Jérémy, Karel Jean-François Jacques

PhD Anaïs Barthoulot

Keywords: comparison, schemes comparison, 6, 3 Broadcast and Trace schemes comparison, Anonymous security for Augmented Broadcast Encryption scheme AugBE -Augmented Broadcast Encryption, BDHE -Bilinear Diffie-Hellman Exponent, BE -Broadcast Encryption CCA2 -Adaptive Chosen-Chiphertext Attack, CDH -Computational Diffie-Hellman Encryption, LVAS -Locally Verifiable Aggregate Signature Augmented Broadcast Encryption scheme, NM -Non-Malleability, PAC -Pattern Certification Center PPKG -Privacy-Preserving Key Generation, PPT -Probabilistic Polynomial Time, ROM -Random Oracle Model, sAH-IPE -strong Attribute-Hiding security for Inner Product Encryption scheme, SBDH -Strong Bilinear Diffie-Hellman, SDH -Strong Diffie-Hellam sSBDH -Symmetric Strong Bilinear Diffie-Hellman, SXDH -Symmetric External Diffie-Hellman XDLin -eXternal Decision Linear

Bien que l'on m'ait suggéré de très bonnes idées pour écrire mes remerciements, comme utiliser de la stéganographie ou de la cryptographie, l'exercice me paraît suffisamment périlleux en lui-même et je suivrai donc sa forme classique. Il me semble normal de commencer en remerciant Sébastien Canard et Olivier Blazy pour leur confiance, leur accompagnement et leurs nombreux conseils pendant ces trois années et demi. De plus, je tiens à remercier Philippe Gaborit d'avoir accepté de reprendre la direction de cette thèse en début de deuxième année, afin de nous éviter un périple administratif complexe. Je remercie également David Pointcheval et Guilhem Castagnos d'avoir accepté de relire ce manuscrit, et je les remercie pour leurs précieux conseils. I also would like to thank Elizabeth Quaglia, Carla Ràfols, and Adeline Roux-Langlois for accepting the role of examiners for my Ph.D. defense. Merci aussi à Débora Thomas qui m'a beaucoup aidée

Merci à Chris(to) : t'avoir auprès de moi, avec ton côté tête en l'air et ce talent à ne jamais stresser, m'a permis de tenir pendant les moments difficiles. Et que dire de nos soirées jeux de société après le refus de mes papiers... Merci pour tout. Enfin, merci à ma famille qui m'a soutenue tout au long de mes études (même si j'ai dû très vite arrêter de leur demander de l'aide pour les devoirs). Merci à ma soeur Chloé qui a corrigé mes nombreux CV et lettres de motivation, je n'aurais probablement pas eu ce stage chez Orange sans toi. Also thank you to my extended family -Ian and Christine, Paul and Chris, Anne and Graham, and Bob -who helped improve my English. A special thanks to Bob: you gave me an incredible opportunity by helping me secure this internship at Wilson James. I can certainly say that without it, I would not be here today. Your kindness and support when I arrived alone in London for the first time on June 1, 2019, were invaluable. I enjoyed all our meals during that summer, and I will never forget all the things you did for me. SI NCE the inception of writing, humans have sought to protect their information from unwanted people. Two famous techniques, renowned since antiquity, are the steganography and the cryptography. While both terms are composed of the suffix "graphy", signifying "writing", their prefixes, "stegano" and "crypto", carry different meanings: "covered" for the former and "hidden" for the latter. More precisely, the steganography involves concealing the message itself (by covering it most of the time), while cryptography consists in hiding the meaning of the message. In history, we can find a lot of examples for steganography and cryptography: the Greek Histiaeus used to shave his slaves' heads to write messages on their skin and waited for his slaves' hair to regrow before to send them (steganography), while the Spartan military employed the Scytale, a cylinder with a strip of parchment wrapped around it, upon which a message was written (cryptography).

Table of Contents

Traditionally, cryptography was used for military purposes. The most famous example is the Enigma machine used by the Nazi Germany during World War II. The Enigma machine is composed of a keyboard (for the 26 letters of the alphabet) along with a set of rotating disks, called rotors, that "scramble" the alphabet letters. The settings of the machine, and especially the arrangement of the rotors determines the encryption scheme. The Enigma machine is also famous because it represents the first example of electronic cryptography; prior to its use, cryptography was entirely "handmade". The security of the machine relied on the fact that at this time, no machine was powerful enough to try all the possible arrangements to decipher a given encryption.

However, today, cryptography is deployed in various domains, not limited to military communications. It is used in electronic commerce, personal communication, and the deployment of secure messaging applications. In short, cryptography is present wherever there is data to protect.

Foundations of Cryptography

Traditionally, cryptographic primitives used to rely on a single secret key used for both encryption and decryption. Besides still being used nowadays, notably the Advanced Encryption Standard (AES), such cryptographic schemes have some drawbacks, such as the fact that they require an efficient and secure way to share keys among concerned users. In the 1970s, Diffie and Hellman [START_REF] Diffie | New directions in cryptography[END_REF] introduced a new kind of cryptography with their key exchange protocol in which cryptographic schemes use a pair of keys instead of only one key: one key of the pair must be kept secret and is used for decryption, while the other is publicly known and used for encryption. Cryptographic schemes with only one key are referred to as symmetric or secret key, while those with a pair of keys are referred to as asymmetric or public key. In this thesis, we will mainly use asymmetric cryptographic primitives as they are better suited for messages sharing.

Cryptography provides four guarantees to users.

• Confidentiality: only the authorized receiver can learn the content of the message; • Integrity: the receiver can ensure that the message has not been altered; • Authenticity: the receiver can verify the origin of the message (that the sender is who she claims to be); • Non-Repudiation: the sender cannot deny being the origin of the message.

Context

Nowadays, data are omnipresent in our daily lives, and we deal with a lot of them without even realizing it. For example, a typical workday for an office worker, let us call her Alice, could unfold as follows: first, she wakes up at around 6 a.m. to the sound of her connected alarm clock, then she checks her social media accounts before taking the bus to go to the office. During lunch, she visits a restaurant with her colleagues, and after work, she takes the underground to meet her personal trainer at the gym. While waiting, she books an appointment with her dentist on her phone. On her way back home, she stops by the grocery store to pick up the order she placed during her afternoon break, and finally, she ends the day by watching TV series online. As we can observe, an average person like Alice deals with and also generates a significant amount of data in a single day. It begins during the night and in the morning when the connected alarm clock analyzes Alice's sleep to determine the perfect time to wake her up. When Alice is active on social media, she accesses others' data while also sharing her own when she posts photos, for example. While taking the bus, Alice uses her travel card, which contains various information about her. At work, Alice handles the company's and its clients' data, and during lunch, when she uses her credit card for payment, sensitive data is involved. When she books her medical appointment on the underground, she deals with sensitive data in an insecure environment. At the gym with her personal trainer, she shares data collected by her connected watch and an associated training application. When collecting her order at the store, she has to pay online, thus sending sensitive data over the internet. Finally, while watching series online, she consumes a significant amount of data and shares some information about her preferences.

Storing data securely and efficiently is one of the most studied and challenging areas today. On one hand, storing an increasing amount of data (and keeping it readily available) demands significant resources, including electricity and water. In an era of environmental concerns, there is a strong motivation to research efficient storage solutions that reduce the size of stored data. On the other hand, privacy concerns are on the rise, with users becoming more cautious about the data they share and with whom they share it, in light of recent laws such as the General Data Protection Regulation (GDPR) established by the European Union in 2016 to protect personal data. There exist several methods to store data while keeping its privacy, including encryption ( such as AES for symmetric and RSA for asymmetric encryption), differential privacy (adding noise to data), and data masking techniques like tokenization and pseudonymization.

However, there is also a need to share data, which necessitates the development of advanced data sharing techniques. This forms the scope of this thesis. We condider that there are three types of data sharing: i) when information is shared from one individual to a group of users, ii) when information is shared from one individual to a group with common attributes, and iii) when information is shared from one individual to another. In this thesis, we focus on the first two types of data sharing, studying two cryptographic primitives known as Broadcast Encryption and Attribute-Based Encryption, which respectively fall into the contexts of i) and ii). Furthermore, it is essential to acknowledge that data are not only stored but also processed by servers to respond to user requests, which sometimes requires substantial computational power from the server. While some promising theoretical techniques for storage and computations over encrypted data, such as Gentry's fully homomorphic encryption (FHE), have been developed, they are often inefficient and resource-intensive for practical deployment. It is important to note that, although highly challenging and intriguing, FHE is beyond the scope of this thesis.

Encryption Scheme for Data Sharing

To a group of users. For this type of sharing we focus on broadcast encryption (BE) [START_REF] Fiat | Broadcast Encryption[END_REF] schemes. A broadcast encryption scheme is a public key encryption system that encrypts messages for a specific subset of users, ensuring that only users within that subset can decrypt them. Figure 1.1 provides a brief and informal overview of how a broadcast encryption scheme operates. In our daily lives, such schemes find application in scenarios like paid television or secure data sharing. Another cryptographic primitive, known as broadcast and trace (BT), serves a dual purpose by enabling both broadcast encryption and traitor tracing. The latter is a mechanism that helps identify individuals, or at least one of them, responsible for creating a pirate decoder for the broadcast encryption scheme. Broadcast and trace is also employed in the realm of paid television to uncover those responsible for distributing illegal decoders online.

An encryption scheme is considered efficient when its parameters remain independent of the number of users within the scheme, even when dealing with large user bases. For broadcast encryption schemes, achieving constant-size ciphertexts has been possible since 2005 using standard objects and assumptions. However, attaining constant-size public and private keys under standard assumptions remains an open challenge. In the context of traitor tracing, there is currently no scheme that offers constant-size ciphertexts, even when considering non-standard assumptions. Currently, the most efficient broadcast encryption and broadcast and trace schemes rely on a combination of pairing and lattice techniques to optimize efficiency. Nevertheless, this approach has the drawback of partial reliance on computational problems that could be compromised by a quantum computer. Therefore, in this thesis, we propose efficient schemes that do not merge these two domains. Whenever feasible, we aim to provide generic constructions of such schemes, enabling implementation with either pairings or lattices.

To a group with common attributes. For this type of sharing we concentrate on attribute-based encryption [START_REF] Sahai | Fuzzy Identity-Based Encryption[END_REF] (ABE) schemes. An attribute-based encryption scheme is a public key encryption system in which messages and secret keys are associated with either a set of attributes or an access policy. There are two types of attribute-based encryption schemes: ciphertext policy attribute-based encryption (CP-ABE), where ciphertexts are linked to access policies, and secret keys are linked to sets of attributes; and key policy attribute-based encryption (KP-ABE), where the roles of attributes and access policies are reversed. We provide a brief and informal overview of how the CP-ABE scheme operates in Figure 1.2. A KP-ABE scheme can be described similarly. Since both ciphertexts and secret keys in attribute-based encryption schemes depend on attribute sets, designing efficient schemes that keep the size of keys and ciphertexts independent of the maximum number of attributes in the scheme is quite challenging.

While some schemes have achieved either constant size ciphertexts or constant size secret keys, there is currently no scheme that accomplishes both. Additionally, it is important to note that the complexity of the access policies affects the scheme's efficiency: the more complex the policy, the less efficient the scheme becomes. However, some applications, such as developing a sharing platform for connected objects, require fine-grained access control. In this thesis, we have chosen to focus on improving the efficiency of attribute-based encryption schemes by using simple access policies.

Our Toolbox of Cryptographic Primitives

The goal of our thesis is to propose generic constructions for broadcast encryption and attribute-based encryption schemes. The advantage of these constructions lies in the modularity of our results. However, developing such constructions is not a straightforward task, and we must employ two underlying additional primitives: identity-based encryption with wildcards and cryptographic accumulators. Furthermore, these primitives require new features or security properties to be effectively utilized in our constructions. [4]. An identity-based encryption with wildcards (WIBE) scheme is a public key encryption system wherein ciphertexts are encrypted based on a vector known as a pattern. Only users possessing a pattern corresponding to the encryption pattern can decipher the message. Patterns are defined within a set that includes a special symbol, "⋆", referred to as a "wildcard". A secret key created for pattern P can decrypt a ciphertext associated with pattern P ′ if and only if, for all i ∈ {1, • • • , L} (where L ∈ N is the length of both patterns), either P i = ⋆ or P ′ i = ⋆ or P i = P ′ i . In this scenario, we say that P matches P ′ , denoted as P = ⋆ P ′ .

Identity-based encryption with wildcards

For visual clarity, Figure 1.3 provides an example illustrating matching and not matching patterns for patterns defined over {0, 1, ⋆} * . In Figure 1.4, we provide a brief and informal overview of how an identity-based encryption with wildcards scheme operates. Cryptographic accumulators [START_REF] Benaloh | One-Way Accumulators: A Decentralized Alternative to Digital Signatures[END_REF]. A cryptographic accumulator is a system designed to aggregate a set of values into a concise representation while also possessing the capability to prove the membership of any element using a piece of information referred to as a witness. This system is parameterized by a tuple consisting of private and secret keys. In Figure 1.5, we provide a brief and informal explanation of how an accumulator scheme functions.

Contributions

We hereby present all our contributions, categorizing them into two distinct categories: those pertaining to the building blocks (WIBE and accumulators), and those related to encryption variant, we establish the necessity of our newly introduced patternhiding security property for identity-based encryption with wildcards schemes. Contribution 2.2: by combining our generic constructions and novel schemes, we introduce a new broadcast encryption scheme featuring ciphertexts of constant size, secure under standard assumptions. Additionally, this marks the first instance of an augmented broadcast encryption scheme secure under standard assumptions. Contribution 2.3: in the domain of attribute-based encryption schemes, we propose a novel scheme constructed using dually computable accumulators. This innovation results in the first attribute-based encryption scheme with constant size ciphertexts and secret keys. It is also noteworthy that this marks the first application of cryptographic accumulators for encryption, extending their use beyond key management. Contribution 2.4: we explore, through a practical use case involving a sharing platform for connected devices, the utility of ciphertext policy attribute-based encryption for access control. We provide evidence that when this encryption method safeguards both the access policy associated with the ciphertext and the user's attributes during secret key requests, our access control protocol upholds the privacy of all platform participants. Furthermore, we introduce a novel ciphertext policy attributebased encryption scheme derived from the privacy-preserving key generation identity-based encryption with wildcards scheme.

These contributions have led to the acceptance of some articles, while others are currently under submission.

• Our two articles "(Augmented) Broadcast Encryption From Identity-Based Encryption with Wildcards" [START_REF] Barthoulot | Augmented) Broadcast Encryption from Identity-Based Encryption with Wildcard[END_REF] and "Dually Computable Cryptographic Accumulators and Their Application To Attribute-Based Encryption" [START_REF] Barthoulot | Dually Computable Cryptographic Accumulators and Their Application to Attribute Based Encryption[END_REF] were respectively presented at the 21st International Conference on Cryptology and Network (CANS 2022) and the 22st International Conference on Cryptology and Network (CANS 2023). • Our articles "SoK: Recent Developments in Cryptographic Accumulators -Properties, Security, and Beyond" (presenting Contribution 1.5) and "Adapting Identitybased Encryption with Wildcards to Access Control" (Contributions 1.1, 1.4 and 2.4) are under submission. More details about our publications are given in Section 8. Table 1.1 provides a list of articles and chapters where you can find our various contributions.

Notations and Mathematical Background

• Vectors are written with bold face lower case letters, patterns and matrices with bold face upper case letters. • R, N, Z, Z N = Z/N Z respectively represent the usual sets of real numbers, natural numbers, integers and integers modulo N . • GL(n, Z p ) for n ∈ N and p prime is the set of n × n invertible matrices over Z p . It is called the general linear group. • For a set S and an integer l, S l corresponds to S × • • • × S l times .

• For a, b ∈ N we denote {1, 2, • • • , a} as [a], and {a, a + 1, • • • , b} as a, b when a ̸ = 1. • For every finite set S, x ← S denotes a uniformly random element x from the set S. • A security parameter is denoted by λ, where λ ∈ N.

• The notation "∈ poly(λ)" means to be polynomial in the security parameter.

• Unless specified, we consider that any Probabilistic Polynomial Time (PPT) adversary A has output in {0, 1}. • The advantage of an adversary A to win a security game Game is written Adv Game Definition 2.1.2 Characteristic polynomial [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF]. A set X = {x 1 , • • • , x n } with elements x i ∈ Z p can be represented by a polynomial following an idea introduced in [START_REF] Michael | Efficient Private Matching and Set Intersection[END_REF].

The polynomial Ch X [z] = n i=1 (x i + Z) from Z p [Z], where Z is a formal variable, is called the characteristic polynomial of X . In what follows, we will denote this polynomial simply by Ch X and its evaluation at a point y as Ch X (y).

{X i } of degree k ≤ n is the polynomial σ k (X 1 , • • • , X n ) = 1≤i 1 ̸ ≤•••̸ ≤i k ≤n X i 1 • • • X i k . Notice that σ 1 (X 1 , • • • , X N ) = n i=1 X i and σ n = n i=1 X i . Note 2.1.1 Let X = {X 1 , • • • , X n }. Notice that Ch X [Z],
which is equals to n i=1 (X i + Z) by definition, is also equals to

Z n + σ 1 (X 1 , • • • , X n )Z n-1 + σ 2 (X 1 , • • • , X n )Z n-2 + • • • + σ n (X 1 , • • • , X n ).
We now recall some algebra definitions. Definition 2.1.4 Group. Let G be a non-empty set and • be a binary law over G. We say that (G, •) is a group if it satisfies three requirements:

• the law • is associative, meaning that for all g 1 , g 2 , g 3 ∈ G, we have that (g 1 •g 2 )•g 3 = g 1 • (g 2 • g 3 );

• there exists an identity element in G, denoted 1 G , such that for all g ∈ G, we have that 1 G • g = g • 1 G = g; • for each g 1 ∈ G, there exists an element g 2 ∈ G such that g 1 • g 2 = 1 G and g 2 • g 1 = 1 G , where 1 G is the identity element. For each g 1 , the element g 2 , called the inverse of g 1 , is unique and denoted by g -1 1 .

Notation 2.1.1 For any g ∈ G and any i ∈ N, we write

g i = g • • • • • g i times .
Notation 2.1. [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF] We here decided to define a group with multiplicative notation •. We can also define a group with additive notation, where the law, the identity element and the inverse element of g 1 are respectively written +, 0 G and -g 1 .

Definition 2.1.5 Commutative group. The group (G, •) is said to be commutative (or abelian) if for all g 1 , g 2 ∈ G, g 1 • g 2 = g 2 • g 1 .

element 1 A ∈ A such that for all a ∈ A, a ̸ = , 1 A • a = a • 1 A = a, we say that 1 A is the multiplicative identity. The ring (A, +, •) is then called unit ring.

Definition 2.1.17 Multiplicative inverse. Let (A, +, •) be a ring. For a 1 ∈ A, if there exists an element a 2 ∈ A such that a 1 • a 2 = 1 A and a 2 • a 1 = 1 A we say that a 2 is the multiplicative inverse of a 1 and is written a -1 1 .

Definition 2.1.18 Field. A ring (A, +, •) is called a field if all elements in A except 0 A have a multiplicative inverse.

Notation 2.1. [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF] The ring (A, +, •) is sometimes refer to as A and a field is often denoted by (F , +, •) or simply by F .

Definition 2.1.19 Vector space. Let F be a field, and V be a non-empty set together with two binary operations + : V × V → V and • : F × V → V . We say that (V , +, •) F is a vector space over a field F if it satisfies the following conditions, where elements of F are called scalar and elements of V are called vectors:

• (V , +) is an abelian group.

• Scalar multiplication is associative:

for any λ 1 , λ 2 ∈ F , v ∈ V , λ 1 •(λ 2 •v) = (λ 1 •λ 2 )•v.
• Scalar multiplication is distributive over vector addition: for any v 1 , v 2 ∈ V and any λ ∈ F , λ(v 1 + v 2 ) = λv 1 + λv 2 . • Scalar multiplication is distributive over scalar addition: for any λ 1 , λ 2 ∈ F and any v ∈ V :

(λ 1 ⊕ λ 2 ) • v = λ 1 • v + λ 2 • v,
where ⊕ is the addition law over F .

• There exists an element 1 F ∈ F such that for all v ∈ V , 1

F • v = v • 1 F = v.
This element is called the identity element of scalar multiplication.

In the following, we will refer to the vector space (V , +, •) F as V F , or as V over F .

Definition 2.1.20 Linear combination. Let V be a vector space over field F and

{v 1 , v 2 , • • • , v k } (for k ∈ N) be a set of elements of V . A linear combination of the elements v 1 , v 2 , • • • , v k is an element of V of the form a 1 • v 1 + a 2 • v 2 + • • • + a k v k
where the scalar a 1 , • • • a k ∈ F are called the coefficients of the linear combination.

Definition 2.1.21 Linear independence. Let V be a vector space over field F and

{v 1 , v 2 , • • • , v k } (for k ∈ N) be a set of elements of V . The elements v 1 , v 2 , • • • , v k are
said to be linearly independent if a linear combination of them results in the vector 0 if and only if all its coefficients are zero.

Definition 2.1.22 Basis and dimension. Let V be a vector space over field F , and B be a subset of V . We say that B is a basis of V if its elements are linearly independent and if every element of V can be written as a unique finite linear combination of the elements of B. The number of elements in B is called the dimension of V and is the same for all bases of V . If |B| is finite, we say that V has finite dimension.

Definition 2.1.23 Linear isomorphism. Let V , W be two vector spaces over the same field F . A function f : V → W is to be a linear map if for any two vectors v 1 , v 2 ∈ V and any scalar λ ∈ F the following conditions are respected:

• f (v 1 + v 2 ) = f (v 1 ) + f (v 2 ). • f (λv 1 ) = λf (v 1
). If f is bijective then f is called linear isomorphism. Note 2.1. 4 Let F be a field and F n be the set of the n-tuples of elements of F . Then F n is a vector space over F . Definition 2.1.24 Canonical basis. Let e i for i ∈ [n] be vectors equals to F except at position i where they are equals to 1 F . Then {e i } n i=1 form an basis of F n and is called standard basis or canonical basis.

Let V be a vector space of finite dimension n over field F and ϕ : F n → V be a linear isomorphism. Then the image of {e i } n i=1 by ϕ forms the canonical basis of V .

Bilinear Pairing

In this thesis, we will focus on a particular branch of cryptography, called pairing-based cryptography which relies on a specific function called a pairing. We formally define this function, its properties and security assumptions related.

Definitions

Definition 2.2.1 Bilinear Pairing. A bilinear pairing on (G 1 , G 2 , G T ), where G 1 , G 2 , G T are three groups of same order N , is a map e : G 1 × G 2 → G T that satisfies the following conditions:

1. Bilinearity: for all g 1 ∈ G 1 , g 2 ∈ G 2 , a, b ∈ Z N , e(g a 1 , g b 2 ) = e(g 1 , g 2 ) ab .

2. Non-degeneracy: for all g 1 ∈ G 1 , g 2 ∈ G 2 such that g 1 ̸ = 1 G 1 and g 2 ̸ = 1 G 2 , we have that e(g 1 , g 2 ) ̸ = 1 G T , where 1 G 1 , 1 G 2 , 1 G T are respectively the identity element of G 1 , G 2 , G T . 3. Computability: e must be efficiently computable.

Actually there exist three kinds of bilinear pairing:

• Type 1: in this kind of paring G 1 = G 2 . The pairing is also said to be symmetric. In this case we will denote G 1 by G. • Type 2: in this kind of pairing G 1 ̸ = G 2 and there exists an efficiently computable isomorphism ψ : G 2 → G 1 . • Type 3: in this kind of pairing G 1 ̸ = G 2 and no efficiently computable isomorphism is known from G 2 to G 1 (or from G 1 to G 2 ).

Note 2.2.1

In the above definition, the groups order N can be either prime or composite. The group G 2 is written H sometimes.

Some works, such as [START_REF] Galbraith | Pairings for Cryptographers[END_REF], show that Type 3 pairing offers better performance and flexibility. Therefore it this thesis we will try as much as possible to use Type 3 bilinear pairing, when instantiating our cryptographic schemes in the bilinear pairing setting.

Definition 2.2.2 Asymmetric bilinear pairing groups [START_REF] Groth | On the Size of Pairing-Based Non-interactive Arguments[END_REF][START_REF] Kim | Scalable Wildcarded Identity-Based Encryption[END_REF]. Asymmetric bilinear pairing groups (of prime order) Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e) are tuple of prime p, cyclic groups G 1 , G 2 , G T of order p, g 1 ∈ G 1 , g 2 ∈ G 2 generators of respectively G 1 and G 2 , and a bilinear pairing e : G 1 × G 2 → G T . An asymmetric bilinear pairing group also possesses efficient algorithms, called generic group operations, for computing group operations, evaluating the bilinear pairing, deciding membership of the groups, equality of group elements and sampling generators of the groups.

Note 2.2.2

From this definition, we can easily derived the definition of asymmetric bilinear pairing groups of composite order, and symmetric bilinear pairing groups of prime or composite order.

In the following, we denote by G a generator of (a)symmetric bilinear pairing groups. Such generator takes as input a security parameter 1 λ . For short, we will sometimes used the term bilinear pairing group to denote (a)symmetric bilinear pairing group for prime (resp. composite) order.

We now present some properties and notations about bilinear pairing groups.

Property 2.2.1 [START_REF] Lewko | Tools for Simulating Features of Composite Order Bilinear Groups in the Prime Order Setting[END_REF] Let Γ = (N, G, G T , g, e) be a symmetric bilinear pairing group of composite order. Let N = p 1 p 2 • • • p m , where p 1 , p 2 , • • • , p m are distinct primes. For each p i , G has a subgroup of order p i denoted by G p i . We let g 1 , • • • , g m denote generators of G p 1 through G pm respectively. Each element g ∈ G can be expressed as g = g a 1 1 g a 2 2 • • • g am m for some a 1 , • • • , a m ∈ Z N , where each a i is unique modulo p i . We will refer to g a i 1 as the "G p i component" of g. When a i is congruent to zero modulo p i , we say that g has no G p i component. The subgroups G p 1 , • • • , G pm are "orthogonal" under the bilinear map e, meaning that if h ∈ G p i and u ∈ G p j for i ̸ = j, then e(h, u) = 1 G T , where 1 G T denotes the identity element in G T .

This structure is achieved naturally when the groups G, H, G T are of composite order N = p 1 p 2 • • • p m (where p 1 , • • • , p m are distinct primes), since we may set G i = G p i , H i = H p i to be the subgroups of order p i for each i. Notation 2.2. [START_REF] Abdalla | Brief Introduction to Provable Security[END_REF] In this work, we will consider individual elements of G 1 or G 2 but also "vectors" of group elements. For any vector v = (v 1 , • • • , v l ) ∈ Z l p and g β ∈ G β , g v β denote a l-tuple of elements of G β , for β = 1, 2:

g v β := (g v 1 β , • • • , g v l β )
For any a ∈ Z p and u, v ∈ Z l p , we have:

g av β := (g av 1 β , • • • , g av l β ), g v+u β := (g v 1 +u 1 β , • • • , g v l +u l β )
Then we define

e(g v 1 , g u 2 ) := l i=1 e(g v i 1 , g u i 2 ) = e(g 1 , g 2 ) v•u .
Here all the computations are done modulo p.

Security Assumptions and Problems

In this section we present bilinear pairing related security problems and assumptions that we will use in this thesis.

Definition 2.2.4 Decisional Diffie-Hellman problem in G 1 (DDH 1 ) [START_REF] Boneh | The Decision Diffie-Hellman problem[END_REF]. Let Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e) be an asymmetric bilinear pairing group of prime order and a, b, c be randoms in Z p . The DDH 1 problem consists, given as input ∆ = (Γ, g 1 , g 2 , g a 1 , g b 2 ) and t, in deciding if t = g ab 1 or t = g ab+c where the probability is taken over the random choice of generators (g 1 , g 2 ) ∈ G 1 × G 2 , the random choice of a, b, c ∈ Z p and the random bits consumed by A.

The dual of above problem is Decisional Diffie-Hellman problem in G 2 (denoted as DDH 2 ), which is identical to DDH 1 with the roles of G 1 and G 2 reversed.

Definition 2.2.5 Computational Diffie-Hellman problem in G 2 (CDH). Let Γ = (p, G 1 , G 2 , G T , e, g 1 , g 2 ) be an asymmetric bilinear pairing group of prime order and a, b be randoms in Z p . The CDH problem in G 2 consists, given as input (Γ, g a 2 , g b 2 ), in computing g ab

2 . An adversary A wins the CDH problem in G 2 with advantage ϵ if

Adv CDH A := Pr A(Γ, g a 2 , g b 2 ) = g ab 2 ≥ ϵ
where the probability is taken over the random choice of generators (g 1 , g 2 ) ∈ G 1 × G 2 , the random choice of a, b ∈ Z p and the random bits consumed by A.

Definition 2.2.6 Symmetric External Diffie-Hellman assumption (SXDH) [START_REF] Boneh | Short Group Signatures[END_REF]. The SXDH assumption holds if DDH problems are intractable in both G 1 and G 2 .

Definition 2.2.7 Decisional Linear problem (DLin) [START_REF] Boneh | Short Group Signatures[END_REF]. Let Γ = (p, G, G T , g, e) be a symmetric bilinear pairing group of prime order, u, v, h be arbitrary generators of G and a, b, c be randoms in Z p . The DLin problem consists, given as input ∆ = (Γ, u, v, h, u a , v b ) and t, in deciding if t = h a+b or t = h c . An adversary A solves the DLin problem with advantage ϵ if

Adv DLin A := Pr A(∆, h a+b ) = 1 -Pr [A(∆, h c ) = 1] ≥ ϵ
where the probability is taken over the random choice of generators g, u, v, h ∈ G, the random choice of a, b, c ∈ Z p and the random bits consumed by A.

Definition 2.2.8 eXternal Decision Linear 1 problem (XDLin1) [START_REF] Abe | Structure-Preserving Signatures and Commitments to Group Elements[END_REF]. Let Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e) be an asymmetric bilinear pairing group group of prime order and x, y, a, b, c be randoms in Z p . The XDLin1 problem consists, given as input a tuple ∆ = (g 1 , g x 1 , g y 1 , g ax 1 , g by 1 , g 2 , g x 2 , g y 2 , g ax 2 , g by 2 ) and t, in deciding if t = g a+b 1 or t = g c 1 . An adversary A solves the XDLin1 problem with advantage ϵ if

Adv XDLin1 A := Pr A(∆, g a+b 1 ) = 1 -Pr [A(∆, g c 1 ) = 1] ≥ ϵ
where the probability is taken over the random choice of generators (g 1 , g 2 ) ∈ G 1 × G 2 , the random choice of x, y, a, b in Z p and the random bits consumed by A.

The eXternal Decision Linear 2 Assumption (XDLin2) is defined similarly, except that t is equal either to g a+b 2 , or to g c 2 .

Definition 2.2.9 ℓ-Bilinear Diffie-Hellman Exponent problem (ℓ-BDHE) [START_REF] Boneh | Hierarchical Identity Based Encryption with Constant Size Ciphertext[END_REF]. Let Γ = (p, G, G T , g, e) be a symmetric bilinear pairing group of prime order, h be a generator of G and α be a random in Z * p . The ℓ-BDHE problem consists, given (g, h, g α , g α 2 , • • • , g α l-1 , g α l+1 , • • • , g α 2l ), in computing e(g, h) α l . An adversary A solves the ℓ-BDHE problem with advantage ϵ if Adv ℓ-BDHE A := Pr A(g, h, g α , g α 2 , • • • , g α l-1 , g α l+1 , • • • , g α 2l ) = e(g, h) α l ≥ ϵ where the probability is taken over the random choice of generators g, h in G, the random choice of α in Z * p , and the random bits used by A.

Definition 2.2.10 q-strong Diffie-Hellman Problem (q-SDH) [START_REF] Boneh | Short Signatures Without Random Oracles and the SDH Assumption in Bilinear Groups[END_REF]. Let G 1 , G 2 be two cyclic groups of prime order p, where possibly G 1 = G 2 . Let g 1 be a generator of G 1 , g 2 a generator of G 2 and x be random in Z * p . The q-SDH problem consists, given a (q + 3)tuple (g 1 , g x 1 , g

x 2 1 , • • • , g x q 1 , g 2 , g x 2 ) ∈ G q+1 1 × G 2 2
, in computing a pair (g

1/(x+c) 1
, c) ∈ G 1 × Z p . An adversary A solves the q-SDH problem with advantage ϵ if

Adv q-SDH A := Pr A(g 1 , g x 1 , • • • , g x q 1 , g 2 , g x 2 ) = (g 1/(x+c) 1 , c) ≥ ϵ
where the probability is taken over the random choice of generators (g 1 , g 2 ) ∈ G 1 × G 2 , the random choice of x ∈ Z * p , and the random bits consumed by A.

Note that when G 1 = G 2 , the pair (g 2 , g x 2 ) is redundant since in that case this pair can be generated by raising (g 1 , g x 1 ) to a random power.

Note 2.2.3

This problem is a stronger version of the original q-SDH problem, introduced by Boneh and Boyen in 2004 [START_REF] Boneh | Short Signatures Without Random Oracles[END_REF]. The reduction of the 2004 version to the 2008 version can be done easily, as explained in [START_REF] Tanaka | On the q-Strong Diffie-Hellman Problem[END_REF].

We now present a modified version of this problem, introduced in 2016 by Ghosh et al. [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF].

Definition 2.2.11 (symmetric) q-strong Bilinear Diffie Hellman problem (q-sSBDH) [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF]. Let Γ = (p, G, G T , g, e) be a symmetric bilinear pairing group of prime order and x be random in Z * p . The q-sSBDH problem consists, given as input a (q + 1)-tuple of elements (g, g x , g

(x 2 ) , • • • , g (x q ) ) ∈ G q+1 , in computing a pair (c, e(g, g) 1/(x+c) ) ∈ Z p × G T for a freely chosen value c ∈ Z p \ {-x}. An adversary A solves the q-sSBDH problem with advantage ϵ if Adv q-sSBDH A := Pr A(g, g x , g (x 2 ) , • • • , g (x q ) ) = (c, e(g, g) 1/(x+c) ) ≥ ϵ
where the probability is taken over the random choice of generator g ∈ G 1 , the random choice of x ∈ Z * p , and the random bits consumed by A.

In this thesis, we will use the asymmetric different version of the above problem, that we present below.

Definition 2.2.12 (asymmetric) q-strong Bilinear Diffie Hellman problem (q-SBDH)

.

Let Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , p
) be an asymmetric bilinear pairing group of prime order and x be random in Z * p . The q-SBDH problem consists, given as input a (2q + 2)-tuple of elements (g 1 , g x 1 , g

(x 2 ) 1 , • • • , g (x q ) 1 , g 2 , g x 2 , g (x 2 ) 2 , • • • , g (x q ) 2 ) ∈ G q+1 1 × G q+1 2 , in computing a pair (c, e(g 1 , g 2 ) 1/(x+c) ) ∈ Z p × G T for a freely chosen value c ∈ Z p \ {-x}. An adversary A solves the q-SBDH problem with advantage ϵ if Adv q-SBDH A := Pr A(g 1 , g x 1 , g (x 2 ) 1 , • • • , g (x q ) 1 , g 2 , g x 2 , g (x 2 ) 2 , • • • , g (x q ) 2 ) = (c, e(g 1 , g 2 ) 1/(x+c) ) ≥ ϵ
where the probability is taken over the random choice of generators (g 1 , g 2 ) ∈ G 1 × G 2 , the random choice of x ∈ Z * p , and the random bits consumed by A.

We easily see that the q-SBDH problem is reductible to the q-SDH problem: for a given q-SBDH tuple (g

1 , g x 1 , • • • , g x q 1 , g 2 , g x 2 , • • • , g x q 2
), one can create the truncated tuple

(g 1 , g x 1 , • • • , g x q 1 , g 2 , g x 2 )
and inputs it to the oracle of q-SDH problem, to obtain (g

1/(x+c) 1
, c) and finally (c, e(g

1/(x+c) 1 , g 2 )) = (c, e(g 1 , g 2 ) 1/(x+c) ).
Definition 2.2.13 n-Extended Decisional Diffie-Hellman problem in G 1 (n-eDDH) [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF].

Let Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e
) be an asymmetric bilinear pairing group, κ be a random in Z * p and ω, {h i , γ i } n i=1 be randoms in Z p . The n-eDDH problem consists, given as input

∆ = (Γ, g κ 1 , g ω+γ i h i 1 , g γ i 1 , g h i 1 n i=1 ) and t in deciding if t = g κω 1 or t is a random element y of G 1 . A PPT adversary A solves the DDH problem in G with advantage ϵ if Adv n-eDDH A := |Pr [A(∆, g κω 1 )] -Pr [A(∆, y)]| ≥ ϵ
where the probability is taken over the random choice of generator

g 1 ∈ G 1 , κ ∈ Z * p , ω, {h i , γ i } n
i=1 ∈ Z p and the random bits consumed by A.

Definition 2.2.14 General Subgroup Decision problem (GSD) [START_REF] Bellare | Identity-Based Encryption Secure against Selective Opening Attack[END_REF][START_REF] Lewko | Tools for Simulating Features of Composite Order Bilinear Groups in the Prime Order Setting[END_REF].

Let S 0 , S 1 , S 2 , • • • , S k be non-empty subsets of [m] such that for each 2 ≤ j ≤ k, either S j ∩ S 0 = ∅ = S j ∩ S 1 or S j ∩ S 0 ̸ = ∅ ̸ = S j ∩ S 1 . Let Γ = (N = p 1 • • • p m , G, G
T , e be a symmetric bilinear pairing composite order group and randoms

Z 0 ← G S 0 , Z 1 ← G S 1 , Z 2 ← G S 2 , • • • , Z k ← G S k . The general subgroup decision problem consists, given ∆ = (Γ, Z 2 , • • • , Z k ) and t, in deciding if t = Z 0 or t = Z 1 .
An adversary A solves the general subgroup decision problem with advantage ϵ if

Adv GSD A := |Pr [A(∆, Z 0 ) = 1] -Pr [A(∆, Z 1 ) = 1]| ≥ ϵ
where the probability is taken over the random choice of Z 0 , • • • , Z k and the random bits consumed by A.

Dual Pairing Vector Spaces

Dual Pairing Vector Spaces is a concept of pairing-based cryptography, introduced by Okamoto and Takashima [START_REF] Okamoto | Homomorphic Encryption and Signatures from Vector Decomposition[END_REF][START_REF] Okamoto | Hierarchical Predicate Encryption for Inner-Products[END_REF] that we will use in this thesis to build our cryptographic schemes and prove their security. In this section we present this concept along with its properties and security assumptions.

Definitions and Properties

Definition 2.3.1 Dual Pairing Vector Spaces (DPVS) [START_REF] Okamoto | Hierarchical Predicate Encryption for Inner-Products[END_REF]. Dual pairing vector spaces (p, V , V * , G T , A, A * ) are a tuple of a prime p, two N -dimensional vector spaces V , V * over Z p , a cyclic group G T of order p, and their canonical bases i.e., A = (a

1 , • • • , a N ) of V and A * = (a * 1 , • • • , a * N ) of V * that
satisfy the following conditions: • Non-degenerate bilinear pairing: there exists a polynomial-time computable nondegenerate bilinear pairing e : V × V * → G T i.e., e(sx, ty) = e(x, y) st and if e(x, y) = 1 T for all y ∈ V * , then x = 0.

• Dual orthonormal bases: A, A * , and e satisfy e(a i , a * j ) = g

δ i,j
T for all i and j, where δ i,j = 1 if i = j, and 0 otherwise, and g T ̸ = 1 T ∈ G T .

• Distorsion maps: endomorphisms ϕ i,j of V such that ϕ i,j (a j ) = a i and ϕ i,j (a k ) = 0 if k ̸ = j are polynomial-time computable. Moreover, endomorphisms ϕ * i,j of V * such that ϕ i,j (a * j ) = a * i and ϕ i,j (a * k ) = 0 if k ̸ = j are also polynomial-time computable. We call ϕ i,j and ϕ * i,j "distortion maps".

Chapter 2 -Mathematical Background

We now present a typical construction of dual pairing vector space as a product of bilinear pairing group, that was first presented in [START_REF] Okamoto | Homomorphic Encryption and Signatures from Vector Decomposition[END_REF].

Let Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e
) be an asymmetric bilinear pairing group of prime order. The construction (where the description of distortion maps is omitted) is the following:

• Vector spaces V and V * :

V := N G 1 × • • • × G 1 and V * := N G 2 × • • • × G 2 , whose elements are expressed by N -dimensional vectors, x := (g x 1 1 , • • • , g x N 1
) and y := (g

y 1 2 , • • • , g y N 2 ), respectively (x i , y i ∈ F q for i = 1, • • • , N ). • Canonical bases A and A * : A := (a 1 , • • • , a N ) of V , where a 1 := (g 1 , 1, • • • , 1), a 2 := (1, g 1 , 1, • • • , 1), • • • , a N := (1, • • • , 1, g 1 ). A * := (a * 1 , • • • , a * N ) of V * , where a * 1 := (g 2 , 1, • • • , 1), a * 2 := (1, g 2 , 1, • • • , 1), • • • , a * N := (1, • • • , 1, g 2 ). • Pairing operation: e(x, y) := N i=1 e(g x i 1 , g y i 2 ) = e(g 1 , g 2 ) N i=1 x i y i = e(g 1 , g 2 ) x•y ∈ G T for the above x ∈ V and y ∈ V * . • Base change: canonical basis A is changed to basis B := (b 1 , • • • , b N ) of V using a uniformly chosen (regular) linear transformation, X := (χ i,j ) ← GL(N, F p ), such that b i = N j=1 χ i,j a j , (i = 1, • • • , N ). A * is also changed to basis B * := (b * 1 , • • • , b * N ) of V * , such that (ϑ) i,j := (X ⊤ ) -1 , b * i = N j=1 ϑ i,j a * j , (i = 1, • • • , N ). We see that e(b i , b * j ) = e(g 1 , g 2 ) δ i,j , (δ i,j = 1 if i = j, and δ i,j = 0 if i ̸ = j), i.e.
B and B * are dual orthonormal basis of V and V * .

• Intractable Problem: one of the most natural decisional problems is the decisional subspace problem (DSP). The DSP N 1 ,N 2 assumption is: it is hard to distinguish

v := v N 2 +1 b N 2 +1 +• • •+v N 1 b N 1 from u := (v 1 b 1 +• • •+v N 1 b N 1 ), where (v 1 , • • • , v N 1 ) ← F N 1 q
and N 2 + 1 < N 1 . DSP is intractable if the generalized DDH or DLin problems are intractable.

• Trapdoor: although the DSP problem is assumed to be intractable, it can be efficiently solve by using trapdoor

t * ∈ span⟨b * 1 , • • • , b * N 2 ⟩. Given v := v N 2 +1 b N 2 +1 + • • • + v N 1 b N 1 from u := (v 1 b 1 + • • • + v N 1 b N 1 )
, we can tell v from u using t * since e(v, t * ) = 1 and e(u, t * ) ̸ = 1 with high probability.

In our work, for simplicity of the reading, we will use the following (simplified) definition of DPVS. Definition 2.3.2 Dual pairing vector spaces (DPVS) [START_REF] Chen | Shorter IBE and Signatures via Asymmetric Pairings[END_REF]. For a prime p and a fixed (constant) dimension n, two random bases For

B = (b 1 , • • • , b n ) and B * = (b * 1 , • • • , b * n ) of Z n p are said to be dual orthonormal, if b i • b * j = 0 (mod p) whenever i ̸ = j, and b i • b * i = ψ (mod p) for all i, where ψ is a uniformly random element of Z * p . For generators g 1 ∈ G 1 and g 2 ∈ G 2 , notice that e(g b i 1 , g b * j 2 ) = 1 whenever i ̸ = j,
n 1 , • • • , n d fixed (constant) dimension, d tuples of two random bases B i , B * i of Z n i p for i = 1, • • • , d, are said to be dual orthonormal if b j,i • b *
k,i = 0 mod p whenever j ̸ = k, and b j,i • b * j,i = ψ mod p for all j and i, where ψ is a random element of Z * p . A generation algorithm of such tuples is denoted by

Dual(Z n 1 p , • • • , Z n d p ).
Note 2.3.1 In the above definition, one can choose, for convenience, to use ψ = 1 as in the work of Lewko [START_REF] Lewko | Functional encryption : new proof techniques and advancing capabilities[END_REF]. In our work, we do not enforce the condition ψ = 1, though it remains a possibility.

We now present a way to produce new dual orthonormal bases from randomly sampled dual orthonormal bases. This construction was presented by Lewko in [START_REF] Lewko | Tools for Simulating Features of Composite Order Bilinear Groups in the Prime Order Setting[END_REF]. The following lemma formalized the fact that the above constructed bases (B A , B * A ) are dual orthonormal. Lemma 2.3.1 [START_REF] Lewko | Tools for Simulating Features of Composite Order Bilinear Groups in the Prime Order Setting[END_REF] For any fixed positive integers m ≤ n, any fixed invertible matrix

A ∈ Z m×m p and set S m ⊆ [n] of size m, if (B, B * ) ← Dual(Z d p ), then (B A , B A * ) is also distributed as a random sample from Dual(Z d p ).
In particular, the distribution of (B A , B A * ) is independent of A. [START_REF] Lewko | Tools for Simulating Features of Composite Order Bilinear Groups in the Prime Order Setting[END_REF]. In the above construction, if the distribution of the final bases (B A , B A * ) reveals nothing about the matrix A employed, we say that the construction is parameter hiding. Note 2.3.2 Dual orthonormal bases (B, B * ) in prime order groups achieved canceling bilinear maps. Each subgroup G i corresponds to the span of vector b i in the exponent of group G 1 , and each subgroup H i corresponds to the span of the vector b * i in the exponent of group G 2 .

Definition 2.3.3 Parameter hiding

Security Assumptions and Problems

In this subsection, we introduce dual pairing vector spaces security assumptions and problems that we will use in our security proofs.

Definition 2.3.4 Decisional subspace problem in G 1 (DS1) [51]. Let Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e
) be an asymmetric bilinear pairing group of prime order, k, n be fixed positive integers that satisfy 2k ≤ n, (B, B * ) be two random dual orthonormal bases of Z n p and τ 1 , τ 2 , µ 1 , µ 2 be randoms of Z p . Define the following elements

u 1 = g µ 1 .b * 1 +µ 2 .b * k+1 2 , • • • , u k = g µ 1 .b * k +µ 2 b * 2k 2 , v 1 = g τ 1 .b 1 1 , • • • , v k = g τ 1 .b k 1 , w 1 = g τ 1 .b 1 +τ 2 b k+1 1 , • • • , w k = g τ 1 .b k +µ 2 b 2k 1 . The decisional subspace problem in G 1 consists, given tuple ∆ = (Γ, g b * 1 2 , • • • , g b * k 2 , g b * 2k+1 2 , • • • , g b * n 2 , g b 1 1 , • • • , g bn 1 , u 1 , • • • , u k , µ 2 ) and (t 1 , • • • , t k ), in deciding if (t 1 , • • • , t k ) = (v 1 , • • • , v k ) or (t 1 , • • • , t k ) = (w 1 , • • • , w k ). An adversary A solves the decisional subspace prob- lem in G 1 with advantage ϵ if Adv DS1 A := |Pr [A(∆, v 1 , • • • , v k ) = 1] -Pr [A(D, w 1 , • • • , w k ) = 1]| ≥ ϵ
where the probability is taken over the random choice of generators (g 1 , g 2 ) ∈ G 1 × G 2 , the random choice of B, B * , τ 1 , τ 2 , µ 1 , µ 2 and the random bits consumed by A. The idea of the proof is that if there exists an adversary that breaks the decisional subspace problem in G 1 , then one can create an adversary against the DDH problem in G 1 . For more details on the proof, refer to [START_REF] Chen | Shorter IBE and Signatures via Asymmetric Pairings[END_REF]. The decisional subspace problem in G 2 is defined as identical to DS1 with the roles of G 1 and G 2 reversed. DS2 holds if DDH in G 2 holds. The proof is done as for G 1 .

We now present three problems, Problem 1, Problem 2 and Problem 3, useful for our security proofs. These three problems were first defined in [START_REF] Okamoto | Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption[END_REF] for the symmetric bilinear setting, and proven to hold if DLin holds. We adapt them to the asymmetric bilinear setting, and prove that they hold if XDLin 1 and XDLin 2 hold.

Definition 2.3.5 Problem 1. Let Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e
) be an asymmetric bilinear pairing group of prime order, (D, D * ) be random dual orthonormal bases of

Z 4n+2 p , D * = (d * 0 , • • • , d * n , d * 2n+1 , • • • , d * 4n+1
) and ω, γ, z be randoms of Z p . For i ∈ 2, n define the following elements e 0,1 = g

ωd 1 +γd 4n+1 1 , e 1,1 = g ωd 1 +zd n+1 +γd 4n+1 1 , e i = g ωd i 1 .
Problem 1 consists, given ∆ = (Γ, D, D * , {e i } i∈ 2,n ) and t, in deciding if t = e 0,1 or t = e 1,1 . An adversary A solves Problem 1 with advantage ϵ if

Adv P 1 A := |Pr [A(∆, e 0,1 ) = 1] -Pr [A(∆, e 1,1 ) = 1]| ≥ ϵ
where the probability is taken over the random choice of generator g 1 ∈ G 1 , random choice of (D, D * ), ω, γ, z in Z p , and the random bits consumed by A.

Lemma 2.3.3 For any adversary A, there is a probabilistic adversary B, whose running time is essentially the same as that of A, such that for any security parameter λ,

Adv P 1 A (λ) ≤ Adv XDLin1 B (λ) + 5/p. Definition 2.3.6 Problem 2. Let Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e
) be an asymmetric bilinear pairing group of prime order, (D, D * ) be random dual orthonormal bases of

Z 4n+2 p , D = (d 0 , • • • , d n , d 2n+1 , • • • , d 4n+1 ) and δ, τ, δ 0 , ω, σ be random elements of Z p . For i ∈ [n] define the following elements h * 0,i = g δd * i +δ 0 d * 3n+i 2 , h * 1,i = g δd * i +τ d * n+i +δ 0 d * 3n+i 2 , e i = g ωd i +σd n+i 1 . Problem 2 consists, given ∆ = (Γ, D, D * , {e i } i∈[n] ) and {t ß } i∈[n] , in deciding if (t 1 , • • • , t n ) = (h * 0,1 , • • • , h * 0,n ) or (t 1 , • • • , t n ) = (h * 1,1 , • • • , h * 1,n ). An adversary A solves Problem 2 with advantage ϵ if Adv P 2 A := Pr A(∆, {e 0,i } i∈[n] ) = 1 -Pr A(∆, {e 1,i } i∈[n] ) = 1 ≥ ϵ
where the probability is taken over the random choice of generators (g 1 , g 2 ) ∈ G 1 × G 2 , random choice of (D, D * ), δ, τ, δ 0 , ω, σ in Z p , and the random bits consumed by A.

Lemma 2.3.4

For any adversary A, there is a probabilistic adversary B, whose running time is essentially the same as that of A, such that for any security parameter λ,

Adv P 2 A (λ) ≤ Adv XDLin2 B (λ) + 5/p. Definition 2.3.7 Problem 3. Let Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e
) be an asymmetric bilinear pairing group of prime order, (D, D * ) be two random dual orthonormal bases of

Z 4n+2 p , D = (d 0 , • • • , d n , d 2n+1 , • • • , d 4n+1 ), D * = (d * 0 , • • • , d * n , d * 2n+1 , • • • , d * 4n+1 ) and τ, δ 0 , ω, ω ′ , ω ′′ , κ ′ , κ ′′ be randoms in Z p . For i ∈ [n] define the following elements h * 0,i = g τ d * n+i +δ 0 d * 3n+i 2 , h * 1,i = g τ d * 2n+i +δ 0 d * 3n+i 2 , e i = g ω ′ d n+i +ω ′′ d 2n+i 1 , f i = g κ ′ d n+i +κ ′′ d 2n+i 1 . Problem 3 consists, given ∆ = (Γ, D, D * , {e i , f i } i∈[n] ) and {t i } i∈[n] , in deciding if (t 1 , • • • , t n ) = (h * 0,1 , • • • , h * 0,n ) or (t 1 , • • • , t n ) = (h * 1,1 , • • • , h * 1,n
). An adversary A solves Problem 3 with advantage ϵ if

Adv P 3 A := Pr A(∆, h * 0,i i∈[n] ) = 1 -Pr A(∆, h * 1,i i∈[n] ) = 1 ≥ ϵ
where the probability is taken over the random choice of generators

(g 1 , g 2 ) ∈ G 1 × G 2 , random choice of (D, D * ), τ, δ 0 , ω, ω ′ , ω ′′ , κ ′ , κ ′′ in Z p ,

and the random bits consumed by

A.

Lemma 2.3.5 For any adversary A, there is a probabilistic adversary B, whose running time is essentially the same as that of A, such that for any security parameter λ,

Adv P 3 A (λ) ≤ Adv XDLin2 B (λ) + 7/p.
The proofs of Lemmas 2.3.3, 2.3.4 and 2.3.5 are done in Appendix C of our paper [START_REF] Barthoulot | Augmented) Broadcast Encryption from Identity-Based Encryption with Wildcard[END_REF], which is the full version of our work [START_REF] Barthoulot | Augmented) Broadcast Encryption from Identity-Based Encryption with Wildcard[END_REF]. It follows the reductions made for [START_REF] Okamoto | Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption[END_REF]'s problems to DLin (which themselves relies on [START_REF] Okamoto | Fully Secure Functional Encryption with General Relations from the Decisional Linear Assumption[END_REF]'s proofs as [START_REF] Okamoto | Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption[END_REF]'s problems 1 and 2 are essentially the same as [START_REF] Okamoto | Fully Secure Functional Encryption with General Relations from the Decisional Linear Assumption[END_REF]'s basic problems 1 and 2.)

Z 4n+2 p , D * = (d * 0 , • • • , d * n , d * 2n+1 , • • • , d * 4n+1 )
, ω, γ be random elements of Z p and {z i } n i=1 be random vector of Z n p . For i ∈ 2, n define the following elements e 0,1 = g

ωd 1 +γd 4n+1 1 , e 1,1 = g ωd 1 + n l=1 n j=1 z l,j d n+l +γd 4n+1 1 , e i = g ωd i 1 .
Problem 1 bis consists, given ∆ = (Γ, D, D * , {e i } i∈ 2,n ) and t, in deciding if t = e 0,1 or t = e 1,1 . An adversary A solves Problem 1 bis with advantage ϵ if

Adv P 1b A := |Pr [A(∆, t) = 1] -Pr [A(∆, t) = 1]| ≥ ϵ
where the probability is taken over the random choice of generator

g 1 ∈ G 1 , random choice of (D, D * ), ω, γ in Z p , {z i } n i=1 in Z n
p and the random bits consumed by A.

Lemma 2.3.6 For any adversary A, there is a probabilistic adversary B, whose running time is essentially the same as that of A, such that for any security parameter λ,

Adv P 1b A (λ) ≤ Adv XDLin1 B (λ) + 5/p. Definition 2.3.9 Problem 2 bis. Let Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e
) be an asymmetric bilinear pairing group of prime order, (D, D * ) be random dual orthonormal bases of

Z 4n+2 p , D = (d 0 , • • • , d n , d 2n+1 , • • • , d 4n+1 ), δ, τ, δ 0 , ω, σ be random elements of Z p , {δ i } n i=1
be random vectors of Z n p , Z be a n × n invertible matrix over Z p , and U = (Z -1 ) ⊤ . For i ∈ [n] define the following elements

h * 0,i = g δd * i + n j=1 δ i,j d * 3n+i 2 , h * 1,i = g δd * i + n j=1 u i,j d * n+i + n j=1 δ i,j d * 3n+i 2 , e i = g ωd i +τ n j=1 z i,j d n+i 1 . Problem 2 bis consists, given ∆ = (Γ, D, D * , {e i } i∈[n] ) and {t i } i∈[n] , in deciding if (t 1 , • • • , t n ) = (h * 0,1 , • • • , h * 0,n ) or (t 1 , • • • , t n ) = (h * 1,1 , • • • , h * 1,n
). An adversary A solves Problem 2 bis with advantage ϵ if

Adv P 2b A := Pr A(∆, h * 0,i i∈[n] ) = 1 -Pr A(∆, h * 1,i i∈[n] ) = 1 ≥ ϵ
where the probability is taken over the random choice of generators

(g 1 , g 2 ) ∈ G 1 × G 2 , random choice of (D, D * ), δ, τ, δ 0 , ω, σ in Z p , {δ i } n i=1 of Z n p , Z in GL(n, Z p )
and the random bits consumed by A. Lemma 2.3.7 For any adversary A, there is a probabilistic adversary B, whose running time is essentially the same as that of A, such that for any security parameter λ,

Adv P 2b A (λ) ≤ Adv XDLin2 B (λ) + 5/p.
d i • d * i = ψ for i ∈ {1, 2}, ψ ∈ Z *
p and where 1 denotes the identity element of G T . The FA-DPVS-I problem consists, given (Γ, g d 2 1 , g

d * 1 2 , g d * 2
2 ), in computing g d 1 1 . An adversary A solves FA-DPVS-I problem with advantage ϵ if

Adv F A-DP V S-I A := Pr A(Γ, g d 2 1 , g d * 1 2 , g d * 2 2 ) = g d 1 1 ≥ ϵ
where the probability is taken over the random choice of generators

(g 1 , g 2 ) ∈ G 1 × G 2 ,
the random choice of (D, D * ) and the random bits consumed by A.

Lemma 2.3.8

The fixed argument dual pairing vector spaces inversion assumption has a unique solution.

Proof 2.3.1 Breaking the assumption means to find an element t = (g

t 1 1 , g t 2 1 ) ∈ G 2 1 for t 1 , t 2 ∈ Z p such that    e(t, g d * 1
2 ) = e(g 1 , g 2 ) ψ e(t, g

d * 2 2 ) = 1 (2.1)
where ψ ∈ Z * p and 1 is the identity element of G T . The above system can be rewritten as

   e(g t 1 1 , g d * 1,1 2 ) • e(g t 2 1 , g d * 1,2 2 ) = e(g 1 , g 2 ) ψ e(g t 1 1 , g d * 2,1 2 ) • e(g t 2 1 , g d * 2,2 2 ) = 1 (2.2)
In the exponent, the system becomes

   t 1 d * 1,1 + t 2 d * 1,2 = ψ t 1 d * 2,1 + t 2 d * 2,2 = 0 (2.
* 1,1 d * 2,2 -d * 2,1 d * 1,2 ̸ = 0. By case-based reasoning we have that d * 1,1 d * 2,2 -d * 2,1 d * 1,2 = 0 if • (d * 1,1 , d * 1,2 ) or (d * 2,1 , d * 2,2
) is equal to (0, 0). This is not possible by dual pairing vector spaces definition. . In these cases the system ( 2.3) becomes

   t 1 d * 1,1 = ψ t 1 d * 2,1 = 0 or    t 2 d * 1,2 = ψ t 2 d * 2,2 = 0
, which does not have a solution. By definition of dual pairing vector spaces, this is not possible.

• (d * 1,1 , d * 1,2 ) = (d * 2,1 , d * 2,2
) which is not possible by definition of dual pairing vector spaces.

• (d * 2,1 , d * 2,2 ) = (d * 1,2 , d * 1,1 ). In this case the equation d * 1,1 d * 2,2 -d * 2,1 d * 1,2 = 0 that can be rewritten as d * 1,1 d * 2,2 = d * 2,1 d * 1,2 becomes d * 2 1,1 = d * 2 1,2
. We now have two cases:

-either d * 1,1 = d * 1,2 thus in this case (d * 1,1 , d * 1,2 ) = (d * 2,1 , d * 2,2
) which is not possible by definition of dual pairing vector spaces;

-or d * 1,1 = -d * 1,2 thus in this case the system 2.3 becomes    -d * 1,2 t 1 + d * 1,2 t 2 = 0 d * 1,2 t 1 -d * 1,2 t 2 = 0
and thus

   0 = ψ d * 1,2 t 1 = d * 1,2 t 2
which is not possible as ψ ̸ = 0.

Thus, by construction

d * 1,1 d * 2,2 -d * 2,1 d * 1,
2 ̸ = 0 and the above system as a unique solution:

t = g d 1 1
. □ Theorem 2.3.1 If the computational Diffie-Hellman assumption in G 2 holds, then the fixed argument dual pairing vector spaces inversion assumption holds.

To do the proof of the above theorem, we need an intermediate problem.

Note 2.3.4

The intermediate problem has a unique solution. Indeed we can rewrite the problem as a fixed pairing inversion problem [START_REF] Galbraith | Aspects of Pairing Inversion[END_REF] as its aim is to find, given g 2 ∈ G 2 and e(g 1 , g 2 ) ab ∈ G T (computed from the other inputs of the problem), t ∈ G 1 such that e(t, g 2 ) = e(g 1 , g 2 ) ab . Then as stated in [START_REF] Galbraith | Aspects of Pairing Inversion[END_REF], as e is non-degenerate and the groups G 1 , G 2 and G T are cyclic of prime order p, then solution to the above problem is unique.

d 1 = abb 1 , d 2 = ab 2 , d * 1 = b * 1 and d * 2 = bb * 2 .
We easily notice that (D, D * ) are dual orthonormal. Then A gives (Γ, g d 2 1 , g

d * 1 2 , g d * 2
2 ) to B. Notice that

g d 2 1 = (g a 1 ) b 2 , g d * 1 2 = g b * 1 2 and g d * 2 2 = (g b 2 ) d * 2 . B answers with t = (t 1 , t 2 ) ∈ G 2 1 , which is equal to g d 1 1 ∈ G 2
1 by uniqueness of the solution in FAP-DPVS-I assumption, and can be rewrite as (g

d 1,1 1 , g d 1,2 1 ). By construction, it is equal to (g abb 1,1 1 , g abb 1,2 1
) and A can returns t

(b 1,1 ) -1 1
as her answers as it is equal to g ab 1 .□

3

Cryptographic Preliminaries THI S chapter introduces formal methods for establishing the security of cryptographic schemes. Additionally, it presents three cryptographic primitives that we will use in this thesis.

Proving Security

When it comes to security, cryptography follows the principle established in the 19th century by Kerckhoffs: to ensure the security of an encryption scheme, the method must be public (it will inevitably become public one day). Only a small part of the method, known as the key, should remain secret and be easily changeable.

Traditionally, proving the security of a cryptographic scheme consisted of searching for attacks on this scheme. If no attack that contradicts the scheme's security property was found, the scheme was considered secure. However, we can never be certain that an attack does not exist, and another method is needed to prove the security of cryptographic primitives. In this section, we present such a method, called provable security, along with two ways to realize proofs in this paradigm. We also introduce different types of attacks an adversary can launch and security models.

Provable Security

Provable security is an approach for demonstrating the security of a cryptographic scheme, introduced in the 1980s. Its principle is to relate the security of a cryptographic scheme to that of its underlying primitives or (well-established) computational or decisional problems. To prove security in this paradigm, one must first identify the security goals and the adversary's capabilities of the cryptographic scheme. Then, do the same for the underlying primitives and computational problems. Finally, one provides a reduction showing how to transform an adversary that breaks the security goals of the scheme into an adversary that breaks the security goals of the underlying primitives and problems [START_REF] Abdalla | Brief Introduction to Provable Security[END_REF]. In short, provable security guarantees that a scheme is secure relative to a specific security definition against a given adversarial model and under a particular assumption. The adversary's capabilities are defined with respect to the kinds of attacks and according to a model that defines the attack environment.

Therefore, the security of cryptographic schemes relies on the difficulty of the underlying mathematical problems. If these problems are successfully solved, the security of the schemes is compromised. That is why cryptographic schemes are built upon mathematical problems that are presumed to be "hard" to solve. An example of such a "hard" problem is the factorization of an integer N into two large primes p and q.

Here "hard" actually means that breaking the problem requires performing so many operations that, without unlimited computational power, it is not possible to complete all the computations in a reasonable time. The notion of "reasonable time" has evolved over the years. For instance, when Alan Turing attempted to break Enigma, he had less than a day to find the machine settings, as new settings were used each day.

Proofs Methods

In provable security, the security proofs can be done in two ways: game-based and simulation-based.

Game-based security. In the game-based approach, security property of the scheme is linked to a particular event and security is demonstrated in the form of a game between a challenger C and an adversary A (usually modeled as a PPT algorithm). The adversary's goal is to solve the game with non-negligible probability, using a set of query oracles modeling her capabilities according to the security model and the type of attacks. Her advantage in winning the game is determined based on the type of the associated problem. If the problem is decisional, then A's advantage is defined as the difference between her probability of winning the game and the probability of winning the game through random guessing. On the other hand, if the problem is computational, A's advantage is defined as her probability of winning the game with a random proposal. If the adversary's advantage is negligible, we say that the primitive satisfies the security property. However, in some cases, reductions are too complicated to be be accomplished in a single step. That is why Shoup [START_REF] Shoup | Sequences of games: a tool for taming complexity in security proofs[END_REF] formalized the game-hopping technique in 2004. In this methodology, a proof starts with an initial game that comes from the security property to prove. From the initial game, a sequence of subsequent games is constructed, with the final one being simple enough for direct analysis. Importantly, it must be proven that the adversary A cannot detect any difference between two consecutive games in the sequence. Ultimately, the probability of an adversary winning the first security game is reduced to her advantage in winning the last security game. In this manuscript, we will utilize this method for our security proofs.

Simulation-based security. In the simulation-based approach, the security of a scheme is established by demonstrating that an adversary's capabilities in the real execution of the primitive are no greater than what they can achieve in an ideal scenario, which is inherently secure by definition. This concept is often referred to as the real world/ideal world paradigm. To demonstrate the indistinguishability of these two worlds, the objective is to present an ideal world adversary, commonly known as a simulator, for each real world adversary. The key criterion is that the output generated by the simulator should be indistinguishable from the output produced by the real world adversary.

We now present possible attacks by the adversary and the environments in which these attacks can occur.

Attacks by the Adversary

In the sequel, we employ the game-based security approach and address a decisional problem. The adversary is given a ciphertext from which she must solve the problem; this ciphertext is referred to as the challenge ciphertext. The adversary is also granted the ability to submit queries to the challenger. For any cryptographic encryption scheme, we consider three types of attacks in which the adversary has a varying levels of attacking capability.

• Chosen-Plaintext Attack (CPA): in this scenario, the adversary can acquire ciphertexts of their choice. It is worth noting that for public-key schemes, providing the adversary with the public key is enough to facilitate these attacks. • Non-Adaptive Chosen-Ciphertext Attack (CCA1) [START_REF] Naor | Public-Key Cryptosystems Provably Secure against Chosen Ciphertext Attacks[END_REF]: in this scenario, the adversary possesses the scheme's public key and has access to an oracle for the decryption function. However, the adversary can only make queries to this oracle before receiving the challenge ciphertext. • Adaptive Chosen-Ciphertext Attack (CCA2) [START_REF] Rackoff | Non-Interactive Zero-Knowledge Proof of Knowledge and Chosen Ciphertext Attack[END_REF]: in this scenario, the adversary, in addition to the public key, also has access to an oracle for the decryption function. Importantly, the adversary can make queries to this oracle even after receiving the challenge ciphertext. However, there is a restriction: the adversary cannot request the decryption of the challenge ciphertext itself.

CPA attacks are less powerful than CCA1 attacks, and CCA1 attacks, in turn, are less powerful than CCA2 attacks. In this thesis, we prioritize the efficiency of schemes over their security levels, so we will primarily focus on CPA security.

Attack Environments

Attack environments can be defined according to several models. We here present some of them.

Computational model [START_REF] Goldwasser | Probabilistic encryption[END_REF]. In the computational model, an adversary is an arbitrary probabilistic algorithm with limitations, and cryptographic primitives are represented as (tuples of) algorithms that adhere to security and constructive assumptions (for example, encryption and decryption are inversely related).

Standard model. In a computational model, if the adversary's limitations are solely related to time and computing power, we refer to this as the standard model. In this model, the security of cryptographic schemes is established solely based on complexity assumptions. It is important to note that proofs in the standard model are recognized to be complex and challenging to attain, and schemes proven to be secure in this model often encounter efficiency There are additional security models in which cryptographic primitives are substituted with idealized versions, with the aim of simplifying the proof.

Random oracle model (ROM) [START_REF] Bellare | Random Oracles Are Practical: A Paradigm for Designing Efficient Protocols[END_REF]. Within this computational model, a theoretical black box known as the random oracle is presumed to exist and be accessible to the adversary. Random oracles are commonly employed as ideal substitutes for cryptographic hash functions when robust randomness within their output domain is necessary. When queried at a new domain point, the random oracle produces a randomly selected value from its range. For previously queried points, it retrieves the same value that it provided initially, as it retains all of its responses in memory.

Generic group model (GGM) [START_REF] Maurer | Abstract Models of Computation in Cryptography[END_REF]. Within this computational model, the adversary gains access to an oracle responsible for executing group operations. In this context, efficient group encodings are substituted with randomly chosen encodings, thereby preventing the adversary from exploiting any specific group structure.

Other models. Other, less frequently employed models exist, such as the weak multilinear maps model [START_REF] Miles | Annihilation Attacks for Multilinear Maps: Cryptanalysis of Indistinguishability Obfuscation over GGH13[END_REF] which encompass all known categories of attacks on multilinear map 1 or the ideal cipher model [START_REF] Shannon | Communication theory of secrecy systems[END_REF] where block ciphers are substituted with a random permutation for every key.

Computing Power

Computers are getting more and more powerful following the observation of Moore from 1965 [START_REF] Moore | Cramming more components onto integrated circuits[END_REF], which states that computer processing speeds roughly double every two years. Therefore, while in the 1980s we considered that 2 60 operations were computationally infeasible, a few years ago in 2008, the bound was 2 80 , and we are now going to consider that 2 100 operations are not possible. To maintain the security of existing cryptographic schemes, the sizes of their parameters (i.e. the keys) are increased to overcome the growing power of computers.

For several years, the possibility of deploying super powerful computers, called quantum computers, has made the community wonder about the robustness of existing cryptographic schemes. This is due to the fact that in 1994 Shor [START_REF] Shor | Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer[END_REF] proposed an algorithm for quantum computers that reduces algorithms complexity, especially the complexity of "hard" problems such as factorization or discrete logarithm. On the other hand, problems relying on error-correcting codes or a mathematical object called lattices are supposed to be resistant against a quantum computer.

Public Key Encryption Schemes

A public key encryption scheme is an encryption system parameterized by a secret key and a public key. Encryption is performed using the scheme's public key, and decryption is only possible with knowledge of the scheme's secret key.

Definition 3.2.1 Public key encryption scheme (PKE).

A public key encryption scheme E consists of three algorithms:

• KeyGen: the key generation algorithm takes as input a security parameter λ, and returns a pair of secret key sk and public key pk. • Encrypt: the encryption algorithm takes as input a public key pk along with a message m and returns ct the encryption of m under pk. • Decrypt: the decryption algorithm takes as input a secret key sk along with a ciphertext ct and returns a message m ′ .

Definition 3.2.2 Correctness.

A public key encryption scheme E = (KeyGen, Encrypt, Decrypt) is said to be correct if for all security parameter 1 λ , all honestly generated key pair (sk, pk) ← KeyGen(1 λ ), and all message m, Pr [Decrypt(sk, Encrypt(pk, m)) = m] = 1.

An encryption scheme will be consider secure if it preserves the privacy of messages, meaning that from a ciphertext no adversary can learn information about its plaintext, except its length. This security notion is referred to as indistinguishability [START_REF] Goldwasser | Probabilistic encryption[END_REF]. We now formally present it. In the above definition, adversary A gives to challenger C the two challenge messages m 0 , m 1 after seeing the scheme's public key. There exists a weaker notion of indistinguishability security, called selective indistinguishability in which the adversary must choose challenge messages before seeing the scheme's public key. The formal definition can easily be derived from the above definition. Selective security, while perhaps justified in some cases, is too restrictive for realistic applications. That is why in this thesis we will focus on adaptive security.

Note 3.2.1

There exists another required security for encryption scheme, non-malleability [START_REF] Dolev | Non-Malleable Cryptography[END_REF] which requires the inability of an adversary, given a challenge ciphertext, to output a different ciphertext such that the plaintexts underlying both ciphertexts are "meaningfully related".

In this thesis, as we focus on privacy concerns we will mainly focus on indistinguishability security.

These security goals IND (indistinguishability) and NM (non-malleability) can be "mixed" with the types of attacks seen in Section 3. Based on the definition of public encryption schemes, the literature has introduced numerous encryption schemes, often referred to as "advanced". These innovative schemes not only enhance the confidentiality of public key encryption but also introduce new functionalities. In Chapters 4 and 6, we will introduce several such advanced encryption schemes. We now present another public encryption scheme, called inner product encryption scheme. Although we do not make any contributions to this primitive, it will serve as a foundational component for our research.

Inner Product Encryption Schemes

Informally, in a inner product encryption scheme, a secret key is associated to a vector, let us say u while a ciphertext is associated to a vector denoted v and the former can decrypt the latter if and only if ⟨u, v⟩ = 0. Definition 3.3.1 Inner product encryption scheme (IPE) [START_REF] Katz | Predicate Encryption Supporting Disjunctions, Polynomial Equations, and Inner Products[END_REF]. An inner product encryption scheme consists of four algorithms:

• Setup: the setup algorithm takes as input a security parameter λ and a vector length n ∈ N and outputs a master secret key msk along with a public key pk. • KeyGen: the key generation algorithm takes as input a master secret key msk and a vector u and returns a secret key sk u created for u. • Encrypt: the encryption algorithm takes as input a public key pk, a vector v and a message m to encrypt. It returns a ciphertext ct v of message m, according to v. • Decrypt: the decryption algorithm takes as input a secret key sk u and a ciphertext ct v and outputs a message m ′ .

Definition 3.3.2

Correctness. An inner product encryption scheme is said to be correct if for all security parameter λ, all integer n, every honestly generated key pairs (msk, pk) ← Setup(λ, n), every messages m and every vectors u, v such that ⟨u, v⟩ = 0,

Pr [Decrypt(KeyGen(msk, u), Encrypt(pk, v, m)) = m] = 1.
Regarding security, IPE schemes can satisfy two indistinguishability security properties: the first one, called payload-hiding security, prevents any adversary to learn information about the plaintext from the ciphertext; and the second, called attribute-hiding security, prevents any adversary to learn information about the encryption vector, from the ciphertext. The latter property is said to be weak if the adversary is not allowed to query secret keys that can decrypt the challenge ciphertext, otherwise it is said to be fully or strong.

Definition 3.3.3 Adaptive payload-hiding security (PH-IPE) [START_REF] Katz | Predicate Encryption Supporting Disjunctions, Polynomial Equations, and Inner Products[END_REF]. An inner product encryption scheme is said to satisfy adaptive payload-hiding security (or to be adaptively payload-hiding) if all PPT adversaries A have at most negligible advantage in winning the game presented in Figure 3.2, where A's advantage is defined as

Adv P H-IP E A (λ) := Pr b ′ = b -1/2 for any λ ∈ N.
Let C be a challenger.

• SETUP: C on input (λ, n) runs Setup(λ, n) to get (msk, pk) and gives pk to A.

• KEY QUERY: A may adaptively query a key for vector u. In response, A is given by C the corresponding secret key sk u ← KeyGen(msk, u). • CHALLENGE: A sends to C challenge pattern v along with two challenge messages m 0 , m 1 . The latter randomly picks b ← {0, 1} and returns to A ct b ← Encrypt(pk, v, m b ).

• KEY QUERY: A may continue to issue key query for vector u and is given sk u ← KeyGen(msk, u). • GUESS: A outputs a bit b ′ and wins if b ′ = b and if, for all u for which a key was queried, the condition ⟨u, v⟩ ̸ = 0 holds. We now present the definition of adaptive strong attribute-hiding security.

Definition 3.3.4 Adaptive strong attribute-hiding security (sAH-IPE) [START_REF] Katz | Predicate Encryption Supporting Disjunctions, Polynomial Equations, and Inner Products[END_REF]. An inner product encryption scheme is said to satisfy adaptive strong attribute-hiding security (or to be adaptively strong attribute-hiding) if all PPT adversaries A have at most negligible advantage in winning the game presented in Figure 3.3, where A's advantage is defined as

Adv sAH-IP E A (λ) := Pr b ′ = b -1/2 for any λ ∈ N. Let C be a challenger.
The definition of adaptive weak attribute-hiding security (wAH-IPE) can easily be derived from the one above, by changing the restriction on vectors for which secret key as queried. The new restriction is that any queried vector u must satisfy ⟨u, v 0 ⟩ = ⟨u, v 1 ⟩ = 1.

Note 3.3.1

We can combine simultaneously weak attribute-hiding security and payloadhiding security as in the former the adversary cannot query keys that decrypt the challenge ciphertext, thus two different challenge messages can be used; but we cannot

• SETUP: C on input (λ, n) runs Setup(λ, n) to get (msk, pk) and gives pk to A.

• KEY QUERY: A may adaptively query a key for vector u. In response, A is given by C the corresponding secret key sk u ← KeyGen(msk, u). • CHALLENGE: A sends to C two challenge patterns v 0 and v 1 along with a challenge message m. The latter randomly picks b ← {0, 1} and returns to A ct b ← Encrypt(pk, v b , m). • KEY QUERY: A may continue to issue key query for vector u. A is then given sk u ← KeyGen(msk, u). • GUESS: A outputs a bit b ′ and wins if b ′ = b and if, for all u for which a key was queried, the condition ⟨u, v⟩ ̸ = 0 holds. do the same with strong attribute-hiding. However this does not mean that an IPE scheme cannot be both payload-hiding and strong attribute-hiding, it only means that both property must be proven separately.

Note 3.3.2 Payload-hiding security is weaker that weak attribute-hiding security, which is itself weaker than strong attribute-hiding security.

Signature Schemes

A digital signature scheme, also known simply as a signature scheme, is a primitive used to verify the authenticity and integrity of messages. Briefly, it is parameterized by both a signing key, which is kept secret, and a verification key, which is made public and each user possesses her own pair of keys. The signature of a message is done with the signing key and the verification is done using the verification key.

Definition 3.4.1 Digital signature scheme. A digital signature scheme consists of three algorithms:

• Setup(λ): the setup algorithm takes as input a security parameter λ and outputs a signing key sk along with a verification key vk. • Sign(sk, m): the signature algorithm takes as input a signing key sk and a message m and returns a signature σ.

Adv Unf A (λ) := Pr [Verify(vk, σ * , m * ) = 1|(m * , σ * ) ← A(vk)] = 1.
Let C be a challenger.

SETUP: C on input λ runs Setup(λ) to get (sk, vk) and sends vk to A. SIGNATURE QUERY: A chooses a message m and sends it to C, who responds with σ ← Sign(sk, m). GUESS: A outputs a message m * and a signature σ * and wins the game if m * was not queried to C and Verify(vk, σ * , m * ) = 1.

Dual System Encryption Framework

The dual system encryption (DSE) framework is a novel approach within the provable security paradigm. It was introduced by Waters in 2009 [START_REF] Waters | Dual System Encryption: Realizing Fully Secure IBE and HIBE under Simple Assumptions[END_REF] to establish the (adaptive) security of public key encryption schemes. This framework operates within the context of game-based security and will be employed in this thesis to demonstrate the security of our encryption schemes.

Within this framework, encryption schemes are designated as dual system encryption schemes if both ciphertexts and private keys can assume two indistinguishable forms: normal or semi-functional (SF). Normal secret keys and ciphertexts are generated through the system's key generation or encryption algorithm and behave as expected in a typical encryption scheme. Semi-functional ciphertexts and secret keys are solely utilized in the security proof, not in the actual system. An important characteristic is that a normal key can decrypt both normal or semi-functional ciphertexts, and a normal ciphertext can be decrypted by both normal or semi-functional secret keys. However, attempting to decrypt a semi-functional ciphertext with a semi-functional secret key will result in failure.

In this framework, a security proof is established through a sequence of games, which are demonstrated to be indistinguishable one to each other. The initial game is the scheme's original security game, involving normal secret keys and ciphertexts. The subsequent game closely resembles the first, with the exception that the challenge ciphertext is now semi-functional. We contend that no adversary can discern this alteration (except by violating a security assumption) because all provided secret keys are normal and, therefore, capable of decrypting the challenge ciphertext (assuming the decryption condition is met), regardless of whether it is normal or semi-functional. Let q ∈ N represents the number of key requests that an attacker is permitted to make. Accordingly, we define games 1 to q as follows: in Game k , the first k keys are semi-functional, while the remaining keys are normal; the challenge ciphertext remains semi-functional. In Game q both the keys and the challenge ciphertext are semi-functional. As none of the provided keys can effectively decrypt the challenge ciphertext (since all keys are semi-functional, the challenge ciphertext is as well), demonstrating security at this stage becomes straightforward. When proving indistinguishability of Game k and Game k-1 , we actually create a simulator who is prepared to generate a semi-functional challenge ciphertext and is also ready to make the k-th key either normal or semi-functional. This situation presents a potential problem. Indeed, the simulator can determine whether key k is semi-functional by testing decryption with a semi-functional ciphertext (created by her) that should be decrypted by the normal form of the k-th secret key. To address this issue, Waters proposed the use of "tag" in dual-system encryption schemes: random tag values are associated with each ciphertext and secret key, and decryption only succeeds when the tag values of the ciphertext and the decrypting key are different. If the simulator creates a semi-functional ciphertext for herself that should be decrypted by the k-th key assuming it is normal, she would only be able to create one with an identical tag, and thus decryption will fail even if the secret key is normal. Since an adversary can only query secret keys that cannot decrypt the challenge ciphertext, this correlation of tags is hidden from her, and the tags appear randomly distributed from the adversary's perspective. This solution introduces additional complications to the security proof of the scheme and increases the size of its parameters. That is why Lewko and Waters [START_REF] Lewko | New Techniques for Dual System Encryption and Fully Secure HIBE with Short Ciphertexts[END_REF] proposed a different approach to address the aforementioned paradox. Instead of causing decryption to fail when the simulator attempts to test the semi-functionality of the k-th key, they ensure that decryption succeeds even when the key is semi-functional. To achieve this, they introduce a variant of semi-functional keys, which they refer to as "nominally" semi-functional keys. These keys are distributed similarly to semi-functional keys but are, in fact, correlated with semi-functional ciphertexts. Consequently, when a nominally semi-functional key is employed to decrypt a semi-functional ciphertext, the interaction of these two semi-functional components leads to cancellation, resulting in successful decryption.

Composite order groups and dual system encryption framework. Lewko and Waters [START_REF] Lewko | New Techniques for Dual System Encryption and Fully Secure HIBE with Short Ciphertexts[END_REF] provided encryption schemes in the (symmetric) bilinear pairing groups of composite order setting, with security proofs made with the dual system encryption framework. Their idea is to take the group order N equals to p 1 p 2 p 3 , where p 1 , p 2 , p 3 a three different primes. They define the subgroups G p 1 , G p 3 as normal space and the subgroup G p 2 as semi-functional space. As composite order groups achieve the structure of canceling bilinear maps (Definition 2.2.3), it is easy to see that a normal key will decrypt both a normal and a semi-functional ciphertext, and that a normal ciphertext can be decrypted by both a normal and a semi-functional key. However, decryption of a semi-functional ciphertext by a semi-functional key is not possible (unless if the key is nominally) as there would be an extra component in G p 2 . The indistinguishability (from the adversary point of view) between normal and semi-functional secret keys and ciphertexts is guaranteed by the general subgroup decision assumption (Definition 2.2.14).

Dual pairing vector spaces and dual system encryption framework. Lewko [90] propose encryption schemes, proven to be secure with the dual system encryption framework, in the bilinear pairing prime order groups setting. Her idea is to exploit the fact that dual pairing vector spaces satisfy the canceling bilinear maps structure. In her scheme, dual orthonormal bases (B, B * ) are sampled for a dimension n ∈ N. Let k ∈ N such that k ≤ 2n. Then normal keys and ciphertexts are defined using vectors b

1 , • • • , b k and b * 1 , • • • , b *
k while semi-functional keys and ciphertexts are defined using vectors b

1 , • • • , b n and b * 1 , • • • , b * n .
With this definition, it is clear that normal keys will decrypt normal or semi-functional ciphertexts, that normal ciphertexts will be decrypted by normal or semi-functional keys but semi-functional keys will not decrypt semi-functional ciphertext (unless if the key is nominally semi-functional). From the adversary point of view, normal and semi-functional secret keys and ciphertexts are indistinguishable, thanks to the parameter hiding property of DPVS (Definition 2.3.3).

THE first cryptographic tool we used in this thesis is identity-based encryption with wildcards (WIBE), introduced in 2006 by Abdalla et al. [4]. Informally, in such primitive secret keys and ciphertexts are associated with vectors, over a set that contains a "wildcard" symbol denoted "⋆". Decryption is possible if and only if the secret key vector and the ciphertext vector are equals at all positions different from the wildcard ⋆.

In the sequel, we first give the definition of identity-based encryption with wildcards and its properties, such as the anonymity property that states that a ciphertext does not reveal any information about its associated pattern. In Section 4.2 we present a generic construction of an anonymous WIBE scheme, proposed by Abdalla et al. [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF]. Then in Section 4.2.2 we present two of our contributions which are two new security properties for identity-based encryption with wildcards schemes, called privacy-preserving key generation and pattern-hiding security: the former transforms the key generation of a WIBE into an interactive protocol between a key generation center (KGC), a pattern audit center (PAC) and a user that is requesting a secret key, and states the KGC center does not learn any information about the user's pattern when creating a key; the latter is an extension of the anonymity property. Finally, in Section 4.3 we propose three new identity-based encryption with wildcards instantiations: the first scheme is a normal WIBE scheme with constant size ciphertext, the second scheme is pattern-hiding and the last scheme has privacy-preserving key generation. SETUP: challenger C on input (λ, L) runs Setup(λ, L) to generate pk and msk, and gives pk to A. KEY QUERY: adversary A may adaptively query a key for pattern P . In response,

Identity-Based Encryption with Wildcards (WIBE)

A is given the corresponding secret key sk P ← KeyGen(msk, P ). CHALLENGE: A chooses challenge pattern P * and challenge messages m 0 , m 1 , and sends them to C. The latter picks a random bit b and gives to A ct * ← Encrypt(pk, P * , m b ). KEY QUERY: The adversary may continue to issue key queries for additional pattern P . A is given the corresponding key sk P ← KeyGen(msk, P ). GUESS: A outputs a bit b ′ , and wins the game if b ′ = b and if, for all P for which a key was queried, the condition P ̸ = ⋆ P * holds. The next definition presents the anonymous security property of WIBE schemes, introduced by [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF], that states that it is hard for an adversary given a ciphertext to guess which previously chosen message was encrypted. SETUP: challenger C on input (λ, L) runs Setup(λ, L) to generate keys pk and msk, and gives pk to A. KEY QUERY: adversary A may adaptively query a key for pattern P . In response,

A is given the corresponding secret key sk P ← KeyGen(msk, P ). CHALLENGE: A chooses two challenge patterns P 0 , P 1 and challenge messages m 0 , m 1 , and sends them to C. The latter picks a random bit b and gives to A ct b ← Encrypt(pk, P b , m b ). KEY QUERY: The adversary may continue to issue key queries for additional pattern P . A is given the corresponding key sk P ← KeyGen(msk, P ). GUESS: A outputs a bit b ′ , and wins if b ′ = b and if, for all pattern P for which a key was queried, the condition P ̸ = ⋆ P 0 and P ̸ = ⋆ P 1 holds. Note 4.1.1 In the anonymous security game for identity-based encryption with wildcards, the adversary is allowed to query secret keys that do not decrypt the challenge ciphertext. In Section 4.2.2 we present a stronger security notion in which the adversary is allowed to query secret keys that decrypt the challenge ciphertext, at the condition that decryption is possible no matter the challenge pattern chosen.

Generic Construction of Anonymous WIBE Scheme

Here we present a generic construction, proposed by Abdalla et al. [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF], of anonymous identity-based encryption with wildcards scheme, from inner product encryption (see Section 3.3). Briefly, in an IPE scheme secret keys and ciphertexts are associated to a vector, and decryption is possible if the inner product of the secret key's vector and the ciphertext's vector is equal to 0. For more details on this primitive, refer to Section 3.3.

In the construction, patterns belong to the set {0, 1, ⋆}. The key idea of the construction is to double the pattern length and simulate wildcard positions with 0 positions in the IPE vector. To do so they introduce two algorithms that we will call ExtendingKeyPattern and ExtendingCtPattern, that work as follows.

Algorithm 4.1 ExtendingKeyPattern

Input: key pattern P of length n Output: pattern u of length 2n We now present the construction in Figure 4.4.

1: i ← 1, j ← 1 2: while i ≤ n, j ≤ 2n do 3: if P i ̸ = ⋆ then 4: u j ←
if P i ̸ = ⋆ then 4: v j ← -r i • P i , v j+1 ← r i for r i ← Z p 5:
Let IP E = (Setup, KeyGen, Encrypt, Decrypt) be an inner product encryption scheme. We construct WIBE = (Setup, KeyGen, Encrypt, Decrypt) an identitybased encryption with wildcards scheme from IP E.

• Setup(λ, L): the setup algorithm runs Setup(λ, 2L) to get (msk, pk) and outputs them. Regarding correctness and security Abdalla et al. [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF] prove that if the underlying IPE scheme is correct and weak attribute-hiding, then the obtained WIBE scheme is respectively correct and anonymous. We refer the interested reader to [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF]'s work for more details.

Note 4.1.2 Actually to be able to make this generic construction, Abdalla et al. [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF] introduced a new kind of IPE schemes: inner product encryption scheme with generalized key delegation. This new feature of IPE schemes is needed in order to obtain the key delegation algorithm of the WIBE scheme. In this thesis, we will use WIBE scheme without key delegation, therefore we omit in our presentation of the generic construction the delegation part. We also rewrite KeyDer algorithm by KeyGen in the WIBE scheme for the same reason.

Our Contributions to WIBE: New Security Properties

We now present two of our contributions regarding identity-based encryption with wildcards, which are two new security properties. The first one, that we call privacypreserving key generation protects the privacy of pattern used for key generation while the second, called pattern-hiding is an extension of the anonymous property.

Introducing Privacy-Preserving Key Generation WIBE

When looking at identity-based encryption with wildcards security properties, we notice that that they either protects the message encrypted (with indistinguishability security, see Definition 4.1.4) or the pattern associated to the ciphertext (anonymous security, see Definition 4.1.5). For future applications, such as one presented in Section 6.3, we decided to introduce a new security property that protects the privacy of the pattern during key generation. In other words, we need a WIBE scheme in which the authority does not learn any information about patterns associated to secret keys.

As such property cannot be included as is in the previously given definition of WIBE (Definition 4.1.2), we need to define a new kind of WIBE: privacy-preserving key generation WIBE scheme. The below definition is based on the work that has been done on e.g., blind signatures [START_REF] Chaum | Blind Signatures for Untraceable Payments[END_REF][START_REF] Pointcheval | Security Arguments for Digital Signatures and Blind Signatures[END_REF], or privacy-preserving key generation (PPKG) ABE [START_REF] Song | Efficient Attribute-Based Encryption with Privacy-Preserving Key Generation and Its Application in In-dustrial Cloud[END_REF].

In this definition the generation of decryption keys is transform into an interactive protocol between a key generation center (KGC) (that knows the master secret key), a pattern certification center (PAC) and a user, in such a way that the user finally obtain the secret key sk P , while each party protects its own input. In the next definition, the name of key generation protocol algorithms that are ran by KGC are written in blue, those ran by user in green and in orange those that are run by PAC.

Note 4.2.1

In the following we use the notation msk to denote a part of msk, given as an optional input some algorithms. Notice that msk is not enough to generate secret keys and might be equals to ∅ in some cases.

Definition 4.2.1 WIBE scheme with privacy-preserving key generation. (PPKG-WIBE) An identity-based encryption with wildcards scheme with privacy-preserving key generation consists of seven algorithms:

• Setup(λ, L): the setup algorithm, run by KGC, takes as input a security parameter λ ∈ N and the maximal pattern length L. It outputs a public key pk and a master secret key msk. • UserTemKeyGen(pk): the user's temporary key generation algorithm is run by user. It takes public key pk as input and outputs user's temporary public key tpk user and user's temporary secret key tsk user . • BlindTokenGen( msk, pk, P, tpk user ): the blind token generation algorithm is run by PAC. It takes pk, user's pattern P, and user's temporary public key tpk user as input and outputs a blind token bt P for pattern P.

• BlindKeyGen(msk, pk, bt P ): the blind key generation algorithm is run by KGC. It takes msk, pk, and user's blind token bt P as input and outputs blind secret key bsk for pattern P. • KeyExtract(bsk P , tsk user ): the key extract algorithm is run by user locally. It takes blind secret key bsk P and user's temporary secret key tsk user as input and outputs the final secret key sk for pattern P. • Encrypt(pk, P ′ , m): the encryption algorithm takes as input the public key pk, a pattern P ′ and a message m. It outputs ciphertext ct for pattern P ′ .

• Decrypt(sk P , ct, P ′ ): the decryption algorithm takes as input a user secret key sk P for a pattern P and a ciphertext ct for a pattern P ′ , and returns a message m ′ .

We present in Figure 4.5 the interactive protocol of the key generation. With this new definition of WIBE, we easily notice that if we want to protect KGC from learning pattern P for which a key is queried we require that the output of BlindTokenGen does not leak any information about the pattern. We formalize this requirement with the following security definition that states that no adversary can distinguish a blind token for pattern P 0 from a blind token for pattern P 1 , where P 0 , P 1 are chosen by the adversary.

Definition 4.2.2 Adaptive privacy-preserving key generation WIBE security.

We define the following oracles: (i) Blind Token Oracle O BT (P ′ ) that takes as input pattern P ′ and outputs corresponding blind token bt P ′ and (ii) O BK (bt P ′ ) that takes as input blind token bt P ′ and outputs corresponding blind key bsk P ′ . A WIBE scheme is said to satisfy adaptive privacy-preserving key generation security if for any PPT adversary A, the advantage of A to win the game presented in Figure 4.6 is negligible. Let C be a challenger.

For our future use of such a WIBE, KGC will be playing the adversary's role.

Anaïs Barthoulot

New Security Property of Pattern-Hiding

In this section, we introduce a new security property for WIBE schemes: pattern-hiding security.

Definition 4.2.3 Adaptive pattern-hiding security (PH-WIBE

). An identity-based encryption with wildcards scheme is said to satisfy adaptive pattern-hiding security (or is adaptively pattern-hiding) if all PPT adversaries A have at most negligible advantage in winning the game presented in Figure 4.7, where A's advantage is defined as

Adv P H-W IBE A (λ) := Pr b ′ = b -1/2 for any λ ∈ N.
Let C be a challenger.

SETUP: C on input (λ, L) runs Setup(λ, L) to generate keys pk and msk, and gives pk to A. KEY QUERY: adversary A may adaptively query a key for pattern P . In response,

A is given the corresponding secret key sk P ← KeyGen(msk, P ). CHALLENGE: A chooses two challenge patterns P 0 , P 1 and challenge message m, and sends them to C. The latter picks a random bit b and gives to A ct b ← Encrypt(pk, P b , m). KEY QUERY: The adversary may continue to issue key queries for additional pattern P , and is given the corresponding key sk P ← KeyGen(msk, P ). GUESS: A outputs a bit b ′ , and wins if b ′ = b and if, for all P for which a key was queried, the condition P = ⋆ P 0 ∧ P = ⋆ P 1 or P ̸ = ⋆ P 0 ∧ P ̸ = ⋆ P 1 holds. We now establish the following theorem, that presents the relation between our new security property and existing the one of anonymity. B is an admissible adversary, meaning that she will always output a key for pattern P such that P ̸ = ⋆ P 0 and P ̸ = ⋆ P 1 . Thus the pattern-hiding security game restrictions are respected. Let us evaluate A's advantage. If b = b, then B is given a challenge ciphertext as expected and thus wins the security game with advantage ϵ. If b ̸ = b, as the challenge ciphertext is not of the form expected by B (for example she can receive the result of Encrypt(pk, P 0 , m 1 )), her advantage in winning the security game is equivalent as making a random guess, thus is equal to 1/2. Therefore,

Adv P H-W IBE A (λ) = ϵ -1/2 which is non negligible. □

Another Contribution: Our New WIBE Instantiations

In this section, we present three identity-based encryption with wildcards schemes.

The first scheme has constant-size ciphertext but does not provide the pattern-hiding property, while the second scheme does not have constant-size ciphertext but is proved to satisfy pattern-hiding. The third scheme is a privacy-preserving key generation WIBE.

Our three identity-based encryption with wildcards schemes have the particularity that they do not allow key derivation for a pattern from another pattern's key (thus KeyDer Anaïs Barthoulot | PhD Thesis | University of Limoges

Licence CC BY-NC-ND 3.0 algorithm will be written KeyGen). Plus, we restrict the first and the second scheme key pattern space to {0, 1} L \ 0 L and ciphertext pattern spaces to {0, ⋆} L \ 0 L for the first scheme and to {0, ⋆} L \ ⋆ L for our second scheme. These restrictions are required for a future use of our WIBE schemes as building blocks for data sharing primitives. Notice that with this key pattern space, the decryption condition now requires that the key pattern belongs (i.e. ∈ ⋆ ) to the ciphertext pattern and no longer that both patterns match (i.e. = ⋆ ). Also, notice that our two instantiations are made for these restrictions specifically therefore they do not work without them. For the third instantiation, patterns for both keys and ciphertexts belong to {0, 1, ⋆} L .

Let P ∈ {0, 1} L \ 0 L be a pattern. We set

I = {i ∈ [L]|P i = 1} and O = {i ∈ [L]|P i = 0}; notice that [L] = I ∪ O.

A WIBE Scheme With Constant Size Ciphertext

Intuition. Kim et al. [START_REF] Kim | Scalable Wildcarded Identity-Based Encryption[END_REF] proposed an identity-based encryption with wildcards, in the symmetric prime order bilinear group setting. Their scheme has constant size ciphertext and satisfies selective IND-WIBE-CPA security under the ℓ-BDHE problem. We first adapt it to the keys and ciphertexts patterns we are interested in, i.e. respectively {0, 1} L \ 0 L , and {0, ⋆} L \ 0 L and moved it to asymmetric prime order bilinear group setting. This results in a new scheme, with shorter secret keys and ciphertexts. Then we modified our scheme in order to obtain adaptive security. To do so, we followed [START_REF] Kim | Scalable Wildcarded Identity-Based Encryption[END_REF]'s idea to use composite order groups and the dual system encryption framework. Finally, we moved our scheme from the composite order bilinear group setting to the prime order bilinear group setting, for efficiency and security reasons. We were able to do this change thanks to the use of dual pairing vectors spaces and following the works of Lewko [START_REF] Lewko | Tools for Simulating Features of Composite Order Bilinear Groups in the Prime Order Setting[END_REF] and Chen et al. [START_REF] Chen | Shorter IBE and Signatures via Asymmetric Pairings[END_REF].

An important point to notice here is in the Setup algorithm: in [START_REF] Kim | Scalable Wildcarded Identity-Based Encryption[END_REF]'s schemes, random groups elements h i (for i = 1, • • • , L) are generated by the scheme authority and put in the public key. In our scheme, the authority will pick random elements a i (for

i = 1, • • • , L) in Z p , sets h i = g a i 1
and gives in the public key h d 2 i , for d 2 ∈ D for D one base of the DPVS. This change was necessary for the security proof as the adversary against the security assumption, that simulates the scheme's authority receives d 2 in the exponent of g 1 which means she cannot compute h d 2 i if h i is not of the form g a i 1 for a i known by the adversary. This gives us our first WIBE scheme, presented in Figure 4.9. With the restrictions on key and ciphertext pattern spaces and the notations we present above, we can rewrite the decryption condition as follows: for patterns P , P * in respectively {0,

1} L \ 0 L Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 • Setup(λ, L): generate an asymmetric bilinear pairing group Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e) for prime order p. Sample random dual orthonormal bases (D, D * ) ← Dual(Z 4 p ). Let d 1 , • • • , d 4 denote the elements of D and d * 1 , • • • , d * 4 denote the elements of D * . Pick α, a 1 , • • • , a L ← Z p . The public key is computed as: pk = (Γ, e(g 1 , g 2 ) αd 1 .d * 1 , g d 1 1 , h 1 = g a 1 •d 2 1 , • • • , h L = g a L •d 2 1
) and the master secret key is msk = (α, g

d * 1 2 , g d * 2 2 , a 1 , • • • , a L ). • KeyGen(msk, P ′ ): pick r ← Z p . Compute β = g αd * 1 +r• i∈I a i •d * 1 -r•d * 2 2
and

υ i = g r•a i •d * 1 2 for i ∈ O. The secret key is sk P ′ = (β, {υ i } i∈O ). • Encrypt(pk, P , m ∈ G T ): choose s ← Z p and compute ct = (c 1 , c 2 )
where

c 1 = m • (e(g 1 , g 2 ) αd * 1 •d 1 ) s , c 2 = g sd 1 1 • i∈W (P ) h s i = g sd 1 +sd 2 i∈W (P ) a i 1 .
• Decrypt(sk and {0, ⋆} L \ 0 L , we have that

P ′ , ct, P ): compute β ′ = β i∈W (P )∩O υ i and finally c 1 • 1 e(c 2 ,β ′ ) .
P ∈ ⋆ P * =⇒ ∀i ∈ [L], if P = 1 then P * i = ⋆ and thus I ⊆ W (P * ).
Our Scheme. We now present in Figure 4.9 our new identity-based encryption with wildcards scheme. .

i∈W (P )

h s i , g αd * 1 +r. i∈I a i .d * 1 -r.d * 2 2 • i∈W (P )∩O g rd * 1 a i 2   = e g sd 1 1 , g αd * 1 2 .e g sd 1 1 , g r.d * 1 ( i∈I a i + i∈W (P )∩O a i ) 2 .e g sd 2 i∈W (P ) a i 1 , g -r.d * 2 2
as thanks to dual vector spaces properties: e g sd 1 1 , g

-rd * 2 2 = e(g 1 , g 2 ) 0 and e g sd 2 i∈W (P ) a i 1 , g αd * 1 +r. i∈I a i .d * 1 + i∈W (P )∩O r.a i .d * 1 2 = e(g 1 , g 2 ) 0 = 1.
The first pairing is equal to (e(g 1 , g 2 ) αd 1 .d * 1 ) s which will canceled with the element of c 1 .

Anaïs Barthoulot | PhD Thesis | University of Limoges

Licence CC BY-NC-ND 3.0

The second pairing is equal to e(g 1 , g 2 )

srψ( i∈I a i + i∈W (P )∩O a i )
and the third pairing is equal to e(g 1 , g 2 )

-rsψ

i∈W (P ) a i
. As user is allowed to decrypt then I ⊆ W (P ), thus we can rewrite I as I ∩ W (P ) and we have that Our proof is based on the ones of [START_REF] Lewko | Tools for Simulating Features of Composite Order Bilinear Groups in the Prime Order Setting[END_REF] (Section 4.6) and [START_REF] Chen | Shorter IBE and Signatures via Asymmetric Pairings[END_REF] (Section 4) and is done with the dual system encryption framework. [START_REF] Lewko | Tools for Simulating Features of Composite Order Bilinear Groups in the Prime Order Setting[END_REF]'s proof is done in the symmetric pairing setting but moving from symmetric pairings to asymmetric pairings is not an issue if elements are taken in the correct group (G 1 for ciphertext and public key elements, and G 2 for secret keys elements).

Let us define semi-functional keys and semi-functional ciphertexts that we will use in the proof. Let sk = (β, {υ i } i∈O ) be a normal key, and t 3 , t 4 , {t b,i } i∈O be random elements of Z p . We define a semi-functional key as sk

′ = (β ′ , υ ′ i i∈O ) where β ′ = β • g t 3 •d * 3 +t 4 •d * 4 2
and υ

′ i = υ i • g t b,i •d * 3 2
for i ∈ O. Let ct = (c 1 , c 2 ) be a normal ciphertext, and z 3 , z 4 ← Z p be random elements. We define a semi-functional ciphertext as ct

′ = (c ′ 1 , c ′ 2 ) where c ′ 1 = c 1 and c ′ 2 = c 2 • g z 3 •d 3 +z 4 •d 4 1 .
We are going to prove Theorem 4.3.2 with a sequence of Q + 3 hybrids games, where Q ∈ N is the number of secret keys that an adversary can query.

• Game 0 : is the real IND-WIBE security game, presented in Figure 4.1.

• Game 1 : is as Game 0 except that the challenge ciphertext is semi-functional.

• Game 2-j : for j from 1 to Q, Game 2-j is the same as Game 1 except that the first j keys are semi-functional and the remaining keys are normal. • Game 3 : is the same as Game 2-Q , except that the challenge ciphertext is a semifunctional encryption of a random message in G T .

We prove indistinguishability between those security games by proving the three following lemmas. The proofs are using assumptions DS1 and DS2, presented in Section 2.3.2.

Informally, we prove indistinguishability between the Q + 3 games above as explained in •

Step 1: we prove that if an adversary can distinguish Game 0 from Game 1 then we can build an adversary with non-negligible advantage against DS1 with k = 2 and n = 4. This is formalized by Lemma 4.

4.3.2 INIT: B is given ∆ = (Γ, g b * 1 2 , g b * 2 2 , g b 1 1 , g b 2 1 , g b 3 1 , g b 4 1 , u 1 , u 2 , µ 2 ) along with t 1 , t 2 , distributed either as g τ 1 b 1 1 , g τ 1 b 2 1 or g τ 1 b 1 +τ 2 b 3 1 , g τ 1 b 2 +τ 2 b 4 1 . Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 SETUP: B first chooses a random invertible matrix A ∈ Z 2×2
p . She implicitly sets dual orthonormal bases D, D * to:

d 1 = b 1 ,d 2 = b 2 , (d 3 , d 4 ) = (b 3 , b 4 ) • A, d * 1 = b * 1 , d * 2 = b * 2 , (d * 3 , d * 4 ) = (b * 3 , b * 4 ) • (A -1 ) ⊤ .
We note that D, D * are properly distributed and reveal no information about A. Notice also that B cannot produce

g d * 3 2 , g d * 4
2 , but these will not be needed to create normal keys.

B chooses random values α, a 1 , • • • , a L ∈ Z p . A is given the public key pk = (Γ, e(g 1 , g 2 ) αd 1 •d * 1 , g d 1 1 , h 1 = g a 1 d 2 1 , • • • , h L = g a L d 2 1
).

The master secret key is msk = (α, g

d * 1 2 , g d * 2 2 , a 1 , • • • , a L ).
KEY QUERY: msk is known to B, which allows B to respond to all of A's key queries by calling the normal key generation algorithm.

CHALLENGE:

A sends B a challenge pattern P and two messages (m 0 , m 1 ). B chooses a random bit b ∈ {0, 1} and encrypts m b under P as follows:

c 1 = m b • (e(t 1 , g b * 1 2 )) α = m b • (e(t 1 , g d * 1 2 )) α , c 2 = t 1 • t i∈W (P ) a i 2 .

She gives the ciphertext ct

* = (c 1 , c 2 ) to A. • If (t 1 , t 2 ) = (g τ 1 b 1 1 , g τ 1 b 2 1
), we have a normal ciphertext with randomness τ 1 :

c 1 = (m b (e(g 1 , g 2 ) d 1 •d * 1 α ) τ 1 , and c 2 = g τ 1 d 1 +τ 1 d 2 i∈W (P ) a i 1
. Thus B has properly simulated Game 0 .

• If (t 1 , t 2 ) = (g τ 1 b 1 +τ 2 b 3 1 , g τ 1 b 2 +τ 2 b 4 1 ), c 1 = m b • (e(g 1 , g 2 ) b 1 •b * 1 α ) τ 1 • e(g 1 , g 2 ) τ 2 b 3 b * 1 α = m b • (e(g 1 , g 2 ) d 1 •d * 1 α ) τ 1 and c 2 = g τ 1 d 1 +τ 1 d 2 i∈W (P ) a i +τ 2 b 3 +τ 2 b 4 i∈W (P )
4.3.3 INIT: B is given ∆ = (Γ, g b 1 1 , g b 2 1 , g b * 1 2 , g b * 2 2 , g b * 3 2 , g b * 4 2 , u 1 , u 2 , µ 2 ) along with t 1 , t 2 , distributed either as g τ 1 b * 1 2 , g τ 1 b * 2 2 or g τ 1 b * 1 +τ 2 b * 3 2 , g τ 1 b * 2 +τ 2 b * 4 2
.

SETUP: B chooses a random invertible matrix A ∈ Z 2×2 q . Then she implicitly sets dual orthonormal bases D, D * to:

d 1 = b 1 , d 2 = b 2 , (d 3 , d 4 ) = (b 3 , b 4 ) • A, d * 1 = b * 1 , d * 2 = b * 2 ,(d * 3 , d * 4 ) = (b * 3 , b * 4 ) • (A -1 ) ⊤ . We note that D, D * are properly distributed and reveal no information about A. B chooses random values α, a 1 , • • • , a L ∈ Z p . A is given the public key pk = (Γ, e(g 1 , g 2 ) αd 1 .d * 1 , g d 1 1 , h 1 = g a 1 d 2 1 , • • • , h L = g a L d 2 1
).

The master secret key is msk = (α, g

d * 1 2 , g d * 2 2 , a 1 , • • • , a L ).
KEY QUERY: B knows msk and g

d * 3 2 , g d * 4
2 , thus can easily call the key generation algorithm or produce semi-functional keys. It allows B to answer to all A's key queries.

• To answer the first j-1 key queries that A makes, B runs the semi-functional key generation algorithm to produce semi-functional keys. • To answer to the j-th key query for P j , B responds with:

β = (g b * 1 2 ) α • t i∈I a i 1 • t -1 2 , υ i = t a i 1 for i ∈ O. -If t 1 , t 2 = g τ 1 b * 1 2 , g τ 1 b * 2 2
, then sk P j is a normal key with randomness τ 1 :

β = g d 1 α+τ 1 d * 1 i∈I a i -τ 1 d * 2 2
and υ i = g

τ 1 d * 1 a i 2 , for i ∈ O. -If t 1 , t 2 = g τ 1 b * 1 +τ 2 b * 3 2 , g τ 1 b * 2 +τ 2 b * 4 2 , β = g d 1 α+τ 1 d * 1 i∈I a i -τ 1 d * 2 +τ 2 i∈I a i b * 3 -τ 2 b * 4 2 and υ i = g τ 1 d * 1 a i +τ 2 b * 3 2
, for i ∈ O.

Anaïs Barthoulot | PhD Thesis | University of Limoges

Licence CC BY-NC-ND 3.0

• For the remaining key queries, B runs the normal key generation algorithm.

CHALLENGE: At some point, A sends to B two messages m 0 , m 1 and a challenge pattern P . B chooses a random bit b ∈ {0, 1} and encrypts m b under P as follows:

c 1 = m b • (e(u 1 , g b * 1 2 )) α = m b • (e(g 1 , g 2 )) αd 1 •d * 1 µ 1 and c 2 = u 1 • u i∈W (P ) a i 2 = g µ 1 d 1 +µ 1 d 2 i∈W (P ) a i +µ 2 b 3 +µ 2 b 4 i∈W (P ) a i 1 .
Suppose that B decides not to be honest, and find the nature of the j-th key by itself.

To do so, she creates a ciphertext for a pattern P * such that P j ∈ ⋆ P * . She tries to decrypt it with sk P j to learn if sk P j is a normal or a semi-functional key (a normal key will decrypt correctly while a SF key will with high probability fail to decrypt). Let us see that by construction even if sk P j is SF it will decrypt correctly. Suppose that t 1 , t 2 = (g

τ 1 b * 1 +τ 2 b * 3 2 , g τ 1 b * 2 +τ 2 b * 4
2

). During decryption, B obtains the term e g

µ 2 b 3 +µ 2 i∈W (P * ) a i b 4 1 , g τ 2 b * 3 i∈I a i -τ 2 b * 4 2 • g τ 2 b * 3 i∈W (P * )∩O a i 2 .
In the exponent we have

µ 2 (b 3 + b 4 i∈W (P * ) a i b 4 ) • τ 2 (b * 3 i∈W (P * ) a i -b * 4 ) because P j ∈ ⋆ P * implies I ∩ (W (P * ) ∪ O) = W (P * ).
The term in the exponent is:

µ 2 τ 2 ψ i∈W (P * ) a i -µ 2 τ 2 ψ i∈W (P * )
a i = 0. Thus it will decrypt, and B will have no information about the j-th key 's nature.

In the authorized case, P j / ∈ ⋆ P . ) respectively, we multiply them by A -1 and A ⊤ respectively. Since the distribution of everything given to A except for the j-th key and the challenge ciphertext is independent of the random matrix A and P j / ∈ ⋆ P , we can conclude that these coefficients are uniformly random. Thus B has properly simulated Game 2-j in this case.

If t 1 , t 2 = g τ 1 b * 1 2 , g τ 1 b * 2 2
then the coefficients of the semi functional part of the ciphertext are uniformly random. Thus B has properly simulated Game 2-(j-1) in this case. Therefore B can leverage A's non-negligible difference in advantage between these games to obtain a non-negligible advantage against DS2. □ We prove this lemma in two steps, by randomizing each appearance of s in the c 2 term of the ciphertext, thereby severing its link with the blinding factor. The end result is a semi-functional encryption of a random message. As a first step, we consider an intermediary game, called Game 2-Q ′ , that is exactly like Game 2-Q , except that in the c 2 term of the challenge ciphertext the coefficient of d 2 is changed from being s

2-Q A -Adv 2-Q ′ A
is nonnegligible, then there exists a PPT algorithm B with non-negligible advantage against DS1 with k = 1 and n = 4.

Proof 4.3.4 INIT: B is given ∆ = (Γ, g b * 1 2 , g b * 3 2 , g b * 4 2 , g b 1 1 , g b 2 1 , g b 3 1 , g b 4 1 , u 1 , µ 2 ), along with t 1 either equal to g τ 1 b 1 1 or g τ 1 b 1 +τ 2 b 2 1 . SETUP: B implicitly sets d 1 = b 3 , d 2 = b 2 , d 3 = b 1 , d 4 = b 4 , and d * 1 = b * 3 , d * 2 = b * 2 , d * 3 = b * 1 , d * 4 = b * 4 .
This enables B to produce

g d 1 1 , g d 2 1 , g d 3 1 , g d 4 1
. We note also that D, D * are properly distributed dual orthonormal bases, and that B can produce

g d * 1 2 , g d * 3 2 and g d * 4 2 but does not know g d * 2 2 . B chooses random values α, a 1 , • • • , a L ∈ Z p . She gives A the public key pk = (Γ, e(g 1 , g 2 ) αd 1 •d * 1 , g d 1 1 , h 1 = g a 1 d 2 1 , • • • , h L = g a L d 2 1
).

KEY QUERY: we note that B does not know the full master secret key, but she knows

u 1 = g µ 1 b * 1 +µ 2 b * 2 2
, µ 2 and a 1 , • • • , a L . This allows her to produce semi-functional keys as follows: when A requests a key for some pattern P ′ , B chooses random values r ′ , t 4 ∈ Z p . She sets r = µ 2 r ′ and forms the secret key as:

β = (u 1 ) -r ′ • g αd * 1 +µ 2 r ′ i∈I a i d * 1 +t 4 d * 4 2
,

υ i = g µ 2 r ′ a i d * 1 +t b,i d * 3 2
.

We obtain that β = g

αd * 1 +rd * 1 i∈I a i -rd * 2 +(-r ′ µ 1 )d * 3 +t 4 d * 4 2
. The coefficients of d * 3 , d * 4 are uniformly random thus it is a SF key.

CHALLENGE:

A submits two messages m 0 , m 1 and a challenge pattern P . B chooses b ∈ {0, 1} and forms the challenge ciphertext as follows:

c 1 = m b • (e(g 1 , g 2 ) αd 1 •d * 1 ) s , c 2 = g sd 1 +sd 2 i∈W (P ) a i 1 • t 1 • g zd 4 1
where s, z ← Z p .

• If t 1 is equal to g τ 1 b 1 1 then c 2 = g sd 1 +sd 2 i∈W (P ) a i +τ 1 d 3 +zd 4 1
which is a semi functional ciphertext and B simulates Game 2-Q .

• If t 1 = g τ 1 b 1 +τ 2 b 2 1 then c 2 = g sd 1 +(s i∈W (P ) a i +τ 2 )d 2 +τ 1 d 3 +zd 4 1 is a semi functional cipher- text with randomized coefficients for d 2 , thus B simulates Game 2-Q ′ .
Therefore, B can leverage A's non-negligible difference of advantage between these two games to achieve a non-negligible advantage against DS1. □ Note 4.3.1 All queried keys shared µ 1 , µ 2 in their randomness. However, as it is in exponent and "randomized" by other random elements, then for an adversary it is indistinguishable from a truly random element.

B is given ∆ = (Γ, g b * 1 2 , g b * 3 2 , g b * 4 2 , g b 1 1 , g b 2 1 , g b 3 1 , g b 4 1 , u 1 , µ 2 ), along with t 1 either equal to g τ 1 b 1 1 or g τ 1 b 1 +τ 2 b 2 1 . SETUP: B implicitly sets d 1 = b 2 , d 2 = b 3 , d 3 = b 1 , d 4 = b 4 , and d * 1 = b * 2 , d * 2 = b * 3 , d * 3 = b * 1 , d * 4 = b * 4 .
This enables B to produce

g d 1 1 , g d 2 1 , g d 3 1 , g d 4 1 , but not d 2 .
We note also that D, D * are properly distributed dual orthonormal bases, and that B can produce g

d * 2 2 , g d * 3 2 and g d * 4 2 but does not know g d * 1 2 . B chooses random values α ′ , a 1 , • • • , a L ∈ Z p . She computes e(g b 3 1 , g b * 3
2

) α = e(g 1 , g 2 ) αd 2 •d * 2 = e(g 1 , g 2 ) αψ = e(g 1 , g 2 ) αd 1 •d * 1 . She gives A the public key pk = (Γ, e(g 1 , g 2 ) αd 1 •d * 1 , g d 1 1 , h 1 = g a 1 d 2 1 , • • • , h L = g a L d 2 1
).

KEY QUERY: We note that B does not know the full master secret key, but she knows

u 1 = g µ 1 b * 1 +µ 2 b * 2 2
, µ 2 and a 1 , • • • , a L . This allows her to produce SF keys as follows: when A requests a key for some pattern P ′ , B chooses random values r ′ , t 4 ∈ Z p . She sets r = µ 2 r ′ and forms the secret key as: β = (u 1 )

(α ′ +r ′ i∈I a i ) .g -µ 2 r ′ d * 2 +t 4 d * 4 2 , υ i = u r ′ a i 1 .
We obtain that β = g

αd * 1 +rd * 1 i∈I a i -rd * 2 +(α ′ µ 1 +r ′ µ 1 i∈I a i )d * 3 +t 4 d * 4 2 and υ i = g rd * 1 a i +r ′ µ 1 a i d * 3 2
. The coefficients of d * 3 , d * 4 are uniformly random thus it is a SK key.

CHALLENGE:

A submits messages m 0 , m 1 and challenge pattern P , B chooses b ∈ {0, 1} and forms the challenge ciphertext as follows: s, w, z ← Z p ,

c 1 = m b • (e(g 1 , g 2 ) αd 1 •d * 1 ) s , c 2 = g sd 1 +wd 2 1 • t 1 • g zd 4 1 • If t 1 is equal to g τ 1 b 1 1 then c 2 = g sd 1 +wd 2 +τ 1 d 3 +zd 4 1
is a semi functional ciphertext with the second appearance of s randomized. In this case B simulates Game

2-Q ′ . • If t 1 is equal to g τ 1 b 1 +τ 2 b 2 1 then c 2 = g (s+τ 2 )d 1 +wd 2 +τ 1 d 3 +zd 4 1
which is a semi functional ciphertext with randomized coefficients for d 1 and d 2 . Thus in this case B simulates Game 3 .

Therefore, B can leverage A's non-negligible difference of advantage between these two games to achieve a non-negligible advantage against DS1.

□ We can easily see that as in order to decrypt, one must know which parts of her secret key she has to take according to the ciphertext pattern. That means that this pattern must be given to make decryption working, and thus the scheme is not pattern-hiding.

Combining

Our Pattern-Hiding WIBE Scheme

Intuition. Additionally we tried to add pattern-hiding security to our first WIBE scheme. We based on work on the works of dimension L + 1 to have one vector that "carries" the scheme secret key α (as we did in our first scheme).

To bring security (indistinguishability and weak attribute-hiding) [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF] increases the DPVS dimension to 2L + 3 to add 1-dimensional randomness space to the secret keys, 1dimensional randomness space to the ciphertexts and L-dimensional hidden subspace to realize the semi-functional forms of the secret keys and ciphertexts in the security proof. [START_REF] Okamoto | Fully Secure Functional Encryption with General Relations from the Decisional Linear Assumption[END_REF] improved [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF]'s scheme security: in the latter, the security assumption is non-standard and non-static, while in the former the security assumption is the DLin assumption, which is a standard, static assumption that brings higher security. This is done at the cost of less efficiency as they increase by n -1 the dimension of the secret keys randomness space, thus the DPVS dimension is now equal to 3L + 2.

Finally, to bring fully attribute-hiding security, [START_REF] Okamoto | Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption[END_REF] increased the hidden subspace from L to 2L, which results in a scheme with DPVS dimension equals to 4L + 2. This enlargement in needed as Okamato et al. extended the Dual System Encryption framework: secret keys can now have three forms (normal, temporal 1 and temporal 2) while ciphertexts can have five forms (normal, temporal 0, temporal 1, temporal 2 and unbiased).

Based on that, we transform [START_REF] Okamoto | Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption[END_REF]'s IPE scheme in a WIBE scheme with keys patterns space equals to {0, 1} L \ 0 L and ciphertexts patterns space equals to {0, ⋆} L \ ⋆ L . Our idea to deal with wildcards is simply to only keep the pattern positions equals to 1 in the secret key and the pattern positions equals to 0 in the ciphertext. This gives us our second WIBE scheme, presented in Figure 4.11.

It is important here to notice that the decryption condition in our second WIBE is expressed differently from the one of our first WIBE. Indeed, for patterns P , P * in respectively {0, 1} L \ 0 L and {0, ⋆} L \ ⋆ L , we have that P ∈ ⋆ P * =⇒ ∀i ∈ [L], if

P * i ̸ = ⋆ then P i = P ⋆ i = 0 and thus I ∩ - W (P * ) = ∅.
Our pattern-hiding scheme. In Figure 4.11 we present our pattern-hiding WIBE scheme.

Theorem 4.3.3 Our WIBE scheme is correct. ,

Proof 4.3.6 e(c 2 , sk P ′ ) = e    g s 1 d 0 +s 2 d 4L+1 1 • i∈ - W (P ) h s 3 i , g αd * 0 + j∈I r j d * j + L l=1 η l •d * 3L+l 2    Anaïs Barthoulot |
h 1 = g d 1 1 , • • • , h L = g d L 1
) and the master secret key is msk = (α, g

d * 0 2 , g d * 1 2 , • • • g d * L 2 , g d * 3L+1 2 • • • , g d * 4L 2 ). • KeyGen(msk, P ′ ): pick r, η ∈ Z L p .
The secret key is sk

P ′ = g αd * 0 + j∈I r j d * j + L l=1 η l •d * 3L+l 2 . • Encrypt(pk, P , m ∈ G T ): choose s 1 , s 2 , s 3 ← Z p and compute ct = (c 1 , c 2 )
where

c 1 = m • (e(g 1 , g 2 ) αb * 0 •b 0 ) s 1 , c 2 = g s 1 d 0 +s 2 d 4L+1 1 • i∈ - W (P )
h s 3 i .

• Decrypt(sk

P ′ , ct): compute c 1 • 1 e(c 2 ,sk P ′ ) .
d i •s 3 1 , g j∈I r j d * j 2  
The last row is obtained thanks to dual vector spaces properties. The first pairing cancels itself with the pairing in c 1 . Now, let's see the value of

i∈ - W (P ) d i • j∈I d * j .
As user with pattern P ′ is allowed to decrypt, I ∩ -W (P ) = ∅, and thanks to dual vector spaces properties, the above product is equal to 0 and decryptor obtains m. □

Security.

The following theorem establishes the security of our new WIBE scheme.

Theorem 4.3.4 If XDLin1, XDLin2 hold, then our scheme satisfies adaptive indistinguishability and is pattern-hiding, in the standard model.

We are going to prove this theorem in two steps: first by proving the pattern-hiding security, then the adaptive indistinguishability.

Pattern-hiding security. Let us start with the proof that our scheme is pattern-hiding, as stated by the following lemma.

Lemma 4.3.6 If XDLin1, XDLin2 hold, then our scheme satisfies pattern-hiding security.

The proof is done as in [START_REF] Okamoto | Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption[END_REF] (Section 4.3.3), except that it is in the asymmetric setting.

The different forms of ciphertext are defined according to challenge patterns P 0 , P 1 . c 1 is the same in all forms, just c 2 is different. We use a sequence of 4Q + 3 games:

• Game 0 : is the original pattern-hiding security game, presented in Figure 4.7.

• Game 1 : is as Game 0 except that the ciphertext is changed to temporal 0 form: let b ∈ {0, 1} , t ∈ Z p and suppose that P b 1 = 0. Define c 2 as

g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P b ) d i +td L+1 1 (4.1)
This game is also called Game 2-0-4 . • For 1 ≤ h ≤ Q (the number of keys queried), we define the following 4 games:

-Game 2-h-1 : in this game, the challenge ciphertext is changed to temporal 1

form: let b ∈ {0, 1} , t, u, ũ ∈ Z p . Define c 2 as g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P b ) d i +t i∈ - W (P b ) d L+i +u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 ) d 2L+i 1 (4.2)
and the first h -1 keys are temporal 2 forms: let x ∈ Z L p be a random vector. Define the key as

g αd * 0 + j∈I r j d * j + j∈I x j d * 2L+j + L l=1 η l •d * 3L+l 2 (4.3)
while the remaining keys are normal. -Game 2-h-2 : in this game the h-th key is changed to temporal 1 form: let z ∈ Z L p be a random vector. Define the key as

g αd * 0 + j∈I r j d * j + j∈I z j d * L+j + L l=1 η l •d * 3L+l 2 (4.4)
while the remaining keys and the challenge ciphertext are the same as in Game while all the queried keys are the same as in Game 2-h-2 . -Game 2-h-4 : in this game, the h-th key is changed to temporal 2 form (eq. 4.3) while the remaining keys and the challenge ciphertext are as in Game 2-h-3 .

2-h-1 . -Game 2-h-3 : in this game, challenge ciphertext is changed to temporal 2 form: let b ∈ {0, 1} , t, t, u, ũ ∈ Z p . Define c 2 as g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P b ) d i +t i∈ - W (P 0 ) d L+i + t i∈ - W (P 1 ) d L+i +u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 )
• Game 3 : the challenge ciphertext is changed to unbiased form:

let b ∈ {0, 1} , w, w, t, t, u, ũ ∈ Z p . Define c 2 as g s 1 d 0 +s 2 d 4L+1 +w i∈ - W (P 0 ) d i + w i∈ - W (P 1 ) d i +t i∈ - W (P 0 ) d L+i + t i∈ - W (P 1 ) d L+i +u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 ) d 2L+i 1
(4.6) while all the queried keys are temporal 2 form (eq. 4.3). In this game, the advantage of adversary is 0.

Informally, indistinguishability between those games is proven as in the original proof, using problems 1,2 and 3 (Definitions 2.3.5, 2.3.6 and 2.3.7). We present the informal security proof in Figure 4.12.

• Step 1: we prove that if there exists an adversary that can distinguish Game 0 from Game 1 then there exists an adversary that breaks Problem 1. This is formalized by Lemma 4.3.7. • Step 2: we show that Game 2-(h-1)-4 can conceptually be changed into Game 2-h-1 . The advantage of an adversary in distinguishing theses games is equal to 4/p when h = 1, otherwise it is equal to 3/p. This is summarized by Lemma 4.3.8. • Step 3: we prove that if there exists an adversary that can distinguish Game 2-h-1 from Game 2-h-2 then there exists an adversary that breaks Problem 2, as stated in Lemma 4.3.9. • Step 4: we show that Game 2-h-2 can conceptually be changed into Game 2-h-3 . The advantage of an adversary in distinguishing theses games is equal to 4 p |I + 5/p. Here we had to modify [START_REF] Okamoto | Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption[END_REF]'s change of bases as it was not working with our scheme. This is summarized in Lemma 4.3.10.

• Step 5: we prove that if there exists an adversary that can distinguish Game 2-h-3 from Game 2-h-4 then there exists an adversary that breaks Problem 3 as formalized by Lemma 4.3.11. • Step 6: we show that Game 2-Q-4 can conceptually be changed into Game 3 .

The advantage of an adversary in distinguishing theses games is equal to 3/p, as stated in Lemma 4.3.12. We now start the formal proof.

Lemma 4.3.7 For any adversary A, there exists a probabilistic adversary B against Problem 1, whose running time is essentially the same as that of A, such that for any security parameter λ, Adv (0)

A (λ) -Adv (1)
A (λ) ≤ Adv P 1 B (λ).

Proof 4.3.7

To prove lemma 4.3.7, we construct a probabilistic machine B against Problem 1 using an adversary A in a security game (Game 0 or Game 1 ) as a black box as follows.

INIT: B is given a Problem 1 instance (Γ, D, D * , e β,1 , {e i } i∈ 2,n ).
SETUP: B plays a role of the challenger in the security game against adversary A. She provides A a public key pk = (Γ, e(g 1 , g 2 ) αd 0 .d * 0 , g d 0 1 , g

d 4L+1 1
,

h 1 = g d 1 1 , • • • , h L = g d L 1
) of Game 0 ′ (and Game 1 ).

KEY QUERY: When a key query is issued for a pattern P , B answers normal key sk P , that is computed using B * of the Problem 1 instance. CHALLENGE: When B receives an encryption query with challenge plaintext m and patterns P 0 , P 1 from A, B computes the challenge ciphertext (c 1 , c 2 ) s.t.,

c 1 = m • e(g 1 , g 2 ) s 1 αd 0 d * 0 c 2 = g s 1 d 0 +s 2 d 4L+1 1 • e β,1 • i∈ - W (P b )\{1} e i , where s 1 , s 2 ← Z p , b ← {0, 1} and {d i } i=0,4L+1 , e β,1 , {e i } i=2,••• ,L is part of the Problem 1 instance. GUESS: A finally outputs bit b ′ . If b = b ′ , B outputs β ′ = 1. Otherwise, B outputs β ′ = 0.
Let us see that the distribution of A's view in the above-mentioned game, simulated by B given a Problem 1 instance with β ∈ {0, 1}, is the same as that in Game 0 (resp.

Game 1 ) if β = 0 (resp. β = 1).

We will consider the distribution of c 2 . When β = 0, challenge ciphertext element c 2 is

c 2 = g s 1 d 0 +s 2 d 4L+1 1 • e β,1 • i∈ - W (P b )\{1} e i = g s 1 d 0 +s 2 d 4L+1 +ωd 1 +γd 4L+1 +ω i∈ - W (P b )\{1} d i 1 = g s 1 d 0 +s 3 i∈ - W (P b ) +s ′ 2 d 4L+1 1
where

s 3 = ω, s ′ 2 = s 2 + γ, s 1 ∈ Z p are uniformly and independently distributed. When β = 1, challenge ciphertext element c 2 is c 2 = g s 1 d 0 +s 2 d 4L+1 1 • e β,1 • i∈ - W (P b )\{1} e i = g s 1 d 0 +s 2 d 4L+1 +ωd 1 +zd L+1 +γd 4L+1 +ω i∈ - W (P b )\{1} d i 1 = g s 1 d 0 +s 3 i∈ - W (P b ) +td L+1 +s ′ 2 d 4L+1 1
where t = z, s 3 = ω, s ′ 2 = s 2 + γ, s 1 ∈ Z p are uniformly and independently distributed. Therefore, the above c 1 , c 2 give a challenge ciphertext in Game 0 when β = 0 and that in Game 1 when β = 1. Thus,

Adv (0 ′ ) A (λ) -Adv (1)
A (λ) = Pr B 1 (λ, ϱ) → 1|ϱ ← G P 1 0 (λ, L) -Pr B 1 (λ, ϱ) → 1|ϱ ← G P 1 1 (λ, L) ≤ Adv P 1 B 1 (λ).
This complete the proof of lemma 4.

A (λ) -Adv (2-1-1) A (λ) ≤ 4/p.
We define an intermediate game, Game 1 ′ , and will show the equivalence of the distribution of the views of A in Game 1 and that in Game 1 ′ and those in Game 2-1-1 and in Game 1 ′ . Game 1 ′ : Game 1 ′ is the same as Game 1 except that the c 2 of the challenge ciphertext for (challenge plaintext m and) patterns P 0 , P 1 is:

c 2 = g s 1 d 0 +s 3 i∈ - W (P b ) d i + 2L i=1 r i d L+i +s 2 d 4L+1 1 where r i ← Z p for i ∈ [2L], r = (r 1 , • • • , r 2L ) ̸ = 0 2L
, and all the other variables are generated as in Game 1 .

Let us see that the distribution of (pk, sk (j)

j∈[Q]
, c 1 , c 2 ) in Game 1 and that in Game 1 ′ are equivalent except with negligible probability.

We will consider the distribution in Game 1 . We define new dual orthonormal bases (B, B * ) below. Pick F ← GL(2L, Z p ), and set

    b L+1 . . . b 3L     = F -1 •     d L+1 . . . d 3L     ,     b * L+1 . . . b * 3L     = F ⊤ •     d * L+1 . . . d * 3L     , and B = (d 0 , • • • , d L , b L+1 , • • • , b 3L , d 3L+1 , • • • , d 4L+1 ) B * = (d * 0 , • • • , d * L , b * L+1 , • • • , b * 3L , d * 3L+1 , • • • , d * 4L+1 ).
Then, B, B * are dual orthonormal bases. Notice that then

d L+1 is equal to F •     b L+1 . . . b 3L     ,
thus can be written as

d L+1 = f 1,1 b L+1 + f 1,2 b L+2 + • • • + f 1,2L b 3L , with F =       f 1,1 f 1,2 , • • • f 1,2L f 2,1 f 2,2 , • • • f 2,2L . . . f 2L,1 f 2L,2 , • • • f 2L,2L       .
Challenge ciphertext c 2 is expressed as

g s 1 d 0 +s 3 i∈ - W (P b ) d i +tb L+1 +s 2 d 4L+1 1 = g s 1 b 0 +s 3 i∈ - W (P b ) b i +t(f 1,1 b L+1 +f 1,2 b L+2 +•••+f 1,2L b 3L )+s 2 b 4L+1 1 = g s 1 b 0 +s 3 i∈ - W (P b ) b i + 2L i=1 r i b L+i +s 2 b 4L+1 1 where s 1 , s 2 , s 3 ← Z p and r = (r i = tf 1,i ) i∈ [2L] . Vector r is uniformly distributed in Z 2L p \ 0 2L
except for probability 1/p and independent of all the other variables.

In Game 1 , sk P is g

αd * 0 + j∈I r j d * j + L l=1 η l •d * 3L+l 2 = g αb * 0 + j∈I r j b * j + L l=1 η l •b * 3L+l 2
, where r, {η l } l∈[L] ← Z p , for every queried key.

In the light of the adversary's view, (B, B * ) is consistent with public key (Γ, e(g 1 , g 2 )

αd 0 •d * 0 , g d 0 1 , g d 4L+1 1 , h 1 = g d 1 1 , • • • , h L = g d L 1
). Moreover, the challenge ciphertext in Game 1 can be conceptually changed to that in Game 1 ′ except with probability 1/p.

Let's see that the distribution of (pk, sk (j)

j∈[Q] , c 1 , c 2 ) in Game 2-1-1 and that in Game 1 ′
are equivalent except with probability 3/p.

We will consider the distribution in Game 2-1-1 . We define new dual orthonormal bases (B, B * ) as above. Challenge ciphertext c 2 is expressed as

g s 1 d 0 +s 3 i∈ - W (P b ) d i +t i∈ - W (P b ) d L+i +u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 ) d 2L+i +s 2 d 4L+1 1 = g s 1 b 0 +s 3 i∈ - W (P b ) b i +t i∈ - W (P b ) ( 2N j=1 f i,j b L+j )+u i∈ - W (P 0 ) ( 2L j=1 f i,j b L+j ) 1 • g ũ i∈ - W (P 1 ) ( 2L j=1 f i,j b L+j )+s 2 b 4L+1 1 Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 = g s 1 b 0 +s 3 i∈ - W (P b ) b i + 2L i=1 r i b L+i +s 2 b 4L+1 1
where s 1 , s 2 , s 3 ← Z p and vector r such that for i ∈

[2L], r i = t j∈ - W (P b ) f j,i +u j∈ - W (P 0 ) f j,i + ũ j∈ - W (P 1 ) f j,i .
Vector r ̸ = 0 2L except with probability 3/p, is uniformly distributed in Z 2L p \ 0 2L , and independent of all the other variables. For the queried keys, the same as above holds also in Game 2-1-1 .

In the light of the adversary's view, (B, B * ) is consistent with public key (Γ, e(g 1 , g 2 )

αd 0 •d * 0 , g d 0 1 , g d 4L+1 1 , h 1 = g d 1 1 , • • • , h L = g d L 1
). Moreover, the challenge ciphertext in Game 2-1-1 can be conceptually changed to that in Game 1 ′ except with probability 3/p.

This completes the proof when

h = 1. Now h ≥ 2, i.e. proof for Adv (2-(h-1)-4) A (λ) -Adv (2-h-1) A (λ) ≤ 3/p.
We define an intermediate game, Game 2-(h-1)-4 ′ , and will show the equivalence of the distribution of the views of A in Game 2-(h-1)-4 and that in Game 2-(h-1)-4 ′ and those in Game

2-h-1 and in Game 2-(h-1)-4 ′ . Game 2-(h-1)-4 ′ : Game 2-(h-1)-4 ′
is the same as Game 2-(h-1)-4 except that the element c 2 of the challenge ciphertext for (challenge plaintext m and) patterns P 0 , P 1 is:

c 2 = g s 1 d 0 +s 3 i∈ - W (P b ) d i + L i=1 r i d L+i +u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 ) d 2L+i +s 2 d 4L+1 1 where r i ← Z p for i ∈ [L], r = (r 1 , • • • , r L ) ̸ = 0 L ,
and all the other variables are generated as in Game 2-(h-1)-4 .

Let's see that the distribution of (pk, sk (j)

j∈[Q] , c 1 , c 2 ) in Game 2-(h-1)-4
and that in Game 2-(h-1)-4 ′ are equivalent except with probability 2/p.

We will consider the distribution in Game 2-(h-1)-4 . We define new dual orthonormal bases (B, B * ) below. We generate F ← GL(L, Z p ), and set

    b L+1 . . . b 2L     = F -1     d L+1 . . . d 2L         b * L+1 . . . b * 2L     = F ⊤     d * L+1 . . . d * 2L     and B = (d 0 , • • • , d L , b L+1 , • • • , b 2L , d 2L+1 , • • • , d 4L+1 ) B * = (d * 0 , • • • , d * L , b * L+1 , • • • , b * 2L , d * 2L+1 , • • • , d * 4L+1
). Then B and B * are dual orthonormal bases. Challenge ciphertext c 2 is expressed as

g s1d0+s3 i∈ - W (P b ) di+t i∈ - W (P 0 ) d L+i + t i∈ - W (P 1 ) d L+i +u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 0 ) d 2L+i +s2d 4L+1 1 = g s1b0+s3 i∈ - W (P b ) bi+t i∈ - W (P 0 ) ( L j=1 fi,j b L+j )+ t i∈ - W (P 1 ) ( L j=1 fi,j b L+j )+u i∈ - W (P 0 ) b 2L+i +ũ i∈ - W (P 0 ) b 2L+i +s2b 4L+1 1 = g s1b0+s3 i∈ - W (P b ) bi+ L i=1 rib L+i +u i∈ - W (P 0 ) b 2L+i +ũ i∈ - W (P 0 ) b 2L+i +s2b 4L+1 1
where s 1 , s 2 , s 3 , u, ũ ← Z p and r is defined such that for i

∈ [L], r i = t j∈ - W (P 0 ) f j,i + t j∈ - W (P 1 )
f j,i . Thus r ̸ = 0 L except with probability 2/p, is uniformly distributed and independent of all the other variables.

When 1 ≤ j ≤ h -1, the j-th queried key sk P (j) is

g αd * 0 + j∈I r j d * j + j∈I x j d 2L+j + L l=1 η l •d * 3L+l 2 = g αb * 0 + j∈I r j b * j + j∈I x j b 2L+j + L l=1 η l •b * 3L+l 2 where {x j , r j } i,j∈[L] , {η l } l∈[L] ← Z p . When h ≤ j ≤ Q, the j-th queried key sk P (j) is g αd * 0 + j∈I r j d * j + L l=1 η l •d * 3L+l 2 Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 = g αb * 0 + j∈I r j b * j + L l=1 η l •b * 3L+l 2 where{r j } j∈[L] , {η l } l∈[L] ← Z p .
In the light of the adversary's view, (B, B * ) is consistent with public key (Γ, e(g 1 , g 2 )

αd 0 •d * 0 , g d 0 1 , g d 4L+1 1 , h 1 = g d 1 1 , • • • , h L = g d L 1
). Moreover, the challenge ciphertext in Game 2-(h-1)-4 can be conceptually changed to that in Game 2-(h-1)-4 ′ except with probability 2/p.

Let us see that the distribution of (pk, sk (j)

j∈[Q] , c 1 , c 2 ) in Game 2-h-1 and that in Game 2-(h-1)-4 ′ are equivalent except with probability 1/p.
We will consider the distribution in Game 2-h-1 . We define new dual orthonormal bases (B, B * ) as above. Challenge ciphertext c 2 is expressed as

g s 1 d 0 +s 3 i∈ - W (P b ) d i +t i∈ - W (P b ) d L+i +u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 0 ) d 2L+i +s 2 d 4L+1 1 = g s 1 b 0 +s 3 i∈ - W (P b ) b i +t i∈ - W (P b ) ( L j=1 b L+j )+u i∈ - W (P 0 ) b 2L+i +ũ i∈ - W (P 0 ) b 2L+i +s 2 b 4L+1 1 = g s 1 b 0 +s 3 i∈ - W (P b ) b i + L i=1 r i d L+i + L i=1 b L+i +u i∈ - W (P 0 ) b 2L+i +ũ i∈ - W (P 0 ) b 2L+i +s 2 b 4L+1 1
where s 1 , s 2 , s 3 , u, ũ ← Z p and vector r such that for i

∈ [L], r i = t j∈ - W (P b )
f j,i . Vector r ̸ = 0 except with probability 1/p, then is uniformly distributed in Z L p \ 0 L , and independent of all the other variables. For the queried keys, the same as above holds also in Game 2-h-1 .

In the light of the adversary's view, (B, B * ) is consistent with public key (Γ, e(g 1 , g 2 )

αd 0 •d * 0 , g d 0 1 , g d 4L+1 1 , h 1 = g d 1 1 , • • • , h L = g d L 1
). Moreover, the challenge ciphertext in Game 2-h-1 can be conceptually changed to that in Game 2-(h-1)-4 ′ except with probability 1/p. This completes the proof when h ≥ 2, and thus also the proof of lemma 4.3.8. □ Lemma 4.3.9 For any adversary A, there exists a probabilistic adversary B, whose running time is essentially the same as that of A, such that for any security parameter λ,

Adv 2-h-1 A (λ) -Adv 2-h-2 A (λ) ≤ Adv P 2 B (λ).
Proof 4.3.9 We construct a probabilistic adversary B against Problem 2 using an adversary A in a security game (Game 2-h-1 or Game

= (d 0 , • • • , d L , d 4L+1 ) is obtained from the Problem 2 instance.
KEY QUERY: when the ι-th key query is issued for a pattern P , B answers as follows:

• When 1 ≤ ι ≤ h -1, B answers keys of temporal 2 form, that are computed using B * of the Problem 2 instance.

• When ι = h, B calculates sk P using h * β,i i∈[Q] , {d * i } i=0,3L+1,••• ,4L of the Problem 2 instance as follows: η = (η 1 , • • • , η L ) ← Z L p , ξ i ← Z p for i ∈ [L] sk P = g αd * 0 2 • i∈I h * ξ i β,i • g i∈[L] η i d * 3L+i 2
• When ι ≥ h + 1, B answers normal keys using B * of the Problem 2 instance.

CHALLENGE: when B receives an encryption query with challenge plaintext m and patterns P 0 , P 1 from A, she computes challenge ciphertext (c 1 , c 2 ) s.t. where

c 1 = m • e(g 1 , g 2 ) s 1 d 0 •d * 0 c 2 = g s 1 d 0 +s 2 d 4L+1 1 • i∈ - W (P b ) e i • g u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 )
s 1 , s 2 , u, ũ ← Z p , b ← {0, 1} and {d i } i=0,2L+1,••• ,3L,4L+1 , {e i } i∈[L] is a part of the Problem 2 instance. GUESS: A outputs bit b ′ . If b = b ′ , B 2-1 outputs β ′ = 1. Otherwise, B 2-1 outputs β ′ = 0.
Let us see that if β = 0, then the distribution of A's view in the above mentioned game, simulated by B, is the same that in Game 2-h-1 , and that if β = 1 it is the same that in Game

2-h-2 . Ciphertext element c 2 is g s 1 d 0 +s 2 d 4L+1 1 • i∈ - W (P b ) e i • g u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 ) d 2L+i 1 = g s 1 d 0 +s 2 d 4L+1 1 • i∈ - W (P b ) g ωd i +σd L+i 1 • g u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 ) d 2L+i 1 = g s 1 d 0 +s 2 d 4L+1 +ω i∈ - W (P b ) d i +σ i∈ - W (P b ) d L+i +u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 ) d 2L+i 1
where s 1 , s 2 , ω, σ, u, ũ ∈ Z p are uniformly distributed. Now let us see the value of sk P . When β = 0, sk P in case ι = h

g αd * 0 2 • i∈I h * ξ i β,i • g i∈[L] η i d * 3L+i 2 = g αd * 0 2 • i∈I g δξ i d * i +ξ i δ 0 d * 3L+i 2 • g i∈[L] η i d * 3L+i 2 = g αd * 0 + j∈I δξ i d * j + i∈[L] ϕ i d * 3L+i 2
where α, δ are uniformly and independently distributed and ϕ i = ξ i δ 0 + η i if i ∈ I and ϕ i = η i otherwise. Therefore, generated c 2 , sk P have the same joint distribution as in Game

2-h-1 . When β = 1, sk P in case ι = h g αd * 0 2 • i∈I h * ξ i β,i • g i∈[L] η i d * 3L+i 2 = g αd * 0 2 • i∈I g ξ i δd * i +ξ i τ d L+i +ξ i δ 0 d * 3L+i 2 • g i∈[L] η i d * 3L+i 2 = g αd * 0 + i∈I δξ i d * j + i∈I τ ξ i d * L+i + i∈[L] ϕ i d * 3L+i 2
where α, δ, τ are uniformly and independently distributed and ϕ i = ξ i δ 0 + η i if i ∈ I and x i = η i otherwise. Therefore, generated c 2 and sk P have the same joint distribution as

Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 in Game 2-h-2 . Thus Adv 2-h-1 A (λ) -A 2-h-2 (λ) ≤ Adv P 2 B (λ). □ Lemma 4.3.10 For any adversary A, Adv (2-h-2) A (λ) -Adv (2-h-3) A ≤ 4 p |I| + 5/p.
This is the only part of the proof that cannot be done as in the original proof. Indeed, as already said, [START_REF] Okamoto | Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption[END_REF] proved that Game 2-h-2 can be conceptually changed to Game In our proof, we change the way the new dual orthonormal bases are computed. We define new dual orthonormal bases (B, B * ), following the idea of the last lemma in the original proof. This solves the issue raised by our scheme's construction and allows us to prove the indistinguishability between the two games. Proof 4.3.10 We will show that distribution (pk, sk (j)

j∈[Q] , c 1 , c 2 ) in Game 2-h-2 and
that in Game 2-h-3 are equivalent. For that purpose, we define an intermediate game: Game 2-h-2 ′ , that is the same as Game 2-h-2 except that element c 2 of the challenge ciphertext for challenge plaintext m and patterns P 0 , P 1 is:

c 2 = g s 1 d 0 +s 2 d 4L+1 + i∈ - W (P b ) si d i + l i=1 ν i d L+i 1 • g u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 ) d 2L+i 1 where {s i ∈ Z p } i∈[L] , ν ← Z L
p and all the other variables are generated as in Game 2-h-2 . Notice that ν is equal to zero at position i such that i / ∈ -W (P 0 ) ∧ i / ∈ -W (P 1 ).

Anaïs Barthoulot | PhD Thesis | University of Limoges

Licence CC BY-NC-ND 3.0

Let us see that the distribution (pk, sk (j)

j∈[Q] , c 1 , c 2 ) in Game 2-h-2 and that in Game 2-h-2 ′
are equivalent except with negligible probability.

We will consider the distribution in Game 2-h-2 . We define new dual orthonormal bases (B, B * ), following the idea of the last lemma in the original proof. For i ∈ [L] let θ i , τ i ← Z p and set

b i = τ -1 i d i + θ i d L+i , b * i = τ i d * i b L+i = τ i d L+i b * L+i = -θ i d * i + τ -1 i d * L+i , and B = (d 0 , b 1 • • • , b L , b L+1 , • • • , b 2L , d 2L+1 • • • d 4L+1 ), B * = (d * 0 , b * 1 , • • • , b * L , b * L+1 , • • • , b * 2L , d * 2L+1 , • • • , d * 4L+1
). We then easily verify that B and B * are dual orthonormal. The h-th queried key and challenge ciphertext (sk

(h) , c 1 , c 2 ) in Game 2-h-2 are expressed over bases (D, D * ) and (B, B * ) as sk (h) = g αd * 0 + j∈I r j d * j + j∈I z j d * L+j + L l=1 η l d * 3L+l 2 = g αb * 0 + j∈I r j τ j b * j + j∈I z j (τ j b * L+j +θ j b * j )+ L l=1 η l b * 3L+l 2 = g αb * 0 + j∈I (r j τ j +z j θ j )b * j + j∈I z j τ j b * L+j + L l=1 η l b * 3L+l 2 c 2 = g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P b ) d i +t i∈ - W (P b ) d L+i +u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 ) d 2L+i 1 = g s 1 b 0 +s 2 b 4L+1 +s 3 i∈ - W (P b ) (τ i b i -θ i b L+i )+t i∈ - W (P b ) b * L+i +u i∈ - W (P 0 ) b 2L+i 1 • g ũ i∈ - W (P 1 ) b 2L+i 1 = g s 1 b 0 +s 2 b 4L+1 +s 3 i∈ - W (P b ) τ i b i + i∈ - W (P b ) (t-s 3 θ i )b * L+i +u i∈ - W (P 0 ) b 2L+i 1 • g ũ i∈ - W (P 1 ) b 2L+i 1 c 1 = m.e(g 1 , g 2 ) sd * 0 d 0 = m.e(g 1 , g 2 ) sb * 0 b 0
where rj = r j τ j + z j θ j , zj = z j τ j for j ∈ I and rj = w j = 0 otherwise, and si = s 3 τ i ,

ν i = t -s 3 θ i for i ∈ - W (P b
) and si = ν i = 0 otherwise. si , ri , ν, w are uniformly distributed for the position different of 0 and independent of all the other variables except with probability 2 p |I| + 2/p.

In the light of the adversary view, both (D, D * ) and (B, B * ) are consistent with public key pk and the answered keys sk (j) j̸ =h

. Therefore, by using the above result for the distribution of (sk (h) , c 1 , c 2 ), sk (j)

j∈[Q]
and c 2 can be expressed as keys and ciphertext in two ways, in Game

d i +t i∈ - W (P 0 ) d L+i + t i∈ - W (P 1 ) d L+i +u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 ) d 2L+i 1 = g s 1 b 0 +s 2 b 4L+1 +s 3 i∈ - W (P b ) (τ i b i -θ i b L+i )+t i∈ - W (P 0 ) τ -1 i b L+i + t i∈ - W (P 1 ) τ -1 i b L+i +u i∈ - W (P 0 ) b 2L+i 1 •g ũ i∈ - W (P 1 ) b 2L+i 1
We can define ν the coefficient vector of SETUP: B plays a role of the challenger in the security game against adversary A. She provides A a public key pk = (Γ, e(g 1 , g 2 )

(b L+1 , • • • , d 2L ) as for i ∈ [L]: ν i =                            τ -1 i t if i ∈ - W (P 0 ) ∧ i / ∈ - W (P 1 ) ∧ b = 1 τ -1 i t if i ∈ - W (P 1 ) ∧ i / ∈ - W (P 0 ) ∧ b = 0 -s 3 θ i + τ -1 i t if i ∈ - W (P 0 ) ∧ i / ∈ - W (P 1 ) ∧ b = 0 -s 3 θ i + τ -1 i t if i ∈ - W (P 1 ) ∧ i / ∈ - W (P 0 ) ∧ b = 1 -s 3 θ i + τ -1 i t + τ -1 i t if i ∈ - W (P 0 ) ∧ i ∈ - W (P 1 ) 0 otherwise and si = s 3 τ i for i ∈ - W (P b ). ν, {s i } i=1,••• ,L
Adv 2-h-3 A (λ) -Adv 2-h-4 A (λ) ≤ Adv P 3 B (λ).
αd 0 d * 0 , g d 0 1 , g d 4L+1 1 , g d 1 1 , • • • , g d L 1
of Game 2-h-3 (and Game 2-h-4 ), obtained from the Problem 3 instance. KEY QUERY: when the ι-th key query is issued for a pattern P , B answers as follows:

• When 1 ≤ ι ≤ h -1, B answers keys of temporal 2 form, that are computed using D * of the Problem 3 instance.

• When ι = h, B calculates sk P using ( h * β,i i∈[L] , {d * i } i=0,3L+1,••• ,4L ) of the Problem 3 instance as follows: {σ i , ξ i } i∈[L] ← Z p , η = (η 1 , • • • , η L ) ← Z L p sk P = g αd * 0 + i∈I σ i d * i + i∈[L] η i d * 3L+i 2 • i∈I h * ξ i β,i • When ι ≥ h + 1, B
c 2 = g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P b ) d i 1 • i∈ - W (P 0 ) e i • i∈ - W (P 1 ) f i c 1 = m • (e(g 1 , g 2 ) αd 0 •d * 0 ) s 1 where s 1 , s 2 , s 3 ← Z p , b ← {0, 1} and ({d i } i=0,2L+1,••• ,3L,4L+1 , {e i } i∈[L] , {e i , f i } i∈[L]
) is a part of the Problem 3 instance.

GUESS: A finally outputs bit b ′ . If b = b ′ , B outputs β ′ = 1. Otherwise, B 2-2 outputs β ′ = 0.
Let us see that the distribution of the view of adversary A in the above-mentioned game, simulated by B given a Problem 3 instance with β ∈ {0, 1}, is the same as that in Game

2-h-3 (resp. Game 2-h-4 ) if β = 0 (resp. β = 1).
We consider the joint distribution of c 2 and sk P . Ciphertext element c 2 is

g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P b ) d i 1 • i∈ - W (P 0 ) e i • i∈ - W (P 1 ) f i = g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P b ) d i + i∈ - W (P 0 ) (ω ′ b L+i +ω " b 2L+i ) 1 •g i∈ - W (P 1 ) (κ ′ b L+i +κ " b 2L+i ) 1 = g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P b ) d i + i∈ - W (P 0 ) ω ′ b L+i + i∈ - W (P 1 ) κ ′ b L+i 1 •g i∈ - W (P 0 ) ω " b 2L+i + i∈ - W (P 1 ) κ " b 2L+i 1
where s 1 , s 2 , s 3 , ω ′ , ω " , κ ′ , κ " ∈ Z p are uniformly distributed. Now let us see the value of sk P . When β = 0, sk P (in case ι = h) is

g αd * 0 + i∈I σ i d * i + i∈[L] η i d * 3L+i 2 • i∈I h * ξ i β,i Anaïs
* 0 + i∈I σ i d * i + i∈[L] η i d * 3L+i + i∈I (τ ξ i d * L+i +ξ i δ 0 d * 3L+i ) 2 = g αd * 0 + i∈I σ i d * i + i∈I τ ξ i d * L+i + i∈I δ 0 ξ i η i d * 3L+i + i∈O η i d * 3L+i 2
where α, σ, τ, δ 0 , {η i } i∈[L] are uniformly and independently distributed. Therefore, generated c 2 , sk P have the same joint distribution as in Game

2-h-3 . When β = 1, sk P (in case ι = h) is g αd * 0 + i∈I σ i d * i + i∈[L] η i d * 3L+i 2 • i∈I h * ξ i β,i = g αd * 0 + i∈I σ i d * i + i∈[L] η i d * 3L+i + i∈I (τ ξ i d * 2L+i +ξ i δ 0 d * 3L+i ) 2 = g αd * 0 + i∈I σ i d * i + i∈I τ ξ i d * 2L+i + i∈I ξ i δ 0 η i d * 3L+i + i∈O η i d * 3L+i 2
where α, σ, τ, δ 0 , {η i } i∈[L] are uniformly and independently distributed. Therefore, generated c 2 , sk P have the same joint distribution as in Game 2-h-4 .

Thus, Adv 2-h-3

A (λ) -A 2-h-4 (λ) ≤ Adv P 3 B (λ). □ Lemma 4.3.12 For any adversary A, Adv 2-Q-4 A (λ) -Adv 3 A (λ) ≤ 2 p |I| + 3/p.
Proof 4.3.12 To prove this lemma, we will show that distribution (pk, {sk

P j } j∈[Q] , c 1 , c 2 )
in Game 2-Q-4 and that in Game 3 are equivalent. For that purpose, we define new dual orthonormal bases (B, B * ) as follows:

We generate

θ i ← Z p for i ∈ [L] and set for i ∈ [L], b 2L+i = d 2L+i -θ i d i , b * i = d * i +θ i d * 2L+i and B = (d 0 , • • • , d 2L , b 2L+1 , • • • , b 3L , b 3L+1 , • • • , b 4L+1 ), B * = (d * 0 , b * 1 , • • • , b * L , d * L+1 , • • • , d * 4L+1 )
We then easily verify that B and B * are dual orthonormal, and are distributed the same as the original bases (D, D * ).

Keys and challenge ciphertext {sk

P j } j∈[Q] , c 1 , c 2 in Game 2-Q-4 are expressed over bases (D, D * ) and (B, B * ) as sk P j = g αd * 0 + i∈I r j i d * i + i∈I x j i d * 2L+i + L l=1 η j l •d * 3L+l 2 = g αb * 0 + i∈I r j i (b * i -θ i d * 2L+i )+ i∈I x j i b * 2L+i + L l=1 η j l •b * 3L+l 2 = g αb * 0 + i∈I r j i b * i + j∈I (x j i -r j i θ i )b * 2L+i + L l=1 η j l •b * 3L+l 2 c 1 = m • e(g 1 , g 2 ) αd 0 d * 0 s = m • e(g 1 , g 2 ) αb 0 b * 0 s c 2 = g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P b ) d i +t i∈ - W (P 0 ) d L+i + t i∈ - W (P 1 ) d L+i +u i∈ - W (P 0 ) d 2L+i +ũ i∈ - W (P 1 ) d 2L+i 1 = g s 1 b 0 +s 2 b 4L+1 +s 3 i∈ - W (P b ) b i +t i∈ - W (P 0 ) b L+i + t i∈ - W (P 1 ) b L+i 1 • g u i∈ - W (P 0 ) (b 2L+i +θ i b i )+ũ i∈ - W (P 1 ) (b 2L+i +θ i b i ) 1 = g s 1 b 0 +s 2 b 4L+1 + L i=1 ν i b i +t i∈ - W (P 0 ) b L+i + t i∈ - W (P 1 ) b L+i +u i∈ - W (P 0 ) b 2L+i +ũ i∈ - W (P 1 ) b 2L+i 1 where for i ∈ [L]: xi = x j i -r j i θ i if i ∈ I 0 otherwise Anaïs Barthoulot | PhD Thesis | University of Limoges
Licence CC BY-NC-ND 3.0 and

ν i =                            0 if i / ∈ - W (P 0 ) ∧ i / ∈ - W (P 1 ) θ i u if i ∈ - W (P 0 ) ∧ i / ∈ - W (P 1 ) ∧ b = 1 θ i ũ if i ∈ - W (P 1 ) ∧ i / ∈ - W (P 0 ) ∧ b = 0 s 3 + uθ i if i ∈ - W (P 0 ) ∧ i / ∈ - W (P 1 ) ∧ b = 0 s 3 + ũθ i if i ∈ - W (P 1 ) ∧ i / ∈ - W (P 0 ) ∧ b = 1 s 3 + (u + ũ)θ i if i ∈ - W (P 1 ) ∧ i ∈ - W (P 0 )
are uniformly, independently (from other variables) distributed since s 3 , θ, t j ← Z p , except with probability IND-WIBE-CPA security. We finally prove that our WIBE scheme satisfies indistinguishability, as stated in the following lemma.

Lemma 4.3.13 If XDLin1, XDLin2 hold, then our scheme satisfies adaptive indistinguishability.

Our proof is similar to the one of [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF] (Section 3.5.2). It exploits the dual system encryption through a sequence of Q + 3 games, where Q ∈ N is the number of secret keys an adversary is allowed to query.

• Game 0 is the original game given in the WIBE security in Figure 4.1.

• Game 1 : is the same as Game 0 except that the challenge ciphertext (c 1 , c 2 ) for challenge plaintexts (m 0 , m 1 ) and challenge pattern P * is changed into semifunctional form:

s 1 , s 2 , s 3 , t 1 , • • • , t L ← Z p , b ← {0, 1}
, and requires that

P * 1 ̸ = ⋆, c 1 = m b • e(g 1 , g 2 ) αd 0 •d * 0 s 1 , c 2 = g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P * ) d i + L l=1 t l d L+l 1 (4.7) Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 • Game 2-k (k ∈ [Q]): is the same as Game 2-(k-1) (for k = 1, Game 2-(k-1) is Game 1 )
except that the reply to the k-th key queried for P is changed into semi-functional form: α,

{r j } j∈I , {η i , x i } i∈[L] ← Z p , sk P = g αd * 0 + j∈I r j d * j + L l=1 x l d * L+l + L l=1 η l d * 3L+l 2 (4.8)
• Game 3 : is the same as Game 2-Q except that the semi-functional challenge ciphertext (c 1 , c 2 ) for challenge plaintexts (m 0 , m 1 ) and challenge pattern P * is changed into a randomized form:

s ′ 1 , {s i } i∈[L] ← Z p c 1 = m b • e(g 1 , g 2 ) αd 0 •d * 0 s 1 , c 2 = g s ′ 1 d 0 +s 2 d 4L+1 + L i=1 si d i + L l=1 t l d L+l 1 (4.9)
and all the other variables are generated as in Game 2-Q .

Informally, the proof works as explained in Figure 4.13.

•

Step 1: we prove that if an adversary can distinguish Game 0 from Game is the same than the one of an adversary winning Game 3 ; and the latter is equal to 0. This is formalized by Lemma 4.3.17 and Lemma 4.3.18. The original proofs are made in the symmetric pairing settings but they can easily be made in the asymmetric setting by taking elements in the correct group.

Lemma 4.3.14 For any adversary A, there exists a probabilistic adversary B, whose running time is essentially the same as that of A, such that for any security parameter λ, Adv

A (λ) -Adv

(1)

A (λ) = Adv P 1 b B (λ).
Proof 4.3.13 In order to prove lemma 4.3.14, we construct a probabilistic adversary B against Problem 1 bis by using any adversary A in a security game (Game 0 or Game 1 ) as a black box as follows.

INIT: B is given a Problem 1 bis instance (Γ, D, D * , e β,1 , {e i } i∈[n]
).

SETUP: B plays a role of the challenger in the security game against adversary A. She returns pk = (Γ, e(g 1 , g 2

) αd 0 .d * 0 , g d 0 1 , g d 4L+1 1
,

h 1 = g d 1 1 , • • • , h L = g d L 1 ) to A.
KEY QUERY: when a key queried is issued, B answers a correct secret key computed by using D * , i.e. a normal key.

CHALLENGE: when B gets challenge plaintexts m 0 , m 1 and pattern P * (with

P * 1 ̸ = ⋆) from A, B returns (c 1 , c 2 ) such that c 1 = m b • e(g 1 , g 2 ) αd 0 •d * 0 s 1 and c 2 = g s 1 d 0 1 • e β,1 • i∈ - W (P * ),i≥2 e i ,
where e β,1 and e i are from the Problem 1 bis instance, s 1 ← Z p and b ∈ {0, 1}.

GUESS: A outputs a bit b ′ . If b = b ′ , B outputs β ′ = 1. Otherwise, B outputs β ′ = 0.
Let us see that if β = 0, then the distribution of (c 1 , c 2 ) is the same as that in Game 0 . If β = 1, the distribution of (c 1 , c 2 ) is the same as that in Game 1 . If β = 0,

c 2 = g s 1 d 0 1 • e β,1 • i∈ - W (P * ),i≥2 e i = g s 1 d 0 1 • g ωd 1 +γd 4L+1 1 • i∈ - W (P * ),i≥2 g ωb i 1 = g s 1 d 0 +ω i∈ - W (P * ) d i +γd 4L+1 1 .
This is the challenge ciphertext in Game 0 . If β = 1, SETUP: B plays a role of the challenger in the security game against adversary A. She returns pk = (Γ, e(g 1 , g 2 ) αd 0 .d * 0 , g d 0 1 , g

c 2 = g s 1 d 0 1 • e β,1 • i∈ - W (P * ),i≥2
d 4L+1 1
,

h 1 = g d 1 1 , • • • , h L = g d L 1 ) to A.
KEY QUERY: when the s-th key query is issued for predicate P , B answers as follows:

• When 1 ≤ s ≤ k -1, B calculates and answers by using D *

sk P = g αd * 0 + j∈I r j d * j + L l=1 x l d * L+l + L l=1 η l d * 3L+l 2 .
• When s = k, B calculates and answers sk P as follows:

{ξ i ← Z p } i∈I , sk P = g αd * 0 2 • i∈I h * ξ i β,i ,
• When q ≥ k + 1, B answers a correct secret key computed by using D * , i.e. normal key.

CHALLENGE

GUESS: A outputs a bit b ′ . If b = b ′ , B outputs β ′ = 1. Otherwise, B outputs β ′ = 0.
Let us see that if β = 0, then the distribution of challenge (c 1 , c 2 ) and sk P is the same as that in Game 2-(k-1) except with probability 1/p. If β = 1, the distribution of challenge (c 1 , c 2 ) and sk P is the same as that in Game 2-k except with probability 1/p.

We consider the joint distribution of c 2 and sk P . Ciphertext element c 2 is If β = 0, secret key (generated in case s = k) is

c 2 = g s 1 d 0 +s 2 d 4L+1 1 • i∈ - W (P * ) e i = g s 1 d 0 +s 2 d 4L+1 1 • i∈ - W (P * ) g ωd i +τ L j=1 z i,j d L+j 1 = g s 1 d 0 +s 2 d 4L+1 +ω i∈ - W (P * ) d i +τ L j=1 i∈ - W (P * )
sk P = g αd * 0 2 • i∈I h * ξ i β,i = g αd * 0 + i∈I ξ i δd * i + i∈I L j=1 ξ i δ i,j d * 3L+j 2
This is a normal secret key, thus distribution of (c 1 , c 2 ), sk P are as in Game 2-(k-1) (i.e. temporal ciphertext and normal key). If β = 1,

sk P = g αd * 0 2 • i∈I h * ξ i β,i = g αd * 0 + i∈I ξ i δd * i + i∈I L j=1 ξ i u i,j d * L+j + i∈I L j=1 ξ i δ i,j d * 3L+j 2 = g αd * 0 + i∈I ξ i δd * i + L j=1 xj d * L+j + i∈I L j=1 ξ i δ i,j d *
→ y i = ξ i if i ∈ I 0 otherwise for i ∈ [L] and - → x i =    τ if i ∈ - W (P * ) 0 otherwise for i ∈ [L].
Since I ∩ -W (P * ) ̸ = ∅ from condition on keys and challenge ciphertext, coefficients vectors t and x are (pairwise)-independently and uniformly distributed under the condition that -

→ y • - → x ̸ = 0 (from lemma 4.3.15). Since (x 1 , • • • , x l ), (t 1 , • • • , t l ) ← Z L p in Game 2-k , the event that(x , • • • , x l ) • (t 1 , • • • , t l ) =
0 occurs in the game with probability 1/p. Thus this is a temporal 1 secret key, and the distribution of (c 1 , c 2 ), sk P are as in Game 2-k , except with probability 1/p. When β = 0, the advantage of A in the above game is equal to that in Game 2-(k-1) , i.e., Adv

(2-Q) A (λ) = Adv (3)
A (λ).

Proof 4.3.15

To prove lemma 4.3.17, we will show that distribution (pk, sk (j)

j∈[Q] , c 1 , c 2 )
in Game 2-Q and that in Game 3 are equivalent. For that purpose, we define new bases B, B * as follows: we generate randoms

{ξ i,s } i,s∈[L] , {θ i } i=1,•••L and set for i ∈ [L]: b L+i = d L+i - L s=1 ξ i,s d s -θ i d 0 , b * i = d * i + L s=1 ξ s,i d * L+s , b * 0 = d * 0 + L s=1 θ s d * L+s and B = (d 0 , d 1 , • • • , d L , b L+1 , • • • , b 2L , d 2L+1 , • • • , d 4L+1 ), B * = (b * 0 , b * 1 , • • • , b * L , d * L+1 , • • • , d * 2L , d * 2L+1 , • • • , d * 4L+1
). We then easily verify that B and B * are dual orthonormal, and are distributed the same as the original bases, D, D * . Keys and challenge ciphertext ( sk (j)

j∈[Q] , c 1 , c 2 ) in Game 2-Q are expressed over bases D and D * as sk (j) = g αd * 0 + i∈I r (j) i d * i + L l=1 x (j) l d * L+l + L l=1 η (j) l d * 3L+l 2 , c 1 = m b • e(g 1 , g 2 ) αd 0 •d * 0 s 1 , c 2 = g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P * ) d i + L l=1 t l d L+l 1
Then,

sk (j) = g αd * 0 + i∈I r (j) i d * i + L l=1 x (j) l d * L+l + L l=1 η (j) l d * 3L+l 2 Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 = g α(b * 0 - L s=1 θsb * L+s )+ i∈I r (j) i (b * i - L s=1 ξ i,s b * L+s )+ L l=1 x (j) l b * L+l + L l=1 η (j) l b * 3L+l 2 = g αb * 0 + i∈I r (j) i b * i + L l=1 x(j) l b * L+l + L l=1 η (j) l b * 3L+l 2 where x(j) l = -αθ l - i∈I r (j) i ξ i,l + x (j) l for l ∈ [L], which are uniformly, independently distributed since x (j) l ← Z p . c 2 = g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ - W (P * ) d i + L l=1 t l d L+l 1 = g s 1 b 0 +s 2 b 4L+1 +s 3 i∈ - W (P * ) b i + L l=1 t l (b L+l + L s=1 ξ l,s bs+θ l b 0 ) 1 = g b 0 +(s 1 + L l=1 t l θ l )+s 2 b 4L+1 +s 3 i∈ - W (P * ) b i + L l=1 t l L s=1 ξ l,s bs+ L l=1 t l b L+l 1 = g s ′ 1 b 0 +s 2 b 4L+1 + L i=1 si b i + L l=1 t l b L+l 1
where s

′ 1 = s 1 + L l=1 t l θ l and si =        L l=1 t l ξ l,i if i / ∈ - W (P * ) L l=1 t l ξ l,i + s 3 if i ∈ - W (P * ) for k ∈ [L].
which are uniformly, independently distributed since

(t 1 , • • • , t l ) ← Z L p \ {0}, {ξ t,i } ← Z p .
In the light of the adversary's view, both (D, D * ) and (B, B * ) are consistent with public key pk = (Γ, e(g 1 , g 2 ) αd 0 .d * 0 , g d 0 1 , g

d 4L+1 1
,

h 1 = g d 1 1 , • • • , h L = g d L 1
). Therefore, sk (j)

j∈[Q]
and c 2 can be expressed as keys and ciphertext in two ways, in Game 2-Q over bases (D, D * ) and in Game 3 over bases (B, B * ). Thus, Game 2-Q can be conceptually changed to Game 3 . □ Lemma 4.3.18 For any adversary A, Adv

A (λ) = 0.

Proof 4.3.16

The value of b is independent from the adversary's view in Game 3 . Hence, Adv

A (λ) = 0. □ Combining all theses proofs, we obtain that any adversary has no advantage in winning the security game. Adding to these the fact that Problem

Our PPKG-WIBE Scheme

We now present a privacy-preserving key generation WIBE instantiation. Our starting point is the WIBE scheme obtained by the combination of [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF] generic construction of anonymous WIBE from IPE schemes (see Section 4.1.2), and the IPE of Lewko et al. [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF]. Our main contribution here is to find a way to protect the attributes of the user by introducing a privacy-preserving interactive key generation. This is done by using the properties of so-called Dual Pairing Vector Spaces. Our scheme is proven secure in the generic group model, under well-known assumptions, namely Decisional Diffie-Hellman and n-extended Decisional Diffie-Hellman introduced in [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF]. We start with the presentation of the WIBE that we will use as building block.

The Basic WIBE. The basic WIBE we will use for our construction is the one by Abdalla et al. [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF], derived from Lewko et al. IPE [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF]. The latter, for vector of length n, is using dual pairing vector space of dimension 2n + 3, and as we saw in Section 4.1.2, the WIBE for patterns of length L is running the IPE with n = 2L. Therefore the construction presented in Figure 4.14 is using dual pairing vector spaces of length 4L + 3. Here keys and ciphertexts patterns belong to {0, 1, ⋆} L .

• Setup(λ, L): generate an asymmetric bilinear group Γ = (G 1 , G 2 , G T , g 1 , g 2 , e, p) and run Dual(Z 4L+3 p ) to get two dual pairing vector spaces (D, D * ). The master secret key is msk = D * and the public key is pk = (g

d 1 1 , • • • , g d 2L 1 , g d 4L+1 1
, g

d 4L+3 1
). • KeyGen(msk, P ′ ): run ExtendingKeyPattern(P ′ ) to get u, then compute

sk P ′ = g ρ 2L j=1 u j d * j +d * 4L+1 +ηd * 4L+2 2
, where ρ, η ← Z p . • Encrypt(msk, P ): run ExtendingCtPattern(P ) to get v, then compute

c 1 = g δ 1 ( 2L j=1 v j d j )+ξd 4L+1 +δ 2 d 4L+3 1
, and c 2 = m•e(g 1 , g 2 ) ξ , where ξ, δ 1 , δ 2 ∈ Z p are chosen randomly. The ciphertext is ct = (c 1 , c 2 ).

• Decrypt(sk P ′ , ct, P ): the decryption consists in executing the IPE decryption, as c 2 /e(c 1 , sk P ′ ). The following theorem is directly deduced from [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF], which shows that the above WIBE is anonymous if the underlying IPE is payload-hiding and attribute hiding and [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF], which proves that the used IPE is payload-hiding and attribute-hiding under the n-eDDH assumption, where n = 2L in our case.

Theorem 4.3.5 The obtained WIBE is anonymous under the n-eDDH assumption.

For the proof of the above theorem, refer to [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF].

Privacy-preserving key generation: intuition. To obtain a privacy-preserving key generation, one idea could be to send the randomized extended version of a pattern. To do so, we define the algorithm presented in Figure 4.15.

Algorithm 4.3 ExtendingKeyPatternRandomized

Input: key pattern P of length n Output: randomized pattern u of length 2n

1: i ← 1, j ← 1 2: while i ≤ n, j ≤ 2n do 3: if P i ̸ = ⋆ then 4:
u j ← s i and u j+1 ← s i • P i for s i ← Z p 5: However, it does not work since e.g., u j ̸ = 0 ∧ u j+1 = 0 for j an odd number reveals that P j = 0. With the same reasoning one can recover positions of P equals to 1 and the ones equal to ⋆, therefore recover P .

To avoid such problem, we propose to exploit the fact that [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF]'s scheme makes use of dual pairing vector spaces properties, of dimension 2n + 3. More precisely, in [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF]'s scheme, a secret key for a vector ν ∈ Z n p is sk ν = g ρ(

n i=1 ν i d * i )+d * 2n+1 +ηd * 2n+2 2
, where ρ, η ← Z p . Our idea is then to ask the Pattern Audit Center (PAC) to compute

x = 2n i=1 g ρ•u i •d * i 2 = g ρ i∈[2n] u i •d * i 2
where u ∈ Z 2n p is the result of ExtendingKeyPattern(P).

Anaïs Barthoulot | PhD Thesis | University of Limoges

Licence CC BY-NC-ND 3.0 PAC sends the result to the Key Generation Center (KGC).

But this is not enough since if KGC is not honest, it computes x d j for j = 1, • • • , 2n. If u j ̸ = 0 then the result is g 2 , otherwise it is equal to 1, where 1 is the identity element of G 2 . From that, KGC can learn P as for j an odd number, if x d j ̸ = 1 ∧ x d j+1 = 1 it reveals that u j = 10 ∧ u j+1 = 0 thus that P ′ j = 0. With the same kind of reasoning KGC can find positions equal to 1 and those equal to ⋆, therefore she can recover P .

Our second trick is to multiply x with a "security" component t = g

2n j=1 τ j d * j 2
(where τ j ← Z p for j = 1, • • • , 2n). Hence, KGC is no more able to get 1 when computing (x • t) d l for some l ∈ [2n]. But in order to recover its secret key, a user now needs to remove the security component t. To do so she will use a token given by PAC:

t -1 = g - 2n j=1 τ j d * j 2
. By multiplying the value received from KGC with t -1 , the user will get its private key.

However as is, PAC and user can recover from a key query the values g

d * 2n+1 +ηd * 2n+2 2
and forged their own secret key.

To prevent this, we slightly modify the protocol so that KGC chooses ρ. First, user choose a random θ ∈ Z p and gives PAC g θ 2 . The latter sends to KGC (

2n i=1 g u i •d * i 2 • 2n j=1 (g θ 2 ) τ j d * j , t ′ = g 2n j=1 τ j d * j 2
). By raising the first received value to the power ρ and multiplying it by g

d * 4n+1 +ηd * 4n+2 2
, KGC obtain the blind secret key. To recover its secret key, user is using (t ′ ) ρ given by KGC and his knowledge of θ. Our privacy-preserving key generation WIBE scheme. We now detail our privacypreserving key generation WIBE instantiation. From the above, the Setup, Encrypt and Decrypt phases are the same than in Figure 4.14, our full scheme only modifies the key generation process. Following Definition 4.2.1, we need to define the following procedures: UserTemKeyGen(pk), BlindTokenGen(pk, P, tpk user ), BlindKeyGen(pk, msk, bt P ) and KeyExtract(bsk P , tsk user ). Our full scheme is given in Figure 4.16. As in Definition 4.2.1,the name of key generation protocol algorithms that are ran by KGC are written in blue, those ran by user in green and in orange those that are run by PAC.

• Setup(λ, L): generate an asymmetric bilinear group Γ ) and the public key is pk = (g

= (G 1 , G 2 , G T , g 1 , g 2 ,
d 1 1 , • • • , g d 2L 1 , g d 4L+1 1
, g

d 4L+3 1
, g

d * 1 2 , • • • , g d * 2L
2 ). • UserTemKeyGen(pk): generate at random θ ← Z p and compute Θ = g θ 2 . Then define tsk user = θ and tpk user = Θ. The latter is sent to PAC. • BlindTokenGen(pk, P , tpk user ): run ExtendingKeyPattern(P ) to get u, then

compute x = g 2L l=1 u l •d * l 2 , t = Θ 2L l=1 τ l d * l and t ′ = g 2L l=1 τ l d * l 2
where

τ l ← Z p for = 1, • • • , 2L. Set the blind token bt P = (x • t, t ′ ) where x • t = g 2L l=1 u l •d * l +θ 2L l=1 τ l d * l 2
and send it to KGC. • BlindKeyGen(pk, msk, bt P ): pick two randoms ρ, η ← Z p and com-

pute bsk 2 = (t ′ ) ρ = g ρ 2L l=1 τ l d * l 2 and bsk 1 = (x • t) ρ • g d * 4L+1 +ηd * 4L+2 2 = g ρ 2L l=1 u l •d * l +ρθ 2L l=1 τ l d * l +d * 4L+1 +ηd * 4L+2 2
. The blind secret key bsk = (bsk 1 , bsk 2 ) is given to user.

• KeyExtract(bsk, tsk user ): output final secret key:

sk P = bsk 1 • bsk 2 -tskuser = g 2L l=1 u l •d * l +d * 4L+1 +ηd * 4L+2 2 .
• Encrypt(msk, P ): run ExtendingCtPattern(P ) to get v, then compute c 1 =

g δ 1 ( 2L j=1 v j d j )+ξd 4L+1 +δ 2 d 4L+3 1
, and c 2 = m•e(g 1 , g 2 ) ξ , where ξ, δ 1 , δ 2 ∈ Z p are chosen randomly. The ciphertext is ct = (c 1 , c 2 ).

• Decrypt(sk P ′ , ct, P ): the decryption consists in executing the IPE decryption, as c 2 /e(c 1 , sk P ′ ). We prove Theorem 4.3.6 with two games:

• Game 0 is the original WIBE PPKG security game, as in Definition 4.2.2 • Game 1 is as Game 0 with the restriction that the adversary queries only challenge patterns that are different at one position exactly.

The idea of the proof is the following: we first prove that if there exists an adversary that can win Game 1 , then we can build an adversary against DDH in G 2 by using the latter's challenge to build to challenge token. Then we prove that we can build an adversary against Game 1 by using an adversary against Game 0 .

Note 4.3.4

To be able to reduce the privacy-preserving key generation security of our scheme to DDH, we actually need to modify our scheme presented in Figure 4. [START_REF] Baldimtsi | Oblivious Accumulators[END_REF] • TOKEN or KEYQUERY: B can create key for patterns P ′ it chooses or asks A for the associated token. The latter answer with bt P ′ ← BlindTokenGen(pk, P ′ ).

C chooses Γ = (G 1 , G 2 , G T , g 1 , g 2 , g T , p, e),
• CHALLENGE: B chooses P 0 , P 1 such that for all i ∈ [L], i ̸ = j, P 0 i = P 1 i and P 0 j ̸ = P 1 j where j ∈ [L]. We suppose w.l.o.g. that P 0 j = ⋆ and P 1 j = 0. B sends both patterns to A. The latter creates the vector ũ which is equal to vector u output by ExtendingKeyPatternRandomized, except that positions j and j + 1 are removed. Notice that by definition of P 0 , P 1 and by construction ũ is the same for both patterns, and ũ has size equal to 2L -2. A creates the blind token bt P b as follows: it chooses {τ l } l=1,••• ,2L,l̸ =j and sets bt

P b = g 2L-2 l=1 ũl •d * l 2 • (g a 2 ) 2L l=1,l̸ =j τ l d * l • t d * j , g 2L l=1,l̸ =j τ l d * l 2 • (g b 2 ) d * j . It gives bt P b to B.
• TOKEN or KEYQUERY: is the same than the previous TOKEN or KEYQUERY step.

• GUESS: B outputs a bit b ′ to A, who outputs it as its guess.

Anaïs Barthoulot | PhD Thesis | University of Limoges

Licence CC BY-NC-ND 3.0

Analysis: if b ′ = 0, then t = g ab 2 and bt

P b = g 2L-2 l=1 ũl •d * l +a( 2L l=1,l̸ =j τ l d * l +bd * j ) 2 , g 2L l=1,l̸ =j τ l d * l +bd * j 2
. By setting θ = a and τ j = b, we obtain a blind token for the pattern equals to ⋆ at position j and tsk user = g a 2 .

If b ′ = 1, then t = g ab+c 2 and bt = g

2L-2 l=1 ũl •d * l +cd * j +a( 2L l=1,l̸ =j τ l d * l +bd * j ) 2 , g 2L l=1,l̸ =j τ l d * l +bd * j 2
. By setting θ = a, τ j = b and u j = c, we obtain a blind token for the pattern equals to 0 at position j and tsk user = g a 2 . □ Lemma 4.3.20 Game 1 implies Game 0 .

Proof 4.3. [START_REF] Barić | Collision-Free Accumulators and Fail-Stop Signature Schemes Without Trees[END_REF] We prove the contrapositive. Let B be an adversary that breaks PPKG game (Game 0 ) with non negligible advantage. We construct below an adversary A against Game 1 that wins with non negligible advantage. • TOKEN or KEYQUERY: B can create key for patterns P ′ it chooses or ask A for a token associated to the chosen pattern. A asks C for the token. The latter responds with bt P ′ ← BlindTokenGen(pk, P ′ ).

• SETUP: challenger C runs Setup(λ, 1 L ) to get (G 1 , G 2 , G T , g 1 , g 2 ,
• CHALLENGE: A chooses P 0 , P 1 such that for all i ∈ [2L], i ̸ = j, P 0 i = P 1 i and P 0 j ̸ = P 1 j where j ∈ [L]; it sends it to C who chooses b ∈ {0, 1} and creates a token θ P b ← BlindTokenGen(pk, P b ). It sends θ P b to A who sends θ P b and P 0 , P 1 to B.

• TOKEN or KEYQUERY: is the same than the previous TOKEN or KEYQUERY step.

• GUESS: B outputs a bit b ′ to A who outputs it as its guess. □

As B, A have no restriction on the challenge patterns, the simulation is perfect. Thus A wins with a non negligible advantage.

Conclusion of This Chapter

This chapter introduced identity-based encryption with wildcards (WIBE) schemes. Our contributions regarding that primitive is the definition of a stronger security property, call pattern-hiding along with the introduction of a new kind of WIBE: privacy-preserving key generation (ppkg) WIBE. In such scheme, the key generation is replaced by an interactive protocol between three entities such that the entity that creates the key does not learn the pattern associated to key, that is chosen by the entity requiring the key. We also proposes three instantiations of WIBE: one scheme with constant size ciphertext, one pattern-hiding scheme and one privacy-preserving key generation scheme.

It is interesting to notice that in our schemes, adding the pattern-hiding security property is possible only at the cost of an efficiency loose. Indeed while we were able to obtain a WIBE scheme with constant size ciphertext, we were only able to build a pattern-hiding WIBE that has linear ciphertext size. We leave as an open problem the proof that efficient pattern-hiding WIBE schemes are possible, and if applicable such a construction. Regarding our privacy-preserving key generation WIBE, we started from an existing WIBE scheme proposed by Abdalla et al. [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF] and transformed it to obtain a privacy-preserving key generation scheme. It might be interesting to find a generic way to transform a WIBE scheme into a PPKG WIBE scheme. In Chapter 6.1 we will see that our pattern-hiding security property is required in order to build a specific data sharing scheme, called augmented broadcast encryption, from a WIBE. Then, we will use our pattern-hiding WIBE instantiation to build such a scheme. We will also use our third instantiation for a specific use case, presented also in Chapter 6.3.

5

Second Cryptographic Tool: Cryptographic Accumulators THE second primitive we used as a building block is called cryptographic accumula- tors. Briefly a cryptographic accumulator is a primitive that allows the representation of a set of values by a short object (the accumulator) and offers the possibility to prove that some input values are in the accumulator. Cryptographic accumulators were introduced in 1993 by Benaloh and De Mare [START_REF] Benaloh | One-Way Accumulators: A Decentralized Alternative to Digital Signatures[END_REF], and since then a lot of new properties, definitions and notations were introduced. For example, originally any modification of the represented set required to recompute the associated accumulator. In 2002, Camenisch and Lysyanskaya [START_REF] Camenisch | Dynamic Accumulators and Application to Efficient Revocation of Anonymous Credentials[END_REF] proposed cryptographic accumulators that support sets modifications, meaning that after a modification of the represented set the accumulator can be updated and does not have to be recomputed. They called this kind of accumulators dynamic and qualified original accumulators as static. We can also cite the property of universal cryptographic accumulators introduced by Li, Li and Xue [START_REF] Li | Universal Accumulators with Efficient Nonmembership Proofs[END_REF] in 2007: such schemes provide as any cryptographic accumulator (called then non-universal) proof of membership, but also proof of non-membership for elements not in the represented set. We start, in Section 5.1.1, by giving a definition of static and universal cryptographic accumulators, along with an up-to-date overview of cryptographic accumulators and state of the art. In Section 5.2 we propose several discussions on accumulators, on the properties of undeniability [START_REF] Lipmaa | Secure Accumulators from Euclidean Rings without Trusted Setup[END_REF] and delegatable [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF] and on accumulators' applications. Then Section 5.3 presents two of our contributions regarding cryptographic accumulators: a new security property for cryptographic accumulator that protects against the forgery of accumulators computed using the scheme's secret key; and the introduction of a new feature for cryptographic accumulators, called dually computable accumulators. We end this chapter with Section 5.4 that presents our two accumulators schemes: the first scheme improves the state of the art by being the first scheme using dual pairing vector spaces and serves as a building block for our second instantiation, which is the first dually computable accumulator.

Cryptographic Accumulators

Definitions

Definition 5.1.1 Static universal accumulator [START_REF] Benaloh | One-Way Accumulators: A Decentralized Alternative to Digital Signatures[END_REF][START_REF] Fazio | Cryptographic Accumulators: Definitions, Constructions and Applications[END_REF][START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF]. A static universal cryptographic accumulator scheme is a tuple of efficient algorithms defined as follows:

• Gen(λ, b): the generation algorithm takes as input a security parameter λ and a bound b ∈ N ∪ {∞} such that if b ̸ = ∞ then the number of elements that can be accumulated is bounded by b. It returns a key pair (sk acc , pk acc ), where sk acc = ∅ if no trapdoor exists and pk acc contains the parameter b. • Eval((sk acc , )pk acc , X ): the evaluation algorithm takes as input the accumulator (secret key sk acc and) public key pk acc and a set X to be accumulated. It returns an accumulator acc X together with some auxiliary information aux. • WitCreate((sk acc , )pk acc , X , acc X , aux, x, Type): the witness creation algorithm takes as input the accumulator (secret key sk acc and) public key pk acc , an accumulator acc X , the associated set X , auxiliary information aux, an element x and a boolean Type. If Type = 0 and x ∈ X it outputs a membership witness mwit X x and if Type = 1 and x / ∈ X it outputs a non-membership witness nmwit X x . • Verify(pk acc , acc X , wit X

x , x, Type): the verification algorithm takes as input the accumulator public key pk acc , an accumulator acc X , a witness wit X

x , an element x and a boolean Type. If wit X x = mwit X x , x ∈ X and Type = 0 it returns 1, if wit X x = nmwit X x , x / ∈ X and Type = 1 it returns 1, otherwise it returns 0. Notation 5.1.1 As one may have notice, membership witnesses are written "mwit" while non-membership witnesses are denoted by "nmwit". When considering general witnesses, i.e. without considering its type, we will write wit. Sometimes when no confusion is possible, we will drop the notation in the exponent of the associated set.

Note 5.1.2 Regarding the way witnesses are generated in WitCreate, the literature gives four possibilities: (i) only using the public key [START_REF] Libert | Functional Commitment Schemes: From Polynomial Commitments to Pairing-Based Accumulators from Simple Assumptions[END_REF], (ii) using the secret key [START_REF] Prasad | Compact Accumulator Using Lattices[END_REF], (iii) using the public key or in a more efficient way using the secret key [START_REF] Ho Au | Dynamic Universal Accumulators for DDH Groups and Their Application to Attribute-Based Anonymous Credential Systems[END_REF][START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF], (iv) using a specially created private key, called the evaluation key [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF]. The evaluation algorithm can take as input either both sk acc and pk acc or only just one. If Eval takes as input sk acc (resp. pk acc ) solely, we say that the accumulator has private evaluation (resp. public evaluation). The same goes for WitCreate: depending on its input the accumulator either has private witness generation or public witness generation.

Some accumulators are trapdoorless meaning that sk acc = ∅.

Definition 5.1.2 Correctness. A static, universal accumulator is said to be correct if for all security parameters λ, all integer b ∈ N ∪ {∞}, all set of values X , and all elements x, y such that x ∈ X and y / ∈ X :

Pr        
(sk acc , pk acc ) ← Gen(λ, b), (acc X , aux) ← Eval((sk acc , )pk acc , X ), mwit X x ← WitCreate((sk acc , )pk acc , acc X , X , aux, x, Type = 0)∧ nmwit X y ← WitCreate((sk acc , )pk acc , acc X , X , aux, x, Type = 1) : Verify(pk acc , acc X , mwit x , x, Type = 0) = 1 ∧Verify(pk acc , acc X , nmwit y , y, Type = 1) = 1

        = 1
Regarding security of cryptographic accumulators, several notions were introduced such as undeniability [START_REF] Lipmaa | Secure Accumulators from Euclidean Rings without Trusted Setup[END_REF], indistinguishability [START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF] or zero-knowledge [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF] for example. We here only formally present the property of collision resistance, but in Section 5.1.2 we give an exhaustive list of all accumulator security properties and an informal definition for all of them. Informally a cryptographic accumulator is said to be collision resistant if it is hard for an adversary to forge a membership (resp. non-membership) witness for an element that is not (resp. that is) in the accumulated set.

Definition 5.1.3 Collision resistance [START_REF] Barić | Collision-Free Accumulators and Fail-Stop Signature Schemes Without Trees[END_REF][START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF]. A static universal accumulator scheme is said to satisfy collision resistance if all PPT adversaries A have at most negligible advantage in the game presented in Figure 5.1, where A's advantage is defined as

Adv CR A (λ) := Pr    Verify(pk acc , acc X * , wit x * , x * , Type = 0) = 1 ∧ x * / ∈ X * ∨Verify(pk acc , acc X * , wit x * , x * , Type = 1) = 1 ∧ x * ∈ X * : (sk acc , pk acc ) ← Gen(λ, b), (X * , wit x * , x * ) ← A(pk acc )   
Let C be a challenger.

Note 5.1.3

If the accumulator is non-universal, then in the above definitions remove the non-membership related parts.

We now give the definition of two properties namely, subset query and multiset setting, that are satisfied by the accumulator schemes we will present in Section 5.4. [START_REF] Dodis | Anonymous Identification in Ad Hoc Groups[END_REF][START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF][START_REF] Libert | Functional Commitment Schemes: From Polynomial Commitments to Pairing-Based Accumulators from Simple Assumptions[END_REF]. A static (non-)universal accumulator is said to satisfy subset query if witnesses can be generated for a subset of the accumu-SETUP: on input λ, C runs Gen(λ) to get (sk acc , pk acc ) and sends pk acc to A. ACCUMULATOR QUERY: A chooses a set X and sends it to C. C returns to A acc X , where acc X ← Eval((sk acc , )pk acc , X ). WITNESSQUERY: A chooses a set X (or an accumulator acc X previously queried),

Definition 5.1.4 Subset query

an element x and a boolean Type and sends all to C. The latter runs WitCreate((sk acc , )pk acc , acc X , X , x, Type) to get wit x and returns it to A. GUESS: A returns a set X * , an element x * and a witness wit x * and wins if Verify(pk acc , acc X * , wit x * , x * , Type = 0) = 1 ∧ x * / ∈ X * or Verify(pk acc , acc X * , wit x * , x * , Type = 1) = 1 ∧ x * ∈ X * . ACCUMULATOR QUERY: A can continue to query accumulator for sets X . WITNESSQUERY: A can continue to query witnesses for elements x. [START_REF] Fauzi | Efficient Non-Interactive Zero Knowledge Arguments for Set Operations[END_REF][START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF][START_REF] Boneh | Batching Techniques for Accumulators with Applications to IOPs and Stateless Blockchains[END_REF]. A static (non-)universal accumulator is said to satisfy multiset setting if sets that can be accumulated are multisets, meaning that an element can be present more than once in the set. In this case, each element is associated to a count (belonging to N) that is equal to 0 when the element is not in accumulated.

Overview And State of The Art

As stated previously, through the years accumulators have been used for multiple purposes. This results in new properties specific to individual needs and is how accumulators became dynamic [START_REF] Camenisch | Dynamic Accumulators and Application to Efficient Revocation of Anonymous Credentials[END_REF], universal [START_REF] Li | Universal Accumulators with Efficient Nonmembership Proofs[END_REF], multisets [START_REF] Fauzi | Efficient Non-Interactive Zero Knowledge Arguments for Set Operations[END_REF] or even the recent property of zero-knowledge [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF], a privacy notion for accumulators. Unfortunately, all these new properties and functionalities were added separately, giving rise to several definitions of accumulators. That makes it complicated to have an overview of accumulators and their properties. That is why in 2015, Derler et al. [START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF] proposed a unified formal model, dealing with most of existing accumulators' properties. Their work became a reference when working with accumulators. However, since 2015 new relevant properties of accumulators have been introduced, such as the zero-knowledge [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF] security property which extends indistinguishability [START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF], or the asynchronous [START_REF] Reyzin | Efficient Asynchronous Accumulators for Distributed PKI[END_REF] property which allows witnesses to be still correct when a fixed number of operations on the accumulated set have been carried out, without needing an update. Some functionalities, such as witnesses computed not for a single element but for a subset, or the multiset setting which allows an element to be accumulated more than once were not taken into account in the work of Derler et al.. In this section we present an up-to-date overview of accumulators properties following Derler et al. definition for accumulators, and an updated state of the art.

All properties presented in this section will be presented for asymmetric accumulators but notice that many of them applied for symmetric accumulators as well. Our choice is motivated by asymmetric accumulator better efficiency (refer to Section 5.2.1 for more details about symmetric accumulators efficiency). We first list the features of accumulators. We do not present correctness, subset query, multiset, and bounded properties as they are formally given in Section 5.1.1.

• Sizes [START_REF] Camenisch | An Accumulator Based on Bilinear Maps and Efficient Revocation for Anonymous Credentials[END_REF]: accumulator and witness sizes should be independent of the number of accumulated elements. • Dynamic [START_REF] Camenisch | Dynamic Accumulators and Application to Efficient Revocation of Anonymous Credentials[END_REF]: an accumulator that additionally provides efficient algorithms (Add, Delete, WitnesUpdate) that respectively adds/removes elements from the accumulated set and the accumulator, and updates the witness accordingly. Notice that Add and Delete also output updated information aux. • Publicly Updatable [START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF]: updates performed without the secret key.

• Universal [START_REF] Li | Universal Accumulators with Efficient Nonmembership Proofs[END_REF]: witnesses can be generated to prove membership or non-membership.

When the accumulator is non-universal, then the witness creation and verification algorithms of Definition 5.1.1 have a new syntax: formally, witness creation algorithm is WitCreate((sk acc , )pk acc , X , acc X , x) and verification algorithm is Verify(pk acc , acc X , x, wit x ). • Delegatable non-membership proofs [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF]: it is possible for a user to give to another entity the ability to prove non-membership of the former's element, without the latter knowing the concerned element. The main idea is to replace the witness by a proof of a proof system, satisfying some properties. • Trusted vs. Non-Trusted Setup [START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF]: in the trusted setup model a trusted third party runs the setup algorithm Gen and discards sk acc afterwards, while in the non-trusted model such trusted third party does not exist. When considering the state of the art it seems most reasonable (regarding the efficiency of the schemes) to define a security model with respect to such trusted setup as [START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF] did and as we will do subsequently. We emphasize that this model is compatible with all existing constructions. • Low Update Frequency [START_REF] Reyzin | Efficient Asynchronous Accumulators for Distributed PKI[END_REF]: the accumulator is dynamic, and witnesses do not have to be updated at each update of the accumulator (for witnesses associated to elements not added or removed of the accumulator). • Old Accumulator Compatibility [START_REF] Reyzin | Efficient Asynchronous Accumulators for Distributed PKI[END_REF]: the accumulator is dynamic, and verification still holds with an updated witness and an old (not updated) accumulator, for an element already present (or not) in the old accumulator.

• Asynchronous [START_REF] Reyzin | Efficient Asynchronous Accumulators for Distributed PKI[END_REF]: the accumulator satisfies both low update frequency and old accumulator compatibility.

• Determinantal [START_REF] Lipmaa | Set (Non-)Membership NIZKs from Determinantal Accumulators[END_REF]: a accumulator with a structure consistent with CLPØ-style ( [START_REF] Couteau | Efficient NIZKs for Algebraic Sets[END_REF]) set (non-)membership non interactive zero knowledge scheme. • Dually computable [START_REF] Barthoulot | Dually Computable Cryptographic Accumulators and Their Application to Attribute Based Encryption[END_REF]: an accumulator with two evaluation algorithms, one that takes as input only the secret key of the scheme while the other takes as input the public key solely. Outputs of both algorithms are distinguishable. This feature is one of our contributions regarding cryptographic accumulators and we present it more in details in Section 5.3.

We now give all security properties that could be found in the literature. The basic property of a secure cryptographic accumulator is the impossibility for an adversary to prove that a value is accumulated while this is not the case. This property, known as collision resistance is formally given in Definition 5.1.3 therefore we do not present it again here. Based on that, several definitions have been proposed in the literature and we discuss all of them in the case of dynamic and universal accumulators.

• One-Wayness [START_REF] Benaloh | One-Way Accumulators: A Decentralized Alternative to Digital Signatures[END_REF]: it is hard for an adversary who is given a set X = (x 1 , • • • , x N ), their accumulation result acc X , and another value x ′ / ∈ X (resp. x ′ ∈ X ) to output a value wit ′ such that Verify(pk acc , acc X , x ′ , wit ′ , 0) = 1 (resp. Verify( pk acc , acc X , x ′ , wit ′ , 1) = 1). • Strong One-Wayness [START_REF] Barić | Collision-Free Accumulators and Fail-Stop Signature Schemes Without Trees[END_REF]: given X = (x 1 , • • • , x N ) and acc, it is hard for an adversary to output x ′ / ∈ X (resp. x ′ ∈ X ) and wit ′ such that Verify(pk acc , acc X , x ′ , wit ′ , 0) = 1 (resp. Verify(pk acc , acc X , x ′ , wit ′ , 1) = 1).

• Undeniability [START_REF] Lipmaa | Secure Accumulators from Euclidean Rings without Trusted Setup[END_REF]: it is hard for an adversary to output an accumulator acc, a value x ′ and two witnesses wit ′ and wit ′′ such that both Verify(pk acc , acc X , x ′ , wit ′ , 0) = 1 and Verify(pk acc , acc X , x ′ , wit ′′ , 1) = 1) hold. • One-Way-Domain [START_REF] Dodis | Anonymous Identification in Ad Hoc Groups[END_REF]: the accumulator is collision resistant, and the set of values that can be accumulated is the span of a one-way function. Hence, it is computationally intractable to find witnesses for random values in the accumulator's domain.

• Indistinguishability [START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF]: given the public key, the adversary chooses two sets X 0 and X 1 and obtain the evaluation of one of the two. It has to decide which one. • Zero-knowledge accumulator [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF]: accumulated value, and (non-)membership witnesses leak nothing about the accumulated set at any given point in the security game (even after insertions and deletions, if the accumulator is dynamic). • Element hiding [START_REF] Baldimtsi | Oblivious Accumulators[END_REF]: publicly available auxiliary information aux output by update algorithms (Add or Delete) and associated to an accumulator does not lead any information about the elements in the accumulated set.

• Add-Del indistinguishability [START_REF] Baldimtsi | Oblivious Accumulators[END_REF]: no adversary given publicly available information aux output by update algorithms (Add or Delete) can learn if an operation is an addition or a deletion. • Obliviousness [START_REF] Baldimtsi | Oblivious Accumulators[END_REF]: when both element hiding and Add-Del indistinguishability hold.

Note 5.1.4 Some works [START_REF] Camenisch | Dynamic Accumulators and Application to Efficient Revocation of Anonymous Credentials[END_REF][START_REF] Nguyen | Accumulators from Bilinear Pairings and Applications[END_REF][START_REF] Ho Au | Dynamic Universal Accumulators for DDH Groups and Their Application to Attribute-Based Anonymous Credential Systems[END_REF][START_REF] Li | An Identity-Based Signcryption Scheme for Multi-domain Ad Hoc Networks[END_REF] complete cryptographic accumulator with zero-knowledge proof-of-knowledge protocols: a client that knows his value x is (or is not) in X , can efficiently prove to a third-party that his value is (resp. is not) in the set, without revealing x. This privacy notion is different from the one we will focus on, zero-knowledge notion of [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF] in which the entire protocol execution (as observed by a curious client or an external attacker) leaks nothing.

In Table 5.1, we present a comparison of existing constructions for accumulators. We present them according to the four categories we have previously seen, and compare them with respect to the different properties and functionalities that they provide.

Note 5.1.5 When doing the state of the art we noticed something surprising: there is no accumulator scheme with private evaluation (meaning that Eval takes as input sk acc ) and public witness generation (meaning that WitCreate takes as input only pk acc ). Indeed, either both evaluation and witness creation are either public [START_REF] Libert | Functional Commitment Schemes: From Polynomial Commitments to Pairing-Based Accumulators from Simple Assumptions[END_REF] or private [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF], or witness generation is private while evaluation is public [START_REF] Prasad | Compact Accumulator Using Lattices[END_REF]. We summarize in Table 5.2 how evaluation and witness generation are done, depending on the type of accumulator scheme.

In Section 5.4.1 we present a pairing based accumulator scheme that has private evaluation and public witness generation, filling the above gap in accumulators state of the art.

Discussions on Accumulators

In the accumulators literature, it is admitted without formal proof that symmetric accumulators cannot have a size less than linear in the number of accumulated elements. In this section we formally define symmetric accumulators and prove the lower bound on their size. Additionally we propose some discussions about relations between accumulators security, about undeniability [START_REF] Lipmaa | Secure Accumulators from Euclidean Rings without Trusted Setup[END_REF] and delegatable [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF] properties. We complete this section with a discussion on future possible applications of accumulators, following our new usage of cryptographic accumulators for encryption that we present more in details in Section 6.2.

[35] Public √ √ √ √ T √ √ √ √

Symmetric Accumulators

Informally, an asymmetric accumulator requires witness for verification, while a symmetric accumulator does not require a witness for verification [START_REF] Kumar | Performances of Cryptographic Accumulators[END_REF][START_REF] Ozcelik | An Overview of Cryptographic Accumulators[END_REF] (and is mostly trapdoor-less meaning that sk acc = ∅). The two types of accumulators were formally named in [START_REF] Kumar | Performances of Cryptographic Accumulators[END_REF]. In this section we fill a gap in the accumulator literature: while it was admit that symmetric accumulators constructions produce large size accumulated value, this has never been properly prove. We first formally define symmetric accumulator and then prove that their size cannot be less than linear in the number of accumulated elements.

Definition 5.2.1 Symmetric cryptographic accumulator [START_REF] Benaloh | One-Way Accumulators: A Decentralized Alternative to Digital Signatures[END_REF]. A symmetric cryptographic accumulator scheme consists in three algorithms:

• Gen(λ): the generation algorithm takes as input a security parameter λ and outputs a pair of public-secret keys (pk acc , sk acc ). • Eval((sk acc ), pk acc , X ): the evaluation algorithm takes as input a (secret key sk acc , a) public key pk acc and a set of elements X . It outputs the accumulator acc X of X . • Verify(pk acc , acc X , x): the verification algorithm takes as input a public key pk acc , an accumulator acc X and an element x. It outputs 1 if x ∈ X , and 0 otherwise.

Definition 5.2.2 Correctness.

A symmetric cryptographic accumulator scheme is said to be correct if for all security parameter λ, every honestly generated key pair (sk acc , pk acc ) ← Gen(λ), every set of elements X and every element x ∈ X :

Pr [Verify(pk acc , Eval((sk acc , )pk acc , X ), x) = 1] = 1. [START_REF] Benaloh | One-Way Accumulators: A Decentralized Alternative to Digital Signatures[END_REF]. A symmetric accumulator scheme is said to be one-way if all PPT adversaries A have at most negligible advantage in the game presented in Figure 5.2, where A's advantage is defined as

Definition 5.2.3 Symmetric accumulator one-wayness

Adv One-Way A (λ) := Pr    acc X * = acc X ∧ X ̸ = X * X * ← A(pk acc , X , acc X ) : acc X ← Eval(sk acc , pk acc , X ) acc X * ← Eval(sk acc , pk acc , X * )    .
Let C be a challenger.

Anaïs Barthoulot | PhD Thesis | University of Limoges

Licence CC BY-NC-ND 3.0 SETUP: on input λ, C runs Gen(λ) to get (sk acc , pk acc ). She chooses a set of elements X , runs Eval(sk acc , pk acc , X ) to get acc X and sends (pk acc , X , acc X ) to A. GUESS: A returns a set X * and wins if X * ̸ = X and acc X * = acc X where acc X * ← Eval(sk acc , pk acc , X * ). Let X be a random variable over D. X is uniformly distributed over D, thus as |D| = 2 N we have that the entropy H(X) is equal to log 2 (2 N ) = N . Suppose that there exists an accumulator that accumulated X into a short value, i.e. a value with size less than linear in N . Then, as the minimal amount of information needed to represent X is H(X) = N , there exists two sets (i.e. two values of X) that have the same accumulated value thanks to the pigeonhole principle. Thus the accumulator is not one-way.□

Relations Between Security Properties

When looking at accumulators' security properties we can classify them into two categories: one that protects the witness (i.e. that prevents forgery of witnesses), and one that protects the accumulated set (i.e. that hides information about the set). We present this classification in Table 5.3.

Protect the witness Protect the accumulated set (Strong) One-wayness Indistinguishability Collision resistance

Zero knowledge One-way domain Obliviousness Undeniability Plus we notice that the properties in the first column are computational ones while in the second column they are decisional. Note 5.2.1 Properties that protect the accumulated set define privacy security for accumulators schemes. As already observed in [START_REF] De Meer | Indistinguishability of one-way accumulators[END_REF][START_REF] Hermann De Meer | Redactable Signature Schemes for Trees with Signer-Controlled Non-Leaf-Redactions[END_REF][START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF], when formulating a notion of privacy for cryptographic accumulators the fact that the accumulation value computation must be randomized becomes evident.

Comparison between indistinguishability and zero-knowledge. The notion of zeroknowledge differs from the privacy notion of [START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF], by protecting not only the originally accumulated set but also all subsequent updates. In fact, [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF] formally proved that, for cryptographic accumulators, zero-knowledge is a strictly stronger property than indistinguishability. In other words: every zero-knowledge dynamic universal accumulator is also indistinguishable under the definition of [START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF], while the opposite is not always true.

Comparison between zero-knowledge and obliviousness. While being really similar at first glance, both properties are actually different in the sense that they require that different elements protect the information about the set: on one hand, a zero-knowledge adversary is given accumulators and witnesses while on the other hand an oblivious adversary is given accumulators and update information.

Therefore there is no relation between zero-knowledge and obliviousness.

Relations between other properties

At first, as the adversary is given more and more flexibility, it is easy to see that the following holds: One-Way Domain =⇒ Collision Resistance =⇒ Strong One-Wayness =⇒ One-Wayness, while the opposite is not true.

Regarding undeniability, it has been proven in Appendix C.1 of [START_REF] Derler | Revisiting Cryptographic Accumulators, Additional Properties and Relations to Other Primitives[END_REF] that every undeniable universal accumulator is collision-resistant. As mentioned in [START_REF] Lipmaa | Secure Accumulators from Euclidean Rings without Trusted Setup[END_REF], a black-box reduction in the other direction is impossible. In particular, [START_REF] Buldas | Eliminating Counterevidence with Applications to Accountable Certificate Management[END_REF] provides a collision-resistant universal accumulator and exhibit an example to show that their scheme is not undeniable.

It remains to make the link between undeniability and one-way domain. At first, we focus on the scheme based on sorted hash tree given in [START_REF] Buldas | Eliminating Counterevidence with Applications to Accountable Certificate Management[END_REF]. This one is proven to be universal and collision resistant, and as state before it is not undeniable. It can moreover be used for domain that is in the span of a one-way function. Hence, one-way domain does not imply undeniability. For the opposite, we do not succeed in proving that this is true or false, and we leave it as an open problem.

In Figure 5.3, we summarize all the above properties and their relation, based on related work, but also on our new results. In the figure an arrow means "implies", a crossed out arrow means "does not imply" and a dash arrow means "not proven". Notice that as there is no relation between obliviousness and other properties we do not include the former in the figure.

Discussion About Undeniability

As explained in Section 5.1.2, there are usually three cases regarding the setup: schemes without a trapdoor key, schemes with a trapdoor key without a trusted setup, and eventually schemes with a trapdoor key and a trusted setup. We also need to take into account the fact that the accumulated value can be computed publicly (without knowing the trapdoor) or privately.

In the trapdoor-less setting, as anyone can compute an accumulator, undeniability is a required property. Indeed, an adversary can compute itself an accumulator while the set of pre-image is not none, and not necessarily unique. In the trapdoor setting, when the accumulated value can be computed publicly, or when the setup is in the no-trusted setting, undeniability is needed as any adversary can compute its own (possibly fake) accumulated value. We now focus on the trusted setup setting, and prove, as state in [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF], that this is an overkill in terms of security.

In the undeniability security game, when adversary can compute itself accumulated value (or if the setup is untrusted), there is no distinction to make between x * ∈ X * or x * / ∈ X * . However, when the only way for the adversary A to compute acc * is to request the challenger by giving a set X * we need to consider both cases:

• If x * ∈ X * , then Verify(pk acc , acc * , x * , wit x * , 0) = 1 by definition. To win the game, A must find a non-membership witness wit ′

x * such that Verify(pk acc , acc * , x * , wit ′

x * , 1) = 1. This means that A wins the undeniability game if it wins the collision resistant game.

• If x * / ∈ X * , then Verify(pk acc , acc * , x * , wit ′

x * , 1) = 1 by definition. To win the game, A must find a membership witness such that Verify(pk acc , acc * , x * wit x * , 0) = 1. That means that A wins the undeniability game if it wins the collision resistance game. In both cases, collision-resistance is enough, and then undeniability is not required.

Discussion About Delegatable Accumulators

To the best of our knowledge, only one accumulator provides delegatable non-membership proofs: [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF]. For their purpose they only consider the delegatable capability for nonmembership proofs but it can be defined for membership proofs as well, and will consider both cases in this section. Our goal here is to find a generic way to build accumulators schemes with delegation of proofs.

Accumulators and proof systems. To understand [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF]'s construction, let us have a look at their definition of accumulators, given in the extended version of their paper [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF]. In their definition an accumulator is constructed from another primitive, called a proof system. Briefly, such primitive is a protocol between a prover and a verifier where an honest prover can convince a verifier about the truth of a statement with the help of a witness, while an adversary cannot convince a verifier of a false statement. The formal definition of proof systems is given below. [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF]. Let R be an efficiently computable relation of (Para, Sta, Wit) with setup parameters Para, a statement Sta, and a witness Wit. A non-interactive proof system for R consists of 3 PPT algorithms: a Setup, a prover Prove, and a verifier Verify. A non-interactive proof system (Setup, Prove, Verify) must be complete and sound. Completeness means that for every PPT adversary A, We now give two properties of proof systems that we will need in the rest of this section. Definition 5.2.6 Randomizable proof system [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF]. A proof system is said to be randomizable if has another PPT algorithm RandProof that takes as input a tuple (Para, Sta, Proof) of setup parameters Para, statement Sta and proof Proof and returns another valid proof Proof ′ , which is indistinguishable from a proof produced by Prove.

Definition 5.2.4 Proof System

In [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF][START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF] accumulators are universal as the authors require non-membership proofs to build delegatable anonymous credentials. According to their definition, a universal accumulator is composed of a setup algorithm Setup that defines all parameters of the accumulator scheme, an evaluation algorithm Accu that aggregates a large size set of values into a constant size value (the accumulator), a membership proof system (Setup, ProveMem, VerifyMem) that proves membership of elements given as input, and a non-membership proof system (Setup, ProveNM, VerifyNM) that proves non-membership of elements given as input. In their definition there are also two other PPT algorithms CompMemWit and CompNMWit that take as input the scheme public key, the accumulated set along with its accumulator and an element, and return respectively a witness for membership and non-membership proof for the given element. As we will see in the next paragraph, proof systems' properties are essential to obtain • Eval((sk acc , )pk acc , X ): this evaluation algorithm takes as input the accumulator (secret key sk acc and) public key pk acc and a set X to be accumulated. It returns an accumulator acc X together with some auxiliary information aux. • WitCreate((sk acc , )pk acc , X , acc X , aux, x, Type): this witness creation algorithm takes as input the accumulator (secret key sk acc and) public key pk acc , an accumulator acc X , the associated set X , auxiliary information aux, an element x and a boolean Type. If Type = 0 and x ∈ X it runs CompMemWit(pk acc , X , acc X , x) to get a membership witness mwit X x and returns it, if Type = 1 and x / ∈ X it run CompNMWit(pk acc , X , acc X , x) to get a non-membership witness nmwit X

x and returns it.

• Verify(pk acc , acc X , wit X

x , x, Type): this verification algorithm takes as input the accumulator public key pk acc , an accumulator acc X , a witness wit X

x , an element x and a boolean Type. If wit X x = mwit X x , and Type = 0 it runs ProveMem(pk acc , acc X , mwit X x ) to get ProofMem and returns the output of VerifyMem(pk acc , accX , ProofMem).

If wit X

x = nmwit X x , and Type = 1 it runs ProveNM(pk acc , acc X , nmwit X x ) to get ProofNM and returns the output of VerifyNM(pk acc , accX , ProofNM). Otherwise it returns 0.

In the sequel we will refer to accumulators in the sense of Definition 5.2.7.

Delegatable (non-)membership proofs. Now we formally define the delegatable proofs property, adapted from [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF] and for both membership and non-membership proofs. In the following, D denotes the space of values to be accumulated. Definition 5.2.8 Delegatable proofs . An accumulator allows delegatable proofs if it additionally provides the following algorithms.

• Dele(pk acc , x, Type): the delegation algorithm takes as input the public key pk acc , an element x and boolean parameter Type. It outputs a delegating key Del y and auxiliary information req = Type. • Vali(pk acc , Del y , req): the validation algorithm takes as input the public key pk acc , a delegating key Del y and auxiliary information req. If Del y is valid it returns 1, otherwise it returns 0. • Rede(pk acc , Del y , req): the re-delegation algorithm takes as input the public key pk acc , a delegating key Del y and auxiliary information req. If Vali(pk acc , Del y , req) = 1, the algorithm returns an other delegating key Del ′

x and auxiliary information req. • CompProof(pk acc , Del y , req, X , acc X ): the proof computation algorithm takes as input the public key pk acc , a delegating key Del y and auxiliary information req, a set X and the associated accumulated value acc X . If x, X |= req it returns a proof (similar to those output by ProveMem and ProveNM) according to req, X and x.

These algorithms verify, for every PPT algorithms A, A 1 , A 2 :

• Delegability: the following is negligible

Pr                
(sk acc , pk acc ) ← Gen(λ); (x, Type, X ) ← A 1 (pk acc ); acc X ← Eval(pk acc , X ); wit x ← WitCreate(pk acc , X , acc X , x, Type); Proof 0 ← Prove(pk acc , acc X , aux, wit x );

(Del y , req) ← Dele(pk acc , x, Type);

Proof 1 ← CompProof(pk acc , Del y , req, X , acc X ); b ← {0, 1} ; b ′ ← A 2 (acc X , wit x , Del y , Proof b ) : (x, X |= req) ∧ b = b ′                 - 1 2
• Unlinkability: the following is negligible

Pr              (sk
= b ′              - 1
) : b = b ′            - 1 2
• Verifiability: the following is negligible Delegatable (non-)membership proofs and proof systems. Let us see that the additional algorithms Dele, Rede, Vali, CompProof required to obtain an accumulator with delegatable (non-)membership proofs can be rewrite to highlight the underlying proof systems algorithms. As we are dealing with both kinds of proofs, we use (Setup, Prove, PSVerify) to denote a general proof system, representing either the membership or the non-membership proof system. The output of Prove is denoted Proof. The setup algorithm Setup of the proof system is run by the accumulator generation algorithm Gen thus Para the setup parameters of the proof system are included in pk acc . Let the proof system be randomizable, i.e. it has another algorithm RandProof that takes as input a proof and outputs a randomized one.

• Dele(pk acc , x, Type) : the algorithm creates a proof system statement Sta from the public parameters, a proof system witness Wit for x, Type and computes a proof system proof Proof 0 from Prove(Para, Sta, Wit x , computed from and from the underlying witness x and the new statement Sta ′ , corresponding to X and acc X .

We now prove that Unlinkability, Redelegability and Verifiability properties are satisfied if the underlying proof system is witness indistinguishable and randomizable.

Lemma 5.2.1 Unlinkability is satisfied thanks to the witness indistinguishability property of the (non-)membership proof system.

Proof 5.2.2

We rewrite the unlinkability property, using the (non-)membership proof system, which gives us:

Pr            (sk acc , pk acc ) ← Gen(1λ); (Wit 0 , Wit 1 ) ← D; Sta ← A, Proof 0 ← Prove(pk acc , Wit 0 , Sta); b ← {0, 1} ; Proof b ← Prove(pk acc , Wit b , Sta); b ′ ← A(pk acc , Proof 0 , Proof b ) : b = b ′           
This corresponds to the probability in the witness indistinguishability security game of the (non-)membership proof system, which is negligible. Thus, so is the probability defined in Unlinkability. □ Lemma 5.2.2 Redelegability is satisfied thanks to the randomizable property of the (non-)membership proof system.

Proof 5.2.3

We rewrite the redelegability property, using the (non-)membership proof system's algorithms, which gives us

Pr              (sk acc , pk acc ) ← Gen(λ); Sta, Wit ← A 1 (pk acc ); Proof ← Prove(pk acc , Wit, Sta); Proof 0 ← Prove(pk acc , Wit, Sta); Proof 1 ← RandProof(pk acc , Sta, Proof); b ← {0, 1} ; b ′ ← A 2 (pk acc , Proof, Proof b ) : b = b ′             
This corresponds to the probability in the randomized security game of the (non-)membership proof system, which is negligible. Thus, so is the probability defined in Redelegability. □ Lemma 5.2.3 Verifiability is satisfied thanks to the completeness and soundness of the (non-)membership proof system.

Proof 5.2. 4 We rewrite the verifiability property, using the (non-)membership proof system's algorithms, which gives us This corresponds to the soundness probability of the proof system, and is overwhelming. Thus so is the second probability of Verifiability. □ Note 5.2.2 In [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF], they proved that their accumulator satisfies unlinkability as they used a composable ZK proof system. Actually, only witness indistinguishability is required.

How to obtain delegability? The witness indistinguishability and randomizable property of proof systems are not enough to obtain an accumulator with delegatable (non-)membership proof as delegability cannot be proven. To solve this issue, [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF] uses a primitive they introduced: homomorphic proofs.

Definition 5.2.9 Homomorphic proofs [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF]. Let (PSSetup, Prove, PSVerify) be a proof system for a relation R and Para ← PSSetup(λ). Consider a subset Π of all (Sta, Wit, Proof) such that (Para, Sta, Wit) ∈ R and PSVerify(Para, Sta, Proof) = 1, and an operation + Π : Π × Π → Π. Π is a set of homomorphic proofs if (Π, + Π ) satisfies closure, associativity and commutativity. Consider an I Π = (Sta 0 , Wit 0 , Proof 0 ) ∈ Π. Π is a set of strongly homomorphic proofs if (Π, + Π , I Π ) forms an Abelian group where I Π is the identity element.

Note 5.2.3

As stated in [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF], one can randomize a proof computed from the homomorphic operation to get another proof, indistinguishable from a proof generated by Prove.

Lemma 5.2.4

Delegability is satisfied thanks to the homomorphic proofs and the randomizable property of the (non-)membership proof system.

Proof 5.2. [START_REF] Abe | Blind Key-Generation Attribute-Based Encryption for General Predicates[END_REF] We rewrite the delegability property, using the (non-)membership proof system which gives us:

Pr              (sk acc , pk acc ) ← Gen(λ); (Sta 0 , Sta, Wit) ← A 1 (pk acc ); Proof 0 ← Prove(pk acc , Sta, Wit); Proof ← Prove(pk acc , Sta 0 , Wit); Proof 1 ← RandProof(pk acc , + Π (Proof)); b ← {0, 1} ; b ′ ← A 2 (Sta, Wit, Proof, Proof b ) : (Sta, Wit, Proof b ) ∈ R ∧ b = b ′             
Thanks to the homomorphic proofs and randomizable property of the (non-)membership proof system, this probability is negligible, so is the probability in Delegability. □

Conclusion.

Combining the above paragraphs we obtain the following theorem.

Theorem 5.2.2 If the membership (resp. non-membership) proof system is witness indistinguishable, randomizable and has homomorphic proofs then the accumulator satisfies Delegability, Unlinkability, Redelegability and Verifiability for membership (resp. non-membership) proofs.

Therefore we can conclude with the following way to obtain an accumulator with delegatable (non-)membership proofs:

1. Find the underlying (non-)membership prove system 2. If the proof system is not witness indistinguishable or randomizable or does not have homomorphic proofs, change it to obtain the required properties.

Applying the above on an example. We tried to apply the above transformation to the accumulator scheme of [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF]. To do so, we used Groth Sahai (GS) proof system [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF] as, as proven by [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF], GS proof system [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF] satisfies all required properties to obtain a delegatable accumulator (i.e. it produces homomorphic proofs). Thus finding the correct GS statement for membership will lead to delegatable membership proofs, and the same goes for non-membership proofs. Unfortunately we were only able to obtain delegation for membership proofs but not for non-membership proofs. We leave this question as an open problem.

Discussion on Accumulator Applications

Originally, accumulators were used for timestamping and membership testing [START_REF] Benaloh | One-Way Accumulators: A Decentralized Alternative to Digital Signatures[END_REF] but over time their usage become multiple: fail stop signatures [START_REF] Barić | Collision-Free Accumulators and Fail-Stop Signature Schemes Without Trees[END_REF], membership revocation in group signature [START_REF] Camenisch | Dynamic Accumulators and Application to Efficient Revocation of Anonymous Credentials[END_REF], ID based ring signatures [START_REF] Nguyen | Accumulators from Bilinear Pairings and Applications[END_REF], anonymous credentials (delegatable) [START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF] or attribute-based anonymous credentials [START_REF] Ho Au | Dynamic Universal Accumulators for DDH Groups and Their Application to Attribute-Based Anonymous Credential Systems[END_REF]), distributed public key infrastructure [START_REF] Reyzin | Efficient Asynchronous Accumulators for Distributed PKI[END_REF], e-cash [START_REF] Ho Au | Compact E-Cash from Bounded Accumulator[END_REF]. Refer to several surveys on a cryptographic accumulator, such as [START_REF] Ren | Cryptographic Accumulator and Its Application: A Survey[END_REF], for details on accumulators' applications.

We wanted to draw attention on one surprising thing: while the purpose of cryptographic accumulators is to make constant the size of cryptographic objects, few attempts have been done to use them for encryption schemes, such as [START_REF] Asano | A Revocation Scheme with Minimal Storage at Receivers[END_REF][START_REF] Gentry | RSA Accumulator-Based Broadcast Encryption[END_REF][START_REF] Wang | Cross-Domain Access Control Encryption: Arbitrary-policy, Constant-size, Efficient[END_REF]. The works of [START_REF] Gentry | RSA Accumulator-Based Broadcast Encryption[END_REF][START_REF] Asano | A Revocation Scheme with Minimal Storage at Receivers[END_REF] propose broadcast encryption schemes that use (RSA based) cryptographic accumulator, to manage users' secret keys: let N ∈ N be the number of users in the broadcast encryption scheme. For an index i ∈ [N ], a secret key is created for each subset of [N ] that contains i and the secret key of user identified by index i is an accumulator of the secret keys created for the subsets. To decrypt a message, user "extract" (with a process similar to the generation of a witness) the secret key corresponding to the subset associated to the ciphertext. More recently, Wang and Chow [START_REF] Wang | Cross-Domain Access Control Encryption: Arbitrary-policy, Constant-size, Efficient[END_REF] present an identity-based broadcast encryption scheme that uses a degenerated notion of accumulators, composed only of algorithms Gen and Eval. In their scheme, the evaluation algorithm Eval is used during encryption to hide some randomness (the latter being used to mask the message) and the compactness of its output is required for the scheme efficiency. However they do not take into account the other functionality of cryptographic accumulators, the efficient membership proof, in their scheme. Also notice that some works propose to use accumulators to add revocation functionality previously existing encryption scheme, such as [START_REF] Jia | Efficient revocable hierarchical identity-based encryption using cryptographic accumulators[END_REF] who adds revocation to Lewko and Water's hierarchical identity-based encryption scheme [START_REF] Lewko | Unbounded HIBE and Attribute-Based Encryption[END_REF].

In Section 6.2 we proposed an encryption scheme that uses cryptographic accumulator for both key management and encryption. While our scheme suffers from large public key size, it opens a door to a new field of works that build encryption scheme from accumulator.

Our Contributions to Accumulators' Formalism

We now present two of our contributions regarding cryptographic accumulators with private evaluation and public witness generation. The first one is a new security property, called unforgeability of private evaluation, that protects the accumulator itself when the latter is computed using the secret key of the scheme. Our second contribution is a new kind of accumulators, called dually computable accumulators, that has two evaluation algorithms: Eval that takes as input the secret key of the scheme, and PublicEval that takes as input the public key of the scheme.

New Security Property of Unforgeability of Private Evaluation

Surprisingly when looking at all security properties presented in Sections 5.1.2 and 5.2.2 we notice that there is no property that protect the accumulator itself, especially when the latter computation requires the knowledge of the scheme's secret key. In the undeniability property the accumulator might be forged but only in order to help forging both membership and non-membership witnesses for the same element. In some applications, the accumulator itself can be an important data to protect: for example when the accumulator represents a revocation list, having a property proving that only the trusted authority can compute this revocation list will improve the general security of the protocol. This is an important gap in cryptographic accumulator schemes security.

We fill this gap by providing the following property that states that it must be hard to "forge" a privately computed accumulator that passes the verification algorithm with an honestly computed witness.

Definition 5.3.1 Unforgeability of private evaluation (UPE

). An accumulator scheme with private evaluation is said to satisfy unforgeability of private evaluation if all PPT adversaries A have at most negligible advantage in the game presented in Figure 5.5, where A's advantage is defined as

Adv UPE A (λ) := Pr        
Verify(pk acc , acc * , x, wit x ) = 1 :

(sk acc , pk acc ) ← Gen(λ), (X * , acc * ) ← A(pk acc );

acc X * ← Eval(sk acc , X * ), x ← X * ; wit x ← WitCreate(pk acc , acc X * , X * , x)         .
Let C be a challenger. SETUP: on input λ, C runs Gen(λ) to get (sk acc , pk acc ) and sends pk acc to A. GUESS: A returns a set X * and a forged accumulator acc * and wins if for any x ∈ X * , Verify(pk acc , acc * , x, wit x ) = 1 where wit x ← WitCreate(pk acc , acc X * , X * , x) and acc X * ← Eval(sk acc , X * ).

Introducing Dually Computable Accumulators

We now introduce a new functionality for accumulators with private evaluation and public witness generation: dually computable. Informally, a dually computable accumulator is a cryptographic accumulator scheme with an additional evaluation algorithm PublicEval that uses solely the scheme public key.

Definition 5.3.2 Dually computable accumulator.

Starting from a static, universal accumulator Acc = (Gen, Eval, WitCreate, Verify), we say that Acc is dually computable if it also provides two algorithms PublicEval and PublicVerify such that:

• PublicEval(pk acc , X ): this evaluation algorithm takes as input the accumulator public key pk acc and a set X . It outputs an accumulator accp X of X and auxiliary information auxp. • PublicVerify(pk acc , accp X , wit x , x, Type): this verification algorithm takes as input the accumulator public key pk acc , a publicly computed accumulator accp X of X , an element x, a witness wit x for x and boolean Type, computed from WitCreate(pk acc , X , accp X , auxp, x, Type). If wit x is a correct membership witness ( i.e. x ∈ X ) and Type = 0, or if wit x is a correct non-membership witness ( i.e.

x / ∈ X ) and Type = 1 then the algorithm outputs 1, otherwise it outputs 0.

Note 5.3.1

When the algorithm WitCreate is run with a publicly computed accumulator (accp) instead of a privately computed one(acc), the output witness will be written witp.

A dually computable accumulator must satisfy four properties: correctness and dual collision resistance as any cryptographic accumulator, correctness of duality and distinguishability two properties that we introduced. In the correctness and collision resistance definitions, we highlight in blue the parts related to PublicEval and PublicVerify. Without these parts, the definitions are exactly as Definitions 5.1.2 and 5.1.3.

Definition 5.3.3 Correctness.

A dually computable accumulator is said to be correct if for all security parameters λ, all integer b ∈ N ∪ {∞}, all set of values X , all boolean type and all element x such that if Type = 0 then x ∈ X and if Type = 1 then x / ∈ X the following holds

Pr             
(sk acc , pk acc ) ← Gen(λ, b), (acc X , aux) ← Eval(sk acc , pk acc , X ), (accp X , auxp) ← PublicEval(pk acc , X ), wit x ← WitCreate(pk acc , X , acc X , aux, x, Type), witp x ← WitCreate(pk acc , X , accp X , auxp, x, Type) :

Verify(pk acc , acc X , wit x , x, Type) = 1 ∧PublicVerify(pk acc , accp X , witp x , x, Type) = 1

             = 1
The following property states that a witness computed for a privately (resp. publicly) computed accumulator as input of the WitCreate algorithm must pass the PublicVerify (resp. Verify) algorithm, with publicly (resp. privately) computed accumulator for the same set as the privately (resp. publicly) computed accumulator.

Definition 5.3.4 Correctness of duality.

A dually computable accumulator is said to satisfy correctness of duality if for all security parameters λ, all integer b ∈ N ∪ {∞}, all set of values X all boolean type and all element x such that if Type = 0 then x ∈ X and if Type = 1 then x / ∈ X the following holds

Pr             
(sk acc , pk acc ) ← Gen(λ, b), (acc X , aux) ← Eval(sk acc , pk acc , X ), (accp X , auxp) ← PublicEval(pk acc , X ), wit x ← WitCreate(pk acc , X , acc X , aux, x, Type), witp x ← WitCreate(pk acc , X , accp X , auxp, x, Type) :

(Verify(pk acc , acc X , witp x , x, Type) = 1) ∧(PublicVerify(pk acc , accp X , wit x , x, Type) = 1)

             = 1
Definition 5.3.5 Distinguishability. A dually computable accumulator satisfies distinguishability, if for any security parameter λ and integer b ∈ N ∪ {∞}, any keys (sk acc , pk acc ) generated by Gen(λ, b), and any set X : acc X ← Eval(sk acc , pk acc , X ) and accp X ← PublicEval(pk acc , X ) are trivially distinguishable.

Definition 5.3.6 Dual collision resistance (DCR). A dually computable accumulator is said to satisfy dual collision resistance if all PPT adversaries

A have at most negligible advantage in the game presented in Figure 5.6, where A's advantage is defined as

Adv DCR A (λ) := Pr              Verify(pk acc , acc X * , wit x * , x * , Type = 0) = 1 ∧ x * /
∈ X * ∨(PublicVerify(pk acc , accp X * , wit x * , x * , Type = 0) = 1 ∧ x * / ∈ X * ) ∨Verify(pk acc , acc X * , wit x * , x * , Type = 1) = 1 ∧ x * ∈ X * ∨(PublicVerify(pk acc , accp X * , wit x * , x * , Type = 1) = 1 ∧ x * ∈ X * ) :

(sk acc , pk acc ) ← Gen(λ, b), (X * , wit x * , x * ) ← A(pk acc ),

acc X * ← Eval(sk acc , X * ), accp X * ← PublicEval(pk acc , X * )             
Let C be a challenger. Note 5.3.2 Notice that in the above security game the adversary does not query the challenger for witnesses as witness generation is done publicly in a dually computable accumulator.

Another Contribution: Our New Accumulators Schemes

We now present our two new cryptographic accumulators schemes. Our first scheme improves the state of the art by being the first accumulator scheme with private eval-Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 SETUP: on input λ, C runs Gen(λ) to get (sk acc , pk acc ) and sends pk acc to A. ACCUMULATOR QUERY: A chooses a set X and sends it to C. C returns to A acc X , where acc X ← Eval(sk acc , X ). GUESS: A returns a set X * , an element x * and a witness wit x * and wins if Verify(pk acc , acc X * , wit x * , x * , Type = 0) = 1 ∧ x * / ∈ X * or PublicVerify(pk acc , accp X * , wit x * , x * , Type = 0 = 1 ∧ x * / ∈ X * ) or Verify(pk acc , acc X * , wit x * , x * , Type = 1) = 1 ∧ x * ∈ X * or PublicVerify(pk acc , accp X * , wit x * , x * , Type = 1) = 1 ∧ x * ∈ X * . ACCUMULATOR QUERY: A can continue to query accumulator for sets X . uation while having public witness generation. Our second scheme is the first dually computable accumulator in the literature and is based on our first scheme.

Our Universal Accumulator with Private Evaluation and Public Witness Generation

Our first construction fills the gap raised in Note 5.1.5 and is a unique combination of dual pairing vector spaces (Definitions 2.3.1, 2.3.2) and the accumulator of Nguyen [START_REF] Nguyen | Accumulators from Bilinear Pairings and Applications[END_REF] that we present below.

Nguyen's accumulator. In 2005, Nguyen proposed the first cryptographic accumulator based on bilinear pairing. His scheme is bounded by q ∈ N and we present it in Figure 5.7.

• Gen(λ, q): run a bilinear group generation algorithm to get Γ = (p, G 1 , G 2 , G T , e, g 1 , g 2 ) and choose a random s ← Z * p . Set sk acc = s and pk acc =

g 1 , g s 1 , • • • , g s q 1 , g 2 , g s 2 , • • • , g s q 2 . • Eval(pk acc , X ): compute the coefficients {a i } i=0,••• ,q of the polynomial Ch X [Z] = x∈X (Z + x). Then compute acc X = g q i=0 a i s i 1
, and return acc X .

• WitCreate(pk acc , acc X , X , x):

let {b i } i=0,••• ,q be the coefficients of the polyno- mial Ch X \{x} [Z] = x∈X ,x̸ =x (x + Z). Compute wit x = g q i=0 b i s i 2
, and return wit x .

• Verify(pk acc , acc X , wit x , x): return 1 if e(acc X , g 2 ) = e(g x 1 • g s 1 , wit x ), 0 otherwise. Correctness of the Nguyen's scheme can easily be shown: let X be a set and x be an element of X . As x ∈ X , we have that

q i=0 a i s i = (x + s) • q i=0
b i s i and thus

e(g x 1 • g s 1 , wit x ) = e(g (x+s) 1 , g q i=0 b i s i 2 ) = e(g 1 , g 2 ) (x+s) q i=0 b i s i = e(g 1 , g 2 ) q i=0 a i s i = e(acc X , g 2 ).
Regarding security, the scheme was proven to be collision resistant under the q-SBDH problem (Definition 2.2.12).

Note 5.4.1 Nguyen's accumulator was originally in the symmetric bilinear setting. We present it in the asymmetric bilinear setting to make the comparison with our accumulator scheme easier. Notice that the choice of representing accumulators with elements of G 1 and witnesses with elements of G 2 is ours and groups can easily be swapped.

Note 5.4.2 Notice that [START_REF] Nguyen | Accumulators from Bilinear Pairings and Applications[END_REF]'s accumulator supports subset queries and multiset settings as characteristic polynomial Ch can be defined for a multiset and for the set X \ I, where I ⊂ X .

Originally, Nguyen [START_REF] Nguyen | Accumulators from Bilinear Pairings and Applications[END_REF]'s accumulator was non-universal. Later, Damgard et al. [START_REF] Damgård | Supporting Non-membership Proofs with Bilinear-map Accumulators[END_REF] and Au et al. [START_REF] Ho Au | Dynamic Universal Accumulators for DDH Groups and Their Application to Attribute-Based Anonymous Credential Systems[END_REF] proposed a way to compute non-membership witnesses: while membership witnesses use the fact that the polynomial

(x + Z) divides Ch X [Z] if x ∈ X , meaning that there exits a polynomial Q[Z] such that Ch X [Z] = (x + Z) • Q[Z]
, they decided to exploit the fact that if x / ∈ X , then there exists an integer r such that Ch

X [Z] = (x + Z) • Q[Z] + r. Thus the non-membership witness is composed of g Q(s) 2
(which is the same element than in membership witness) and g r 2 . Verification is done by checking if e(acc X , g 2 ) = e(g x 1 • g s 1 , g

Q(s) 2
) • e(g 1 , g r 2 ). Unfortunately, recently Biryukov et al. [START_REF] Biryukov | Cryptanalysis of a Dynamic Universal Accumulator over Bilinear Groups[END_REF] proved that this way to compute non-membership witness breaks the collision resistance property of the scheme. For this reason (and as they wanted to reach another level of privacy security), Ghosh et al. [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF] defined non-membership witnesses with Bezout coefficients: let X be a set and x / ∈ X . As x / ∈ X , the gcd of Ch X [Z] and (x + Z) is 1. Then with the Extended Euclidean algorithm, compute the polynomials q

1 [Z], q 2 [Z] (the Bezout coefficients) such that Ch X • q 1 [Z] + q 2 [Z] • (x + Z) = 1. The non-membership witness is composed of g q 1 (s) 2 and g q 2 (s) 2
and verification is done by checking if e(acc X , g

q 1 (s) 2 ) • e(g x 1 • g s 1 , g q 2 (s) 2
) = e(g 1 , g 2 ). We will use their idea to make our scheme universal.

Anaïs Barthoulot | PhD Thesis | University of Limoges

Licence CC BY-NC-ND 3.0

Intuition. Let us now present the intuition of our construction. It is easy to see that with Nguyen's accumulator, both evaluation and witness generation are either done publicly or privately but it is not possible to have one algorithm executed privately while the other is executed publicly. Indeed, a trivial idea to have private evaluation and public witness creation would be to keep secret the elements of G 1 for the private evaluation and use the elements of G 2 as public elements. But this does not work as g s 1 must be given publicly for verification. That is why we use dual pairing vector spaces (see Section 2. , we can keep secret some elements and publish some others as follows:

•

g d 1 1 , g d 1 s 1 , • • • g d 1 s q 1
are not publicly given since used for private evaluation;

• g d * 1 2 , g d * 1 s 2 , • • • , g d * 1 s q 2 , g d * 2 2 , g d * 2 s 2 , • • • g d * 2 s q 2
are publicly used for witness creation; and • g

d * 1 2 , g d 2 1 , g d 2 s 1 , g d 2 s q 1
are publicly used for verification.

Thanks to that and the transformation from

x∈X (x + s) to q i=0
a i s i , using the characteristic polynomial result given in Definition 2.1.2, the above public elements are easily computable from the knowledge of the successive powers of s in groups G 1 or G 2 , as it is done in Nguyen. We obtain our scheme presented in Figure 5.8. Our scheme allows multiset setting and subset queries, thus we replace x by I in the construction. However, a non-membership witness for subset I is only computed if X ∩ I = ∅. Our scheme is, as Nguyen's, bounded: let q ∈ N be its bound. Notice that we write in green elements needed when considering the scheme universal. Those elements can be removed when considering our accumulator scheme non-universal. Highlighting our scheme when non-universal will be helpful to build a data sharing scheme, that we present in Section 6.2.

Theorem 5.4.1 Our accumulator is correct.

Proof 5.4.1 Correctness of membership: let X , I be two sets such that I ⊂ X . Let {a i , b i , c i } q i=0 be respectively the coefficients of polynomials Ch

X [Z] = x∈X (x + Z), Ch X \I [Z] = x∈X \I (x + Z) and Ch I [Z] = x∈I (x + Z).
Let acc X ← Eval(sk acc , X ) and mwit I ← WitCreate(pk acc , acc X , X , I, 0). We have that e(g

d 2 q i=0 c i s i 1 , mwit I ) = e(g d 2 q i=0 c i s i 1 , g d * 2 q i=0 b i s i 2 ) = e(g 1 , g 2 ) ψ q i=0 c i s i • q i=0 b i s i . Anaïs Barthoulot | PhD Thesis | University of Limoges
Licence CC BY-NC-ND 3.0

• Gen(λ, q): run a bilinear group generation algorithm to get Γ = (p, G 1 , G 2 , G T , e, g 1 , g 2 ). Then choose a random s ← Z * p , and run Dual(

Z 2 p ) to get D = (d 1 , d 2 ), D * = (d * 1 , d * 2 ). Let ψ ∈ Z * p be a random such that d 1 • d * 1 = d 2 • d * 2 = ψ. Set sk acc = (s, D, D * ), pk acc = Γ, g d 2 1 , g d 2 s 1 , • • • , g d 2 s q 1 , g d * 1 2 , g d * 1 s 2 , • • • , g d * 1 s q 2 , g d * 2 2 , g d * 2 s 2 , • • • , g d * 2 s q 2
, e(g 1 , g 2 ) ψ , and return sk acc , pk acc . • Eval(sk acc , pk acc , X ): compute the coefficients

{a i } i=0,••• ,q of the polynomial Ch X [Z] = x∈X (Z + x). Then compute acc X = g d 1 q i=0 a i s i 1
, and return acc X .

• WitCreate(pk acc , acc X , X , I, Type): let

{b i } i=0,••• ,q be the coefficients of the polynomial Ch X \I [Z] = x∈X \I (x + Z) and let {c i } i=0,••• ,q be the coefficients of the polynomial Ch I [Z] = x∈I (x + Z) -If Type = 0 (membership), compute mwit I = g d * 2 q i=0 b i s i 2
, and return mwit I .

-If Type = 1 (non-membership), using Extended Euclidean algorithm, compute polynomials

q 1 [Z], q 2 [Z] such that Ch X [Z]q 1 [Z] + Ch I [Z]q 2 [Z] = 1. Then, set W 1 = g d * 1 q 1 (s) 2 and W 2 = g d * 2 q 2 (s) 2 . Output nmwit I = (W 1 , W 2 ).
• Verify(pk acc , acc X , wit I , I, Type):

-If Type = 0, and wit I is not a membership witness, it outputs 0. Else, the algorithm returns 1 if e(acc X , g

d * 1
2 ) = e(g

d 2 q i=0 c i s i 1
, mwit I ), 0 otherwise. -If Type = 1, and wit I is not a non-membership witness, it outputs 0.

Else, the algorithm returns 1 if e(acc X , W 1 ) • e(g Here notice that Nguyen's scheme correctness comes into play, and as I ⊂ X we have e(g

d 2 q i=0 c i s i 1 , W 2 ) = e(g 1 , g 2 ) ψ , 0 otherwise.
d 2 q i=1 c i s i 1 , mwit I ) = e(g 1 , g 2 ) ψ q i=0 a i s i = e(acc X , g d * 1 2 ).
Correctness of non-membership: let X , I be two sets such that I ̸ ⊂ X and I ∩ X = ∅. Let {a i , c i } q i=0 be respectively the coefficients of polynomials Ch (pk acc , acc X , X , I, 1). We have that e(acc X , W 1 ) • e(g

d 2 q i=0 c i s i 1 , W 2 ) = e(g d 1 q i=0 a i s i 1 , g d * 1 q 1 (s) 2 ) • e(g d 2 q i=0 c i s i 1 , g d * 2 q 2 (s) 2 ) =
e(g 1 , g 2 ) ψCh X (s)q 1 (s) • e(g 1 , g 2 ) ψq 2 (s)Ch I (s) = e(g 1 , g 2 ) ψ(Ch X (s)q 1 (s)+q 2 (s)Ch I (s)) .

Again, thanks to Nguyen's scheme correctness and as I ̸ ⊂ X , we have e(acc X , W 1 ) • e(g

d 2 q i=0 c i s i 1 , W 2 ) = e(g 1 , g 2 ) ψ•1 = e(g 1 , g 2 ) ψ .
Regarding security our scheme is, as Nguyen's scheme, collision resistant under the q-SBDH problem (Definition 2.2.12).

Theorem 5.4.2 Our accumulator satisfies collision resistance under the q-SBDH problem.

Proof 5.4.2 We prove the contrapositive. Let C be a q-SBDH challenger, B an adversary against collision resistance of the accumulator, that wins with non-negligible advantage.

In Figure 5.9 we build A an adversary that breaks the q-SBDH assumption using B.

• On input λ, q ∈ N, C runs bilinear group generation to get

Γ = (p, G 1 , G 2 , G T , e, g 1 , g 2 ) and chooses α ← Z * p . It sends Γ, g α 1 , • • • , g α q 1 , g 2 , g α 2 , • • • , g α q 2 to A. • A runs Dual(Z 2 p ) to get D = (d 1 , d 2 ) and D * = (d * 1 , d * 2 ) such that d 1 • d * 1 = d 2 • d * 2 = ψ, where ψ ∈ Z * p . Then it sets pk acc = Γ, g d 2 1 , g d 2 α 1 , • • • , g d 2 α q 1 , g d * 1 2 , g d * 1 α 2 , • • • , g d * 1 α q 2 , g d * 2 2 , g d * 2 α 2 , • • • , g d * 2 α q 2
, e(g 1 , g 2 ) ψ and sends it to B. • B makes an accumulator query: it chooses set X and sends it to A. The latter uses its knowledge of d 1 to return to B acc X = g

d 1 Ch X (α) 1
. This step can be repeated an unbounded number of times.

• At some point, B answers either with (X * , x * , mwit x * ) where x * / ∈ X * and mwit x * is a membership witness of x * for set X * , or with (X , x * , nmwit x * = (W 1 , W 2 )) where x * ∈ X * and nmwit x * is a non-membership witness of x * for set X * . • A returns to C, either (x * , e(g 1 , (mwit

d * 2 x * ) 1/ψr • (g -Q(α) 2
) 1/r )) or (x * , e(g

d 1 Q(α) 1 , W 1 ) ψ -1 • e(g d 2 1 , W 2 ) ψ -1
) as its answer to break the assumption. Let us see that the solution output by A is correct.

Suppose that B outputs (X * , x * , mwit x * ). As x * / ∈ X * , there exist

Q[Z], r such that Ch X * [Z] = Q[Z] • (x * + Z) + r.
As mwit x * is a membership witness, we have that e(g

d 2 (x * +α) 1 , mwit x * ) = e(acc X * , g d * 1
2 ). Therefore, e(g

d 2 (x * +α) 1
, mwit x * ) = e(g 1 , g 2 ) ψ(α+x * )Q(α)+ψr and (e(g 1 , (mwit

d * 2 x * ) 1/ψr • (g -Q(α) 2 ) 1/r )) α+x * = e(g 1 , g 2 ) (α+x * )Q(α) r+1 • (g 1 , g 2 ) -(α+x * )Q(α) r = e(g 1 , g 2 ).
Notice that A knows d * 2 , ψ and r and can compute g

-Q(α) 2
from the challenge tuple. Thus, (x * , e(g 1 , (mwit

d * 2 x * ) 1/ψr • (g -Q(α) 2 ) 1/r )) is a solution to the q-SBDH problem. Now, suppose that B outputs (X * , x * , nmwit x * = (W 1 , W 2 )). As x * ∈ X * , there exists Q[Z] such that Ch X * [Z] = Q[Z](x * + Z). As (W 1 , W 2
) is a non-membership witness, we have that e(acc X * , W 1 ) • e(g

d 2 (x * +α) 1 , W 2 ) = e(g 1 , g 2 ) ψ . Therefore, e(acc X * , W 1 ) • e(g d 2 (x * +α) 1 , W 2 ) = e(g 1 , g 2 ) ψ ⇐⇒ e(g d 1 Q(α)(x * +α) 1 , W 1 ) • e(g d 2 (x * +α) 1 , W 2 ) = e(g 1 , g 2 ) ψ ⇐⇒ e(g d 1 Q(α) 1 , W 1 ) (x * +α) • e(g d 2 1 , W 2 ) (x * +α) = e(g 1 , g 2 ) ψ ⇐⇒ (e(g d 1 Q(α) 1 , W 1 ) • e(g d 2 1 , W 2 )) (x * +α) = e(g 1 , g 2 ) ψ ⇐⇒ (e(g d 1 Q(α) 1 , W 1 ) ψ -1 • e(g d 2 1 , W 2 ) ψ -1 ) (x * +α) = e(g 1 , g 2 )
Notice that A knows d 1 , d 2 and ψ and can compute g

Q(α) 1
from the challenge tuple. Thus (x * , e(g

d 1 Q(α) 1 , W 1 ) ψ -1 • e(g d 2 1 , W 2 ) ψ -1
) is a solution to the q-SBDH problem.

As A breaks the assumption when B breaks the collision resistance of the accumulator, we have that A's advantage is equal to B's advantage, meaning that A breaks the q-SBDH assumption with non-negligible advantage. □

Comparison with Nguyen's accumulator. As already stated, by construction our cryptographic accumulator is closed to Nguyen's accumulator [START_REF] Nguyen | Accumulators from Bilinear Pairings and Applications[END_REF]. We now compare in Table 5.4 our accumulator to [START_REF] Nguyen | Accumulators from Bilinear Pairings and Applications[END_REF]'s when considering the latter universal and in the asymmetric bilinear pairing setting. We highlight in red the differences between both schemes. )

nmwit x = (W 1 , W 2 ) = (g d * 1 q1(s) 2 , g d * 2 q2(s) 2
).

Membership Verification e(acc X , g 2 )

? = e(g x 1 • g s 1 , mwit x ) e(acc X , g d * 1
2 )

? = e(g d2x 1 • g d2s 1 , mwit x ) Non-Membership Verification e(acc X , W 1 ) • e(g x 1 • g s 1 , W 2 ) ? = e(g 1 , g 2 ) e(acc X , W 1 ) • e(g d2x 1 • g d2s 1 , W 2 ) ? = e(g 1 , g 2 ) ψ
Unforgeability of private evaluation. We now prove that our accumulator (presented in Figure 5 Proof 5.4. [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF] We prove the contrapositive. Let B be an adversary that breaks UPE security with non negligible advantage. We build A an adversary that uses B to break FA-DPVS-I assumption.

A is given (Γ, g d 2 1 , g

d * 1 2 , g d * 2
2 ). She chooses s ← Z p , creates pk acc and sends it to B. B answer to A with a tuple of message-forged accumulator (X * , acc * ). A knows that for any x ∈ X * , e(acc * , g

d * 1 2 ) = e(g d 2 (x+s) 1
, wit x ) and that e(g

d 2 (x+s) 1 , wit x ) = e(g 1 , g 2 ) ψ q i=1 a i s i . Thus e(acc * , g d * 1
2 ) = e(g 1 , g 2 ) ψ q i=1 a i s i . As A knows X * she can recover {a i } q i=0 and as she knows s, she can compute ( q i=0 a i s i ) -1 and obtains that e((acc * ) ( q i=0 a i s i ) -1 , g

d * 1
2 ) = e(g 1 , g 2 ) ψ . Thus A outputs (acc * ) ( q i=0 a i s i ) -1 as her answer and wins the game with an advantage equal to B's advantage, therefore with non-negligible advantage. □ Note 5.4.3 Notice that by construction in our scheme an accumulator is an element of G 2 1 .

Anaïs Barthoulot | PhD Thesis | University of Limoges

Licence CC BY-NC-ND 3.0

Our Dually Computable Accumulator

We now present our second cryptographic accumulator scheme, which is the first dually computable accumulator. We start with an overview of our construction and then give its presentation.

Overview of the construction. We started from our first accumulator scheme, presented in Figure 5.8. Our idea is to set accp X = g

d * 1 x∈X (x+s) 2
, which is publicly computable as g

d * 1 2 , g d * 1 s 2 , • • • , g d * 1 s q 2
are given in pk acc 1 . With the description of Eval as in the previous scheme, we directly obtain what we need. Moreover, the two accumulators are easily distinguishable as the secretly computed one is composed of two elements in G 1 while the publicly generated one is composed of two elements in G 2 . Indeed, as stated in Definition 2.2.2, an asymmetric bilinear pairing group possesses efficient algorithms for deciding membership of the groups.

Regarding witnesses, membership witnesses can be computed as in our first accumula-

tor: mwit x = g d * 2 x∈X \{x} (x+s) 2
. For both privately and publicly computed accumulators, we are able to provide two very close verification equations. In fact, we remark that we obtain a sort of symmetry between the two accumulators, as e(acc X , g

d * 1 2 ) = e(g d 1 1 , accp X ), which two are equals to e(g d 2 x 1 • g d 2 s
1 , mwit x ), which is computable from the knowledge of the witness. For non-membership witness, an issue raised. Indeed, if we define non-membership witnesses as in our first scheme, i.e. nmwit x = (W 1 , W 2 ) = (g

d * 1 q 1 (s) 2 , g d * 2 q 2 (s) 2
), verification with publicly computed accumulator is not working. That is because in the non-membership verification, we have e(acc X , W 1 ). Therefore, as acc X is replaced by accp X which is composed of two elements of G 2 , the pairing with W 1 cannot work. The only solution to solve this problem is to have a different witness for accp and acc. As this does not correspond to our definition of dually computable accumulator (we recall that we require correctness of duality, meaning that a witness is working with both kind of accumulator in the verification algorithm), we decided to present a non-universal dually computable accumulator and leave as an open problem to build a universal dually computable accumulator. Construction. In Figure 5.10, we present the full description of our first dually computable scheme, from the above intuition. We highlight in blue the algorithms and elements associated to public evaluation. 1 We could have also chosen to define PublicEval such that it returns g • Gen(λ, q): run a bilinear group generation algorithm to get Γ = (p, G 1 , G 2 , G T , e, g 1 , g 2 ). Then choose a random s ← Z * p , and run Dual(

Z 2 p ) to get D = (d 1 , d 2 ), D * = (d * 1 , d * 2 ). Let ψ ∈ Z * p be the random such that d 1 •d * 1 = d 2 •d * 2 = ψ. Set sk acc = (s, D, D * ), pk acc = Γ, g d 1 1 , g d 2 1 , g d 2 s 1 , • • • , g d 2 s q 1 , g d * 1 2 , g d * 1 s 2 , • • • , g d * 1 s q 2 ,g d * 2 2 , g d * 2 s 2 , • • • , g d * 2 s q 2
and return sk acc , pk acc .

• Eval(sk acc , pk acc , X ): compute the coefficients

{a i } i=0,••• ,q of the polynomial Ch X [Z] = x∈X (Z + x). Then compute acc X = g d 1 q i=0 a i s i 1
, and return acc X .

• PublicEval(pk acc , X ): compute the coefficients

{a i } i=0,••• ,q of the polynomial Ch X [Z] = x∈X (Z + x). Then compute accp X = g d * 1 q i=0 a i s i 2
, and return accp X .

• WitCreate(pk acc , acc X \accp X , X , I): Let X , I be two sets such that I ⊂ X . Let {a i , b i , c i } q i=0 be respectively the coefficients

let {b i } i=0,••• ,q be the coefficients of the polynomial Ch X \I [Z] = x∈X \I (x + Z). Compute wit I = witp I = g d * 2 q i=0 b i s i
of polynomials Ch X [Z] = x∈X (x + Z), Ch X \I [Z] = x∈X \I (x + Z) and Ch I [Z] = x∈I (x + Z).
Let accp X ← PublicEval(sk acc , X ) and witp I ← WitCreate(pk acc , accp X , X , I). We have that e(g

d 2 q i=0 c i s i 1 , witp I ) = e(g d 2 q i=0 c i s i 1 , g d * 2 q i=0 b i s i 2 ) = e(g 1 , g 2 ) ψ q i=0 c i s i • q i=0 b i s i .
Here notice that Nguyen's scheme correctness comes into play, and as I ⊂ X we have e(g

d 2 q i=1 c i s i 1 , witp I ) = e(g 1 , g 2 ) ψ q i=0 a i s i = e(g d 1 1 , accp X ).
Lemma 5.4.2 Our dually computable accumulator satisfies dual collision resistance under q-SBDH problem.

Proof 5.4.5 Dual collision resistance for privately computed accumulator is done as for membership witnesses in Proof 5.4.2. Let us do the proof for publicly computed accumulators.

The proof is done by proving the contrapositive as in Figure 5.9. At the end of the game, B outputs (X * , x * , witp x * ) where x * / ∈ X * and witp x * is a membership witness for x * . As x * / ∈ X * , there exist

Q[Z], r such that Ch X * [Z] = Q[Z] • (x * + Z) + r.
As witp x * is a membership witness, we have that e(g

d 2 (x * +s) 1 , witp x * ) = e(g d 1 1
, accp X * ), where accp X * ← PublicEval(pk acc , X * ). Therefore, e(g

d 2 (x * +α) 1
, witp x * ) = e(g 1 , g 2 ) ψ(α+x * )Q(α)+ψr and (e(g 1 , (witp

d * 2 x * ) 1/ψr • (g -Q(α) 2 ) 1/r )) α+x * = e(g 1 , g 2 ) (α+x * )Q(α) r+1 • (g 1 , g 2 ) -(α+x * )Q(α) r = e(g 1 , g 2 ).
Notice that A knows d * 2 , ψ and r and can compute g

-Q(α) 2
from the challenge tuple. Thus, (x * , e(g 1 , (witp

d * 2 x * ) 1/ψr • (g -Q(α) 2 ) 1/r
)) is a solution to the q-SBDH problem. □ Lemma 5.4.3 Our dually computable accumulator satisfies distinguishability.

Our accumulator satisfies distinguishability as a privately computed accumulator is composed of two elements in G 1 while a publicly computed accumulator is composed of two elements in G 2 . In fact, in a bilinear environment, we know that there are an efficient algorithm for deciding membership of the groups (see e.g., Definition 2.2.2). Correctness of duality is satisfied as we have one unique witness (i.e. wit = witp) and, as explained above, we have a symmetry between the two accumulators:

e(acc X , g

d * 1
2 )

from Eval = e(g

d 2 q i=0 c i s i 1 , wit I )
from WitCreate(pk acc ,acc X ,X ,I) = e(g

d 2 q i=0 c i s i 1 , witp I ) from WitCreate(pk acc ,accp X ,X ,I) = e(g d 1 1 , accp X ) from PublicEval .
Thus, the proof is exactly the same than in Proof 5.4.1.

Conclusion of This Chapter

This chapter introduced cryptographic accumulators schemes. Our contributions regarding that primitive is the definition of a new security property, call unforgeability of private evaluation along with the introduction of a new kind of accumulators: dually computable accumulators. In such scheme there are two evaluation algorithms Eval and PublicEval that take as input respectively only the secret key of the scheme (sk acc ) and the public key of the scheme (pk acc ). We also proposes two instantiations of accumulators: one scheme that satisfies our new security property and one dually computable scheme.

Regarding cryptographic accumulators literature we provide a formal proof for the lower bound on symmetric accumulator size along with discussions on accumulators' applications and the delegatable property. As for the latter, we investigate a generic way to bring the property to any accumulator, and we leave as an open problem to know if (and how) all proof systems can be turned into homomorphic proofs. Doing the same thing for other properties, such as asynchronous, might be an interesting challenge and is therefore a lead for future works. In Chapter 6.2 we will see how our dually computable accumulator scheme can be used to build a specific data sharing scheme, called attribute-based encryption. broadcast encryption and attribute-based encryption. For each of them, we give a formal definition along with associated properties, then we present our constructions from the primitives studied in the previous sections. The primitive of broadcast encryption is presented in Section 6.1 while in Section 6.2 we focus on the primitive of attribute-based encryption. We end this chapter in Section 6.3 with a use case for attribute-based encryption.

Broadcast Encryption

The first data sharing scheme we study in this thesis is broadcast encryption (BE), introduced in 1993 by Fiat and Naor [START_REF] Fiat | Broadcast Encryption[END_REF]. In a broadcast encryption scheme the encryption algorithm takes as input the public key pk, a message m, a subset S ⊆ [N ] of users (N being the number of users in the system), and such that the output ciphertext can be decrypted by any user in the subset S. Regarding related work, Boneh et al. [START_REF] Boneh | Collusion Resistant Broadcast Encryption with Short Ciphertexts and Private Keys[END_REF] were the first to achieve constant size ciphertext (i.e., independent of the number of users in the set), but the security was only selective and proven in the generic group model. Recently, Agrawal et al. ( [START_REF] Agrawal | Optimal Broadcast Encryption from LWE and Pairings in the Standard Model[END_REF]) achieves constant size parameters with a security proven in the standard model. But it is only selective secure and their scheme combines both pairings and lattices. Lastly, Gay et al. ( [START_REF] Gay | Tight Adaptively Secure Broadcast Encryption with Short Ciphertexts and Keys[END_REF]) proposes a scheme based on pairings with constant size ciphertext. As far as we know, this is the only BE scheme with a constant-size ciphertext and providing adaptive security in the standard model.

In this manuscript, we also study a variant of broadcast encryption: augmented broadcast encryption (AugBE). An augmented broadcast encryption scheme is a broadcast encryption scheme in which the encryption algorithm takes as additional input an index ind ∈ [N + 1]. As for any BE scheme, the output ciphertext can be decrypted by any user in the subset S, but it is additionally required that the user's index is greater or equal to ind. In particular, if ind = N + 1, no one can decrypt. The first AugBE constructions [START_REF] Boneh | A Fully Collusion Resistant Broadcast, Trace, and Revoke System[END_REF][START_REF] Garg | Building Efficient Fully Collusion-Resilient Traitor Tracing and Revocation Schemes[END_REF] give a ciphertext's size in O( √ N ). In [START_REF] Goyal | Broadcast and Trace with N ϵ Ciphertext Size from Standard Assumptions[END_REF], using both pairings and lattices, Goyal et al. propose a selectively secure construction with ciphertext size in O(N ϵ ) (0 < ϵ ≤ 1/2). Goyal et al. also propose in [START_REF] Goyal | Collusion Resistant Broadcast and Trace from Positional Witness Encryption[END_REF] a generic construction of an AugBE based on positional witness encryption (PWE). Their scheme is the first one providing constant parameters. However, currently only few instantiations of positional witness encryption exist and all rely on multilinear maps. In the following, we first give broadcast encryption and augmented broadcast encryption definitions and properties, including our new definition of anonymous augmented broadcast encryption scheme. Then in Section 6.1.3 we present our contributions regarding BE and AugBe: new generic constructions from identity-based encryption with wildcards schemes. Finally we end this section with a presentation of our new broadcast encryption and augmented broadcast encryption schemes, and we compare them to the state of the art. We also present briefly Boneh et al. [START_REF] Boneh | A Fully Collusion Resistant Broadcast, Trace, and Revoke System[END_REF]'s generic construction of a third primitive, called broadcast and trace, from augmented broadcast encryption scheme. Using our new AugBE scheme and this construction, we obtain a new broadcast and trace scheme that we compare with existing ones.

Definitions and Properties

Definition 6.1.1 Broadcast encryption [START_REF] Fiat | Broadcast Encryption[END_REF][START_REF] Gay | Tight Adaptively Secure Broadcast Encryption with Short Ciphertexts and Keys[END_REF]. A broadcast encryption scheme consists of four algorithms.

• Setup(λ, N ): the setup algorithm takes as input a security parameter λ ∈ N and a number of users N ∈ N. It outputs public parameters pk and a master secret key msk. • KeyGen(msk, i): the key generation algorithm takes as input a master secret key msk and an index i ∈ [N ]. It outputs a secret key sk i for user i. • Encrypt(pk, S, m): the encryption algorithm takes as input a public key pk, a message m and a subset S ⊆ [N ]. It outputs a ciphertext ct S . • Decrypt(pk, S, i, sk i , ct S ): the decryption algorithm takes as input a public key pk, a subset S, an index i, a secret key sk i and a ciphertext ct S , and it returns a message m ′ . Definition 6.1.2 Correctness [START_REF] Gay | Tight Adaptively Secure Broadcast Encryption with Short Ciphertexts and Keys[END_REF]. A broadcast encryption scheme is said to be correct if for all security parameter λ ∈ N, all number of users N ∈ N, every honestly generated key pairs (msk, pk) ← Setup(λ, N ), every messages m, every set S ⊆ [N ] and every i ∈ [N ] such that i ∈ S:

Pr [Decrypt(pk, S, i, KeyGen(msk, i), Encrypt(pk, S, m)) = m] = 1. Definition 6.1.4 Anonymous broadcast encryption scheme (ANO-BE) [START_REF] Barth | Privacy in Encrypted Content Distribution Using Private Broadcast Encryption[END_REF][START_REF] Libert | Anonymous Broadcast Encryption: Adaptive Security and Efficient Constructions in the Standard Model[END_REF]. A broadcast encryption scheme is said to be adaptively anonymous if all PPT adversaries A have at most negligible advantage in the game presented in Figure 6.2, where C is a challenger and A's advantage is defined as

Adv ANO-BE A (λ) = Pr b ′ = b -1/2 .
Note 6.1.1 Many broadcast encryption schemes require the encryption set S to be publicly given as an input of decryption algorithm. Otherwise even authorized users will not be able to decrypt. However, anonymous schemes do not need the encryption set description as an input for the decryption algorithm. Definition 6.1.5 Augmented broadcast encryption scheme (AugBE) [START_REF] Boneh | A Fully Collusion Resistant Broadcast, Trace, and Revoke System[END_REF][START_REF] Goyal | Collusion Resistant Broadcast and Trace from Positional Witness Encryption[END_REF]. An augmented broadcast encryption scheme consists of three algorithms.

• Setup(λ, N ): the setup algorithm takes as input a security parameter λ ∈ N and a number of users N ∈ N. It outputs a master secret key msk, a public key pk and secret keys {sk 1 , • • • , sk N }, where sk i is the secret key for user i. Note 6.1.2 More recently, Goyal et al. [START_REF] Goyal | Broadcast and Trace with N ϵ Ciphertext Size from Standard Assumptions[END_REF] gave another definition of augmented broadcast encryption in which there are two encryption algorithms called Encrypt and Index-Encrypt. The former takes as input the scheme public key, a set of users and a message to encrypt while the latter as an additional input which is an index ind. In the following, we will consider only the original AugBE definition, i.e., the one with one encryption algorithm only. Definition 6.1.6 Correctness [START_REF] Goyal | Collusion Resistant Broadcast and Trace from Positional Witness Encryption[END_REF]. An augmented broadcast encryption scheme is said to be correct if for every security parameter λ ∈ N, all number of users N ∈ N, every message m, every set

∈ S 0 ∧ i / ∈ S 1 or i ∈ S 0 ∧ i ∈ S 1 and if m 0 ̸ = m 1 then i / ∈ S 0 ∩ S 1 holds.
S such that S ⊆ [N ], every index ind ∈ [N ], all i ∈ [N ] such that i ∈ S ∩ {ind, • • • , N },

Our Contribution: Anonymous Augmented Broadcast Encryption

In this thesis, we introduce a new security property for augmented broadcast encryption scheme: anonymity. The below definition, close to the one for broadcast schemes ( [START_REF] Libert | Anonymous Broadcast Encryption: Adaptive Security and Efficient Constructions in the Standard Model[END_REF]), provides the adaptive version. In the following theorem we prove that this new anonymity property implies index-hiding security. Theorem 6.1.1 If an augmented broadcast encryption scheme is anonymous, then it is also index-hiding. Proof 6.1.1 Let C be a challenger and B be an adversary that wins the index-hiding security game with non negligible advantage. Informally, index-hiding means that

• without the key sk ind , an adversary cannot distinguish between an encryption for index ind and one for index ind + 1;

• and if ind is not in the target set S * , then no adversary can distinguish an encryption for index ind and one for index ind + 1 ( [START_REF] Boneh | A Fully Collusion Resistant Broadcast, Trace, and Revoke System[END_REF]).

Thus B can either distinguish which index was used in encryption when ind ∈ S * and without knowing sk ind , or she can distinguish the encryption index when ind / ∈ S * , knowing sk ind . Therefore she either chooses ind ∈ S * or ind / ∈ S * but in this case she asks sk ind otherwise she would have advantage equal to 1/2. We construct, in Figure 6.6, an adversary A that wins the anonymous security game with non negligible advantage. We have that if all B's queries satisfy the game constraints, then all A's queries have the same property. Thus A's simulation is perfect and the advantage of A is the same as B's. This concludes the proof. □ Note 6.1.3 If ind ∈ S * , then ind ∈ S 0 ∧ ind / ∈ S 1 thus adversary cannot query sk ind . If ind / ∈ S * , then ind / ∈ S 0 ∧ ind / ∈ S 1 thus adversary can query sk ind . Note 6.1.4 Index-hiding does not imply anonymous. Indeed, in the index-hiding security game, in the case where ind is not in the challenge, knowing the challenge set does not help determining if ind or ind + 1 was used for encryption.

SETUP: C on inputs λ, N runs Setup(λ, N ) → (msk, pk, sk 1 , • • • , sk N ),

From WIBE to (Aug)BE: Our Generic Constructions

In this section we present two generic broadcast encryption constructions from identitybased encryption with wildcards: one for a basic BE scheme and the other for an AugBE scheme. We also formalize which properties of WIBE are needed in order to obtain a secure BE (resp. AugBE). As in a broadcast encryption scheme there is no key delegation from user to another, we do not consider this feature of the underlying identity-based encryption with wildcards scheme, and thus replace KeyDer by KeyGen in the WIBE definition. For sake of simplicity, we admit in proofs that the number of keys queried is always lower or equal to the maximal number Q of keys that an adversary is allowed to query. All proofs are done for adaptive security definitions and can be adapted to the selective case. The length of patterns is L ∈ N.

First notice that any subset S * ⊆ [N ] can be represented as a pattern P ∈ {0, ⋆} N , where for j ∈ [N ], P j = ⋆ if j ∈ S * and P j = 0 otherwise. This fact can then be used to associate such pattern to the BE encryption set S. Additionally, any user identity i ∈ [N ] can be represented as a pattern P i ∈ {0, 1} N such that for j ∈ [N ], P i j = 1 if i = j and P i j = 0 otherwise. This finally gives us that i ∈ S iff P i belongs to P . Regarding AugBE, we have noticed that the decrypting condition i ≥ ind for any i ∈

[N ], ind ∈ [N + 1] can be rewritten as i ∈ {ind, ind + 1, • • • , N + 1}. It follows that the AugBE decrypting condition becomes i ∈ S ∩ {ind, ind + 1, • • • , N + 1}.
In the sequel, we set L the length pattern of the WIBE schemes to be equal to N the number of users in the BE and AugBE schemes.

Broadcast Encryption from WIBE. Let W IBE = (Setup, KeyGen, Encrypt, Decrypt) be an identity-based encryption with wildcards scheme for key pattern space {0, 1} N \ 0 N and ciphertext pattern space {0, ⋆} N \ 0 N . We construct a broadcast encryption scheme BE = (Setup, Encrypt, Decrypt) in Figure 6.7.

Setup(λ, N ): run Setup(λ, N ) to get pk, msk and set pk = pk and msk = msk.

KeyGen(msk, i ∈ [N ]): define P ′ ∈ {0, 1} N such that for j ∈ [N ], P ′ j = 0 if j ̸ = i and P ′ j = 1 if i = j.
Then run KeyGen(msk, P ′ ) to get sk i and set sk i = sk i . It outputs sk i . Encrypt(pk, S, m): first, associate S with a pattern P in {0, ⋆} N such that for j ∈ [N ], P j = ⋆ if j ∈ S and P j = 0 otherwise. Then compute ct = Encrypt(pk, P , m) and outputs ct = ct. Decrypt(pk, sk i , ct, S): gets m ′ ← Decrypt(sk i , P , ct). Theorem 6.1.4 If the underlying identity-based encryption with wildcards satisfies pattern-hiding security, then the obtained broadcast encryption scheme is anonymous. Proof 6.1.4 Let B be an adversary against anonymous security, that wins with non negligible advantage. In Figure 6.9 we construct A, an adversary against pattern-hiding security that uses B and wins with non negligible advantage. Let C be a challenger.

SETUP: C on inputs λ, N runs Setup(λ, N ) → (msk, pk) and sends pk to A, who sends it to B. KEY QUERY: B chooses i ∈ [N ], sends it to A who creates the pattern P i such that for j ∈ [N ], P i j = 1 if i = j and P i j = 0 otherwise. A sends P i to C who runs KeyDer(msk, P i ) → sk P i . A receives sk P i and sends it to B as sk i . CHALLENGE: B chooses challenge message m, two challenge sets S 0 , S 1 and sends them to A who creates patterns P 0 , P 1 s.t. for j ∈ [N ], P 0 j = ⋆ if j ∈ S 0 , P 0 j = 0 otherwise, and P 1 j = ⋆ if j ∈ S 1 , P 1 j = 0 otherwise. m, P 0 , P 1 are sent to C. C chooses b ← {0, 1} randomly and runs ct * ← Encrypt(pk, P b , m). C sends ct * to A, who sends it to B. KEY QUERY: B and A proceeds as in the first KEY QUERY step. C runs KeyDer(msk, P i ) → sk P i . sk P i is sent to A, who sends it to B as sk i . GUESS: B outputs its guess b ′ to A, who outputs it as its guess. If all B's queries satisfy the game constraints, then all A's queries have the same property. Thus A's simulation is perfect, and the advantage of A is the same as B's. This concludes the proof. □ Augmented Broadcast Encryption from WIBE. Let W IBE = (Setup, KeyGen, Encrypt, Decrypt) be an identity-based encryption with wildcards scheme for key pattern space {0, 1} N \ 0 N and ciphertext pattern space {0, ⋆} N . We now construct an augmented broadcast encryption scheme AugBE = (Setup, Encrypt, Decrypt) in Figure 6.10. Note 6.1.6 Here encryption for pattern 0 N corresponds to encryption for index N + 1.

Note 6.1.7

As the underlying WIBE is pattern-hiding, the AugBE decryption algorithm does not take as input the set for which the message was encrypted.

Theorem 6.1.5 The augmented broadcast encryption scheme obtained is correct if the underlying identity-based encryption with wildcards scheme is correct.

Concrete (Augmented) Broadcast Encryption Schemes

In this section we present our new broadcast encryption scheme and augmented broadcast encryption scheme, both obtained thanks to the combination of our generic constructions and our identity-based encryption with wildcards schemes presented in Section 4.3.

A New Broadcast Encryption Scheme. Using our generic construction in Section 6.1.3 and our first identity-based encryption with wildcards scheme (Section 4.3, Figure 4.9) with L = N we obtain an instantiation of a broadcast encryption scheme that we present in Figure 6.13.

Setup(λ, N ): generate an asymmetric bilinear pairing group Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e) for prime order p. Sample random dual orthonormal bases

(D, D * ) ← Dual(Z 4 p ). Let d 1 , • • • , d 4 denote the elements of D and d * 1 , • • • , d * 4 denote the elements of D * . Pick α, a 1 , • • • , a N ← Z p . The master secret key is msk = (α, g d * 1 2 , g d * 2 2 , a 1 , • • • , a N ) and the public key is pk = (Γ, p, e(g 1 , g 2 ) αd 1 .d * 1 , g d 1 1 , h 1 = g a 1 •d 2 1 , • • • , h N = g a N •d 2 1
).

KeyGen(msk, i ∈ [N ]): pick r ← Z p . Compute a = g αd * 1 +r•a i •d * 1 -r•d * 2 2 and b j = g r•a j •d * 1 2 for j ∈ [N ] \ {i}. The secret key is sk i = (a, {b j } j∈[N ]\{i} ). Encrypt(pk, S, m ∈ G T ): choose s ← Z p and compute ct = (c 1 , c 2 ) where c 1 = m • (e(g 1 , g 2 ) αd * 1 •d 1 ) s , c 2 = g sd 1 1 • j∈S h s j . Decrypt(sk i , ct, S): compute a ′ = a j∈S∩([N ]\{i})
b j and finally C 1 • 1 e(c 2 ,a ′ ) . In Table 6.1, we give a comparison between our broadcast encryption scheme and existing schemes.

based on that table, we remark that our scheme is not as efficient as [START_REF] Agrawal | Optimal Broadcast Encryption from LWE and Pairings in the Standard Model[END_REF]'s scheme, which is currently the most efficient BE scheme in the literature. However, our scheme satisfies the stronger adaptive security notion, and is proven secure under standard assumption. Compare to the adaptively secure scheme given in [START_REF] Gay | Tight Adaptively Secure Broadcast Encryption with Short Ciphertexts and Keys[END_REF], we have a bigger user secret key (sk i ) size, but a shorter public key (pk) size. To be exhaustive, [START_REF] Boneh | Low Overhead Broadcast Encryption from Multilinear Maps[END_REF] proposed a scheme with all parameters in poly(log(N )), with adaptive security. However, this scheme is using multilinear maps and its security is proven in the generic group model (see paragraph 3.1.4) [START_REF] Brakerski | Lattice-Inspired Broadcast Encryption and Succinct Ciphertext-Policy ABE[END_REF] proposed a scheme with all parameters in poly(N, log(N )) With our second identity-based encryption with wildcards scheme (Figure 4.11) and our generic constructions, setting L = N , we obtain a new anonymous broadcast encryption scheme. Our scheme does not improve the efficiency of the Libert et al. scheme [START_REF] Libert | Anonymous Broadcast Encryption: Adaptive Security and Efficient Constructions in the Standard Model[END_REF], which is the best known so far. In particular, their scheme has pk and sk i sizes in respectively O(N ) and O(1) while in our scheme the same parameters have sizes in O(N 2 ) and O(N ) respectively. Regarding security, their scheme achieves the stronger CCA security in the standard model while we only reach a CPA security. However, in Libert et al.'s scheme, each user has to try each element of the ciphertext to find the one she can truly decrypt, while this is not necessary in our construction. Note 6.1.9 In the anonymous broadcast encryption setting, notice that [START_REF] Libert | Anonymous Broadcast Encryption: Adaptive Security and Efficient Constructions in the Standard Model[END_REF] said that achieving shorter than linear size for ciphertext is impossible when considering the used users set description as part of the ciphertext.

A New Augmented Broadcast Encryption Scheme. Using our generic construction and our second identity-based encryption with wildcards scheme (Figure 4.11) with L = N we obtain an instantiation of an augmented broadcast encryption scheme, presented in Figure 6.14.

Our augmented broadcast encryption scheme is the first proven adaptively secure in the standard model. We compare it to the literature in Table 6

d * 0 2 , g d * 1 2 , • • • g d * N 2 , g d * 3N +1 2 • • • , g d * 4N 2
) and the public key is pk = (Γ, p, e(g 1 , g 2 ) αd 0 .d * 0 , g d 0 1 , g

d 4L+1 1
,

h 1 = g d 1 1 , • • • , h N = g d N 1
).

For each i ∈ [N ], pick r ∈ Z p , η ∈ Z L p and set secret key sk i to

g αd * 0 +rd * i + N l=1 η l •d * 3N +l 2 .
Encrypt(pk, S, ind, m ∈ G T ): choose s 1 , s 2 , s 3 ← Z p and compute ct = (c 1 , c 2 ) where

c 1 = m • (e(g 1 , g 2 ) αb * 0 •b 0 ) s 1 , c 2 = g s 1 d 0 +s 2 d 4N +1 1 • j∈[N ]\S,j≥ind h s 3 j . Decrypt(sk i , ct): compute c 1 • 1 e(c 2 ,sk i ) .

Broadcast and Trace Scheme.

There exists another variant of broadcast encryption, called Broadcast and Trace (BT) [START_REF] Naor | Efficient Trace and Revoke Schemes[END_REF]. Such a scheme is a primitive that combines broadcast encryption scheme and traitor tracing (TT) [START_REF] Chor | Tracing Traitors[END_REF] schemes. We recall that the latter is a primitive in which a message is encrypted for the whole subset [N ] but if some subset of traitors uses their secret keys to produce a pirate decoder, then the tracing procedure can identify at least one of the traitors.

In [START_REF] Boneh | A Fully Collusion Resistant Broadcast, Trace, and Revoke System[END_REF][START_REF] Goyal | Collusion Resistant Broadcast and Trace from Positional Witness Encryption[END_REF], it was demonstrated that a broadcast and trace scheme can be constructed from any message and index-hiding AugBE. Briefly, the idea of the construction is that for the broadcast part the AugBE encryption algorithm is used with index ind = 1, while the traitor tracing part is done by running the AugBE encryption algorithm several times, with different indices. Let us see how the traitor tracing part works. Suppose that one has a black box access to a pirate decoder, meaning that she can learn the result of decryption output by the decoder. She then encrypts several messages with index equals to 1, then to 2, etc. At some point, for index j ∈ [N ] the decoder will output a correct decryption while for index j + 1 the decryption will fail. It means that the (or one of the) traitor(s) has an index that is greater or equal to j but strictly lower than j + 1, thus traitor's index is equal to j.

As for traitor tracing, broadcast and trace schemes can achieve either public (anyone can find the traitors) or private (traitors can only be retrieved by the owner of a specific master key) traceability, and both cases are useful for different kinds of use cases.

Theoretically speaking, public traceability is however known to be harder to achieve [START_REF] Boneh | Fully Collusion Resistant Traitor Tracing with Short Ciphertexts and Private Keys[END_REF]. By construction, the original (i.e. given by Boneh and Waters) AugBE definition [START_REF] Boneh | A Fully Collusion Resistant Broadcast, Trace, and Revoke System[END_REF] gives a publicly traceable broadcast and trace scheme while Goyal et al. [START_REF] Goyal | Broadcast and Trace with N ϵ Ciphertext Size from Standard Assumptions[END_REF]'s definition with two encryption algorithms is suitable for the private case.

Following the generic construction given in [START_REF] Boneh | A Fully Collusion Resistant Broadcast, Trace, and Revoke System[END_REF][START_REF] Goyal | Collusion Resistant Broadcast and Trace from Positional Witness Encryption[END_REF], our augmented broadcast encryption scheme can itself be turned into a broadcast and trace scheme. Table 6.3 gives a comparison between our resulting broadcast and trace scheme and existing ones. We also specify in this table if the users set used for encryption must be given additionally to the ciphertext, in order to make the decryption working. A "×" means that the set does not have to be given.

Table 6.3: Broadcast and Trace schemes comparison; tk, "p.o", "c.o", "PWE", "std" "Multi", "P" and "S" mean tracing key, "prime order" "composite order", "Positional Witness Encryption", "standard", "multilinear", "public" and "secret respectively, 0 < ϵ ≤ 1/2. In the column "Users set" a " √ " indicates that the set is given along with the ciphertext while a "×" means that it is not the case. As we can see our scheme is the first BT scheme (as far as we know) that does not need the description of the user sets to be able to decrypt, and that has security proven in the standard model. Moreover, our scheme is publicly traceable, and uses pairings in prime order group while other existing publicly traceable schemes are using either pairings in composite order group (less secure), or positional witness encryption. Regarding efficiency, our resulting BT scheme has a complexity similar to a "trivial" scheme [START_REF] Hieu | Some Advances in Broadcast Encryption and Traitor Tracing[END_REF] (with all parameters sizes linear in the number of users). However, the claimed of our work is not to provide a new efficient Broadcast and Trace scheme, but a new generic way to build AugBE schemes, and our generic construction could be more efficient than a "trivial" BT scheme, even if our current instantiation is not.

Scheme

Moreover, we also consider that our proposal has the additional feature of anonymity, that the trivial construction could not have without being less efficient than ours. With such property, the users set is included in the ciphertext and no longer given in the clear which leads to a linear additional computational cost during decryption. Anonymity in the context of BT seems to be an overkill, but we think that for applications in which being in the used users set reveals some private information about users, it might be a real interest to use an anonymous scheme. Eventually, the derivation of our anonymous AugBE to an anonymous BT scheme is quite direct from the generic construction given in [START_REF] Boneh | A Fully Collusion Resistant Broadcast, Trace, and Revoke System[END_REF]. A formal definition of an anonymous BT scheme is quite straightforward from the one of anonymous AugBE and can be found in e.g., [START_REF] Murat Ak | Anonymous trace and revoke[END_REF]. The only existing anonymous BT is the one of [START_REF] Murat Ak | Anonymous trace and revoke[END_REF], which is based on the anonymous BE scheme of [START_REF] Libert | Anonymous Broadcast Encryption: Adaptive Security and Efficient Constructions in the Standard Model[END_REF]: it directly inherit advantages and drawbacks compare to our resulting scheme. Hence, if our new instantiation of a BT scheme is not more efficient than the "trivial" scheme, it has some specific features that could not be obtained so easily "trivially". Notice that Blazy et al. [START_REF] Blazy | An Anonymous Trace-and-Revoke Broadcast Encryption Scheme[END_REF] proposed an anonymous trace and revoke broadcast encryption scheme, but their definition differs slightly from the one we use, therefore we do not take into account their scheme in our comparison as it would not make sense.

Attribute-Based Encryption

The second data sharing scheme we study in this manuscript is attribute-based encryption (ABE) scheme, introduced by Sahai and Waters [START_REF] Sahai | Fuzzy Identity-Based Encryption[END_REF] in 2005. In such encryption scheme, secret keys and ciphertexts are associated to some subset of attributes, and decryption is possible if there exists a relation between the secret key's attributes and the ciphertext's attributes. In more details, in a Ciphertext Policy ABE (CP-ABE) the ciphertext is associated to an access policy while the secret key is associated to a set of attributes. Decryption becomes possible if the set of attributes satisfies the policy. There exists the dual of a CP-ABE, known as Key Policy ABE (KP-ABE) in which the roles of attributes and access policies are swapped. There exist several ways to define an access policy in the literature: through threshold structure [START_REF] Sahai | Fuzzy Identity-Based Encryption[END_REF], tree-based structure [START_REF] Goyal | Attribute-Based Encryption for Fine-Grained Access Control of Encrypted Data[END_REF], boolean formulas [START_REF] Lewko | New Proof Methods for Attribute-Based Encryption: Achieving Full Security through Selective Techniques[END_REF], linear secret sharing schemes [START_REF] Waters | Ciphertext-Policy Attribute-Based Encryption: An Expressive, Efficient, and Provably Secure Realization[END_REF], circuits [START_REF] Boneh | Fully Key-Homomorphic Encryption, Arithmetic Circuit ABE and Compact Garbled Circuits[END_REF], . . . . The main aim of research in ABE is to build efficient schemes in terms of both time and space complexities, while supporting complex access policies. Unfortunately, most existing schemes propose ciphertexts with a size linear in the number of attributes in the scheme [START_REF] Goyal | Attribute-Based Encryption for Fine-Grained Access Control of Encrypted Data[END_REF][START_REF] Lewko | Revocation Systems with Very Small Private Keys[END_REF][START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF], while some other constructions succeed in proposing constant size ciphertext, but at the cost of quadratic-size user private key [START_REF] Attrapadung | Expressive Key-Policy Attribute-Based Encryption with Constant-Size Ciphertexts[END_REF].

In the sequel we first formally define attribute-based encryption and its properties. Then in Section 6.2.2 we present one of our contributions, which is the construction of a ciphertext policy attribute-based encryption scheme from dually computable accumulators. In Section 6.2.3, we detail the obtained CP ABE scheme, prove its correctness and security and compare it to the state of the art. We end this section with a key policy version of our attribute-based encryption scheme, and compare it to existing schemes, in Section 6.2.4.

Definitions and Properties

Definition 6.2.1 Ciphertext policy attribute-based encryption (CP-ABE) [START_REF] Sahai | Fuzzy Identity-Based Encryption[END_REF]. A ciphertext policy attribute-based encryption scheme consists of four algorithms.

• Setup(λ): the setup algorithm takes as input a security parameter λ and outputs a master public key pk and a master secret key msk. • KeyGen(pk, msk, Υ): the key generation algorithm takes as input a master public key pk, a master secret key msk, a key attribute Υ and outputs a private key sk Υ . • Encrypt(pk, Π, m): the encryption algorithm takes as input a master public key pk, an access policy Π, and a message m. It outputs a ciphertext ct Π . • Decrypt(pk, sk Υ , Υ, ct Π , Π): the decryption algorithm takes as input a master public key pk, a private key sk Υ along with an associated set of attributes Υ, a ciphertext ct Π and its associated access policy Π, and it returns a message m ′ .

Definition of key policy attribute-based encryption can easily be obtained from the above definition, with the roles of attributes sets and access policies swapped. Definition 6.2.2 Correctness. A CP-ABE scheme is said to be correct if for all security parameter λ ∈ N, every attributes set Υ, every access policy Π such that Υ satisfies Π, every messages m, and every honestly generated keys (pk, msk) ← Setup(λ) and sk Υ ← KeyGen(pk, msk, Υ):

Pr [Decrypt(pk, sk Υ , Υ, Encrypt(pk, Π, m), Π) = m] = 1.
Note 6.2.1 ABE schemes can be bounded, meaning that during the setup phase a bound in the number of attributes allowed in the scheme is given and keys and ciphertexts can be created for an arbitrarily number of attributes at the condition that this number is lower than a given.

computable accumulator to obtain a compact, efficient and secure ABE. Unfortunately as our construction relies on pairing-based accumulators' specific features we are not able to propose a generic construction of attribute-based encryption scheme from dually computable accumulators.

Basic idea. Having both private evaluation and public witness creation permits us to transform a cryptographic accumulator into an encryption scheme. More precisely, in our CP-ABE, the user secret key is a privately computed accumulator acc X = g

d 1 x∈X (x+s) 1
, where X is a representation of the user's attributes. In parallel, the ciphertext is a one-time-pad between the message m and a mask H that is computed using a publicly computable accumulator accp Y , where Y is a representation of the access policy. However, with the dually computable accumulator of the previous section as given in Figure 5.10, this construction is not efficient and secure, thus we have to make some changes on the accumulator scheme. Before going into those details, we first explain how we can define X and Y. In the sequel let Q = 2 q -1, where q ∈ N is the bound on the number of attributes in the ABE.

Representation of boolean formulas and attributes with cryptographic accumulators.

In our ABE, access policies are expressed as disjunctions of conjunctions (DNF), without "NO" gates. Hence, a policy could be written Π = π 1 ∨ π 2 ∨ • • • ∨ π l , where l ∈ N, and π i is a conjunction of attributes. Let Y i be the set of attributes present in clause π i , for i = 1, • • • , l. Our idea is to define Y as the set {H(Y i )} l i=1 , where H is a hash function that takes as input a set of elements and returns an element in Z p , for a prime p. During the encryption process, we create the accumulator accp Y using PublicEval (see below).

For a set Υ of attributes for a given user, we create X as the set of hash values (using H) of all non-empty subsets of Υ1 . During the key generation process, the authority hence creates the accumulator acc X using Eval.

Encryption and decryption. For a given user, if her set of attributes Υ satisfies the policy Π, it means that there exists a non-empty subset of Υ that corresponds to a clause π i in Π. As H is deterministic, it follows that one element, called ξ in the sequel, is present in both accumulators: acc X (the one corresponding to the non-empty subsets of Υ) and accp Y (the one that corresponds to Π). Based on that, we propose that during the encryption process, the mask H is computed using the public verification equation PublicVerify, as e(g d 1 1 , accp Y ) α , where α is some randomness.

During decryption, a user having a valid set of attributes precisely knows both the clause π i and the element in Υ that match together. The next step is then for the user to generate a witness for such element, and thanks to the verification algorithms, retrieve H and then the message. But as both accumulators are not related to the same sets, we cannot directly use the properties of a dually computable accumulator. The user hence needs to compute two witnesses (one for each accumulator), and we need to find a way to combine them appropriately for the decryption to work.

Let wit Y ξ , wit X ξ be membership witnesses for ξ and respectively Y, and X . For verification, we compute A = e(wit Y ξ , (g

d * 2 α 2 ) ξ • g d * 2 sα 2
) and B = e(wit X ξ , (g

d * 2 α 2 ) ξ • g d * 2 sα 2
). Multiplying A and B gives us

e(wit Y ξ • wit X ξ , (g d * 2 α 2 ) ξ • g d * 2 sα 2 )
thanks to bilinear pairing properties. To prove simultaneously that ξ is in both accumulators, we need to "force" the decryptor to compute e(A • B, (g

d * 2 α 2 ) ξ • g d * 2 sα 2
) instead of e(A, (g

d * 2 α 2 ) ξ • g d * 2 sα 2 ) • (B, (g d * 2 α 2 ) ξ • g d * 2 sα 2
).

An easy way to do that is to give with the ciphertext (A • B) α instead of g

d * 2 α 2 , g d * 2 sα 2 .
But this implies to know witnesses during encryption whereas they are only known during decryption. Our idea is then to "anticipate" the witnesses or at least a part of them.

Notice that for any set S = {s 1 , • • • , s T }, its polynomial representation T i=1 (s + Z) is actually composed of the elementary symmetric polynomials for T variables:

σ 1 = T i=1 s i , • • • , σ T = T i=1 s i (see Definition 2.1.3). Indeed, T i=1 (s + Z) = Z T + σ 1 Z T -1 + • • • σ T
(see Note 2.1.1). Thus, if we know one element s of S, we know that s is a factor of σ T . We use this idea to anticipate a part of both witnesses for element ξ.

Let {c i , t i } Q i=0 be respectively the coefficients of Ch X \{ξ} [Z] and Ch Y\{ξ} [Z]. Our first idea is to separate coefficients c 0 and t 0 of the others. Thus, in our scheme for clause π j (and associated set Y j ) and non-empty subset p j * , a witness that ξ = H(p j * ) is accumulated in acc X is now equal to (g

d 1 c 0 1 , g d * 2 Q i=1 c i s i 2
) and a witness that ξ = H(Y j ) is accumulated in accp Y is now equal to (g

d 1 t 0 1 , g d * 2 Q i=1 t i s i 2
). This gives us our first intermediate accumulator, presented in Figure 6. [START_REF] Baldimtsi | Oblivious Accumulators[END_REF]. In orange we highlight the differences with our accumulator

pk acc = Γ, g d 1 1 , g d 2 1 , g d 2 s 1 , • • • , g d 2 s q 1 , g d * 1 2 , g d * 1 s 2 , • • • , g d * 1 s q 2 ,g d * 2 s 2 , • • • , g d * 2 s q 2 .
Return sk acc , pk acc .

• Eval(sk acc , X ): compute the coefficients

{a i } i=0,••• ,q of the polynomial Ch X [Z] = x∈X (Z + x). Then compute acc X = g d 1 q i=0 a i s i 1
, and return acc X .

• PublicEval(pk acc , X ): compute the coefficients

{a i } i=0,••• ,q of the polynomial Ch X [Z] = x∈X (Z + x). Then compute accp X = g d * 1 q i=0 a i s i 2
, and return accp X .

• WitCreate(pk acc , acc X \accp X , X , I):

let {b i } i=0,••• ,q be the coefficients of the polynomial Ch X \I [Z] = x∈X \I (x + Z). Compute W 1 = g d 1 b 0 1 and W 2 = g d * 2 q i=1 b i s i 2 ,
and return wit I = (W 1 , W 2 ).

• Verify(pk acc , acc X , wit I , I): let {c i } i=0,••• ,q be the coefficients of the polynomial Ch I [Z] = x∈I (x + Z) and the return 1 if e(acc X , g

d * 1 2 ) = e(W 1 , g d * 1 q i=0 c i s i 2 ) • e(g d 2 q i=0 c i s i 1 , W 2 ), 0 otherwise.
• PublicVerify(pk acc , accp X , wit I , I): let {c i } i=0,••• ,q be the coefficients of the polynomial Ch However, the values c 0 and t 0 depend on X \ {ξ} and Y \ {ξ} respectively. While Y is known during encryption, X and ξ are only known during decryption. Therefore, we cannot anticipate c 0 and t 0 during decryption.

I [Z] = x∈I (x + Z) and return 1 if e(g d 1 1 , accp X ) = e(W 1 , g d * 1 q i=0 c i s i 2 ) • e(g d 2 q i=0 c i s i 1 , W 2 ), 0 otherwise.
To solve this, we choose two values x 0 , y 0 that do not correspond to an output of H and add them to the sets X and Y respectively. As x 0 , y 0 / ∈ Im(H), we know that x 0 and y 0 will always be in sets X \ {ξ} and Y \ {ξ} respectively. Thus, x 0 is a factor of c 0 while y 0 is a factor of t 0 . Therefore, we can anticipate a part of the first element of both witnesses with g d 1 x 0 1 for the witness associated to acc X and g d 1 y 0 1 for the witness associated to accp Y . Now that we can anticipate a part of the witnesses, we can combine them by setting aux 1 = g

d 1 α(x 0 +y 0 ) 1 . Let δ, δ
′ ∈ N such that c 0 = x 0 δ and t 0 = y 0 δ ′ . We can compute e(aux δδ 0 1 , (g

d * 1
2 ) ξ • g

d * 1 s
2 ) = e((g

d 1 α(x 0 +y 0 ) 1 ) δδ ′ , g d * 1 (ξ+s) 2 ) = e(g d 1 αδδ ′ (x 0 +y 0 ) 1 , g d * 1 (s+ξ) 2 ) = e(g 1 , g 2 ) ψαδ ′ c 0 (s+ξ) • e(g 1 , g 2 ) ψαδt 0 (s+ξ)
As the verification that ξ ∈ X will give e(g 1 , g 2 )

ψα Q i=0 a i s i
(if ξ is indeed in the set) we have to give in encryption the auxiliary information aux 2 = g -αd 1 2 to remove this extra term and recover the mask. Notice that aux 2 will work only with privately computed accumulator, and will be used for the verification of membership in the accumulator of the secret key.

Managing the randomness α and a constant-size ciphertext. We now have to compute the rest of witness such that it is randomized by α. The trivial solution is to give g

αd * 2 s 2 , • • • , g αd * 2 s Q 2
but this will result in a linear size for the ciphertext. Thus, it seems more efficient to give g αd 2 (s+ξ) 1

. But as ξ is unknown at the time of encryption, we have to give g αd 2 s 1 and g αd 2

1 . With the latter it is possible to cheat: with g

d * 2 2 , g d * 2 s 2 , • • • g d * 2 s Q 2 we can compute g d * 2 Q i=0 m i s i 2
and recover the mask.

Our idea to avoid this is to anticipate the value of ξ. We do as we did to anticipate c 0 and t 0 . We choose another value z 0 that is not in Im(H) that we add in X and Y. Then z 0 is an element accumulated in both acc X (the secret key) and accp Y (used in the mask of the message). During decryption, we prove the membership of {ξ, z 0 }, and thus we need the polynomial Z 2 + Z(ξ + z 0 ) + ξ • z 0 = Z 2 + Zz 0 + ξ(Z + z 0 ). Therefore, we give with the ciphertext the auxiliary information ele 3 = g αd 2 (z 0 s+s 2 ) 1 and ele 4 = g αd 2 (z 0 +s) 1 . As s is secret, there is no way to cheat.

Auxiliary information in the ciphertext. As is, the scheme is not secure. Indeed, from aux 1 = g To correct this we set: α = α 1 • α 2 for α 1 , α 2 two randoms, aux 1 = g

d 1 α 2 (x 0 +y 0 ) 1 , ele 3 = g α 1 α 2 d 2 (z 0 s+s 2 ) 1 , ele 4 = g α 1 α 2 d 2 (z 0 +s) 1
, and aux 2 = g

-α 1 α 2 d * 1 2
. To have correctness during membership verification, we need more auxiliary information (ele 1 , ele 2 ) are equal to (g

d * 1 α 1 (z 0 s+s 2 ) 2 , g d * 1 α 1 (z 0 +s) 2
).

At this point we obtain a CP-ABE that is working, but unfortunately we are not able to prove its security. Therefore, we have to modify the underlying accumulator, as we explain in the next subsection.

Managing the dual system encryption framework. We want to prove adaptive security of our scheme with the dual system encryption framework, and the decisional subspace assumption in G 1 and G 2 , as it relies on the hidden subspaces of dual pairing vector spaces. We now have to define semi-functional keys and ciphertexts, that will be used in the security proof. We recall that our CP-ABE secret key for attributes sets Υ is equal to acc X = g will be used for semi-functional space. Thus, trivially we can define for a secret key sk Υ and ciphertext auxiliary information aux 2 their semi-functional forms as: sk

(SF ) Υ = sk Υ • g d 3 t 3 1 and aux (SF ) 2 = aux 2 • g d * 3 z 3 2 for t 3 , z 3 ← Z p .
When using the DS2 assumption to change challenge ciphertext from normal form to semi-functional, we will use the element t 1 , which is equal either to g . However, the random τ 1 will have to appear in other parts of the ciphertext as e(acc X , aux 2 ) = e(acc X , g

d * 1
2 ) τ 1 thus for membership verification we have to be able to reconstruct τ 1 q i=0 a i s i . And as τ 1 is only given in exponent of the assumption's challenge we do not know it and will not be able to use it for other parts of the ciphertext, especially because in the ciphertext there are elements of G 1 and we only have τ 1 as exponent of an element of G 2 . Thus, we have to change the way we define semi-functional keys and ciphertexts. To do so we have to also modify normal secret keys and ciphertexts. Let us now define normal and semi-functional keys and ciphertexts as follows: respectively. Notice that we keep the same randoms for coefficients of d 4 and d * 4 in both parts of the semi-functional key and ciphertext (as the assumption's challenge gives us only one coefficient for d 4 , d * 4 and if we randomized it for the second part of SF keys and ciphertext, again we will not be able to remove the extra term). But doing so we obtain that a semi-functional key always decrypt a semi-functional ciphertext, which should not be possible.

sk Υ = g d 1 q i=0 a i s i +z 2 d 2 1 , aux 2 = g rd * 1 +t 2 d * 2 2 sk (SF ) Υ = g d 1 q i=0 a i s i +z 2 d 2 +z 4 d 4 1 , aux (
To fix this issue, we can define normal keys and ciphertexts as follows:

sk Υ = g d 1 q i=0 a i s i +(d 1 -d 2 ) 1 , aux 2 = g rd * 1 +(d * 1 +d * 2 ) 2 .
With this definition, we obtain in the accumulator verification e(g 1 , g 2 ) ψγ • e(g 1 , g 2 ) -ψγ , as we wanted. But we also obtain e(g 1 , g 2 )

ψγ q i=0 a i s i
, an extra term we cannot remove.

At this point, our idea is to increase the dimension of the used DPVS of the accumulator to 3 (and thus 6 for the ABE to have semi-functional spaces). Then, we define normal and semi-functional keys and ciphertexts as:

sk Υ = g d 1 q i=0 a i s i +(d 2 -d 3 ) 1 , aux 2 = g rd * 1 +(d * 2 +d * 3 ) 2 sk (SF ) Υ = g d 1 q i=0 a i s i +(d 2 -d 3 )+z 5 d 5 +z 6 d 6 1 , aux (SF ) 2 = g rd * 1 +(d * 2 +d * 3 )+t 5 d * 5 +t 6 d * 6 2
where z 5 , z 6 , t 5 , t 6 ← Z p . Decryption of a normal ciphertext by a normal or SK key will work as no extra term will be in the result and decryption of a SF ciphertext by a normal key will also work. However, decryption of a SF ciphertext by a SK key will not work as it has an extra term: e(g 1 , g 2 ) ψ(t 5 z 5 +t6 z 6 )6 .

Though there is one problem when defining keys and ciphertexts like this. In the security proof, we use the challenge of DS2 assumption t 2 , t 3 to build the challenge ciphertext. (t 2 , t 3 ) are either equals to (g

τ 1 d * 2 2
, g

τ 1 d * 3
2

) or to (g

τ 1 d * 2 +τ 2 d * 5 2
, g

τ 1 d * 3 +τ 2 d * 6
2

). We set aux 2 = g for z ← Z p . As the same goes when using the challenge of DS1 assumption to build the challenge key, we have to define

-α 1 α 2 d * 1 2 • t 2 • t 3 .
sk Υ = g d 1 q i=0 a i s i +r(d 2 -d 3 )
1 for r ← Z p . We carry these modifications in sk . But notice that with way of building the challenge ciphertext, when t 2 , t 3 are equals to g

τ 1 d * 2 +τ 2 d * 5 2
, g

τ 1 d * 3 +τ 2 d * 6 2
we have that t 5 = t 6 = τ 2 (and the same goes for the challenge key where z 5 = z 6 = τ 2 ). Thus, we do not obtain an SF ciphertext (or SF key). To solve this issue we actually randomized d 3 in the keys and d * 2 in the ciphertext, with the same random γ. Therefore, we define normal and SF keys and ciphertext as follows:

sk Υ = g d 1 q i=0 a i s i +(d 2 -γd 3 ) 1 , aux 2 = g rd * 1 +(γd * 2 +d * 3 ) 2 sk (SF ) Υ = g d 1 q i=0 a i s i +(d 2 -γd 3 )+z 5 d 5 +z 6 d 6 1 , aux (SF ) 2 = g rd * 1 +(γd * 2 +d * 3 )+t 5 d * 5 +t 6 d * 6 2
This gives us our second intermediate accumulator, presented in Figure 6.17. We highlight in green the differences with our first intermediate accumulator scheme, presented in Figure 6. [START_REF] Baldimtsi | Oblivious Accumulators[END_REF]. Notice that we do not include g

r(d * 2 -γd * 3 ) 2
in the publicly computed accumulator as we do not need a semi-functional form of it.

Finally, to conclude our security proof, we will do a change of bases from (D, D * ) to (F , F * ). By the way we define it, we obtain f 1 = d 1 -ηd 5 where η ← Z p . It means that each part of the ciphertext that uses d 1 will have a semi-functional part in bases F ,

• Gen(λ, q): run a bilinear group generation algorithm to get Γ = (p, G 1 , G 2 , G T , e, g 1 , g 2 ). Then choose randoms s, γ ← Z * p , and run Dual(

Z 3 p ) to get D = (d 1 , d 2 , d 3 ), D * = (d * 1 , d * 2 , d * 3 ). Let ψ ∈ Z * p be the random such that d 1 • d * 1 = d 2 • d * 2 = d 3 • d * 3 =ψ.
Set sk acc = (s, γ,D, D * ), and

pk acc = Γ, g d 1 1 , g d 2 1 , g d 2 s 1 , • • • , g d 2 s q 1 , g d * 1 2 , g d * 1 s 2 , • • • , g d * 1 s q 2 , g d * 2 γ 2 , g d * 2 s 2 , • • • , g d * 2 s q 2 , g d * 3 2 .
Return sk acc , pk acc .

• Eval(sk acc , pk acc , X ): compute the coefficients

{a i } i=0,••• ,q of the polyno- mial Ch X [Z] = x∈X (Z + x).
Then pick r ← Z p and compute acc X =

g d 1 q i=0 a i s i +r(d 2 -γd 3 ) 1
, and return acc X .

• PublicEval(pk acc , X ): compute the coefficients

{a i } i=0,••• ,q of the polynomial Ch X [Z] = x∈X (Z + x). Then compute accp X = g d * 1 q i=0 a i s i 2
, and return accp X .

• WitCreate(pk acc , acc X \accp X , X , I):

let {b i } i=0,••• ,q be the coefficients of the polynomial Ch X \I [Z] = x∈X \I (x + Z). Compute W 1 = g d 1 b 0 1 and W 2 = g d * 2 q i=1 b i s i 2 ,
and return wit I = (W 1 , W 2 ).

• Verify(pk acc , acc X , wit I , I): let {c i } i=0,••• ,q be the coefficients of the polynomial

Ch I [Z] = x∈I (x + Z) and return 1 if e(acc X , g d * 1 2 •g d * 2 γ 2 • g d * 3 2 ) = e(W 1 , g d * 1 q i=0 c i s i 2 ) • e(g d 2 q i=0 c i s i 1 , W 2 ), 0 otherwise.
• PublicVerify(pk acc , accp X , wit I , I): let {c i } i=0,••• ,q be the coefficients of the poly-

nomial Ch I [Z] = x∈I (x + Z) and return 1 if e(g d 1 1 , accp X ) = e(W 1 , g d * 1 q i=0 c i s i 2 ) • e(g d 2 q i=0 c i s i 1
, W 2 ), 0 otherwise. and our ciphertext will no longer be a correct SF ciphertext. Indeed, we defined (and we need for the other parts of the proof) a SF ciphertext as being a normal ciphertext with only element aux 2 having a semi-functional part. Therefore, we need to replace d 1 by d 3 in ciphertexts to avoid this issue. As in our CP-ABE the anticipation of the first element of the membership witness, aux 1 , uses d 1 , we modify our accumulator so that W 1 has in exponent d 3 . Plus, as in the CP-ABE ciphertext the mask of the message is e(g d 1 1 , accp Y ), we have to change the way to publicly computed accumulators: we now use {b * 3 s i } q i=0 instead of {b * 1 s i } q i=0 . We also change elements ele 1 , ele 2 in our CP-ABE ciphertext: we replace d * 1 by d * 3 to keep correctness. That gives us our last accumulator scheme (the one that we will use in our CP-ABE scheme), presented in Figure 6.18. We highlight in purple the differences with the intermediate accumulator of Figure 6.17.

Note 6.2.2

To prove security of our attribute-based encryption scheme we will use DS1 and DS2 with parameter k = 3 and n = 2k = 6, and so DPVS of dimension 6.

Our CP-ABE Scheme From Dually Computable Accumulator

The resulting CP-ABE is fully given in Figure 6.19. As said above, it permits to manage access policies expressed as disjunctions of conjunctions without "NO" gates. For sake of clarity, we use the same color notations than in the accumulator of Figure 6.18 and we highlight in red the elements used for anticipation of the witnesses and the intersection of both sets. ) δδ ′ , g

α 1 d * 3 (z 0 s+s 2 ) 2 • (g α 1 d * 3 (z 0 +s) 2 ) ξ ) = e(g α 2 d 3 δδ ′ (x 0 +y 0 ) 1 , g αd * 3 (s 2 +s(z 0 +ξ)+z 0 ξ) 2 ) = e(g 1 , g 2 ) ψα 1 α 2 (s 2 +s(z 0 +ξ)+z 0 ξ)c 0 δ ′ • e(g 1 , g 2 ) ψα 1 α 2 (s 2 +s(z 0 +ξ)+z 0 ξ)t 0 δ and e(ele 3 • ele ξ 4 , W δ ′ 2 • W ′ δ 2 ) = e(g α 1 α 2 d 2 (z 0 s+s 2 ) 1 • (g α 1 α 2 d 2 (z 0 +s) 1
) ξ , (g

d * 2 Q i=1 c i s i 2 ) δ ′ • (g d * 2 Q i=1 t i s i 2 ) δ ) = e(g α 1 α 2 d 2 (s 2 +s(z 0 +ξ)+z 0 ξ) 1 , g d * 2 δ ′ Q i=1 c i s i +d * 2 δ Q i=1 t i s i 2 ) = e(g 1 , g 2 ) ψα 1 α 2 (s 2 +s(z 0 +ξ)+z 0 ξ)δ ′ Q i=1 c i s i Anaïs Barthoulot | PhD Thesis | University of Limoges
Licence CC BY-NC-ND 3.0

• Gen(λ, q): run a bilinear group generation algorithm to get Γ = (p, G 1 , G 2 , G T , e, g 1 , g 2 ). Then choose randoms s, γ ← Z * p , and run Dual(

Z 3 p ) to get D = (d 1 , d 2 , d 3 ), D * = (d * 1 , d * 2 , d * 3 ). Let ψ ∈ Z * p be the random such that d 1 • d * 1 = d 2 • d * 2 = d 3 • d * 3 =ψ. Set sk acc = (s, γ, D, D * ), and
pk acc = Γ, g d 3 1 , g d 2 1 , g d 2 s 1 , • • • , g d 2 s q 1 , g d * 1 2 , g d * 1 s 2 , • • • , g d * 1 s q 2 , g d * 2 γ 2 , g d * 2 s 2 , • • • , g d * 2 s q 2 , g d * 3 2 , g d * 3 s 2 , • • • , g d * 3 s q 2
, and return sk acc , pk acc .

• Eval(sk acc , pk acc , X ): compute the coefficients

{a i } i=0,••• ,q of the polyno- mial Ch X [Z] = x∈X (Z + x). Then pick r ← Z p and compute acc X = g d 1 q i=0 a i s i +r(d 2 -γd 3 ) 1
, and return acc X .

• PublicEval(pk acc , X ): compute the coefficients

{a i } i=0,••• ,q of the polynomial Ch X [Z] = x∈X (Z + x). Then compute accp X = g d * 3 q i=0 a i s i 2
, and return accp X .

• WitCreate(pk acc , acc X \accp X , X , I):

let {b i } i=0,••• ,q be the coefficients of the polynomial Ch X \I [Z] = x∈X \I (x + Z). Compute W 1 = g d 3 b 0 1 and W 2 = g d * 2 q i=1 b i s i 2 ,
and return wit I = (W 1 , W 2 ).

• Verify(pk acc , acc X , wit I , I): let {c i } i=0,••• ,q be the coefficients of the poly-

nomial Ch I [Z] = x∈I (x + Z) and return 1 if e(acc X , g d * 1 2 •g d * 2 γ 2 • g d * 3 2 ) = e(W 1 , g d * 3 q i=0 c i s i 2 ) • e(g d 2 q i=0 c i s i 1 , W 2 ), 0 otherwise. • PublicVerify(pk acc , accp X , wit I , I): let {c i } i=0,••• ,q be the coefficients of the polynomial Ch I [Z] = x∈I (x + Z) and return 1 if e(g d 3 1 , accp X ) = e(W 1 , g d * 3 q i=0 c i s i 2 ) • e(g d 2 q i=0 c i s i 1 , W 2
), 0 otherwise. •e(g 1 , g 2 )

ψα 1 α 2 (s 2 +s(z 0 +ξ)+z 0 ξ)δ Q i=1 t i s i
= {H(p i )} 2 k -1 i=1 ∪ {x 0 , z 0 }. Compute {a i } i=0,••• ,Q the coefficients of the polynomial Ch X [Z] = (x 0 + Z) • (z 0 + Z) • 2 k -1 i=1 (H(p i ) + Z). Pick r ← Z p and set sk Υ = acc X = g d 1 Q i=0 a i s i +r(d 2 -γd 3 ) 1 . • Encrypt(pk, Π, m): let Π = π 1 ∨ π 2 ∨ • • • ∨ π l be
the access policy, where l ∈ N is the number of clauses in the policy, and .

π i for i = 1, • • • , l is a conjunction of attributes. Define Y i for i = 1, • • • , l as the set of attributes associated to clause π i and Y = ∪ l i=1 H(Y i ) ∪ {y 0 , z 0 }. Let {m i } Q i=0 be the coefficients of polynomial Ch Y [Z]. Choose z, α 1 , α 2 ← Z p and do -Mask computation: define accp Y = g d * 3 Q i=0 m i s i
-Anticipation of the intersection: set ele 1 = g

α 1 d * 3 (z 0 s+s 2 ) 2 , ele 2 = g α 1 d * 3 (z 0 +s) 2 , ele 3 = g α 1 α 2 d 2 (z 0 s+s 2 ) 1
, and ele 4 = g

α 1 α 2 d 2 (z 0 +s) 1 . Set ct Π = (ele 1 , ele 2 , ele 3 , ele 4 , aux 1 , aux 2 , m • H) and return ct Π . • Decrypt(pk, sk Υ , Υ, ct Π , Π): find p j * (for j * ∈ 1, • • • , 2 k -1 ) the non-empty subset of Υ that satisfies Π It means that there exist j ∈ [1, • • • , l] such that Y j = p j * and H(Y j ) = H(p j * ) = ξ. Let {c i } Q i=0 be the coefficients of the polynomial Ch X [Z]/((z 0 + Z)(ξ + Z)). Let {t i } Q i=0 be the coefficients of the polynomial Ch Y [Z]/((z 0 + Z)(ξ + Z)). Find δ, δ ′ ∈ Z p such that c 0 = x 0 δ and t 0 = y 0 δ ′ . Set W 2 = g d * 2 Q i=1 c i s i 2 , W ′ 2 = g d * 2 Q i=1 t i s i 2 and compute m • H e(aux δδ ′ 1 , ele 1 • ele ξ 2 ) • e(ele 3 • ele ξ 4 , W 2 δ ′ • W 2 ′ δ ) • e(acc X , aux 2 ) δ ′ δ -1
e(aux δδ ′ 1 , ele 1 • ele ξ 2 ) • e(ele 3 • ele ξ 4 , W δ ′ 2 • W ′ δ 2 ) = e(g 1 , g 2 ) ψα 1 α 2 (s 2 +s(z 0 +ξ)+z 0 ξ)δ ′ Q i=0 c i s i •e(g 1 , g 2 ) ψα 1 α 2 (s 2 +s(z 0 +ξ)+z 0 ξ)δ Q i=0 t i s i If ξ belongs to X and ξ belongs to Y, then e(aux δδ ′ 1 , ele 1 • ele ξ 2 ) • e(ele 3 • ele ξ 4 , W δ ′ 2 • W ′ δ 2 ) = e(g 1 , g 2 ) ψα 1 α 2 δ ′ Q i=0 a i s i • e(g 1 , g 2 ) ψα 1 α 2 δ Q i=0 m i s i
The last pairing is equal to

e(acc X , aux 2 ) δ ′ = e(g d 1 Q i=0 a i s i +r(d 2 -γd 3 ) 1 , g -d * 1 α 1 α 2 +z(γd * 2 +d * 3 ) 2 ) δ ′ = e(g 1 , g 2 ) -α 1 α 2 ψ Q i=0 a i s i δ ′ • e(g 1 , g 2 ) rzγψ • e(g 1 , g 2 ) -rzγψ = e(g 1 , g 2 ) -α 1 α 2 ψ Q i=0 a i s i δ ′ so multiplying it with e(aux δδ ′ 1 , ele 1 •ele ξ 2 )•e(ele 3 •ele ξ 4 , W δ ′ 2 •W ′ δ
2 ) gives e(g 1 , g 2 )

ψα 1 α 2 δ Q i=0 m i s i
. As δ is publicly known, one can from that recover H and then m. Therefore, the scheme is correct. □ Theorem 6.2.2 Our ciphertext attribute-based encryption scheme satisfies adaptive indistinguishability under SXDH problem.

To prove the security of our scheme, we prove that the encryption of challenge message is indistinguishable from the encryption of a random message. Let N q ∈ N be the number of secret keys that the adversary is allowed to query. 3 To prove security of our scheme, we use a sequence N q + 3 of games (our proof is inspired of Chen et al. [START_REF] Chen | Shorter IBE and Signatures via Asymmetric Pairings[END_REF]'s IBE security proof) and Water's dual system encryption framework (see Section 3.5).

• Game Real is the original security game, as presented in Figure 6.15.

• Game 0 is the same as Game Real except that the challenge ciphertext is a semifunctional ciphertext. • Game i for i = 1, • • • , N q is the same as Game 0 except that the first i keys are semi-functional. • Game F inal is the same as Game Nq except that the challenge ciphertext is an encryption of a random message. Now we define semi-functional keys and ciphertexts. Let t 5 , t 6 , z 5 , z 6 ← Z p .

• a semi-functional key for Υ, sk

(SF ) Υ
, is computed from normal key sk Υ as sk

(SF ) Υ = sk Υ • g t 5 d * 5 +t 6 d * 6 1 = g d * 1 Q i=0 a i s i +r(d * 2 -γd * 3 )+t 5 d * 5 +t 6 d * 6 1 • a semi-functional ciphertext for Π, ct (SF ) Π
, is computed as a normal ciphertext ct Π except that aux

(SF ) 2 = aux 2 • g z 5 d 5 +z 6 d 6 2 .
Notice that normal keys can decrypt SF ciphertexts, and normal ciphertexts can be decrypted by SF keys. However, decryption of a SF ciphertext by a SF key leads to an additional term: 1/e(g 1 , g 2 ) (t 5 z 5 ψ+t 6 z 6 ψ)δ -1 .

Our proof is using assumptions DS1 and DS2 (Definition 2.3.4) that hold if SXDH holds. Informally, the proof is done as follows.

• First we prove that if there exists an adversary that can distinguish Game Real from Game 0 then we can build an adversary that breaks the DS2 assumption with parameters k = 3 and n = 6. To do so the main idea is to use the assumption's challenge to build the challenge ciphertext. Depending on the value of the challenge we will either obtain a normal ciphertext or a semi-functional one. • Then we prove that if there exists an adversary that can distinguish Game j-1 from Game j for j = 1, • • • , N q we can build an adversary that breaks the DS1 assumption with k = 3 and n = 6. The idea is to use the assumption's challenge to build the j-th key. Thus, depending on the value of the challenge we will either obtain a normal key or a semi-functional one. To build the challenge ciphertext, we use the assumption's parameters to obtain a semi-functional ciphertext. • Finally, we prove that Game Nq is computationally indistinguishable from Game F inal , with a change of dual orthonormal bases. Doing so, we randomized the coefficient of d * 1 in the aux 2 term of the ciphertext, thereby severing its link with the blinding factor. That gives us the encryption of a random message.

The master key is msk = (γ, s, g

d * 2 2 , g d 1 s i 1 Q i=0 , g d 3 s i 1 Q i=1 ).
KEY QUERY: B knows msk and g d 5 1 , g d 6 1 , thus can easily call the key generation algorithm or produce semi-functional keys. It allows B to answer to all A's key queries.

• To answer the first j-1 key queries that A makes, B runs the semi-functional key generation algorithm to produce semi-functional keys. • To answer to the j-th key query for Υ j , B responds with:

sk Υ j = g b 1 Q i=0 a i s i 1 • t 2 • t -γ 3 where {a i } Q i=0 are the coefficients of polynomial Ch X [Z] and X = H(p j i ) 2 k -1 i=1 ∪ {x 0 , z 0 }, k ∈ N is the size of Υ j and p j i 2 k -1 i=1 are all the non-empty parties of Υ j . -If t 1 , t 2 , t 3 = g τ 1 b 1 1 , g τ 1 b 2 1 , g τ 1 b 3 1 , then sk Υ j is a normal key with randomness r = τ 1 : sk Υ j = g d 1 Q i=0 a i s i +τ 1 (d 2 -γd 3 ) 1 . Thus B has properly simulated Game j-1 . -If t 1 , t 2 , t 3 = g τ 1 b 1 +τ 2 b 3 1 , g τ 1 b 2 +τ 2 b 4 1 , g τ 1 b 3 +τ 2 b 6 1 , then: sk Υ j = g d 1 Q i=0 a i s i +τ 1 (d 2 -γd 3 )+τ 2 (b 4 -γb 6 ) 1 .
• For the remaining key queries, B runs the normal key generation algorithm. .

* 3 Q i=0 m i s i 2 H = e(g b 3 1 , accp Y ) α 1 α 2 aux 1 = g α 2 b 3 (x 0 +y 0 ) 1 aux 2 = g -b * 1 α 1 α 2 2 • u γ 2 • u 3 ele 1 = g α 1 b * 3 (z 0 s+s 2 ) 2 ele 2 = g α 1 b * 3 (z 0 +s) 2 ele 3 = g α 1 α 2 b 2 (z 0 s+s 2 ) 1 ele 4 = g α 1 α 2 b 2 (z 0 +s) 1 which is equal to accp Y = g d * 3 Q i=0 m i s i 2 H = e(g d 3 1 , accp Y ) α 1 α 2 aux 1 = g α 2 d 3 (x 0 +y 0 ) 1 aux 2 = g -d * 1 α 1 α 2 2 • u γ 2 • u 3 ele 1 = g α 1 d * 3 (z 0 s+s 2 ) 2 ele 2 = g α 1 d * 3 (z 0 +s) 2 ele 3 = g α 1 α 2 d 2 (z 0 s+s 2 ) 1 ele 4 = g α 1 α 2 d 2 (z 0 +s) 1 where Y = {H(Y i )} l i=1 ∪ {y 0 , z 0 },
We prove this lemma, by randomizing the coefficient of d * 1 in the aux 2 term of the ciphertext, thereby severing its link with the blinding factor. Proof 6.2. 4 We pick η ∈ Z p and define new dual orthonormal bases

F = (f 1 , • • • , f 6 ) and F * = (f * 1 , • • • , f * 6 )
as follows:

f * 1 = d * 1 , f * 2 = d * 2 , f * 3 = d * 3 , f * 4 = d * 4 , f * 5 = ηd * 1 + d * 5 , f * 6 = d * 6 f 1 = d 1 -ηd 5 , f 2 = d 2 , f 3 = d 3 , f 4 = d 4 , f 5 = d 5 , f 6 = d 6
It is easy to see that F and F * are also dual orthonormal, and are distributed the same as D and D * .

Then, the public key, challenge ciphertext, and queried secret keys in Game N q are expressed over bases D and D * :

pk = Γ, g d 3 1 , g d 2 1 , g d 2 s 1 , • • • , g d 2 s Q ct Π =         accp Y = g f * 3 Q i=0 m i s i 2 H = e(g f 3 1 , g f * 3 Q i=0 m i s i 2 ) α 1 α 2 aux 1 = g α 2 f 3 (x 0 +y 0 ) 1 aux 2 = g -f * 1 α ′ +z(γf * 2 +f * 3 )+z 5 f * 5 +z 6 f * 6 2 ele 1 = g α 1 f * 3 (z 0 s+s 2 ) 2 ele 2 = g α 1 f * 3 (z 0 +s) 2 ele 3 = g α 1 α 2 f 2 (z 0 s+s 2 ) 1 ele 4 = g α 1 α 2 f 2 (z 0 +s) 1         {sk Υ j } j∈[Nq] =    acc X • g t j ′ 5 f 5 +t j 6 f 6 1 = g f 1 Q i=0 a j i s i +r j (d 2 -γd 3 )+t j ′ 5 f 5 +t j 6 f 6 1    j∈[Nq] where α ′ = α 1 α 2 -z 5 η t ′ j 5 = t j 5 + η Q i=0 a j i s i j∈[Nq]
,

which are all uniformly distributed.

In other words, the coefficient α 1 α 2 of d * 1 in the aux 2 term of the challenge ciphertext is changed to random coefficient α ′ ∈ Z p of f * 1 , thus the challenge ciphertext can be viewed as a semi-functional encryption of a random message in G T . Moreover, the coefficients t

j ′ 5 j∈[Nq] of f 5 in the sk (SF ) Υ j j∈[Nq]
are uniformly distributed since t j 5 of d 5 are all independent random values. Thus (pk, ct

(SF ) Π , sk (SF ) Υ j i∈[Nq]
) expressed over bases F and F * is properly distributed as (pk, ct

(SF ) Π R , sk (SF ) Υ j i∈[Nq]
) in Game F inal .

In the adversary's view, both (D, D * ) and (F , F * ) are consistent with the same public parameters. Therefore, the challenge ciphertext and queried secret keys above can be expressed as keys and ciphertext in two ways, in Game Nq over bases (D, D * ) and in Game F inal over bases (F , F * ). Thus, Game Q and Game F inal are statistically indistinguishable. □ Lemma 6.2.4 For any adversary A, Adv Game F inal A (λ) = 0. Proof 6.2. [START_REF] Abe | Blind Key-Generation Attribute-Based Encryption for General Predicates[END_REF] The value of β is independent of the adversary's view in Game F inal . Hence,

Adv Game F inal A (λ) = 0. □ Comparison.
It is known that monotone boolean formulas can be put under DNF form, where the latter represents the minterm of the formula, i.e. a minimal set of variables which, if assigned the value 1, forces the formula to take the value 1 regardless of the values assigned to the remaining variables [START_REF] Elbassioni | On the readability of monotone Boolean formulae[END_REF]. It is also known that the circuit [START_REF] Attrapadung | Dual System Encryption Framework in Prime-Order Groups via Computational Pair Encodings[END_REF][START_REF] Chen | Unbounded ABE via Bilinear Entropy Expansion, Revisited[END_REF], and the case of non-monotonic access formulas [START_REF] Okamoto | Fully Secure Functional Encryption with General Relations from the Decisional Linear Assumption[END_REF][START_REF] Okamoto | Fully Secure Unbounded Inner-Product and Attribute-Based Encryption[END_REF], even if we give some intuitions about it in the note below.

Note 6.2.4

To improve our CP-ABE scheme so that it deals with "NO" gates, we might need to use universal accumulators. A universal accumulator scheme provides both membership and non-membership proofs. We might use non-membership proofs to deal with "NO" gates. The dually computable feature can easily be defined for universal accumulator schemes. However, we were not able to construct such schemes. Our accumulator of Figure 5.8 can be made universal, following [START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF]'s idea for non-membership proofs: the use of Bezout's coefficients. Using Extended Euclidean algorithm, compute polynomials q

1 [Z], q 2 [Z] such that Ch X [Z]q 1 [Z] + Ch I [Z]q 2 [
Z] = 1 (at the condition that I ∩ X = ∅ otherwise the gcd of their associate polynomials is not equal to 1). Then, set

W 1 = g d 1 q 1 (s) 2 and W 2 = g d 2 q 2 (s) 2
. However, when universal, our accumulator is no longer dually computable: in the non-membership verification, we have e(acc X , W 1 ). Therefore, as acc X is replaced by accp X which is composed of two elements of G 2 , the pairing with W 1 cannot work. To keep it working, we would have to modify the witness, and thus we would no longer satisfies correctness of duality. Plus, the modification requires the use of private elements.

Our KP-ABE Scheme From Dually Computable Accumulator

In this section we present a key policy attribute-based encryption scheme, which is built as our ciphertext policy attribute-based encryption scheme of Section 6.2.3, and we compare it to existing schemes. Our KP-ABE is presented in Figure 6.20. We use the same color notations than in Figure 6.19. Theorem 6.2.3 Our scheme is correct and satisfies adaptive indistinguishability under SXDH.

Correctness and security proofs of our KP-ABE can be done as for our CP-ABE.

In Table 6.5 we compare our KP-ABE with other KP-ABE schemes. All schemes are for single authority, secure in the standard model, bounded and in the pairing settings. As we notice for our CP-ABE, there exist schemes that are unbounded or deal with non-monotonic access policies. We leave as an open problem to modify our KP-ABE to achieve such properties.

• Setup(λ, 1 q ): generate bilinear group Γ = (G 1 , G 2 , G T , p, e, g 1 , g 2 ), dual pairing vector spaces (D, D

* ) ← Dual(Z 6 p ) such that D = (d 1 , • • • , d 6 ), D * = (d * 1 , • • • , d * 6 ) and d i • d * i = ψ, for i = 1, • • • , 6 and ψ ∈ Z * p .
Also choose γ, s, x 0 , y 0 , z 0 ← Z p and a hash function H that takes as input an attributes set and outputs an element of Z p \ {γ, s, x 0 , y 0 , z 0 }.

Set Q = 2 q -1, msk = γ, s, g d * 2 2 , g d 1 s i 1 Q i=0 , g d 3 s i 1 Q i=1 and pk = Γ, g d 3 1 , g d 2 1 , g d 2 s 1 , • • • , g d 2 s Q
Return msk, pk. • KeyGen(pk, msk, Π): let Π = π 1 ∨π 2 ∨• • •∨π l be the access policy, where l ∈ N is the number of clauses in the policy, and .

π i for i = 1, • • • , l is a conjunction of attributes. Define Y i for i = 1, • • • , l as the set of attributes associated to clause π i and Y = ∪ l i=1 H(Y i ) ∪ {y 0 , z 0 }. Let {m i } Q i=0 be the coefficients of polynomial Ch Y [Z]. Pick r ← Z p and set sk Π = acc Y = g d 1 Q i=0 m i s i +r(d 2 -γd 3 ) 1 • Encrypt(pk, Υ, m): let k ∈ N be the number of attributes in Υ. Compute p 1 , • • • , p 2 k -1 all the non-empty parties of Υ and set X = {H(p i )} 2 k -1 i=1 ∪ {x 0 , z 0 }. Compute {a i } i=0,••• ,Q the coefficients of the polynomial Ch X [Z] = (x 0 + Z) • (z 0 + Z) • 2 k -1 i=1 (H(p i ) + Z). Choose z, α 1 , α 2 ← Z p and do -Mask computation: define accp X = g d * 3 Q i=0 a i s i
-Anticipation of the element computation: set ele 1 = g

α 1 d * 3 (z 0 s+s 2 ) 2 , ele 2 = g α 1 d * 3 (z 0 +s) 2 , ele 3 = g α 1 α 2 d 2 (z 0 s+s 2 ) 1 and ele 4 = g α 1 α 2 d 2 (z 0 +s) 1 Set ct Υ = (ele 1 , ele 2 , ele 3 , ele 4 , aux 1 , aux 2 , m • H) and return ct Υ . • Decrypt(pk, sk Π , Π, ct Υ , Υ): Find p j * (for j * ∈ 1, • • • , 2 k -1 ) such that Υ satisfies Π It means that there exist j ∈ [1, • • • , l] such that p j * = Y j and H(p j * ) = H(Y j ) = ζ. Let {c i } Q i=0 be the coefficients of the polynomial Ch X [Z]/((z 0 + Z)(ζ + Z)). Let {t i } Q i=0 be the coefficients of the polynomial Ch Y [Z]/((z 0 + Z)(ζ + Z)). Find δ, δ ′ ∈ Z p such that c 0 = x 0 δ and t 0 = y 0 δ ′ . Set W 2 = g d * 2 Q i=1 c i s i 2 , W ′ 2 = g d * 2 Q i=1 t i s i 2 and compute m • H e(aux δδ ′ 1 , ele 1 • ele ζ 3 ) • e(ele 2 • ele ζ 4 , W 2 δ ′ • W 2 ′ δ ) • e(acc X , aux 2 ) δ ′ δ -1
(q) O(l) O(q) × Static Yes Prime Symmetric [91] O(q) O(q) O(l) √ Static No Composite Symmetric [94] O(q) O(q) O(l) √ Non Static No Prime Symmetric [87] O(n) O(n) O(l) √ Static No Prime Asymmetric Our O(2 q ) O(1) O(1) √ Static No Prime Asymmetric

Use Case

In this section we present a specific use case requiring data sharing schemes. We here focus on connected objects and the data they produce. Connected objects have an important role in our daily life: from connected clocks to connected watches, they have different functions to play but all of them require security. First, these objects are configured to fit user's specific needs so it must avoid another to change (maliciously on purpose or by mistake) the settings. For example, no one would enjoy being woke up in the middle of the night because someone hacked their connected clock and changed the alarm. Furthermore, these objects deal with user personal data and even sensitive confidential information. Therefore the privacy level guaranteed by the devices must be really high. As an example, the data coming from a connected tensiometer or glucometer can reveal a lot of information about the individual attached to those objects. It also happens that resource owners want to share to others (called users in the sequel, and denoted U) some data collected or produced by their connected devices (called a resource in the sequel): we can imagine that one would like to share with his personal fitness trainer the number of footsteps collected by the pedometer of his smart watch, or that one neighbor wants to give to the all neighborhood access to his connected weather station. For this purpose, a very appealing setting is to store the resource coming from connected objects into a central server, since it permits a larger and more flexible sharing.

Here we hence consider such case, and introduce a Central Server (CS) that will centralize the data coming from a set of connected objects. But owners of these must be able to have full control on this sharing capacity: granting access only to authorized users and being able to stop sharing whenever they want. One natural way to give and remove access to a connected device is to associate the access to a policy, which defines the conditions to satisfy in order to obtain access. Doing so, only users having the right attributes (which can be names, addresses, ages, ...) satisfying the defined access policy will access the data of the devices. For this purpose, we also consider an Authorization Server (AS), who will help to check whether the access policy is verified by the attributes of the user accessing the data store in CS.

In the following, we present an innovative way to use identity-based encryption with wildcard schemes to do access control in the above scenario, through a sharing platform called COPP ("Connected Objects Preserving Privacy"). We first present the context, the actors and the security requirements of the platform in Section 6.3.1. Then in Section 6.3.2 we present our generic solution using identity-based encryption with wildcard scheme and the required properties for the latter. Finally, in Section 4.3.3 we present a WIBE scheme satisfying all desired features. Our work present an innovative way to use identity-based encryption with wildcard schemes to do access control in the above scenario and could also lead to new constructions of cryptographic-based access control since this is the first time, as far as we know, that a WIBE is used for such kind of access control.

Presentation

From the above context, our purpose is to find a way to prevent any non authorized user to access a resource, but also to protect the privacy of both (i) the owner of a resource who wants to share it with some users, and (ii) the user who is requesting an access to a resource. For this to succeed, we need to manage two issues at the same time.

• Access policies can themselves leak personal information: imagine a healthcare organization that stores patient medical records electronically and implements an access policy that restricts access to medical records based on the patient's medical condition. For example, the policy that might allow only authorized healthcare professionals to access the medical records of patients with certain sensitive conditions, such as HIV. If an outsider learn this access policy, she could infer that patients likely have HIV, as this condition is explicitly mentioned in the policy as criteria for restricted access. It means that in terms of privacy, access policies should be protected to anyone but the owner of the resource that defines it, and the AS that will manage access to the resource according to the policy.

• The identity of the user can also leak information about the resource owner. Indeed, taking the same example as above and considering the condition having heart issue, if one learn that a cardiologist is trying to access a resource from one user, then it also learn that the resource owner has heart issues. Hence, user's attributes should also be protected to anyone (including AS) but the user himself. But to prevent a user to cheat on the attribute she has (to access a resource she would not normally has the right to), we need to introduce a new entity, namely the Identity provider (IdP), whose role is to certify the attributes of the requesting users.

Based on that, we now consider the following work-flow. At first, a resource owner can store his resources to CS and define an access policy that is given to AS. In parallel, any user can obtain from IdP a certification of his attributes. Eventually, a user can request AS to obtain access to a specific resource. If the attributes of the user verify the access policy attached to the requested resource, the user obtains a token that can be used with CS to obtain the resource.

Basic solutions. To manage the above, one basic solution could be for the user to send his attributes to AS, so that the latter can verify if they match the access policy. But this is not satisfactory as AS will accumulate too much information on users, as explained in the above second item. Another solution could be to add some trust between AS and IdP. In this case, AS could send the access policy to IdP who can check the validity of the user's attributes, hence validating this access to the resource. In this case, the user's attributes are no more available to AS, and the user does not obtain any information about the access policy. But this is still not satisfactory, as IdP is in this case too powerful. She can easily decide whether a user can or cannot access to a resource, independently on his attributes and the access policy. Additionally, we do not verify the above first security item for obvious reasons.

In this thesis, we propose a cryptographic solution verifying all the above security items: protection of the access to a resource from non-authorized users, protection of the access policy, and protection of user's attributes. In the sequel, we will focus on access policies expressed as disjunctions of conjunctions, i.e. boolean formulas composed of OR of AND. For simplicity, we also suppose that each resource is only associated to one access policy. Our protocol still works if several policies are associated to each object, but it becomes less easy to read and less efficient.

Related work.

Based on this setting, there are multiple ways to treat our problem using different security tools.

• Role-Based Access Control [START_REF] Ferraiolo | Role-Based Access Control[END_REF][START_REF] Sandhu | Role-based access control models[END_REF]: in such a system, an entity (in our case AS) authenticates a user and verifies if it has the right attributes according to a given access policy. If it has the advantage of preventing the user of knowing the access policy attached to a resource, the main issue of such technique in our use case is that such entity should know everything about the users' attributes (to verify their validity according to the access policy). Hence, it is not fully relevant. • Anonymous Credential Systems [START_REF] Chaum | Security without Identification: Transaction Systems to Make Big Brother Obsolete[END_REF]: this primitive permits a user to prove to third parties that she has some certified attributes, without revealing who she is among the set of users having the same attributes. Such system could be used to manage some access policies, the IdP being the entity certifying the attributes of users. But such solution does not provide attribute confidentiality (except by adding some complex zero-knowledge proofs of knowledge), nor access policy secrecy as the user needs to know it to properly choose his attributes. • Attribute-Based Signatures [START_REF] Hemanta | Attribute-Based Signatures[END_REF](ABS): in such a scheme, a signing key is related to some attributes and the signature of a message is generated thanks to an access policy. It results that if the attributes embedded in the key that has been used to generate the signature verify the access policy used to sign the message, then the verification process will outputs "true". The signing key is generated thanks to a master secret key (e.g., managed by IdP) and a set of attributes. In our context, the user can hence generate a signature to obtain the authorization to access a resource, then protecting his attributes. But the concept of "policy-hiding" ABS does not exist yet, as far as we know, and seems to be hard to obtain. • Attribute-Based Encryption [START_REF] Sahai | Fuzzy Identity-Based Encryption[END_REF](ABE): this primitive, which has already been detailed Section 6.2, is the equivalent of ABS but for encryption. In our context, such cryptographic tool can be used by playing the usual authentication system based on encryption: AS generates a random, encrypt it and if the user can send back the initially chosen random value, it means that she has correctly decrypted the received ciphertext [START_REF] Ferrara | Policy Privacy in Cryptographic Access Control[END_REF]. To fit our use case, we need to modify such primitive by two means: (i) having a key generation which does not permit the issuer to obtain any information about the user attributes; (ii) having a ciphertext which does not reveal the access policy that has been used. In this case, we talk about "policyhiding" ABE. As far as we know, it does not exist an ABE with both properties in the literature. The policy-hiding property has been extensively studied, and many papers can be found in the literature [START_REF] Chandra | Ciphertext Policy-Hiding Attribute-Based Encryption[END_REF][START_REF] Müller | Hiding the Policy in Cryptographic Access Control[END_REF][START_REF] Balu | Ciphertext Policy Attribute-based Encryption with anonymous access policy[END_REF][START_REF] Michalevsky | Decentralized Policy-Hiding ABE with Receiver Privacy[END_REF]. Regarding the privacy-preserving key generation, we can cite [START_REF] Song | Efficient Attribute-Based Encryption with Privacy-Preserving Key Generation and Its Application in In-dustrial Cloud[END_REF][START_REF] Abe | Blind Key-Generation Attribute-Based Encryption for General Predicates[END_REF].

Our idea. Our idea is to create a new kind of ABE by using an identity-based encryption with wildcard (WIBE) scheme. As explained previously, and detailed below, from such basic cryptographic concept, we need to add three functionalities: (i) the way to treat attributes and an access policy with a WIBE; (ii) the way to hide the access policy during decryption; (iii) the way to obtain a decryption key in a blind manner. As for the ABE, such tool can quite naturally be used in our setting, as we will see below. Before that, we investigate the required properties for the identity-based encryption with wildcard scheme.

Actors, architecture and requirements. We consider a set of connected objects that belong to several different owners (a Data Owner is denoted DO). Each connected object regularly generates some data that we call resources. A resource is denoted R i and the set of resources is R. We also denote k = |R|. A resource is considered as sensitive and must be protected to non authorized entities. But as it is most of the time done in our modern world, we assume that the resource owner cannot directly manage the storage and the access to his resources. Hence, the storage of such sensitive data is delegated to a so called Central Server CS. But for the confidentiality of the resources, the latter only provides access to a resource if the requestor (a user U) provides a valid token. Such token is generated by an Authorization Server (AS), which is responsible for the management of the access to the resources. More precisely, we consider that the access to a resource R i is conditioned by an access policy π i . The latter is defined for each resource by the data owner DO of the said resource.

An access policy is most of the time defined over a set of attributes, and this is the case in our setting. It follows that each user U should be associated to a set of attributes A U (names, addresses, emails...), related to the access policies. As we do not want each user to freely manage his own attributes, as she can try to cheat to obtain more resources, those are managed by an identity provider (IdP), which is considered as an independent entity. Then the COPP platform allows a user U to access a resource R i if and only if his attributes satisfy the access policy π i protecting R i . This verification that the access policy is verified is mandatory and permits the user to obtain a valid token, thanks to AS, that is eventually sent to CS to obtain the resource. Notice that this does not mean that AS could know whether a user U has or has not access to a requested resource. In our solution, this will not be the case. As a user is considered as an individual in our study, his attributes should be protected against non-authorized entities. This should include AS and CS.

Finally, we also consider that the access policy is something sensitive. As explain previously, some policies could reveal information about the data owner ("access is provided to users having the attribute cardiologist" means that this data owner certainly has heart problems) and the user ("access is provided to users having the attribute cardiologist" means that this user is a cardiologist, "access is provided to Mr. Smith" means that the name of the user is Smith). We give more details about this requirement just below. From this general overview, we obtain Table 6.6 which summarizes what information is known by whom. We consider that the introduction of all those actors is the best way to protect the privacy of all individuals, namely data owners and users. Example 1. Imagine a financial institution that grants employees varying levels of access to customer financial data based on their job roles. For example, the access policy can states that only employees with the "higher" roles can access the accounts of the most valuable customers, and all other employees are restricted from doing so. A (malicious) employee with "low" role will not be able to access the resource (as wanted), but she might infer that the customers with this level of protection are likely valuable individuals. This could lead to targeted unauthorized access or potential data breaches targeting these customers. In this scenario, the access policy inadvertently discloses sensitive financial information by implying the wealth status of certain customers, which could have significant consequences for their privacy and security.

Example 2. Imagine a company that holds a portfolio of valuable patents and trade secrets. To protect their intellectual property, they restricts access to specific projects and proprietary information with the use of an access policy: only individuals directly involved in a project have access to its related documents. There are three reasons why even authorized users must not know the access policy:

• By not disclosing the specificities of the access policy to authorized users, the company minimizes the risk of attackers gaining insight into the company's intellectual property protection measures. • Even trusted employees may inadvertently leak information or fall victim to social engineering attacks. If employees were fully aware of the access policy and its intricacies, it could make it easier for them to exploit or bypass the policy, potentially leading to data breaches. • By keeping authorized users unaware of the access policy, the company helps maintain the integrity of their intellectual property and ensures that access is granted only to those who genuinely require it. In this scenario, the company prioritizes the protection of their intellectual property by limiting knowledge of the access policy among authorized users. This approach helps mitigate risks associated with both external threats and unintentional internal breaches, safeguarding their valuable assets. Note 6.3.1 To access a resource, a user must grant access to some of his personal attributes. By hiding the access policy from the user, the user remains unaware of which attributes she is consenting to provide access to. Following the GDPR, we need to find a suitable lawful basis to permit such treatment of such personal attributes. If we consider the "consent" lawful basis, it seems hard to prevent the user from knowing the access policy. Indeed, in such case, the service provider must precisely informed an individual about the way his personal data are used. This seems to mean that the user should know which of his attributes are used, and how. If we can certainly inform the user about which of his attributes are used, it is infeasible to hide the access policy and explain the user how his attributes are used! Another option could be to use the "contract" lawful basis, which states that the processing is necessary for a contract the service provider has with the individual. We could easily consider that the user has signed a contract to access the resources, hence permitting some specified actors to use his personal data. Again, we can provide the user which of his attributes are used. As our purpose in this thesis is not to discuss about lawful issues, we defer such discussions to legal experts and jurists.

Procedures. Based on the above, we consider the four following steps for our system:

1. a Setup phase which is executed by the AS and the IdP, which permits them to generate all the needed parameters and keys. In particular, each of them obtains a private key, and a global public key is also output; 2. a StoreResource step, in which DO stores a new resource R i on CS and send the related access policy π i to AS;

3. a KeyQuery protocol that is executed between a user (with a set of attributes), the IdP and the AS. The IdP can identify the user and verify his attributes. At the end of the protocol, the user obtains a secret key which is related to his attributes; 4. a ResourceQuery protocol between a user (having played the previous step), AS and CS, which permits the former to get access to some resources. AS permits a user with a set of attributes verifying the access policy to get of token that is eventually given to CS to access the resource. A summary of the actors and architecture is given in Figure 6.21. Security requirements. As a summary regarding security, we require the following requirements.

• For a given resource R i , a set {U j } j of users, each U j having a set of attributes A U j that does not verify the access policy π i defined by AS for R i , must not access R i . • For a given resource, the access policy must only be known by AS and DO.

• For a given user U j , the set of attributes A U j verifying the access policy π i attached to a resource R i should not be revealed to AS nor CS.

We additionally assume the following, additionally to the fact that we consider no coalitions between the different actors:

• DO is honest;

• AS is honest but curious, meaning that it will correctly define the access policy attached to a resource, but can try to obtain some information about users' attributes;

• CS is honest but curious, trying to obtain information about the user's attributes and the access policy; • IdP is honest but curious, and can want to obtain some information about the access policy, and the resource; • users U are dishonest and can try to cheat to obtain access to more resources, and to obtain more information about access policies;

Requested features for WIBE. Before entering into the formal presentation of our solution with identity-based encryption with wildcard scheme, we first sketch how we can add the three above functionalities to a WIBE scheme, informally speaking.

Policies, attributes and patterns. We here consider that an access policy π is represented as a disjunction of conjunctions. For simplicity of the reading, we consider policies with only one clause even if our scheme will be working with policies considering several clauses (but be less efficient). Notice that a clause can be seen as a conjunction, thus it can be transformed into a pattern P ′ of space {0, 1} L , where for l = 1, • • • , L, P ′ l = 1 if attribute l is in the clause, and P ′ l = 0 otherwise. It follows that we can associate to each user a pattern P of space {0, ⋆} L , where for l = 1, • • • , L, P l = ⋆ if user has attribute l, P l = 0 otherwise. Thus, we have that the key decrypts the ciphertext only if for l = 1, • • • , L, P l = P ′ l or P l = ⋆, which will be denoted by P ′ ∈ ⋆ P. Based on that, it is easy to see that a "basic" WIBE is enough to manage such feature. What we need is to add two different procedures:

• Att2Pattern which takes as input a set A U of attributes and which outputs a pattern P U using the above transformation; • AP2Pattern which takes as input an access policy π and which outputs a pattern P ′ using the above transformation;

Hiding the access policy. The next step is to hide the access policy during the decryption phase. As we now manage an access policy as described just above, what we need is a WIBE scheme in which the pattern is hidden with the sole knowledge of the ciphertext. Such concept already exists and known as an anonymous WIBE (see Definition 4.1.5). Note 6.3.2 Here anonymous security is enough for the WIBE, there is no need to consider our stronger security property of pattern-hiding.

Attribute-protecting key generation.

To obtain such feature, we can use a privacypreserving key generation WIBE scheme, as presented in Chapter 4 (Section 4.2 and Definition 4.2.1). Doing so, we will have a scheme in which the user does not have to send its P = (P 1 , • • • , P L ) in the clear to obtain the associated decryption keys.

Our Generic Solution

In this section, we show how a privacy-preserving key generation identity-based encryption with wildcard scheme (Definition 4.2.2) with policy hiding can be used within the COPP platform. Our protocol is also using signature schemes (Definition 3.4.1).

Basic idea. Based on the architecture given in Section 6.3.1, we give a possible instanciation based on WIBE. For simplicity, we present the protocol with only one user U with attributes set A and one resource R associated to policy π, but the protocol easily works when there are several users and resources. The basic idea is as follows:

• during the Setup phase, the AS, playing the role of the KGC, generates the WIBE master secret key. The IdP generates a key pair for a digital signature. The IdP will also play the role of the PAC for the WIBE scheme. This is given by operations circled in blue in Figure 6.22; • the StoreResource phase simply consists for the Data Owner DO to send, through two different secure channels (using e.g., TLS), (i) a new resource R to CS and (ii) the accompanied access policy π to AS. We consider that a unique identifier permits to make the link between the two. This step is represented by red circles in Figure 6.22. Compare to the others, this phase is no more detailed in the sequel, as we do not really have anything to add; • the KeyQuery protocol corresponds to the privacy-preserving key generation phase in which the user obtains a secret key based on her attributes. The IdP verifies the attributes (i.e., the pattern in the WIBE sense), and the AS generates the user's secret key, in a blind manner, as described by operations circled in green in Figure 6.22; • in the ResourceQuery phase, when receiving a query to access a resource R by a user U, the CS chooses a random challenge t and sends it to U, who forwards it to AS. The latter signs it and encrypts both t and the signature σ based on the underlying access policy π. It finally sends the ciphertext to the user. Based on the secret key obtains in the KeyQuery step, the user can decrypt it to retrieve t and σ iff her attributes verifies the access policy (otherwise, the resulting value has no sense w.r.t. t and the signature and CS will reject the query). This is represented by operations circled in purple in Figure 6.22. 4. AS checks the validity of the signature σ, using Σ.Verify and the public key pk IdP . If it is correct, it runs the blind key generation algorithm Π.BlindKeyGen on input the master secret key msk and the blind token bt P , which outputs the blind secret key bsk P . The latter is finally sent to user U. 5. U uses COPP to extracts her final secret key sk A by executing Π.KeyExtract on input the blind secret key bsk P and her temporary secret key tsk user . Refer to operations circled in green in Figure 6.23.

• ResourceQuery: we consider that U has previously played the KeyQuery protocol.

She is thus in possession of a secret key sk A , based on her attributes A . 1. U makes through COPP a request to CS for resource R, identified by Id R .

2. CS generates a random challenge t, sends it back to U who forwards it to AS 3. AS first runs AP2Pattern routine to transform π into a pattern P * . It then signs Id R ∥t using Σ.Sign and its signing key sk AS , obtaining σ t . The value τ = (Id R , t, σ t ) corresponds to the access token. It then runs the WIBE encryption Π.Encrypt on input the pattern P * and the message τ to get the ciphertext ct. Eventually, AS sends ct to user U. 4. U runs the WIBE algorithm Π.Decrypt with U 's secret key sk A and gets a value τ , which is sent to the Central Server CS resource server for resource R. 5. If U 's attributes allow her to access the resource, then CS retrieves ((Id R , t, σ t ) from τ ). If σ t is a valid signature for pk AS on the message Id R ∥t, if t is similar to the one it has sent during step 1., and if Id R exists, then the corresponding resource R is sent to U. Refer to operations circled in purple in Figure 6. [START_REF] Barthoulot | Dually Computable Cryptographic Accumulators and Their Application to Attribute-Based Encryption[END_REF]. We now show that our above proposal verifies three properties.

Secrecy of the resource. If a non authorized user can access a resource for which she does not have the right attributes, it means that (i) she has corrupted IdP to obtain a secret key for attributes she does not have (but we have assume that such coalition is not possible), (ii) she has broken the indistinguishability of the WIBE scheme by being able to decrypt a message while not having a valid secret key (which is assumed to be infeasible), or (iii) she has broken the signature scheme to forge an AS signature to generate a token that will be accepted by CS (which is also infeasible).

Secrecy of the access policy. Such security property is given by the way the access policy is treated (see Table 6.6), and from the anonymity property of the WIBE scheme. Secrecy of user's attributes. During the execution of a complete sequence, the only way for non-authorized to obtain any information about the user's attribute is to (i) corrupt the IdP (but such coalition is our of scope), or (ii) break the privacy-preserving key generation property of the WIBE scheme (which is assumed to be infeasible).

Our Concrete Solution: An Anonymous PPKG-WIBE

We now present a WIBE scheme that matches all the requirements defined above.

Core WIBE construction. The basis of our identity-based encryption with wildcard scheme is an idea given in [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF] and presented in Section 4.2: the construction of an anonymous WIBE from an inner product encryption scheme. We however need to modify such construction since (i) their proposal considers a key derivation from another key, which we do not need and (ii) we have some specific restrictions regarding our patterns spaces.

Hiding the access policy. Based on the above core generic WIBE construction, our idea is then to build our own scheme on [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF]'s IPE scheme, which satisfies attributehiding property (Definition 3.3.4), meaning that ciphertexts do not give information about the associated vector. Doing so, we protect the access policy almost for free. Another option would have been to use the construction by Okamoto and Takashima [START_REF] Okamoto | Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption[END_REF] or by Chen et al. [START_REF] Chen | Shorter IBE and Signatures via Asymmetric Pairings[END_REF]. At the cost of an efficiency lost, those schemes achieve adaptive and attribute hiding security, based on a static and standard assumption, hence more secure than [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF]. But with the current version of the scheme, we do not protect users attributes as in order to obtain a secret key, any user must send its attributes to the owner of the master secret key. Hence, we need to provide a privacy-preserving key generation such that the master secret key owner does not learn users attributes.

Privacy-preserving key generation. Our WIBE scheme presented in Figure 4.16, in Section 4.16 is a PPKG-WIBE scheme, based on the combination of Abdalla et al. [START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF] generic construction of anonymous WIBE from IPE and the Lewko et al. [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF] attribute-hiding IPE scheme. Notice our scheme do not consider key derivation from another key. Combining this with the above paragraph, we have that our PPKG-WIBE scheme once adapted to our new patterns spaces is a good candidate to instantiate our generic solution for the use case.

Patterns spaces restrictions. Our PPKG-WIBE scheme (Figure 4.16) is dealing with patterns that belong to {0, 1, ⋆} L . For the use case, patterns spaces are equal to {0, 1} L and {0, ⋆} L for ciphertexts and keys respectively. For algorithms ExtendingCtPattern and ExtendingKeyPatternRandomized this change is not an issue as {0, 1} L ⊂ {0, 1, ⋆} L and {0, ⋆} L ⊂ {0, 1, ⋆} L . We present in Figure 6.24 an example of the execution of both algorithms of such subsets. Therefore our PPKG-WIBE scheme can be used for the use case.

Conclusion of This Chapter

This chapter introduced two data sharing schemes: broadcast encryption (and its variants) and attribute-based encryption. Our contributions regarding the first primitive is a generic construction of (augmented) broadcast encryption scheme from (patternhiding) identity-based encryption with wildcard, along with two new schemes: a constant size ciphertext broadcast encryption scheme and an augmented broadcast encryption scheme, both proven to be adaptively secure in the standard model. As for attributebased encryption, we first propose a new scheme that is the first one in the literature to have constant size ciphertext and secret keys. This ABE scheme is based on our dually computable accumulator scheme, presented in Section 5.4. We also investigate a use case centered on access control within the realm of connected devices, and propose an identity-based encryption with wildcard scheme that protects both the privacy of the access policies and users' attributes. Regarding our ABE from dually computable accumulator, the size of its public key is a major drawback. This increase of the size is coming from the way we decided to represent sets of attributes and access policies and how we defined verification that an access policy is satisfied. Finding another way to represent them and to check if the attribute set verifies the access policy might lead to a more efficient scheme. We leave this question an open problem. Our construction relies strongly on some features of pairing-based accumulators (such as the use of the characteristic polynomial to represent a set of elements). That makes it unfortunately not generalizable. Finding a way to build attribute-based encryption from dually computable accumulators without relying on some specific features to obtain a generic construction is a challenging problem that we leave open. Another thing to improve regarding this construction is the complexity of supported access policies. Indeed currently our scheme is only dealing with disjunctions of conjunctions, which is not suitable for fine-grained access control. Building a ABE scheme from a dully computable accumulator that deals with complex access policies is a challenge for a future work.

Finally a last open question is about our data sharing schemes resistance to quantum computers. As we instantiate our identity-based encryption with wildcard schemes and accumulators schemes with pairing, our obtained broadcast encryption, augmented broadcast encryption and attribute-based encryption schemes are not quantum resistant. However, for the (augmented) broadcast encryption scheme as we provide a generic construction, building lattice-based (for example) identity-based encryption with wildcard schemes with all the required properties (and efficiently) will lead to (efficient) quantum resistant data sharing schemes. But building such identity-based encryption with wildcard schemes is quite challenging. As for accumulators, finding, for example, lattice-based accumulators that are efficient and can be dually computable might lead to an efficient quantum resistant attribute-based encryption scheme. However, currently there are only few accumulators based on lattices and they suffer from large accumulated values (or witnesses). all signatures and all aggregate signatures generated honestly, the AggVerify algorithm outputs 1. Regarding efficiency, aggregate signature schemes have a compactness of aggregation requirement: the size of an aggregate signature is a fixed polynomial in the security parameter, independent of the number of aggregations. As for security, an aggregate signature scheme must satisfy aggregated unforgeability, which is the same definition as unforgeability of signature schemes (see Definition 3.4.3) except that now the adversary must produce a set of messages along with a forged aggregate signature.

Locally Verifiable Aggregate Signatures [START_REF] Goyal | Locally Verifiable Signature and Key Aggregation[END_REF]. A locally verifiable aggregate signatures scheme (LVAS), is an aggregate signature scheme with two additional algorithms LocalOpen and LocalAggVerify such that • LocalOpen takes as input a verification key, an aggregate signature, a set of l ∈ N messages and an index ind in [l] and returns auxiliary information aux corresponding to the message of index ind; • and LocalAggVerify takes as input a verification key, an aggregate signature, one message and auxiliary information associated, and returns 1 if the aggregate signature contains the signature of the message, 0 otherwise. This local opening brings efficient verification: the verification algorithm takes as input one specific message instead of all messages, to prove that the signature of this message is indeed in the aggregate signature. A LVAS scheme must satisfy correctness of local opening meaning that for all security parameter, all signing and verification keys generated honestly, all messages, all honestly computed signatures and aggregate signatures, and all honestly generated auxiliary information, the LocalAggVerify algorithm returns 1. It must also satisfy compactness of aggregation as for aggregate signature schemes and compactness of opening that requires that the size of the auxiliary information is fixed polynomial in the security parameter, and is independent of the number of aggregations. Regarding security, LVAS scheme must satisfy aggregated unforgeability with adversarial opening: this definition is similar to unforgeability of signature schemes (see Definition 3.4.3) except that this time the adversary must produce a tuple of aggregate signature-auxiliary information-message that passes the LocalAggVerify algorithm.

Similarities between signature and symmetric accumulator. We can easily build a signature scheme from an accumulator scheme with private evaluation and public generation. Indeed, set sk = sk acc , vk = pk acc , let the signature of a message m be the accumulator of the set {m} and let the signature verification be the accumulator verification algorithm. Correctness of the signature scheme comes straight from the correctness of the accumulator scheme. The construction can be done the other way round: the accumulator scheme can be build from the signature scheme, however it results in a bounded accumulator scheme, with bound equals to 1 in our case. As for security, the question is more tricky: an adversary of the accumulator security will try to find another set that has the same accumulator (i.e. the same signature) as one given as challenge, while an adversary of the signature security will try to produce a new pair of message-signature. Thus we were not able to make the reduction from one to the other as both adversaries are requiring different inputs, and have different outputs that cannot be used to solve the other's security game.

Similarities between aggregate signatures and symmetric accumulator. Using an aggregate signature scheme to build a symmetric accumulator will solve the above problem of the bound equals to 1. Indeed, when the set to accumulate contains more than one element, the Eval algorithm runs the Sign algorithm on all elements of the set, then queries the Aggregate algorithm on all pairs of element-signature and returns the aggregate signature as the accumulator of the set. However, there is some issue when defining the verification algorithm Verify from the aggregate verification algorithm AggVerify: the latter is expecting as input a set of messages while the former is only expecting one element (i.e. one message). This difference of syntax traduces the fact that AggVerify is doing verification for all messages at the same time, while Verify is doing verification for one element (i.e. message) only. Thus the construction in this way is not working. Now let us do the construction in the other way round. It is more complicated as we need to find a way to define Aggregate. Using an additive accumulator scheme [START_REF] Camenisch | Dynamic Accumulators and Application to Efficient Revocation of Anonymous Credentials[END_REF] might be the answer, as such accumulator schemes provide an algorithm Add that takes as input the scheme (secret and) public key(s), a set of elements along with its accumulator and an element y to add, and returns an accumulator corresponding to the union of the original set and {y}. Then Aggregate is defined as follow: it runs Eval on one message of the set given as input, then runs the addition algorithm Add to obtain an accumulator of all messages, that will be output as an aggregate signature. However notice that the Aggregate algorithm takes as input only the verification key, therefore we need to use an accumulator scheme with public addition, meaning that Add only takes as input the accumulator public key and not the accumulator secret key. As for the aggregate verification algorithm AggVerify, we can define it such that it runs the accumulator verification algorithm Verify for all messages taken as input and outputs 0 if Verify returns 0 at least once.

Regarding security, our attempt to prove the security of the construction above through a security reduction was hindered by the differing inputs and outputs in the accumulator and aggregate signature security games, preventing us from completing the proof. not a straightforward task, even in the single-signer setting. Furthermore, addressing the multi-signer scenario presents significant challenges, as it would necessitate the creation of a novel class of cryptographic accumulators where accumulators computed from different keys could be "accumulated" together. This innovative development could have numerous potential applications, and we conclude this thesis by posing this intriguing open question.

Chiffrement avancé pour le partage de données sensibles

Résumé : Les données, y compris les données privées, jouent aujourd'hui un rôle prépondérant dans notre quotidien. Les recherches actuelles se concentrent principalement sur le stockage de ces données, en mettant l'accent sur la possibilité de les traiter de manière sécurisée même lorsqu'elles sont chiffrées. Cependant, au-delà de leur conservation, ces données doivent également être partagées de diverses manières : soit entre un individu et un groupe d'individus, parfois unis par des caractéristiques communes qui définissent les règles de partage, soit simplement entre deux individus. À l'heure actuelle, ces différents modes de partage ne sont pas encore bien maîtrisés, que ce soit en raison de leur coût élevé en termes de performance ou de leurs fonctionnalités limitées. Cette thèse se penche sur divers schémas de chiffrement adaptés au partage de données sensibles, en proposant de nouvelles constructions. Tout d'abord, nous examinons deux primitives cryptographiques : les schémas de chiffrement basés sur l'identité avec caractère générique et les accumulateurs cryptographiques, qui serviront de point de départ pour nos nouvelles constructions. En ce qui concerne les schémas de chiffrement basés sur l'identité avec caractère générique, nous introduisons une nouvelle propriété de sécurité et proposons deux nouvelles instanciations, dont l'une satisfait cette nouvelle propriété de sécurité que nous avons définie. Pour les accumulateurs cryptographiques, nous présentons un nouveau type d'accumulateur, ainsi qu'un schéma amélioré par rapport à l'état de l'art, et un deuxième schéma illustrant notre nouvelle fonctionnalité. Nous introduisons également une nouvelle propriété de sécurité pour cette primitive et soulevons de nombreuses questions concernant différentes propriétés de cette dernière. Enfin, nous explorons la construction de schémas de chiffrement adaptés au partage de données en utilisant les deux primitives précédentes. Nous proposons une construction générique de schéma de chiffrement de groupe (y compris le chiffrement de groupe "augmenté") à partir de schémas de chiffrement basés sur l'identité avec caractère générique. Grâce à nos instantiations de la primitive, nous obtenons un nouveau schéma de chiffrement de groupe qui améliore l'état de l'art en offrant une sécurité adaptative plutôt que simplement sélective, tout en préservant l'efficacité des meilleurs schémas grâce à une taille de chiffré constante. Pour les schémas de chiffrement de groupe "augmentés", la combinaison d'une de nos instantiations de schémas de chiffrement basés sur l'identité avec caractère générique et notre construction générique nous permet d'obtenir un nouveau schéma, le premier à garantir une sécurité adaptative dans le modèle standard. Malheureusement, en termes d'efficacité, notre schéma n'est pas plus efficace qu'une solution "triviale". Cependant, grâce à nos constructions génériques, une amélioration de la primitive sous-jacente contribuera à l'amélioration des schémas de chiffrement de groupe "augmentés". Nous proposons également un schéma de chiffrement basé sur les attributs en utilisant notre nouveau type d'accumulateurs. Ce schéma est le premier à offrir une taille constante pour la clé secrète et le chiffré, indépendamment du nombre d'attributs dans le schéma, tout en garantissant une sécurité adaptative. Cependant, cette efficacité est obtenue au détriment de la taille exponentielle de la clé publique, et notre construction, reposant sur des spécificités propres à l'instantiation de notre nouvel accumulateur avec des couplages, ne peut pas être généralisée. Enfin, à travers un cas d'usage concret, nous proposons une nouvelle approche du contrôle d'accès grâce aux schémas de chiffrement basés sur l'identité avec caractère générique.

Mots clés : cryptographie, chiffrement par attributs, chiffrement de groupe, chiffrement basé sur l'identité avec caractère générique, accumulateurs cryptographiques

Advanced Encryption for the Sharing of Sensitive Data

Abstract: Data, including private information, plays a pivotal role in our daily lives today.

Current research predominantly focuses on data storage, with an emphasis on the ability to securely process data even when it is encrypted. However, beyond mere preservation, data must also be shared in various ways: either among an individual and a group of individuals, sometimes bound by common characteristics defining sharing rules, or simply between two individuals. Currently, these different modes of sharing are not yet well-mastered, either due to their high performance cost or limited functionalities. This thesis delves into various encryption schemes tailored for sharing sensitive data, proposing new constructions. Firstly, we investigate two cryptographic primitives: identity-based encryption schemes with wildcards and cryptographic accumulators, which serve as a starting point for our new constructions. Regarding identity-based encryption schemes with wildcards, we introduce a new security property and propose two new instantiations, one of which satisfies this new security property that we have defined. For cryptographic accumulators, we present a new type of accumulator, an improved scheme compared to the state of the art, and a second scheme illustrating our new functionality. We also introduce a new security property for this primitive and raise numerous questions concerning various properties of the latter. Finally, we explore the construction of encryption schemes suited for data sharing using the two aforementioned primitives. We propose a generic construction of a group encryption scheme (including "augmented" group encryption) based on identity-based encryption schemes with wildcards. With our instantiations of the primitive, we achieve a new group encryption scheme that enhances the state of the art by offering adaptive security rather than just selective, while preserving the efficiency of the best schemes due to a constant ciphertext size. For "augmented" group encryption schemes, the combination of one of our instantiations of identity-based encryption schemes with wildcards and our generic construction enables us to obtain a new scheme, the first to guarantee adaptive security in the standard model. Unfortunately, in terms of efficiency, our scheme is no more efficient than a "trivial" solution. However, thanks to our generic constructions, an enhancement of the underlying primitive will contribute to improving "augmented" group encryption schemes. We also propose an attribute-based encryption scheme using our new type of accumulators. This scheme is the first to offer a constant size for the secret key and ciphertext, regardless of the number of attributes in the scheme, while guaranteeing adaptive security. However, this efficiency comes at the cost of an exponential size for the public key, and our construction, relying on specific features of our new accumulator instantiation with pairings, cannot be generalized. Finally, through a concrete use case, we introduce a novel approach to access control using identity-based encryption schemes with wildcards.

Keywords

1 Introduction 1 . 1 1 Introduction 1 . 1 21 1. 6

 111111216 Foundations of Cryptography . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Encryption Scheme for Data Sharing . . . . . . . . . . . . . . . . . . . . 1.4 Our Toolbox of Cryptographic Primitives . . . . . . . . . . . . . . . . . . 1.5 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.6 Organization of this Thesis . . . . . . . . . . . . . . . . . . . . . . . . . . Contents Foundations of Cryptography . . . . . . . . . . . . . . . . . . . . . . . 16 1.2 Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.3 Encryption Scheme for Data Sharing . . . . . . . . . . . . . . . . . . 18 1.4 Our Toolbox of Cryptographic Primitives . . . . . . . . . . . . . . . . . 20 1.5 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Organization of this Thesis . . . . . . . . . . . . . . . . . . . . . . . . 24 Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0

Figure 1 . 1 :

 11 Figure 1.1: Broadcast encryption scheme, simplified.

Figure 1 . 2 :

 12 Figure 1.2: Ciphertext policy attribute-based encryption scheme, simplified.

Figure 1 . 3 :

 13 Figure 1.3: Example of matching and not matching patterns.

Figure 1 . 4 :

 14 Figure 1.4: Identity-based encryption with wildcards scheme, simplified.

Figure 1 . 5 :

 15 Figure 1.5: Cryptographic accumulator, simplified.

Definition 2 . 1 . 1

 211 Thesis | University of Limoges Licence CC BY-NC-ND 3.0 Negligible function. A function ϵ : N → R is called negligible if for all k ∈ N, there exists N ∈ N such that for all n ≥ N , we have that |ϵ(n)| < 1 n k .

Definition 2 . 1 . 3

 213 Elementary symmetric polynomial. The elementary symmetric polynomial on n ∈ N variables

1 . 1 A 1 ) = 1

 1111 An adversary A solves the DDH problem in G 1 with advantage ϵ if Adv DDH := Pr A(∆, g ab 1 ) = 1 -Pr A(D, g ab+c ≥ ϵ

  where 1 here denotes the identity element in G T . We denote by Dual(Z n p ) an algorithm that generates dual pairing vector Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 spaces.

  Let B, B * be dual orthonormal bases, m ≤ n be fixed positive integers and A ∈ Z m×m p be an invertible matrix. We let S m ⊆ [n] be a subset of size m, and define new dual orthonormal bases B A , B A * as follows. We let B m denote the n × m matrix over Z p whose columns are the vectors b i ∈ B such that i ∈ S m . Then B m A is also an n × m matrix. We form B A by retaining all of the vectors b i ∈ B for i / ∈ S m and exchanging the b i for i ∈ S m with the columns of B m A. To define B * A , we similarly let B * denote the n × m matrix over Z p whose columns are the vectors of b * i ∈ B * such that i ∈ S m . Then B * m (A -1 ) ⊤ is also an n × m matrix, where (A -1 ) ⊤ denotes the transpose of A -1 . We form B * A by retaining all of the vector b * i ∈ B * for i / ∈ S m and exchanging the b * i for i ∈ S m with the columns of B * m (A -1 ) ⊤ .

Lemma 2 . 3 . 2

 232 If the decisional Diffie Hellman problem (DDH) in G 1 holds, then the decisional subspace problem in G 1 (DS1) also holds.

3 )

 3 Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 and has a unique solution if d

Contents 3 . 1 49 3. 1 . 1 49 3. 1 . 2

 3149114912 Proving Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Provable Security . . . . . . . . . . . . . . . . . . . . . . . . . Proofs Methods . . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.1.3 Attacks by the Adversary . . . . . . . . . . . . . . . . . . . . . 51 3.1.4 Attack Environments . . . . . . . . . . . . . . . . . . . . . . . 51 3.1.5 Computing Power . . . . . . . . . . . . . . . . . . . . . . . . . 53 3.2 Public Key Encryption Schemes . . . . . . . . . . . . . . . . . . . . . 53 3.3 Inner Product Encryption Schemes . . . . . . . . . . . . . . . . . . . 55 3.4 Signature Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 3.5 Dual System Encryption Framework . . . . . . . . . . . . . . . . . . . 58 Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0

Definition 3 . 2 . 3

 323 Adaptive indistinguishability security. A public key encryption scheme E = (KeyGen, Encrypt, Decrypt) is said to satisfy adaptive indistinguishability security if the advantage of any adversary A of winning the security game presented in Figure3.1 is negligible. Let C be a challenger.• SETUP: C takes as input a security parameter λ, runs KeyGen(λ) to get (sk, pk) and gives pk to A. • CHALLENGE: A chooses two challenge messages m 0 , m 1 of same length and sends them to C. The latter picks b ← {0, 1} and returns to A the challenge ciphertext ct b ← Encrypt(pk, m b ). • GUESS: A outputs a guess bit b ′ ∈ {0, 1}. A wins the security game if b ′ = b.

Figure 3 . 1 :

 31 Figure 3.1: Adaptive indistinguishability security game for public key encryption schemes.

Figure 3 . 2 :

 32 Figure 3.2: Adaptive payload-hiding security game for inner product encryption schemes.

Figure 3 . 3 :

 33 Figure 3.3: Adaptive strong attribute-hiding security game for inner product schemes.

Figure 3 . 4 :

 34 Figure 3.4: Adaptive unforgeability security game.

Figure 4 . 1 ,

 41 where A's advantage is defined as Adv IN D-W IBE A (λ) := Pr b ′ = b -1/2 for any λ ∈ N. Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0

Figure 4 . 1 :

 41 Figure 4.1: Adaptive indistinguishability security game for identity-based encryption with wildcards schemes.

Definition 4 . 1 . 5

 415 Adaptive anonymous security (ANO-WIBE)[START_REF] Abdalla | Generalized Key Delegation for Wildcarded Identity-Based and Inner-Product Encryption[END_REF]. An identity-based encryption with wildcards scheme is said to satisfy adaptive anonymous security if all PPT adversaries A have at most negligible advantage in winning the game presented in Figure 4.2, where A's advantage is defined as Adv AN O-W IBE A (λ) := Pr b ′ = b -1/2for any λ ∈ N.

Figure 4 . 2 :

 42 Figure 4.2: Adaptive anonymous security game for identity-based encryption with wildcards schemes.

else 6 :j

 6 v j ← 0 and v j+1 ← 0 ← j + 2, i ← i + 1 9: end while 10: return v We present in Figure4.3 how both algorithm work on an example.

Figure 4 . 3 :

 43 Figure 4.3: ExtendingKeyPattern and ExtendingCtPattern on a example.

Figure 4 . 4 :

 44 Figure 4.4: Generic construction of anonymous identity-based encryption with wildcards scheme from inner product encryption scheme.

Figure 4 . 5 :

 45 Figure 4.5: The key generation interactive protocol.

  | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 SETUP: C on input (λ, L) runs Setup(λ, L) to get pk, msk and gives pk to A. TOKEN or KEYQUERY: A queries oracles O BT and O BK freely. CHALLENGE: A submits two patterns P 0 and P 1 where |P 0 | = |P 1 |. C chooses b ∈ {0, 1} randomly and queries O BT on input P b . It returns blind token bt P b to A. TOKEN or KEYQUERY: A queries oracles O BT and O BK freely. GUESS: A outputs its guess b ′ and wins if b = b ′ .

Figure 4 . 6 :

 46 Figure 4.6: Adaptive privacy-preserving key generation security game for PPKG-WIBE schemes.

Figure 4 . 7 :

 47 Figure 4.7: Adaptive pattern-hiding security game for identity-based encryption with wildcards schemes.

Theorem 4 . 2 . 1 Proof 4 . 2 . 1

 421421 Pattern-hiding security implies anonymous security for WIBE schemes.Anaïs Barthoulot | PhD Thesis | University of LimogesLicence CC BY-NC-ND 3.0 We prove the contrapositive. Let B be an adversary against anonymous security, that wins with non negligible advantage ϵ and let C be a challenger for patternhiding security. We construct, in Figure4.8, an adversary A that wins the pattern-hiding security game, by using B. Let C be a challenger. • SETUP: C on input (λ, L) runs Setup(λ, L) to get pk, msk, and sends pk to A and B. • KEY QUERY: adversary B chooses a pattern P for which she requires a key and sends it to A. The latter sends P to C who answers with sk P ← KeyGen(msk, P ). • CHALLENGE: B chooses two challenge patterns P 0 , P 1 along with challenge messages m 0 , m 1 and sends them to A. The latter picks b ← {0, 1} and sends to C patterns P 0 , P 1 and message m b. C chooses b ← {0, 1} and returns ct b ← Encrypt(pk, P b , m b) to A, who sends it to B. • KEY QUERY: B may continue to issue key queries for additional pattern P . A queries C and returns to B the answer of sk P ← KeyGen(msk, P ). • GUESS: B outputs a bit b ′ to A, who outputs it as her own guess.

Figure 4 . 8 :

 48 Figure 4.8: Construction of PH-WIBE adversary from ANO-WIBE adversary.

Figure 4 . 9 :

 49 Figure 4.9: Our identity-based encryption with wildcards scheme in prime order group, with constant size ciphertext and adaptive security.

Theorem 4 . 3 . 1 Proof 4 . 3 . 1

 431431 Our first WIBE scheme is correct. We have that e(c 2 , β ′ ) = e   g sd 1 1

Theorem 4 . 3 . 2

 432 a i . Therefore multiplying the two last pairings gives 1, and user can decrypt. □ Security. The following theorem establishes the security of our new WIBE scheme. If SXDH holds then our scheme satisfies adaptive IND-WIBE-CPA.

Figure 4

 4 Figure 4.10.

a-Step 3 . 1 :

 31 i to a fresh random value in Z p . Then we prove that if an adversary can distinguish Game 2-Q from Game 2-Q ′ then we can build an adversary with non-negligible advantage against DS1 with k = 1 and n = 4. This formalized by Lemma 4.3.4. -Step 3.2: if an adversary can distinguish Game 2-Q ′ from Game 3 then we can build an adversary with non-negligible advantage against DS2 with k = 1 and n = 4, as stated in Lemma 4.3.5.

Figure 4 . 10 :

 410 Figure 4.10: Informal security proof for our constant size ciphertext identity-based encryption with wildcards scheme.

Lemma 4 . 3 . 1

 431 If there exists a PPT algorithm A such that Adv 0 A -Adv 1A is non-negligible, then there exists a PPT algorithm B with non-negligible advantage against DS1 with k = 2 and n = 4.

Proof

a i 1 .Lemma 4 . 3 . 2

 1432 This ciphertext has an additional term with coefficients in basis b 3 , b 4 , which form the vector τ 2 (1, i∈W (P ) a i ). To compute coefficients in the basis (d 3 , d 4 ) we multiply the matrix A -1 by the transpose of this vector. Since A is random, these new coefficients are uniformly random. Thus in this case the ciphertext is SF (with coefficients in the base D) and B has properly simulated Game 1 . This allows B to leverage A's non-negligible difference in advantage between Game 0 and Game 1 to achieve a non-negligible advantage against DS1.□ If there exists a PPT algorithm A such that Adv 2-(j-1) A -Adv 2-j A is nonnegligible, then there exists a PPT algorithm B with non-negligible advantage against DS2 with k = 2 and n = 4.

Proof

  Let's see that the extra coefficients in basis (b 3 , b 4 ) of the ciphertext and the extra coefficients in basis (b * 3 , b * 4 ) of the key are distributed as random vectors in the spans of (d 3 , d 4 ) and (d * 3 , d * 4 ) respectively. To express them in basis (d 3 , d 4 ) and (d * 3 , d * 4

Lemma 4 . 3 . 3

 433 If there exists a PPT algorithm A such that Adv 2-Q A -Adv 3A is nonnegligible, then there exists a PPT algorithm B with non-negligible advantage against DS1 with k = 1 and n = 4.

Lemma 4 . 3 . 4

 434 i∈W (P ) a i to a fresh random value in Z p . We denote the advantage of an algorithm A in this game by Adv Q ′ A . We first prove the following lemma. Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 If there exists a PPT algorithm A such that Adv

Lemma 4 . 3 . 5

 435 If there exists a PPT algorithm A such that Adv 2-Q ′ A -Adv 3 A is nonnegligible, then there exists a PPT algorithm B with non-negligible advantage against DS1 with k = 1 and n = 4. Proof 4.3.5 INIT:

First let us briefly

  present the ideas of the above quoted works. Let L ∈ N be the vectors length. In these works each position of the vector is associated to a different vector of the DPVS, thus they need a DPVS with dimension L. Actually they use DPVS with Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0

Figure 4 . 11 :

 411 Figure 4.11: Our identity-based encryption with wildcards scheme in prime order group, with adaptive indistinguishability and adaptive pattern-hiding security.

d 2L+i 1 ( 4 . 5 )

 145 Anaïs Barthoulot | PhD Thesis | University of LimogesLicence CC BY-NC-ND 3.0

Figure 4 . 12 :

 412 Figure 4.12: Informal security proof for our pattern-hiding identity-based encryption with wildcards scheme.

Lemma 4 . 3 . 8

 438 3.7. □ For any adversary A, Adv (2-(h-1)-4) A (λ) -Adv (2-h-1) A (λ) ≤ ϵ, for ϵ = 4/p when h = 1 and ϵ = 3/p when h ≥ 2. Proof 4.3.8 We start with the case h = 1, i.e. the proof for Adv

d 2L+i 1

 1 Anaïs Barthoulot | PhD Thesis | University of LimogesLicence CC BY-NC-ND 3.0

  2-h-3 with a change of bases and an intermediate game. However, with their change of bases D, D * to B, B * , the h-th key of our scheme can no longer decrypt the ciphertext. Thus, the adversary can distinguish the different games as in one case the h-th key decrypts the challenge ciphertext but not in the other case. That is because, with the definition of B, B * , some elements of D (resp. D * ) are now linear combination of elements of B (resp. B * ). Thus, the set -W (P b ) ∩ I is no longer equal to ∅ (the decryption condition) but is equal to -W (P b ).

  are uniformly distributed for the position different of 0 and independent of the other variables except with probability 3/p . Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 Similar as above, we see that sk (j) j∈[Q] and c 2 can be expressed as keys and ciphertext in two ways, in Game 2-h-3 over bases (D, D * ) and in Game 2-h-2 ′ over bases (B, B * ). Thus Game 2-h-3 can be conceptually changed to Game 2-h-2 ′ except with probability 2 p |I| + 3/p. Combining both, we obtain lemma 4.3.10. □ Lemma 4.3.11 For any adversary A, there exists a probabilistic adversary B, whose running time is essentially the same as that of A, such that for any security parameter λ,

Proof 4 . 3 . 11

 4311 We construct a probabilistic adversary B against Problem 3 using an adversary A in a security game (Game 2-h-3 or Game 2-h-4 ) as a black box as follows.INIT: B is given an integer h and a Problem 3 instance, (Γ, D, D * , h * β,i , e i , f i i∈[n] ).

  answers normal keys using D * of the Problem 3 instance. Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 CHALLENGE: when B receives an encryption query with the challenge plaintext m and patterns P 0 , P 1 from A, B computes the challenge ciphertext (c 1 , c 2 ) such that

99 Chapter 4 -

 994 Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 First Cryptographic Tool: Identity-Based Encryption with Wildcards = g αd

Figure 4 . 13 :

 413 Figure 4.13: Informal indistinguishability security proof for our pattern-hiding identity-based encryption with wildcards scheme.

  Thesis | University of Limoges Licence CC BY-NC-ND 3.0 Game 2-k ) as a black box as follows. INIT: B is given a Problem 2 bis instance (Γ, D, D * , h * β,i , e i } i∈[n] ).

s 1 and c 2 = g s 1 d 0 +s 2 d 4L+1 1 •-W

 1 : when B gets challenge plaintexts m 0 , m 1 and pattern P * from A, B calculates and returns (c 1 , c 2 ) such that c 1 = m b • e(g 1 , g 2 ) αd 0 •d * 0 i∈ (P * ) e i , where e i are from the Problem 2 bis instance, s 1 , s 2 ← Z p and b ∈ {0, 1}.

z i,j d L+j 1 Anaïs 1 where s 1

 111 Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 = g s 1 d 0 +s 2 d 4L+1 +ω i∈ -, s 2 , ω ∈ Z p , tj = i∈ -W (P * ) τ z i,j and ( t1 , • • • , tL ) ← Z L p \ {0} are independently uniform.

3L+j 2 where

 2 xj = i∈I ξ i u i,j and (x 1 , • • • , xL ) ← Z L p \ {0}. Since Z = (U -1 ) ⊤ where Z = (z i,j ) and U = (u i,j ), we should verify the independence of coefficient vectors t = ( t1 , • • • , tl ) in c 2 and x = (x 1 , • • • , xl ) in sk P . Notice that we can rewrite t and x respectively as -→ y • U and -→ x • Z, where -→ y and -→ x are vectors such that -

( 2 -

 2 (k-1)) A (λ), and is also equal to Pr 0 = Pr [B(∆, t) → 0|β = 0]. Similarly, when β = 1, we see that the advantage of A in the above game is equal to Adv

( 2 Lemma 4 . 3 . 17

 24317 -k) A (λ), and is Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 also equal to Pr 1 = Pr [B(∆, t) → 1|β = 1]. Therefore, Adv (2-(k-1)) A (λ) -Adv (2-h) A (λ) ≤ |Pr 0 -Pr 1 | + 1/p = Adv P 2 b B (λ) + 1/p. This completes the proof. □ For any adversary A, Adv

Figure 4 . 14 :

 414 Figure 4.14: Abdalla et al. [3] 's anonymous WIBE scheme.

jFigure 4 . 15 :

 415 Figure 4.15: Randomization of ExtendingKeyPattern algorithm.

Note 4 . 3 . 3

 433 In order to make the above work, PAC must know a part of the secret key, i.e. she must knowd * 1 , • • • , d * 2n .

  e, p) and run Dual(Z 4L+3 p ) to get two dual pairing vector spaces (D, D * ). The master secret key is msk = (g

Figure 4 . 16 :Theorem 4 . 3 . 6

 416436 Figure 4.16: Our privacy-preserving key generation identity-based encryption with wildcards scheme.

  randoms a, b, c ← Z p and b ′ ∈ {0, 1} randomly. If b ′ = 0, it sets t = g ab 2 , and t = g ab+c 2 otherwise. It sends (Γ, g a 2 , g b 2 , t) to A. The latter gives Γ to B, who chooses (D, D * ) ← Dual(Z 4L+3 p ) and sends d * 1 , • • • , d * 2L to A.

  g T , p, e) and sends it to A who sends it to B. The latter chooses (D, D * ) ← Dual(Z 4L+3 p ) and sends d * 1 , • • • , d * 2L to A, who sends it to C.

Combining lemmas 4 . 3 .

 43 19 and 4.3.20, we prove Theorem 4.3.6. Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0

Note 5 . 1 . 1

 511 If b ̸ = ∞ then we say that the accumulator is bounded[START_REF] Ho Au | Compact E-Cash from Bounded Accumulator[END_REF].

Figure 5 . 1 :

 51 Figure 5.1: Collision resistance security game.

Figure 5 . 2 :Theorem 5 . 2 . 1 AProof 5 . 2 . 1

 52521521 Figure 5.2: Symmetric accumulators one-wayness security game.

Figure 5 . 3 :

 53 Figure 5.3: Relations between security properties of accumulators.

  - 1

 1 Para ← Setup(λ); (Sta, Wit) ← A(Para); Proof ← Prove(Para, Sta, Wit) : Verify(Para, Sta, Proof) = 1 if (Para, Sta, Wit) ∈ R  Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 is negligible. Soundness means that for every PPT adversary A, Pr Para ← Setup(λ); (Sta, Proof) ← A(Para) : Verify(Para, Sta, Proof) = 0 if (Para, Sta, Wit) / ∈ R, ∀Wit -1 is negligible.

Definition 5 . 2 . 5

 525 Witness indistinguishability[START_REF] Groth | Short Pairing-Based Non-interactive Zero-Knowledge Arguments[END_REF][START_REF] Acar | Revocation for Delegatable Anonymous Credentials[END_REF]. A proof system is said to satisfy witness indistinguishability if the advantage of any malicious verifier V of winning the security game presented in Figure5.4 is negligible. Let P be an honest prover. • SETUP: P, on input security parameter λ and relation R, runs Setup(λ) to get Para and send it to V along with R. • CHALLENGE: V choose a statement Sta along with two witnesses Wit 0 and Wit 1 and sends (Sta, Wit 0 , Wit 1 ) to P. The latter chooses b ← {0, 1} and runs Prove(Para, Sta, Wit b ) to get Proof b . P sends Proof b to V. • GUESS: V outputs a guess bit b ′ ∈ {0, 1} and wins the security game if b ′ = b.

Figure 5 . 4 :

 54 Figure 5.4: Adaptive witness indistinguishability security game for proof systems.

Anaïs Barthoulot |Definition 5 . 2 . 7

 Barthoulot527 PhD Thesis | University of LimogesLicence CC BY-NC-ND 3.0 delegatable (non-)membership proof. That is why we now rewrite our definition of accumulators (Definition 5.1.1, in Section 5.1) to highlight the underlying proof systems. Static universal accumulator with proof systems. We consider (Setup, ProveMem, VerifyMem) and (Setup, ProveNM, VerifyNM) respectively a membership and a non-membership proof system along with their associated algorithms CompMemWit and CompNMWit. A static universal cryptographic accumulator scheme is a tuple of efficient algorithms defined as follows:• Gen(λ, b): this generation algorithm takes as input a security parameter λ and a bound b ∈ N ∪ {∞} such that if b ̸ = ∞ then the number of elements that can be accumulated is bounded by b. It returns a key pair (sk acc , pk acc ), where sk acc = ∅ if no trapdoor exists and pk acc contains the parameter b.

  acc , pk acc ) ← Gen(λ); (y 0 , y 1 ) ← D; Type ← A, (Del y , req) ← Dele(pk acc , y 0 , Type); b ← {0, 1} ; (Del y b , req b ) ← Dele(pk acc , y b , Type); b ′ ← A(pk acc , Del y , Del y b ) : b

2 Anaïs(

 2 sk acc , pk acc ) ← Gen(λ); (Type, x) ← A 1 (pk acc ); (Del y , req) ← Dele(pk acc ), x, Type); (Del 0 y , req 0 ) ← Dele(pk acc ), x, Type); (Del 1 y , req 1 ) ← Rede(pk acc , Del y , req); b ← {0, 1} ; b ′ ← A 2 (pk acc , Del y , Del b y

((

  sk acc , pk acc ) ← Gen(λ); (Type, x) ← A(pk acc ); (Del y , req) ← Dele(pk acc , x, Type) : Vali(pk acc , Del y , req) = 1 if x ∈ D sk acc , pk acc ) ← Gen(λ); Del ′ ← A(pk acc ) : Vali(pk acc , Del ′ Del|Del ← Dele(pk acc , x ′ , Type); x ′ ∈ D means that the delegation key Del ′ does not correspond to a delegation key correctly computed, for any element x ′ of the domain D.

(

  sk acc , pk acc ) ← Gen(λ); (Sta, Wit) ← A(pk acc ); Proof ← Prove(pk acc , Sta, Wit) : PSVerify(pk acc , Sta, Proof) = 1 if (pk acc , Sta, Proof) ∈ R    and Pr (sk acc , pk acc ) ← Gen(λ); (Sta, Proof) ← A(pk acc ) : PSVerify(pk acc , Sta, Proof) = 0 if (pk acc , Sta, Proof) / ∈ R, ∀t t

Figure 5 . 5 :

 55 Figure 5.5: Unforgeability of private evaluation security game.

Figure 5 . 6 :

 56 Figure 5.6: Collision resistance security game for dually computable accumulators.

Figure 5 . 7 :144Chapter 5 -

 575 Figure 5.7: Nguyen's [113] cryptographic accumulator scheme.

  3), with dimension n = 2. Let D, D * be two dual orthonormal bases such that D = (d 1 , d 2 ) and D * = (d * 1 , d * 2 ). By playing with the bases d 1 , d * 1 , d 2 and d * 2

Figure 5 . 8 :

 58 Figure 5.8: Our universal accumulator scheme, with private evaluation and public witness generation.

  X [Z] = x∈X (x + Z), and Ch I [Z] = x∈X (x + Z). Let acc X ← Eval(sk acc , X ) and nmwit I = (W 1 , W 2 ) ← WitCreate Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0

Figure 5 . 9 :

 59 Figure 5.9: Construction of q-SBDH adversary from collision resistance adversary.

d * 2 ais i 2

 2 Anaïs Barthoulot | PhD Thesis | University of LimogesLicence CC BY-NC-ND 3.0

c i s i 1 ,c i s i 1 ,

 11 wit I = witp I . • Verify(pk acc , acc X , wit I , I): let {c i } i=0,••• ,q be the coefficients of the polynomial Ch I [Z] = x∈I (x + Z) and return 1 if e(acc X , g wit I ), 0 otherwise. • PublicVerify(pk acc , accp X , witp I , I): let {c i } i=0,••• ,q be the coefficients of the polynomial Ch I [Z] = x∈I (x + Z) and return 1 if e(g d 1 1, accp X ) = witp I ), 0 otherwise.

Figure 5 . 10 :Theorem 5 . 4 . 4 Lemma 5 . 4 . 1 Proof 5 . 4 . 4

 510544541544 Figure 5.10: Our dually computable accumulator scheme.

Lemma 5 . 4 . 4

 544 Our dually computable accumulator satisfies correctness of duality. Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0

Definition 6 . 1 . 3

 613 Adaptive indistinguishability (IND-BE)[START_REF] Gay | Tight Adaptively Secure Broadcast Encryption with Short Ciphertexts and Keys[END_REF]. A broadcast encryption scheme is said to satisfy adaptive indistinguishability security if all PPT adversaries A have at most negligible advantage in winning the game presented in Figure6.1, where A's advantage is defined as Adv IND-BE A (λ) := Pr b ′ = b -1/2 . Let C be a challenger. SETUP: C on inputs (λ, N ) runs Setup(λ, N ) to generate pk and msk, and gives pk to A. KEY QUERY: A issues queries to C for index i ∈ [N ]. C returns sk i ← KeyGen(msk, i). CHALLENGE: A selects two challenge messages m 0 , m 1 and a challenge set S * ⊆ [N ] of users. A sends m 0 , m 1 and S * to C. The latter picks b ∈ {0, 1} randomly and computes ct * ← Encrypt(pk, S * , m b ) which is returned to A. KEY QUERY: A makes queries for index i ∈ [N ]. C returns sk i ← KeyGen(msk, i) to A. GUESS: A outputs her guess b ′ ∈ {0, 1} for b, and wins the game if b ′ = b and if, for all index i ∈ [N ] for which a key was queried, the condition i / ∈ S * holds.

Figure 6 . 1 :

 61 Figure 6.1: Adaptive indistinguishability security game for broadcast encryption schemes.

SETUP: C

  on inputs λ, N runs Setup(λ, N ) to generate pk and msk, and gives pk to A. KEY QUERY: A issues queries to C for index i ∈ [N ]. C returns sk i ← KeyGen(msk, i). CHALLENGE: A selects two challenge messages m 0 , m 1 and two distinct challenge sets S 0 , S 1 ⊆ [N ] of users. A passes m 0 , m 1 and S 0 , S 1 to C. The latter picks b ∈ {0, 1} randomly and computes ct * ← Encrypt(pk, S b , m b ) which is returned to A. KEY QUERY: A continues to make queries for index i ∈ [N ] C answers sk i ← KeyGen(msk, i) to A. GUESS: A outputs her guess b ′ ∈ {0, 1} for b, and wins the game if b ′ = b and if, for all index i ∈ [N ] for which a key was queried, the condition i /

Figure 6 . 2 :

 62 Figure 6.2: Adaptive anonymous security game for broadcast encryption schemes.

1 . 6 . 1 . 7

 1617 and every honestly generated keys (msk, pk, {sk 1 , • • • , sk N }) ← Setup(λ, N ): Pr [Decrypt(pk, sk i , S, Encrypt(pk, S, m, ind)) = m] = Definition Message-hiding security (MH-AugBE) [77]. An augmented broadcast encryption scheme is said to satisfy adaptive message-hiding security if all PPT adversaries A have at most negligible advantage in the game presented in Figure 6.3, where C is a challenger and A's advantage is defined as Adv MH-AugBE A (λ) := Pr b ′ = b -1/2 . SETUP: C on inputs λ, N runs Setup(λ, N ) to obtain msk, pk, {sk i } i∈[N ] and gives pk to A. KEY QUERY: A chooses an index i ∈ [N ] and sends it to C, who responds with sk i . CHALLENGE: A chooses two challenge messages m 0 , m 1 and a challenge set S * and sends it to C. C chooses b ∈ {0, 1} randomly, runs ct * ← Encrypt(pk, S * , m b , N + 1) and gives ct * to A. KEY QUERY: A chooses an index i ∈ [N ] and sends it to C, who responds with sk i . GUESS: A outputs her guess b ′ ∈ {0, 1} for b, and wins the game if b ′ = b.

Figure 6 . 3 :Definition 6 . 1 . 8

 63618 Figure 6.3: Adaptive message-hiding security game for augmented broadcast encryption schemes.

Figure 6 . 4 :

 64 Figure 6.4: Adaptive index-hiding security game for augmented broadcast encryption schemes.

Definition 6 . 1 . 9

 619 Anonymous augmented broadcast encryption (ANO-AugBE). An augmented broadcast encryption scheme is said to be adaptively anonymous if all PPT adversaries A have at most negligible advantage in the game presented in Figure 6.5, where C is a challenger and A's advantage is defined as Adv ano-augbe A (λ) := Pr b ′ = b -1/2 . SETUP: C on inputs λ, N runs Setup(λ, N ) to obtain pk, msk, {sk i } i∈[N ] , and gives pk to A. KEY QUERY: A can issue queries to the challenger for index i ∈ [N ]. C responds with sk i . CHALLENGE: A selects a challenge message m, two distinct challenge sets S 0 , S 1 ⊆ [N ] of users and a challenge index ind ∈ [N + 1]. A passes m, S 0 , S 1 , ind to C. The latter picks b ∈ {0, 1} randomly and computes ct * ← Encrypt(pk, S b , m, ind) which is returned to A. KEY QUERY: A makes queries for index i ∈ [N ] C responds with sk i . GUESS: A outputs her guess b ′ ∈ {0, 1} for b, and wins the game if b ′ = b and if, for all index i ∈ [N ] for which a key was queried, if i ≥ ind then the condition i ∈ S 0 ∩ S 1 holds.

Figure 6 . 5 :

 65 Figure 6.5: Adaptive anonymous security game for augmented broadcast encryption schemes.

  and sends pk to A, and B. KEY QUERY: B chooses i ∈ [N ], sends it to A who sends it to C. The later sends sk i to A who sends it to B. CHALLENGE: B chooses a challenge message m, a challenge set S * of users and a challenge index ind ∈ [N ] and sends m, S * , ind to A. The latter creates the sets S 0 = S * ∩{ind, • • • , N } and S 1 = S * ∩{ind + 1, • • • , N }. A sends m, S 0 , S 1 to C. C chooses b ← {0, 1} randomly and sets ct * ← Encrypt(pk, S b , m, 1). It sends ct * to A who sends it to B. KEY QUERY: A and B act like in the previous KEY QUERY step. C sends sk i to A who sends it to B. GUESS: B outputs her guess b ′ to A, who outputs it as her own guess.

Figure 6 . 6 :

 66 Figure 6.6: Construction of ANO-AugBE adversary from IH-AugBE adversary.

Figure 6 . 7 :

 67 Figure 6.7: Generic construction of broadcast encryption scheme from identity-based encryption with wildcards scheme.

Figure 6 . 9 :

 69 Figure 6.9: Construction of PH-WIBE-CPA adversary from ANO-BE adversary.

Figure 6 . 13 :

 613 Figure 6.13: Our adaptively secure broadcast encryption scheme in prime order group, with constant size ciphertext.

Figure 6 . 14 :

 614 Figure 6.14: Our adaptively anonymous augmented broadcast encryption scheme in prime order group.

  Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 presented in Figure 5.10, in Section 5.4.2. • Gen(λ, q): run a bilinear group generation algorithm to get Γ = (p, G 1 , G 2 , G T , e, g 1 , g 2 ). Then choose a random s ← Z * p , and run Dual(Z 2 p ) to get D = (d 1 , d 2 ), D * = (d * 1 , d * 2 ). Let ψ ∈ Z * p be the random such that d 1 •d * 1 = d 2 •d * 2 = ψ. Set sk acc = (s, D, D * ), and

Figure 6 . 16 :

 616 Figure 6.16: The first intermediate accumulator scheme.

(

  publicly known), anyone can compute(e(g 1 , g 2 ) ψα Q i=0 m i s i) x 0 +y 0 . As x 0 , y 0 are publicly known, anyone can recover e(g 1 , g 2 ) ψα Q i=0 m i s i = H and thus the message.

a i s i 1 . 1 2

 11 During decryption we compute e(acc X , aux 2 ) where aux 2 = g -α 1 α 2 d * is given in the ciphertext, for α 1 , α 2 ← Z p . As aux 2 is the only part of the ciphertext to interact with the secret key, it is the only part that need semi-functional form. To define SF keys and aux 2 , we need to double the dimension of the used DPVS: we now have D = (d 1 , d 2 , d 3 , d 4 ) and D * = (d * 1 , d * 2 , d * 3 , d * 4 ), where d 3 , d 4 , d * 3 , d * 4

τ 1 d * 1 2 or to g τ d * 1 +τ 2 d * 3 2 ,

 12 to build either aux 2 or aux (SF ) 2

Figure 6 . 17 :

 617 Figure 6.17: The second intermediate accumulator scheme.

Theorem 6 . 2 . 1 Proof 6 . 2 . 1

 621621 Our ciphertext policy attribute-based encryption scheme is correct. We have that e(aux δδ ′ 1 , ele 1 • ele ξ 2 ) = e((g α 2 d 3 (x 0 +y 0 ) 1

Figure 6 . 18 :

 618 Figure 6.18:The dually computable accumulator used in our CP-ABE scheme.

.

  Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 Return msk, pk. • KeyGen(pk, msk, Υ): let k ∈ N be the number of attributes in Υ. Compute p 1 , • • • , p 2 k -1 all the non-empty subsets of Υ and set X

2 and H = e(g d 3 1 ,= g α 2 d 3 (x 0 +y 0 ) 1 and aux 2

 21312 accp Y ) α 1 α 2 .-Anticipation of the witnesses and auxiliary information computation: set aux 1 = g-d * 1 α 1 α 2 +z(γd * 2 +d * 3 ) 2

Figure 6 . 19 :

 619 Figure 6.19: Our adaptively secure ciphertext policy attribute-based encryption scheme with constant size ciphertexts and secret keys.

Therefore

CHALLENGE:

  At some point, A sends to B two challenge messages m 0 , m 1 and a challenge policy Π * = π * 1 ∨ • • • ∨ π * l . B chooses a random bit b ∈ {0, 1} and encrypts m b under Π * as follows: z, α 1 , α 2 ← Z p and accp Y = g b

2 and H = e(g d 3 1 ,= g α 2 d 3 (x 0 +y 0 ) 1 and aux 2

 21312 accp X ) α 1 α 2 .-Anticipation for the witnesses and auxiliary information computation: set aux 1 = g-d * 1 α 1 α 2 +z(γd * 2 +d * 3 ) 2

Figure 6 . 20 :

 620 Figure 6.20: Our adaptively secure key policy attribute-based encryption scheme with constant size ciphertexts and secret keys.

Anaïs Barthoulot |201Chapter 6 -

 Barthoulot6 PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 Applications to Data Sharing

Figure 6 . 21 :

 621 Figure 6.21: Actors and Architecture.

Figure 6 . 22 :

 622 Figure 6.22: Our basic protocol.

Figure 6 . 23 :

 623 Figure 6.23: Our detailed protocol.

Figure 6 . 24 :

 624 Figure 6.24: ExtendingKeyPatternRandomized and ExtendingCtPattern on a example.

7 Contents 7 . 1

 771 Conclusion Our Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 7.2 Locally Verifiable Aggregate Signatures and Accumulators . . . . . . 214 Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0

  : cryptography, attribute-based encryption, (augmented) broadcast encryption, identity-based encryption with wildcard, cryptographic accumulators Univ. de Limoges, CNRS, XLIM, UMR 7252, F-87000 Limoges, France

10 Fixed argument dual pairing vector spaces inversion problem

  Proofs of Lemmas 2.3.6 and 2.3.7 are done in Appendix C of our paper[START_REF] Barthoulot | Augmented) Broadcast Encryption from Identity-Based Encryption with Wildcard[END_REF]. They are based on[START_REF] Okamoto | Fully Secure Functional Encryption with General Relations from the Decisional Linear Assumption[END_REF]'s proofs, and the idea is to prove that Problem 1 bis and Problem 2 bis hold if Problem 1 and Problem 2 hold respectively.We now introduce a new security problem for dual pairing vector spaces: the fixed argument dual pairing vector spaces inversion problem. This problem is the first computational problem for dual pairing vector spaces, and can be reduced to CDH in G 2 (Definition 2.2.5). (FA-DPVS-I). Let Γ = (p, G 1 , G 2 , G T , e, g 1 , g 2 ) be an asymmetric bilinear pairing group, (D, D

	Definition 2.3.

Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 * ) ← Dual(Z 2 p ) be two dual orthonormal bases where

  where the probability is taken over the random choice of generators (g 1 , g 2 ) ∈ G 1 × G 2 , the random choice of a, b ∈ Z p and the random bits consumed by A. If CDH in G 2 holds, then the intermediate problem holds. We prove the contrapositive. Let B be an adversary that breaks the intermediate problem with non-negligible advantage. We build A that usesB to break CDH in G 2 . A is given (Γ, g a 2 , g b 2 ). Using type 2 pairings, there exists ϕ from G 2 to G 1 .

	Theorem 2.3.2 Proof 2.3.2 Then A gives
	to B: (Γ, ϕ(g a 2 ) = g a 1 , g a 2 , g b 2 ). The latter answers with g ab 1 and A returns ϕ(g ab 1 ) = g ab 2
	as her answers. Notice that A's advantage is equal to B's advantage, therefore it is
	non-negligible.
		problem
	consists, (Γ, g a 1 , g a 2 , g b 2 ), in computing g ab 1 . An adversary A solves the intermediate
	problem with advantage ϵ if
	Adv IP A := Pr A(Γ, g a 1 , g a 2 , g b 2 ) = g ab 1	≥ ϵ

Definition 2.3.11 Intermediate problem (IP). Let Γ = (p, G 1 , G 2 , G T , e, g 1 , g 2 ) be an asymmetric bilinear pairing group and a, b be randoms in Z p . The intermediate Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 □ Note 2.3.3 Notice that the above proof is possible only when considering type 2 pairings (Section 2.2.2).

Definition 3.4.2 Correctness. A

  signature scheme is said to be correct if for all security parameter λ, every honestly generated key pair (sk, vk) ← Setup(λ), every message m:

	Pr [Verify(vk, Sign(sk, m), m) = 1] = 1.
	Definition 3.4.3 Adaptive unforgeability (Unf). A signature scheme is said to sat-
	isfy adaptive unforgeability security if all PPT adversaries A have at most negligible
	advantage in the game presented in Figure 3.4, where A's advantage is defined as
	• Verify(vk, σ, m): the verification algorithm takes as input a verification key vk, a
	signature σ and a message m. It returns 1 if the signature σ is a valid signature of
	message m, and return 0 otherwise.

4.1.1 Definitions Definition 4.1.1 Pattern [

  4,[START_REF] Kim | Scalable Wildcarded Identity-Based Encryption[END_REF]. A pattern P is a vector (P 1 , • • • , P L ) ∈ U L , where U is a set with a special wildcard symbol "⋆", and L ∈ N.

	Let P	′ = (P	′ 1 , • • • , P L ) and P = (P 1 , • • • , P L ) be two patterns. P ′	′ belongs to P , denoted
	P	′ ∈ ⋆ P , if and only if ∀i ∈ {1, • • • , L}, (P	′ i = P i ) ∨ (P i = ⋆). P	′ matches P , denoted
	P	′ = ⋆ P , if and only if ∀i ∈ {1, • • • , L}, (P	′ i = P i ) ∨ (P i = ⋆) ∨ (P	′ i = ⋆). Notice that if
	P	′ ∈ ⋆ P then P	′ = ⋆ P .
	Notation 4.1.1 For a pattern P ∈ U L , W (P ) denoted the set of all indices i ∈ {1, • • • , L}
					-	-
	such that P i = ⋆, and	W (P ) is the complementary set. Clearly W (P ) ∩	W (P ) = ∅ and
				-
	W (P ) ∪	W (P ) = {1, • • • , L}.

Definition 4.1.2 Identity-based encryption with wildcards

				(WIBE) [4, 85]. An identity-
	based encryption with wildcards scheme consists of four algorithms:
	• Setup(λ, L): the setup algorithm takes as input a security parameter λ ∈ N and
		pattern length L ∈ N. It outputs a public key pk and a master secret key msk.
	• KeyDer(msk, P ): the key derivation algorithm takes as input a master secret key
		msk and a pattern P and creates a secret key sk P for P . It can also take as input
		a secret key sk P ′ for a pattern P any pattern P ∈ ⋆ P ′ .	′ instead of msk and then derives a secret key for
	• Encrypt(pk, P , m): the encryption algorithm takes as input a public key pk, a
		pattern P and a message m. It outputs ciphertext ct of message m, for pattern P .
	• Decrypt(sk P , ct, P	′ ): the decryption algorithm takes as input a user secret key
		sk P for a pattern P and a ciphertext ct for a pattern P	′ , and it returns a message
		m	′ .
	Definition 4.1.3 Correctness [85]. An identity-based encryption with wildcards scheme
	is said to be correct if for all security parameter λ ∈ N, all integer L ∈ N, every honestly
	generated key pair (pk, msk) ← Setup(λ, L), every messages m, and every patterns
	P , P	′ ∈ U L , such that P	′ = ⋆ P :
			Pr Decrypt(KeyDer(msk, P	′ ), Encrypt(pk, P , m)) = m = 1.
	Definition 4.1.4 Adaptive indistinguishability security (IND-WIBE) [4, 85]. An
	identity-based encryption with wildcards scheme is said to satisfy adaptive indis-
	tinguishability security if all PPT adversaries A have at most negligible advantage
	in winning the game presented in

1 and u j+1 ← P i 5: else 6: u j ← 0 and u j+1 ← 0 7: end if 8: j ← j + 2, i ← i + 1 9: end while 10: return u Algorithm 4.2 ExtendingCtPattern

	Input: ciphertext pattern P of length n
	Output: pattern v of length 2n
	1: i ← 1, j ← 1
	2: while i ≤ n, j ≤ 2n do
	3:

  3.1. • Step 2: we show that if an adversary can distinguish Game 2-(j-1) from Game 2-j we can build an adversary with non-negligible advantage against DS2 with k = 2 and n = 4. This is resumed in Lemma 4.3.2. • Step 3: we prove that if an adversary can distinguish Game 2-Q from Game 3 then we can build an adversary with non-negligible advantage against DS1 with k = 1 and n = 4. This is traduced by Lemma 4.3.3. We actually prove this in two steps, by randomizing each appearance of s in the c 2 term of the ciphertext, thereby severing its link with the blinding factor. The end result is a semi-functional encryption of a random message. As a first step, we consider an intermediary game, called Game 2-Q ′ , that is exactly like Game 2-Q , except that in the c 2 term of the challenge ciphertext the coefficient of d 2 is changed from being s

i∈W (P )

  Let d 0 , • • • , d 4L+1 denote the elements of D and d * 0 , • • • , d * 4L+1 denote the elements of D * . Pick α ← Z p . The public key is computed as: pk = (Γ, e(g 1 , g 2 ) αd 0 .d * 0 , g d 0 1 , g

	d 4L+1
	1

PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 • Setup(λ, L): generate an asymmetric bilinear pairing group Γ = (p, G 1 , G 2 , G T , g 1 , g 2 , e) for prime order p. Sample random dual orthonormal bases (D, D * ) ← Dual(Z 4L+2 p

).

  2-h-2 over bases (D, D * ) and in Game 2-h-2 ′ over bases (B, B * ). Thus, Game 2-h-2 can be conceptually changed to Game 2-h-2 ′ , except with probability , c 1 , c 2 ) in Game 2-h-3 and that in Game 2-h-2 ′ are equivalent except with negligible probability. As above, we set new bases (B, B * ). The h-th queried key sk(h) in Game 2-h-3 is expressed as above in bases D * and B * , and the part of the ciphertext c 1 in Game 2-h-3 is given as above. Element c 2

	2 p |I| + 2/p.
	Now let us see that the distribution (pk, sk (j)
	j∈[Q]

in Game 2-h-3 is expressed over bases D and B as g s 1 d 0 +s 2 d 4L+1 +s 3 i∈ -W (P b )

  2 p |I| + 3/p.In the light of the adversary's view, both (D, D * ) and (B, B * ) are consistent with public key pk. Therefore, {sk P j } j∈[Q] , c 1 , c 2 can be expressed as keys and ciphertext in two ways, in Game 2-Q-4 over bases (D, D

* ) and in Game 3 over bases (B, B * ).

Thus, Game

2-Q-4 can be conceptually changed to Game 3 . □ Combining all theses proofs, we obtain that any adversary has no advantage in winning the security game. Adding to these the fact that Problem 1, Problem 2 and Problem 3 hold if XDLin1, XDLin2 hold, we have proven Lemma 4.3.6.

  we build an adversary against Problem 2 bis (Definition 2.3.9) using an adversary that distinguishes Game 2-(k-1) from Game 2-k , as stated in Lemma 4.3.16.• Step 3: we prove that the advantage of an adversary in winning Game 2-Q

1 then an adversary against Problem 1 bis (Definition 2.3.8) can be created. This is formalized by Lemma 4.3.14. • Step 2:

  XDLin1, XDLin2 hold, we have proven Lemma 4.3.13. Combining Lemmas 4.3.6 and 4.3.13 we proved Theorem 4.3.4.

1 bis and Problem 2 bis hold if Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0

  by replacing ExtendingKeyPattern by ExtendingKeyPatternRandomized. If DDH holds in G 2 , then the advantage of any adversary to win Game 1 is negligible. We prove the contrapositive. Let B be an adversary against Game 1 , that wins with non negligible advantage. We construct below an adversary A against DDH in G 2 , that wins with non negligible advantage.

	Lemma 4.3.19 Proof 4.3.17

• SETUP: challenger

  .2.2 Relations Between Security Properties . . . . . . . . . . . . . 5.2.3 Discussion About Undeniability . . . . . . . . . . . . . . . . . 5.2.4 Discussion About Delegatable Accumulators . . . . . . . . . . 5.2.5 Discussion on Accumulator Applications . . . . . . . . . . . . 5.3 Our Contributions to Accumulators' Formalism . . . . . . . . . . . . . Our Dually Computable Accumulator . . . . . . . . . . . . . . 151 5.5 Conclusion of This Chapter . . . . . . . . . . . . . . . . . . . . . . . . 154

	5.3.1 New Security Property of Unforgeability of Private Evaluation
	5.3.2 Introducing Dually Computable Accumulators . . . . . . . . .
	5.4 Another Contribution: Our New Accumulators Schemes . . . . . . . .

Contents 5.1 Cryptographic Accumulators . . . . . . . . . . . . . . . . . . . . . . . 5.1.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1.2 Overview And State of The Art . . . . . . . . . . . . . . . . . 5.2 Discussions on Accumulators . . . . . . . . . . . . . . . . . . . . . . 5.2.1 Symmetric Accumulators . . . . . . . . . . . . . . . . . . . . . 55.4.1 Our Universal Accumulator with Private Evaluation and Public Witness Generation . . . . . . . . . . . . . . . . . . . . . . . . Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 5.4.2 Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0

Table 5 . 2 :

 52 Comparison of evaluation and witness creation according to the type of accumulator instantiation.

	Type	Evaluation Witness Generation
	Hash based	Public	Public
		Public	Public
	Lattices	Public	Private
	Number Theoretic	Public	Public 4
	Pairing based	Public	Public
		Private	Private

Table 5 .3: Classification

 5

of accumulator security properties.

  ). It outputs Proof and req = {Type, Sta}. • Vali(pk acc , Proof, req) : if the verification algorithm of PSVerify on inputs (Para, Sta, Proof outputs 1, the algorithm outputs 1 otherwise it outputs 0. • Rede(pk acc , Proof, req): if Vali(pk acc , Proof, req) = 1, it runs RandProof(pk acc , Sta, Proof) to get a randomized proof Proof ′ . • CompProof(pk acc , Proof y , req, X , acc X , ): if X , x |= req, where x is the witness used to create Proof y , it uses homomorphic property of the proof system to obtain a new proof Proof

	′

Table 5 . 4 :

 54 Comparison between Nguyen's accumulator and ours.

	Operation	Nguyen [113]	Ours
	Evaluation		(x+s)			d1	(x+s)
		acc X = g x∈X 1	acc X = g	1	x∈X
	Membership		(x+s)		d * 2	(x+s)
	Witness	mwit x = g	x∈X \{x} 2	mwit x = g	2	x∈X \{x}	.
	Non-Membership Witness	nmwit x = (W 1 , W 2 ) = (g 2 q1(s)	q2(s) 2 , g

  .2.2 CP-ABE From Dually Computable Accumulators: The Different Steps of Our Construction . . . . . . . . . . . . . . . . . . . . Use Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.1 Presentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.2 Our Generic Solution . . . . . . . . . . . . . . . . . . . . . . . 6.3.3 Our Concrete Solution: An Anonymous PPKG-WIBE . . . . .

	6
	Applications to Data Sharing
	6.2.3 Our CP-ABE Scheme From Dually Computable Accumulator .
	6.2.4 Our KP-ABE Scheme From Dually Computable Accumulator .
	6.3

Contents 6.1 Broadcast Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1.1 Definitions and Properties . . . . . . . . . . . . . . . . . . . . 6.1.2 Our Contribution: Anonymous Augmented Broadcast Encryption161 6.1.3 From WIBE to (Aug)BE: Our Generic Constructions . . . . . . 6.1.4 Concrete (Augmented) Broadcast Encryption Schemes . . . . 6.2 Attribute-Based Encryption . . . . . . . . . . . . . . . . . . . . . . . . 6.2.1 Definitions and Properties . . . . . . . . . . . . . . . . . . . . 66.4 Conclusion of This Chapter . . . . . . . . . . . . . . . . . . . . . . . . Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 IN this chapter we present two advanced cryptographic schemes used for data sharing:

Table 6 . 1 :

 61 Broadcast Encryption schemes comparison; "GGM", "Sym" and "Asym" stand for "Generic Group Model", "Symmetric" and "Asymmetric" respectively. Here t ∈ N, such that t divides N .

	Scheme	|pk|	|sk i |	|ct|	Security Assumption	Model	Settings
	[38]	O(N )	O(1)	O(1) Selective	N-BDHE	GGM	Sym pairings
	[49]	O(t + N/t) O(N/t) O(t) Adaptive	k-Lin	Standard Asym pairings
	[71]	O(N 2 )	O(1)	O(1) Adaptive	k-Lin	Standard Asym pairings
	[9]	O(λ)	O(λ)	O(λ) Selective	LWE,	Standard	Lattices
						KOALA
	Ours	O(N )	O(N ) O(1) Adaptive	SXDH	Standard Asym pairings
	using lattices, but no security proof is given.

  G 1 , G 2 , G T , g 1 , g 2 , e) for prime order p. Sample random dual orthonormal bases (D, D * ) ← Dual(Z 4N +2 p ). Let d 0 , • • • , d 4N +1 denote the elements of D and d * 0 , • • • , d 4N +1 * denote the elements of D * . Pick α ← Z p . The master secret key is msk = (α, g

	Setup(λ, N ):	generate an asymmetric bilinear pairing group Γ	=
	(p,
		.2.
	Notice the augmented broadcast encryption scheme obtained from our second WIBE
	instantiation is actually the first known anonymous AugBE.

Table 6 . 2 :

 62 Augmented Broadcast Encryption schemes comparison; "Multi" and "PWE" mean respectively "Multilinear Map" and "Positional Witness Encryption".

	Scheme	Enc	|pk|	|sk i |	|ct|	Security	Model	Settings
	[40]	Algo 1	O( √ N ) O( √ N ) O( √	N ) Adaptive	GGM	Pairing c.o.
	[75]	2	Ω(N )	Ω(N 2 )	O(N ϵ ) Selective	GGM	Pairing, lattices
	[77]	1	poly(λ) poly(λ) poly(λ) Adaptive	Multi	PWE
	Ours	1	O(N 2 )	O(N )	O(N )	Adaptive Standard	Pairings p.o.

  , z 4 , t 2 , t 4 ← Z p . We easily notice that during membership verification between a normal key and a normal ciphertext, we have an extra term e(g 1 , g 2 ) ψz 2 t 2 . To remove this extra term, we can add in the key g -d 2 t 2 . But as we add an element to normal keys and one to normal ciphertexts, we have to modify the semi-functional keys and ciphertext by adding them g -d 2 t 2 -d 4 t 4

		2	SF )	rd * 1 +t 2 d * 2 +t 4 d * 4 2 = g
	where z 2 1	d * 2 z 2 2 and in the ciphertext g
				1	d * 2 z 2 +d * 4 z 4 2 and g

  In the both case, we have that d * 2 , d * 3 are randomized by τ 1 . Thus we need to define aux 2 = g

	rd * 1 +z(d * 2 +d * 3 )
	2

  Therefore, B can leverage A's non-negligible difference in advantage between these games to obtain a non-negligible advantage against DS1.□ For any PPT adversary A, Adv Game F inal

	Lemma 6.2.3 Game Nq A

and Y i for i = 1, • • • , l is a set that contains the ele-Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND 3.0 A ≤ Adv

Table 6 . 5 :

 65 Comparison of KP-ABE schemes for monotone NC 1 circuits, based on pairings. Here q is the bound on the number of attributes in the scheme, and l is the number of rows in the access matrix when the policy is expressed with LSSS matrix.

	Schemes	|pk|	|ct|	|sk|	Adaptive Security	Assumption	One-Use	Group Order	Pairing
	[78] O

Table 6 . 6 :

 66 Summary of the knowledge of each actor.Access policy secrecy.As shown above, it is important to provide the secrecy of the access policy, w.r.t. the Central Server and the Identity Provider. But what about the user? Does she need to obtain the information about the access policy? Through the following two examples we show that users and even authorized users should not learn the whole access policy.

	Actor Resource Access policy User attributes User has access Requested resource
	DO	x	x
	CS	x		x	x
	AS		x		x
	U	x	x	x	x
	IdP		x

Anaïs Barthoulot | PhD Thesis | University of LimogesLicence CC BY-NC-ND 3.0

A multilinear map is defined a bilinear map except that the map e now takes as input n elements instead of

Anaïs Barthoulot | PhD Thesis | University of LimogesLicence CC BY-NC-ND

3.0

If we do not take into account the work of[START_REF] Biryukov | Cryptanalysis of a Dynamic Universal Accumulator over Bilinear Groups[END_REF].

Actually,[START_REF] Srinivasan | Batching, Aggregation, and Zero-Knowledge Proofs in Bilinear Accumulators[END_REF] improves the dynamic property of[START_REF] Ghosh | Zero-Knowledge Accumulators and Set Algebra[END_REF]: the latter has efficient membership witness update but inefficient non-membership witness update. The former proposes a way to update nonmembership witnesses efficiently.

 4 Secret key can be given for witness generation in order to improve efficiency. Creation is still possible without it.Anaïs Barthoulot | PhD Thesis | University of LimogesLicence CC BY-NC-ND 3.0

It follows that if |Υ| = k, then |X | =

k -1. Anaïs Barthoulot | PhD Thesis | University of Limoges Licence CC BY-NC-ND

3.0

This idea is inspired by the IBE of[START_REF] Chen | Shorter IBE and Signatures via Asymmetric Pairings[END_REF].Anaïs Barthoulot | PhD Thesis | University of LimogesLicence CC BY-NC-ND 3.0

As the number of attributes in the scheme is bounded, so is the number of keys that an adversary can query.Anaïs Barthoulot | PhD Thesis | University of LimogesLicence CC BY-NC-ND 3.0

Some works are expressing their monotone boolean formula through Linear Secret Sharing Scheme (LSSS) matrix, see[START_REF] Lewko | Decentralizing Attribute-Based Encryption[END_REF] for more details on this transformation.Anaïs Barthoulot | PhD Thesis | University of LimogesLicence CC BY-NC-ND 3.0

Remerciements

p \ 0 L and γ are independently uniform, this is the challenge ciphertext in Game 1 .

When β = 0, the advantage of A in the above game is equal to that in Game 0 , i.e., Adv (0) A (λ), and is also equal to Pr 0 = Pr [B(∆, t) → 0|β = 0]. Similarly, when β = 1, we see that the advantage of A in the above game is equal to Adv B (λ). This completes the proof. □

To prove lemma 4.3.16, we need the following lemma from [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF], that we admit.

Lemma 4.3.15 [START_REF] Lewko | Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption[END_REF] Let

, where V is n-dimensional vector space Z n p , and V * its dual. For all (x, v) ∈ C, for all (r, w) ∈ C,

where Z ← GL(n, Z p ), ρ, τ ← Z * p , U = (Z -1 ) ⊤ and s = #C(= (p n -1)(p n -p n-1 )).

Lemma 4.3.16 For any adversary A, there exists a probabilistic adversary B, whose running time is essentially the same as that of A, such that for any security parameter λ, Adv

Note 6.1.5 Encryption for pattern 0 N is not relevant here as it means that no one can decrypt, that is why we excluded this pattern of encryption pattern space. Secret key for pattern 0 N is not relevant either as it does not match any of the users.

GUESS: B outputs a bit b

′ to A who outputs it as its guess. If all B's queries satisfy the game constraints, then all A's queries have the same property. Thus, A's simulation is perfect and the advantage of A is the same as B's. □ Setup(λ, N ): and run Setup(λ, N ) to obtain pk, msk. Then for each i ∈ [N ], define P ′ ∈ {0, 1} N such that for j ∈ [N ], P ′ j = 0 if j ̸ = i and P ′ j = 1 if i = j. Then set sk i = sk i = KeyGen(msk, P ′ ), (pk, msk) = (pk, msk). It outputs msk, pk and

. Encrypt(pk, S, ind, m): here ind ∈ [N + 1]. Associate S with a pattern P * in {0, ⋆} N such that for j ∈ [N ], P * j = ⋆ if j ∈ S and P * j = 0 otherwise. Then define the pattern P ind ∈ {0, ⋆} N such that for j ∈ [N ], P ind j = 0 if j < ind and P ind j = ⋆ otherwise. Define P ∈ {0, ⋆} N such that for j ∈ [N ], P j = P * j ∧ P ind j with the following rule : ⋆ ∧ 0 = 0. Finally compute ct = ct = Encrypt(pk, P , m) and outputs ct. Decrypt(pk, sk i , ct): compute m ′ ← Decrypt(sk i , ct). Proof 6.1.5 P i ∈ ⋆ P implies that P i i = P i or P i = ⋆. As P i i = 1, we have that P i = ⋆ and thus i / ∈ -W (P ), i.e. i ∈ S ∧ i ≥ ind. Suppose that i ∈ S ∧ i ≥ ind. By construction for all j ∈ [N ], j ̸ = i, P i j = 0 and either P i j = 0 = P j or P j = ⋆, and P i = ⋆, i.e. P i ∈ ⋆ P . Then correctness follows from WIBE's correctness. □ Theorem 6.1.6 If the underlying identity-based encryption with wildcards scheme satisfies adaptive IND-WIBE security, then the obtained augmented broadcast encryption scheme satisfies adaptive message-hiding security.

Proof 6.1.6 Let B be an adversary against message-hiding security, that wins with non negligible advantage. In Figure 6.11 we construct A an adversary against IND-WIBE that uses B and wins with non negligible advantage. Let C be a challenger.

SETUP: C on inputs λ, N runs Setup(λ, N ) → (msk, pk) and sends pk to A, who sends it to B. KEY QUERY: B chooses i ∈ [N ], sends it to A who creates the pattern P i such that for j ∈ [N ], P i j = 1 if i = j, P i j = 0 otherwise. A sends P i to C, who responds with sk P i ← KeyDer(msk, P i ). A sends sk P i to B as sk i . CHALLENGE: B chooses two challenge messages m 0 , m 1 and a challenge set S * . It sends m 0 , m 1 , S * to A, who creates pattern P * , such that for j ∈ [N ], P * j = 0. A sends m 0 , m 1 , P * to C, who chooses b ← {0, 1} randomly and runs ct * ← Encrypt(pk, P * , m b ). C gives ct * to A, who sends it to B. KEY QUERY: A, B, C act like in the previous KEY QUERY step.

GUESS: B outputs its guess b

′ to A, who outputs it as its guess. If all B's queries satisfy the game constraints, then all A's queries have the same property. Thus A's simulation is perfect and the advantage of A is the same as B's. This concludes the proof. □ Note 6.1.8 Pattern P * is equal to 0 N . Then, for all i ∈ [N ], P i / ∈ ⋆ P * : the WIBE adversary's constraint is always verified and we do not specify it in the proof. Theorem 6.1.7 If the underlying WIBE satisfies adaptive pattern-hiding security, then the obtained AugBE scheme satisfies adaptive anonymous security. Proof 6.1.7 Let C be a challenger and B be an adversary that wins the anonymous security game with non negligible advantage. We construct, in Figure 6.12, an adversary A that uses B and wins the pattern-hiding security game with non negligible advantage.

SETUP: C on inputs λ, N runs Setup(λ, N ) → (msk, pk) and sends pk to A, who sends it to B. KEY QUERY: B chooses i ∈ [N ], sends it to A who creates the pattern P i such that for j ∈ [N ], P i j = 1 if i = j, P i j = 0 otherwise. A sends P i to C, who responds with sk P i ← KeyDer(msk, P i ). A sends sk P i to B as sk i . CHALLENGE: B chooses a challenge message m, two challenge sets S 0 , S 1 and sends m, S 0 , S 1 to A. The latter creates the patterns P 0 , P 1 such that for j ∈ [N ], P 0 j = ⋆ if j ∈ S 0 , P 0 j = 0 otherwise, and P 1 j = ⋆ if j ∈ S 1 , P 1 j = 0 otherwise. A sends m, P 0 , P 1 to C. C chooses b ← {0, 1} randomly and sets ct * ← Encrypt(pk, P b , m). It sends ct * to A who sends it to B. KEY QUERY: A and B act like in the previous KEY QUERY step. C runs KeyDer(msk, P i ) → sk P i and sends sk P i to A who sends it as sk i to B.

GUESS: B outputs its guess b

′ to A, who outputs it as its guess. If all B's queries satisfy the game constraint, then all A's queries have the same property. Thus A's simulation is perfect, and the advantage of A is the same as B's. This concludes the proof. □ Combining theorem 6.1.1 and 6.1.7 we obtain that if the underlying WIBE satisfies adaptive pattern-hiding security then the built AugBE scheme satisfies adaptive indexhiding security. Again, adaptive indistinguishability security for key policy attribute-based encryption schemes can easily be derived from the above definition, by switching the roles of attributes sets and access policies.

CP-ABE From Dually Computable Accumulators: The Different Steps of Our Construction

In this section we propose a way to obtain an ABE scheme for which both the ciphertext and the user secret key are constant, while obtaining very good time complexities. To reach such objective of compactness, our idea is to employ our notion of dually computable accumulators in the following manner: the secret key, computed by the authority, corresponds to a privately computed accumulator of the users' attributes set, while the encryption corresponds to a one-time-pad with a mask derived from a publicly computed accumulator of the access policy. Decryption is then possible if the decryptor can demonstrate that the intersection of their accumulator and the one associated with the ciphertext is not empty, utilizing membership witnesses for both the privately computed and the publicly computed accumulators. However, while it is relatively straightforward to use accumulators to represent sets of attributes, understanding how they can serve as a concise representation of access policies is more complex. In this study, we introduce a way to represent monotone boolean formulas that is compatible with the use of accumulators, and then show how to employ our dually vector τ 2 (γ, 1). To compute coefficients in the bases (d * 5 , d * 6 ) we multiply the matrix A -1 by the transpose of this vector. Since A is random, these new coefficients are uniformly random. Thus, in this case, the ciphertext is SF (with coefficients in the base D) and B has properly simulated Game 0 . This allows B to leverage A's non-negligible difference in advantage between Game Real and Game 0 to achieve a non-negligible advantage against DS2. □ Lemma 6.2.2 If there exists a PPT algorithm A such that Adv

non-negligible, then there exists a PPT algorithm B with non-negligible advantage against assumption DS1 with k = 3 and n = 6.

Proof 6.2.3 INIT:

q . Then it implicitly sets dual orthonormal bases D, D * to:

) ⊤ . We note that D, D * are properly distributed and reveal no information about A. B chooses random values γ, s, x 0 , y 0 , z 0 ∈ Z p and a hash function H that takes as input attributes set and outputs an element of Z p \ {γ, s, x 0 , y 0 , z 0 }. A is given the public key

complexity class monotone NC 1 is captured by monotone boolean formulas of log-depth and fan-in two [START_REF] Kowalczyk | Compact Adaptively Secure ABE for NC 1 from k-Lin[END_REF]. Therefore, our CP-ABE can directly deal with monotone NC 1 circuits. We present in Table 6.4 a comparison of (bounded) CP-ABE scheme for monotone NC 1 circuits, based on pairings 4 . All schemes in this table overpass the one-use restriction on attributes, which imposes that each attribute is only present once in the access policy.

All schemes are single authority, and secure in the standard model.

As we can see our scheme is the first one to obtain constant size for both ciphertexts and secret keys. However, this is done at the cost of the public key size, which become exponential. This drawback comes from the fact that for accumulating user's attributes set we are running the hash function H on each non-empty subset of this set. Doing so we obtain an easy way to check if an attributes set verifies an access policy: if it does, one of non-empty subsets of the set is equal to one clause of the access policy. We argue that the size of the public key is less important than the size of the other parameters, as it can easily be stored on-line. Additionally, while the sets (and access policies) representation might be scary at first glance, this is not an issue in practice as (i) it is not necessary to keep all elements in memory and (ii) for each decryption, only the useful part will have to be computed again. Finding another way to accumulate attributes sets and access policies in order to have efficient membership verification may lead to a more efficient CP-ABE, with shorter public key size. We leave it as an open problem. We also leave as an open problem the case of unbounded ABE schemes THe conclusion of this thesis is divided into two parts: one that summarizes all of our contributions and another that addresses an open problem.

Our Results

This thesis presents two methods for data sharing: broadcast encryption and attributebased encryption. The initial chapters, Chapters 2 and 3, provide the necessary mathematical background and cryptographic fundamentals. Chapter 4 focuses on identity-based encryption with wildcards, a primitive employed as a building block in Chapter 6 (specifically in Section 6.1) for broadcast encryption schemes. Additionally, we propose a generic construction of augmented broadcast encryption, a broadcast encryption variant, using the same kind of ideas. This construction is made possible through the introduction in Section 4.2 of the novel pattern-hiding security property. Leveraging our identity-based encryption with wildcards schemes from Section 4.3, including one with pattern-hiding capabilities, we create new (augmented) broadcast encryption schemes that are adaptively secure in the standard model. In Section 6.2, we present a novel attribute-based encryption scheme based on a cryptographic accumulator scheme introduced in Section 5.4. This new attribute-based encryption scheme represents the first instance in the literature with constant size ciphertexts and secret keys. The key idea behind its design is to exploit our new feature of accumulators, known as dually computable, as presented in Section 5.3. Finally, Section 6.3, explores a specific use case wherein the data sharing scheme must adhere to varying levels of privacy. We propose a solution for this use case, utilizing a newly introduced feature of identity-based encryption with wildcards, termed privacy preserving key generation (introduced in Section 4.2).

The main focus of this thesis was to establish formal connections between various cryptographic primitives. While we were able to provide generic constructions for some of them, such as constructing broadcast encryption schemes from identity-based encryption with wildcards, there is still work to be done. For example, one open problem left unresolved by this thesis is the generic construction of attribute-based encryption schemes from dually computable accumulators. Another connection we attempted to prove is the relationship between accumulators and locally verifiable aggregate signature schemes [START_REF] Goyal | Locally Verifiable Signature and Key Aggregation[END_REF]. Unfortunately, our attempts were unsuccessful, and we have presented the results of these attempts in a short article [START_REF] Barthoulot | Locally Verifiable Signatures and Cryptographic Accumulators: Different Names, Same Thing?[END_REF] at the CFail 2023 conference.

Locally Verifiable Aggregate Signatures and Accumulators

Here, we briefly describe locally verifiable aggregate signature schemes, along with another primitive called aggregate signature [START_REF] Boneh | Aggregate and Verifiably Encrypted Signatures from Bilinear Maps[END_REF], to underscore the similarities with accumulators. In the sequel we consider the single-signer setting, meaning that aggregation of signatures is possible only when signatures were generated using the same verification key. We restrict our attention to this setting as there are similarities with cryptographic accumulators only when considering single-signer (locally verifiable) aggregate signature schemes.

Aggregate Signatures [START_REF] Boneh | Aggregate and Verifiably Encrypted Signatures from Bilinear Maps[END_REF]. An aggregate signature scheme is a signature scheme (see Definition 3.4.1) that also provides two algorithms Aggregate and AggVerify, where • Aggregate takes as input a verification key, along with a set of message-signature pairs and returns a shorter aggregate signature σ; • and AggVerify takes as input a verification key, a set of messages and an aggregate signature, and outputs 1 if the aggregate signature is valid with respect to the set of messages, 0 otherwise.

Aggregate signatures must satisfy correctness (as any signature scheme, refer to Definition 3.4.2) and must also satisfy correctness of aggregation, meaning that for all security parameters, all signing and verification keys generated honestly, all messages, Anaïs Barthoulot | PhD Thesis | University of Limoges

Licence CC BY-NC-ND 3.0 Additionally, we have observed a significant point concerning the construction mentioned above: in Theorem 5.2.1, we established that symmetric accumulator schemes result in accumulator sizes that grow linearly with the number of accumulated elements. Consequently, if we were able to build an aggregate signature scheme based on a symmetric accumulator, it would not satisfy the compactness of aggregation property, as an aggregate signature is treated as an accumulator within our construction.

To address the challenge posed by the varying inputs in the verification algorithms, one potential solution could involve using a locally verifiable aggregate signature scheme instead of an aggregate signature scheme. The former provides a verification algorithm for a single message only. However, it is important to note that this verification algorithm also requires auxiliary information as input, which symmetric accumulator schemes cannot provide. Asymmetric accumulator schemes, on the other hand, can provide this information through the use of witnesses. This leads us to a comparison between asymmetric accumulators and locally verifiable aggregate signature schemes.

Similarities between locally verifiable aggregate signatures and asymmetric accumulators. We can easily build an asymmetric accumulator scheme (with private evaluation and public key generation) from a LVAS scheme:

• the Gen algorithm runs the Setup algorithm;

• the Eval algorithm runs the Sign algorithm for each element of the set, then runs the Aggregate algorithm on all obtained signatures; • the WitCreate algorithm runs the LocalOpen algorithm; • and the Verify algorithm runs the LocalAggVerify algorithm. Here all algorithm are consistent in the inputs/outputs, the correctness of the accumulator scheme directly comes from the LVAS correctness of local opening and the scheme has constant size accumulators and witnesses thanks to the LVAS compactness of aggregation and compactness of local opening.

The other way round, the construction is a little bit more complicated but still possible:

• Setup runs the accumulator scheme algorithm Gen;

• Sign runs the Eval algorithm on a singleton;

• Verify runs the algorithms WitCreate and Verify of the accumulator scheme;

• Aggregate runs the Eval algorithm on a set composed of one message then run the Add algorithm to include all the other messages' signatures; • AggVerify runs the accumulator scheme algorithms WitCreate and Verify for each messages; • LocalOpen runs the algorithm WitCreate; In order for the construction to function properly, the accumulator scheme must possess private evaluation and public witness creation capabilities, and it must also be additive, with a publicly computable Add algorithm, as previously demonstrated with the symmetric accumulator. It is worth noting that if the accumulator scheme permits subset queries [START_REF] Dodis | Anonymous Identification in Ad Hoc Groups[END_REF], meaning that witnesses can be generated for a subset of elements rather than just one element, then the efficiency of AggVerify improves. It is evident that the correctness of the LVAS is derived from the correctness of the accumulator scheme. As for the compactness of aggregation and local opening, these are assured if the accumulator scheme maintains constant-sized accumulators and witnesses. Regarding security, the unforgeability of local opening property in the LVAS scheme appears somewhat analogous to the collision resistance security property of accumulator schemes (see Definition 5.1.3). However, there are intricacies in these reductions: while our property of unforgeability of private evaluation (see Definition 5.3.1) might prove useful in demonstrating the unforgeability of the aggregate signature, it lacks the inclusion of the challenge witness being forged in our property. To our knowledge, there is no security property in the cryptographic accumulator literature that guards against the forgery of both the accumulator and witnesses. And what about oracle queries? In the collision resistance security game, the adversary is granted the freedom to query the oracle for any sets without restrictions. In the aggregated unforgeability with adversarial opening security game, the adversary can query the oracle for any messages except the challenge message. When conducting security reductions from one adversary to the other, we encountered certain limitations that altered the adversary's advantage in winning the collision resistance security game, in a manner that we were unable to accurately assess. √ ", "×" and "≈" respectively mean "asymmetric", "symmetric", "working", "not working", and "working under some conditions". In red we highlight the most inefficient construction, and in green the best construction we made.