (denoted by ) while keeping the size of n constant (denoted by ). This modification only impacts the description of the Setup algorithm, which we briefly describe below. Therefore, we have , where and . Note that when , we obtain the Joye–Libert cryptosystem, which we further refer to as the balanced Joye–Libert scheme.
Setup(): Set an integer . Randomly generate two distinct large prime numbers p, q such that , and . Output the public key , where and . The corresponding secret key is .
Remark 1. Modifying the size of p does not impact the security proofs discussed in [1,2]. Therefore, as long as factoring is hard, the unbalanced version is secure. We show how to choose such that factoring remains difficult in Section 6. 5. The Multiprime Joye–Libert PKE Scheme
5.1. Description
We further describe the multiprime Joye–Libert encryption scheme. In this case, we split up
n into multiple primes. Therefore, we have
. Note that when
and
, we obtain the original cryptosystem from [
1,
2], and moreover, when in addition we set
, we obtain the Goldwasser–Micali cryptosystem [
3]. In addition, if we set
, we obtain the unbalanced version.
Setup(
): Set an integer
. Randomly generate
distinct large prime numbers
such that
,
and
. Let
. For each
select
such that
Output the public key and the corresponding secret key , where and .
Encrypt(): To encrypt message , first we divide it into t blocks such that for each we have . Then, we choose randomly and compute the value . The output is ciphertext c.
Decrypt(): For each , compute using Algorithm 1.
Algorithm 1 Basic decryption algorithm |
![Mathematics 10 01577 i001]() |
Correctness. Let
be the binary expansion of block
. Note that
since
, where ;
, where ;
.
As a result, the message block can be recovered bit-by-bit using .
5.2. Security Analysis
In this section, we first introduce a vectorial generalisation of the quadratic residuosity problem and prove that inverting the encryption function of our proposal is as hard as breaking this assumption. Then, we generalise the gap
-residuosity problem stated in [
1] and prove the
ind-cpa security of our proposal.
Before stating the security assumptions used to prove the security of our proposal, we first define the following sets
where
and
.
Definition 3 Vectorial Quadratic Residuosity—
vqr).
Choose distinct large prime numbers such that , and . Let . Let A be a PPT algorithm that returns 1 on input if . We define the advantage The Vectorial Quadratic Residuosity assumption states that for any PPT algorithm A the advantage is negligible. Theorem 1. Inverting the encryption function of the multiprime Joye–Libert PKE is intractable if thevqrassumption is intractable.
Proof. Let us assume that there exists an adversary A such that given a ciphertext c, it recovers the message m. We construct a PPT algorithm that breaks the vqr assumption. More precisely, on input B computes , where . Remark that if , then c is an encryption of . If , then , and thus is an encryption of . According to the above arguments, on input algorithm A outputs either or , and thus B outputs 0 or 1, respectively. Therefore, B breaks the vqr assumption with non-negligible probability. □
Definition 4 (Vectorial Gap
-Residuosity—
vgr).
Choose distinct large prime numbers such that , and . Let . Let A be a PPT algorithm that returns 1 on input if . We define the advantage The Vectorial Gap -Residuosity assumption states that for any PPT algorithm A, the advantage is negligible. Theorem 2. The multiprime Joye–Libert PKE isind-cpasecure if and only if thevgrassumption is intractable.
Proof. The proof of the statement is obtained by simply replacing the distribution of the public key elements . More precisely, we randomly select the values from the multiplicative subgroup of residues modulo n instead of drawing them from the set. Under the vgr assumption, the adversary will not notice this change. Therefore, we removed any link between the ciphertext c and the message m, and thus the ind-cpa security follows. □
5.3. Optimizations
Setup Optimization. When choosing the public key we have to meet certain restrictions. An effective way to accomplish this is to first randomly choose the values , and . Then compute the elements . Using the Chinese remainder theorem, we compute the desired value such that for all and .
Decryption Optimization. In order to speed-up the decryption process, the authors of [
2] add an extra restriction when generating the prime factors of
n, and then use it to simplify decryption. Applying this to the multiprime case, we obtain the fact that we have to generate
such that
holds.
Let
and
. Then, the following relation between the ciphertext and plaintext holds
since
;
, where ;
;
.
Hence, if we precompute
, then we can recover message block
. Wrapping it all together, we obtain Algorithm 2. Note that when
, we obtain [
2] (Algorithm 3). The authors also propose three other optimizations [
2] (Algorithms 4–6), but their complexity is similar to that of Algorithm 3. Remark that two of these optimizations contain a typo: in line 5, Algorithm 5 and line 6, Algorithm 6 we should have
instead of
.
Algorithm 2 Optimized decryption algorithm |
![Mathematics 10 01577 i002]() |
6. Implementation and Performance Analysis
6.1. Parameter Selection
The fastest currently known algorithm for factoring composite numbers is the Number Field Sieve (NFS) [
12]. The expected running time of the NFS depends on the size of the modulus
n and not on the size of its factors. More precisely, the expected running time is approximately
In [
12,
13], the authors extrapolate the running time needed to factor a modulus of size
from the computational effort required to factor a 512-bit modulus. Hence, a
-bit modulus offers a security equivalent to a block cipher of
d-bit security if
Since we start from a secure Joye–Libert PKE and we wish to optimize decryption by decreasing the size of some of the factors of the modulus, while keeping the size of the modulus constant, the NFS cannot be expected to factor
n. Unfortunately, this strategy can make the resulting PKEs vulnerable to the Elliptic Curve Method (ECM) [
14] if we lower the size of the factors below a certain threshold. Compared to the NFS, the ECM has a running time determined by the size of the smallest factor. Thus, if
p is the smallest factor, then the running time of the ECM is
Similarly to the NFS, Lenstra [
15] extrapolates the equivalent security provided by a module of size
with the smallest prime of size
to be
From Equations (
1) and (
2), we can deduce the following equivalency
A different model for predicting the security against the NFS and the ECM is provided in [
16]. Compared to Lenstra’s model, Brent uses known historical factoring records to predict the year a modulus of a given size will be factored. Using the least-squares fit, Brent obtains the following equation for the NFS
and for the ECM
where
is the number of digits of the factored modulus and
is the number of digits of the largest prime factor found using the ECM.
Using regression analysis, we update Brent’s equations using data points from [
17,
18,
19,
20,
21,
22,
23,
24,
25,
26,
27] for the NFS and from [
28,
29] for the ECM. These data points are presented in
Figure 1 and
Figure 2.
Therefore, the updated equation for the NFS is
and for the ECM
Equations (
4)–(
7) are presented in
Figure 3 and
Figure 4. Note that the black dots represent the acquired data points. We observe that in the case of the NFS the estimates are close, while in the case of the ECM the new estimate is more pessimistic from a security point of view. Using the updated estimates (Equations (
6) and (
7)), we obtain the following equivalency
According to NIST [
30], the recommended key sizes for composite modules are
. We preferred to use NIST recommendations instead of the ones from [
12,
13], since these key sizes are the ones used by the industry and the key sizes from [
12,
13] are criticized as being too conservative [
17]. Therefore, using Equations (
3) and (
8), we obtain the equivalent size of the smallest prime. The results are presented in
Table 2. Note that in the parentheses we provide the maximum number of prime factors that
n can have. Based on these equivalences, we obtain the parameters for the Joye–Libert schemes that offer protection against the NFS and the ECM (see
Table 3).
Due to a powerful attack by Coppersmith [
31], the size of
k must be upper bounded by
. Otherwise, the factors of
n can be found. We can easily see that the block sizes from
Table 3 offer a large enough security margin obtained from this bound (see
Table 4).
6.2. Complexity
Using the complexities provided in
Table 1, we compute the asymptotic run times of the decryption algorithm for each Joye–Libert variant. We also determine the size of a block
for each variant. The results are provided in
Table 5. Note that by parallel multiprime we mean the multiprime version in which we use a separate thread to compute each block
. We can easily see that for the parameters presented in
Table 3, the encryption and decryption complexities of the unbalanced and multiprime versions are similar. Therefore, we only compare the balanced, unbalanced and the parallel multiprime versions. In addition, remark that we choose the parameters such that the message spaces are similar for all the variants.
The comparison of the computational complexity of the three variants is presented in
Figure 5,
Figure 6 and
Figure 7. Note that the two sets of crosses for the multiprime version correspond to the two equivalence models: Lenstra—right side crosses and Regression—left side crosses. We also added a dotted red line in the case of the basic decryption (Algorithm 1), which represents the boundary of the optimized decryption algorithm (Algorithm 2) of the balanced version.
From the six plots, we can see that the parallel multiprime version always performs better than the (un)balanced version if multiple threads are available. Additionally, the more threads we use, the faster we recover the original message. Therefore, if additional memory is available and parallelization is possible, then the parallel multiprime version endowed with the optimized decryption algorithm is preferable. Nevertheless, if we only have access to parallelization, then the parallel multiprime version equipped with the basic decryption algorithm is the best choice. Otherwise, we should use the unbalanced variant.
6.3. Implementation Details
We further provide the reader with benchmarks for the three Joye–Libert PKE schemes. We ran each of the three sub-algorithms on a CPU Intel i7-4790 4.00 GHz and used GCC to compile it (with the O3 flag activated for optimization). Note that for all computations we used the GMP library [
32]. To calculate the running times we used the
omp_get_wtime() function [
33]. For the parallel multiprime variant we used the OMP library [
33] to parallelize encryption/decryption. To obtain the average running time in seconds we chose to encrypt 100
-bit messages. Therefore, we wanted to simulate a key distribution scenario. The results are provided in
Table 6. Note that the optimized version of the decryption algorithm is denoted by
Decrypt (opt).
We can see from
Table 6 that the conclusions presented in
Section 6.2 hold. We can also see that the multiprime version has the shortest time to generate the parameters, while the unbalanced version the longest time. Nevertheless, generating parameters is a one-time operation.
7. Conclusions
In this work, we introduced two novel versions of the Joye-Libert cryptosystem. The first one, called the unbalanced Joye–Libert PKE, lowers the size of p in order to decrease decryption time. The second one, called the multiprime Joye–Libert PKE, increases the number of factors and achieves better decryption times by using multiple threads. Therefore, if parallel threads are available, we recommend the multiprime version, otherwise, we recommend the unbalanced variant. If additional memory is available, then we can replace the basic decryption algorithm with the optimized version, and therefore, we can obtain even better decryption times.
Open Problem. In [
2], the authors manage to link the gap
-residuosity assumption to the quadratic residuosity assumption, when
, and to the quadratic residuosity and squared Jacobi symbols assumptions, when
. Therefore, it would be interesting to find a similar link for the
vqr assumption. The main bottleneck that we encountered when trying to link it to the
vqr is that the probability of choosing an element from
is
, and thus for
t elements the probability is
. Therefore, for practical values of
k and
t, this probability is negligible.