Anonymous Homomorphic IBE with Application to Anonymous Aggregation

Abstract

All anonymous identity-based encryption (IBE) schemes that are group homomorphic (to the best of our knowledge) require knowledge of the identity to compute the homomorphic operation. This paper is motivated by this open problem, namely to construct an anonymous group-homomorphic IBE scheme that does not sacrifice anonymity to perform homomorphic operations. Note that even when strong assumptions, such as indistinguishability obfuscation (iO), are permitted, no schemes are known. We succeed in solving this open problem by assuming iO and the hardness of the DBDH problem over rings (specifically, $Z_{N^2}$ for RSA modulus N). We then use the existence of such a scheme to construct an IBE scheme with re-randomizable anonymous encryption keys, which we prove to be IND-ID-RCCA secure. Finally, we use our results to construct identity-based anonymous aggregation protocols.

1. Introduction

The problem we tackle in this paper relates to a primitive known as identity-based group homomorphic encryption (IBGHE), which is defined in [1]. Basically, IBGHE is identity-based encryption that is homomorphic for some group operation, and the ciphertext space for every identity forms a group. Moreover, the decryption function is a group homomorphism between the ciphertext group and the plaintext group. GHE has several applications, discussed in [1], and an IBGHE facilitates those applications in an identity-based infrastructure.

It is an open problem to construct an IBGHE that is simultaneously anonymous and homomorphic for addition. There are only two IBGHE schemes that support modular addition to the best of our knowledge, namely the XOR-homomorphic variant of the Cocks IBE scheme in [1] and the more recent IBGHE scheme from [2] that is homomorphic for addition modulo smooth square-free integers. Now, Joye has discovered that the Cocks IBE scheme itself is XOR-homomorphic [3], but the scheme is not an IBGHE since the ciphertext space with the homomorphic operation forms a quasigroup and not a group. Some readers might wonder about schemes that are considered multiplicatively homomorphic, which allow addition in the exponent, and question why we do not classify them as IBGHE schemes for addition. The reason is that the corresponding additive group has exponential order, and decryption can only recover messages using Pollard’s lambda algorithm that are less than some polynomial bound, so the valid message space does not form an additive group. Now the two IBGHE schemes supporting modular addition that we are aware of are not anonymous, but there are variants of these schemes that achieve anonymity. However, although such schemes gain anonymity, they lose the homomorphic property. Most usually, we need to know the identity associated with a ciphertext in order to correctly compute the homomorphic operation, and so when the identity is hidden from us, as it is when the scheme is anonymous, we cannot compute the homomorphic operation. Therefore, in a nutshell, the open problem we address in this paper is to construct an IBGHE for addition that is anonymous while retaining the homomorphic operation. Note that while we have concentrated on GHE, it is important to point out that there are no other additively homomorphic schemes (such as quasigroup homomorphic schemes, such as Cocks, as observed by Joye) that achieve simultaneous anonymity and the ability to carry out the homomorphic operation without knowing the identity associated with a ciphertext. Of course, our focus is not on bounded homomorphisms, such as LWE-based schemes that incorporate noise, but instead on those with an algebraic structure and support for a theoretically unbounded number of operations. One of the reasons we opt for GHE over linearly homomorphic LWE-based schemes is that the former enjoy the desired property of strong unlinkability; that is, an evaluated ciphertext is distributed the same as a fresh ciphertext in the view of the key holder (recipient), whereas LWE-based schemes achieve this only by requiring an expensive bootstrapping operation and making a circular security assumption.

1.1. Motivation and Applications

Beyond theoretical interest, there are applications that motivate consideration of this open problem. We construct an anonymous IBE using an anonymous IBGHE as a building block. We prove this scheme $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$secure (note that RCCA is a slight relaxation of CCA2). Our anonymous IBE scheme has two interesting properties. First, it allows one to generate anonymous keys associated with a particular identity. Therefore, an encryptor can encrypt a message using an anonymous key for some unknown recipient. Secondly, such keys can be rerandomized such that the resulting anonymous key is computationally unlinkable to the original anonymous key. This finds an immediate application in anonymous aggregation, as we describe below.

Consider the following application scenario. Suppose we have a collection of sensor nodes that collect data and send it to a central server. Suppose the data are numerical measurements, and there are different recipients depending on external factors. Each sensor data encrypts a measurement with the recipient’s identity and sends it en route to the central server. It is desirable that ciphertexts that are seen by potential adversaries do not reveal the associated recipient’s identity. Along the route there are nodes that function as aggregators that can be authorized independently by each sensor node to aggregate the data coming from that sensor node. If a sensor node give authorization to the aggregator, then the aggregator should be able to aggregate data for the same recipient coming from any of the sensor nodes that have given authorization. Addition (summation) is a common type of aggregation since perhaps only an average measurement is needed by the recipient. To fulfill this application scenario, we need an IBE scheme that is anonymous and homomorphic for addition, where the homomorphic operation can be computed without knowing the recipient’s identity.

Consider two senders that produce ciphertexts for the recipient $\mathsf{id}$. Both of them send their respective authorization keys to an aggregator whose identity is $\overline{\mathsf{id}}$, they perform aggregation on the two ciphertexts and send the result on to a second aggregator. The second aggregator should not be able to perform aggregation with the result unless they are given an authorization key from $\overline{\mathsf{id}}$. However, the recipient should be able to decrypt all such ciphertexts intended for them, including the result of the aggregation. Now the issue is that the recipient’s identity is hidden from the aggregators. However, the result of their aggregation needs to be decryptable by the recipient $\mathsf{id}$ and also “fresh”, such that the second aggregator, who may be authorized by the original senders, but not authorized by the first aggregator, should not be able to perform aggregation on the result. We describe our approach to solving this problem below.

1.2. Our Results

We present a feasibility result in this work of an additively homomorphic IBGHE that is both anonymous and supports the evaluation of the homomorphic operation without knowing a user’s identity. Our construction is based on iO and the hardness of DDH in elliptic curves over ${\mathbb{Z}}_{N^2}$ where N is an RSA modulus. These are strong assumptions but we make headway on this open problem. Elliptic curves over rings have been less widely studied; Pailler [4] introduced the types of curves we use in this paper, which are over the ring ${\mathbb{Z}}_{N^2}$, while Peter et al. [5] describe a specific class of curves that are suitable to instantiate our construction. Furthermore, iO has not been realized from standard assumptions, although there have been several recent advances in constructing iO from quite different approaches under different assumptions, which gives us more confidence that iO exists. To obtain our feasibility result, we first borrow an idea from [6] to leverage obfuscation to map an identity string to a freshly generated public key of some encryption scheme. In fact, abstracting for a moment from the specific construction, we will describe the high-level paradigm. As part of the public parameters, we have an obfuscated program that maps an identity to a public key in some multi-user system with public parameters. The public keys in a multi-user system share the same set of common public parameters—think of the generator g and modulus p in ElGamal [7] as the common public parameters, except ElGamal is of no use here since it is only multiplicatively homomorphic. Nevertheless, ElGamal serves to illustrate another property that this paradigm requires, namely that the multi-user system supports key privacy where key privacy can be viewed as the analog to anonymity in the identity-based setting; that is, the ciphertexts in the multi-user system do not reveal the public key they are associated with, which is the case in ElGamal. We are using the term multi-user system in a broad sense here, permitting both the case where we have a trusted authority and the case where we do not. In the former, the public parameters are generated by a trusted authority with a backdoor (master secret key) such that the trusted authority can decrypt any ciphertext. In our paradigm, the public parameters of the multi-user system will be generated by the trusted authority of the IBE scheme and published as part of the IBE scheme’s public parameters. Therefore, we need the multi-user system to be both key-private and additively homomorphic, where the homomorphic operation can be computed without knowing the public key associated with a ciphertext. The fundamental question is: can we concretely realize a multi-user system that has both key privacy and an additive homomorphism. We can answer this question in the affirmative by using a variant of the Paillier scheme based on elliptic curves over rings that is presented in [5], which is a multi-user system supporting homomorphic addition modulo a large semiprime N and for which we can easily show that key privacy holds assuming the hardness of DDH in elliptic curves over ${\mathbb{Z}}_{N^2}$.

1.2.1. Anonymous IBE with Rerandomizable Anonymous Keys

Next, we present an anonymous IBE scheme based on the Boneh–Franklin scheme, which we prove $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$secure. Our scheme requires an additively homomorphic anonymous IBE scheme as a building block (as described above and which we realize in Section 3). Our anonymous IBE scheme has two interesting properties. First, it allows one to generate anonymous keys associated with a particular identity. Therefore, an encryptor can encrypt a message using an anonymous key for some unknown recipient. Secondly, such keys can be rerandomized such that the resulting anonymous key is computationally unlinkable to the original anonymous key. One of the applications for this scheme is in realizing identity-based anonymous aggregation in Section 5. This is the first IBE scheme that is both anonymous and $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$ secure.

1.2.2. Identity-Based Anonymous Aggregation

In an identity-based anonymous aggregation (IBAA) protocol, every identity has an associated secret key derivable by the Trusted Authority with their master secret key. Every identity can issue an authorization key to an aggregator that allows the aggregator to perform aggregation on ciphertexts created by that identity, but for any recipient identity. We envisage that, in practice, more complex policies may be used to control authorization, which is beyond the scope of this work. Here we simply model authorization with symmetric keys. Therefore, a symmetric key functions as an authorization key that can be issued to aggregators. For every ciphertext, the encryptor generates a fresh symmetric key $\kappa$ (effectively a session or transport key) and uses it to encrypt the IBE ciphertext that encrypts the message. This symmetric key $\kappa$ is encrypted with the authorization key for the sender so that any party who is given this key can recover the IBE ciphertext that encrypts the message. However, the recipient must always be able to decrypt a ciphertext intended for them, irrespective of whether it has been given an authorization key (for aggregation) by the encryptor. To solve this problem, the ciphertext also incorporates an IBE encryption of $\kappa$ so that the recipient can recover the IBE ciphertext that encrypts the message. One of the main challenges is in relation to aggregation. It is straightforward for the aggregator to evaluate the homomorphic operation on both IBE ciphertexts without knowing the recipient’s identity (anonymous group-homomorphic IBE enables this). However, we must use a fresh symmetric key to encrypt this evaluated IBE ciphertext in order to ensure unlinkability. However, how do we encrypt this fresh key with the recipient’s identity without knowledge of the identity so that they can decrypt the result of the aggregation? One solution to this is to use FHE and then rely on bootstrapping for unlinkability, but this requires us to make a circular security assumption, and, furthermore, bootstrapping in the identity-based settings requires strong assumptions, such as iO. Our solution is to use our anonymous IBE scheme with its rerandomizable anonymous keys (described above), and this solves all our problems (including strong unlinkability) while being more efficient than FHE and without the need for a circular security assumption. Furthermore, we rely on the $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$security to prove a desirable property of aggregation validity whereby no party who has not been granted authorization as an aggregator can perform a pre-determined transformation of the plaintext.

2. Preliminaries

2.1. Notation

A quantity is said to be negligible with respect to some parameter $\lambda$, written $\mathsf{negl}\left(\lambda \right)$, if it is asymptotically bounded from above by the reciprocal of all polynomials in $\lambda$.

For a probability distribution D, we denote by $x\leftarrow \$D$ that x is sampled according to D. If S is a set, $y\leftarrow \$S$ denotes that y is sampled from x according to the uniform distribution on S.

The support of a predicate $f:A\to \{0,1\}$ for some domain A is denoted by $\mathsf{supp}\left(f\right)$, and is defined by the set $\{a\in A:f(a)=1\}$.

The set of contiguous integers $\{1,\cdots ,k\}$ for some $k>1$ is denoted by $\left[k\right]$.

2.2. Identity-Based Encryption

Definition 1. 

An Identity-Based Encryption (IBE) scheme is a tuple of PPT algorithms $(G,K,E,D)$ defined with respect to a message space $\mathcal{M}$, an identity space $\mathcal{I}$ and a ciphertext space $\widehat{\mathcal{C}}$ as follows:

• $\mathsf{G}\left(1^{\lambda }\right)$:
  On input (in unary) of a security parameter λ, generates public parameters $\mathsf{PP}$ and a master secret key $\mathsf{MSK}$. Output $(\mathsf{PP},\mathsf{MSK})$.
• $\mathsf{K}(\mathsf{MSK},\mathsf{id})$:
  On input of the master secret key $\mathsf{MSK}$ and an identity $\mathsf{id}\in \mathcal{I}$: a secret key ${\mathsf{sk}}_{\mathsf{id}}$ for identity $\mathsf{id}$ is derived and output.
• $\mathsf{E}(\mathsf{PP},\mathsf{id},m)$:
  On input of public parameters $\mathsf{PP}$, an identity $\mathsf{id}\in \mathcal{I}$, and a message $m\in \mathcal{M}$, a ciphertext $c\in \mathcal{C}\subseteq \widehat{\mathcal{C}}$ that encrypts m under identity $\mathsf{id}$ is output.
• $\mathsf{D}({\mathsf{sk}}_{\mathsf{id}},c)$:
  On input of a secret key ${\mathsf{sk}}_{\mathsf{id}}$ for identity $\mathsf{id}\in \mathcal{I}$ and a ciphertext $c\in \widehat{\mathcal{C}}$, a $m^{\prime }$ is output if c is a valid encryption under identity $\mathsf{id}$; otherwise, a failure symbol ⊥ is output.

2.3. Public-Key GHE

An important subclass of partial homomorphic encryption is the class of public-key encryption schemes that admit a group homomorphism between their ciphertext space and plaintext space. This class corresponds to what is considered “classical” HE [8], where a single group operation is supported, most usually, addition. Gjøsteen [9] examined the abstract structure of these cryptosystems in terms of groups and characterized their security as relying on the hardness of a subgroup membership problem. Armknecht, Katzenbeisser and Peter [8] rigorously formalized the notion and called it group homomorphic encryption (GHE). We recap with the formal definition of GHE by Armknecht, Katzenbeisser and Peter [8].

Definition 2 

(GHE, Definition 1 in [8]). A public-key encryption scheme $\mathcal{E}=(G,E,D)$ is called group homomorphic, if for every $(\mathsf{pk},\mathsf{sk})\leftarrow G\left(1^{\lambda }\right)$, the plaintext space $\mathcal{M}$ and the ciphertext space $\widehat{\mathcal{C}}$ (written in multiplicative notation) are non-trivial groups such that

• the set of all encryptions $\mathcal{C}:=\{c\in \widehat{\mathcal{C}}\mid c\leftarrow E_{\mathsf{pk}}\left(m\right),m\in \mathcal{M}\}$ is a non-trivial subgroup of $\widehat{\mathcal{C}}$
• the restricted decryption $D_{\mathsf{sk}}^{*}:=D_{\mathsf{sk}|\mathcal{C}}$ is a group epimorphism (surjective homomorphism) i.e.,

  $$D_{\mathsf{sk}}^{*}\mathit{is}\mathit{surjective}\mathit{and}\forall c,c^{\prime }\in \mathcal{C}:D_{\mathsf{sk}}(c·c^{\prime })=D_{\mathsf{sk}}\left(c\right)·D_{\mathsf{sk}}\left(c^{\prime }\right)$$
• $\mathsf{sk}$ contains an efficient decision function $\delta :\widehat{\mathcal{C}}\to \{0,1\}$ such that

  $$\delta \left(c\right)=1\iff c\in \mathcal{C}$$
• the decryption on $\widehat{\mathcal{C}}\backslash \mathcal{C}$ returns the symbol ⊥.

2.4. Identity-Based Group Homomorphic Encryption (IBGHE)

Definition 3 

(Identity-Based Group Homomorphic Encryption (IBGHE), Based on [1]). Let $\mathcal{E}=(G,K,E,D)$ be an IBE scheme with message space $\mathcal{M}$, identity space $\mathcal{I}$ and ciphertext space $\widehat{\mathcal{C}}$. The scheme $\mathcal{E}$ is group homomorphic if, for every $(\mathsf{PP},\mathsf{MSK})\leftarrow G\left(1^{\lambda }\right)$, every $\mathsf{id}\in \mathcal{I}$, and every ${\mathsf{sk}}_{\mathsf{id}}\leftarrow K(\mathsf{MSK},\mathsf{id})$, the message space $(\mathcal{M},·)$ is a non-trivial group, and there is a binary operation $*:{\widehat{\mathcal{C}}}^2\to \widehat{\mathcal{C}}$ such that the following properties are satisfied for the restricted ciphertext space $\widehat{{\mathcal{C}}_{\mathsf{id}}}=\{c\in \widehat{\mathcal{C}}:D_{{\mathsf{sk}}_{\mathsf{id}}}\left(c\right)\ne \perp \}$:

GH.1: 

The set of all encryptions ${\mathcal{C}}_{\mathsf{id}}=\{c\mid c\leftarrow E(\mathsf{PP},\mathsf{id},m),m\in \mathcal{M}\}\subseteq \widehat{{\mathcal{C}}_{\mathsf{id}}}$ is a non-trivial group with respect to the operation *.

GH.2: 

The restricted decryption $D_{{\mathsf{sk}}_{\mathsf{id}}}^{*}:=D_{{\mathsf{sk}}_{\mathsf{id}}|{\mathcal{C}}_{\mathsf{id}}}$ is surjective

and $\forall c,c^{\prime }\in {\mathcal{C}}_{\mathsf{id}}{D}_{{\mathsf{sk}}_{\mathsf{id}}}(c*c^{\prime })=D_{{\mathsf{sk}}_{\mathsf{id}}}\left(c\right)·D_{{\mathsf{sk}}_{\mathsf{id}}}\left(c^{\prime }\right)$.

We are interested in schemes whose plaintext space forms a group and which allow the operation to be homomorphically applied an unbounded number of times. There exist schemes, however, that do not satisfy all the requirements of GHE, namely their ciphertext space does not form a group but instead forms a quasigroup (a group without associativity), such as the Cocks’ IBE [10], which was shown to be inherently XOR-homomorphic by Joye [3].

2.5. Multi-User Encryption

A multi-user encryption (MUE) scheme is an abstraction from a class of public-key encryption schemes where the public keys of users share common public parameters, whose generation may or may not include a trusted setup, in which case a Trusted Authority (TA) may hold a master decryption key that enables them to decrypt the ciphertexts of any user. An instance of MUE is ElGamal, which does not require a trusted setup or involve a Trusted Authority with a “backdoor”, whereas another instance of an MUE is a public-key encryption scheme with a double decryption mechanism (DD-PKE), as defined by Galindo and Herranz [11] where the public parameters are generated along with a master secret key by a TA.

An MUE is a tuple of PPT algorithms $(\mathsf{Setup},\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec},\mathsf{mDec})$ with plaintext space $\mathcal{M}$ and ciphertext space $\widehat{\mathcal{C}}$, defined as follows:

• $\mathsf{Setup}\left(1^{\lambda }\right)$: takes as input a security parameter $\lambda$ and outputs a pair $(\mathsf{PP},\mathsf{MSK})$ consisting of public parameters $\mathsf{PP}$ and an optional master secret key $\mathsf{MSK}$, which may be set to ⊥,
• $\mathsf{KeyGen}\left(\mathsf{PP}\right)$: takes as input the public parameters $\mathsf{PP}$ and outputs a pair of public/private keys $(\mathsf{pk},\mathsf{sk})$.
• $\mathsf{Enc}(\mathsf{PP},\mathsf{pk},m)$: takes as input the public parameters $\mathsf{PP}$, a user’s public key $\mathsf{pk}$ and a message $m\in \mathcal{M}$, and outputs a ciphertext $c\in \mathcal{C}\subseteq \widehat{\mathcal{C}}$.
• $\mathsf{Dec}(\mathsf{PP},\mathsf{sk},c)$: takes as input the public parameters $\mathsf{PP}$, a secret key $\mathsf{sk}$ and a ciphertext $c\in \widehat{\mathcal{C}}$, and outputs either a plaintext $m\in \mathcal{M}$ or ⊥ if decryption fails.
• $\mathsf{mDec}(\mathsf{PP},\mathsf{MSK},\mathsf{pk},c)$: takes as input the public parameters $\mathsf{PP}$, the master secret key $\mathsf{MSK}$, a user’s public key $\mathsf{pk}$ and a ciphertext $c\in \widehat{\mathcal{C}}$ and outputs either a plaintext $m\in \mathcal{M}$ or ⊥ if decryption fails or $\mathsf{MSK}=\perp$.

2.6. Elliptic Curves over Rings

Proposition 1 

([5]). If $N=pq$ is some RSA modulus, i.e., p and q are primes of about the same bit length λ, then there is an efficient construction of elliptic curves $E:y^{2}z=x^3+ax{z}^2+b{z}^3$ over ${\mathbb{Z}}_{N^2}$ such that $M:=\mathsf{lcm}(\#E\left({\mathbb{Z}}_p\right),\#E\left({\mathbb{Z}}_q\right))$ has at least two large (of about the same size as p and q) prime factors.

Lemma 1 

([5]). As in Proposition 1, let $M\in \mathbb{N}$ have at least two large prime factors (of about λ bits). If $\pi \left(M\right)$ denotes the product of all small prime factors of M, then

$${\mathsf{Pr}}_{s\leftarrow \$\mathrm{\Pi }\left(M\right)}\left[\mathsf{gcd}(s,M)\ne 1\right]\mathit{is}\mathit{negligible}\mathit{in}\lambda$$

where $\mathrm{\Pi }\left(M\right):=\{s\in {\mathbb{Z}}_{N^2}\backslash \left\{0\right\}|\mathsf{gcd}(s,\pi \left(M\right))=1\}$.

2.7. Indistinguishability Obfuscation

Definition 4 

(Indistinguishability Obfuscation).(Based on Definition 7 from ([12]) A uniform PPT machine $i\mathcal{O}$ is called an indistinguishability obfuscator for every circuit class $\left\{{\mathcal{C}}_{\kappa }\right\}$ if the following two conditions are met:

• Correctness: For every $\kappa \in \mathbb{N}$, for every $C\in {\mathcal{C}}_{\kappa }$, for every x in the domain of C, we have that

  $$Pr{C}^{\prime }\left(x\right)=C\left(x\right):C^{\prime }\leftarrow i\mathcal{O}\left(C\right)=1.$$
• Indistinguishability: For every $\kappa \in \mathbb{N}$, for all pairs of circuits $C_0,C_1\in {\mathcal{C}}_{\kappa }$, if $C_0\left(x\right)=C_1\left(x\right)$ for all inputs x, then for all PPT adversaries $\mathcal{A}$, we have:

  $$|Pr\mathcal{A}\left(i\mathcal{O}\left(C_0\right)\right)=1|-|Pr\mathcal{A}\left(i\mathcal{O}\left(C_1\right)\right)=1|\le \mathsf{negl}\left(\kappa \right).$$

2.8. Puncturable Pseudorandom Function

A puncturable pseudorandom function (PRF) is a constrained PRF $(\mathsf{Key},\mathsf{Eval})$ with an additional PPT algorithm $\mathsf{Puncture}$. Let $n(·)$ and $m(·)$ be polynomials. Our definition here is based on Section 2.5 of [6]. A PRF key K is generated with the PPT algorithm $\mathsf{Key}$, which takes as input the security parameter $\kappa$. The $\mathsf{Eval}$ algorithm is deterministic, and on input of a key K and an input string $x\in {\{0,1\}}^{n\left(\kappa \right)}$, outputs a string $y\in {\{0,1\}}^{m\left(\kappa \right)}$.

A puncturable PRF allows one to obtain a “punctured” key $K^{\prime }\leftarrow \mathsf{Puncture}(K,S)$ with respect to a subset of input strings $S\subset {\{0,1\}}^{n\left(\kappa \right)}$ with $\left|S\right|=\mathsf{poly}\left(\kappa \right)$. It is required that $\mathsf{Eval}(K,x)=\mathsf{Eval}(K^{\prime },x)\forall x\in {\{0,1\}}^{n\left(\kappa \right)}\backslash S$, and for any poly-bounded adversary $({\mathcal{A}}_1,{\mathcal{A}}_2)$ with $S\leftarrow {\mathcal{A}}_1\left(1^{\kappa }\right)\subset {\{0,1\}}^{n\left(\kappa \right)}$ and $\left|S\right|=\mathsf{poly}\left(\kappa \right)$, any key $K\leftarrow \mathsf{Key}\left(1^{\kappa }\right)$, any $K^{\prime }\leftarrow \mathsf{Puncture}(K,S)$ and any $x\in S$, it holds that

$$Pr{\mathcal{A}}_2(K^{\prime },x,\mathsf{Eval}(K,x))=1-Pr{\mathcal{A}}_2(K^{\prime },x,u)=1\le \mathsf{negl}\left(\kappa \right)$$

where $u\leftarrow \${\{0,1\}}^{m\left(\kappa \right)}$.

3. Construction of Anonymous Additively Homomorphic IBE

3.1. PKTK MUE Scheme

We now describe the cryptosystem from [5] that is an instance of an MUE and satisfies some interesting properties, including the fact that even the Trusted Authority cannot determine which user a ciphertext is created for (Property 3 [5]), so the scheme is anonymous even to the TA under the hardness of DDH in $E\left({\mathbb{Z}}_{N^2}\right)$. The scheme is very similar to Galbraith’s elliptic-curve-based Paillier scheme [13].

• $\mathsf{Setup}\left(1^{\lambda }\right):$ On input of a security parameter $\lambda$, this algorithm generates an RSA modulus $N=pq$ where p and q are primes of about the same bit length $\lambda$. Then it constructs an elliptic curve $E:y^{2}z=x^3+ax{z}^2+b{z}^3$ over ${\mathbb{Z}}_{N^2}$ such that E has the properties described in Proposition 1. Furthermore, it chooses a point $Q=(x,y,z)\in E\left({\mathbb{Z}}_{N^2}\right)$ whose order divides $M=\mathsf{lcm}(\#E\left({\mathbb{Z}}_p\right),\#E\left({\mathbb{Z}}_q\right))$. It outputs the public parameters $\mathsf{PP}:=(N,\pi (\left(M\right),a,b,Q)$ and the master secret key $\mathsf{MSK}:=M$. The plaintext space is $\mathcal{M}={\mathbb{Z}}_N$, and the ciphertext space is $\widehat{\mathcal{C}}=\langle Q\rangle \times \langle Q,{\mathcal{M}}_1\rangle$.
• $\mathsf{KeyGen}\left(\mathsf{PP}\right)$: chooses $s\leftarrow \${\mathbb{Z}}_M^{*}$ at random (This can be performed by sampling $s\leftarrow \$\mathrm{\Pi }\left(M\right)$ (which is possible as $\pi \left(M\right)$ is included in $\mathsf{PP}$)) and computes $R\leftarrow sQ$. It outputs public key $\mathsf{pk}:=R$ and secret key $\mathsf{sk}:=s$.
• $\mathsf{Enc}(\mathsf{PP},\mathsf{pk},m)$: chooses a random value $r\leftarrow \${\mathbb{Z}}_{N^2}$ and computes the ciphertext $(A,B)$ as

  $$A\leftarrow rQ\mathrm{and}B\leftarrow rR+{\mathcal{M}}_m.$$
• $\mathsf{Dec}(pp,\mathsf{sk},(A,B\left)\right)$: outputs

  $$m\leftarrow \frac{x(B-sA)}{N}.$$
• $\mathsf{mDec}(\mathsf{PP},\mathsf{MSK},(A,B)):$ outputs

  $$m\leftarrow \frac{x\left(MB\right)}{N}{M}^{-1}modN.$$

3.2. Our Scheme

Our scheme is essentially the transformation in [6] applied to the MUE scheme above. We need to define a program $F_{\mathsf{MapPK}}$ that is obfuscated as part of the public parameters. Let $\mathcal{E}$ be an MUE scheme such as the PKTK scheme above, which has message space ${\mathbb{Z}}_N$. The program $F_{\mathsf{MapPK}}$ takes an identity $\mathsf{id}$ and maps it to the public key ${\mathsf{pk}}_{\mathsf{id}}$.

Program $F_{\mathsf{MapPK}}\left(\mathsf{id}\right):$

1.   Compute $r_{\mathsf{id}}\leftarrow \mathsf{PRF}.\mathsf{Eval}(K,\mathsf{id})$.

2.   Compute $({\mathsf{pk}}_{\mathsf{id}},{\mathsf{sk}}_{\mathsf{id}})\leftarrow \mathcal{E}.\mathsf{KeyGen}({\mathsf{PP}}_{\mathcal{E}};r_{\mathsf{id}})$.

3.   Output  ${\mathsf{pk}}_{\mathsf{id}}$

Let $\mathcal{E}$ be the PKTK MUE scheme. Let $i\mathcal{O}$ be an indistinguishability obfuscator and let $\mathsf{PRF}$ be a puncturable PRF. We now define the construction.

• $\mathsf{AH}.\mathsf{Setup}\left(1^{\lambda }\right):$ On input of security parameter $\lambda$, compute $({\mathsf{PP}}_{\mathcal{E}},{\mathsf{MSK}}_{\mathcal{E}})\leftarrow \mathcal{E}.\mathsf{Setup}\left(1^{\lambda }\right)$. Next, generate $K\leftarrow \mathsf{PRF}.\mathsf{Gen}\left(1^{\lambda }\right)$ and compute $\mathcal{O}\leftarrow i\mathcal{O}\left(F_{{\mathsf{MapPK}}_{{\mathsf{PP}}_{\mathcal{E}},K}}\right)$. Output $(\mathsf{PP}:=(\mathcal{O},{\mathsf{PP}}_{\mathcal{E}}),\mathsf{MSK}:=(K,{\mathsf{MSK}}_{\mathcal{E}})$.
• $\mathsf{AH}.\mathsf{KeyGen}(\mathsf{MSK},\mathsf{id}):$ On input of master secret key $\mathsf{MSK}:=(K,{\mathsf{MSK}}_{\mathcal{E}})$ and an identity $\mathsf{id}$, compute $r_{\mathsf{id}}\leftarrow \mathsf{PRF}.\mathsf{Eval}(K,\mathsf{id})$. Next, generate $({\mathsf{pk}}_{\mathsf{id}},{\mathsf{sk}}_{\mathsf{id}})\leftarrow \mathcal{E}.\mathsf{KeyGen}({\mathsf{PP}}_{\mathcal{E}};r_{\mathsf{id}})$. Output ${\mathsf{sk}}_{\mathsf{id}}$.
• $\mathsf{AH}.\mathsf{Enc}(\mathsf{PP},\mathsf{id},m):$ On input of public parameters $\mathsf{PP}$, an identity $\mathsf{id}$ and a message $m\in {\mathbb{Z}}_N$, obtain ${\mathsf{pk}}_{\mathsf{id}}\leftarrow \mathcal{O}\left(\mathsf{id}\right)$ and compute $c\leftarrow \mathcal{E}.\mathsf{Enc}({\mathsf{PP}}_{\mathcal{E}},{\mathsf{pk}}_{\mathsf{id}},m)$. Output c.
• $\mathsf{AH}.\mathsf{Dec}({\mathsf{sk}}_{\mathsf{id}},c)$: On input of a secret key ${\mathsf{sk}}_{\mathsf{id}}$ for identity $\mathsf{id}$, compute $m\leftarrow \mathcal{E}.\mathsf{Dec}({\mathsf{PP}}_{\mathcal{E}},{\mathsf{sk}}_{\mathsf{id}},c)$ and output m.

Theorem 1. 

Assuming indistinguishability obfuscation and the hardness of DDH in $E\left({\mathbb{Z}}_{N^2}\right)$, AH is an anonymous and IND-ID-CPA secure IBE scheme.

Proof. 

The theorem follows as a consequence of Theorem 1 in [6], where the underlying public-key encryption scheme is replaced with the PKTK MUE scheme whose key privacy and semantic security rely on the hardness of DDH in $E\left({\mathbb{Z}}_{N^2}\right)$.    □

This simple construction serves mainly as a possible result for an anonymous homomorphic IBE where the homomorphic operation can be computed without knowing the identity associated with one or more ciphertexts. We leave the construction of more efficient and perhaps even practical schemes of this nature as an open problem.

4. Anonymous IBE with Rerandomizable Anonymous Encryption Keys

In this section, we present an anonymous IBE scheme that is a variant of Boneh–Franklin and show that it is both anonymous and $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$secure. The scheme has two interesting properties: the generation of anonymous keys associated with a particular recipient identity and the rerandomization of such keys. In regard to the former, anonymous keys allow a party to encrypt a message for an unknown recipient; that is, the key hides the identity of the recipient. In regard to the rerandomization of these keys, a rerandomized key is computationally unlinkable to another anonymous key with the same associated identity. Therefore, two anonymous keys for the same identity, where one is obtained by rerandomizing the other, cannot be linked in any way. These properties are essential in our application of anonymous aggregation in the next section. Here, we observe that an essential building block of our construction is an anonymous homomorphic IBE for addition modulo N as realized in the previous section. In fact, an anonymous homomorphic IBE from LWE does not suffice here; a group homomorphic scheme appears to be necessary.

4.1. Our Construction

Let $g\in \mathbb{G}$ be a generator of a cyclic group $\mathbb{G}$, and let $g_T\in {\mathbb{G}}_T$ be a generator of another cyclic group ${\mathbb{G}}_T$. Both groups are of order N, a large semiprime. Now let $e:\mathbb{G}\times \mathbb{G}\to {\mathbb{G}}_T$ be a non-degenerate bilinear map between $\mathbb{G}$ and ${\mathbb{G}}_T$ (the target group) such that $g_T=e(g,g)$. The notational convention we follow in this section is to write group elements using uppercase letters whose integer exponent with respect to the generator is the corresponding lowercase letter. Our construction is based around the Boneh–Franklin scheme. We now describe our construction, which serves to illustrate various concepts we would like to establish. Let H be a hash function modeled as a random oracle that maps identity strings to elements of $\mathbb{G}$. The master secret key contains an integer $s\leftarrow \${\mathbb{Z}}_N$ chosen at setup while the public parameters contain $S\leftarrow g^s$. The other building blocks are an anonymous group homomorphic IBE scheme ${\mathcal{E}}_m$ that is homomorphic for addition modulo N, a NIZK and an IND-CCA2 secure symmetric encryption scheme. Consider a recipient identity $\mathsf{id}$. Then we derive the public key for $\mathsf{id}$ as $A\leftarrow H\left(\mathsf{id}\right)\in \mathbb{G}$. The encryptor chooses a random integer $r\leftarrow \${\mathbb{Z}}_N$ and computes $\widehat{A}\leftarrow A^r$. Then they compute ${\psi }_1\leftarrow {\mathcal{E}}_m.\mathsf{Enc}({\mathsf{PP}}_{\mathsf{IBE}},\mathsf{id},r)$ and $z_1\leftarrow {\mathcal{E}}_m.\mathsf{Enc}({\mathsf{PP}}_{\mathsf{IBE}},\mathsf{id},1_{\mathcal{M}})$. Subsequently, the encryptor chooses a random integer $b\leftarrow \${\mathbb{Z}}_N$ and computes $B\leftarrow g^b$ and ${\psi }_2\leftarrow \mathsf{PKE}.\mathsf{Enc}({\mathsf{pk}}_T,b;\rho )$ for some randomness $\rho$. Finally, the encryptor generates a NIZK proof $\pi$ that ${\psi }_2$ encrypts the discrete logarithm of B with respect to base g. We derive the symmetric key $k\leftarrow e({\widehat{A}}^b,S)\in {\mathbb{G}}_T$ and encrypt the message with the symmetric encryption scheme using the key k.

In the real mode, a decryptor with a secret key ${\mathsf{sk}}_{\mathsf{id}}:=(S_{\mathsf{id}}:=A^s,{\mathsf{sk}}_{\mathsf{IBE},\mathsf{id}}\leftarrow {\mathcal{E}}_m.\mathsf{KeyGen}({\mathsf{MSK}}_{\mathsf{IBE}},\mathsf{id}))$ for identity $\mathsf{id}$, computes $r\leftarrow {\mathcal{E}}_m.\mathsf{Dec}({\mathsf{sk}}_{\mathsf{id}},{\psi }_1)$ and $k\leftarrow e{(B,S_{\mathsf{id}})}^r\in {\mathbb{G}}_T$. In the security proof, when we do not have access to $S_{\mathsf{id}}$, we alternatively derive k as follows. First, we decrypt ${\psi }_2$ with the trapdoor secret key to obtain b then we compute $k\leftarrow e({\widehat{A}}^b,S)\in {\mathbb{G}}_T$.

To generate an anonymous key for an identity, consider the following algorithm:

• $\mathsf{GenAnonKey}(\mathsf{PP},\mathsf{id})$:

  –

  $r\leftarrow \${\mathbb{Z}}_N$

  –

  $\psi \leftarrow {\mathcal{E}}_m.\mathsf{Enc}({\mathsf{PP}}_{\mathsf{IBE}},\mathsf{id},r)$

  –

  $z\leftarrow {\mathcal{E}}_m.\mathsf{Enc}({\mathsf{PP}}_{\mathsf{IBE}},\mathsf{id},1_{\mathcal{M}})$

  –

  $A\leftarrow H\left(\mathsf{id}\right)$

  –

  $\widehat{A}\leftarrow A^r$

  –

  Return $\mathsf{AnK}:=(\widehat{A},\psi ,z)$

An anonymous key $\mathsf{AnK}$ lets a party encrypt messages for an unknown intended recipient, which is computationally hidden from the party.

To rerandomize an $\mathsf{AnK}$ generated as above, the following algorithm is used:

• $\mathsf{RerandomizeKey}(\mathsf{PP},\mathsf{AnK})$:

  –

  Parse $\mathsf{AnK}$ as $(\widehat{A},\psi ,z)$

  –

  $r^{\prime }\leftarrow \${\mathbb{Z}}_N$

  –

  ${\widehat{A}}^{\prime }\leftarrow {\widehat{A}}^{r^{\prime }}$

  –

  $u_1,u_2\leftarrow \${\mathbb{Z}}_N$

  –

  ${\psi }^{\prime }\leftarrow {\psi }^{r^{\prime }}*z^{u_1}$

  –

  $z^{\prime }\leftarrow z^{u_2}$

  –

  Return ${\mathsf{AnK}}^{\prime }:=({\widehat{A}}^{\prime },{\psi }^{\prime },z^{\prime })$

The advantage of $\mathsf{RerandomizeKey}$ is that given an anonymous key derived with this algorithm from an original anonymous key; no party can link the keys and determine that they are related (i.e., have the same intended recipient). The anonymous key is preprended to every ciphertext generated with it, so, therefore, it is advantageous to rerandomize it so ciphertexts are not linked to each other.

We present the scheme formally now. Note that the encryption algorithm may alternatively accept an anonymous key $\mathsf{AnK}$ as input instead of a recipient identity.

Algorithm 1 formally describes the scheme.

4.2. Security

The scheme cannot be proved IND-ID-CCA2 secure in the conventional sense because the $\mathsf{AnK}$ portion of the ciphertext is malleable, and so too is the NIZK proof potentially (unless a non-malleable NIZK is used). We can, however, prove the scheme secure against an adaptive chosen ciphertext attack in a relaxed model, namely the notion $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$.

Theorem 2. 

Assuming ${\mathcal{E}}_m$ is IND-ID-CPA secure, $\mathsf{PKE}$ is IND-CPA secure and $\mathsf{NIZK}$ is a sound and zero-knowledge NIZK, then our scheme is $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$secure under the hardness of DBDH in the random oracle model.

Algorithm 1 Our IBE scheme with rerandomizable anonymous keys.

Setup $\left(1^{\lambda }\right)$       $({\mathsf{PP}}_{\mathsf{IBE}},{\mathsf{MSK}}_{\mathsf{IBE}})\leftarrow {\mathcal{E}}_m.\mathsf{Setup}\left(1^{\lambda }\right)$       $({\mathsf{pk}}_T,{\mathsf{sk}}_T)\leftarrow \mathsf{PKE}.\mathsf{Gen}\left(1^{\lambda }\right)$       $H\leftarrow \$\mathcal{H}$       $s\leftarrow \${\mathbb{Z}}_N$       $S\leftarrow g^s$       $\mathsf{CRS}\leftarrow \mathsf{NIZK}.\mathsf{CRSGen}\left(1^{\lambda }\right)$       Return $(\mathsf{PP}:=(H,S,{\mathsf{PP}}_{\mathsf{IBE}},{\mathsf{pk}}_T,\mathsf{CRS}),\mathsf{MSK}:=(K,s,{\mathsf{MSK}}_{\mathsf{IBE}},{\mathsf{sk}}_T))$    $\mathsf{KeyGen}(\mathsf{MSK},\mathsf{id})$       $A\leftarrow H\left(\mathsf{id}\right)$       $S_{\mathsf{id}}\leftarrow A^s$       ${\mathsf{sk}}_{\mathsf{IBE},\mathsf{id}}\leftarrow {\mathcal{E}}_m.\mathsf{KeyGen}({\mathsf{MSK}}_{\mathsf{IBE}},\mathsf{id})$       Return ${\mathsf{sk}}_{\mathsf{id}}:=(S_{\mathsf{id}},{\mathsf{sk}}_{\mathsf{IBE},\mathsf{id}})$    $\mathsf{Enc}(\mathsf{PP},\mathsf{id},m)$       $r\leftarrow \${\mathbb{Z}}_N$       ${\psi }_1\leftarrow {\mathcal{E}}_m.\mathsf{Enc}({\mathsf{PP}}_{\mathsf{IBE}},\mathsf{id},r)$       $z\leftarrow {\mathcal{E}}_m.\mathsf{Enc}({\mathsf{PP}}_{\mathsf{IBE}},\mathsf{id},1_{\mathcal{M}})$       $A\leftarrow H\left(\mathsf{id}\right)$       $\widehat{A}\leftarrow A^r$       $b\leftarrow \${\mathbb{Z}}_N$       $B\leftarrow g^b$       $\rho \leftarrow \${\{0,1\}}^{{\ell }_{\rho }}$ // where ${\ell }_{\rho }$ is the          length of randomness required for $\mathsf{PKE}.\mathsf{Enc}$       ${\psi }_2\leftarrow \mathsf{PKE}.\mathsf{Enc}({\mathsf{pk}}_T,b;\rho )$       $\pi \leftarrow \mathsf{NIZK}.\mathsf{Prove}(\mathsf{CRS},(g,B,{\mathsf{pk}}_T,{\psi }_2),(b,\rho ))$          // the NIZK uses relation R (below)       $k\leftarrow e({\widehat{A}}^b,S)$       ${\psi }_3\leftarrow \mathsf{SKE}.\mathsf{Enc}(k,{\psi }_1\Vert m)$       Return $c:=(\widehat{A},{\psi }_1,z,B,{\psi }_2,\pi ,{\psi }_3)$    $\mathsf{Dec}({\mathsf{sk}}_{\mathsf{id}},c)$       $(S_{\mathsf{id}},{\mathsf{sk}}_{\mathsf{IBE},\mathsf{id}})\leftarrow {\mathsf{sk}}_{\mathsf{id}}$       $(\widehat{A},{\psi }_1,z,B,{\psi }_2,\pi ,{\psi }_3)\leftarrow c$       If $\mathsf{NIZK}.\mathsf{Verify}(\mathsf{CRS},(g,B,{\mathsf{pk}}_T,{\psi }_2),\pi )\ne 1$          Return ⊥       $r\leftarrow {\mathcal{E}}_m.\mathsf{Dec}({\mathsf{sk}}_{\mathsf{IBE},\mathsf{id}},{\psi }_1)$       $If\widehat{A}\ne A^r$           Return ⊥       $k\leftarrow e{(S_{\mathsf{id}},B)}^r$       Return $\mathsf{SKE}.\mathsf{Dec}(k,{\psi }_3)$    Relation $R(\mathsf{stmt}:=(g,B,{\mathsf{pk}}_T,{\psi }_2),w:=(b,\rho ))$       Return $B=g^b\wedge {\psi }_2=\mathsf{PKE}.\mathsf{Enc}({\mathsf{pk}}_T,b;\rho )$

Proof. 

We prove the theorem by means of a hybrid argument. We start with a real system that encrypts the first challenge message $m_0$, and move to a hybrid that encrypts the second challenge message $m_1$.

• Hybrid 0: This is the real system that encrypts the challenge message $m_0$. Let k be the symmetric key used to produce the symmetric ciphertext ${\psi }_3$.
• Hybrid 1: The change we make in this hybrid is to how ${\psi }_1$ is generated. Instead of encrypting randomness r, we choose another uniform random element s and produce ${\psi }_1$ as an IBE encryption of s. We still use the previous symmetric key k to produce ${\psi }_3$, which is a symmetric encryption of ${\psi }_1\Vert m_0$.

  The indistinguishability between Hybrids 0 and 1 follows from the semantic security of the ${\mathcal{E}}_m$. In the reduction, we use the “trapdoor” mode discussed earlier to derive the symmetric key; that is, for a typical ciphertext, we decrypt ${\psi }_{!}$ to obtain b and compute $e{(\widehat{A},S)}^b$. When we decrypt ${\psi }_3$, we check if the first component of the plaintext matches ${\psi }_1$; otherwise, we output ⊥. Secondly, if the second component is $m_0$ or $m_1$, we output “test” as is required in IND-ID-RCCA. If the ciphertext we gave the adversary is queried for decryption, then we also output “test”.

• Hybrid 2: The change we make in this hybrid is to how ${\psi }_1$ is generated. We compute it instead as an encryption of some uniformly random element $z\ne b$ but still use k (as in the previous hybrid) to produce ${\psi }_3$.

  Hybrids 1 and 2 are indistinguishable from the IND-CCA2 security of PKE. In the reduction, we return the original approach (i.e., the “real” mode) to compute the symmetric key.

• Hybrid 3: The change we make in this hybrid is to generate the symmetric key uniformly at random.

  The indistinguishability of Hybrids 2 and 3 follows from the hardness of DBDH.

• Hybrid 4: In this hybrid, we change how ${\psi }_3$ is produced. Instead of encrypting ${\psi }_1\Vert m_0$, we encrypt ${\psi }_1\Vert m_1$.  

  The indistinguishability of Hybrids 3 and 4 follows from the iND-CCA2 security of the symmetric encryption scheme. We are now in a hybrid where the second challenge message $m_1$ is encrypted. The remaining hybrids reverse the changes in Hybrids 1–3 until we arrive at a hybrid that is the real system that encrypts the challenge message $m_1$. This completes our proof.    □

Corollary 1. 

Assuming ${\mathcal{E}}_m$ is an IND-ID-CPA secure anonymous IBE, then our scheme is anonymous.

This is an immediate consequence of the semantic security and anonymity of ${\mathcal{E}}_m$.

5. Identity-Based Anonymous Aggregation

In an identity-based anonymous aggregation protocol, a collection of nodes encrypt data for different recipients and forward them to their neighbors. The intended recipient, along with an aggregator, is able to extract the following grouping, functional unit or “package”, comprising the tuple $(h,v,z)$, which we define momentarily. Let $\mathcal{E}$ be an anonymous IBGHE scheme (such as AH in Section 3), and let H be a collision-resistant function. Furthermore, let $\mathsf{id}$ be the recipient’s identity. Then we have $h=H\left(\mathsf{id}\right)$, $v\leftarrow \mathcal{E}.\mathsf{Enc}({\mathsf{PP}}_{\mathcal{E}},\mathsf{id},m)$ and $z\leftarrow \mathcal{E}.\mathsf{Enc}({\mathsf{PP}}_{\mathcal{E}},\mathsf{id},\mathfrak{0})$. For two such tuples, $c:=(h,v,z)$ and $c^{\prime }:=(h^{\prime },v^{\prime },z^{\prime })$, the aggregation algorithm is defined in Algorithm 2.

Algorithm 2 Aggregation algorithm in P-type setting.

$\mathsf{Agg}.\mathsf{Aggregate}(c,c^{\prime })$.       $(h,v,z)\leftarrow c$       $(h^{\prime },v^{\prime },z^{\prime })\leftarrow c^{\prime }$       If $h\ne h^{\prime }$:          Output ⊥       $s_1,s_2\leftarrow \${\mathbb{Z}}_N$       $v^{″}\leftarrow v*v^{\prime }*z^{s_1}$       $z^{″}\leftarrow z^{s_2}$       Return $c^{″}:=(h^{″}:=h,v^{″},z^{″})$

The hash of the recipient’s identity h allows an aggregator to determine whether two ciphertexts have the same intended recipient, in which case, the hash components are equal, and aggregation can be performed; otherwise, aggregating both ciphertexts would produce an invalid result. With this approach, we obtain one-way anonymity. The v component is an $\mathcal{E}$ encryption under the recipient’s identity of the plaintext value. For the sake of simplicity, we are assuming the plaintext space is $\mathcal{M}:={\mathbb{Z}}_N$. For referential convenience, we designate this type of scheme P-type.

Now, an alternative approach is to exclude the hash component from this tuple such that an aggregator cannot learn anything about the recipient’s identity, nor can it determine whether two ciphertexts have the same recipient. As such, aggregation is always performed, but we need some way for the decryptor to establish whether a ciphertext is valid or has been likely contaminated through aggregation with a different identity. A solution to this emerges when the plaintext space is exponentially large, as is the case here. The idea is to include additional encryption $\overline{v}$ of $-m$ where the underlying plaintext of v is m such that $v*\overline{v}$ decrypts to zero (or $1_{\mathcal{M}}$, the identity element). The decryptor discards a ciphertext as invalid if $v*\overline{v}$ does not decrypt to zero. Homomorphically adding (pairwise) a pair of ciphertexts $(v^{\prime },{\overline{v}}^{\prime })$ associated with another identity results in a pair of encryptions of random values in ${\mathbb{Z}}_N$. Therefore, the resulting ciphertext will be rejected as invalid by the decryptor with overwhelming probability. For referential convenience, we designate this type of scheme F-type. The aggregation algorithm for this type is shown in Algorithm 3.

Algorithm 3 Aggregation algorithm in F-type setting.

$\mathsf{Agg}.\mathsf{Aggregate}(c,c^{\prime })$.       $(v,\overline{v},z)\leftarrow c$       $(v^{\prime },{\overline{v}}^{\prime },z^{\prime })\leftarrow c^{\prime }$       $s_1,s_2,s_3\leftarrow \${\mathbb{Z}}_N$       $v^{″}\leftarrow v*v^{\prime }*z^{s_1}$       ${\overline{v}}^{″}\leftarrow \overline{v}*{\overline{v}}^{\prime }*z^{s_2}$       $z^{″}\leftarrow z^{s_3}$       Return $c^{″}:=(v^{″},{\overline{v}}^{″},z^{″})$

Since any party who obtains the ciphertext tuple as above can modify the underlying plaintext (malleability), we may wish to restrict this ability to a subset of authorized parties, which we refer to as aggregators. While a suitable means of access control for granting such authorization to aggregators is beyond the scope of this work (e.g., ABE and related primitives may be of import), we describe a simplified paradigm that can be adapted and extended as required. Typically, we would expect the ciphertext tuple above to be encrypted with a non-malleable encryption scheme, such as an IND-CCA2 secure symmetric-key encryption scheme denoted by $\mathsf{SKE}$. Moreover, a random symmetric key $\kappa$ is first generated, and the tuple c is then encrypted, i.e., we have $\psi \leftarrow \mathsf{SKE}.\mathsf{Enc}(\kappa ,c)$. The natural question is, then, how does one obtain $\kappa$? Note that both authorized aggregators and the recipient must be able to access $\kappa$. First, an appropriate means of access control can be employed to allow authorized aggregators to access $\kappa$, a subject that, as aforementioned, is outside the scope of this work. Secondly, and most importantly, the intended recipient must be able to access $\kappa$. The challenge arises for intermediate aggregators who need to encrypt a fresh $\kappa$ under the recipient’s identity, which is hidden from them due to the desired property of anonymity. It is apparent from the proof of aggregation validity that the IBE scheme in which $\kappa$ is encrypted must be secure against adaptive chosen ciphertext attacks. Aggregation validity is a property that is defined in the next section and informally means that no efficient adversary who is given an encryption of a message m and who is neither an authorized aggregator nor the intended recipient can produce a valid ciphertext that encrypts a targeted modification of m, that is, $t·m$ for some a priori decided $t\ne 1_{\mathcal{M}}$.

We now formalize the identity-based anonymous aggregation (IBAA) in a simplified form where the authorization of aggregators is based on symmetric encryption, which is sufficient for our purposes, but we note this may be replaced with a more complex form of access control accommodated by a more generalized definition.

Definition 5. 

An identity-based anonymous aggregation (IBAA) protocol $\mathcal{P}$ consists of the following PPT algorithms:

• $\mathsf{Setup}\left(1^{\lambda }\right)$: On input of a security parameter λ, generate public parameters $\mathsf{PP}$ and master secret key $\mathsf{MSK}$. Output $(\mathsf{PP},\mathsf{MSK})$.
• $\mathsf{KeyGen}(\mathsf{MSK},\mathsf{id})$: On input of a master secret key $\mathsf{MSK}$ and an identity $\mathsf{id}$, output a secret key ${\mathsf{sk}}_{\mathsf{id}}$ for identity $\mathsf{id}$.
• $\mathsf{Authorize}\left({\mathsf{sk}}_{\widetilde{\mathsf{id}}}\right)$: On input of a secret key ${\mathsf{sk}}_{\widetilde{\mathsf{id}}}$ for identity $\widetilde{\mathsf{id}}$, output an authorization key that permits aggregation on ciphertexts generated by a source (sender) with identity $\widetilde{\mathsf{id}}$.
• $\mathsf{Enc}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{\mathsf{id}}},\mathsf{id},m)$: On input of public parameters $\mathsf{PP}$, a secret key for the source (sender) ${\mathsf{sk}}_{\widetilde{\mathsf{id}}}$ whose identity is $\widetilde{\mathsf{id}}$, a recipient identity $\mathsf{id}$ and message $m\in \mathcal{M}$, produce a ciphertext c that encrypts m under identity $\mathsf{id}$ and output c.
• $\mathsf{Dec}({\mathsf{sk}}_{\mathsf{id}},c)$: On input of a secret key ${\mathsf{sk}}_{\mathsf{id}}$ for identity $\mathsf{id}$ and a ciphertext c, output a message $m\in \mathcal{M}$ if c is a valid ciphertext for identity $\mathsf{id}$; otherwise, output⊥.
• $\mathsf{Aggregate}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{\mathsf{id}}},({\mathsf{ak}}_1,c_1),({\mathsf{ak}}_2,c_2))$: On input of public parameters $\mathsf{PP}$, the aggregator’s secret key ${\mathsf{sk}}_{\widetilde{\mathsf{id}}}$ for their identity $\widetilde{\mathsf{id}}$ and two ciphertexts $c_1$ and $c_2$ with corresponding authorization keys ${\mathsf{ak}}_1$ and ${\mathsf{ak}}_2$ (it may be the case that ${\mathsf{ak}}_1={\mathsf{ak}}_2$) that permit aggregation, if ${\mathsf{ak}}_1$ permits aggregation on $c_1$ and ${\mathsf{ak}}_2$ permits aggregation on $c_2$, then output $c^{\prime }$ such that $\mathsf{Dec}({\mathsf{sk}}_{\mathsf{id}},c^{\prime })=\mathsf{Dec}({\mathsf{sk}}_{\mathsf{id}},c_1)*\mathsf{Dec}({\mathsf{sk}}_{\mathsf{id}},c_2)$ for some operation * (typically for an abelian group). Otherwise, output ⊥. Additionally, in order to perform aggregation on $c^{\prime }$, a party needs an authorization key from $\widetilde{\mathsf{id}}$.

This primitive is very similar to homomorphic IBE, except there are a few notable differences. First, only senders who are authorized by the TA can encrypt messages, which can be decrypted by the recipient if they have received a secret key from the TA for their identity. Secondly, aggregation is possible on a sender’s ciphertext only if the aggregator has received an authorization key from the sender.  

Correctness: 

For$i\in \{1,2\}$, all$(\mathsf{PP},\mathsf{MSK})\leftarrow \mathsf{Setup}\left(1^{\lambda }\right)$, all identities ${\mathsf{id}}_i^{*}\in \mathcal{I}$(senders), $\overline{\mathsf{id}}\in \mathcal{I}$(aggregator) and$\mathsf{id}\in \mathcal{I}$(recipient), all ${\mathsf{sk}}_{{\mathsf{id}}_i^{*}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},{\mathsf{id}}_i^{*})$, all ${\mathsf{sk}}_{\overline{\mathsf{id}}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},\overline{\mathsf{id}})$, all ${\mathsf{sk}}_{\mathsf{id}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},\mathsf{id})$, all $m_i\in \mathcal{M}$, all $c_i\leftarrow \mathsf{Enc}(\mathsf{PP},{\mathsf{id}}_i^{*},\mathsf{id},m_i)$ and any ${\mathsf{ak}}_i$, then

$$\mathsf{Dec}({\mathsf{sk}}_{\mathsf{id}},\mathsf{Aggregate}(\mathsf{PP},{\mathsf{sk}}_{\overline{\mathsf{id}}},({\mathsf{ak}}_1,c_1),({\mathsf{ak}}_2,c_2)))=m_1*m_2$$

iff  ${\mathsf{ak}}_i\in \mathsf{Authorize}\left({\mathsf{sk}}_{{\mathsf{id}}_i^{*}}\right)$(except with negligible probability) where$\mathcal{I}$is the identity space. More precisely, the second part of the iff in the above condition is actually a security condition, which we now treat on its own.

Definition 6. 

An IBAA scheme is said to satisfy (selective) aggregation validity if for all $t\ne \mathfrak{0}\in \mathcal{M}$, the advantage of any PPT adversary $\mathcal{A}=({\mathcal{A}}_1,{\mathcal{A}}_2)$ is negligible in the security parameter where the advantage is defined as follows:

$$\begin{array}{ccc}{\mathsf{Adv}}_{\mathcal{A},\mathsf{AV}}=& Pr\mathsf{Dec}({\mathsf{sk}}_{\mathsf{id}},c^{\prime })\to t*m:& (\mathsf{PP},\mathsf{MSK})\leftarrow \mathsf{Setup}\left(1^{\lambda }\right),\hfill \\ & & (\widetilde{\mathsf{id}},\mathsf{id})\leftarrow {\mathcal{A}}_1\left(1^{\lambda }\right),\hfill \\ & & m\leftarrow \$\mathcal{M},\hfill \\ & & {\mathsf{sk}}_{\widetilde{\mathsf{id}}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},\widetilde{\mathsf{id}}),\hfill \\ & & {\mathsf{sk}}_{\mathsf{id}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},\mathsf{id}),\hfill \\ & & c\leftarrow \mathsf{Enc}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{\mathsf{id}}},\mathsf{id},m),\hfill \\ & & c^{\prime }\leftarrow {\mathcal{A}}_2^{\mathcal{O}}(\mathsf{PP},c))\hfill \end{array}$$

where $\mathcal{O}=\mathsf{KeyGen}(\mathsf{MSK},·)$ except queries cannot be made for identities $\widetilde{\mathsf{id}}$ and $\mathsf{id}$. It is assumed that $\left|\mathcal{M}\right|$ is exponentially large and the min-entropy of $\mathcal{M}$ is sufficiently higher than the security parameter.

Definition 7. 

An IBAA scheme is said to satisfy (selective) strong unlinkability if the advantage of any PPT adversary $\mathcal{A}=({\mathcal{A}}_1,{\mathcal{A}}_2)$ is negligible in the security parameter where the advantage is defined as follows:

$$\begin{array}{ccc}{\mathsf{Adv}}_{\mathcal{A},\mathsf{UL}}=& Pr{\mathcal{A}}_2^{\mathcal{O}}(\mathsf{PP},c^{\prime },c^{″},c^{″})\to 1:& (\mathsf{PP},\mathsf{MSK})\leftarrow \mathsf{Setup}\left(1^{\lambda }\right),\hfill \\ & & (\widetilde{\mathsf{id}},\widetilde{{\mathsf{id}}^{\prime }},\widetilde{{\mathsf{id}}^{″}},m,m^{\prime },\mathsf{id})\leftarrow {\mathcal{A}}_1\left(1^{\lambda }\right),\hfill \\ & & {\mathsf{sk}}_{\widetilde{\mathsf{id}}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},\widetilde{\mathsf{id}}),\hfill \\ & & {\mathsf{sk}}_{\widetilde{{\mathsf{id}}^{\prime }}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},\widetilde{{\mathsf{id}}^{\prime }}),\hfill \\ & & {\mathsf{sk}}_{\widetilde{{\mathsf{id}}^{″}}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},\widetilde{{\mathsf{id}}^{″}}),\hfill \\ & & \mathsf{ak}\leftarrow \mathsf{Authorize}\left({\mathsf{sk}}_{\widetilde{\mathsf{id}}}\right),\hfill \\ & & {\mathsf{ak}}^{\prime }\leftarrow \mathsf{Authorize}\left({\mathsf{sk}}_{\widetilde{{\mathsf{id}}^{\prime }}}\right),\hfill \\ & & c\leftarrow \mathsf{Enc}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{\mathsf{id}}},\mathsf{id},m),\hfill \\ & & c^{\prime }\leftarrow \mathsf{Enc}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{{\mathsf{id}}^{\prime }}},\mathsf{id},m^{\prime }),\hfill \\ & & c^{″}\leftarrow \mathsf{Aggregate}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{{\mathsf{id}}^{″}}},(\mathsf{ak},c),({\mathsf{ak}}^{\prime },c^{\prime }))\hfill \end{array}$$

$$\begin{array}{ccc}& \hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}-Pr{\mathcal{A}}_2^{\mathcal{O}}(\mathsf{PP},c^{\prime },c^{″},c^{″})\to 1:& (\mathsf{PP},\mathsf{MSK})\leftarrow \mathsf{Setup}\left(1^{\lambda }\right),\hfill \\ & & (\widetilde{\mathsf{id}},\widetilde{{\mathsf{id}}^{\prime }},\widetilde{{\mathsf{id}}^{″}},m,m^{\prime },\mathsf{id})\leftarrow {\mathcal{A}}_1\left(1^{\lambda }\right),\hfill \\ & & {\mathsf{sk}}_{\widetilde{\mathsf{id}}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},\widetilde{\mathsf{id}}),\hfill \\ & & {\mathsf{sk}}_{\widetilde{{\mathsf{id}}^{\prime }}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},\widetilde{{\mathsf{id}}^{\prime }}),\hfill \\ & & {\mathsf{sk}}_{\widetilde{{\mathsf{id}}^{″}}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},\widetilde{{\mathsf{id}}^{″}}),\hfill \\ & & \mathsf{ak}\leftarrow \mathsf{Authorize}\left({\mathsf{sk}}_{\widetilde{\mathsf{id}}}\right),\hfill \\ & & {\mathsf{ak}}^{\prime }\leftarrow \mathsf{Authorize}\left({\mathsf{sk}}_{\widetilde{{\mathsf{id}}^{\prime }}}\right),\hfill \\ & & c\leftarrow \mathsf{Enc}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{\mathsf{id}}},\mathsf{id},m),\hfill \\ & & c^{\prime }\leftarrow \mathsf{Enc}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{{\mathsf{id}}^{\prime }}},\mathsf{id},m^{\prime }),\hfill \\ & & c^{″}\leftarrow \mathsf{Enc}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{{\mathsf{id}}^{″}}},\mathsf{id},m*m^{\prime })\hfill \end{array}$$

where $\mathcal{O}=\mathsf{KeyGen}(\mathsf{MSK},·)$; note that queries can be made for identity $\mathsf{id}$.

Definition 8. 

An IBAA scheme is said to be one-way anonymous if the advantage of any PPT adversary $\mathcal{A}=({\mathcal{A}}_1,{\mathcal{A}}_2)$ is negligible in the security parameter where the advantage is defined as follows:

$$\begin{array}{ccc}{\mathsf{Adv}}_{\mathcal{A},\mathsf{OW}\text{-}\mathsf{ANON}}=& Pr{\mathcal{A}}_2^{\mathcal{O}}(\mathsf{PP},c)\to \mathsf{id}:& (\mathsf{PP},\mathsf{MSK})\leftarrow \mathsf{Setup}\left(1^{\lambda }\right),\hfill \\ & & (\widetilde{\mathsf{id}},m)\leftarrow {\mathcal{A}}_1\left(1^{\lambda }\right),\hfill \\ & & \mathsf{id}\leftarrow \$\mathcal{I},\hfill \\ & & {\mathsf{sk}}_{\widetilde{\mathsf{id}}}\leftarrow \mathsf{KeyGen}(\mathsf{MSK},\widetilde{\mathsf{id}}),\hfill \\ & & c\leftarrow \mathsf{Enc}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{\mathsf{id}}},\mathsf{id},m)\hfill \end{array}$$

where $\mathcal{O}=\mathsf{KeyGen}(\mathsf{MSK},·)$. It is assumed that $\mathcal{I}$ is exponentially large and the min-entropy of $\mathcal{I}$ is sufficiently higher than the security parameter.

6. Construction of IBAA

We now present a construction of the primitive defined in Section 5. Our construction requires an anonymous homomorphic IBE scheme ${\mathcal{E}}_m$ for the plaintext values, a collision-resistant hash function family, a symmetric encryption scheme ${\mathcal{E}}_{\mathsf{SKE}}$, a PRF and an anonymous IBE ${\mathcal{E}}_k$ for encrypting the keys. Let $\mathcal{H}$ be a family of collision-resistant hash functions. Our IBAA scheme is shown in Algorithm 4.

Algorithm 4 Our IBAA scheme—first five algorithms.

$\mathsf{Agg}.\mathsf{Setup}\left(1^{\lambda }\right)$.       $K\leftarrow \mathsf{PRF}.\mathsf{Gen}\left(1^{\lambda }\right)$       $({\mathsf{PP}}_{\mathsf{IBE}},{\mathsf{MSK}}_{\mathsf{IBE}})\leftarrow {\mathcal{E}}_m.\mathsf{Setup}\left(1^{\lambda }\right)$       $({\mathsf{PP}}_{\mathsf{IBE}}^{\prime },{\mathsf{MSK}}_{\mathsf{IBE}}^{\prime })\leftarrow {\mathcal{E}}_k.\mathsf{Setup}\left(1^{\lambda }\right)$       $H\leftarrow \$\mathcal{H}$       Return $(\mathsf{PP}:=(H,{\mathsf{PP}}_{\mathsf{IBE}},{\mathsf{PP}}_{\mathsf{IBE}}^{\prime }),\mathsf{MSK}:=(K,{\mathsf{MSK}}_{\mathsf{IBE}},{\mathsf{MSK}}_{\mathsf{IBE}}^{\prime }))$    $\mathsf{Agg}.\mathsf{KeyGen}(\mathsf{MSK},\mathsf{id})$.       $r_{\alpha }\leftarrow \mathsf{PRF}.\mathsf{Eval}(K,\mathsf{id}\Vert ‘\mathrm{A}’)$       ${\alpha }_{\mathsf{id}}\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Gen}(1^{\lambda };r_{\alpha })$       ${\mathsf{sk}}_{\mathsf{IBE}}\leftarrow {\mathcal{E}}_m.\mathsf{KeyGen}({\mathsf{MSK}}_{\mathsf{IBE}},\mathsf{id})$       ${\mathsf{sk}}_{\mathsf{IBE}}^{\prime }\leftarrow {\mathcal{E}}_k.\mathsf{KeyGen}({\mathsf{MSK}}_{\mathsf{IBE}}^{\prime },\mathsf{id})$       Return ${\mathsf{sk}}_{\mathsf{id}}:=({\alpha }_{\mathsf{id}},{\mathsf{sk}}_{\mathsf{IBE}},{\mathsf{sk}}_{\mathsf{IBE}}^{\prime })$    $\mathsf{Agg}.\mathsf{Authorize}\left({\mathsf{sk}}_{\widetilde{\mathsf{id}}}\right)$.       $({\alpha }_{\widetilde{\mathsf{id}}},{\mathsf{sk}}_{\mathsf{IBE}},{\mathsf{sk}}_{\mathsf{IBE}}^{\prime })\leftarrow {\mathsf{sk}}_{\widetilde{\mathsf{id}}}$       Return ${\mathsf{ak}}_{\widetilde{\mathsf{id}}}:={\alpha }_{\widetilde{\mathsf{id}}}$    $\mathsf{Agg}.\mathsf{Enc}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{\mathsf{id}}},\mathsf{id},m)$.       $({\alpha }_{\widetilde{\mathsf{id}}},{\mathsf{sk}}_{\mathsf{IBE}},{\mathsf{sk}}_{\mathsf{IBE}}^{\prime })\leftarrow {\mathsf{sk}}_{\widetilde{\mathsf{id}}}$       $\kappa \leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Gen}\left(1^{\lambda }\right)$       $h\leftarrow H\left(\mathsf{id}\right)$       $c_1\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Enc}({\alpha }_{\widetilde{\mathsf{id}}},\kappa )$       $c_2\leftarrow {\mathcal{E}}_k.\mathsf{Enc}({\mathsf{PP}}_{\mathsf{IBE}}^{\prime },\mathsf{id},\kappa )$       $v\leftarrow {\mathcal{E}}_m.\mathsf{Enc}({\mathsf{PP}}_{\mathsf{IBE}},\mathsf{id},m)$       $z\leftarrow {\mathcal{E}}_m.\mathsf{Enc}({\mathsf{PP}}_{\mathsf{IBE}},\mathsf{id},1_{\mathcal{M}})$       $c_3\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Enc}(\kappa ,(h,v,z))$       Return $c:=(c_1,c_2,c_3)$    $\mathsf{Agg}.\mathsf{Dec}({\mathsf{sk}}_{\mathsf{id}},c)$.       $({\alpha }_{\mathsf{id}},{\mathsf{sk}}_{\mathsf{IBE}},{\mathsf{sk}}_{\mathsf{IBE}}^{\prime })\leftarrow {\mathsf{sk}}_{\mathsf{id}}$       $\kappa \leftarrow {\mathcal{E}}_k.\mathsf{Dec}({\mathsf{sk}}_{\mathsf{IBE}}^{\prime },c_2)$       $t\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Dec}(\kappa ,c_3)$       If $t=\perp$:          Return ⊥       $(h,v,z)\leftarrow t$       $m\leftarrow {\mathcal{E}}_m.\mathsf{Dec}({\mathsf{sk}}_{\mathsf{IBE}},v)$       Return m

We now prove an important result.

Theorem 3. 

Assuming ${\mathcal{E}}_k$ is $\mathit{IND}\text{-}\mathit{ID}\text{-}\mathit{RCCA}$secure and $\mathsf{SKE}$ is IND-CCA2 secure, then the IBAA scheme in Algorithm 4 satisfies aggregation validity.

Proof. 

We prove the theorem via a hybrid argument. To avoid repetition and to make the analysis more concise, we describe some notations for things that are common to all steps in the argument. For each step, we need to construct a simulator that uses an adversary $\mathcal{A}$ against selective aggregation validity in either the hybrid from the step in question or the previous hybrid to attack the security of one of the underlying primitives. However, the security games for each of these primitives involve an adversary outputting a guess bit, whereas adversary $\mathcal{A}$ outputs a ciphertext $c^{\prime }$. Therefore, an essential part of the reduction is to show how we convert this ciphertext $c^{\prime }$ into a bit $b^{\prime }\in \{0,1\}$ such that either $b^{\prime }$ or its complement can be sent to the challenger to break the security of the underlying primitive. For the sake of brevity in the reductions below, we simply describe how $b^{\prime }$ is computed from $c^{\prime }$.

• Hybrid 0: This is the real system.
• Hybrid 1: In this hybrid, we change $c_1$ to the encryption of a uniformly random and independent element.  

Indistinguishability follows from the IND-CCA2 security of the symmetric encryption scheme. The reduction, in this case, is straightforward.

• Hybrid 2: In this hybrid, we change the $c_2$ component of the ciphertext to an encryption of a random element drawn from the message space of the ${\mathcal{E}}_k$ scheme. Therefore, instead of encrypting $\kappa$, we encrypt a random element $\rho$.  

We can use an adversary that has a non-negligible advantage distinguishing between Hybrids 0 and 1 to construct an adversary that has a non-negligible advantage against the $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$security of ${\mathcal{E}}_k$. The reduction is as follows. First, we run ${\mathcal{A}}_1$ to obtain $(\widetilde{\mathsf{id}}$, $\mathsf{id}$). We sample $m\leftarrow \$\mathcal{M}$. We run $\mathsf{Setup}$ and all steps of the encryption algorithm except the step that generates $c_2$. Therefore, we, for example, generate $\kappa$, $c_1$ and $c_3$. We set ${\mu }_0\leftarrow \kappa$ and ${\mu }_1\leftarrow \rho$ where $\rho$ is a uniform random element in the message space of ${\mathcal{E}}_k$ and send the pair of messages $({\mu }_0,{\mu }_1)$ to the $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$challenger. We receive a challenge ciphertext e, and we set $c_1\leftarrow e$ and set $c\leftarrow (c_1,c_2,c_3)$. Then we run ${\mathcal{A}}_2$ with the public parameters and ciphertext c and obtain $c^{\prime }$. We parse $c^{\prime }$ as $(c_1^{\prime },c_2^{\prime },c_3^{\prime })$. Then the reduction sends $c_1^{\prime }$ to the $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$decryption oracle, and if the oracle responds with $\mathsf{test}$, then check if $c_3^{\prime }$ is decryptable with $\kappa$ or $\rho$ and let $\mu$ be the tuple obtained, or else if the oracle responds with a plaintext k, check if $c_3^{\prime }$ is decryptable with k and set $\mu$ to be the tuple returned. Otherwise, set $\mu \leftarrow \perp$. Finally, the guess bit $b^{\prime }$ is computed as $b^{\prime }\leftarrow \mu \ne \perp \wedge .{\mathcal{E}}_m.\mathsf{Dec}({\mathsf{sk}}_{\mathsf{IBE}},\mu .v)=m*t$, where ${\mathsf{sk}}_{\mathsf{IBE}}$ is the key we have derived in the simulation. Indistinguishability follows from the $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$security of ${\mathcal{E}}_k$.

• Hybrid 3: In this hybrid, we change the $c_3$ component of the ciphertext to an encryption of a random element drawn from the message space of the SKE scheme.  

•   In the reduction, we parse $c^{\prime }$ as $(c_1^{\prime },c_2^{\prime },c^{\prime }3)$ and decrypt $c_2^{\prime }$ with the secret key derived in the simulation to obtain $\kappa$. If $\kappa$ decrypts $c_3^{\prime }$, set $\mu$ to the resulting tuple. Otherwise, send $c_3^{\prime }$ to the IND-CCA2 decryption oracle and set $\mu$ to the response. Finally, the guess bit $b^{\prime }$ is computed as $b^{\prime }\leftarrow \mu \ne \perp \wedge .{\mathcal{E}}_m.\mathsf{Dec}({\mathsf{sk}}_{\mathsf{IBE}},\mu .v)=m*t$ where ${\mathsf{sk}}_{\mathsf{IBE}}$ is the key we have derived in the simulation. Indistinguishability follows from the IND-CCA2 security of the SKE scheme.

The adversary has a negligible advantage in this game since the ciphertext c does not contain any information about m. The result follows.    □

We have omitted the aggregation algorithm from Algorithm 4 since this varies depending on whether we target the P-type or F-type setting. Our goal is to achieve strong unlinkability, aggregation validity and (one-way/full) anonymity in the (P-type/F-type) settings.

6.1. P-Type Setting

We can, however, readily obtain strong unlinkability together with aggregation validity in the P-type setting of one-way anonymity, which we will now describe. Unfortunately, our approach is inherently restricted to one-way anonymity, leaving open the problem of achieving strong unlinkability and aggregation validity in the F-type setting of full anonymity; we will tackle this problem later. Our approach for the P-type setting involves instantiating ${\mathcal{E}}_k$ with an IND-ID-CCA2 secure IBE scheme. The hash of the target identity h in the tuple encrypted by $c_3$ is used as an identity string; that is, $c_2$ is an encryption with ${\mathcal{E}}_k$ under identity string h of the symmetric key $\kappa$. The ciphertext component $c_3$ is an encryption of the tuple $(h,v,z)$. The aggregation algorithm for our IBAA scheme in this setting is given in Algorithm 5.

Algorithm 5 Our IBAA scheme aggregation algorithm for P-type setting.

$\mathsf{Agg}.\mathsf{Aggregate}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{\mathsf{id}}},(\mathsf{ak},(c_1,c_2,c_3)),({\mathsf{ak}}^{\prime },(c_1^{\prime },c_2^{\prime },c_3^{\prime })))$.       $({\alpha }_{\widetilde{\mathsf{id}}},{\mathsf{sk}}_{\mathsf{IBE}},{\mathsf{sk}}_{\mathsf{IBE}}^{\prime })\leftarrow {\mathsf{sk}}_{\widetilde{\mathsf{id}}}$       $\alpha \leftarrow \mathsf{ak}$       ${\alpha }^{\prime }\leftarrow {\mathsf{ak}}^{\prime }$       $\kappa \leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Dec}(\alpha ,c_1)$       ${\kappa }^{\prime }\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Dec}({\alpha }^{\prime },c_1^{\prime })$       If $\kappa =\perp$ or ${\kappa }^{\prime }=\perp$:          Output ⊥       $(h,v,z)\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Dec}(\kappa ,c_3)$       $(h^{\prime },v^{\prime },z^{\prime })\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Dec}({\kappa }^{\prime },c_3^{\prime })$       If $h\ne h^{\prime }$:          Output ⊥       $s_1,s_2\leftarrow \${\mathbb{Z}}_N$       $v^{″}\leftarrow v*v^{\prime }*z^{s_1}$       $z^{″}\leftarrow z^{s_2}$       ${\kappa }^{″}\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Gen}\left(1^{\lambda }\right)$       $c_1^{″}\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Enc}({\alpha }_{\widetilde{id}},{\kappa }^{″})$       $c_2^{″}\leftarrow {\mathcal{E}}_k.\mathsf{Enc}({\mathsf{PP}}_{\mathsf{IBE}}^{\prime },h,{\kappa }^{″})$       $c_3^{″}\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Enc}({\kappa }^{″},(h^{″}:=h,v^{″},z^{″})$       Return $(c_1^{″},c_2^{″},c_3^{″})$

6.2. F-Type Setting

Now, we turn our attention to the more challenging problem of obtaining aggregation validity together with strong unlinkability in the F-type setting of full anonymity. We observe that we can solve this problem with (identity-based) fully homomorphic encryption (FHE). The idea is to encrypt the hash h with an identity-based FHE scheme to obtain ciphertext ${\psi }_h$ and place ${\psi }_h$ in the tuple $(h,v,z)$ instead of h. The aggregator can then homomorphically produce encryption of a fresh key under identity h by performing homomorphic evaluation on ${\psi }_h$. The additional expense of homomorphic evaluation aside, the major prohibitive factor of this approach is the fact that bootstrapping is necessary to achieve unlinkability, and this requires us to make a circular security assumption. Hence we seek to solve the problem in an alternative way, avoiding FHE and bootstrapping.

Instead, we rely on an $\mathrm{IND}\text{-}\mathrm{ID}\text{-}\mathrm{RCCA}$secure IBE scheme that is both anonymous and satisfies strong unlinkability with the ability to generate rerandomizable anonymous encryption keys for a particular identity. We make use of our anonymous IBE scheme from the previous section to fulfill our requirements. Recall that this scheme comes with two useful algorithms:

• $\mathsf{GenAnonKey}(\mathsf{PP},\mathsf{id})$.
• $\mathsf{RerandomizeKey}(\mathsf{PP},\mathsf{AnK})$.

Given the public parameters and an identity string,  Algorithm $\mathsf{GenAnonKey}$ generates an anonymous key $\mathsf{AnK}$, which hides the identity and can be used to encrypt a message for that identity. The second algorithm, $\mathsf{RerandomizeKey}$, given the public parameters and an anonymous key, derives an unrelated anonymous key for the same identity such that no party can link the keys and determine that they are related (i.e., have the same intended recipient). The anonymous key is preprended to every ciphertext generated with it, so, therefore, it is advantageous to rerandomize it, so the ciphertexts are not linked to each other. Algorithm 6 shows how this algorithm is used in our IBAA scheme’s aggregation algorithm for the F-type setting. Note that although we do not show it, it is also necessary to slightly modify the encryption and decryption algorithms of our IBAA scheme to accommodate the F-type setting.

Algorithm 6 Our IBAA scheme aggregation algorithm for F-type setting.

$\mathsf{Agg}.\mathsf{Aggregate}(\mathsf{PP},{\mathsf{sk}}_{\widetilde{\mathsf{id}}},(\mathsf{ak},\mathsf{ct}),({\mathsf{ak}}^{\prime },{\mathsf{ct}}^{\prime })).$       $({\alpha }_{\widetilde{\mathsf{id}}},{\mathsf{sk}}_{\mathsf{IBE}},{\mathsf{sk}}_{\mathsf{IBE}}^{\prime })\leftarrow {\mathsf{sk}}_{\widetilde{\mathsf{id}}}$       $(c_1,c_2:=(\mathsf{AnK},\psi ),c_3)\leftarrow \mathsf{ct}$       $(c_1^{\prime },c_2^{\prime }:=({\mathsf{AnK}}^{\prime },{\psi }^{\prime }),c_3^{\prime })\leftarrow {\mathsf{ct}}^{\prime }$       $\alpha \leftarrow \mathsf{ak}$       ${\alpha }^{\prime }\leftarrow {\mathsf{ak}}^{\prime }$       $\kappa \leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Dec}(\alpha ,c_1)$       ${\kappa }^{\prime }\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Dec}({\alpha }^{\prime },c_1^{\prime })$       If $\kappa =\perp$ or ${\kappa }^{\prime }=\perp$:          Output ⊥       $(v,\overline{v},z)\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Dec}(\kappa ,c_3)$       $(v^{\prime },{\overline{v}}^{\prime },z^{\prime })\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Dec}({\kappa }^{\prime },c_3^{\prime })$       $s_1,s_2,s_3\leftarrow \${\mathbb{Z}}_N$       $v^{″}\leftarrow v*v^{\prime }*z^{s_1}$       ${\overline{v}}^{″}\leftarrow \overline{v}*{\overline{v}}^{\prime }*z^{s_2}$       $z^{″}\leftarrow z^{s_3}$       ${\kappa }^{″}\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Gen}\left(1^{\lambda }\right)$       $c_1^{″}\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Enc}({\alpha }_{\widetilde{id}},{\kappa }^{″})$       ${\mathsf{AnK}}^{″}\leftarrow \mathsf{RerandomizeKey}({\mathsf{PP}}_{\mathsf{IBE}}^{\prime },\mathsf{AnK})$       $c_2^{″}\leftarrow ({\mathsf{AnK}}^{″},{\mathcal{E}}_k.\mathsf{Enc}({\mathsf{PP}}_{\mathsf{IBE}}^{\prime },{\mathsf{AnK}}^{″},{\kappa }^{″}))$       $c_3^{″}\leftarrow {\mathcal{E}}_{\mathsf{SKE}}.\mathsf{Enc}({\kappa }^{″},(v^{″},{\overline{v}}^{″},z^{″})$       Return $(c_1^{″},c_2^{″},c_3^{″})$