Re-Encryption Method Designed by Row Complete Matrix

Abstract

With the prevalence of Internet access, document storage has become a fundamental web service in recent years. One important topic is how to design a secure channel for efficiently sharing documents with another receiver. In this paper, we demonstrate a re-encryption method that is designed with row complete matrices. With this new method, the document owner can share a ciphertext in the cloud with another receiver by sending a serial number to the server and giving the receiver a corresponding key at the same time. This method ensures that the server cannot obtain the information about key and plaintext and that the receiver cannot obtain the original key of the owner either. Only the owner has the knowledge of all the information. Using this re-encryption system, the cloud server can provide a secure file-sharing service without worrying about the shared key management problem. Moreover, the cost of re-encryption will not increase even when the encryption is strengthened with longer encryption keys.

1. Introduction

The latin matrix is an n-by-n square matrix filled with elements from 𝑍_𝑛, each occurring exactly once in each row and in each column. The orthogonal Latin matrices have been found to be useful in error-correcting codes [1] and in mathematical puzzles, SUDOKU. Nevertheless, Colbourn proved that if a partially filled square can be completed to form, a Latin square is NP-complete [2]. In addition, the Latin matrices are the multipermutation method, an important method in cryptography. The Latin matrices include a many-internal state that may be keyed, and combining operations using keyed matrices will be nonlinear. Jiejun Kong shows the role of Latin matrices in Cipher Systems [3].

Blaze et al. introduced the proxy re-encryption (PRE) based on Elgamal encryption in 1998 [4], in which the proxy can translate ciphertexts under Alice’s key into ciphertexts under Bob’s key with a given re-encryption key. However, traditional PRE can translate all Alice’s ciphertexts without any condition. Therefore, Weng et al. proposed conditional proxy re-encryption in 2009 [5]. In Weng’s scheme, the proxy can only translate ciphertexts under certain condition. Unfortunately, Weng’s scheme was broken and an efficient conditional PRE scheme with bilinear pairing was introduced in 2011 [6]. Another related topic is PRE with keyword search, in which proxy is given a search keyword to find whether or not a ciphertext contains the search keyword without knowing the corresponding plaintext [7, 8].

In 2007, Green and Ateniese [9] presented the first identity-based proxy re-encryption scheme, where ciphertexts are transformed from one identity to another. Moreover, this scheme does not require any extra work from the key generator of a trusted party. Later, Chu and Tzeng [10] also proposed an identity-based proxy re-encryption scheme, which is efficient in terms of both computation and length of ciphertexts. However, the data owners in those schemes above cannot prevent Bob from decrypting the data and generating new re-decryption keys to another user. Hence, Liu et al. proposed a time-based re-encryption scheme, which enables the cloud servers to re-encrypt data based on specified interval [11]. Moreover, Liu’s scheme is an attribute-based encryption that provides fine grained access control as each user is issued keys associated with attributes and corresponding attribute effective times. The data can be decrypted by Bob using the attribute keys satisfying the access control and attribute effective times satisfying the access time. Fang et al. combined conditional PRE and attribute-based encryption techniques and proposed interactive conditional proxy re-encryption with fine grain policy (ICPRE-FG) [12] in 2011. In ICPRE-FG system, each ciphertext labels a set of descriptive conditions; each proxy re-encryption key is associated with a tree-access structure where the leaves are associated with conditions. Hence, this structure determines which type of ciphertexts the key can re-encrypt.

In addition, Ateniese et al. [13] proposed the first key-private PRE scheme and also left an open problem about how to achieve key privacy without compromising security against the chosen-ciphertext attack (CCA). Furthermore, Shao et al. proposed the “achieving key privacy without losing CCA security in proxy re-encryption” in 2011 [14] to achieve CCA security. In recent years, as the adoption of cloud computing environment grows, the PRE gradually presents its vital role in cloud computing. Take personal health record (PHR) for example; a PHR contains not only medical history such as surgery, illness, laboratory test results, and imaging report immunization records, but also sensitive personal data such as name, birth date, weight, and contact information. Obviously, such sensitive data should be protected by one’s key, and the medical history might be re-encrypted for public health issue in cloud computing environment.

In a cloud computing environment, users may want to exchange their digital contents with other users in the domain of another cloud. However, before doing that, users need to authenticate each other first and exchange a session key for communication. And PRE scheme can serve as a useful tool for content exchange in such cloud computing scenario.

Since the PRE scheme runs the risk of divulging the key of content provider, we will propose a secure re-encryption method designed by applying the properties of latin square matrix. Before we describe this new method, we need to introduce a special type of latin matrix, which is called row complete matrix.

Row Complete Matrix
A row complete matrix is a latin matrix in which, for all pairs (𝑖,𝑗)∈𝑍^2𝑛 where 𝑖≠𝑗, the pair exists in some row of the latin matrix. It is known that when 𝑛 is 3 and 5, there is no latin matrix that is row complete. It remains an open problem to decide whether or not the row complete matrix exists when 𝑛 is odd.
For example, the smallest row complete matrix is ⎛⎜⎜⎝0110⎞⎟⎟⎠.(1.1) This simple case shows that all the pairs (𝑖,𝑗)∈𝑍₂ can be found in the matrix, that is, (0,1) in the first row and (1,0) in the second row. The second example is in the case of 𝑛=4. For example, ⎛⎜⎜⎜⎜⎜⎜⎝3210210303211032⎞⎟⎟⎟⎟⎟⎟⎠.(1.2) In this example, we see that the pairs (0,1), (0,2), and (0,3) can be found in the first, third, and fourth rows, respectively. Similarly, all the pairs (𝑖,𝑗)∈𝑍₄ for 𝑖≠𝑗 can be found in this latin matrix, and therefore this matrix is row complete.
There are only 2 row complete matrices for 𝑛=2, 144 row complete matrices for 𝑛=4 and 172800 row complete matrices for 𝑛=6. In fact, the number of row complete matrices grows rapidly as the even number 𝑛 increases. We will design a re-encryption method using row complete matrix, and the security will rely on the number of possible row complete matrices for given size 𝑛. We will describe some properties of row complete matrix in the following sections.
The remainder of this paper is organized as follows. Section 2 gives the definition of re-encryption and a new re-encryption method designed by the properties of row complete matrix. The detailed procedure of the proposed method and the security analysis are described in Section 3. Finally, Section 4 gives the conclusions.

2. Re-Encryption Method

First, we define the concept of re-encryption. Assume that Alice (A) has some contents that she will upload to the Cloud (C) and Bob (B) is Alice’s friend with whom Alice will share her contents through the server in the cloud. Before Alice uploads her contents (𝑃) with the server, she will encrypt her contents with a key, say 𝐾_𝑎. Then the ciphertext (𝑇_𝑎) is uploaded to the server. When Alice wants to share her contents (𝑃) to Bob, she will create two keys. The first key is 𝐾_𝑏, which is a key that Bob can use to decrypt the ciphertext from the server. The second key is 𝑚_𝑎,𝑏, which is a serial number and with which the server will re-encrypt the ciphertext (𝑇_𝑎). Let the operation of re-encryption be 𝑅. We denote the re-encrypted ciphertext by 𝑇_𝑏, which is equal to 𝑅(𝑇_𝑎,𝑚_𝑎,𝑏). If we denote the encryption method and the decryption method by 𝐸 and 𝐷, respectively, then we have the following relations:(i)𝑇_𝑎=𝐸(𝑃,𝐾_𝑎), (ii)𝑃=𝐷(𝑇_𝑎,𝐾_𝑎), (iii)𝑇_𝑏=𝑅(𝑇_𝑎,𝑚_𝑎,𝑏), (iv)𝑃=𝐷(𝑇_𝑏,𝐾_𝑏).

For the reason of security and feasibility, we set the following criteria. (1) It is difficult for the server, S, to recover the 𝐾_𝑎 and 𝑃 from the information of 𝑇_𝑎 and 𝑚_𝑎,𝑏. (2) It is difficult for Bob, B, to recover 𝐾_𝑎 from the information of 𝑃, 𝑇_𝑏, and 𝐾_𝑏. Moreover, (3) for the feasibility of cloud transition, the length of the serial number 𝑚_𝑎,𝑏 should be small and the computational cost of 𝑅(𝑇_𝑎,𝑚_𝑎,𝑏) must also be small.

Encryption Method
The row complete matrix plays a pivotal role in our method. In fact, the adjacent column pairs of the row complete matrix serve collectively as the code book in an encryption. We first show the central idea of our method. Based on this idea, we will implement the encryption process to make it more secure.
We begin with the following example. Assuming the key 𝐾_𝑎 is an n-by-n row complete matrix, we will express the plaintext with the n-base representation first. For example, 𝐾_𝑎=⎛⎜⎜⎜⎜⎜⎜⎝3210210303211032⎞⎟⎟⎟⎟⎟⎟⎠,(2.1) where the size of 𝐾_𝑎 is 4-by-4. Then, we express the plaintext with the 4-base representation. The first element of the 4-base plaintext is encrypted by the first two columns. If the first element is 3, then it is encrypted by 2, and if it is 2, then it is encrypted by 1. The second element of the plaintext is encrypted by the second and third columns. If the second element is 2, then it is encrypted by 0, and if it is 1, then it is encrypted by 3. If 𝐾_𝑎 is a 4-by-4 matrix, only three pairs of columns can be used. We will repeat these three pairs when the length of plaintext is greater than 4. The formal encryption process is as follows.
If the key 𝐾_𝑎 is an n-by-n matrix, the 𝑘th element of the n-base representation of the plaintext 𝑃(𝑘) is encrypted by 𝐾_𝑎(𝑠,𝑡+1), where 𝐾_𝑎(𝑠,𝑡) is the element of 𝑠 row and 𝑡 column of 𝐾_𝑎, 𝑡=mod(𝑘−1,𝑛−1)+1 and 𝑠 is the index of the 𝑡th column of 𝐾_𝑎 such that 𝐾_𝑎(𝑠,𝑡)=𝑃(𝑘).

Decryption Method
The decryption process is straightforward when we have key 𝐾_𝑎. Because 𝐸(𝑃(𝑘))=𝐾_𝑎(𝑠,𝑡+1) when 𝑇(𝑘)=𝐾_𝑎(𝑠,𝑡), 𝑃(𝑘) is decoded by the index 𝑡, which is determined by the location index 𝑘 and the index of the (𝑡+1)th column of 𝐾_𝑎, where 𝑇(𝑘) occurs. That is 𝑃(𝑘)=𝐾_𝑎(𝑠,𝑡), where 𝑡=mod(𝑘−1,𝑛−1)+1, and 𝑠 is the index of the (𝑡+1)th column of 𝐾_𝑎 such that 𝐾_𝑎(𝑠,𝑡+1)=𝑇(𝑘).
Before we further explain the re-encryption method, we will first show some important properties for row complete matrix.

Theorem 2.1. Let 𝐴 be a row complete matrix; then a row permutation of A also gives a row complete matrix.

Proof. If 𝐴 is a row complete matrix, then 𝐴 is a latin matrix. A latin matrix after a row permutation is still a latin matrix, and the row permutation will not affect the row (𝑖,𝑗) pair. That is, if 𝐵 is a row permutation from 𝐴, the pair (𝑖,𝑗) in the 𝑠th row of 𝐴 must exist in some row of 𝐵. Hence, a row complete matrix after a row permutation is also a row complete matrix.

Corollary 2.2. Let 𝐴 be a row complete matrix. If 𝐵 is a matrix derived from 𝐴 by row permutation, then 𝐴 and 𝐵 are equivalent in the sense that they encrypt the plaintext to the same ciphertext.

Theorem 2.3. Let 𝐴 be a row complete matrix; then permuting the elements of A will again produce a row complete matrix.

Proof. Let 𝜎 be a permutation defined on 𝑍_𝑛 and 𝐵 a matrix such that 𝐵(𝑖,𝑗)=𝜎(𝐴(𝑖,𝑗)). Since 𝐴 is a latin matrix, each row and each column contain each element of 𝑍_𝑛 exactly once. As 𝜎 is a permutation, each row and each column of 𝐵 contain each element of 𝑍_𝑛 exactly once as well; therefore 𝐵 is also a latin matrix.
Since 𝜎 is a permutation mapping, we have 𝜎⁻¹(𝑖)≠𝜎⁻¹(𝑗) if 𝑖, 𝑗∈𝑍_𝑛 and 𝑖≠𝑗. Then for all pairs (𝑖,𝑗)∈𝑍^2𝑛, 𝑖≠𝑗, we have 𝑖^=𝜎⁻¹(𝑖), 𝑗^=𝜎⁻¹(𝑗), and 𝑖^≠𝑗^. Because 𝐴 is a row complete, there exist some 𝑠∈{1,…,𝑛} and 𝑡∈{1,…,𝑛−1} such that 𝐴(𝑠,𝑡)=𝑖^ and 𝐴(𝑠,𝑡+1)=𝑗^. Then, with the same indices 𝑠 and 𝑡, we will have 𝐵(𝑠,𝑡)=𝜎(𝐴(𝑠,𝑡))=𝜎(𝑖^)=𝑖 and 𝐵(𝑠,𝑡+1)=𝑗. Hence, 𝐵 is a row complete matrix too.

From these two theorems, we know that if 𝐴 is a row complete matrix with size 𝑛, there are more than 𝑛! row complete matrices that can be derived from the row permutations of 𝐴 and the element permutations of 𝐴. If 𝐵 is a row complete matrix derived from the row permutation of another row complete matrix 𝐴, we can see that using these two matrices as the keys in the previous simple encryption process, we will obtain the same ciphertext. As this property will downgrade the encryption security, we will modify the encryption method to a secure version.

The main idea of the modification is to make the ciphertexts encrypted by 𝐴 and 𝐵 that are derived from the row permutation from 𝐴 different. The number of the first column can be used. If we use the number of the first column (except 0) as the column order for encryption, we can make the above 𝐴 and 𝐵 have different ciphertexts. For example, if 𝐾_𝑎 is as (2.1), then we use the third column to encrypt the first element of plaintext, the second column to encrypt the second element, the first column to encrypt the third element, and then repeat.

The encryption formula is modified as 𝐸(𝑃(𝑘))=𝐾_𝑎(𝑠,𝑡+1), where 𝑡=𝑘_𝑎(mod(𝑘−1,𝑛−1)+1), 𝑘_𝑎 is the first column of 𝐾_𝑎 from which the 0 element is removed, and 𝑠 is the index of the 𝑡th column of 𝐾_𝑎 such that 𝐾_𝑎(𝑠,𝑡)=𝑃(𝑘). Similarly, the decryption process is modified as 𝐷(𝑇(𝑘))=𝐾_𝑎(𝑠,𝑡), where 𝑡=𝑘_𝑎(mod(𝑘−1,𝑛−1)+1), 𝑘_𝑎 is the first column of 𝐾_𝑎 from which the 0 element is removed, and 𝑠 is the index of the (𝑡+1)th column of 𝐾_𝑎 such that 𝐾_𝑎(𝑠,𝑡+1)=𝑇(𝑘).

Re-Encryption Method
Let 𝐾_𝑎 be the key of Alice, 𝑃 the plaintext, and 𝑇_𝑎 the ciphertext of 𝑃 that is encrypted by 𝐾_𝑎. After encryption, 𝑇_𝑎 is transmitted to the cloud. If Alice wants to share the document 𝑇_𝑎 with Bob, Alice will randomly generate a key, say 𝐾_𝑏, and then send this key to Bob. At the same time, Alice has to send a re-encryption key 𝑚_𝑎,𝑏 to the cloud server which can produce 𝑇_𝑏 for Bob. Note that the re-encryption keys 𝑚_𝑎,𝑏 and 𝐾_𝑏 are one time keys, so the server will not keep the key and do any key management.
The main idea of re-encryption is to create a ciphertext 𝑇_𝑏 from which Bob can successfully reconstruct the plaintext by 𝐾_𝑏. For the ease of understanding, we will use the following example to illustrate. Let the keys of Alice and Bob be 𝐾_𝑎=⎛⎜⎜⎜⎜⎜⎜⎝2310120330210132⎞⎟⎟⎟⎟⎟⎟⎠,𝐾_𝑏=⎛⎜⎜⎜⎜⎜⎜⎝1230012323013012⎞⎟⎟⎟⎟⎟⎟⎠.(2.2)
We can see that Alice encrypts the plaintext by the order (2,3,1,2,3,1,…) and Bob decrypts the ciphertext by the order (1,2,3,1,2,3,…). The first element of 𝑇_𝑎(𝑇_𝑏) will be decoded by the first column of 𝐾_𝑎(𝐾_𝑏). If 𝑃(1)=0, then 𝑇_𝑎(1)=2. If we want 𝑇_𝑏(1) to be decoded to 𝑃(1)=0, 𝑇_𝑏(1) should be 3. However, the difference between 𝑇_𝑎(1) and 𝑇_𝑏(1) is the message that Alice should provide to the server. If we check all the possible values of 𝑃(1), we can see that the difference between 𝑇_𝑎(1) and 𝑇_𝑏(1) is the same in the sense of mod 4, that is 𝑇_𝑏(1)=mod(𝑇_𝑎(1)+1,4) for all 𝑃(1). Similarly, we can check that 𝑇_𝑏(2)=mod(𝑇_𝑎(2)+1,4) and 𝑇_𝑏(3)=mod(𝑇_𝑎(3)+2,4). Therefore, the message that Alice should provide to the server is a 𝑛−1-dimensional vector (1,1,2). When the sever (S) receives this message, it only has to add these values by repeating the order onto 𝑇_𝑎 and then take mod 4 to obtain 𝑇_𝑏.
Note that the message that Alice provides to the server is a vector, not a matrix, and each value of this vector belongs to 𝑍₄. This property satisfies the third criterion; namely, the size of the message for re-encryption is small and the computational cost is also small. However, this advantage does not always hold true for all row complete matrices. For example, let 𝐾_𝑎=⎛⎜⎜⎜⎜⎜⎜⎝2013123003213102⎞⎟⎟⎟⎟⎟⎟⎠,𝐾_𝑏=⎛⎜⎜⎜⎜⎜⎜⎝3210032121031032⎞⎟⎟⎟⎟⎟⎟⎠,(2.3) the re-encryption key should be 𝑚_𝑎,𝑏=⎛⎜⎜⎜⎜⎜⎜⎝0123202000312033⎞⎟⎟⎟⎟⎟⎟⎠.(2.4) The first column specifies the values appearing in ciphertext. If the 𝑘th element of ciphertext is 𝑗, then it will be re-encrypted by adding the value in the (𝑗+1,mod(𝑘−1,𝑛−1)+2) element of 𝑚_𝑎,𝑏. Although, the first column of 𝑚_𝑎,𝑏 is redundant, this re-encryption key is still of a matrix form. Fortunately, there exists large amount of row complete matrices that make the column (except the first column) of 𝑚_𝑎,𝑏 a unique constant so that we can easily transmit the re-encryption key to the server. The following theorem will give us a simple method to derive a new row complete matrix from a given row complete matrix such that its re-encryption key is an (𝑛−1)-dimensional vector.

Theorem 2.4. Let 𝐴 be a given row complete matrix of size 𝑛. There exists a nonzero (𝑛−1)-dimensional vector such that when each element of the 𝑖th column of 𝐴 is added by the 𝑖th number of the vector in the sense of modular addition, it will become the other row complete matrix.

Proof. Let the nonzero (𝑛−1)-dimensional vector be a constant vector with the constant 𝑐. We can see that adding 𝑐 to every element of 𝐴 is equivalent to a permutation 𝜎 such that 𝜎(𝑖)=mod(𝑖+𝑐,𝑛). By Theorem 2.3, we know that the new matrix 𝐴+𝑐 is also a row complete matrix.

What we are interested in is the case of the nonconstant vector. In particular, we would like to decide under what condition the row complete matrix modified by an non-constant vector will become the other row complete matrix. Note that the first flowchart in Figure 1 can quickly generate a row complete matrix although we also observe that it can only produce a subset of all the row complete matrices. Once a row complete matrix is obtained from the first flowchart, we can then efficiently produce another row complete matrix by adding a non-constant vector.

Figure 1 

The flowchart to generate a row complete matrix by simple Latin matrix.

The first flowchart started by the special Latin matrix that is called the simple Latin matrix. The (𝑖,𝑗) element of simple Latin matrix in which each element is defined by mod(𝑖+𝑗−2,𝑛). Given this simple Latin matrix, we can randomly permute the columns of the matrix until this matrix becomes a row complete matrix. When we obtain the row complete matrix, we randomly permute its rows once again. Up to now, we obtain a row complete matrix. The advantage of this flowchart is that we do not have to check whether the matrix is a Latin matrix because the row and column permutation operation preserves itself as a Latin matrix.

Given two arbitrary row complete matrices, the re-encryption key 𝑚_𝑎,𝑏 related to these two row complete matrices does not always have the same value for each column. Hence, we must have an algorithm to produce a row complete matrix from the others such that the re-encryption key can be reduced to the vector type. The flowchart in Figure 2 describes a simple procedure for the above-mentioned purpose. Since the output row complete matrix is derived by the column permutation of a row complete matrix, the next theorem will show that such re-encryption key can be reduced to a vector form.

Figure 2 

The flowchart to generate another row complete matrix by a given row complete matrix.

Theorem 2.5. Let 𝐴 be a row complete matrix derived according to the flowchart in Figure 1. If 𝐵 is a row complete matrix that is derived from 𝐴 by columns permutation, then the re-encryption key between 𝐴 and 𝐵 can be reduced to the vector form.

Proof. Since 𝐴 is derived according to the flowchart 1, 𝐴 is derived by columns permutation and rows permutation from the simple Latin matrix. That is, if 𝑆 is the simple Latin matrix, there exists two permutations 𝜎₁ and 𝜎₂ such that 𝐴(𝑖,𝑗)=𝑆(𝜎₁(𝑖),𝜎₂(𝑗)). Because 𝐵 is derived from 𝐴 by column permutations, there exist a permutation 𝜎₃ such that 𝐵(𝑖,𝑗)=𝐴(𝑖,𝜎₃(𝑗)). Therefore, 𝐵(𝑖,𝑗)=𝐴(𝑖,𝜎₃(𝑗))=𝑆(𝜎₁(𝑖),𝜎(𝑗)), where 𝜎=𝜎₂𝜎₁.
Comparing the formula of 𝐴 and 𝐵, if we want to show that the re-encryption key can be reduced to the vector form, we just need to show that the difference between arbitrary two columns of 𝑆 is constant. Since 𝑆(𝑖,𝑗)=mod(𝑖+𝑗,𝑛), for given 𝑗₁ and 𝑗₂, 𝑆(𝑖,𝑗₁)−𝑆(𝑖,𝑗₂)=mod(𝑗₁−𝑗₂,𝑛) for all 𝑖=1,…,𝑛. That is, the difference between the 𝑗₁th and 𝑗₂th columns of 𝑆 is a constant mod(𝑗₁−𝑗₂,𝑛). Therefore, the re-encryption key between 𝐴 and 𝐵 can be reduced to the vector form.

Corollary 2.6. Given a row complete matrix 𝐴 derived according to Figure 1 and a row complete matrix 𝐵 derived according to Figure 2 with input 𝐴, the re-encryption key between 𝐴 and 𝐵 can be reduced to vector form.

In our experiment, if a row complete matrix of size 4 is not generated according to Figure 1, using column permutations can not generate another row complete matrix. However, if the size of row complete matrix is over 6, using column permutations can generate another row complete matrix. It is our on-going project to generate all the row complete matrices so that we can design how many keys are available in this method.

In practice, people often choose a string of characters as a password. It is almost not humanly possible to memorize a Latin matrix as a password, especially when the matrix size is greater than 6-by-6. Hence, in our scheme the password will be mapped to a random seed. Based on this random seed and using the flowchart in Figure 3, the system can generate 𝐾_𝑎 for Alice.

Figure 3 

The flowchart of encryption.

When Alice wants to share a ciphertext with Bob, Alice uses the flowchart in Figure 4 to generate 𝐾_𝑏 randomly. At the same time the system can produce the re-encryption key 𝑚_𝑎,𝑏. Before Alice sends 𝐾_𝑏 to Bob, Alice uses a hashing function to generate a hash code. This hash code, denoted by ℎ_𝑏=hashing(𝐾_𝑏), plays the role of a password for Bob. Then, Alice will send 𝑚_𝑎,𝑏, the index of the ciphertext and the email address of Bob to the server. At the same time Alice will send 𝐾_𝑏 and ℎ_𝑏 to Bob. When the server receives the re-encryption key and the ciphertext index, it will re-encrypt the ciphertext immediately and send a message to Bob in secure manner, informing him of where to download the ciphertext. When Bob receives the message coming from the server, he can start to download the ciphertext 𝑇_𝑏. Bob uses ℎ_𝑏 as the password to decrypt ciphertext. The decoding software will use ℎ_𝑏 to verify whether 𝐾_𝑏 matches this hash code. If it matches, the decoding software will start the decryption process of 𝑇_𝑏 by 𝐾_𝑏. That is, the key management is in the client (Bob), not in the cloud (Server). The flowcharts of encryption, re-encryption, and decryption are depicted in Figures 3, 4 and 5, respectively.

Figure 4 

The flowchart of decryption.

Figure 5 

The flowchart of re-encryption.

3. Security Analysis

In this section we discuss some details in the practical application and the security of our proposed re-encryption method.

To meet the three criteria of re-encryption previously mentioned, the flowchart in Figure 5 only produces a subset of row complete matrices. We have to make sure the number of this subset is sufficiently large such that it is computationally infeasible to guess 𝐾_𝑎. When the matrix size is 4, the number of all row complete matrices is 144. When the size is 6, the number rapidly increases to 172800. As the security is strongly related to the size of row complete matrices, we recommend that the matrix size be at least 36. If we only consider the element permutation of the first row and the row permutation of the remaining rows of the row complete matrix, a very conservative estimation of the number of all row complete matrices of size n is 𝑛!(𝑛−1)!.

When the matrix size is over 32, the conservative estimation of the number of all row complete matrices is about 2.16∗10⁶⁹. Since the number 2.16∗10⁶⁹ is much larger than 2¹²⁸ (around 3.4∗10³⁸), we estimate the security strength to be comparable to that of 128-bit block cipher encryption method. The server receives 𝑇_𝑎 and 𝑚_𝑎,𝑏 for easily producing 𝑇_𝑏 with a modular addition. However, there is no further information (except for the size of 𝐾_𝑎) that can be derived for the server to guess 𝐾_𝑎. Even with the knowledge of the tuple (𝑇_𝑎, 𝑇_𝑏, 𝑚_𝑎,𝑏), the adversary does not gain more advantage to derive 𝐾_𝑎 than random guessing. In addition, the probability to guess 𝐾_𝑎 correctly is at most 1/(𝑛!(𝑛−1)!). It is computationally infeasible to derive 𝐾_𝑎 when 𝑛≥32. This satisfies the first criterion of re-encryption.

For decryption part, Bob receives tuple (𝑇_𝑏, 𝐾_𝑏, ℎ_𝑏). The hash code ℎ_𝑏 is for Bob to verify 𝐾_𝑏 so it is highly dependent on 𝐾_𝑏, and therefore it is not useful for guessing 𝐾_𝑎. 𝐾_𝑏 is the key for Bob to decrypt plaintext 𝑃 where 𝑃=𝐷(𝑇_𝑏,𝐾_𝑏). Consequently, neither 𝑃 nor 𝑇_𝑏 contains the information related to 𝐾_𝑎. Hence, the only issue needs to be discussed is whether Bob can use 𝐾_𝑏 to infer 𝐾_𝑎. When the matrix size is 𝑛, the length of 𝑚_𝑎,𝑏 is 𝑛−1 and there are 𝑛^𝑛−1 possibilities for Bob to guess 𝑚_𝑎,𝑏.

If the server does not reveal 𝑚_𝑎,𝑏 to Bob, it is computationally infeasible for Bob to guess the key 𝐾_𝑎 of Alice when 𝑛≥32. Therefore, our proposed method satisfies the second criterion of the re-encryption.

Finally, in our method, since the server does not store any keys from either the content provider or the receiver, the server does not need to deal with any key management issue. Moreover, the 𝑚_𝑎,𝑏 is just a vector and cost of re-encryption will not increase even when the encryption is strengthened with longer encryption keys, as the complexity of re-encryption is only related to the length of the ciphertext. Hence, we conclude that our proposed method satisfies all three criteria in Section 2.

Although our method fits the requirements for a re-encryption system, we note that if Bob collaborates with the server, they can recover the key of Alice. Specifically, if Bob reveals the plaintext to the server, it can compare the plaintext (𝑃) with 𝑇_𝑎 and then reconstruct Alice’s key 𝐾_𝑎. Assume that the keys of Alice and Bob are 𝐾_𝑎 and 𝐾_𝑏, respectively, in (2.2) and the plaintext is (0,3,2,2,3,0,1,0,1,3,2,0). When the server gets this plaintext (𝑃), it compares 𝑃 with 𝑇_𝑎=(2,0,1,0,0,3,3,1,0,1,3,3). From the periodic entries that are encrypted by the first column, the server obtains the mapping pairs (0,2), (2,0), (1,3), and (3,1). Similarly, from the entries that are encrypted by the second column, the server obtains the mapping pairs (3,0), (0,1), and (2,3). Although there are only three pairs, the server can use the nonrepetitiveness property of Latin matrix to find out the fourth pair (1,2). Repeat this process to find out that the pairs of the third column are (2,1), (0,3), (1,0), and (3,2). We can collect the above pairs to form Table 1.

Table 1 

The possible column pairs.

Now, we want to use these three columns of pairs to construct a row complete matrix. Assuming that the column order appearing in the row complete matrix is just (1)-(2)-(3), we have (0, 2), the first column, connecting to (2, 3), the second column, and then (3, 2). Therefore, we get (0, 2, 3, 2). Because the element 2 is repetitive, this row should not be in a latin matrix, and the column order is not (1)-(2)-(3). Hence, we can compare all the possible orders of columns to check whether the latin matrix exists. For this example, we find that there are two possible orders that can form row complete matrices. They are (2)-(1)-(3) and (3)-(1)-(2), and the corresponding row complete matrices are𝐶₁=⎛⎜⎜⎜⎜⎜⎜⎝3021013223101203⎞⎟⎟⎟⎟⎟⎟⎠,𝐶₂=⎛⎜⎜⎜⎜⎜⎜⎝2013130231200231⎞⎟⎟⎟⎟⎟⎟⎠.(3.1)

These two row complete matrices are not the final results because we have to adjust the orders of their rows. We adjust the candidate matrix 𝐶₁ first. When we compare the plaintext and the ciphertext, we observe that the first element 0 is encrypted to 2, and, therefore, we know it is encrypted from the second column to the third column. So the first nonzero element of the first column is 2. The second element of the plaintext is encrypted from 3 to 0, so the second nonzero element of the first column is 1, that is,𝐶₁=⎛⎜⎜⎜⎜⎜⎜⎝2130320110230312⎞⎟⎟⎟⎟⎟⎟⎠.(3.2) Because the position of the row leading by 0 has no effect on encryption or decryption, there are four possible row complete matrices for 𝐶₁. Similarly, we have 𝐶₂=⎛⎜⎜⎜⎜⎜⎜⎝2310120330210132⎞⎟⎟⎟⎟⎟⎟⎠.(3.3) In this case, there are four keys that are equivalent in encryption and decryption. How to overcome this problem is an important issue that we will address in the future.

There is another pitfall to watch out for. Ideally the server only re-encrypts the specified ciphertext to Bob by 𝑚_𝑎,𝑏. However, if the server re-encrypts all the ciphertexts of Bob in the cloud by 𝑚_𝑎,𝑏 and allows Bob to access all the re-encrypted files, Bob can see all the plaintexts of Alice.

To resolve this issue, we can modify our encryption method by including an additional parameter that is highly related to the ciphertext, for example, the length of 𝑇_𝑎, to change the order of coding. Hence, 𝑚_𝑎,𝑏 is dependent on the ciphertext. The reason we do not modify the encryption/decryption method is to make it easier for the readers to understand this re-encryption method.

4. Conclusions

We proposed a new re-encryption method for the cloud storage service. This method is based on the properties of row complete matrices, which can be beautifully incorporated in designing a practical scheme of cloud storage. It is flexible for the adjustment of the secure requirement; namely, if the level of security needs to be increased, we only have to increase the matrix size. This method is quite suitable for cloud service because the re-encryption cost is rather low and there is no key management issue at all. Hence, we do not have to worry about the rapid growth of contents and there is no need for protecting the shared keys in the server.

There remain some research topics worthy of exploration in the future. For example, our experiments indicate that the flowchart in Figure 1, which generates the row complete matrices will become quite slow when the matrix size is greater than 12. Although the possible permutations can be listed in a look-up table to speed up the matrix generation, to achieve significant improvements it is probably preferred to design faster algorithms for generating the row complete matrices. The other problem is the collaboration between Bob and Server. In the example of security analysis we can see that some row complete matrices are equivalent in the sense of encryption and decryption, and we have to compute carefully all the possible numbers of equivalent row complete matrices to make sure of the security level. However, this property can be used in the collaborative writing, in which users with different keys can edit the same document at the same time [15].