Jong Hwan Park

Asymmetric broadcast encryption (ABE) allows a sender, given the public keys or identities of recipients, to encrypt a message such that only an authorized subset of users can decrypt it. In fully asymmetric settings, where any user may act as a sender, ciphertext generation time and ciphertext size become critical performance metrics. However, most existing ABE schemes impose substantial sender-side computational costs and scale poorly with system size. This paper presents new ABE constructions that achieve fast ciphertext generation while maintaining compact ciphertexts. Our schemes are built upon the identity-based revocation (IBR) framework, enabling each user's identity to serve directly as a public key. We first propose a basic IBR scheme that produces constant-size ciphertexts independent of the number of recipients or revoked users, achieving efficient encryption through optimized hash-to-point and aggregation techniques. We then extend this design to a tree-based construction that supports large-scale systems and offers a practical trade-off among encryption cost, decryption efficiency, and secret-key size. Both schemes are proven CPA-secure under a modified Decisional Bilinear Diffie–Hellman (mDBDH) assumption in the random-oracle model. Extensive experiments with concrete parameters demonstrate that our schemes significantly outperform existing asymmetric revocation approaches. For a system with 10⁶ users and a revocation rate of 1:5–3%, prior schemes require tens of seconds to generate a ciphertext, whereas our constructions complete encryption within 1:6 seconds while keeping the ciphertext size nearly constant (below 10² KB).

A threshold key encapsulation mechanism (TKEM) facilitates the secure distribution of session keys among multiple participants, allowing key recovery through a threshold number of shares. TKEM has gained significant attention, especially for decentralized systems, including blockchains. However, existing constructions often rely on trusted setups, which pose security risks such as a single point of failure and are limited by fixed participant numbers and thresholds. To overcome this issue, we propose a dynamic TKEM with a transparent setup, allowing for a flexible selection of both recipients and thresholds without relying on trusted third parties in the setup phase. In addition, our construction does not rely on pairing operations, which are less efficient compared to exponentiation. We prove the selective chosen-ciphertext security of our construction under the decisional Diffie-Hellman assumption, zero-knowledge, and soundness of a non-interactive zero-knowledge (NIZK) proof system. We also show that our scheme satisfies decapsulation consistency when the underlying NIZK system is sound. Our proof-of-concept implementation highlights the practicality and efficiency of this approach, further advancing the field of threshold cryptography.

Performance appraisal is crucial in human resource management for identifying areas within organizations. Ensuring anonymity and confidentiality is important to obtain honest feedback and prevent retaliation. Although blockchain-based anonymous reputation systems have been discussed, permissioned blockchains are susceptible to Sybil attack vulnerabilities, while permissionless private blockchains do not provide full anonymity. We present the Anonymous Reputation System for Performance Appraisal (ARSPA), which uses a permissionless public blockchain. This system is designed for upward feedback in performance appraisals, employing cryptographic techniques such as non-interactive zero-knowledge proofs, public-key encryption, and Merkle trees to ensure security. Our protocol addresses the risks of Sybil attacks, ensures review limitation and unforgeability. We validate the security of ARSPA through analysis and demonstrate its feasibility through proof-of-concept on Ethereum test networks. ARSPA provides a secure and efficient approach to enhance the reliability and fairness of performance appraisal.

In CRYPTO 2013, Ducas et al. introduced a bimodal discrete Gaussian distribution into the Fiat-Shamir with abort paradigm, proposing a signature scheme called BLISS, which significantly improved rejection sampling efficiency and reduced the number of required abort steps compared to all previously proposed (uni-modal) lattice-based signature schemes. Although the theoretical structure of the bimodal distribution is elegant, the BLISS implementation suffers from several side-channel vulnerabilities. The primary issue arises from the fact that the probability mass function of the bimodal discrete Gaussian distribution is a transcendental function, which makes it difficult to implement solely with integers in constant-time. To address this issue, we introduce a new distribution called ‘Generalized Centered Binomial Distribution (GCBD)’ that can replace the (bimodal) discrete Gaussian distribution. As a generalized form of the centered binomial distribution (CBD), GCBD is simple and efficient in sampling integers from distributions with large standard deviations. GCBD sampling consists of sampling uniformly random bitstrings and integer addition/subtraction operations, allowing for efficient constant-time implementation. Furthermore, bimodal rejection sampling using GCBD can be implemented only with integer operations in constant-time, with the help of the Newton-Raphson method. By incorporating the bimodal GCBD rejection sampling into BLISS, we present a new variant of BLISS that can be implemented in constant-time, thereby eliminating the side-channel vulnerabilities associated with timing attacks. Finally, we compare the performance of our variant to GALACTICS, a previous constant-time implementation of BLISS. While the signing algorithm of our variant is about 3.3 times slower than that of GALACTICS, GCBD can serve as an alternative to the discrete Gaussian distribution for designing bimodal lattice signatures.

In 2009, Lyubashevsky proposed a lattice-based signature scheme using the Schnorr-like identification and the Fiat-Shamir heuristic and proved its security under the collision resistance of a generalized compact knapsack function. However, their security analysis requires the witness indistinguishability property, leading to significant inefficiency and an increase of sizes of public key and signature. To overcome the efficiency issue associated with the WI property, we introduce a new lattice-based assumption, called the target-modified one-wayness problem of the GCK function and show its reduction to well-known lattice-based problems. Additionally, we present a simple and efficient GCK-based signature scheme, GCKSign, whose security is based on the Module GCK-TMO problem in the random oracle model. GCKSign is a natural extension of Lyubashevsky’s scheme in a module setting, but achieves considerable efficiency gains due to eliminating the witness indistinguishability property. As a result, GCKSign achieves approximately 3.4 times shorter signature size and 2.4 times shorter public key size at the same security level.

NTRU was the first practical public key encryption scheme constructed on a lattice over a polynomial-based ring and has been considered secure against significant cryptanalytic attacks over the past few decades. However, NTRU and its variants suffer from several drawbacks, including difficulties in achieving worst-case correctness error in a moderate modulus, inconvenient sampling distributions for messages, and relatively slower algorithms compared to other lattice-based schemes. In this work, we propose a new NTRU-based key encapsulation mechanism (KEM), called NTRU+, which overcomes nearly all existing drawbacks. NTRU+ is constructed based on two new generic transformations: ACWC ₂ and FO ^⊥ (a variant of the Fujisaki-Okamoto transform). ACWC ₂ is used to easily achieve worst-case correctness error, while FO ^⊥ is used to achieve chosen-ciphertext security without re-encryption. Both ACWC ₂ and FO ^⊥ are defined using a randomness-recovery algorithm and an encoding method. In particular, our simple encoding method, the semi-generalized one-time pad (SOTP), allows us to sample a message from a natural bit-string space with an arbitrary distribution. We provide four parameter sets for NTRU+ and present implementation results using NTT-friendly rings over cyclotomic trinomials.

Privacy plays a crucial role in the internet era, where many applications allow people to communicate and use their services through the internet. Privacy-preserving Identity Management (PPIdM) system is a scheme that helps manage users’ identities and protects users’ privacy by enabling users to authenticate themselves without disclosing their real identities. The PPIdM system also allows users to reveal some minor identity attributes while others remain secret selectively. However, anonymity also encourages malicious users to break the system’s policy and commit crimes since their real identities are anonymous. Existing PPIdM systems use the identity provider (IP) as a medium to verify users’ identity attributes, record all users’ real identities, and ensure that malicious users’ identities are traceable. Therefore, users’ identities are hidden from all entities but the IP. However, the user’s privacy is vulnerable because there is nothing to guarantee that the IP is always honest and not curious about their users’ activities and private information. This paper proposes a PPIdM system on the blockchain that helps users manage their identity attributes and keeps their real identities secret from all entities, including the IP. Still, the system’s consensus can trace malicious users’ real identities if they violate the system’s policy. The PPIdM’s security requirements are analyzed and proved informally using the game-based proof scheme. The main idea of this study is to combine zk-SNARK, a type of zero-knowledge proof (ZKP), Shamir’s secret sharing (SSS), and several other cryptography techniques.

A fuzzy extractor can extract an almost uniform random string from a noisy source with enough entropy such as biometric data. To reproduce an identical key from repeated readings of biometric data, the fuzzy extractor generates a helper data and a random string from biometric data and uses the helper data to reproduce the random string from the second reading. In 2013, Fuller et al. proposed a computational fuzzy extractor based on the learning with errors problem. Their construction, however, can tolerate a sub-linear fraction of errors and has an inefficient decoding algorithm, which causes the reproducing time to increase significantly. In 2016, Canetti et al. proposed a fuzzy extractor with inputs from low-entropy distributions based on a strong primitive, which is called digital locker. However, their construction necessitates an excessive amount of storage space for the helper data, which is stored in authentication server. Based on these observations, we propose a new efficient computational fuzzy extractor with small size of helper data. Our scheme supports reusability and robustness, which are security notions that must be satisfied in order to use a fuzzy extractor as a secure authentication method in real life. Also, it conceals no information about the biometric data and thanks to the new decoding algorithm can tolerate linear errors. Based on the non-uniform learning with errors problem, we present a formal security proof for the proposed fuzzy extractor. Furthermore, we analyze the performance of our fuzzy extractor scheme and provide parameter sets that meet the security requirements. As a result of our implementation and analysis, we show that our scheme outperforms previous fuzzy extractor schemes in terms of the efficiency of the generation and reproduction algorithms, as well as the size of helper data.