Public Key Encryption with Secure Key Leasing

TL;DR

This paper introduces a new concept of public key encryption with secure key leasing (PKE-SKL), enabling controlled decryption key leasing with security guarantees, and provides constructions for PKE-SKL and related encryption schemes.

Contribution

It formalizes the notion of secure key leasing, introduces security definitions, and constructs PKE-SKL schemes leveraging existing encryption frameworks.

Findings

Defined PKE with secure key leasing and security notions

Constructed PKE-SKL using CoIC-KLA security and CPFE

Extended secure key leasing to IBE, ABE, and FE schemes

Abstract

We introduce the notion of public key encryption with secure key leasing (PKE-SKL). Our notion supports the leasing of decryption keys so that a leased key achieves the decryption functionality but comes with the guarantee that if the quantum decryption key returned by a user passes a validity test, then the user has lost the ability to decrypt. Our notion is similar in spirit to the notion of secure software leasing (SSL) introduced by Ananth and La Placa (Eurocrypt 2021) but captures significantly more general adversarial strategies. In more detail, our adversary is not restricted to use an honest evaluation algorithm to run pirated software. Our results can be summarized as follows: 1. Definitions: We introduce the definition of PKE with secure key leasing and formalize security notions. 2. Constructing PKE with Secure Key Leasing: We provide a construction of PKE-SKL by leveraging a PKE scheme that satisfies a new security notion that we call consistent or inconsistent security against key leasing attacks (CoIC-KLA security). We then construct a CoIC-KLA secure PKE scheme using 1-key Ciphertext-Policy Functional Encryption (CPFE) that in turn can be based on any IND-CPA secure PKE scheme. 3. Identity Based Encryption, Attribute Based Encryption and Functional Encryption with Secure Key Leasing: We provide definitions of secure key leasing in the context of advanced encryption schemes such as identity based encryption (IBE), attribute-based encryption (ABE) and functional encryption (FE). Then we provide constructions by combining the above PKE-SKL with standard IBE, ABE and FE schemes.

Equations

$${\mathsf{Adv}}_{\mathsf{SKE},\text{mathpzc}A}^{\mathsf{pr}\text{mbox}-\mathsf{ct}}(\lambda )=\text{absolutevalue}\mathrm{Pr}[{\mathsf{Exp}}_{\text{mathpzc}A,\mathsf{SKE}}^{\mathsf{pr}\text{mbox}-\mathsf{ct}}(1^{\lambda },0)=1]-\mathrm{Pr}[{\mathsf{Exp}}_{\text{mathpzc}A,\mathsf{SKE}}^{\mathsf{pr}\text{mbox}-\mathsf{ct}}(1^{\lambda },1)=1]\le \mathsf{negl}(\lambda ).$$

$$\displaystyle\Pr\left[\mathsf{Dec}(\mathsf{dk},\mathsf{ct})\allowbreak=\mathsf{m}\ \middle|\begin{array}[]{ll}(\mathsf{ek},\mathsf{dk})\leftarrow\mathsf{KG}(1^{\lambda})\\ \mathsf{ct}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m})\end{array}\right]=1-{\mathsf{negl}}(\lambda).$$

$${\mathsf{Adv}}_{\mathsf{PKE},\text{mathpzc}A}^{\mathsf{ind}\text{mbox}-\mathsf{cpa}}(\lambda ):=\text{absolutevalue}\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{PKE},\text{mathpzc}A}^{\mathsf{ind}\text{mbox}-\mathsf{cpa}}(1^{\lambda },0)\to 1]-\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{PKE},\text{mathpzc}A}^{\mathsf{ind}\text{mbox}-\mathsf{cpa}}(1^{\lambda },1)\to 1]\le \mathsf{negl}(\lambda ).$$

$${\mathsf{Adv}}_{\mathsf{PKE},\text{mathpzc}A}^{\mathsf{ow}\text{mbox}-\mathsf{cpa}}(\lambda ):=\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{PKE},\text{mathpzc}A}^{\mathsf{ow}\text{mbox}-\mathsf{cpa}}(1^{\lambda })\to 1]\le \mathsf{negl}(\lambda ).$$

$$\mathrm{Pr}[{\mathsf{F}}_{\mathsf{K}}(x)={\mathsf{F}}_{{\mathsf{K}}_{\notin S}}(x)\mid \mathsf{K}\leftarrow \mathsf{PRF}.\mathsf{Gen}(1^{\lambda }),{\mathsf{K}}_{\notin S}\leftarrow \mathsf{Puncture}(\mathsf{K},S)]=1.$$

$$|\mathrm{Pr}[\text{mathpzc}A({\mathsf{F}}_{{\mathsf{K}}_{\notin S}},\{{\mathsf{F}}_{\mathsf{K}}(x_i){\}}_{x_i\in S})\to 1]-\mathrm{Pr}[\text{mathpzc}A({\mathsf{F}}_{{\mathsf{K}}_{\notin S}},({\mathcal{U}}_{{\ell }_2}{)}^{\text{absolutevalue}S})\to 1]|\le \mathsf{negl}(\lambda ),$$

$$\Pr\left[\mathsf{GCEval}(\widetilde{C},\{\mathsf{lab}_{i,x_{i}}\}_{i\in[\ell]})=C(x)\ \middle|\begin{array}[]{rl}\mathsf{Grbl}(1^{\lambda},C))\to(\{\mathsf{lab}_{i,b}\}_{i\in[\ell],b\in\{0,1\}},\widetilde{C})\end{array}\right]=1-{\mathsf{negl}}(\lambda)$$

$$(\{{\mathsf{lab}}_{i,x_i}{\}}_{i\in [\ell ]},\tilde{C}){\approx }_{c}Sim.GC(1^{\lambda },\mathsf{info}(C),C(x))$$

$$\Pr\left[\mathsf{Dec}(\mathsf{sk}_{y},x,\mathsf{ct})=m\ \middle|\begin{array}[]{rl}&(\mathsf{pk},\mathsf{msk})\leftarrow\mathsf{Setup}(1^{\lambda}),\\ &\mathsf{sk}_{y}\leftarrow\mathsf{KG}(\mathsf{msk},y),\\ &\mathsf{ct}\leftarrow\mathsf{Enc}(\mathsf{pk},x,m)\end{array}\right]=1-{\mathsf{negl}}(\lambda).$$

$${\mathsf{Adv}}_{\mathsf{ABE},\text{mathpzc}A}^{\mathsf{ada}\text{mbox}-\mathsf{ind}}(\lambda ):=\text{absolutevalue}\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{ABE},\text{mathpzc}A}^{\mathsf{ada}\text{mbox}-\mathsf{ind}}(1^{\lambda },0)\to 1]-\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{ABE},\text{mathpzc}A}^{\mathsf{ada}\text{mbox}-\mathsf{ind}}(1^{\lambda },1)\to 1]\le \mathsf{negl}(\lambda ).$$

$$\Pr\left[\mathsf{Dec}(\mathsf{sk}_{f},\mathsf{ct})=f(x)\ \middle|\begin{array}[]{rl}&\mathsf{msk}\leftarrow\mathsf{Setup}(1^{\lambda}),\\ &\mathsf{sk}_{f}\leftarrow\mathsf{KG}(\mathsf{msk},f),\\ &\mathsf{ct}\leftarrow\mathsf{Enc}(\mathsf{msk},x)\end{array}\right]=1-{\mathsf{negl}}(\lambda).$$

$${\mathsf{Adv}}_{\mathsf{SKFE},\text{mathpzc}A}^{\mathsf{full}\text{mbox}-\mathsf{fp}}(\lambda ):=\text{absolutevalue}\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{SKFE},\text{mathpzc}A}^{\mathsf{full}\text{mbox}-\mathsf{fp}}(1^{\lambda },0)\to 1]-\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{SKFE},\text{mathpzc}A}^{\mathsf{full}\text{mbox}-\mathsf{fp}}(1^{\lambda },1)\to 1]\le \mathsf{negl}(\lambda ).$$

$$\Pr\left[\mathsf{Dec}(\mathsf{sk}_{f},\mathsf{ct})=f(x)\ \middle|\begin{array}[]{rl}&(\mathsf{pk},\mathsf{msk})\leftarrow\mathsf{Setup}(1^{\lambda}),\\ &\mathsf{sk}_{f}\leftarrow\mathsf{KG}(\mathsf{msk},f),\\ &\mathsf{ct}\leftarrow\mathsf{Enc}(\mathsf{pk},x)\end{array}\right]=1-{\mathsf{negl}}(\lambda).$$

$${\mathsf{Adv}}_{\mathsf{PKFE},\text{mathpzc}A}^{\mathsf{ada}\text{mbox}-\mathsf{ind}}(\lambda ):=\text{absolutevalue}\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{PKFE},\text{mathpzc}A}^{\mathsf{ada}\text{mbox}-\mathsf{ind}}(1^{\lambda },0)\to 1]-\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{PKFE},\text{mathpzc}A}^{\mathsf{ada}\text{mbox}-\mathsf{ind}}(1^{\lambda },1)\to 1]\le \mathsf{negl}(\lambda ).$$

$$\mathrm{Pr}\left[\text{mathpzc}A(\text{mathpzc}aux,r)\to x\cdot r|r\leftarrow \{0,1{\}}^n\right]\ge \frac{1}{2}+ϵ.$$

$$\mathrm{Pr}\left[\text{mathpzc}Ext([\text{mathpzc}A],\text{mathpzc}aux)\to x\right]\ge 4{ϵ}^2.$$

$$\displaystyle\Pr\left[\mathpzc{Dec}(\mathpzc{dk},\mathsf{ct})\allowbreak=\mathsf{m}\ \middle|\begin{array}[]{ll}(\mathsf{ek},\mathpzc{dk},\mathsf{vk})\leftarrow\mathpzc{KG}(1^{\lambda})\\ \mathsf{ct}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m})\end{array}\right]=1-{\mathsf{negl}}(\lambda).$$

$$\displaystyle\Pr\left[\mathpzc{Vrfy}(\mathsf{vk},\mathpzc{dk})=\top\ \middle|\begin{array}[]{ll}(\mathsf{ek},\mathpzc{dk},\mathsf{vk})\leftarrow\mathpzc{KG}(1^{\lambda})\end{array}\right]=1-{\mathsf{negl}}(\lambda).$$

$${\mathsf{Adv}}_{\mathsf{SKL},\text{mathpzc}A}^{\mathsf{ind}\text{mbox}-\mathsf{kla}}(\lambda ):=\text{absolutevalue}\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{SKL},\text{mathpzc}A}^{\mathsf{ind}\text{mbox}-\mathsf{kla}}(1^{\lambda },0)\to 1]-\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{SKL},\text{mathpzc}A}^{\mathsf{ind}\text{mbox}-\mathsf{kla}}(1^{\lambda },1)\to 1]\le \mathsf{negl}(\lambda ).$$

$${\mathsf{Adv}}_{\mathsf{SKL},\text{mathpzc}A}^{\mathsf{ow}\text{mbox}-\mathsf{kla}}(\lambda ):=\mathrm{Pr}[{\mathsf{Exp}}_{\mathsf{SKL},\text{mathpzc}A}^{\mathsf{ow}\text{mbox}-\mathsf{kla}}(1^{\lambda })\to 1]\le \mathsf{negl}(\lambda ).$$

$${\mathsf{Adv}}_{\mathsf{SKL},\text{mathpzc}A}^{\mathsf{omur}}(\lambda ):=\mathrm{Pr}[{\mathsf{Expt}}_{\mathsf{SKL},\text{mathpzc}A}^{\mathsf{omur}}(1^{\lambda })\to 1]\le \mathsf{negl}(\lambda ).$$

$$\mathrm{Pr}[{\mathsf{Hyb}}_0=1]={\mathsf{Adv}}_{{\mathsf{OW}}^{\prime },\text{mathpzc}A}^{\mathsf{omur}}(\lambda ).$$

$$\mathrm{Pr}[{\mathsf{Hyb}}_1=1]=\frac{2}{Q(Q-1)}\mathrm{Pr}[{\mathsf{Hyb}}_0=1].$$

$$\mathrm{Pr}[{\mathsf{Hyb}}_2=1]\ge \mathrm{Pr}[{\mathsf{Hyb}}_1=1].$$

$$\mathrm{Pr}[{\mathsf{Hyb}}_3=1]\ge \mathrm{Pr}[{\mathsf{Hyb}}_2=1].$$

$$\mathrm{Pr}[{\mathsf{Hyb}}_3=1]=\mathsf{negl}(\lambda ).$$

$${\mathsf{Adv}}_{\mathsf{OW},\text{mathpzc}B}^{\mathsf{ow}\text{mbox}-\mathsf{kla}}(\lambda )=\mathrm{Pr}[{\mathsf{Hyb}}_3=1].$$

$$\underset{\mathsf{coin}\leftarrow \{0,1\}}{\mathrm{Pr}}[{\mathsf{Exp}}_{\mathsf{IND},\text{mathpzc}A}^{\mathsf{ind}\text{mbox}-\mathsf{kla}}(1^{\lambda },\mathsf{coin})\to \mathsf{coin}]\ge 1/2+ϵ(\lambda )$$

$$\underset{\mathsf{coin}\leftarrow \{0,1\}}{\mathrm{Pr}}[{\mathsf{Exp}}_{\mathsf{IND},\text{mathpzc}A}^{\mathsf{ind}\text{mbox}-\mathsf{kla}}(1^{\lambda },\mathsf{coin})\to \mathsf{coin}]$$

$$=\underset{\mathsf{coin}\leftarrow \{0,1\}}{\mathrm{Pr}}[{\mathsf{Exp}}_{\mathsf{IND},\text{mathpzc}A}^{\mathsf{ind}\text{mbox}-\mathsf{kla}}(1^{\lambda },\mathsf{coin})\to \mathsf{coin}\wedge V=\top ]$$

$$+\underset{\mathsf{coin}\leftarrow \{0,1\}}{\mathrm{Pr}}[{\mathsf{Exp}}_{\mathsf{IND},\text{mathpzc}A}^{\mathsf{ind}\text{mbox}-\mathsf{kla}}(1^{\lambda },\mathsf{coin})\to \mathsf{coin}\wedge V=\perp ]$$

Full text

*Definitions: * We introduce the definition of PKE with secure key leasing and formalize a security notion that we call indistinguishability against key leasing attacks (IND-KLA security). We also define a one-wayness notion for PKE-SKL that we call OW-KLA security and show that an OW-KLA secure PKE-SKL scheme can be lifted to an IND-KLA secure one by using the (quantum) Goldreich-Levin lemma. 2. 2.

Constructing IND-KLA PKE with Secure Key Leasing: We provide a construction of OW-KLA secure PKE-SKL (which implies IND-KLA secure PKE-SKL as discussed above) by leveraging a PKE scheme that satisfies a new security notion that we call consistent or inconsistent security against key leasing attacks (CoIC-KLA security). We then construct a CoIC-KLA secure PKE scheme using 1-key Ciphertext-Policy Functional Encryption (CPFE) that in turn can be based on any IND-CPA secure PKE scheme. 3. 3.

Identity Based Encryption, Attribute Based Encryption and Functional Encryption with Secure Key Leasing: We provide definitions of secure key leasing in the context of advanced encryption schemes such as identity based encryption (IBE), attribute-based encryption (ABE) and functional encryption (FE). Then we provide constructions by combining the above PKE-SKL with standard IBE, ABE and FE schemes.

Notably, our definitions allow the adversary to request distinguishing keys in the security game, namely, keys that distinguish the challenge bit by simply decrypting the challenge ciphertext, as long as it returns them (and they pass the validity test) before it sees the challenge ciphertext. All our constructions satisfy this stronger definition, albeit with the restriction that only a bounded number of such keys is allowed to the adversary in the IBE and ABE (but not FE) security games.

Prior to our work, the notion of single decryptor encryption (SDE) has been studied in the context of PKE (Georgiou and Zhandry, Eprint 2020) and FE (Kitigawa and Nishimaki, Asiacrypt 2022) but all their constructions rely on strong assumptions including indistinguishability obfuscation. In contrast, our constructions do not require any additional assumptions, showing that PKE/IBE/ABE/FE can be upgraded to support secure key leasing for free.

1. 1 Introduction

2. 1.1 Prior Work

3. 1.2 Our Results

4. 1.3 Technical Overview

5. 1.4 Other Related Work

6. 1.5 Concurrent Work

7. 1.6 Organization of the paper

8. 2 Preliminaries

9. 2.1 Standard Cryptographic Tools

10. 2.2 Useful Lemmata

11. 3 Public Key Encryption with Secure Key Leasing

12. 3.1 Definitions

13. 3.2 Relationships among Security Notions

14. 4 Public Key Encryption with CoIC-KLA Security

15. 4.1 Tools

16. 4.2 Definitions of CoIC-KLA Security

17. 4.3 Strong CoIC-KLA Secure PKE from CPFE

18. 5 Construction of PKE with Secure Key Leasing

19. 6 Attribute-Based Encryption with Secure Key Leasing

20. 6.1 Definitions

21. 6.2 1-Bounded Distinguishing Key Construction

22. 6.3 $Q$-Bounded Distinguishing Key Construction

23. 6.4 Instantiations

24. 7 Public-Key Functional Encryption with Secure Key Leasing

25. 7.1 Definitions

26. 7.2 Constructions

27. 7.3 Security Proofs

28. A SDE Implies PKE-SKL

29. B OW-CPA from CoIC-KLA

30. C Deferred Proofs for PKFE-SKL

1 Introduction

Recent years have seen amazing advances in cryptography by leveraging the power of quantum computation. Several novel primitives such as perfectly secure key agreement [BB20], quantum money [Wie83], quantum copy protection [Aar09], one shot signatures [AGKZ20] and such others, which are not known to exist in the classical world, can be constructed in the quantum setting, significantly advancing cryptographic capabilities.

In this work, we continue to study harnessing quantum powers to protect against software piracy. The quantum no-cloning principle intuitively suggests applicability to anti-piracy, an approach which was first investigated in the seminal work of Aaronson [Aar09], who introduced the notion of quantum copy protection. At a high level, quantum copy protection prevents users from copying software in the sense that it guarantees that when an adversary is given a copy protected circuit for computing some function $f$, it cannot create two (possibly entangled) quantum states, both of which can compute $f$. While interesting in its own right for preventing software piracy, quantum copy protection (for some class of circuits) also has the amazing application of public-key quantum money [AC12]. Perhaps unsurprisingly, constructions of quantum copy protection schemes from standard cryptographic assumptions have remained largely elusive. This motivates the study of primitives weaker than quantum copy protection, which nevertheless offer meaningful guarantees for anti-piracy.

Secure software leasing (SSL), introduced by Ananth and La Placa [AL21], is such a primitive, which while being weaker than quantum copy-protection, is nevertheless still meaningful for software anti-piracy. Intuitively, this notion allows to encode software into a version which may be leased or rented out, for some specific term at some given cost. Once the lease expires, the lessee returns the software and the lessor can run an efficient procedure to verify its validity. If the software passes the test, we have the guarantee that the lessee is no longer able to run the software (using the honest evaluation algorithm).

In this work, we explore the possibility of equipping public key encryption (PKE) with a key leasing capability. The benefits of such a capability are indisputable – in the real world, decryption keys of users often need to be revoked, for instance, when a user leaves an organization. In the classical setting, nothing prevents the user from maintaining a copy of her decryption key and misusing its power. Revocation mechanisms have been designed to prevent such attacks, but these are often cumbersome in practice. Typically, such a mechanism entails the revoked key being included in a Certificate Revocation List (CRL) or Certificate Revocation Trees (CRT), or some database which is publicly available, so that other users are warned against its usage. However, the challenges of effective certificate revocation are well acknowledged in public key infrastructure – please see [BDTW01] for a detailed discussion. If the decryption keys of a PKE could be encoded as quantum states and allow for verifiable leasing, this would constitute a natural and well-fitting solution to the challenge of key revocation.

1.1 Prior Work

In this section, we discuss prior work related to public key encryption (PKE) and public key functional encryption (PKFE), where decryption keys are encoded into quantum states to benefit from uncloneability. For a broader discussion on prior work related to quantum copy protection and secure software leasing, we refer the reader to Section 1.4.

Georgiou and Zhandry [GZ20] introduced the notion of single decryptor encryption (SDE), where the decryption keys are unclonable quantum objects. They showed how to use one-shot signatures together with extractable witness encryption with quantum auxiliary information to achieve public key SDE. Subsequently, Coladangelo, Liu, Liu, and Zhandry [CLLZ21] achieved SDE assuming iO and extractable witness encryption or assuming subexponential iO, subexponential OWF, LWE and a strong monogamy property (which was subsequently shown to be true [CV22]). Very recently, Kitagawa and Nishimaki [KN22a] introduced the notion of single-decryptor functional encryption (SDFE), where each functional decryption key is copy protected and provided collusion-resistant single decryptor PKFE for $\mathsf{P/poly}$ from the subexponential hardness of iO and LWE.

It is well-known [ALL*+*21, AL21] that copy protection is a stronger notion than SSL222The informed reader may observe that this implication may not always be true due to some subtleties, but we ignore these for the purpose of the overview. – intuitively, if an adversary can generate two copies of a program, then it can return one of them while keeping the other for later use. Thus, constructions of single decryptor encryption [GZ20, CLLZ21, KN22a] imply our notion of PKE with secure key leasing from their respective assumptions, which all include at least the assumption of iO (see Appendix A for the detail). Additionally, in the context of public key FE, the only prior work by Kitagawa and Nishimaki [KN22a] considers the restricted single-key setting where an adversary is given a single decryption key that can be used to detect the challenge bit. In contrast, we consider the more powerful multi-key setting, which makes our definition of FE-SKL incomparable to the SDFE considered by [KN22a]. For the primitives of IBE and ABE, there has been no prior work achieving any notion of key leasing to the best of our knowledge. We also note that Aaronson et al. [ALL*+*21] studied the notion of “copy-detection”, which is a weaker form of copy protection, for any “watermarkable” functionalities based on iO and OWF. In particular, by instantiating the construction with the watermarkable PKE of [GKM*+*19], they obtain PKE with copy-detection from iO + PKE.

Overall, all previous works that imply PKE-SKL are designed to achieve the stronger goal of copy protection (or the incomparable goal of copy detection) and rely at least on the strong assumption of iO. In this work, our goal is to achieve the weaker goal of PKE-SKL from standard assumptions.

1.2 Our Results

In this work, we initiate the study of public key encryption with secure key leasing. Our results can be summarized as follows:

*Definitions: * We introduce the definition of PKE with secure key leasing (PKE-SKL) to formalize the arguably natural requirement that decryption keys of a PKE scheme is encoded into a leased version so that the leased key continues to achieve the decryption functionality but now comes with an additional “returnability” guarantee. In more detail, the security of PKE-SKL requires that if the quantum decryption key returned by a user passes a validity test, then the user has lost the ability to decrypt. To capture this intuition, we formalize a security notion that we call indistinguishability against key leasing attacks (IND-KLA security). We also define a one-wayness notion for PKE-SKL that we call OW-KLA security and show that an OW-KLA secure PKE-SKL scheme can be lifted to an IND-KLA secure one by using the (quantum) Goldreich-Levin lemma. 2. 2.

Constructing IND-KLA PKE with Secure Key Leasing: We provide a construction of OW-KLA secure PKE-SKL (which imples IND-KLA PKE-SKL as discussed above) by leveraging a PKE scheme that satisfies a new security notion that we call consistent or inconsistent security against key leasing attacks (CoIC-KLA security). We then construct a CoIC-KLA secure PKE scheme using 1-key Ciphertext-Policy Functional Encryption (CPFE) that in turn can be based on any IND-CPA secure PKE scheme. 3. 3.

Identity Based Encryption, Attribute Based Encryption and Functional Encryption with Secure Key Leasing: We provide definitions of secure key leasing in the context of advanced encryption schemes such as identity based encryption (IBE), attribute-based encryption (ABE) and functional encryption (FE). Then we provide constructions by combining the above PKE-SKL with standard IBE, ABE and FE schemes.

Notably, our definitions allow the adversary to request distinguishing keys in the security game, namely, keys that distinguish the challenge bit by simply decrypting the challenge ciphertext. Recall that this was not permitted in the classical setting to avoid trivializing the security definition. However, in the quantum setting, we consider a stronger definition where the adversary can request such keys so long as it returns them (and they pass the validity test) before it sees the challenge ciphertext. All our constructions satisfy this stronger definition, albeit with the restriction that only a bounded number of such keys be allowed to the adversary in the IBE and ABE (but not FE) security games. We emphasize that this restriction is a result of our techniques and could potentially be removed in future work.

We note that, in general, secure software leasing (SSL) only ensures a notion of security where the adversary is forced to use an honest evaluation algorithm for the software. However, our definition (and hence constructions) of PKE/ABE/FE SKL do not suffer from this limitation. Our constructions do not require any additional assumptions, showing that PKE/IBE/ABE/FE can be upgraded to support secure key leasing for free.

1.3 Technical Overview

We proceed to give a technical overview of this work.

Definition of PKE with secure key leasing.

We first introduce the definition of PKE with secure key leasing (PKE-SKL). A PKE-SKL scheme $\mathsf{SKL}$ consists of four algorithms $(\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec},\mathpzc{Vrfy})$, where the first three algorithms form a standard PKE scheme except the following differences on $\mathpzc{KG}$.333In this paper, standard math or sans serif font stands for classical algorithms and classical variables. The calligraphic font stands for quantum algorithms and the calligraphic font and/or the bracket notation for (mixed) quantum states.

• •

$\mathpzc{KG}$ outputs a quantum decryption key $\mathpzc{dk}$ instead of a classical decryption key.

• •

$\mathpzc{KG}$ outputs a (secret) verification key $\mathsf{vk}$, together with a public encryption key and quantum decryption key.

The verification algorithm $\mathpzc{Vrfy}$ takes as input a verification key and a quantum decryption key, and outputs $\top$ or $\bot$. In addition to decryption correctness, $\mathsf{SKL}$ should satisfy verification correctness that states that $\mathpzc{Vrfy}(\mathsf{vk},\mathpzc{dk})=\top$ holds, where $(\mathsf{ek},\mathpzc{dk},\mathsf{vk})\leftarrow\mathpzc{KG}(1^{\lambda})$.

The security of PKE-SKL requires that once a user holding a quantum decryption key returns the key correctly, the user can no longer use the key and lose the ability to decrypt. We formalize this as a security notion that we call indistinguishability against key leasing attacks (IND-KLA security). It is defined by using the following security game.

First, the challenger generates $(\mathsf{ek},\mathpzc{dk},\mathsf{vk})\leftarrow\mathpzc{KG}(1^{\lambda})$ and sends $\mathsf{ek}$ and $\mathpzc{dk}$ to an adversary $\mathpzc{A}$. 2. 2.

$\mathpzc{A}$ sends two challenge plaintexts $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})$ and a quantum state $\widetilde{\mathpzc{dk}}$ that is supposed to be a correct decryption key. The challenger checks if $\mathpzc{Vrfy}(\mathsf{vk},\widetilde{\mathpzc{dk}})=\top$ holds. If not, $\mathpzc{A}$ is regarded as invalid and the game ends here. Otherwise, the game goes to the next step.444We also consider a slightly stronger definition where the adversary can get access to a verification oracle many times, and the adversary is regarded as valid if the answer to at least one query $\widetilde{\mathpzc{dk}}$ is $\top$. In this overview, we focus on the “1-query” security for simplicity. 3. 3.

The challenger generates $\mathsf{ct}^{*}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{\mathsf{coin}}^{*})$ and sends it to $\mathpzc{A}$, where $\mathsf{coin}\leftarrow\{0,1\}$. 4. 4.

$\mathpzc{A}$ outputs $\mathsf{coin}^{\prime}$.

IND-KLA security guarantees that any QPT $\mathpzc{A}$ cannot guess $\mathsf{coin}$ correctly significantly better than random guessing, conditioned on $\mathpzc{A}$ being valid. In more detail, for any QPT adversary $\mathpzc{A}$ that passes the verification with a non-negligible probability, we have $\absolutevalue{\Pr[\mathsf{coin}^{\prime}=\mathsf{coin}\mid\mathpzc{Vrfy}(\mathsf{vk},\widetilde{\mathpzc{dk}})=\top]-1/2}={\mathsf{negl}}(\lambda)$.

One-wayness to indistinguishability.

It is natural to define a one-wayness notion for PKE-SKL, which we call OW-KLA security, by modifying the above definition so that the adversary is required to recover entire bits of a randomly chosen message from its ciphertext. Similarly to standard PKE, we can transform a OW-KLA secure PKE-SKL scheme into an IND-KLA secure one by using (quantum) Goldreich-Levin lemma [AC02, CLLZ21]. Hence, though our goal is to construct an IND-KLA secure scheme, it suffices to construct an OW-KLA secure one.

Basic idea for OW-KLA secure scheme.

Towards realizing a OW-KLA secure PKE-SKL scheme, we construct an intermediate scheme $\mathsf{Basic}=(\mathsf{Basic}.\mathpzc{KG},\mathsf{Basic}.\mathsf{Enc},\allowbreak\mathsf{Basic}.\mathpzc{Dec},\mathsf{Basic}.\mathpzc{Vrfy})$ using two instances of a standard PKE scheme, with parallel repetition. Let $\mathsf{PKE}=(\mathsf{PKE}.\mathsf{KG},\mathsf{PKE}.\mathsf{Enc},\mathsf{PKE}.\mathsf{Dec})$ be a standard PKE scheme. $\mathsf{Basic}.\mathpzc{KG}$ generates two key pairs $(\mathsf{ek}_{0},\mathsf{dk}_{0})$ and $(\mathsf{ek}_{1},\mathsf{dk}_{1})$ using $\mathsf{PKE}.\mathsf{KG}$ and outputs $\mathsf{ek}:=(\mathsf{ek}_{0},\mathsf{ek}_{1})$, $\mathpzc{dk}:=1/\sqrt{2}(\ket{0}\ket{\mathsf{dk}_{0}}+\ket{1}\ket{\mathsf{dk}_{1}})$, and $\mathsf{vk}:=(\mathsf{dk}_{0},\mathsf{dk}_{1})$. Given $\mathsf{m}$ and $\mathsf{ek}$, $\mathsf{Basic}.\mathsf{Enc}$ generates $\mathsf{ct}_{0}\leftarrow\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{0},\mathsf{m})$ and $\mathsf{ct}_{1}\leftarrow\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{1},\mathsf{m})$ and outputs $\mathsf{ct}:=(\mathsf{ct}_{0},\mathsf{ct}_{1})$. $\mathsf{Basic}.\mathpzc{Dec}$ can decrypt this ciphertext using the decryption keys $\mathsf{dk}_{0}$ and $\mathsf{dk}_{1}$, respectively, in superposition. Since both decryptions result in the same message $\mathsf{m}$, we can decrypt ciphertexts without collapsing $\mathpzc{dk}$. Finally, $\mathsf{Basic}.\mathpzc{Vrfy}$ checks if the input decryption key is an equal-weight superposition of $\mathsf{dk}_{0}$ and $\mathsf{dk}_{1}$. Concretely, it applies a binary outcome measurement w.r.t. a projection $\Pi_{\mathrm{vrfy}}\coloneqq\frac{1}{2}\left(\ket{0}\ket{\mathsf{dk}_{0}}+\ket{1}\ket{\mathsf{dk}_{1}}\right)\left(\bra{0}\bra{\mathsf{dk}_{0}}+\bra{1}\bra{\mathsf{dk}_{1}}\right)$, and returns $\top$ if and only if the state is projected onto $\Pi_{\mathrm{vrfy}}$.

Intuitively, if the adversary has returned the correct decryption key, then it no longer has the capability to decrypt since the decryption key cannot be cloned. However, this scheme does not satisfy OW-KLA because an adversary can pass the verification with probability $1/2$ simply by measuring the decryption key and returning the collapsed decryption key. Such an adversary can keep the decryption capability even after passing verification because the decryption key collapses to a classical string, which can be easily copied. Nonetheless, it is reasonable to expect that this attack strategy is optimal because there appears to be no obvious way to attack with a better advantage. That said, it is unclear how to turn this intuition into a formal proof assuming only IND-CPA security of the underlying PKE. To address this gap, we introduce a new security notion for PKE, that we call consistent or inconsistent security against key leasing attacks (CoIC-KLA security). Using this, we can prove that the aforementioned adversarial strategy is optimal and $\mathsf{Basic}$ satisfies $1/2$-OW-KLA security.

By being $1/2$-OW-KLA secure, we mean that the probability that an adversary can correctly return a decryption key and recover the challenge plaintext simultaneously is at most $1/2+{\mathsf{negl}}(\lambda)$. Below, we introduce the definition of CoIC-KLA security and how to prove $1/2$-OW-KLA security of $\mathsf{Basic}$ using CoIC-KLA security. Then, we explain how to achieve a full OW-KLA secure scheme by applying parallel amplification to $\mathsf{Basic}$.

Definition of CoIC-KLA security.

CoIC-KLA security is defined by using the following game.

The challenger generates $(\mathsf{ek}_{0},\mathsf{dk}_{0})$ and $(\mathsf{ek}_{1},\mathsf{dk}_{1})$ using $\mathsf{PKE}.\mathsf{KG}$, and generates $\mathpzc{dk}:=1/\sqrt{2}(\ket{0}\ket{\mathsf{dk}_{0}}+\ket{1}\ket{\mathsf{dk}_{1}})$. The challenger sends $\mathsf{ek}_{0}$, $\mathsf{ek}_{1}$, and $\mathpzc{dk}$ to an adversary $\mathpzc{A}$. In this game, $\mathpzc{A}$ can access the verification oracle only once, where the oracle is given a quantum state and returns the outcome of the projective measurement $(\Pi_{\mathrm{vrfy}},I-\Pi_{\mathrm{vrfy}})$. 2. 2.

$\mathpzc{A}$ sends two plaintexts $(\mathsf{m}^{*}_{0},\mathsf{m}^{*}_{1})$ to the challenger. The challenger picks random bits $a,b$ and generates $\mathsf{ct}_{0}=\mathsf{Enc}(\mathsf{ek}_{0},\mathsf{m}_{a})$ and $\mathsf{ct}_{1}=\mathsf{Enc}(\mathsf{ek}_{1},\mathsf{m}_{a\oplus b})$. Then, the challenger sends $\mathsf{ct}_{0}$ and $\mathsf{ct}_{1}$ to $\mathpzc{A}$. 3. 3.

$\mathpzc{A}$ outputs a bit $b^{\prime}$.

Then, CoIC-KLA security requires that any QPT $\mathpzc{A}$ cannot guess $b$ significantly better than random guessing. In the above game, if $b=0$, $\mathsf{ct}_{0}$ and $\mathsf{ct}_{1}$ are ciphertexts of the same plaintext $\mathsf{m}_{a}^{*}$. On the other hand, if $b=1$, $\mathsf{ct}_{0}$ and $\mathsf{ct}_{1}$ are ciphertexts of the different plaintexts $\mathsf{m}_{a}^{*}$ and $\mathsf{m}_{1\oplus a}^{*}$. Thus, we call this security notion consistent or inconsistent security.

$1/2$-OW-KLA security of $\mathsf{Basic}$.

We explain how to prove $1/2$-OW-KLA security of $\mathsf{Basic}$ based on CoIC-KLA security of $\mathsf{PKE}$. The OW-KLA security game for $\mathsf{Basic}$ is as follows.

The challenger generates $(\mathsf{ek}_{0},\mathsf{dk}_{0})$ and $(\mathsf{ek}_{1},\mathsf{dk}_{1})$ using $\mathsf{PKE}.\mathsf{KG}$, sets $\mathsf{ek}:=(\mathsf{ek}_{0},\mathsf{ek}_{1})$ and $\mathpzc{dk}:=1/\sqrt{2}(\ket{0}\ket{\mathsf{dk}_{0}}+\ket{1}\ket{\mathsf{dk}_{1}})$, and sends $\mathsf{ek}$ and $\mathpzc{dk}$ to an adversary $\mathpzc{A}$. 2. 2.

The adversary returns a quantum state $\widetilde{\mathpzc{dk}}$ that is supposed to be a correct decryption key. The challenger checks if the result of applying $\Pi_{\mathrm{vrfy}}$ defined above to $\widetilde{\mathpzc{dk}}$ is $1$. If not, $\mathpzc{A}$ is regarded as invalid and the game ends here. Otherwise, the game goes to the next step. 3. 3.

The challenger generates random plaintext $\mathsf{m}^{*}$ and two ciphertexts $\mathsf{ct}_{0}\leftarrow\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{0},\mathsf{m}^{*})$ and $\mathsf{ct}_{1}\leftarrow\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{1},\mathsf{m}^{*})$, and sends $\mathsf{ct}:=(\mathsf{ct}_{0},\mathsf{ct}_{1})$ to $\mathpzc{A}$. 4. 4.

$\mathpzc{A}$ outputs $m^{\prime}$.

In this game, we say that $\mathpzc{A}$ wins if $(a)$ $\widetilde{\mathpzc{dk}}$ passes the verification, that is, the result of applying $\Pi_{\mathrm{vrfy}}$ to $\widetilde{\mathpzc{dk}}$ is $1$, and $(b)$ $m^{\prime}=m^{*}$ holds. $\mathpzc{A}$ can win this game with probability at least $1/2$ by just measuring $1/\sqrt{2}(\ket{0}\ket{\mathsf{dk}_{0}}+\ket{1}\ket{\mathsf{dk}_{1}})$, returns collapsed key, and decrypt the challenge ciphertext with the key. As stated above, we can prove that this is the optimal strategy for $\mathpzc{A}$, that is, we can bound the advantage of $\mathpzc{A}$ by $1/2+{\mathsf{negl}}(\lambda)$. The proof can be done by using game sequences. We denote the probability that $\mathpzc{A}$ wins in Game $i$ as $\Pr[S_{i}]$.

Game [math]:

This is exactly the above game.

Game $1$:

We defer the verification of the returned key $\widetilde{\mathpzc{dk}}$ after $\mathpzc{A}$ outputs $\mathsf{m}^{\prime}$.

From the deferred measurement principle, we have $\Pr[S_{0}]=\Pr[S_{1}]$.

Game $2$:

We change $\mathpzc{A}$’s winning condition $(b)$. Concretely, we replace $(b)$ with $(b^{\prime})$ $\mathsf{m}^{\prime}\in\{\mathsf{m}^{*},\tilde{\mathsf{m}}\}$ holds, where $\tilde{m}$ is a random plaintext.

Since we relaxed $\mathpzc{A}$’s winning condition, we have $\Pr[S_{1}]\leq\Pr[S_{2}]$.

Game $3$:

We generate $\mathsf{ct}_{1}$ as $\mathsf{ct}_{1}\leftarrow\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{1},\tilde{\mathsf{m}})$ instead of $\mathsf{ct}_{1}\leftarrow\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{1},\mathsf{m}^{*})$.

The only difference between Game $2$ and $3$ is that $\mathsf{ct}_{0}$ and $\mathsf{ct}_{1}$ are ciphertexts of the same plaintext in Game $2$, but they are ciphertexts of different plaintexts in Game $3$. Thus, we obtain $\absolutevalue{\Pr[S_{2}]-\Pr[S_{3}]}={\mathsf{negl}}(\lambda)$ using CoIC security of $\mathsf{PKE}$.

We complete the proof by showing that $\Pr[S_{3}]\leq 1/2+{\mathsf{negl}}(\lambda)$ holds if $\mathsf{PKE}$ satisfies one-wayness (that is implied by CoIC-KLA security). To show it, we use the following Fact $1$.

Fact $1$:

Assume $\mathsf{PKE}$ satisfies one-wayness. Then, given $1/\sqrt{2}(\ket{0}\ket{\mathsf{dk}_{0}}+\ket{1}\ket{\mathsf{dk}_{1}})$, $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{0},\mathsf{m}^{*})$, and $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{1},\tilde{\mathsf{m}})$, no adversary can obtain $(\mathsf{dk}_{0},\tilde{\mathsf{m}})$ or $(\mathsf{dk}_{1},\mathsf{m}^{*})$ with non-negligible probability.

This can be proved by using the fact that even if we measure $1/\sqrt{2}(\ket{0}\ket{\mathsf{dk}_{0}}+\ket{1}\ket{\mathsf{dk}_{1}})$ in the computational basis before giving it to the adversary, the adversary still has success probability at least $\epsilon/2$, where $\epsilon$ is the success probability of the original experiment [BZ13, Lemma 2.1] (which is stated as Lemma 2.21).

Suppose $\Pr[S_{3}]=1/2+1/{\mathrm{poly}}(\lambda)$ for some polynomial ${\mathrm{poly}}$. This means that conditioned that $\mathsf{m}^{\prime}\in\{m^{*},\tilde{m}\}$, $\widetilde{\mathpzc{dk}}$ returned by $\mathpzc{A}$ passes the verification with probability significantly greater than $1/2$. Thus, if we measure $\widetilde{\mathpzc{dk}}$ in the computational basis, we obtain $\mathsf{dk}_{0}$ with some inverse polynomial probability and also $\mathsf{dk}_{1}$ with some inverse polynomial probability. (If either one is obtained with overwhelming probability, $\widetilde{\mathpzc{dk}}$ cannot pass the verification with probability significantly greater than $1/2$.) This means that using $\mathpzc{A}$, we can obtain either one pair of $(\mathsf{dk}_{0},\tilde{\mathsf{m}})$ or $(\mathsf{dk}_{1},\mathsf{m}^{*})$ with inverse polynomial probability, which contradicts Fact $1$. Thus, we obtain $\Pr[S_{3}]\leq 1/2+{\mathsf{negl}}(\lambda)$.

From the above discussions, we can conclude that if $\mathsf{PKE}$ satisfies CoIC-KLA security, $\mathsf{Basic}$ satisfies $1/2$-OW-KLA security.

Full OW-KLA security by parallel repetition.

To achieve a fully OW-KLA secure scheme, we apply parallel amplification to $\mathsf{Basic}$ in the following way. When generating a key tuple, we generate $\lambda$ key tuples $(\mathsf{ek}_{i},\mathpzc{dk}_{i},\mathsf{vk}_{i})$ of $\mathsf{Basic}$ and set $\mathsf{ek}^{\prime}:=(\mathsf{ek}_{i})_{i\in[\lambda}$, $\mathpzc{dk}^{\prime}:=(\mathpzc{dk}_{i})_{i\in[\lambda]}$, and $\mathsf{vk}^{\prime}:=(\mathsf{vk}_{i})_{i\in[\lambda]}$. When encrypting a plaintext $\mathsf{m}$, we divide it into $\lambda$ pieces $\mathsf{m}_{1},\cdots,\mathsf{m}_{\lambda}$, and encrypt each $\mathsf{m}_{i}$ using $\mathsf{ek}_{i}$. Then decryption and verification are performed naturally by running the underlying procedures in $\mathsf{Basic}$ for every $i\in[\lambda]$. We can prove the full OW-KLA security of this construction using a strategy analogous to that used to achieve $1/2$-OW-KLA security of $\mathsf{Basic}$. We remark that it is unclear whether we can amplify $1/2$-OW-KLA security to full OW-KLA security in a black box way and our security proof relies on the specific structure of our scheme.

Constructing CoIC-KLA secure PKE scheme.

In the rest of this overview, we mainly explain how to construct CoIC-KLA secure PKE scheme. We construct it using 1-key Ciphertext-Policy Functional Encryption (CPFE) that in turn can be based on any IND-CPA secure PKE scheme.

We first review the definition of 1-key CPFE scheme. A 1-key CPFE scheme $\mathsf{CPFE}$ consists of four algorithms $(\mathsf{FE}.\mathsf{Setup},\mathsf{FE}.\mathsf{KG},\mathsf{FE}.\mathsf{Enc},\mathsf{FE}.\mathsf{Dec})$. Given a security parameter, $\mathsf{FE}.\mathsf{Setup}$ outputs a master public key $\mathsf{mpk}$ and a master secret key $\mathsf{msk}$. $\mathsf{FE}.\mathsf{KG}$ takes as input $\mathsf{msk}$ and a string $x$ and outputs a decryption key $\mathsf{sk}_{x}$ tied to the string $x$. $\mathsf{FE}.\mathsf{Enc}$ takes as input $\mathsf{mpk}$ and a description of a circuit $C$ and outputs a ciphertext $\mathsf{ct}$. If we decrypt this ciphertext $\mathsf{ct}$ with $\mathsf{sk}_{x}$ using $\mathsf{FE}.\mathsf{Dec}$, we can obtain $C(x)$. The security of it states that ciphertexts of two circuits $C_{0}$ and $C_{1}$ are computationally indistinguishable for an adversary who has decryption key $\mathsf{sk}_{x}$ for $x$ of its choice, as long as $C_{0}(x)=C_{1}(x)$ holds.

Letting $\mathsf{CPFE}=(\mathsf{FE}.\mathsf{Setup},\mathsf{FE}.\mathsf{KG},\mathsf{FE}.\mathsf{Enc},\mathsf{FE}.\mathsf{Dec})$ be a 1-key CPFE scheme, we construct a CoIC secure PKE scheme $\mathsf{PKE}=(\mathsf{PKE}.\mathsf{KG},\mathsf{PKE}.\mathsf{Enc},\mathsf{PKE}.\mathsf{Dec})$ as follows. $\mathsf{PKE}.\mathsf{KG}$ generates $(\mathsf{mpk},\mathsf{msk})\leftarrow\mathsf{CPFE}.\mathsf{Setup}(1^{\lambda})$ and a decryption key $\mathsf{sk}_{x}\leftarrow\mathsf{CPFE}.\mathsf{KG}(\mathsf{msk},x)$ for random string $x$, and outputs an encryption key $\mathsf{ek}:=\mathsf{mpk}$ and the corresponding decryption key $\mathsf{dk}:=\mathsf{sk}_{x}$. Given $\mathsf{ek}=\mathsf{mpk}$ and $\mathsf{m}$, $\mathsf{PKE}.\mathsf{Enc}$ outputs $\mathsf{FE}.\mathsf{Enc}(\mathsf{mpk},C[\mathsf{m}])$, where $C[\mathsf{m}]$ is the constant circuit that outputs $\mathsf{m}$ on any input. Given $\mathsf{dk}=\mathsf{sk}_{x}$ and $\mathsf{ct}$, $\mathsf{PKE}.\mathsf{Dec}$ simply outputs $\mathsf{CPFE}.\mathsf{Dec}(\mathsf{sk}_{x},\mathsf{ct})$. We see that $\mathsf{PKE}$ satisfies decryption correctness from that of $\mathsf{CPFE}$.

Before proving CoIC-KLA security of $\mathsf{PKE}$, we explain a nice tracing property of $\mathsf{PKE}$ that plays an important role in the proof. It says that if there exists a decoder that can distinguish $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{0}^{*})$ and $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{1}^{*})$ with probability $1/2+1/{\mathrm{poly}}(\lambda)$ for some plaintexts $\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*}$ and polynomial ${\mathrm{poly}}$, we can extract the string $x$ tied to the decryption key from the decoder. Concretely, the following fact holds.

Fact $2$:

Consider the following experiment. The challenger generates $(\mathsf{ek}:=\mathsf{mpk},\mathsf{dk}:=\mathsf{sk}_{x})$ using $\mathsf{PKE}.\mathsf{KG}$ and sends them to an adversary $\mathpzc{A}$. $\mathpzc{A}$ outputs a decoder $D$ together with $\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*}$ that can predict random bit $b$ from $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{b}^{*})$ with probability $1/2+1/{\mathrm{poly}}(\lambda)$ for some polynomial ${\mathrm{poly}}$. Then, we can extract $x$ from $D$ with inverse polynomial probability.

In fact, if the decoder $D$ is a classical decoder, we can extract $x$ from $D$ with a probability close to $1$ as follows. Let $\tilde{C}[b,\mathsf{m}_{0},\mathsf{m}_{1},i]$ be the circuit that is given $x$ as an input and outputs $\mathsf{m}_{b\oplus x[i]}$, where $x[i]$ is the $i$-th bit of $x$. Then, suppose we generate many random $(b,\mathsf{FE}.\mathsf{Enc}(\mathsf{mpk},\tilde{C}[b,\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*},i]))$ and estimate the probability that the decoder $D$ outputs $b$ given $\mathsf{FE}.\mathsf{Enc}(\mathsf{mpk},\tilde{C}[b,\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*},i])$ as an input. By the $\mathsf{CPFE}$’s security, $\mathsf{FE}.\mathsf{Enc}(\mathsf{mpk},\tilde{C}[b,\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*},i])$ is indistinguishable from a correctly generated ciphertext of $\mathsf{m}_{b\oplus x_{i}}^{*}$, that is, $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{b\oplus x_{i}}^{*})=\mathsf{FE}.\mathsf{Enc}(\mathsf{mpk},C[\mathsf{m}_{b\oplus x_{i}}^{*}])$ from the view of $\mathpzc{A}$ and $D$ who has $\mathsf{sk}_{x}$, since $\tilde{C}[b,\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*},i](x)=C[\mathsf{m}_{b\oplus x_{i}}^{*}](x)=\mathsf{m}_{b\oplus x_{i}}^{*}$. Then, the result of the estimation should be as follows.

• •

In the case of $x[i]=0$, each sample used for the estimation looks $(b,\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{b}))$ from the view of $D$. Thus, the result of the estimation should be greater than $1/2$ from the fact that $D$ correctly predicts random bit $b$ from $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{b})$ with probability $1/2+1/{\mathrm{poly}}(\lambda)$.

• •

In the case of $x[i]=1$, each sample used for the estimation looks $(b,\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{1\oplus b}))$ from the view of $D$. Thus, the result of the estimation should be smaller than $1/2$ since $D$ outputs $1\oplus b$ given $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{1\oplus b})$ with probability $1/2+1/{\mathrm{poly}}(\lambda)$.

Therefore, by checking if the result of the estimation is greater than $1/2$ or not, we can extract $x[i]$. By doing this for every $i$, we can extract entire bits of $x$.

The above extraction technique is a direct application of that used by Kitagawa and Nishimaki [KN22b] to realize watermarking scheme secure against quantum adversaries. By using their technique, even if the decoder is a quantum decoder $\mathpzc{D}$ that consists of a unitary and an initial quantum state, we can extract $x$ from $\mathpzc{D}$ with inverse polynomial probability, as long as $\mathpzc{D}$ has a high distinguishing advantage. Roughly speaking, this is done by performing the above estimation using (approximate) projective implementation proposed by Zhandry [Zha20] that is based on the technique by Marriott and Watrous [MW05]. By extending the above extraction technique, we can obtain the following fact.

Fact $3$:

Consider the following experiment. The challenger generates $(\mathsf{ek}_{0}:=\mathsf{mpk}_{0},\mathsf{dk}_{0}:=\mathsf{sk}_{x_{0}})$ and $(\mathsf{ek}_{1}:=\mathsf{mpk}_{1},\mathsf{dk}_{1}:=\mathsf{sk}_{x_{1}})$ using $\mathsf{PKE}.\mathsf{KG}$, and sends $\mathsf{ek}_{0}$, $\mathsf{ek}_{1}$, and $1/\sqrt{2}(\ket{0}\ket{\mathsf{dk}_{0}}+\ket{1}\ket{\mathsf{dk}_{1}})=1/\sqrt{2}(\ket{0}\ket{\mathsf{sk}_{x_{0}}}+\ket{1}\ket{\mathsf{sk}_{x_{1}}})$ to an adversary $\mathpzc{A}$. $\mathpzc{A}$ outputs a quantum decoder $\mathpzc{D}$ together with $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})$ that can predict $b$ from $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{0},\mathsf{m}_{a})$ and $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{1},\mathsf{m}_{a\oplus b})$ with probability $1/2+1/{\mathrm{poly}}(\lambda)$ for some polynomial ${\mathrm{poly}}$. Then, we can extract both $x_{0}$ and $x_{1}$ from $\mathpzc{D}$ with inverse polynomial probability.

We now explain how we can prove CoIC-KLA security of $\mathsf{PKE}$ using Fact $3$. To this end, we introduce one more fact.

Fact $4$:

Given $\mathsf{mpk}_{0}$, $\mathsf{mpk}_{1}$, and $1/\sqrt{2}(\ket{0}\ket{\mathsf{sk}_{x_{0}}}+\ket{1}\ket{\mathsf{sk}_{x_{1}}})$, where $(\mathsf{mpk}_{0},\mathsf{sk}_{x_{0}})$ and $(\mathsf{mpk}_{1},\mathsf{sk}_{x_{1}})$ are generated as in $\mathsf{PKE}.\mathsf{KG}$, no adversary can compute both $x_{0}$ and $x_{1}$ with non-negligible probability.

Similarly to Fact $1$, we can prove this from the fact that even if we measure $1/\sqrt{2}(\ket{0}\ket{\mathsf{sk}_{x_{0}}}+\ket{1}\ket{\mathsf{sk}_{x_{1}}})$ in the computational basis before giving it to the adversary, the adversary still has success probability at least $\epsilon/2$, where $\epsilon$ is the success probability of the original experiment [BZ13, Lemma 2.1].

Suppose there exists a QPT adversary $\mathpzc{A}$ that breaks CoIC-KLA security of $\mathsf{PKE}$. We consider the following adversary $\mathpzc{B}$ using $\mathpzc{A}$. Given $\mathsf{mpk}_{0}$, $\mathsf{mpk}_{1}$, and $1/\sqrt{2}(\ket{0}\ket{\mathsf{sk}_{x_{0}}}+\ket{1}\ket{\mathsf{sk}_{x_{1}}})$, $\mathpzc{B}$ simulates CoIC-KLA security game for $\mathpzc{A}$ by setting $\mathsf{ek}_{0}:=\mathsf{mpk}_{0}$, $\mathsf{ek}_{1}:=\mathsf{mpk}_{1}$, and $\mathpzc{dk}:=1/\sqrt{2}(\ket{0}\ket{\mathsf{sk}_{x_{0}}}+\ket{1}\ket{\mathsf{sk}_{x_{1}}})$ until $\mathpzc{A}$ outputs two plaintexts $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})$. When $\mathpzc{A}$ makes a verification query, $\mathpzc{B}$ just returns a random bit. Let $\bm{U}$ be the unitary that performs the rest of $\mathpzc{A}$’s actions given the challenge ciphertexts. Also, let $\mathpzc{q}$ be the internal state of $\mathpzc{A}$ at this point. Then, from the averaging argument and the fact that $\mathpzc{B}$ correctly answers to $\mathpzc{A}$’s verification query with probability $1/2$, with some inverse polynomial probability, the quantum decoder $\mathpzc{D}=(\bm{U},\mathpzc{q})$ is a decoder that can predict $b$ from $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{0},\mathsf{m}_{a}^{*})$ and $\mathsf{PKE}.\mathsf{Enc}(\mathsf{ek}_{1},\mathsf{m}_{a\oplus b}^{*})$ with probability $1/2+1/{\mathrm{poly}}(\lambda)$ for some polynomial ${\mathrm{poly}}$. Thus, by using the extractor that is guaranteed to exist by Fact $3$, $\mathpzc{B}$ can obtain both $x_{0}$ and $x_{1}$ with some inverse polynomial probability, which contradicts Fact $4$. This means that $\mathsf{PKE}$ satisfies CoIC-KLA security.

Extension to Advanced Encryption Systems with Secure Key Leasing.

We also provide constructions of advanced encryption schemes such as ABE and FE with secure key leasing. We do not focus on IBE in this paper since IBE is a special case of ABE and our transformation preserves the underlying function class.555Although ABE is a special case of FE, we need stronger assumptions for (collusion-resistant) FE to instantiate them. In addition, the security level of FE-SKL that we can achieve is different from that of ABE-SKL. Hence, we consider both ABE and FE. We construct these schemes by carefully combining standard ABE (resp. FE) with PKE-SKL in the way that each decryption key of the resulting ABE-SKL (resp. FE-SKL) scheme includes a decryption key of the underlying PKE-SKL scheme and a ciphertext of the ABE-SKL (resp. FE-SKL) scheme cannot be decrypted without the decryption key of the underlying PKE-SKL scheme. By doing so, our ABE-SKL and FE-SKL take over the secure key leasing security from the underlying PKE-SKL. Moreover, since PKE-SKL can be based on any PKE, our ABE-SKL and FE-SKL can be based on any standard ABE and FE, respectively.

ABE-SKL.

Here, we provide an overview of ABE with secure key leasing. Let us start with the definition of plain ABE (without key leasing). An ABE scheme $\mathsf{ABE}$ consists of four algorithms $(\mathsf{ABE}.\mathsf{Setup},\mathsf{ABE}.\mathsf{KG},\mathsf{ABE}.\mathsf{Enc},\allowbreak\mathsf{ABE}.\mathsf{Dec})$ and is associated with a relation $R$. Given a security parameter, $\mathsf{ABE}.\mathsf{Setup}$ outputs a master public key $\mathsf{mpk}$ and a master secret key $\mathsf{msk}$. $\mathsf{ABE}.\mathsf{KG}$ takes as input $\mathsf{msk}$ and a key attribute $y$ and outputs a user secret key $\mathsf{sk}_{y}$ tied to the attribute $y$. $\mathsf{ABE}.\mathsf{Enc}$ takes as input $\mathsf{mpk}$, a ciphertext attribute $x$, and a message $\mathsf{m}$ and outputs a ciphertext $\mathsf{ct}$. The decryption of the ciphertext is possible only when $R(x,y)=1$. For this reason, we call a user secret key for attribute $y$ satisfying $R(x,y)=1$ a decrypting key (for a ciphertext associated with $x$). As for the security, we require that $\mathsf{ABE}.\mathsf{Enc}(x^{*},\mathsf{m}^{*}_{0})$ should be computationally indistinguishable from $\mathsf{ABE}.\mathsf{Enc}(x^{*},\mathsf{m}^{*}_{1})$ as long as an adversary is only given non-decrypting keys for the ciphertext (i.e., user secret keys for $y$ satisfying $R(x^{*},y)=0$).

We now define the notion of ABE with secure key leasing (ABE-SKL) by extending the syntax of ABE. The difference from the above is that the key generation algorithm is now quantum and it outputs user secret key $\mathpzc{usk}_{y}$ along with verification key $\mathsf{vk}$. We also additionally introduce a verification algorithm that takes $\mathsf{vk}$ and a quantum state $\mathpzc{usk}^{\prime}$ and outputs $\top$ if it judges that the user secret key corresponding to $\mathsf{vk}$ is correctly returned and $\bot$ otherwise. As for the security, we require that $\mathsf{ABE}.\mathsf{Enc}(x^{*},\mathsf{m}_{0})$ should be computationally indistinguishable from $\mathsf{ABE}.\mathsf{Enc}(x^{*},\mathsf{m}_{1})$ if the adversary returns all decrypting keys before it is given the challenge ciphertext. Here, we say the adversary returns the key if the adversary provides the challenger with a quantum state that makes the verification algorithm output $\top$.

For the construction, the basic idea is to use ABE for access control and PKE-SKL for obtaining security against key leasing attacks. To enable this idea, we encrypt a message $\mathsf{m}$ for an attribute $x$ so that the decryptor recovers PKE-SKL ciphertext $\mathsf{skl}.\mathsf{ct}=\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek},\mathsf{m})$ if it has decrypting key and nothing otherwise, where $\mathsf{skl}.\mathsf{ek}$ is an individual encryption key corresponding to the user. The user is given the corresponding decryption key $\mathsf{skl}.\mathsf{dk}$ and can recover the message by decrypting $\mathsf{skl}.\mathsf{ct}$. Roughly speaking, the security follows since (1) a user with a non-decrypting key cannot obtain any information and (2) even a user with a decrypting key cannot recover the message from $\mathsf{skl}.\mathsf{ct}$ once it returns $\mathsf{skl}.\mathsf{dk}$ due to the security of $\mathsf{SKL}$.

The generation of user individual $\mathsf{SKL}$ ciphertext is somewhat non-trivial since $\mathsf{ABE}$ can only encrypt a single message. In order to achieve this, we use an idea similar to [SS10, GKW16] that combines encryption with the garbled circuits. In particular, we garble the encryption circuit of $\mathsf{SKL}$ that hardwires a message and encrypt the labels by ABE. We then provide a secret key of ABE for a user only for the positions corresponding to $\mathsf{skl}.\mathsf{ek}$. This allows a user with decrypting key to recover the labels corresponding to $\mathsf{skl}.\mathsf{ek}$ and then run the garbled circuit on input the labels to recover $\mathsf{skl}.\mathsf{ct}$.

Unfortunately, the introduction of the garbled circuits in the construction poses some limitations on the security of the scheme. In particular, once the adversary obtains two decrypting user secret keys, the message can be revealed from the garbled circuit in the ciphertext since the security of garbled circuits is compromised when labels for two different inputs are revealed. Therefore, we are only able to prove $1$-bounded distinguishing key security,666 When we consider the security game for ABE-SKL, a decrypting key can be used for distinguishing the challenge bit by decrypting the challenge ciphertext (if it is not returned). Therefore, we use the term “decrypting key” and “distinguishing key” interchangeably. where the adversary can make a single decrypting key query and should return the key before the challenge ciphertext is given. We note that the adversary can make an arbitrary number of non-decrypting key queries throughout the game, unlike bounded collusion ABE [GVW12, ISV*+*17] and only the number of decrypting keys is bounded.

Ideally, we would like to have a scheme without restriction on the number of decrypting keys. However, we do not know how to achieve it without strong assumptions like functional encryption or indistinguishability obfuscation. Instead, we achieve intermediate security notion that we call $q$-bounded distinguishing key security without introducing additional assumption, where the number of decrypting keys is bounded by some pre-determined polynomial. To do so, we use the same idea as [ISV*+*17], which converts single bounded collusion ABE into $q$-bounded collusion ABE. The construction is based on the balls and bins idea, where we prepare multiple “bins", each of which consists of multiple instances of $1$-bounded distinguishing key secure ABE-SKL $\mathsf{1ABE}$. The key generation algorithm chooses a single instance from each bin randomly and generates a user secret key for each of them. The encryption algorithm secret shares the message and encrypts them using the instances of the $\mathsf{1ABE}$ so that the same share is encrypted by the instances in the same bin. By careful choices of the parameters and analysis, in the security proof, we can argue that there exists a bin such that $\mathsf{1ABE}$ instances used for generating decrypting keys in that bin are all distinct. This means that for every $\mathsf{1ABE}$ instance in that bin, only a single decrypting key is generated and thus, we can use $1$-bounded distinguishing key security for each of them. While this overall proof strategy is the same as [ISV*+*17], our proof is a little bit more complex than theirs because the adversary is allowed to make an unbounded number of (non-decrypting) key queries. We refer to Section 6 for further details.

PKFE-SKL.

We move to the overview of PKFE-SKL. In this work, we focus on Key-Policy FE (KPFE) with secure key leasing. We start with the definition of plain FE (without key leasing). An FE scheme $\mathsf{FE}$ consists of four algorithms $(\mathsf{FE}.\mathsf{Setup},\mathsf{FE}.\mathsf{KG},\mathsf{FE}.\mathsf{Enc},\mathsf{FE}.\mathsf{Dec})$ and is associated with a function class $\mathcal{F}$. Given a security parameter, $\mathsf{FE}.\mathsf{Setup}$ outputs a public key $\mathsf{pk}$ and a master secret key $\mathsf{msk}$. $\mathsf{FE}.\mathsf{KG}$ takes as input $\mathsf{msk}$ and a function $f\in\mathcal{F}$ and outputs a functional decryption key $\mathsf{sk}_{f}$ tied to the function $f$. $\mathsf{FE}.\mathsf{Enc}$ takes as input $\mathsf{pk}$ and a plaintext $x$ and outputs a ciphertext $\mathsf{ct}$. The decryption result is $f(x)$. For security, we require that $\mathsf{FE}.\mathsf{Enc}(\mathsf{pk},x_{0})$ should be computationally indistinguishable from $\mathsf{FE}.\mathsf{Enc}(\mathsf{pk},x_{1})$ as long as an adversary is only given functional decryption keys for $\{f_{i}\}_{i}$ such that $f_{i}(x_{0})=f_{i}(x_{1})$ for all $i$.

We define the notion of FE with secure key leasing (FE-SKL) by extending the syntax of FE like ABE-SKL. The key generation algorithm is now quantum and it outputs functional decryption key $\mathpzc{sk}_{f}$ along with verification key $\mathsf{vk}$. We also introduce a verification algorithm that takes $\mathsf{vk}$ and a quantum state $\mathpzc{sk}^{\prime}$ and outputs $\top$ if it judges that the functional decryption key corresponding to $\mathsf{vk}$ is correctly returned and $\bot$ otherwise.

In the security game of PKFE-SKL, the adversary can send a distinguishing key query $f$ such that $f(x_{0}^{\ast})\neq f(x_{1}^{\ast})$ where $(x_{0}^{\ast},x_{1}^{\ast})$ are the challenge plaintexts as long as it returns a valid functional decryption key for $f$. We consider a security game where the adversary can send unbounded polynomially many distinguishing and non-distinguishing (that is, $f(x_{0}^{\ast})=f(x_{1}^{\ast})$) key queries and tries to distinguish $\mathsf{FE}.\mathsf{Enc}(\mathsf{pk},x_{0})$ from $\mathsf{FE}.\mathsf{Enc}(\mathsf{pk},x_{1})$.

We transform a (classical) PKFE scheme into a PKFE scheme with secure key leasing by using the power of PKE-SKL. The basic idea is as follows. When we generate a functional decryption key for function $f$, we generate a key triple of PKE-SKL and a functional decryption key of the classical PKFE for a function $W$ that computes a PKE-SKL ciphertext of $f(x)$. That is, we wrap $f(x)$ by PKE-SKL encryption. A decryption key of PKE-SKL is appended to $\mathsf{fe}.\mathsf{sk}_{W}$, which is the functional decryption key for $W$. Hence, we can decrypt the PKE-SKL ciphertext and obtain $f(x)$. The PKE-SKL decryption key for $f$ is useless for another function $g$ since we use different key triples of PKE-SKL for each function.

More specifically, we generate PKE-SKL keys $(\mathsf{skl}.\mathsf{ek},\mathsf{skl}.\mathpzc{sk},\mathsf{skl}.\mathsf{vk})$ and a PKFE functional decryption key $\mathsf{fe}.\mathsf{sk}_{W}\leftarrow\mathsf{FE}.\mathsf{KG}(\mathsf{fe}.\mathsf{msk},W[f,\mathsf{skl}.\mathsf{ek}])$, where function $W[f,\mathsf{skl}.\mathsf{ek}]$ takes as input $x$ and outputs a PKE-SKL ciphertext $\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek},f(x))$.777We ignore the issue of encryption randomness here. In our construction, we use (puncturable) PRFs to generate encryption randomness. A functional decryption key for $f$ consists of $(\mathsf{fe}.\mathsf{sk}_{W},\mathsf{skl}.\mathpzc{sk})$. A ciphertext of $x$ is a (classical) PKFE ciphertext $\mathsf{FE}.\mathsf{Enc}(\mathsf{fe}.\mathsf{pk},x)$. If we return $\mathsf{skl}.\mathpzc{sk}$ for $f$ (verified by $\mathsf{skl}.\mathsf{vk}$) before we obtain $\mathsf{FE}.\mathsf{Enc}(\mathsf{fe}.\mathsf{pk},x)$, we cannot obtain $f(x)$ from $\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek},f(x))$ by the security of PKE-SKL.

We need to prove security against an adversary that obtains a functional decryption key for $f$ such that $f(x_{0}^{\ast})\neq f(x_{1}^{\ast})$ where $(x_{0}^{\ast},x_{1}^{\ast})$ is a pair of challenge plaintexts if the adversary returns the functional decryption key. To handle this issue, we rely on IND-KLA security and need to embed a challenge ciphertext of PKE-SKL into a PKFE ciphertext. We use the trapdoor method of FE (a.k.a. Trojan method) [ABSV15, BS18] for this purpose. We embed an SKFE functional decryption key and ciphertext in a PKFE functional decryption key and ciphertext, respectively. We use these SKFE functional decryption key and ciphertext for the trapdoor mode of PKFE. We gradually change SKFE ciphertexts and keys so that we can embed a PKE-SKL challenge ciphertext by using the adaptively single-ciphertext function privacy of SKFE. Once we succeed in embedding a PKE-SKL challenge ciphertext, we can change a ciphertext of $x_{0}^{\ast}$ into a ciphertext of $x_{1}^{\ast}$ such that $f(x_{0}^{\ast})\neq f(x_{1}^{\ast})$ as long as the functional decryption key $\mathpzc{sk}_{f}=(\mathsf{fe}.\mathsf{sk}_{W},\mathsf{skl}.\mathpzc{sk})$ for $f$ is returned. This is because $\mathsf{skl}.\mathpzc{sk}$ is returned and we can use IND-KLA security under $\mathsf{skl}.\mathsf{ek}$. See Section 7 for more details.

1.4 Other Related Work

Quantum Copy Protection. Aaronson [Aar09] introduced the notion of quantum copy protection and constructed a quantum copy protection scheme for arbitrary unlearnable Boolean functions relative to a quantum oracle. He also provided two heuristic copy-protection schemes for point functions in the standard model. Coladangelo et al. [CMP20] provided a quantum copy-protection scheme for a class of evasive functions in the QROM. Subsequently, Aaronson et al. [ALL*+*21] constructed a quantum copy protection scheme for unlearnable functions relative to classical oracles. By instantiating the oracle with post-quantum candidate obfuscation schemes, they obtained a heuristic construction of copy protection. Coladangelo et al. [CLLZ21] provided a copy-protection scheme for pseudorandom functions in the plain model assuming iO, OWF and extractable witness encryption, or assuming subexponential iO, subexponential OWF, LWE and a strong “monogamy property” (which was was proven to be true in a follow-up work [CV22]). Ananth et al. [AK21, AKL*+*22] also constructed copy protection for point functions, which in turn can be transformed into copy protection for compute-and-compare programs. Sattath and Wyborski [SW22] studied unclonable decryptors, which are an extension of SDE. Their unclonable decryptors scheme is secret key encryption and can be instantiated with iO and OWF, or quantum oracles.

Secure software leasing. Secure software leasing (SSL) was introduced by Ananth and La Placa [AL21], where they also provided the first SSL scheme supporting a subclass of “evasive” functions by relying on the existence of public key quantum money and the learning with errors assumption. Evasive functions is a class of functions for which it is hard to find an accepting input given only black-box access to the function. Their construction achieves a strong security notion called infinite term security. They also demonstrate that there exists an unlearnable function class such that it is impossible to achieve an SSL scheme for that function class, even in the CRS model. Later, Coladangelo et al. [CMP20] improved the security notion achieved by [AL21] by relying on the QROM, for the same class of evasive functions. Additionally, Kitagawa, Nishimaki and Yamakawa [KNY21] provided a finite term secure SSL scheme for pseudorandom functions (PRFs) in the CRS model by assuming the hardness of the LWE problem against polynomial time quantum adversaries. Additionally, this work achieves classical communication. Further, Broadbent et al. [BJL*+*21] showed that SSL is achievable for the aforementioned evasive circuits without any setup or computational assumptions that were required by previous work, but with finite term security, quantum communication and correctness based on a distribution. The notion of secure leasing for the powerful primitive of functional encryption was studied by Kitagawa and Nishimaki [KN22a], who introduced the notion of secret key functional encryption (SKFE) with secure key leasing and provided a transformation from standard SKFE into SKFE with secure key leasing without relying on any additional assumptions.

Certified deletion. Broadbent and Islam [BI20] introduced the notion of quantum encryption with certified deletion, where we can generate a (classical) certificate to ensure that a ciphertext is deleted. They constructed a one-time SKE scheme with certified deletion without computational assumptions. After that, many works presented various quantum encryption primitives (PKE, ABE, FE and so on) with certified deletion [HMNY21, Por23, BK22, HMNY22]. The root of quantum encryption with certified deletion is revocable quantum time-released encryption by Unruh [Unr15]. It is an extension of time-released encryption where a sender can revoke quantum encrypted data before a pre-determined time. If the revocation succeeds, the receiver cannot obtain the plaintext information.

Related technique. The basic idea of our PKE-SKL is to prepare a superposition of two decryption keys and coherently run the decryption algorithm in each branch. Previous works by Zhang [Zha21, Zha22] use a similar idea of running some algorithm (which is an evaluation of “lookup tables” in their case) on two branches in superposition though their motivation is to construct efficient blind quantum computation and classical verification of quantum computation, which are completely irrelevant to PKE-SKL.

1.5 Concurrent Work

A concurrent and independent work by Ananth, Poremba, and Vaikuntanathan [APV23] introduces key-revocable PKE, which is similar to PKE-SKL. They construct key-revocable PKE based on the LWE assumption while our construction of PKE-SKL only assumes the existence of IND-CPA secure PKE. In addition, they only prove somewhat weaker security notion called $1$-bit unpredictability. Roughly, it ensures that the probability that the adversary passes the verification for the returned key and wins the IND game is at most $1/2+{\mathsf{negl}}(\lambda)$. For example, even if an adversary passes the verification with probability $1/3$ and has a distinguishing advantage $1$ conditioned on the acceptance, it is not considered to break the security while such an adversary breaks IND-KLA security. Thus, we believe that IND-KLA security is more desirable security notion than $1$-bit unpredictability.888Strictly speaking, IND-KLA security and $1$-bit unpredictability are incomparable because the former requires the indistinguishability between ciphertexts of two different messages whereas the latter requires the indistinguishability between a ciphertext of some message and a uniformly random string. On the other hand, the advantages of their work are that their construction of key-revocable PKE is based on dual-Regev encryption, which is likely to be more efficient than our PKE-SKL, and that they also show a fully homomorphic encryption variant.

1.6 Organization of the paper

In Section 2 we define the notation and preliminaries that we require in this work. In Section 3, we define the notion of public key encryption with secure key leasing (PKE-SKL) and its various security notions. We also show several general relationships among those security notions. In Section 4, we define and construct Public Key Encryption with CoIC-KLA security. In Section 5, we provide our construction of PKE with secure key leasing. In Section 6 and Section 7 we provide our construction of Attribute Based Encryption with secure key leasing and public key Functional Encryption with secure key leasing respectively.

2 Preliminaries

Notations and conventions.

In this paper, standard math or sans serif font stands for classical algorithms (e.g., $C$ or $\mathsf{Gen}$) and classical variables (e.g., $x$ or $\mathsf{pk}$). Calligraphic font stands for quantum algorithms (e.g., $\mathpzc{Gen}$) and calligraphic font and/or the bracket notation for (mixed) quantum states (e.g., $\mathpzc{q}$ or $\ket{\psi}$).

Let $[\ell]$ denote the set of integers $\{1,\cdots,\ell\}$, $\lambda$ denote a security parameter, and $y\coloneqq z$ denote that $y$ is set, defined, or substituted by $z$. For a finite set $X$ and a distribution $D$, $x\leftarrow X$ denotes selecting an element from $X$ uniformly at random, $x\leftarrow D$ denotes sampling an element $x$ according to $D$. Let $y\leftarrow\mathsf{A}(x)$ and $y\leftarrow\mathpzc{A}(\mathpzc{x})$ denote assigning to $y$ the output of a probabilistic or deterministic algorithm $\mathsf{A}$ and a quantum algorithm $\mathpzc{A}$ on an input $x$ and $\mathpzc{x}$, respectively. When we explicitly show that $\mathsf{A}$ uses randomness $r$, we write $y\leftarrow\mathsf{A}(x;r)$. PPT and QPT algorithms stand for probabilistic polynomial-time algorithms and polynomial-time quantum algorithms, respectively. Let ${\mathsf{negl}}$ denote a negligible function. For strings $x,y\in\{0,1\}^{n}$, $x\cdot y$ denotes $\bigoplus_{i\in[n]}x_{i}y_{i}$ where $x_{i}$ and $y_{i}$ denote the $i$th bit of $x$ and $y$, respectively.

2.1 Standard Cryptographic Tools

Secret-key encryption.

Definition 2.1 (Secret Key Encryption).

An SKE scheme $\mathsf{SKE}$ is a two tuple $(\mathsf{E},\mathsf{D})$ of PPT algorithms.

• •

The encryption algorithm $\mathsf{E}$, given a key $K\in\{0,1\}^{\lambda}$ and a plaintext $m\in\mathcal{M}$, outputs a ciphertext $\mathsf{ct}$, where $\mathcal{M}$ is the plaintext space of $\mathsf{SKE}$.

• •

The decryption algorithm $\mathsf{D}$, given a key $K$ and a ciphertext $\mathsf{ct}$, outputs a plaintext $\tilde{m}\in\{\bot\}\cup\mathcal{M}$. This algorithm is deterministic.

We require $\mathsf{SKE}$ to satisfy correctness.

Correctness:

*We require $\mathsf{D}(K,\mathsf{E}(K,m))=m$ for every $m\in\mathcal{M}$ and key $K\in\{0,1\}^{\lambda}$. *

Definition 2.2 (Ciphertext Pseudorandomness for SKE).

Let $\{0,1\}^{\ell}$ be the ciphertext space of $\mathsf{SKE}$. We define the following experiment $\mathsf{Exp}_{\mathpzc{A},\mathsf{SKE}}^{\mathsf{pr}\mbox{-}\mathsf{ct}}(1^{\lambda},\mathsf{coin})$ between a challenger and an adversary $\mathpzc{A}$.

The challenger generates $K\leftarrow\{0,1\}^{\lambda}$. Then, the challenger sends $1^{\lambda}$ to $\mathpzc{A}$. 2. 2.

$\mathpzc{A}$* may make polynomially many encryption queries adaptively. $\mathpzc{A}$ sends $m\in\mathcal{M}$ to the challenger. Then, the challenger returns $\mathsf{ct}\leftarrow\mathsf{E}(K,m)$ if $\mathsf{coin}=0$, otherwise $\mathsf{ct}\leftarrow\{0,1\}^{\ell}$.* 3. 3.

$\mathpzc{A}$* outputs $\mathsf{coin}^{\prime}\in\{0,1\}$.*

We say that $\mathsf{SKE}$ is pseudorandom-secure if for any QPT adversary $\mathpzc{A}$, we have

[TABLE]

Theorem 2.3.

If OWFs exist, there exists a pseudorandom-secure SKE scheme.

Public-key encryption.

Definition 2.4 (PKE).

A PKE scheme $\mathsf{PKE}$ is a tuple of three algorithms $(\mathsf{KG},\mathsf{Enc},\mathsf{Dec})$. Below, let $\mathcal{X}$ be the message space of $\mathsf{PKE}$.

$\mathsf{KG}(1^{\lambda})\rightarrow(\mathsf{ek},\mathsf{dk})$:

The key generation algorithm takes a security parameter $1^{\lambda}$, and outputs an encryption key $\mathsf{ek}$ and a decryption key $\mathsf{dk}$.

$\mathsf{Enc}(\mathsf{ek},\mathsf{m})\rightarrow\mathsf{ct}$:

The encryption algorithm takes an encryption key $\mathsf{ek}$ and a message $\mathsf{m}\in\mathcal{X}$, and outputs a ciphertext $\mathsf{ct}$.

$\mathsf{Dec}(\mathsf{dk},\mathsf{ct})\rightarrow\tilde{\mathsf{m}}$:

The decryption algorithm is a deterministic algorithm that takes a decryption key $\mathsf{dk}$ and a ciphertext $\mathsf{ct}$, and outputs a value $\tilde{\mathsf{m}}$.

Correctness:

For every $\mathsf{m}\in\mathcal{X}$, we have

[TABLE]

Definition 2.5 (IND-CPA Security).

We say that a PKE scheme $\mathsf{PKE}$ with the message space $\mathcal{X}$ is IND-CPA secure if it satisfies the following requirement, formalized from the experiment $\mathsf{Exp}_{\mathsf{PKE},\mathpzc{A}}^{\mathsf{ind}\mbox{-}\mathsf{cpa}}(1^{\lambda},\mathsf{coin})$ between an adversary $\mathpzc{A}$ and a challenger:

The challenger runs $(\mathsf{ek},\mathsf{dk})\leftarrow\mathsf{KG}(1^{\lambda})$ and sends $\mathsf{ek}$ to $\mathpzc{A}$. 2. 2.

$\mathpzc{A}$* sends $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})\in\mathcal{X}^{2}$ to the challenger.* 3. 3.

The challenger generates $\mathsf{ct}^{*}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{\mathsf{coin}}^{*})$ and sends $\mathsf{ct}^{*}$ to $\mathpzc{A}$. 4. 4.

$\mathpzc{A}$* outputs a guess $\mathsf{coin}^{\prime}$ for $\mathsf{coin}$. The challenger outputs $\mathsf{coin}^{\prime}$ as the final output of the experiment.*

For any QPT $\mathpzc{A}$, it holds that

[TABLE]

Definition 2.6 (OW-CPA Security).

We say that a PKE scheme $\mathsf{PKE}$ with the message space $\mathcal{X}$ is OW-CPA secure if it satisfies the following requirement, formalized from the experiment $\mathsf{Exp}_{\mathsf{PKE},\mathpzc{A}}^{\mathsf{ow}\mbox{-}\mathsf{cpa}}(1^{\lambda})$ between an adversary $\mathpzc{A}$ and a challenger:

The challenger runs $(\mathsf{ek},\mathsf{dk})\leftarrow\mathsf{KG}(1^{\lambda})$, chooses $\mathsf{m}^{*}\leftarrow\mathcal{X}$, runs $\mathsf{ct}^{*}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m}^{*})$, and sends $(\mathsf{ek},\mathsf{ct}^{*})$ to $\mathpzc{A}$. 2. 2.

$\mathpzc{A}$* sends $\mathsf{m}^{\prime}\in\mathcal{X}$ to the challenger.* 3. 3.

The challenger outputs $1$ if $\mathsf{m}^{\prime}=\mathsf{m}^{*}$ and otherwise [math] as the final output of the experiment.

For any QPT $\mathpzc{A}$, it holds that

[TABLE]

It is well-known that IND-CPA security implies OW-CPA security if $|\mathcal{X}|$ is super-polynomial.

Pseudorandom functions.

Definition 2.7 (Puncturable PRF).

A puncturable PRF (PPRF) is a tuple of algorithms $\mathsf{PPRF}=(\mathsf{PRF}.\mathsf{Gen},\mathsf{F},\mathsf{Puncture})$ where $\{\mathsf{F}_{\mathsf{K}}:\{0,1\}^{\ell_{1}}\rightarrow\{0,1\}^{\ell_{2}}\mid\mathsf{K}\in\{0,1\}^{\lambda}\}$ is a PRF family and satisfies the following two conditions. Note that $\ell_{1}$ and $\ell_{2}$ are polynomials of $\lambda$.

Punctured correctness:

For any polynomial-size set $S\subseteq\{0,1\}^{\ell_{1}}$ and any $x\in\{0,1\}^{\ell_{1}}\setminus S$, it holds that

[TABLE]

Pseudorandom at punctured point:

For any polynomial-size set $S\subseteq\{0,1\}^{\ell_{1}}$ and any QPT distinguisher $\mathpzc{A}$, it holds that

[TABLE]

where $\mathsf{K}\leftarrow\mathsf{PRF}.\mathsf{Gen}(1^{\lambda})$, $\mathsf{K}_{\notin S}\leftarrow\mathsf{Puncture}(\mathsf{K},S)$ and $\mathcal{U}_{\ell_{2}}$ denotes the uniform distribution over $\{0,1\}^{\ell_{2}}$.

If $S=\{x^{\ast}\}$ (i.e., puncturing a single point), we simply write $\mathsf{F}_{\neq x^{\ast}}(\cdot)$ instead of $\mathsf{F}_{\mathsf{K}_{\notin S}}(\cdot)$ and consider $\mathsf{F}_{\neq x^{\ast}}$ as a keyed function.

It is easy to see that the Goldwasser-Goldreich-Micali tree-based construction of PRFs (GGM PRF) [GGM86] from OWF yield puncturable PRFs where the size of the punctured key grows polynomially with the size of the set $S$ being punctured [BW13, BGI14, KPTZ13]. Thus, we have:

Theorem 2.8 ([GGM86, BW13, BGI14, KPTZ13]).

If OWFs exist, then for any polynomials $\ell_{1}(\lambda)$ and $\ell_{2}(\lambda)$, there exists a PPRF that maps $\ell_{1}$-bits to $\ell_{2}$-bits.

Garbling schemes.

Definition 2.9 (Garbling schemes).

A garbling scheme $\mathsf{GC}$ is a tuple of PPT algorithms $\mathsf{GC}=(\mathsf{Grbl},\mathsf{GCEval})$.

$\mathsf{Grbl}(1^{\lambda},C)\to(\{\mathsf{lab}_{i,b}\}_{i\in[\ell],b\in\{0,1\}},\widetilde{C})$:

The garbling algorithm takes a security parameter $1^{\lambda}$ and a circuit $C$ and outputs labels $\{\mathsf{lab}_{i,b}\}_{i\in[\ell],b\in\{0,1\}}$ and garbled version of the circuit $\widetilde{C}$, where $\ell$ is the input length of $C$.

$\mathsf{GCEval}(\widetilde{C},\{\mathsf{lab}_{i}\}_{i\in[\ell]})\rightarrow z$:

The evaluation algorithm $\mathsf{GCEval}$ takes the garbled circuit $\widetilde{C}$ and labels $\{\mathsf{lab}_{i}\}_{i\in[\ell]}$ and outputs an evaluation result $z$.

Correctness:

We require that

[TABLE]

holds for all $\ell\in\mathbb{N}$, $x\in\{0,1\}^{\ell}$ and $C$ with input length $\ell$, where $x_{i}$ is the $i$-th bit of $x$.

Security:

We require that there exists a PPT algorithm $\mathsf{Sim.GC}$ such the following distributions are computationally indistinguishable for all $\ell\in\mathbb{N}$, $x\in\{0,1\}^{\ell}$, and circuit $C$ with input length $\ell$:

[TABLE]

where $\mathsf{Grbl}(1^{\lambda},C))\to(\{\mathsf{lab}_{i,b}\}_{i\in[\ell],b\in\{0,1\}},\widetilde{C})$ and $\mathsf{info}(C)$ refers to the size of $C$, input and output lengths of $C$.

We note that we will drop $\mathsf{info}(C)$ from the inputs to $\mathsf{Sim.GC}$ when it is clear from the context.

Theorem 2.10.

[Yao86, LP09]** If there exists a one-way function, there exists secure garbling scheme.

Attribute-based encryption.

Definition 2.11 (Attribute-Based Encryption).

An ABE scheme $\mathsf{ABE}$ is a tuple of four PPT algorithms $(\mathsf{Setup},\mathsf{KG},\mathsf{Enc},\mathsf{Dec})$. Below, let $\mathcal{X}=\{\mathcal{X}_{\lambda}\}_{\lambda}$, $\mathcal{Y}=\{\mathcal{Y}_{\lambda}\}_{\lambda}$, and $R=\{R_{\lambda}:\mathcal{X}_{\lambda}\times\mathcal{Y}_{\lambda}\rightarrow\{0,1\}\}_{\lambda}$ be the ciphertext attribute space, key attribute space, and the relation associated with $\mathsf{ABE}$, respectively. We note that we will abuse the notation and occasionally drop the subscript for these spaces for notational simplicity. We also note that the message space is set to be $\{0,1\}^{\ell}$ below.

$\mathsf{Setup}(1^{\lambda})\rightarrow(\mathsf{pk},\mathsf{msk})$:

The setup algorithm takes a security parameter $1^{\lambda}$ and outputs a public key $\mathsf{pk}$ and master secret key $\mathsf{msk}$.

$\mathsf{KG}(\mathsf{msk},y)\rightarrow\mathsf{sk}_{y}$:

The key generation algorithm $\mathsf{KG}$ takes a master secret key $\mathsf{msk}$ and a key attribute $y\in\mathcal{Y}$, and outputs a decryption key $\mathsf{sk}_{y}$.

$\mathsf{Enc}(\mathsf{pk},x,m)\rightarrow\mathsf{ct}$:

The encryption algorithm takes a public key $\mathsf{pk}$, a ciphertext attribute $x\in\mathcal{X}$, and a message $x$, and outputs a ciphertext $\mathsf{ct}$.

$\mathsf{Dec}(\mathsf{sk}_{y},x,\mathsf{ct})\rightarrow z$:

The decryption algorithm takes a secret key $\mathsf{sk}_{f}$, a ciphertext attribute $x$, and the corresponding ciphertext $\mathsf{ct}$ and outputs $z\in\{\bot\}\cup\{0,1\}^{\ell}$.

Correctness:

We require that

[TABLE]

holds for all $x\in\mathcal{X}$ and $y\in\mathcal{Y}$ such that $R(x,y)=1$ and $m\in\{0,1\}^{\ell}$.

Definition 2.12 (Adaptive Security for ABE).

We say that $\mathsf{ABE}$ is an adaptively secure ABE scheme for relation $R:\mathcal{X}\times\mathcal{Y}\to\{0,1\}$, if it satisfies the following requirement, formalized from the experiment $\mathsf{Exp}_{\mathpzc{A}}^{\mathsf{ada}\mbox{-}\mathsf{ind}}(1^{\lambda},\mathsf{coin})$ between an adversary $\mathpzc{A}$ and a challenger:

The challenger runs $(\mathsf{pk},\mathsf{msk})\leftarrow\mathsf{Setup}(1^{\lambda})$ and sends $\mathsf{pk}$ to $\mathpzc{A}$. 2. 2.

$\mathpzc{A}$* sends arbitrary key queries. That is, $\mathpzc{A}$ sends a key attribute $y\in\mathcal{Y}$ to the challenger and the challenger responds with $\mathsf{sk}_{y}\leftarrow\mathsf{KG}(\mathsf{msk},y)$ for the query.* 3. 3.

At some point, $\mathpzc{A}$ sends $(x,m_{0},m_{1})$ to the challenger. If $R(x,y)=0$ for all queried $y$, the challenger generates a ciphertext $\mathsf{ct}^{*}\leftarrow\mathsf{Enc}(\mathsf{pk},x,m_{\mathsf{coin}})$. The challenger sends $\mathsf{ct}^{*}$ to $\mathpzc{A}$. 4. 4.

Again, $\mathpzc{A}$ can send key queries $y$ such that $R(x,y)=0$. 5. 5.

$\mathpzc{A}$* outputs a guess $\mathsf{coin}^{\prime}$ for $\mathsf{coin}$.* 6. 6.

The experiment outputs $\mathsf{coin}^{\prime}$.

We say that $\mathsf{ABE}$ is adaptively secure if, for any QPT $\mathpzc{A}$, it holds that

[TABLE]

Definition 2.13 (Selective Security for ABE).

We also define selective security for $\mathsf{ABE}$. For doing so, we consider the same security game as that for adaptive security except that the adversary $\mathpzc{A}$ should declare its target $x$ at the beginning of the game (even before it is given $\mathsf{pk}$). We then define the advantage $\mathsf{Adv}_{\mathsf{ABE},\mathpzc{A}}^{\mathsf{sel}\mbox{-}\mathsf{ind}}(\lambda)$ for the selective security similarly. We say $\mathsf{ABE}$ is selectively indistinguishably-secure if for any QPT adversary $\mathpzc{A}$, $\mathsf{Adv}_{\mathsf{ABE},\mathpzc{A}}^{\mathsf{sel}\mbox{-}\mathsf{ind}}(\lambda)$ is negligible.

By setting $\mathcal{X}$, $\mathcal{Y}$, and $R$ appropriately, we can recover important classes of ABE. In particular, if we set $\mathcal{X}_{\lambda}=\mathcal{Y}_{\lambda}=\{0,1\}^{*}$ and define $R$ so that $R(x,y)=1$ if $x=y$ and $R(x,y)=0$ otherwise, we recover the definition of identity-based encryption (IBE). If we set $\mathcal{X}_{\lambda}=\{0,1\}^{n(\lambda)}$ and $\mathcal{Y}_{\lambda}$ to be the set of all circuits with input space $\{0,1\}^{n(\lambda)}$ and depth at most $d(\lambda)$, where $n$ and $d$ are some polynomials, and define $R$ so that $R(x,y)=y(x)$, we recover the definition of ABE for circuits.

Functional encryption.

Definition 2.14 (Secret-Key Functional Encryption).

An SKFE scheme $\mathsf{SKFE}$ is a tuple of four PPT algorithms $(\mathsf{Setup},\mathsf{KG},\mathsf{Enc},\mathsf{Dec})$. Below, let $\mathcal{X}$, $\mathcal{Y}$, and $\mathcal{F}$ be the plaintext, output, and function spaces $\mathsf{SKFE}$, respectively.

$\mathsf{Setup}(1^{\lambda})\rightarrow\mathsf{msk}$:

The setup algorithm takes a security parameter $1^{\lambda}$, and outputs a master secret key $\mathsf{msk}$.

$\mathsf{KG}(\mathsf{msk},f)\rightarrow\mathsf{sk}_{f}$:

The key generation algorithm takes a master secret key $\mathsf{msk}$ and a function $f\in\mathcal{F}$, and outputs a functional decryption key $\mathsf{sk}_{f}$.

$\mathsf{Enc}(\mathsf{msk},x)\rightarrow\mathsf{ct}$:

The encryption algorithm takes a master secret key $\mathsf{msk}$ and a plaintext $x\in\mathcal{X}$, and outputs a ciphertext $\mathsf{ct}$.

$\mathsf{Dec}(\mathsf{sk}_{f},\mathsf{ct})\rightarrow y$:

The decryption algorithm takes a functional decryption key $\mathsf{sk}_{f}$ and a ciphertext $\mathsf{ct}$, and outputs $y\in\{\bot\}\cup\mathcal{Y}$.

Correctness:

We require that for every $x\in\mathcal{X}$, $f\in\mathcal{F}$, $q\in\mathbb{N}$, we have that

[TABLE]

Definition 2.15 (Function Privacy).

We formalize the experiment $\mathsf{Exp}_{\mathpzc{A},\mathsf{SKFE}}^{\mathsf{full}\mbox{-}\mathsf{fp}}(1^{\lambda},\mathsf{coin})$ between an adversary $\mathpzc{A}$ and a challenger for SKFE scheme for $\mathcal{X},\mathcal{Y}$, and $\mathcal{F}$ as follows:

At the beginning, the challenger runs $\mathsf{msk}\leftarrow\mathsf{Setup}(1^{\lambda})$. Throughout the experiment, $\mathpzc{A}$ can access the following oracles.

$O_{\mathtt{\mathsf{Enc}}}(x_{0},x_{1})$:

Given $(x_{0},x_{1})$, it returns $\mathsf{Enc}(\mathsf{msk},x_{\mathsf{coin}})$.

$O_{\mathtt{\mathsf{KG}}}(f_{0},f_{1})$:

Given $(f_{0},f_{1})$, it returns $\mathsf{KG}(\mathsf{msk},f_{\mathsf{coin}})$. 2. 2.

If the following happens during the oracle queries above, the experiment aborts: $f_{0}(x_{0})\neq f_{1}(x_{1})$ or $\absolutevalue{x_{0}}\neq\absolutevalue{x_{1}}$ or $\absolutevalue{f_{0}}\neq\absolutevalue{f_{1}}$. 3. 3.

$\mathpzc{A}$* outputs a guess $\mathsf{coin}^{\prime}$ for $\mathsf{coin}$. The challenger outputs $\mathsf{coin}^{\prime}$ as the final output of the experiment.*

We say that $\mathsf{SKFE}$ is fully function private if, for any QPT $\mathpzc{A}$, it holds that

[TABLE]

If $\mathpzc{A}$ can access $O_{\mathtt{\mathsf{Enc}}}$ only once in $\mathsf{Exp}_{\mathsf{SKFE},\mathpzc{A}}^{\mathsf{full}\mbox{-}\mathsf{fp}}$, we say that $\mathsf{SKFE}$ is adaptively single-ciphertext function private.

Theorem 2.16 ([GVW12, BS18, ABSV15, AV19]).

If there exist OWFs, there exists adaptively single-ciphertext function private SKFE for $\mathsf{P/poly}$.

Definition 2.17 (Public-Key Functional Encryption).

A PKFE scheme $\mathsf{PKFE}$ is a tuple of four PPT algorithms $(\mathsf{Setup},\mathsf{KG},\mathsf{Enc},\mathsf{Dec})$. Below, let $\mathcal{X}$, $\mathcal{Y}$, and $\mathcal{F}$ be the plaintext, output, and function spaces of $\mathsf{PKFE}$, respectively.

$\mathsf{Setup}(1^{\lambda})\rightarrow(\mathsf{pk},\mathsf{msk})$:

The setup algorithm takes a security parameter $1^{\lambda}$ and outputs a public key $\mathsf{pk}$ and master secret key $\mathsf{msk}$.

$\mathsf{KG}(\mathsf{msk},f)\rightarrow\mathsf{sk}_{f}$:

The key generation algorithm $\mathsf{KG}$ takes a master secret key $\mathsf{msk}$ and a function $f\in\mathcal{F}$, and outputs a functional decryption key $\mathsf{sk}_{f}$.

$\mathsf{Enc}(\mathsf{pk},x)\rightarrow\mathsf{ct}$:

The encryption algorithm takes a public key $\mathsf{pk}$ and a message $x\in\mathcal{X}$, and outputs a ciphertext $\mathsf{ct}$.

$\mathsf{Dec}(\mathsf{sk}_{f},\mathsf{ct})\rightarrow y$:

The decryption algorithm takes a functional decryption key $\mathsf{sk}_{f}$ and a ciphertext $\mathsf{ct}$, and outputs $y\in\{\bot\}\cup\mathcal{Y}$.

Correctness:

We require we have that

[TABLE]

Definition 2.18 (Adaptive Security for PKFE).

We formalize the experiment $\mathsf{Exp}_{\mathpzc{A}}^{\mathsf{ada}\mbox{-}\mathsf{ind}}(1^{\lambda},\mathsf{coin})$ between an adversary $\mathpzc{A}$ and a challenger for PKFE scheme for $\mathcal{X},\mathcal{Y}$, and $\mathcal{F}$ as follows:

The challenger runs $(\mathsf{pk},\mathsf{msk})\leftarrow\mathsf{Setup}(1^{\lambda})$ and sends $\mathsf{pk}$ to $\mathpzc{A}$. 2. 2.

$\mathpzc{A}$* sends arbitrary key queries. That is, $\mathpzc{A}$ sends function $f_{i}\in\mathcal{F}$ to the challenger and the challenger responds with $\mathsf{sk}_{f_{i}}\leftarrow\mathsf{KG}(\mathsf{msk},f_{i})$ for the $i$-th query $f_{i}$.* 3. 3.

At some point, $\mathpzc{A}$ sends $(x_{0},x_{1})$ to the challenger. If $f_{i}(x_{0})=f_{i}(x_{1})$ for all $i$, the challenger generates a ciphertext $\mathsf{ct}^{*}\leftarrow\mathsf{Enc}(\mathsf{pk},x_{\mathsf{coin}})$. The challenger sends $\mathsf{ct}^{*}$ to $\mathpzc{A}$. 4. 4.

Again, $\mathpzc{A}$ can sends function queries $f_{i}$ such that $f_{i}(x_{0})=f_{i}(x_{1})$. 5. 5.

$\mathpzc{A}$* outputs a guess $\mathsf{coin}^{\prime}$ for $\mathsf{coin}$.* 6. 6.

The experiment outputs $\mathsf{coin}^{\prime}$.

We say that $\mathsf{PKFE}$ is adaptively secure if, for any QPT $\mathpzc{A}$, it holds that

[TABLE]

If $\mathpzc{A}$ can send only $q$ key queries in $\mathsf{Exp}_{\mathsf{PKFE},\mathpzc{A}}^{\mathsf{ada}\mbox{-}\mathsf{ind}}$ where $q$ is a bounded polynomial, we say that $\mathsf{PKFE}$ is $q$-bounded adaptively secure.

Theorem 2.19 ([GVW12, AV19]).

If there exists IND-CPA secure PKE, there exists $q$-bounded adaptively secure PKFE for $\mathsf{P/poly}$.

Remark 2.20.

We defined FE as key-policy FE (KPFE) here. There is another type of FE called ciphertext-policy FE (CPFE). Since we use CPFE only as a building block of the CoIC-KLA secure PKE scheme in Section 4, we defer its definition to Section 4.1.

2.2 Useful Lemmata

The following lemma is taken verbatim from [BZ13, Lemma 2.1].

Lemma 2.21 ([BZ13, Lemma 2.1]).

Let $\mathpzc{A}$ be a quantum algorithm, and let $\Pr[x]$ be the probability that $\mathpzc{A}$ outputs $x$. Let $\mathpzc{A}^{\prime}$ be another quantum algorithm obtained from $\mathpzc{A}$ by pausing $\mathpzc{A}$ at an arbitrary stage of execution, performing a partial measurement that obtains one of $k$ outcomes, and then resuming $\mathpzc{A}$. Let $\Pr^{\prime}[x]$ be the probability $\mathpzc{A}^{\prime}$ outputs $x$. Then $\Pr^{\prime}[x]\geq\Pr[x]/k$.

We will also need the quantum Goldreich-Levin lemma established by [CLLZ21] based on [AC02].

Lemma 2.22 (Quantum Goldreich-Levin with Quantum Auxiliary Input [CLLZ21, Lemma B.12]).

There exists a QPT algorithm $\mathpzc{Ext}$ that satisfies the following. Let $n\in\mathbb{N}$, $x\in\{0,1\}^{n}$, $\epsilon\in[0,1/2]$, and $\mathpzc{A}$ be a quantum algorithm with a quantum auxiliary input $\mathpzc{aux}$ such that

[TABLE]

*Then, we have *

[TABLE]

*where $[\mathpzc{A}]$ means the description of $\mathpzc{A}$. *

3 Public Key Encryption with Secure Key Leasing

In this section, we define the notion of public key encryption with secure key leasing (PKE-SKL) and its various security notions. Then we show several general relationships among those security notions.

3.1 Definitions

The syntax of PKE-SKL is defined as follows.

Definition 3.1 (PKE with Secure Key Leasing).

A PKE-SKL scheme $\mathsf{SKL}$ is a tuple of four algorithms $(\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec},\mathpzc{Vrfy})$. Below, let $\mathcal{X}$ be the message space of $\mathsf{SKL}$.

$\mathpzc{KG}(1^{\lambda})\rightarrow(\mathsf{ek},\mathpzc{dk},\mathsf{vk})$:

The key generation algorithm takes a security parameter $1^{\lambda}$, and outputs an encryption key $\mathsf{ek}$, a decryption key $\mathpzc{dk}$, and a verification key $\mathsf{vk}$.

$\mathsf{Enc}(\mathsf{ek},\mathsf{m})\rightarrow\mathsf{ct}$:

The encryption algorithm takes an encryption key $\mathsf{ek}$ and a message $\mathsf{m}\in\mathcal{X}$, and outputs a ciphertext $\mathsf{ct}$.

$\mathpzc{Dec}(\mathpzc{dk},\mathsf{ct})\rightarrow\tilde{\mathsf{m}}$:

The decryption algorithm takes a decryption key $\mathpzc{dk}$ and a ciphertext $\mathsf{ct}$, and outputs a value $\tilde{\mathsf{m}}$.

$\mathpzc{Vrfy}(\mathsf{vk},\widetilde{\mathpzc{dk}})\rightarrow\top/\bot$:

The verification algorithm takes a verification key $\mathsf{vk}$ and a (possibly malformed) decryption key $\widetilde{\mathpzc{dk}}$, and outputs $\top$ or $\bot$.

Decryption correctness:

For every $\mathsf{m}\in\mathcal{X}$, we have

[TABLE]

Verification correctness:

We have

[TABLE]

Remark 3.2.

We can assume without loss of generality that a decryption key of a PKE-SKL scheme is reusable, i.e., it can be reused to decrypt (polynomially) many ciphertexts. In particular, we can asusme that for honestly generated $\mathsf{ct}$ and $\mathpzc{dk}$, if we decrypt $\mathsf{ct}$ by using $\mathpzc{dk}$, the state of the decryption key after the decryption is negligibly close to that before the decryption in terms of trace distance. This is because the output of the decryption is almost deterministic by decryption correctness, and thus such an operation can be done without almost disturbing the input state by the gentle measurement lemma [Win99]. A similar remark applies to all variants of PKE-SKL (IBE, ABE, and FE with SKL) defined in this paper.

Remark 3.3.

Though we are the first to define PKE with secure key leasing, SKFE with secure key leasing was already defined by Kitagawa and Nishimaki [KN22a]. The above definition is a natural adaptation of their definition with the important difference that we do not require classical certificate of deletion.

We define several security notions for PKE-SKL. The first is a natural indistinguishability security definition, which is our primary taget.

Definition 3.4 (IND-KLA Security).

We say that a PKE-SKL scheme $\mathsf{SKL}$ with the message space $\mathcal{X}$ is IND-KLA secure, if it satisfies the following requirement, formalized from the experiment $\mathsf{Exp}_{\mathsf{SKL},\mathpzc{A}}^{\mathsf{ind}\mbox{-}\mathsf{kla}}(1^{\lambda},\mathsf{coin})$ between an adversary $\mathpzc{A}$ and a challenger $\mathpzc{C}$:

$\mathpzc{C}$* runs $(\mathsf{ek},\mathpzc{dk},\mathsf{vk})\leftarrow\mathpzc{KG}(1^{\lambda})$ and sends $\mathsf{ek}$ and $\mathpzc{dk}$ to $\mathpzc{A}$.* 2. 2.

Throughout the experiment, $\mathpzc{A}$ can access the following (stateful) verification oracle $O_{\mathtt{\mathpzc{Vrfy}}}$ where $V$ is initialized to be $\bot$:

** $O_{\mathtt{\mathpzc{Vrfy}}}(\widetilde{\mathpzc{dk}})$:**

*It runs $d\leftarrow\mathsf{Vrfy}(\mathsf{vk},\widetilde{\mathpzc{dk}})$ and returns $d$. If $V=\bot$ and $d=\top$, it updates $V\coloneqq\top$. * 3. 3.

$\mathpzc{A}$* sends $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})\in\mathcal{X}^{2}$ to $\mathpzc{C}$. If $V=\bot$, $\mathpzc{C}$ output [math] as the final output of this experiment. Otherwise, $\mathpzc{C}$ generates $\mathsf{ct}^{*}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{\mathsf{coin}}^{*})$ and sends $\mathsf{ct}^{*}$ to $\mathpzc{A}$.* 4. 4.

$\mathpzc{A}$* outputs a guess $\mathsf{coin}^{\prime}$ for $\mathsf{coin}$. $\mathpzc{C}$ outputs $\mathsf{coin}^{\prime}$ as the final output of the experiment.*

For any QPT $\mathpzc{A}$, it holds that

[TABLE]

*We say that $\mathsf{SKL}$ is 1-query IND-KLA secure if the above holds for any QPT $\mathpzc{A}$ that makes at most one query to $O_{\mathtt{\mathpzc{Vrfy}}}$. *

Remark 3.5.

When we consider a 1-query adversary, we can assume that its query is made before receiving the challenge ciphertext $\mathsf{ct}^{*}$ without loss of generality. This is because otherwise the experiment always outputs [math].

Remark 3.6.

By a standard hybrid argument, one can show that IND-KLA security implies multi-challenge IND-KLA security where the adversary is allowed to request arbitrarily many challenge ciphertexts. Thus, if we have an IND-KLA secure PKE-SKL scheme for single-bit messages, we can extend the plaintext length to an arbitrary polynomial by bit-by-bit encryption.

We also define the one-way variant of the above security.

Definition 3.7 (OW-KLA Security).

We say that a PKE-SKL scheme $\mathsf{SKL}$ with the message space $\mathcal{X}$ is OW-KLA secure, if it satisfies the following requirement, formalized from the experiment $\mathsf{Exp}_{\mathsf{SKL},\mathpzc{A}}^{\mathsf{ow}\mbox{-}\mathsf{kla}}(1^{\lambda})$ between an adversary $\mathpzc{A}$ and a challenger $\mathpzc{C}$:

$\mathpzc{C}$* runs $(\mathsf{ek},\mathpzc{dk},\mathsf{vk})\leftarrow\mathpzc{KG}(1^{\lambda})$ and sends $\mathsf{ek}$ and $\mathpzc{dk}$ to $\mathpzc{A}$.* 2. 2.

Throughout the experiment, $\mathpzc{A}$ can access the following (stateful) verification oracle $O_{\mathtt{\mathpzc{Vrfy}}}$ where $V$ is initialized to be $\bot$:

** $O_{\mathtt{\mathpzc{Vrfy}}}(\widetilde{\mathpzc{dk}})$:**

It runs $d\leftarrow\mathsf{Vrfy}(\mathsf{vk},\widetilde{\mathpzc{dk}})$ and returns $d$. If $V=\bot$ and $d=\top$, it updates $V\coloneqq\top$. 3. 3.

$\mathpzc{A}$* sends $\mathsf{RequestChallenge}$ to $\mathpzc{C}$. If $V=\bot$, $\mathpzc{C}$ outputs [math] as the final output of this experiment. Otherwise, $\mathpzc{C}$ chooses $\mathsf{m}^{*}\leftarrow\mathcal{X}$, generates $\mathsf{ct}^{*}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m}^{*})$ and sends $\mathsf{ct}^{*}$ to $\mathpzc{A}$.* 4. 4.

$\mathpzc{A}$* outputs $\mathsf{m}$. $\mathpzc{C}$ outputs $1$ if $\mathsf{m}=\mathsf{m}^{*}$ and otherwise outputs [math] as the final output of the experiment.*

For any QPT $\mathpzc{A}$, it holds that

[TABLE]

We say that $\mathsf{SKL}$ is 1-query OW-KLA secure if the above holds for any QPT $\mathpzc{A}$ that makes at most one query to $O_{\mathtt{\mathpzc{Vrfy}}}$.

Similar to normal PKE, IND-KLA security implies OW-KLA security if $|\mathcal{X}|$ is super-polynomial in $\lambda$.

Finally, we define a security notion which we call one-more unreturnability (OMUR), which requires that an adversary given a single copy of the decryption key cannot pass the verification more than once. Though this does not seem very meaningful by itself, this is a useful intermediate tool for our final goal of constructing IND-KLA secure scheme.

Definition 3.8 (One-More Unreturnability).

We say that a PKE-SKL scheme $\mathsf{SKL}$ with the message space $\mathcal{X}$ satisfies One-More UnReturnability (OMUR), if it satisfies the following requirement, formalized from the experiment $\mathsf{Expt}_{\mathsf{SKL},\mathpzc{A}}^{\mathsf{omur}}(1^{\lambda})$ between an adversary $\mathpzc{A}$ and a challenger $\mathpzc{C}$:

$\mathpzc{C}$* runs $(\mathsf{ek},\mathpzc{dk},\mathsf{vk})\leftarrow\mathpzc{KG}(1^{\lambda})$ and sends $\mathsf{ek}$ and $\mathpzc{dk}$ to $\mathpzc{A}$.* 2. 2.

Throughout the experiment, $\mathpzc{A}$ can access the following (stateful) verification oracle $O_{\mathtt{\mathpzc{Vrfy}}}$ where $\mathsf{count}$ is initialized to be [math]:

$O_{\mathtt{\mathpzc{Vrfy}}}(\widetilde{\mathpzc{dk}})$:

It runs $d\leftarrow\mathsf{Vrfy}(\mathsf{vk},\widetilde{\mathpzc{dk}})$ and returns $d$. It updates $\mathsf{count}\coloneqq\mathsf{count}+1$ if $d=\top$. 3. 3.

$\mathpzc{A}$* sends $\mathsf{Finish}$ to $\mathpzc{C}$. If $\mathsf{count}\geq 2$, $\mathpzc{C}$ outputs $1$ and [math] otherwise as the final output of this experiment.*

For any QPT $\mathpzc{A}$, it holds that

[TABLE]

3.2 Relationships among Security Notions

We show several relationships among different security notions for PKE-SKL. In particular, we show the following theorem.

Theorem 3.9.

*If there exists a 1-query OW-KLA secure PKE-SKL scheme, there exists an IND-KLA secure PKE-SKL scheme. *

This theorem simplifies our task: For constructing a (${\mathrm{poly}}$-query) IND-KLA secure scheme, it suffices to construct a 1-query OW-KLA secure scheme. We construct a 1-query OW-KLA secure scheme in Section 5.

We prove Theorem 3.9 in the following three steps.

Give a conversion to add OMUR to any 1-query OW-KLA secure scheme (Lemma 3.10). 2. 2.

Convert a 1-query OW-KLA secure scheme that satisfies OMUR to a 1-query IND-KLA secure scheme that satisfies OMUR (Lemma 3.12). 3. 3.

Show that any 1-query IND-KLA secure scheme that satisfies OMUR is IND-KLA secure (Lemma 3.14).

It is clear that Theorem 3.9 follows from Lemmata 3.10, 3.12 and 3.14. We prove them in the following.

Lemma 3.10.

If there exists a 1-query OW-KLA secure PKE-SKL scheme, then there exists a 1-query OW-KLA secure PKE-SKL scheme that satisfies OMUR.

Remark 3.11.

This lemma is actually not needed for the purpose of this paper since our construction of a 1-query OW-KLA secure PKE-SKL scheme in Section 5 already satisfies OMUR as mentioned in Remark 5.7. We include this lemma in the paper because this general reduction may be useful in future works.

Proof of Lemma 3.10.

Let $\mathsf{OW}=(\mathsf{OW}.\mathpzc{KG},\mathsf{OW}.\mathsf{Enc},\mathsf{OW}.\mathpzc{Dec},\mathsf{OW}.\mathpzc{Vrfy})$ be a 1-query OW-KLA secure PKE-SKL scheme with the message space $\mathcal{X}$. We assume that a decryption key of $\mathsf{OW}$ is reusable in the sense of Remark 3.2 and $\mathsf{vk}$ contains $\mathsf{ek}$ without loss of generality. Then we consider a modified PKE-SKL scheme $\mathsf{OW}^{\prime}=(\mathsf{OW}^{\prime}.\mathpzc{KG},\mathsf{OW}^{\prime}.\mathsf{Enc},\mathsf{OW}^{\prime}.\mathpzc{Dec},\mathsf{OW}^{\prime}.\mathpzc{Vrfy})$ with the same message space $\mathcal{X}$ defined as follows. The algorithms $\mathsf{OW}^{\prime}.\mathpzc{KG}$, $\mathsf{OW}^{\prime}.\mathsf{Enc}$, and $\mathsf{OW}^{\prime}.\mathpzc{Dec}$ are identical to $\mathsf{OW}.\mathpzc{KG}$, $\mathsf{OW}.\mathsf{Enc}$, and $\mathsf{OW}.\mathpzc{Dec}$, respectively. The algorithm $\mathsf{OW}^{\prime}.\mathpzc{Vrfy}$ works as follows:

$\mathsf{OW}^{\prime}.\mathpzc{Vrfy}(\mathsf{vk},\widetilde{\mathpzc{dk}})$:

On input a verification key $\mathsf{vk}$ and a (possibly malformed) decryption key $\widetilde{\mathpzc{dk}}$, do the following:

Decryptability verification:

Choose $\mathsf{m}\leftarrow\mathcal{X}$ and run $\mathsf{ct}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m})$ and $\mathsf{m}^{\prime}\leftarrow\mathsf{Dec}(\widetilde{\mathpzc{dk}},\mathsf{ct})$. If $\mathsf{m}^{\prime}\neq\mathsf{m}$, return $\bot$.

Original verification:

Otherwise, let $\widetilde{\mathpzc{dk}}^{\prime}$ be the state of the decryption key after running the decryption algorithm. Run $\mathsf{OW}.\mathpzc{Vrfy}(\mathsf{vk},\widetilde{\mathpzc{dk}}^{\prime})$ and return whatever $\mathsf{OW}.\mathpzc{Vrfy}$ returns.

Correctness.

The decryption correctness of $\mathsf{OW}^{\prime}$ follows from that of $\mathsf{OW}$ because the only difference between these schemes is the verification algorithm, which is irrelevant to the decryption correctness. The verification correctness of $\mathsf{OW}^{\prime}$ follows from that of $\mathsf{OW}$ because we assume that $\mathsf{OW}$ has reusable decryption keys and thus $\widetilde{\mathpzc{dk}}^{\prime}$ in $\mathsf{OW}^{\prime}.\mathpzc{Vrfy}$ has a negligible trace distance from $\widetilde{\mathpzc{dk}}$, which passes $\mathsf{OW}.\mathpzc{Vrfy}$ except for a negligible probability by the verification correctness of $\mathsf{OW}$.

1-query OW-SKL security.

The 1-query OW-SKL security of $\mathsf{OW}^{\prime}$ follows from that of $\mathsf{OW}$ by a straightforward reduction. Specifically, let $\mathpzc{A}$ be an QPT adversary that breaks the 1-query OW-SKL security of $\mathsf{OW}^{\prime}$. Then, we construct a QPT adversary $\mathpzc{B}$ that breaks the 1-query OW-SKL security of $\mathsf{OW}$ as follows:

$\mathpzc{B}(\mathsf{ek},\mathpzc{dk})$:

Run $\mathpzc{A}(\mathsf{ek},\mathpzc{dk})$ until $\mathpzc{A}$ makes a verification query $\widetilde{\mathpzc{dk}}$. For simulating the verification oracle to $\mathpzc{A}$, choose $\mathsf{m}\leftarrow\mathcal{X}$, run $\mathsf{ct}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m})$ and $\mathsf{m}^{\prime}\leftarrow\mathsf{Dec}(\widetilde{\mathpzc{dk}},\mathsf{ct})$, and let $\widetilde{\mathpzc{dk}}^{\prime}$ be the state of the decryption key after running the decryption algorithm. If $\mathsf{m}^{\prime}\neq\mathsf{m}$, output [math] and immediately halt. Otherwise, query $\widetilde{\mathpzc{dk}}^{\prime}$ to its own verification oracle, and forward the response to $\mathpzc{A}$. When $\mathpzc{A}$ sends $\mathsf{RequestChallenge}$, forward it to the external challenger to receive $\mathsf{ct}^{*}$ and forward it to $\mathpzc{A}$. Run $\mathpzc{A}$ until it halts and output whatever $\mathpzc{A}$ outputs.

We can see that the experiment which $\mathpzc{B}$ plays outputs $1$ if and only if the (simulated) experiment which $\mathpzc{A}$ plays outputs $1$. Therefore, $\mathpzc{B}$ breaks the 1-query OW-SKL security of $\mathsf{OW}$. Thus, the 1-query OW-SKL security of $\mathsf{OW}^{\prime}$ follows from that of $\mathsf{OW}$.

OMUR.

In the following, we show that $\mathsf{OW}^{\prime}$ satisfies OMUR. Let $\mathpzc{A}$ be a QPT adversary against the OMUR of $\mathsf{OW}^{\prime}$ that makes $Q={\mathrm{poly}}(\lambda)$ verification queries. Then we consider the following sequence of hybrids.

$\mathsf{Hyb}_{0}$:

This is identical to the experiment $\mathsf{Expt}_{\mathsf{OW}^{\prime},\mathpzc{A}}^{\mathsf{omur}}(1^{\lambda})$ as defined in Definition 3.8.

Note that we have

[TABLE]

$\mathsf{Hyb}_{1}$:

This is identical to $\mathsf{Hyb}_{0}$ except that the challenger uniformly chooses integers $1\leq i_{1}<i_{2}\leq Q$ at the beginning of the experiment and outputs $1$ if and only if $i_{1}$-th and $i_{2}$-th verification queries are the first two queries to which the verification oracle returned $\top$.

Whenever $\mathsf{Hyb}_{0}$ returns $1$, there are at least $2$ verification queries accepted by the verification oracle. Therefore, when we uniformly choose $1\leq i_{1}<i_{2}\leq Q$, the probability that $i_{1}$-th and $i_{2}$-th queries are the first two queries to be accepted is ${\binom{Q}{2}}^{-1}=\frac{2}{Q(Q-1)}$. Therefore we have

[TABLE]

$\mathsf{Hyb}_{2}$:

This is identical to $\mathsf{Hyb}_{1}$ except that the verification oracle just returns $\bot$ without running the verification algorithm to $i$-th query for all $i\in[i_{2}-1]\setminus\{i_{1}\}$ and the experiment halts right after running the verification oracle for the $i_{2}$-th query where it outputs $1$ if and only if the verification oracle returned $\top$ to both $i_{1}$-th and $i_{2}$-th queries.

When $\mathsf{Hyb}_{1}$ returns $1$, the verification oracle returns $\bot$ to $i$-th query for all $i\in[i_{2}-1]\setminus\{i_{1}\}$ since otherwise $i_{1}$-th and $i_{2}$-th queries cannot be the first $2$ queries to be accepted. Therefore, these hybrids are identical until $\mathpzc{A}$ makes $i_{2}$-th query when $\mathsf{Hyb}_{1}$ returns $1$.999 Note that there is a superficial difference that the verification oracle of $\mathsf{Hyb}_{1}$ runs the verification algorithm to $i$-th query for all $i\in[i_{2}-1]\setminus\{i_{1}\}$ in $\mathsf{Hyb}_{1}$ but it does not in $\mathsf{Hyb}_{2}$. However since these query registers are not used at all for generating the output of $\mathsf{Hyb}_{2}$, the difference of if measurements are applied on them cannot affect the probability to output $1$. Moreover, $\mathsf{Hyb}_{2}$ outputs $1$ whenever $\mathsf{Hyb}_{1}$ outputs $1$ if we run the rest of $\mathpzc{A}$ to complete $\mathsf{Hyb}_{1}$. Therefore, we have

[TABLE]

$\mathsf{Hyb}_{3}$:

This is identical to $\mathsf{Hyb}_{2}$ except that the experiment outputs $1$ if and only if $i_{1}$-th query is accepted and $i_{2}$-th query passes the “Decryptability verification" part of $\mathsf{OW}^{\prime}.\mathpzc{Vrfy}$, i.e., $\mathsf{m}=\mathsf{m}^{\prime}$ in the notation of the description of $\mathsf{OW}^{\prime}.\mathpzc{Vrfy}$.

Since the condition to output $1$ is just relaxed, we have

[TABLE]

Below, we prove

[TABLE]

To prove this, we consider the following QPT adversary $\mathpzc{B}$ against the 1-query OW-SKL security of $\mathsf{OW}$ that works as follows:

$\mathpzc{B}(\mathsf{ek},\mathpzc{dk})$:

Uniformly choose integers $1\leq i_{1}<i_{2}\leq Q$ and run $\mathpzc{A}(\mathsf{ek},\mathpzc{dk})$ until it makes $i_{2}$-th query where the response by the verification oracle to $\mathpzc{A}$’s $i$-th query for $i\in[i_{2}-1]$ is simulated as follows: If $i\neq i_{1}$, return $\bot$ as the response from the verification oracle. If $i=i_{1}$, forward the query to its own verification oracle and forward the response to $\mathpzc{A}$. Let $\mathpzc{dk}_{i_{2}}$ be $\mathpzc{A}$’s $i_{2}$-th verification query. Send $\mathsf{RequestChallenge}$ to the external challenger to receive $\mathsf{ct}^{*}$. Run $\mathsf{m}^{\prime}\leftarrow\mathsf{OW}.\mathsf{Dec}(\mathsf{ct}^{*},\mathpzc{dk})$ and output $\mathsf{m}^{\prime}$.

By the definitions of $\mathsf{Hyb}_{3}$ and $\mathpzc{B}$, we can see that

[TABLE]

Thus, we have $\Pr[\mathsf{Hyb}_{3}=1]={\mathsf{negl}}(\lambda)$ by the 1-query OW-SKL security of $\mathsf{OW}$.

Combining the above, we have $\mathsf{Adv}_{\mathsf{OW}^{\prime},\mathpzc{A}}^{\mathsf{omur}}(\lambda)={\mathsf{negl}}(\lambda)$, which means that $\mathsf{OW}$ satisfies OMUR. This completes the proof of Lemma 3.10. ∎

Lemma 3.12.

If there exists a 1-query OW-KLA secure PKE-SKL scheme, then there exists a 1-query IND-KLA secure PKE-SKL scheme. Moreover, if the base scheme satisfies OMUR, then then the resulting scheme satisfies OMUR.

Proof.

Let $\mathsf{OW}=(\mathsf{OW}.\mathpzc{KG},\mathsf{OW}.\mathsf{Enc},\mathsf{OW}.\mathpzc{Dec},\mathsf{OW}.\mathpzc{Vrfy})$ be a 1-query OW-KLA secure PKE-SKL scheme with the message space $\{0,1\}^{n}$ that satisfies OMUR. Then, we construct an IND-KLA secure PKE-SKL scheme $\mathsf{IND}=(\mathsf{IND}.\mathpzc{KG},\mathsf{IND}.\mathsf{Enc},\mathsf{IND}.\mathpzc{Dec},\mathsf{IND}.\mathpzc{Vrfy})$ with the message space $\{0,1\}$ as follows.

$\mathsf{IND}.\mathpzc{KG}(1^{\lambda})\rightarrow(\mathsf{ek},\mathpzc{dk},\mathsf{vk})$:

On input the security parameter $1^{\lambda}$, run $(\mathsf{ek},\mathpzc{dk},\mathsf{vk})\leftarrow\mathsf{OW}.\mathpzc{KG}(1^{\lambda})$ and output $(\mathsf{ek},\mathpzc{dk},\mathsf{vk})$.

$\mathsf{IND}.\mathsf{Enc}(\mathsf{ek},\mathsf{m})\rightarrow\mathsf{IND}.\mathsf{ct}$:

On input an encryption key $\mathsf{ek}$ and a message $\mathsf{m}\in\{0,1\}$, choose $r,x\leftarrow\{0,1\}^{n}$, generate $\mathsf{OW}.\mathsf{ct}\leftarrow\mathsf{OW}.\mathsf{Enc}(\mathsf{ek},x)$, set $b\coloneqq(x\cdot r)\oplus\mathsf{m}$, and output a ciphertext $\mathsf{IND}.\mathsf{ct}\coloneqq(\mathsf{OW}.\mathsf{ct},r,b)$.

$\mathsf{IND}.\mathpzc{Dec}(\mathpzc{dk},\mathsf{IND}.\mathsf{ct})\rightarrow\tilde{\mathsf{m}}$:

On input a decryption key $\mathpzc{dk}$ and a ciphertext $\mathsf{IND}.\mathsf{ct}=(\mathsf{OW}.\mathsf{ct},r,b)$, compute $\tilde{x}\leftarrow\mathsf{OW}.\mathpzc{Dec}(\mathpzc{dk},\mathsf{OW}.\mathsf{ct})$ and output $\tilde{\mathsf{m}}\coloneqq(\tilde{x}\cdot r)\oplus b$.

$\mathsf{IND}.\mathpzc{Vrfy}(\mathsf{vk},\widetilde{\mathpzc{dk}})\rightarrow\top/\bot$:

On input a verification key $\mathsf{vk}$ and a (possibly malformed) decryption key $\widetilde{\mathpzc{dk}}$, run $\mathsf{OW}.\mathpzc{Vrfy}(\mathsf{vk},\widetilde{\mathpzc{dk}})$ and output whatever $\mathsf{OW}.\mathpzc{Vrfy}$ outputs.

The decryption correctness and verification correctness of $\mathsf{IND}$ immediately follow from those of $\mathsf{OW}$. The OMUR of $\mathsf{IND}$ immediately follows from that of $\mathsf{OW}$ since their key generation and verification algorithms are identical and the definition of OMUR only depends on these algorithms. In the following, we prove that $\mathsf{IND}$ is IND-KLA secure assuming that $\mathsf{OW}$ is OW-KLA secure. Toward contradiction, suppose that $\mathsf{IND}$ is not IND-KLA secure. Then, there is a QPT adversary $\mathpzc{A}$ such that $\mathsf{Adv}_{\mathsf{IND},\mathpzc{A}}^{\mathsf{ind}\mbox{-}\mathsf{kla}}(\lambda)$ is non-negligible. Without loss of generality, we assume that

[TABLE]

for a non-negligible $\epsilon(\lambda)$. Since $\mathsf{IND}$ is a bit encryption, we assume that the challenge message pair $(\mathsf{m}_{0},\mathsf{m}_{1})$ is $(0,1)$ without loss of generality. We divide $\mathpzc{A}$ into the following two stages $\mathpzc{A}_{0}$ and $\mathpzc{A}_{1}$:

$\mathpzc{A}_{0}^{O_{\mathtt{\mathpzc{Vrfy}}}}(\mathsf{ek},\mathpzc{dk})\rightarrow\mathpzc{st}{A}$:

Upon receiving $(\mathsf{ek},\mathpzc{dk})$ from $\mathpzc{C}$, makes a single query to $O_{\mathtt{\mathpzc{Vrfy}}}$ and outputs a quantum state $\mathpzc{st}{A}$.

$\mathpzc{A}_{1}(\mathpzc{st}{A},\mathsf{IND}.\mathsf{ct})\rightarrow\mathsf{coin}^{\prime}$:

Upon receiving the state $\mathpzc{st}_{\mathcal{A}}$ from $\mathpzc{A}_{0}$ and $\mathsf{IND}.\mathsf{ct}=(\mathsf{OW}.\mathsf{ct},r,b)$ from $\mathpzc{C}$, output $\mathsf{coin}^{\prime}$.

We remark that we can assume that $\mathpzc{A}_{1}$ does not make any query to $O_{\mathtt{\mathpzc{Vrfy}}}$ without loss of generality by Remark 3.5.

We have

[TABLE]

By Equations 27 and 32, we have101010We can assume $\Pr[V=\top]\neq 0$ since otherwise Equation 27 cannot be satisfied.

[TABLE]

Then, we construct an adversary $\mathpzc{B}=(\mathpzc{B}_{0},\mathpzc{B}_{1})$ against OW-KLA security of $\mathsf{OW}$ that works as follows.

$\mathpzc{B}_{0}^{O_{\mathtt{\mathpzc{Vrfy}}}}(\mathsf{ek},\mathpzc{dk})\rightarrow\mathpzc{st}{A}$:

This is identical to $\mathpzc{A}_{0}$. Specifically, run $\mathpzc{st}{A}\leftarrow\mathpzc{A}_{0}^{O_{\mathtt{\mathpzc{Vrfy}}}}(\mathsf{ek},\mathpzc{dk})$ and output $\mathpzc{st}{A}$.

$\mathpzc{B}_{1}(\mathpzc{st}{A},\mathsf{OW}.\mathsf{ct})\rightarrow x$:

Upon receiving $\mathpzc{st}{A}$ from $\mathpzc{B}_{0}$, send $\mathsf{RequestChallenge}$ to $\mathpzc{C}$ and receive $\mathsf{OW}.\mathsf{ct}$ from $\mathpzc{C}$. Then set $\mathpzc{aux}\coloneqq(\mathpzc{st}{A},\mathsf{OW}.\mathsf{ct})$ and define an algorithm $\mathpzc{A}^{\prime}$ as follows.

$\mathpzc{A}^{\prime}(\mathpzc{aux},r)$:

On input $\mathpzc{aux}=(\mathpzc{st}{A},\mathsf{OW}.\mathsf{ct})$ and $r\in\{0,1\}^{n}$, choose $b\leftarrow\{0,1\}$, set $\mathsf{IND}.\mathsf{ct}=(\mathsf{OW}.\mathsf{ct},r,b)$, run $\mathsf{coin}^{\prime}\leftarrow\mathpzc{A}_{1}(\mathpzc{st}{A},\mathsf{IND}.\mathsf{ct})$, and output $\mathsf{coin}^{\prime}\oplus b$.

Run $x\leftarrow\mathpzc{Ext}([\mathpzc{A}^{\prime}],\mathpzc{aux})$, and output $x$ where $\mathpzc{Ext}$ is the algorithm as in Lemma 2.22 and $[\mathpzc{A}^{\prime}]$ is the description of $\mathpzc{A}^{\prime}$.

In the following, we show that $\mathpzc{B}$ breaks OW-KLA security of $\mathsf{OW}$. Let $\mathpzc{G}$ be an algorithm that works as follows.

$\mathpzc{G}(1^{\lambda})$:

Generate $(\mathsf{ek},\mathpzc{dk},\mathsf{vk})\leftarrow\mathsf{OW}.\mathpzc{KG}(1^{\lambda})$, $\mathpzc{st}{A}\leftarrow\mathpzc{A}_{0}^{O_{\mathtt{\mathpzc{Vrfy}}}}(\mathsf{ek},\mathpzc{dk})$, $x\leftarrow\{0,1\}^{n}$, and $\mathsf{OW}.\mathsf{ct}\leftarrow\mathsf{OW}.\mathsf{Enc}(\mathsf{ek},x)$. Let $V\coloneqq\top$ if the response to $\mathpzc{A}_{0}$’s query (which is assumed to be made once) is $\top$ and $V\coloneqq\bot$ otherwise. Output $(V,\mathpzc{st}{A},\mathsf{OW}.\mathsf{ct},x)$.

By Equation 33 and a standard averaging argument, for at least $\frac{\epsilon(\lambda)}{2\Pr[V=\top]}$-fraction of $(V,\mathpzc{st}{A},\mathsf{OW}.\mathsf{ct},x)$ generated by $\mathpzc{G}(1^{\lambda})$ conditioned on $V=\top$, we have

[TABLE]

where $\mathsf{coin}\leftarrow\{0,1\}$, $r\leftarrow\{0,1\}^{n}$, $b\coloneqq(x\cdot r)\oplus\mathsf{coin}$, and $\mathsf{IND}.\mathsf{ct}=(\mathsf{OW}.\mathsf{ct},r,b).$

Therefore, for at least $\frac{\epsilon(\lambda)}{2}$-fraction of $(V,\mathpzc{st}{A},\mathsf{OW}.\mathsf{ct},x)$ generated by $\mathpzc{G}(1^{\lambda})$, we have

[TABLE]

where $\mathsf{coin}\leftarrow\{0,1\}$, $r\leftarrow\{0,1\}^{n}$, $b\coloneqq(x\cdot r)\oplus\mathsf{coin}$, and $\mathsf{IND}.\mathsf{ct}=(\mathsf{OW}.\mathsf{ct},r,b).$

For such $(V,\mathpzc{st}{A},\mathsf{OW}.\mathsf{ct},x)$, if we let $\mathpzc{aux}=(\mathpzc{st}{A},\mathsf{OW}.\mathsf{ct})$, Equation 35 directly implies

[TABLE]

Therefore, by Lemma 2.22, we have

[TABLE]

Since Equation 37 and $V=\top$ hold at the same time for at least $\frac{\epsilon(\lambda)}{2}$-fraction of $(V,\mathpzc{st}{A},\mathsf{OW}.\mathsf{ct},x)$, we have

[TABLE]

By the definitions of $\mathpzc{B}=(\mathpzc{B}_{0},\mathpzc{B}_{1})$ and $\mathpzc{G}$ and the assumption that $\epsilon(\lambda)$ is non-negligible, this implies that $\mathpzc{B}$ breaks OW-KLA security of $\mathsf{OW}$. ∎

Remark 3.13 (On Multiple-Query Case).

In the above reduction, it is important that $\mathpzc{A}_{1}$ can be assumed to not make any verification query because otherwise we cannot apply the quantum Goldreich-Levin theorem (Lemma 2.22). In the 1-query setting, this can be assumed without loss of generality by Remark 3.5. In the multiple-query setting, we cannot assume it in general. If we assume that the base scheme satisfies OMUR, we can assume it without loss of generality because post-challenge verification queries are useless for such schemes. However, we do not know how to resolve the issue in the multiple-query setting without relying on OMUR.

Lemma 3.14.

If a PKE-SKL scheme is 1-query IND-KLA secure and satisfies OMUR, then it is IND-KLA secure.

Proof.

Let $\mathsf{SKL}=(\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec},\mathpzc{Vrfy})$ be an IND-KLA secure PKE-SKL scheme that satisfies OMUR. For a QPT adversary $\mathpzc{A}$ against IND-KLA security of $\mathsf{SKL}$ that makes $Q={\mathrm{poly}}(\lambda)$ verification queries and $\mathsf{coin}\in\{0,1\}$, we consider the following sequence of hybrids.

$\mathsf{Hyb}_{0}^{\mathsf{coin}}$:

This is identical to $\mathsf{Exp}_{\mathsf{SKL},\mathpzc{A}}^{\mathsf{ind}\mbox{-}\mathsf{kla}}(1^{\lambda},\mathsf{coin})$.

Note that our goal is to prove

[TABLE]

$\mathsf{Hyb}_{1}^{\mathsf{coin}}$:

This is identical to $\mathsf{Hyb}_{0}^{\mathsf{coin}}$ except that the verification oracle returns $\bot$ to all queries made after it returns $\top$ once.

By the OMUR of $\mathsf{SKL}$, we have

[TABLE]

for $\mathsf{coin}\in\{0,1\}$.

$\mathsf{Hyb}_{2}^{\mathsf{coin}}$:

This is identical to $\mathsf{Hyb}_{1}^{\mathsf{coin}}$ except that the challenger chooses $i^{*}\leftarrow[Q]$ at the beginning of the game, the verification oracle just returns $\bot$ without running the verification algorithm to $i$-th query for $i\neq i^{*}$, and the experiment returns [math] if the verification oracle returns $\bot$ to $i^{*}$-th query.

Note that there is exactly one verification query to be accepted in $\mathsf{Hyb}_{1}^{\mathsf{coin}}$ whenever it returns $1$. If $i^{*}$ is the correct guess for such query, which occurs with probability $\frac{1}{Q}$, then $\mathsf{Hyb}_{2}^{\mathsf{coin}}$ is identical to $\mathsf{Hyb}_{1}^{\mathsf{coin}}$.111111A similar remark to Footnote 9 applies here. Moreover, $\mathsf{Hyb}_{2}^{\mathsf{coin}}$ outputs [math] when the guess is incorrect. Therefore, we have

[TABLE]

Below, we prove

[TABLE]

To prove this, we consider a QPT adversary $\mathpzc{B}$ against $1$-query IND-KLA security of $\mathsf{SKL}$ that works as follows.

$\mathpzc{B}(\mathsf{ek},\mathpzc{dk})$:

Choose $i^{*}\leftarrow[Q]$ and run $\mathpzc{A}(\mathsf{ek},\mathpzc{dk})$ where the $i^{*}$-th query is forwarded to its own verification oracle and responded according to the response from the oracle while all the other queries are responded by $\bot$. When $\mathpzc{A}$ sends $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})$, forward it to the external challenger, receive $\mathsf{ct}^{*}$ from the challenger, and forward it to $\mathpzc{A}$. Finally, output whatever $\mathpzc{A}$ outputs.

By the definitions of $\mathpzc{B}$ and $\mathsf{Hyb}_{2}^{\mathsf{coin}}$, one can see that

[TABLE]

for $\mathsf{coin}\in\{0,1\}$. Therefore, we have

[TABLE]

by the $1$-query IND-SKL security of $\mathsf{SKL}$.

Combining the above, we have

[TABLE]

This completes the proof of Lemma 3.14. ∎

4 Public Key Encryption with CoIC-KLA Security

In this section, we introduce a new security notion called CoIC-KLA security for PKE, and construct a PKE scheme that satisfies it based on any IND-CPA secure PKE scheme. Looking ahead, it is used as a building block of our construction of PKE-SKL in Section 5.

4.1 Tools

We first introduce some tools used in this section.

Measurement Implementation.

We review some notions related to measurement implementations used in the definition and the security proof of CoIC-KLA security.

Definition 4.1 (Projective Implementation).

Let:

• •

$\mathcal{D}$* be a finite set of distributions over an index set $\mathcal{I}$.*

• •

$\mathcal{P}=\{\bm{P}_{i}\}_{i\in\mathcal{I}}$* be a positive operator valued measure (POVM).*

• •

$\mathcal{E}=\{\bm{E}_{D}\}_{D\in\mathcal{D}}$* be a projective measurement with index set $\mathcal{D}$.*

We consider the following measurement procedure.

Measure under the projective measurement $\mathcal{E}$ and obtain a distribution $D$. 2. 2.

Output a random sample from the distribution $D$.

We say $\mathcal{E}$ is the projective implementation of $\mathcal{P}$, denoted by $\mathsf{ProjImp}(\mathcal{P})$, if the measurement process above is equivalent to $\mathcal{P}$.

Theorem 4.2 ([Zha20, Lemma 1]).

Any binary outcome POVM $\mathcal{P}=(\bm{P},\bm{I}-\bm{P})$ has a unique projective implementation $\mathsf{ProjImp}(\mathcal{P})$.

Definition 4.3 (Shift Distance).

For two distributions $D_{0},D_{1}$, the shift distance with parameter $\epsilon$, denoted by $\Delta_{\mathsf{Shift}}^{\epsilon}(D_{0},D_{1})$, is the smallest quantity $\delta$ such that for all $x\in\mathbb{R}$:

[TABLE]

For two real-valued measurements $\mathcal{M}$ and $\mathcal{N}$ over the same quantum system, the shift distance between $\mathcal{M}$ and $\mathcal{N}$ with parameter $\epsilon$ is

[TABLE]

Definition 4.4 (Mixture of Projetive Measurement [Zha20]).

Let $D:\mathcal{R}\rightarrow\mathcal{I}$ where $\mathcal{R}$ and $\mathcal{I}$ are some sets. Let $\{(\bm{P}_{i},\bm{Q}_{i})\}_{\in\mathcal{I}}$ be a collection of binary projective measurement. The mixture of projective measurements associated to $\mathcal{R}$, $\mathcal{I}$, $D$, and $\{(\bm{P}_{i},\bm{Q}_{i})\}_{\in\mathcal{I}}$ is the binary POVM $\mathcal{P}_{D}=(\bm{P}_{D},\bm{Q}_{D})$ defined as follows.

[TABLE]

where $R$ is uniformly distributed in $\mathcal{R}$.

Theorem 4.5 ([Zha20, KN22b]).

Let $D$ be any probability distribution and $\mathcal{P}=\{(\Pi_{i},\bm{I}-\Pi_{i})\}_{i}$ be a collection of binary outcome projective measurements. For any $0<\epsilon,\delta<1$, there exists an algorithm of measurement $\mathpzc{API}_{\mathcal{P},\mathcal{D}}^{\epsilon,\delta}$ that satisfies the following.

• •

$\Delta_{\mathsf{Shift}}^{\epsilon}(\mathpzc{API}_{\mathcal{P},D}^{\epsilon,\delta},\mathsf{ProjImp}(\mathcal{P}_{D}))\leq\delta$.

• •

$\mathpzc{API}_{\mathcal{P},D}^{\epsilon,\delta}$* is $(\epsilon,\delta)$-almost projective in the following sense. For any quantum state $\ket{\psi}$, we apply $\mathpzc{API}_{\mathcal{P},D}^{\epsilon,\delta}$ twice in a row to $\ket{\psi}$ and obtain measurement outcomes $x$ and $y$, respectively. Then, $\Pr[\absolutevalue{x-y}\leq\epsilon]\geq 1-\delta$.*

• •

$\mathpzc{API}_{\mathcal{P},D}^{\epsilon,\delta}$* is $(\epsilon,\delta)$-reverse almost projective in the following sense. For any quantum state $\ket{\psi}$, we apply $\mathpzc{API}_{\mathcal{P},D}^{\epsilon,\delta}$ and $\mathpzc{API}_{\mathcal{P}^{\mathtt{rev}},D}^{\epsilon,\delta}$ in a row to $\ket{\psi}$ and obtain measurement outcomes $x$ and $y$, respectively, where $\mathcal{P}^{\mathtt{rev}}=\{(\bm{I}-\Pi_{i},\Pi_{i})\}_{i}$. Then, $\Pr[\absolutevalue{(1-x)-y}\leq\epsilon]\geq 1-\delta$.*

• •

The expected running time of $\mathpzc{API}_{\mathcal{P},D}^{\epsilon,\delta}$ is $T_{\mathcal{P},D}\cdot{\mathrm{poly}}(1/\epsilon,\log(1/\delta))$ where $T_{\mathcal{P},D}$ is the combined running time of $D$, the procedure mapping $i\rightarrow(\bm{P}_{i},\bm{I}-\bm{P}_{i})$, and the running time of measurement $(\bm{P}_{i},\bm{I}-\bm{P}_{i})$.

Theorem 4.6 ([Zha20, Corollary 1]).

Let $\mathpzc{q}$ be an efficiently constructible, potentially mixed state, and $D_{0},D_{1}$ efficiently sampleable distributions. If $D_{0}$ and $D_{1}$ are computationally indistinguishable, for any inverse polynomial $\epsilon$ and any function $\delta$, we have $\Delta_{\mathsf{Shift}}^{3\epsilon}(\mathpzc{API}_{\mathcal{P},D_{0}}^{\epsilon,\delta}(\mathpzc{q}),\mathpzc{API}_{\mathcal{P},D_{1}}^{\epsilon,\delta}(\mathpzc{q}))\leq 2\delta+{\mathsf{negl}}(\lambda)$.

Definition 4.7 (Quantum Program with Classical Inputs and Outputs [ALL*+*21]).

A quantum program with classical inputs is a pair of quantum state $\mathpzc{q}$ and unitaries $\{\bm{U}_{x}\}_{x\in[N]}$ where $[N]$ is the domain, such that the state of the program evaluated on input $x$ is equal to $\bm{U}_{x}\mathpzc{q}\bm{U}_{x}^{\dagger}$. We measure the first register of $\bm{U}_{x}\mathpzc{q}\bm{U}_{x}^{\dagger}$ to obtain an output. We say that $\{\bm{U}_{x}\}_{x\in[N]}$ has a compact classical description $\bm{U}$ when applying $\bm{U}_{x}$ can be efficiently computed given $\bm{U}$ and $x$.

Ciphertext-Policy Functional Encryption.

We review the definition of ciphertext-policy functional encryption (CPFE) that we use as the building block of our CoIC-KLA secure PKE scheme.

Definition 4.8 (Ciphertext-Policy Functional Encryption).

A CPFE scheme for the circuit space $\mathcal{C}$ and the input space $\mathcal{X}$ is a tuple of algorithms $(\mathsf{Setup},\mathsf{KG},\mathsf{Enc},\mathsf{Dec})$.

• •

The setup algorithm $\mathsf{Setup}$ takes as input a security parameter $1^{\lambda}$, and outputs a master public key $\mathsf{MPK}$ and master secret key $\mathsf{MSK}$.

• •

The key generation algorithm $\mathsf{KG}$ takes as input the master secret key $\mathsf{MSK}$ and $x\in\mathcal{X}$, and outputs a decryption key $\mathsf{sk}_{x}$.

• •

The encryption algorithm $\mathsf{Enc}$ takes as input the master public key $\mathsf{MPK}$ and $C\in\mathcal{C}$, and outputs a ciphertext $\mathsf{ct}$.

• •

The decryption algorithm $\mathsf{Dec}$ takes as input a functional decryption key $\mathsf{sk}_{x}$ and a ciphertext $\mathsf{ct}$, and outputs $y$.

Decryption Correctness:

We require $\mathsf{Dec}(\mathsf{KG}(\mathsf{MSK},x),\mathsf{Enc}(\mathsf{MPK},C))\allowbreak=C(x)$ for every $C\in\mathcal{C}$, $x\in\mathcal{X}$, and $\left(\mathsf{MPK},\mathsf{MSK}\right)\leftarrow\mathsf{Setup}(1^{\lambda})$.

Next, we introduce $1$-bounded security for CPFE schemes.

Definition 4.9 ($1$-Bounded Security).

Let $\mathsf{CPFE}$ be a CPFE scheme. We define the game $\mathsf{Expt}_{\mathpzc{A},\mathsf{CPFE}}^{\mathsf{1\textrm{-}bounded}}(\lambda,\mathsf{coin})$ as follows.

The challenger generates $(\mathsf{MPK},\mathsf{MSK})\leftarrow\mathsf{Setup}(1^{\lambda})$ and sends $\mathsf{MPK}$ to $\mathpzc{A}$. $\mathpzc{A}$ sends $x\in\mathcal{X}$ to the challenger. The challenger generates $\mathsf{sk}_{x}\leftarrow\mathsf{KG}(\mathsf{MSK},x)$ and sends $\mathsf{sk}_{x}$ to $\mathpzc{A}$. 2. 2.

$\mathpzc{A}$* outputs $(C_{0},C_{1})$ such that $C_{0}(x)=C_{1}(x)$ and $C_{0}$ and $C_{1}$ have the same size. The challenger picks $\mathsf{coin}\leftarrow\{0,1\}$, generates $\mathsf{ct}\leftarrow\mathsf{Enc}(\mathsf{MPK},C_{\mathsf{coin}})$, and sends $\mathsf{ct}$ to $\mathpzc{A}$.* 3. 3.

$\mathpzc{A}$* outputs $\mathsf{coin}^{\prime}\in\{0,1\}$.*

We say that $\mathsf{CPFE}$ is $1$-bounded secure if for every QPT $\mathpzc{A}$, we have

[TABLE]

Theorem 4.10 ([GVW12]).

If there exists IND-CPA secure PKE, there exists $1$-bounded secure CPFE for $\mathsf{P/poly}$.121212Though [GVW12] present their construction as KPFE instead of CPFE, it is easy to see that they implicitly give CPFE.

4.2 Definitions of CoIC-KLA Security

We introduce definitions of CoIC-KLA security. In addition to normal CoIC-KLA security needed to realize our PKE-SKL, we also define what we call strong CoIC-KLA security. We can prove that strong CoIC-KLA security implies CoIC-KLA security. The reason we introduce strong CoIC-KLA is that it is more compatible to our construction strategy in Section 4.3 that uses watermarking technique by Kitagawa and Nishimaki [KN22b].

Definition 4.11 (CoIC-KLA Security).

We say that a PKE scheme $\mathsf{PKE}$ with the message space $\mathcal{X}$ is CoIC-KLA secure, if it satisfies the following requirement, formalized from the experiment $\mathsf{Exp}_{\mathsf{PKE},\mathpzc{A}}^{\mathsf{coic}\mbox{-}\mathsf{kla}}(1^{\lambda})$ between an adversary $\mathpzc{A}$ and a challenger $\mathpzc{C}$:

$\mathpzc{C}$* runs $(\mathsf{ek}_{0},\mathsf{dk}_{0})\leftarrow\mathsf{KG}(1^{\lambda})$ and $(\mathsf{ek}_{1},\mathsf{dk}_{1})\leftarrow\mathsf{KG}(1^{\lambda})$, and generates $\mathpzc{dk}:=\frac{1}{\sqrt{2}}(\ket{0}\ket{\mathsf{dk}_{0}}+\ket{1}\ket{\mathsf{dk}_{1}})$. $\mathpzc{C}$ sends $\mathsf{ek}_{0}$, $\mathsf{ek}_{1}$, and $\mathpzc{dk}$ to $\mathpzc{A}$. $\mathpzc{A}$ can get access to the following oracle only once.*

$\mathcal{O}(\widetilde{\mathpzc{dk}})$:

On input a possibly malformed decryption key $\widetilde{\mathpzc{dk}}$, it applies a binary-outcome measurement $(\bm{I}-\Pi_{\mathrm{vrfy}},\Pi_{\mathrm{vrfy}})$, where $\Pi_{\mathrm{vrfy}}$ is the projection to the right decryption key, i.e.,

[TABLE]

It returns the measurement outcome (indicating whether the state was projected onto $\Pi_{\mathrm{vrfy}}$ or not). 2. 2.

$\mathpzc{A}$* sends $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})\in\mathcal{X}^{2}$ to $\mathpzc{C}$. $\mathpzc{C}$ generates $a,b\leftarrow\{0,1\}$ and generates $\mathsf{ct}_{0}^{*}\leftarrow\mathsf{Enc}(\mathsf{ek}_{0},\mathsf{m}_{a}^{*})$ and $\mathsf{ct}_{1}^{*}\leftarrow\mathsf{Enc}(\mathsf{ek}_{1},\mathsf{m}_{a\oplus b}^{*})$. $\mathpzc{C}$ sends $\mathsf{ct}_{0}^{*}$ and $\mathsf{ct}_{1}^{*}$ to $\mathpzc{A}$.* 3. 3.

$\mathpzc{A}$* outputs a guess $b^{\prime}$ for $b$. $\mathpzc{C}$ outputs $1$ if $b=b^{\prime}$ and [math] otherwise as the final output of the experiment.*

For any QPT $\mathpzc{A}$, it holds that

[TABLE]

Definition 4.12 (Strong CoIC-KLA Security).

We say that a PKE scheme $\mathsf{PKE}$ with the message space $\mathcal{X}$ is $\epsilon$-strong CoIC-KLA secure, if it satisfies the following requirement, formalized from the experiment $\mathsf{Exp}_{\mathsf{PKE},\mathpzc{A}}^{\mathsf{s}\mbox{-}\mathsf{coic}\mbox{-}\mathsf{kla}}(1^{\lambda},\epsilon)$ between an adversary $\mathpzc{A}$ and a challenger $\mathpzc{C}$:

$\mathpzc{C}$* runs $(\mathsf{ek}_{0},\mathsf{dk}_{0})\leftarrow\mathsf{KG}(1^{\lambda})$ and $(\mathsf{ek}_{1},\mathsf{dk}_{1})\leftarrow\mathsf{KG}(1^{\lambda})$, and generates $\mathpzc{dk}:=\frac{1}{\sqrt{2}}(\ket{0}\ket{\mathsf{dk}_{0}}+\ket{1}\ket{\mathsf{dk}_{1}})$. $\mathpzc{C}$ sends $\mathsf{ek}_{0}$, $\mathsf{ek}_{1}$, and $\mathpzc{dk}$ to $\mathpzc{A}$.* 2. 2.

$\mathpzc{A}$* sends $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})\in\mathcal{X}^{2}$ and a quantum circuit $\mathpzc{D}=(\mathpzc{q},\bm{U})$, where $\mathpzc{D}$ is a quantum program with classical inputs and one-bit outputs and $\bm{U}$ is a compact classical description of $\{\bm{U}_{\mathsf{ct}_{0},\mathsf{ct}_{1}}\}_{\mathsf{ct}_{0},\mathsf{ct}_{1}}$ to $\mathpzc{C}$.* 3. 3.

Let $D$ be the following distribution.

$D$:

Generate $a,b\leftarrow\{0,1\}$ and $\mathsf{ct}_{0}\leftarrow\mathsf{Enc}(\mathsf{ek}_{0},\mathsf{m}_{a})$ and $\mathsf{ct}_{1}\leftarrow\mathsf{Enc}(\mathsf{ek}_{1},\mathsf{m}_{a\oplus b})$. Output $(b,\mathsf{ct}_{0},\mathsf{ct}_{1})$.

We also let $\mathcal{P}=(\bm{P}_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}},\bm{Q}_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}})_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}}$ be a collection of binary outcome projective measurements, where

[TABLE]

Moreover, we let $\mathcal{M}_{D}=(\bm{P}_{D},\bm{Q}_{D})$ be binary outcome POVMs, where

[TABLE]

Note that $\mathcal{R}$ is the random coin space of $D$ and $\bm{P}_{D(r)}=\bm{P}_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}}$, where $(b,\mathsf{ct}_{0},\mathsf{ct}_{1})\leftarrow D(r)$.131313The random coin $r$ for $D$ consists of random bits $a,b$ and encryption coins of two ciphertexts. $\mathpzc{C}$ applies the measurement $\mathsf{ProjImp}(\mathcal{M}_{D})$ to $\mathpzc{q}$, and obtain a value $p$. $\mathpzc{C}$ outputs $1$ if $p\geq\frac{1}{2}+\epsilon$ and [math] otherwise.

For any QPT $\mathpzc{A}$, it holds that

[TABLE]

Theorem 4.13.

If $\mathsf{PKE}$ is $\epsilon$-strong CoIC-KLA secure for any inverse polynomial $\epsilon$, then $\mathsf{PKE}$ is CoIC-KLA secure.

Proof.

Assume there exists $\mathpzc{A}$ that breaks CoIC-KLA security of $\mathsf{PKE}$. Without loss of generality, we assume that $\mathpzc{A}$ correctly guesses the bit $b$ with probability $\frac{1}{2}+\gamma$ for some inverse polynomial $\gamma$. Then, consider the following experiment using $\mathpzc{A}$.

Execute $\mathsf{Exp}_{\mathsf{PKE},\mathpzc{A}}^{\mathsf{coic}\mbox{-}\mathsf{kla}}(1^{\lambda})$ until the point $\mathpzc{A}$ outputs $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})$. 2. 2.

Construct a quantum program with classical inputs and outputs $\mathpzc{D}=(\mathpzc{q},\bm{U})$, where $\mathpzc{q}$ is the inner quantum state of $\mathpzc{A}$ and $\bm{U}$ is a compact description of $\{\bm{U}_{\mathsf{ct}_{0},\mathsf{ct}_{1}}\}_{\mathsf{ct}_{0},\mathsf{ct}_{1}}$ and $\bm{U}_{\mathsf{ct}_{0},\mathsf{ct}_{1}}$ is a unitary that performs the rest of $\mathpzc{A}$’s computations on input $(\mathsf{ct}_{0},\mathsf{ct}_{1})$. 3. 3.

Obtain $p$ by applying $\mathsf{ProjImp}(\mathcal{M}_{D})$ to $\mathpzc{q}$, where the measurement $\mathcal{M}_{D}$ and the distribution $D$ are defined in Definition 4.12.

Then, from the definition of $\mathsf{ProjImp}$ and the fact that $\mathpzc{A}$’s advantage is $\frac{1}{2}+\gamma$, we have $E[p]=\frac{1}{2}+\gamma$. By the averaging argument, we obtain $\Pr[p\geq\frac{1}{2}+\frac{\gamma}{2}]\geq\frac{\gamma}{2}$. Consider the following adversary $\mathpzc{B}$ that attacks $\frac{\gamma}{2}$-strong CoIC-KLA security of $\mathsf{PKE}$.

Given, $\mathsf{ek}_{0}$, $\mathsf{ek}_{1}$, and $\mathpzc{dk}$, $\mathpzc{B}$ executes $\mathsf{Exp}_{\mathsf{PKE},\mathpzc{A}}^{\mathsf{coic}\mbox{-}\mathsf{kla}}(1^{\lambda})$ until the point $\mathpzc{A}$ outputs $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})$. When $\mathpzc{A}$ makes a query to $\mathcal{O}$, $\mathpzc{B}$ returns a random bit. 2. 2.

$\mathpzc{B}$ constructs a quantum program with classical inputs and outputs $\mathpzc{D}=(\mathpzc{q},\bm{U})$, where $\mathpzc{q}$ is the inner quantum state of $\mathpzc{A}$, $\bm{U}$ is a compact description of $\{\bm{U}_{\mathsf{ct}_{0},\mathsf{ct}_{1}}\}_{\mathsf{ct}_{0},\mathsf{ct}_{1}}$, and $\bm{U}_{\mathsf{ct}_{0},\mathsf{ct}_{1}}$ is a unitary that performs the rest of $\mathpzc{A}$’s computations on input $(\mathsf{ct}_{0},\mathsf{ct}_{1})$. $\mathpzc{B}$ outputs $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})$ and $\mathpzc{D}$.

$\mathpzc{B}$ correctly answers to $\mathpzc{A}$’s query to $\mathcal{O}$ and correctly simulates $\mathsf{Exp}_{\mathsf{PKE},\mathpzc{A}}^{\mathsf{coic}\mbox{-}\mathsf{kla}}$ for $\mathpzc{A}$ with probability $\frac{1}{2}$.141414$\mathpzc{B}$ does not apply the verification procedure to the queried state differently from $\mathsf{Exp}_{\mathsf{PKE},\mathpzc{A}}^{\mathsf{coic}\mbox{-}\mathsf{kla}}$. This is not a problem since from the view of $\mathpzc{A}$, the experiment simulated by $\mathpzc{B}$ is the same as the experiment where the verification process is applied to the queried state, but the result is ignored and a random bit is returned. Moreover, from the above discussion, under the condition that $\mathpzc{B}$ correctly answers to $\mathpzc{A}$’s query to $\mathcal{O}$, $\mathpzc{B}$ wins with probability $\frac{\gamma}{2}$. Overall, $\mathsf{Adv}_{\mathsf{PKE},\mathpzc{B}}^{\mathsf{s}\mbox{-}\mathsf{coic}\mbox{-}\mathsf{kla}}(\lambda)\geq\frac{\gamma}{4}$, which contradicts $\frac{\gamma}{2}$-strong CoIC-KLA security of $\mathsf{PKE}$. This completes the proof. ∎

4.3 Strong CoIC-KLA Secure PKE from CPFE

We construct a strong CoIC-KLA secure PKE $\mathsf{PKE}=(\mathsf{Gen},\mathsf{Enc},\mathsf{Dec})$ using a CPFE scheme $\mathsf{CPFE}=(\mathsf{CPFE}.\mathsf{Setup},\allowbreak\mathsf{CPFE}.\mathsf{KG},\mathsf{CPFE}.\mathsf{Enc},\mathsf{CPFE}.\mathsf{Dec})$ as a building block.

$\mathsf{Gen}(1^{\lambda})$:

• •

Generate $(\mathsf{MPK},\mathsf{MSK})\leftarrow\mathsf{CPFE}.\mathsf{Setup}(1^{\lambda})$.

• •

Generate $x\leftarrow\{0,1\}^{\lambda}$ and $\mathsf{sk}_{x}\leftarrow\mathsf{CPFE}.\mathsf{KG}(\mathsf{MSK},x)$.

• •

Output $\mathsf{ek}\coloneqq\mathsf{MPK}$ and $\mathsf{dk}:=\mathsf{sk}_{x}$.

$\mathsf{Enc}(\mathsf{ek},\mathsf{m})$:

• •

Parse $\mathsf{ek}=\mathsf{MPK}$.

• •

Let $C[\mathsf{m}]$ be a constant circuit that outputs $\mathsf{m}$ on any input. $C$ is padded so that it has the same size as the circuit $C^{*}$ appeared in the security proof.

• •

Output $\mathsf{ct}\leftarrow\mathsf{CPFE}.\mathsf{Enc}(\mathsf{MPK},C[\mathsf{m}])$.

$\mathsf{Dec}(\mathsf{dk},\mathsf{ct})$:

• •

Parse $\mathsf{dk}=\mathsf{sk}_{x}$.

• •

Output $\mathsf{m}^{\prime}\leftarrow\mathsf{CPFE}.\mathsf{Dec}(\mathsf{sk}_{x},\mathsf{ct})$.

The decryption correctness of $\mathsf{PKE}$ follows from that of $\mathsf{CPFE}$. We also have the following theorems.

Theorem 4.14.

If $\mathsf{CPFE}$ is a $1$-bounded secure CPFE scheme, then $\mathsf{PKE}$ is a $\epsilon$-strong CoIC-KLA secure PKE scheme for any inverse polynomial $\epsilon$.

Proof.

We show that if there exists a QPT adversary $\mathpzc{A}$ that breaks $\epsilon$-strong CoIC-KLA security for some inverse polynomial $\epsilon$, then we can construct a QPT adversary $\mathpzc{B}$ that contradicts the following lemma.

Lemma 4.15.

Consider the following experiment $\mathsf{Expt}_{\mathsf{CPFE},\mathpzc{B}}^{\mathsf{BZ}}(1^{\lambda})$ between an adversary $\mathpzc{B}$ and a challenger $\mathpzc{C}$.

$\mathpzc{C}$* generates $(\mathsf{MPK}_{0},\mathsf{MSK}_{0})\leftarrow\mathsf{CPFE}.\mathsf{Setup}(1^{\lambda})$, $(\mathsf{MPK}_{1},\mathsf{MSK}_{1})\leftarrow\mathsf{CPFE}.\mathsf{Setup}(1^{\lambda})$, $x_{0},x_{1}\leftarrow\{0,1\}^{\lambda}$, $\mathsf{sk}_{x_{0}}\leftarrow\mathsf{CPFE}.\mathsf{KG}(\mathsf{MSK}_{0},x_{0})$, and $\mathsf{sk}_{x_{1}}\leftarrow\mathsf{CPFE}.\mathsf{KG}(\mathsf{MSK}_{1},x_{1})$. $\mathpzc{C}$ gives $\mathsf{MPK}_{0}$, $\mathsf{MPK}_{1}$, and $\frac{1}{\sqrt{2}}(\ket{0}\ket{\mathsf{sk}_{x_{0}}}+\ket{1}\ket{\mathsf{sk}_{x_{1}}})$ to $\mathpzc{B}$.* 2. 2.

$\mathpzc{B}$* outputs $x_{0}^{\prime}$ and $x_{1}^{\prime}$. $\mathpzc{C}$ outputs $1$ if $x_{0}^{\prime}=x_{0}$ and $x_{1}^{\prime}=x_{1}$ and [math] otherwise.*

Then, for any QPT adversary $\mathpzc{B}$, we have $\mathsf{Adv}_{\mathsf{CPFE},\mathpzc{B}}^{\mathsf{BZ}}(1^{\lambda})=\Pr[\mathsf{Expt}_{\mathsf{CPFE},\mathpzc{B}}^{\mathsf{BZ}}(1^{\lambda})=1]={\mathsf{negl}}(\lambda)$.

Proof.

This lemma directly follows from Lemma 2.21. ∎

Let $\epsilon$ be some inverse polynomial. Assume there exits a QPT $\mathpzc{A}$ such that $\mathsf{Adv}_{\mathsf{PKE},\mathpzc{A}}^{\mathsf{s}\mbox{-}\mathsf{coic}\mbox{-}\mathsf{kla}}(\lambda,\epsilon)=\gamma$ for some inverse polynomial $\gamma$. We construct the following adversary $\mathpzc{B}$.

Given $\mathsf{MPK}_{0}$, $\mathsf{MPK}_{1}$, and $\mathpzc{dk}$, $\mathpzc{B}$ sets $\mathsf{ek}_{0}:=\mathsf{MPK}_{0}$ and $\mathsf{ek}_{1}:=\mathsf{MPK}_{1}$. $\mathpzc{B}$ sends $\mathsf{ek}_{0}$, $\mathsf{ek}_{1}$, and $\mathpzc{dk}$ to $\mathpzc{A}$. 2. 2.

When $\mathpzc{A}$ outputs $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})$ and $\mathpzc{D}=(\mathpzc{q},\bm{U})$, $\mathpzc{B}$ outputs $(x_{0}^{\prime},x_{1}^{\prime})\leftarrow\mathpzc{Extract}(\mathsf{MPK}_{0},\mathsf{MPK}_{1},\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*},\mathpzc{D},\epsilon)$, where $\mathpzc{Extract}$ is described below.

$\mathpzc{Extract}(\mathsf{MPK}_{0},\mathsf{MPK}_{1},\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*},\mathpzc{D},\epsilon)$:

• •

Let $\epsilon^{\prime}=\epsilon/8\lambda$ and $\delta^{\prime}=2^{-\lambda}$.

• •

Parse $(\mathpzc{q},\bm{U})\leftarrow\mathpzc{D}$.

• •

Let $\mathcal{P}$ be defined in the same way as that in Definition 4.12 and $D_{0,i}$ and $D_{1,i}$ be the following distributions for every $i\in[\lambda]$.

$D_{0,i}$:

Generate $a,b\leftarrow\{0,1\}$. Generate $\mathsf{ct}_{0}\leftarrow\mathsf{CPFE}.\mathsf{Enc}(\mathsf{MPK}_{0},C^{*}[a,b,\mathsf{m}_{0},\mathsf{m}_{1},i])$, where $C^{*}[a,b,\mathsf{m}_{0},\mathsf{m}_{1},i]$ is a circuit that takes $x$ as input and outputs $\mathsf{m}_{a\oplus b\oplus x[i]}$. Generate $\mathsf{ct}_{1}\leftarrow\mathsf{CPFE}.\mathsf{Enc}(\mathsf{MPK}_{1},C[\mathsf{m}_{a}])$. Output $(b,\mathsf{ct}_{0},\mathsf{ct}_{1})$.

$D_{1,i}$:

Generate $a,b\leftarrow\{0,1\}$. Generate $\mathsf{ct}_{1}\leftarrow\mathsf{CPFE}.\mathsf{Enc}(\mathsf{MPK}_{0},C^{*}[a,b,\mathsf{m}_{0},\mathsf{m}_{1},i])$, where $C^{*}[a,b,\mathsf{m}_{0},\mathsf{m}_{1},i]$ is a circuit that takes $x$ as input and outputs $\mathsf{m}_{a\oplus b\oplus x[i]}$. Generate $\mathsf{ct}_{0}\leftarrow\mathsf{CPFE}.\mathsf{Enc}(\mathsf{MPK}_{1},C[\mathsf{m}_{a}])$. Output $(b,\mathsf{ct}_{0},\mathsf{ct}_{1})$.

• •

Let $\mathsf{D}$ be the distribution defined in the same way as that in Definition 4.12. Compute $\tilde{p}_{0}\leftarrow\mathpzc{API}_{\mathcal{P},D}^{\epsilon^{\prime},\delta^{\prime}}(\mathpzc{q})$. If $\tilde{p}_{0}<\frac{1}{2}+\epsilon-4\epsilon^{\prime}$, return $\bot$. Otherwise, let $\mathpzc{q}_{0,0}$ be the post-measurement state, go to the next step.

• •

For all $i\in[\lambda]$, do the following.

1. 1.

Compute $\tilde{p}_{0,i}\leftarrow\mathpzc{API}_{\mathcal{P},D_{0,i}}^{\epsilon^{\prime},\delta^{\prime}}(\mathpzc{q}_{0,i-1})$. Let $\mathpzc{q}_{0,i}$ be the post-measurement state. 2. 2.

If $\tilde{p}_{0,i}>\frac{1}{2}+\epsilon-4(i+1)\epsilon^{\prime}$, set $x_{0}^{\prime}[i]=0$. If $\tilde{p}_{0,i}<\frac{1}{2}-\epsilon+4(i+1)\epsilon^{\prime}$, set $x_{0}^{\prime}[i]=1$. Otherwise, exit the loop and output $\bot$.

• •

Let $\mathpzc{q}_{1,0}$ be $\mathpzc{q}_{0,\lambda}$. For all $i\in[\lambda]$, do the following.

1. 1.

Compute $\tilde{p}_{1,i}\leftarrow\mathpzc{API}_{\mathcal{P},D_{1,i}}^{\epsilon^{\prime},\delta^{\prime}}(\mathpzc{q}_{1,i-1})$. Let $\mathpzc{q}_{1,i}$ be the post-measurement state. 2. 2.

If $\tilde{p}_{1,i}>\frac{1}{2}+\epsilon-4(\lambda+i+1)\epsilon^{\prime}$, set $x_{1}^{\prime}[i]=0$. If $\tilde{p}_{1,i}<\frac{1}{2}-\epsilon+4(\lambda+i+1)\epsilon^{\prime}$, set $x_{1}^{\prime}[i]=1$. Otherwise, exit the loop and output $\bot$.

• •

Output $x_{0}^{\prime}=x_{0}^{\prime}[1]\|\cdots\|x_{0}^{\prime}[\lambda]$ and $x_{1}^{\prime}=x_{1}^{\prime}[1]\|\cdots\|x_{1}^{\prime}[\lambda]$.

We will estimate $\mathsf{Adv}_{\mathsf{CPFE},\mathpzc{B}}^{\mathsf{BZ}}(1^{\lambda})$. We define the events $\mathsf{BadDec}$, and $\mathsf{BadExt}_{0,i}$ and $\mathsf{BadExt}_{1,i}$ for every $i\in[\lambda]$.

$\mathsf{BadDec}$:

When $\mathpzc{B}$ runs $\mathpzc{Extract}(\mathsf{MPK}_{0},\mathsf{MPK}_{1},\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*},\mathpzc{D},\epsilon)$, $\tilde{p}_{0}<\frac{1}{2}+\epsilon-4\epsilon^{\prime}$ holds.

$\mathsf{BadExt}_{0,i}$:

When $\mathpzc{B}$ runs $\mathpzc{Extract}(\mathsf{MPK}_{0},\mathsf{MPK}_{1},\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*},\mathpzc{D},\epsilon)$, the following conditions hold.

• •

$\tilde{p}_{0}\geq\frac{1}{2}+\epsilon-4\epsilon^{\prime}$ holds.

• •

$x_{0}^{\prime}[j]=x_{0}[j]$ holds for every $j\in[i-1]$.

• •

$x_{0}^{\prime}[i]\neq x_{0}[i]$ holds.

$\mathsf{BadExt}_{1,i}$:

When $\mathpzc{B}$ runs $\mathpzc{Extract}(\mathsf{MPK}_{0},\mathsf{MPK}_{1},\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*},\mathpzc{D},\epsilon)$, the following conditions hold.

• •

$\tilde{p}_{0}\geq\frac{1}{2}+\epsilon-4\epsilon^{\prime}$ holds.

• •

$x_{0}^{\prime}[j]=x_{0}[j]$ holds for every $j\in[\lambda]$.

• •

$x_{1}^{\prime}[j]=x_{1}[j]$ holds for every $j\in[i-1]$.

• •

$x_{1}^{\prime}[i]\neq x_{1}[i]$ holds.

From the assumption that $\mathsf{Adv}_{\mathsf{PKE},\mathpzc{A}}^{\mathsf{s}\mbox{-}\mathsf{coic}\mbox{-}\mathsf{kla}}(\lambda)=\gamma$, for $\tilde{p}_{0}$ computed in $\mathpzc{Extract}$, $\tilde{p}_{0}\geq\frac{1}{2}+\epsilon-\epsilon^{\prime}$ holds with probability $\gamma-{\mathsf{negl}}(\lambda)$ due to the first item of Theorem 4.5. This means that $\Pr[\mathsf{BadDec}]\leq 1-\gamma+{\mathsf{negl}}(\lambda)$. Then, we have

[TABLE]

Estimation of $\Pr[\mathsf{BadExt}_{0,i}]$ for every $i\in[\lambda]$.

We first estimate $\Pr[\mathsf{BadExt}_{0,1}]$. We first consider the case of $x_{0}[1]=0$. From the first item of the event, we have $\tilde{p}_{0}>\frac{1}{2}+\epsilon-4\epsilon^{\prime}$. Let $\tilde{p}^{\prime}_{0}\leftarrow\mathpzc{API}_{\mathcal{P},D}^{\epsilon^{\prime},\delta^{\prime}}(\mathpzc{q}_{0,0})$. From the almost-projective property of $\mathpzc{API}$, we have

[TABLE]

Lemma 4.16.

When $x_{0}[1]=0$, $D_{0,1}$ is computationally indistinguishable from $D$.

Proof.

The difference between $D_{0,1}$ and $D$ is that $\mathsf{ct}_{0}$ is generated as $\mathsf{ct}_{0}\leftarrow\mathsf{CPFE}.\mathsf{Enc}(\mathsf{MPK}_{0},C^{*}[a,b,\mathsf{m}_{0},\mathsf{m}_{1},1])$ in $D_{0,1}$ and it is generated as $\mathsf{ct}_{0}\leftarrow\mathsf{CPFE}.\mathsf{Enc}(\mathsf{MPK}_{0},C[\mathsf{m}_{a\oplus b}])$ in $D$. From the condition that $x_{0}[1]=0$, we have $C^{*}[a,b,\mathsf{m}_{0},\mathsf{m}_{1},1](x_{0})=C[\mathsf{m}_{a\oplus b}](x_{0})=\mathsf{m}_{a\oplus b}$. Thus, from the $1$-bounded security of $\mathsf{CPFE}$, $D_{0,1}$ and $D$ are computationally indistinguishable when $x_{0}[1]=0$. ∎

Thus, from Theorem 4.6 and Lemma 4.16, we have

[TABLE]

This means that $\Pr[\mathsf{BadExt}_{0,1}]={\mathsf{negl}}(\lambda)$ when $x_{0}[1]=0$. We next consider the case of $x_{0}[1]=1$. We define the following distribution $D^{\mathtt{rev}}$.

$D^{\mathtt{rev}}$:

Generate $(b,\mathsf{ct}_{0},\mathsf{ct}_{1})\leftarrow D$. Output $(1\oplus b,\mathsf{ct}_{0},\mathsf{ct}_{1})$.

That is, the first bit of the output is flipped from $D$. Then, for any random coin $r$, we have $(\bm{P}_{D^{\mathtt{rev}}(r)},\bm{Q}_{D^{\mathtt{rev}}(r)})=(\bm{Q}_{D(r)},\bm{P}_{D(r)})$. This is because we have $\bm{Q}_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}}=\bm{I}-\bm{P}_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}}=\bm{P}_{1\oplus b,\mathsf{ct}_{0},\mathsf{ct}_{1}}$ for any tuple $(b,\mathsf{ct}_{0},\mathsf{ct}_{1})$. Therefore, $\mathpzc{API}_{\mathcal{P},D^{\mathtt{rev}}}^{\epsilon^{\prime},\delta^{\prime}}$ is exactly the same process as $\mathpzc{API}_{\mathcal{P}^{\mathtt{rev}},D}^{\epsilon^{\prime},\delta^{\prime}}$, where $\mathcal{P}^{\mathtt{rev}}=(\bm{Q}_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}},\bm{P}_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}})_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}}$. Let $\tilde{p}^{\prime}_{0}\leftarrow\mathpzc{API}_{\mathcal{P},D^{\mathtt{rev}}}^{\epsilon^{\prime},\delta^{\prime}}(\mathpzc{q}_{0,0})$. From, the reverse-almost-projective property of $\mathpzc{API}$, we have

[TABLE]

Lemma 4.17.

When $x_{0}[1]=1$, $D_{0,1}$ is computationally indistinguishable from $D^{\mathtt{rev}}$.

Proof.

We see that $D^{\mathtt{rev}}$ is identical to the following distribution.

• •

Generate $a,b\leftarrow\{0,1\}$ and $\mathsf{ct}_{0}\leftarrow\mathsf{Enc}(\mathsf{ek}_{0},\mathsf{m}_{a})$ and $\mathsf{ct}_{1}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{a\oplus 1\oplus b})$. Output $(b,\mathsf{ct}_{0},\mathsf{ct}_{1})$.

Then, the difference between $D_{0,1}$ and $D^{\mathtt{rev}}$ is that $\mathsf{ct}_{0}$ is generated as $\mathsf{ct}_{0}\leftarrow\mathsf{CPFE}.\mathsf{Enc}(\mathsf{MPK}_{0},C^{*}[a,b,\mathsf{m}_{0},\mathsf{m}_{1},1])$ in $D_{0,1}$ and it is generated as $\mathsf{ct}_{0}\leftarrow\mathsf{CPFE}.\mathsf{Enc}(\mathsf{MPK}_{0},C[\mathsf{m}_{a\oplus 1\oplus b}])$ in $D^{\mathtt{rev}}$. From the condition that $x_{0}[1]=1$, we have $C^{*}[a,b,\mathsf{m}_{0},\mathsf{m}_{1},1](x_{0})=C[\mathsf{m}_{a\oplus 1\oplus b}](x_{0})=\mathsf{m}_{a\oplus 1\oplus b}$. Thus, from the $1$-bounded security of $\mathsf{CPFE}$, $D_{0,1}$ and $D^{\mathtt{rev}}$ are computationally indistinguishable when $x_{0}[1]=1$. ∎

Thus, from Theorem 4.6 and Lemma 4.17, we have

[TABLE]

This means that $\Pr[\mathsf{BadExt}_{0,1}]={\mathsf{negl}}(\lambda)$ when $x_{0}[1]=1$.

Overall, $\Pr[\mathsf{BadExt}_{0,1}]={\mathsf{negl}}(\lambda)$ regardless of the value of $x_{0}$. We can similarly show that $\Pr[\mathsf{BadExt}_{0,i}]={\mathsf{negl}}(\lambda)$ for $i\in\{2,\cdots,\lambda\}$ using the fact that $D_{0,i}$ is computationally indistinguishable from $D$ if $x_{0}[i]=0$ and it is computationally indistinguishable from $D^{\mathtt{rev}}$ if $x_{0}[i]=1$. We omit the details.

Estimation of $\Pr[\mathsf{BadExt}_{1,i}]$ for every $i\in[\lambda]$.

We estimate $\Pr[\mathsf{BadExt}_{1,1}]$. We first consider the case of $x_{0}[\lambda]=0$ and $x_{1}[1]=0$. From the second item of the event, we have $\tilde{p}_{0,\lambda}>\frac{1}{2}+\epsilon-4(\lambda+1)\epsilon^{\prime}$. Let $\tilde{p}^{\prime}_{0,\lambda}\leftarrow\mathpzc{API}_{\mathcal{P},D_{0,\lambda}}^{\epsilon^{\prime},\delta^{\prime}}(\mathpzc{q}_{0,\lambda})$. From, the almost-projective property of $\mathpzc{API}$, we have

[TABLE]

Lemma 4.18.

When $x_{0}[\lambda]=x_{1}[1]=0$, $D_{0,\lambda}$ and $D_{1,1}$ are computationally indistinguishable.

Proof.

We can show that $D_{0,\lambda}$ is computationally indistinguishable from $D$ when $x_{0}[\lambda]=0$ similarly to Lemma 4.16. We see that $D$ is identical to the following distribution.

• •

Generate $a,b\leftarrow\{0,1\}$ and $\mathsf{ct}_{0}\leftarrow\mathsf{Enc}(\mathsf{ek}_{0},\mathsf{m}_{a\oplus b})$ and $\mathsf{ct}_{1}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m}_{a})$. Output $(b,\mathsf{ct}_{0},\mathsf{ct}_{1})$.

Then, the difference between $D_{1,1}$ and $D$ is that $\mathsf{ct}_{1}$ is generated as $\mathsf{ct}_{1}\leftarrow\mathsf{CPFE}.\mathsf{Enc}(\mathsf{MPK}_{1},C^{*}[a,b,\mathsf{m}_{0},\mathsf{m}_{1},1])$ in $D_{1,1}$ and it is generated as $\mathsf{ct}_{1}\leftarrow\mathsf{CPFE}.\mathsf{Enc}(\mathsf{MPK}_{1},C[\mathsf{m}_{a\oplus b}])$ in $D$. From the condition that $x_{1}[1]=0$, we have $C^{*}[a,b,\mathsf{m}_{0},\mathsf{m}_{1},1](x_{1})=C[\mathsf{m}_{a\oplus b}](x_{1})=\mathsf{m}_{a\oplus b}$. Thus, from the $1$-bounded security of $\mathsf{CPFE}$, $D_{1,1}$ and $D$ are computationally indistinguishable when $x_{0}[1]=0$. This means that $D_{0,\lambda}$ and $D_{1,1}$ are computationally indistinguishable when $x_{0}[\lambda]=x_{1}[1]=0$. ∎

Thus, from Theorem 4.6 and Lemma 4.18, we have

[TABLE]

This means that $\Pr[\mathsf{BadExt}_{1,1}]={\mathsf{negl}}(\lambda)$ when $x_{0}[\lambda]=0$ and $x_{1}[1]=0$. We next consider the case of $x_{0}[\lambda]=0$ and $x_{1}[1]=1$. We define the following distribution $D^{\mathtt{rev}}_{0,\lambda}$.

$D^{\mathtt{rev}}_{0,\lambda}$:

Generate $(b,\mathsf{ct}_{0},\mathsf{ct}_{1})\leftarrow D_{0,\lambda}$. Output $(1\oplus b,\mathsf{ct}_{0},\mathsf{ct}_{1})$.

That is, the first bit of the output is flipped from $D_{0,\lambda}$. Then, for any random coin $r$, we have $(\bm{P}_{D^{\mathtt{rev}}_{0,\lambda}(r)},\bm{Q}_{D^{\mathtt{rev}}_{0,\lambda}(r)})=(\bm{Q}_{D_{0,\lambda}(r)},\bm{P}_{D_{0,\lambda}(r)})$. (Again, this is because we have $\bm{Q}_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}}=\bm{I}-\bm{P}_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}}=\bm{P}_{1\oplus b,\mathsf{ct}_{0},\mathsf{ct}_{1}}$ for any tuple $(b,\mathsf{ct}_{0},\mathsf{ct}_{1})$.) Therefore, $\mathpzc{API}_{\mathcal{P},D^{\mathtt{rev}}_{0,\lambda}}^{\epsilon^{\prime},\delta^{\prime}}$ is exactly the same process as $\mathpzc{API}_{\mathcal{P}^{\mathtt{rev}},D_{0,\lambda}}^{\epsilon^{\prime},\delta^{\prime}}$, where $\mathcal{P}^{\mathtt{rev}}=(\bm{Q}_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}},\bm{P}_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}})_{b,\mathsf{ct}_{0},\mathsf{ct}_{1}}$. Let $\tilde{p}^{\prime}_{0,\lambda}\leftarrow\mathpzc{API}_{\mathcal{P},D^{\mathtt{rev}}_{0,\lambda}}^{\epsilon^{\prime},\delta^{\prime}}(\mathpzc{q}_{0,\lambda})$. From, the reverse-almost-projective property of $\mathpzc{API}$, we have

[TABLE]

Lemma 4.19.

When $x_{0}[\lambda]=0$ and $x_{1}[1]=1$, $D^{\mathtt{rev}}_{0,\lambda}$ and $D_{1,1}$ are computationally indistinguishable.

Proof.

We can show that both $D^{\mathtt{rev}}_{0,\lambda}$ and $D_{1,1}$ are computationally indistinguishable from $D^{\mathtt{rev}}$ when $x_{0}[\lambda]=0$ and $x_{1}[1]=1$. The proof is similarly to those for Lemmata 4.16, 4.17 and 4.18, thus we omit the details. ∎

Thus, from Theorem 4.6 and Lemma 4.19, we have

[TABLE]

This means that $\Pr[\mathsf{BadExt}_{1,1}]={\mathsf{negl}}(\lambda)$ when $x_{0}[\lambda]=0$ and $x_{1}[1]=1$.

Similarly, we can show that $\Pr[\mathsf{BadExt}_{1,1}]={\mathsf{negl}}(\lambda)$ holds when $(x_{0}[\lambda],x_{1}[1])=(1,0)$ and $(x_{0}[\lambda],x_{1}[1])=(1,1)$. Moreover, we can show that $\Pr[\mathsf{BadExt}_{1,i}]={\mathsf{negl}}(\lambda)$ holds for $i\in\{2,\cdots,\lambda\}$.

From the above discussion, we have $\mathsf{Adv}_{\mathsf{CPFE},\mathpzc{B}}^{\mathsf{BZ}}(1^{\lambda})\geq\gamma-{\mathsf{negl}}(\lambda)$ for some inverse polynomial $\gamma$, which contradicts Lemma 4.15. This completes the proof of Theorem 4.14. ∎

5 Construction of PKE with Secure Key Leasing

In this section, we prove the following theorem:

Theorem 5.1.

If there is an IND-CPA secure PKE scheme, then there is an IND-KLA secure PKE-SKL scheme.

By Theorem 3.9, it suffices to construct 1-query OW-KLA secure PKE-SKL scheme. In the rest of this section, we construct such a scheme. To build our scheme, we rely on a PKE scheme satisfying CoIC-KLA security, which is constructed from any IND-CPA secure PKE scheme in Section 4.

Let $\mathsf{cPKE}=(\mathsf{cPKE}.\mathsf{KG},\mathsf{cPKE}.\mathsf{Enc},\mathsf{cPKE}.\mathsf{Dec})$ be a PKE scheme satisfying CoIC-KLA security with message space $\{0,1\}^{\ell}$ where $\ell=\omega(\log\lambda)$. We note that CoIC-KLA security implies OW-CPA security when $\ell=\omega(\log\lambda)$. (See Appendix B for the proof.) Then, we construct a PKE-SKL scheme $(\mathsf{SKL}.\mathpzc{KG},\mathsf{SKL}.\mathsf{Enc},\mathsf{SKL}.\mathpzc{Dec},\mathsf{SKL}.\mathpzc{Vrfy})$ with message space $\{0,1\}^{\lambda\ell}$ as follows.

$\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$:

• •

Generate $(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{cPKE}.\mathsf{dk}_{i,b})\leftarrow\mathsf{cPKE}.\mathsf{KG}(1^{\lambda})$ for $i\in[\lambda]$ and $b\in\{0,1\}$.

• •

Output an encryption key

[TABLE]

a decryption key

[TABLE]

and a verification key

[TABLE]

For convenience, we write {\color[rgb]{.5,.5,.5}{\mathsf{DK}_{i}}} to mean the registers of $\mathpzc{dk}$ that contains $\frac{1}{\sqrt{2}}\left(\ket{0}\ket{\mathsf{cPKE}.\mathsf{dk}_{i,0}}+\ket{1}\ket{\mathsf{cPKE}.\mathsf{dk}_{i,1}}\right)$ for $i\in[\lambda]$.

$\mathsf{SKL}.\mathsf{Enc}(\mathsf{ek},\mathsf{m})$:

• •

Parse $\mathsf{ek}=\{\mathsf{cPKE}.\mathsf{ek}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ and $\mathsf{m}=\mathsf{m}_{1}\|\ldots\|\mathsf{m}_{\lambda}$ where $\mathsf{m}_{i}\in\{0,1\}^{\ell}$ for each $i\in[\lambda]$.

• •

Generate $\mathsf{cPKE}.\mathsf{ct}_{i,b}\leftarrow\mathsf{cPKE}.\mathsf{Enc}(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{m}_{i})$ for $i\in[\lambda]$ and $b\in\{0,1\}$.

• •

Output $\mathsf{ct}\coloneqq\{\mathsf{cPKE}.\mathsf{ct}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$.

$\mathsf{SKL}.\mathpzc{Dec}(\mathpzc{dk},\mathsf{ct})$:

• •

Parse $\mathpzc{dk}=\bigotimes_{i\in[\lambda]}\mathpzc{dk}_{i}$ and $\mathsf{ct}=\{\mathsf{cPKE}.\mathsf{ct}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$.

• •

Let $U_{\mathrm{dec}}$ be a unitary such that for all $\mathsf{cPKE}.\mathsf{dk}^{\prime}$, $\mathsf{cPKE}.\mathsf{ct}^{\prime}_{0}$, and $\mathsf{cPKE}.\mathsf{ct}^{\prime}_{1}$:

[TABLE]

Note that such a unitary can be computed in quantum polynomial-time since we assume that $\mathsf{cPKE}.\mathsf{Dec}$ is a deterministic classical polynomial-time algorithm.

• •

For all $i\in[\lambda]$, generate

[TABLE]

measure the rightmost register, and let $\mathsf{m}^{\prime}_{i}$ be the measurement outcome.

• •

Output $\mathsf{m}^{\prime}\coloneqq\mathsf{m}^{\prime}_{1}\|\ldots\|\mathsf{m}^{\prime}_{\lambda}$.

$\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{vk},\widetilde{\mathpzc{dk}})$:

• •

Parse $\mathsf{vk}=\{\mathsf{cPKE}.\mathsf{dk}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$.

• •

Apply a binary-outcome measurement $(\bm{I}-\Pi_{\mathrm{vrfy}}^{\mathsf{vk}},\Pi_{\mathrm{vrfy}}^{\mathsf{vk}})$ on $\widetilde{\mathpzc{dk}}$ where $\Pi_{\mathrm{vrfy}}^{\mathsf{vk}}$ is the projection onto the right decryption key, i.e.,

[TABLE]

If the measurement outcome is $1$ (indicating that the state was projected onto $\Pi_{\mathrm{vrfy}}^{\mathsf{vk}}$), output $\top$ and otherwise output $\bot$.

The correctness of $\mathsf{SKL}$ easily follows from that of $\mathsf{cPKE}$. Below, we show that $\mathsf{SKL}$ is 1-query OW-KLA secure.

Theorem 5.2.

If $\mathsf{cPKE}$ is CoIC-KLA secure, then $\mathsf{SKL}$ is 1-query OW-KLA secure.

Proof.

Let $\mathpzc{A}$ be a QPT adversary against 1-query OW-KLA security of $\mathsf{SKL}$. By Remark 3.5, we assume that $\mathpzc{A}$ makes the verification query before receiving the challenge ciphertext without loss of generality. We consider the following sequence of hybrids.

$\mathsf{Hyb}_{0}$:

This is the same as $\mathsf{Exp}_{\mathsf{SKL},\mathpzc{A}}^{\mathsf{ow}\mbox{-}\mathsf{kla}}(1^{\lambda})$. More specifically, it works as follows.

1. 1.

The challenger generates $(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{cPKE}.\mathsf{dk}_{i,b})\leftarrow\mathsf{cPKE}.\mathsf{KG}(1^{\lambda})$ for $i\in[\lambda]$ and $b\in\{0,1\}$, sets $\mathsf{ek}\coloneqq\{\mathsf{cPKE}.\mathsf{ek}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ and $\mathpzc{dk}\coloneqq\bigotimes_{i\in[\lambda]}\frac{1}{\sqrt{2}}\left(\ket{0}\ket{\mathsf{cPKE}.\mathsf{dk}_{i,0}}+\ket{1}\ket{\mathsf{cPKE}.\mathsf{dk}_{i,1}}\right)$, and sends $\mathsf{ek}$ and $\mathpzc{dk}$ to $\mathpzc{A}$. 2. 2.

$\mathpzc{A}$ queries $\widetilde{\mathpzc{dk}}$ to the verification oracle. The challenger applies a binary-outcome measurement $(\bm{I}-\Pi_{\mathrm{vrfy}}^{\mathsf{vk}},\Pi_{\mathrm{vrfy}}^{\mathsf{vk}})$ on $\widetilde{\mathpzc{dk}}$where $\Pi_{\mathrm{vrfy}}^{\mathsf{vk}}$ is the projection defined in the description of $\mathsf{SKL}.\mathpzc{Vrfy}$. If the measurement outcome is [math] (indicating that the state was projected onto $\bm{I}-\Pi_{\mathrm{vrfy}}^{\mathsf{vk}}$), the challenger outputs [math] as the final outcome of this experiment.151515In the description of the OW-KLA experiment in Definition 3.7, the oracle returns $\bot$ even if the decryption key does not pass the verification. However, in the 1-query setting, if the first (and only) query is rejected, the experiment finally outputs [math]. Thus, we terminate the experiment at this point when the query is rejected. Otherwise, the challenger returns $\top$ to $\mathpzc{A}$ as the response from the oracle. 3. 3.

The challenger chooses $\mathsf{m}^{*}_{i}\leftarrow\{0,1\}^{\ell}$ for $i\in[\lambda]$, generates $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}\leftarrow\mathsf{cPKE}.\mathsf{Enc}(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{m}^{*}_{i})$ for $i\in[\lambda]$ and $b\in\{0,1\}$, and sends $\mathsf{ct}^{*}\coloneqq\{\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ to $\mathpzc{A}$.161616Since $\mathpzc{A}$ makes only one verification query, we can assume that $\mathpzc{A}$ requests the challenge ciphertext immediately after finishing the first verification query without loss of generality. 4. 4.

$\mathpzc{A}$ outputs $\mathsf{m}^{\prime}=\mathsf{m}^{\prime}_{1}\|\ldots\|\mathsf{m}^{\prime}_{\lambda}$. The challenger outputs $1$ if $\mathsf{m}^{\prime}_{i}=\mathsf{m}^{*}_{i}$ for all $i\in[\lambda]$ and otherwise [math] as the final outcome of this experiment.

Note that we have $\Pr[\mathsf{Hyb}_{0}=1]=\mathsf{Adv}_{\mathsf{SKL},\mathpzc{A}}^{\mathsf{ow}\mbox{-}\mathsf{kla}}(1^{\lambda})$. Our goal is to prove $\Pr[\mathsf{Hyb}_{0}=1]={\mathsf{negl}}(\lambda)$.

$\mathsf{Hyb}_{1}$:

This is identical to $\mathsf{Hyb}_{0}$ except for the following modifications:

• •

The challenger chooses $\mathsf{m}^{*}_{i,b}\leftarrow\{0,1\}^{\ell}$ for $i\in[\lambda]$ and $b\in\{0,1\}$ (instead of choosing $\mathsf{m}^{*}_{i}\leftarrow\{0,1\}^{\ell}$ for $i\in[\lambda]$) and $a_{i}\leftarrow\{0,1\}$ for $i\in[\lambda]$.

• •

$\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}$ is generated as $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}\leftarrow\mathsf{cPKE}.\mathsf{Enc}(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{m}^{*}_{i,a_{i}})$ for $i\in[\lambda]$ and $b\in\{0,1\}$. We emphasize that \mathsf{m}^{*}_{i,\color[rgb]{1,0,0}\underline{a_{i}}} is encrypted for both cases of $b=0$ and $b=1$ and $\mathsf{m}^{*}_{i,a_{i}\oplus 1}$ is not used in this step.

• •

In Step 4, the challenger outputs $1$ if $\mathsf{m}^{\prime}_{i}\in\{\mathsf{m}^{*}_{i,0},\mathsf{m}^{*}_{i,1}\}$ for all $i\in[\lambda]$.

By considering $\mathsf{m}^{*}_{i,a_{i}}$ in $\mathsf{Hyb}_{1}$ as $\mathsf{m}^{*}_{i}$ in $\mathsf{Hyb}_{0}$, these hybrids are identical from the view of $\mathpzc{A}$ except that the winning condition (i.e., the condition that the challenger returns $1$) is just relaxed in $\mathsf{Hyb}_{1}$. Therefore, we trivially have $\Pr[\mathsf{Hyb}_{0}=1]\leq\Pr[\mathsf{Hyb}_{1}=1]$.

$\mathsf{Hyb}_{2}$:

This is identical to $\mathsf{Hyb}_{1}$ except that $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}$ is generated as $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}\leftarrow\mathsf{cPKE}.\mathsf{Enc}(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{m}^{*}_{i,a_{i}\oplus b})$ for $i\in[\lambda]$ and $b\in\{0,1\}$. We remark that the way of generating $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,1}$ is changed but that of $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,0}$ is unchanged (because $a_{i}\oplus 0=a_{i}$).

By the CoIC-KLA security of $\mathsf{cPKE}$ and a standard hybrid argument, we have $\absolutevalue{\Pr[\mathsf{Hyb}_{1}=1]-\Pr[\mathsf{Hyb}_{2}=1]}={\mathsf{negl}}(\lambda)$. See Lemma 5.3 for the detail.

$\mathsf{Hyb}_{3}$:

This is identical to $\mathsf{Hyb}_{2}$ except that the challenger quits choosing $a_{i}\leftarrow\{0,1\}$ for $i\in[\lambda]$ and $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}$ is generated as $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}\leftarrow\mathsf{cPKE}.\mathsf{Enc}(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{m}^{*}_{i,b})$ for $i\in[\lambda]$ and $b\in\{0,1\}$.

This modification is just conceptual and we have $\Pr[\mathsf{Hyb}_{2}=1]=\Pr[\mathsf{Hyb}_{3}=1]$.

$\mathsf{Hyb}_{4}$:

This is identical to $\mathsf{Hyb}_{3}$ except for a conceptual modification that the measurement of the returned key $\widetilde{\mathpzc{dk}}$ is deferred until the end of the experiment. For clarity, we give the full description of this experiment.

1. 1.

The challenger generates $(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{cPKE}.\mathsf{dk}_{i,b})\leftarrow\mathsf{cPKE}.\mathsf{KG}(1^{\lambda})$ for $i\in[\lambda]$ and $b\in\{0,1\}$, sets $\mathsf{ek}\coloneqq\{\mathsf{cPKE}.\mathsf{ek}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ and $\mathpzc{dk}\coloneqq\bigotimes_{i\in[\lambda]}\frac{1}{\sqrt{2}}\left(\ket{0}\ket{\mathsf{cPKE}.\mathsf{dk}_{i,0}}+\ket{1}\ket{\mathsf{cPKE}.\mathsf{dk}_{i,1}}\right)$, and sends $\mathsf{ek}$ and $\mathpzc{dk}$ to $\mathpzc{A}$. 2. 2.

$\mathpzc{A}$ queries $\widetilde{\mathpzc{dk}}$ to the verification oracle. The challenger returns $\top$ to $\mathpzc{A}$ as the response from the oracle. 3. 3.

The challenger chooses $\mathsf{m}^{*}_{i,b}\leftarrow\{0,1\}^{\ell}$ for $i\in[\lambda]$ and $b\in\{0,1\}$ generates $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}\leftarrow\mathsf{cPKE}.\mathsf{Enc}(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{m}^{*}_{i,b})$ for $i\in[\lambda]$ and $b\in\{0,1\}$, and sends $\mathsf{ct}^{*}\coloneqq\{\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ to $\mathpzc{A}$. 4. 4.

$\mathpzc{A}$ outputs $\mathsf{m}^{\prime}=\mathsf{m}^{\prime}_{1}\|\ldots\|\mathsf{m}^{\prime}_{\lambda}$. The challenger outputs [math] as the final outcome of this experiment if $\mathsf{m}^{\prime}_{i}\notin\{\mathsf{m}^{*}_{i,0},\mathsf{m}^{*}_{i,1}\}$ for some $i\in[\lambda]$. 5. 5.

Otherwise, the challenger applies a binary-outcome measurement $(\bm{I}-\Pi_{\mathrm{vrfy}}^{\mathsf{vk}},\Pi_{\mathrm{vrfy}}^{\mathsf{vk}})$ on $\widetilde{\mathpzc{dk}}$where $\Pi_{\mathrm{vrfy}}^{\mathsf{vk}}$ is the projection defined in the description of $\mathsf{SKL}.\mathpzc{Vrfy}$. the challenger outputs the outcome of the measurement as the final outcome of this experiment.

By the deferred measurement principle, we have $\Pr[\mathsf{Hyb}_{3}=1]=\Pr[\mathsf{Hyb}_{4}=1]$.

$\mathsf{Hyb}_{5}$:

This is identical to $\mathsf{Hyb}_{4}$ except that the challenger measures the returned key $\widetilde{\mathpzc{dk}}$ in the computational basis instead of applying the projective measurement $(\bm{I}-\Pi_{\mathrm{vrfy}}^{\mathsf{vk}},\Pi_{\mathrm{vrfy}}^{\mathsf{vk}})$ in Step 5, and the condition to output $1$ is modified as follows:

• •

Let $\{\widetilde{b}_{i},\mathsf{cPKE}.\widetilde{\mathsf{dk}}_{i}\}_{i\in[\lambda]}$ be the outcome of the measurement of $\widetilde{\mathpzc{dk}}$ in the computational basis. If there is $i\in[\lambda]$ such that $\mathsf{cPKE}.\widetilde{\mathsf{dk}}_{i}\neq\mathsf{cPKE}.\mathsf{dk}_{i,\widetilde{b}_{i}}$, the challenger outputs [math] as the final outcome of this experiment. Otherwise, define $\mathbf{b}=b_{1}\|\ldots\|b_{\lambda}\in\{0,1\}^{\lambda}$ in such a way that $\mathsf{m}^{\prime}_{i}=\mathsf{m}^{*}_{i,b_{i}}$ for $i\in[\lambda]$. Note that such $\mathbf{b}$ must exist since this step is invoked only when the challenger does not output [math] in Step 4.171717If $\mathsf{m}^{*}_{i,0}=\mathsf{m}^{*}_{i,1}$ (which happens with a negligible probability), then we set $b_{i}\coloneqq 0$. If there is $i\in[\lambda]$ such that $\widetilde{b}_{i}\neq b_{i}$, the challenger outputs $1$ and otherwise [math] as the final output of the experiment.

We prove that if $\Pr[\mathsf{Hyb}_{5}=1]={\mathsf{negl}}(\lambda)$, then it holds that $\Pr[\mathsf{Hyb}_{4}=1]={\mathsf{negl}}(\lambda)$. The intuition is as follows: If we have $\widetilde{b}_{i}=b_{i}$ with overwhelming probability, then $\widetilde{\mathpzc{dk}}$ has a negligible amplitude on $\bigotimes_{i\in[\lambda]}\ket{b^{\prime}_{i}}\ket{\mathsf{cPKE}.\widetilde{\mathsf{dk}}_{b^{\prime}_{i}}}$ for all $\mathbf{b}^{\prime}\neq\mathbf{b}$. In this case, the probability that $\widetilde{\mathpzc{dk}}$ is projected onto $\Pi_{\mathrm{vrfy}}^{\mathsf{vk}}$ is negligible since the right key $\mathpzc{dk}$ has an exponentially small amplitude on $\bigotimes_{i\in[\lambda]}\ket{b_{i}}\ket{\mathsf{cPKE}.\widetilde{\mathsf{dk}}_{b_{i}}}$. See Lemma 5.4 for the detail.

$\mathsf{Hyb}_{6}$:

This is identical to $\mathsf{Hyb}_{5}$ except that the challenger chooses $i^{*}\leftarrow[\lambda]$ at the beginning of the experiment and the condition to output $1$ is modified to that $\widetilde{b}_{i^{*}}\neq b_{i^{*}}$ holds for the a priori chosen $i^{*}$ instead of for some $i\in[\lambda]$.

Whenever there is $i$ such that $\widetilde{b}_{i}\neq b_{i}$, the probability that $i^{*}\leftarrow[\lambda]$ satisfies $\widetilde{b}_{i^{*}}\neq b_{i^{*}}$ is at least $\frac{1}{\lambda}$. Thus, we have $\Pr[\mathsf{Hyb}_{6}=1]\geq\frac{1}{\lambda}\Pr[\mathsf{Hyb}_{5}=1]$.

$\mathsf{Hyb}_{7}$:

This is identical to $\mathsf{Hyb}_{6}$ except that challenger measures the register {\color[rgb]{.5,.5,.5}{\mathsf{DK}_{i^{*}}}} of the decryption key $\mathpzc{dk}$ in the computational basis before giving $\mathpzc{dk}$ to $\mathpzc{A}$. (See the description of $\mathsf{SKL}.\mathpzc{KG}$ for the definition of register {\color[rgb]{.5,.5,.5}{\mathsf{DK}_{i^{*}}}}.)

Note that the measurement of {\color[rgb]{.5,.5,.5}{\mathsf{DK}_{i^{*}}}} in the computational basis yields either $(0,\mathsf{cPKE}.\mathsf{dk}_{i^{*},0})$ or $(1,\mathsf{cPKE}.\mathsf{dk}_{i^{*},1})$. In particular, there are only two possible outcomes. Thus, by Lemma 2.21, we have $\Pr[\mathsf{Hyb}_{7}=1]\geq\frac{1}{2}\Pr[\mathsf{Hyb}_{6}=1]$.

$\mathsf{Hyb}_{8}$:

This is identical to $\mathsf{Hyb}_{7}$ except that the collapsing caused by measuring {\color[rgb]{.5,.5,.5}{\mathsf{DK}_{i^{*}}}} is simulated by classical randomness. That is, the challenger chooses $b^{*}\leftarrow\{0,1\}$ at the beginning and sets

[TABLE]

It is easy to see that $\mathsf{Hyb}_{7}$ and $\mathsf{Hyb}_{8}$ are identical from the view of $\mathpzc{A}$, and thus we have $\Pr[\mathsf{Hyb}_{7}=1]=\Pr[\mathsf{Hyb}_{8}=1]$. In Lemma 5.6, we prove that $\Pr[\mathsf{Hyb}_{8}=1]={\mathsf{negl}}(\lambda)$ by using the OW-CPA security (which is implied by CoIC-KLA security) of $\mathsf{SKL}$.

By combining the above, we have $\Pr[\mathsf{Hyb}_{0}=1]={\mathsf{negl}}(\lambda)$. This means that $\mathsf{SKL}$ is OW-KLA secure. We are left to prove Lemmata 5.3, 5.4 and 5.6

Lemma 5.3.

It holds that $\absolutevalue{\Pr[\mathsf{Hyb}_{1}=1]-\Pr[\mathsf{Hyb}_{2}=1]}={\mathsf{negl}}(\lambda)$ if $\mathsf{cPKE}$ is CoIC-KLA secure.

Proof.

We define additional hybrids $\mathsf{Hyb}_{1.j}$ for $j\in[\lambda+1]$ as follows.

$\mathsf{Hyb}_{1.j}$:

This is identical to $\mathsf{Hyb}_{1}$ except that $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}$ is generated as

[TABLE]

for $i\in[\lambda]$.

Clearly, we have $\mathsf{Hyb}_{1}=\mathsf{Hyb}_{1.1}$ and $\mathsf{Hyb}_{2}=\mathsf{Hyb}_{1.\lambda+1}$. Thus, it suffices to prove that $\left|\Pr[\mathsf{Hyb}_{1.j+1}=1]-\Pr[\mathsf{Hyb}_{1.j}=1]\right|={\mathsf{negl}}(\lambda).$ Remark that the only difference between $\mathsf{Hyb}_{1.j+1}$ and $\mathsf{Hyb}_{1.j}$ is the way of generating $\mathsf{cPKE}.\mathsf{ct}^{*}_{j,1}$. To show that $\left|\Pr[\mathsf{Hyb}_{1.j+1}=1]-\Pr[\mathsf{Hyb}_{1.j}=1]\right|={\mathsf{negl}}(\lambda)$, we construct $\mathpzc{B}$ against CoIC-KLA security of $\mathsf{cPKE}$ as follows.

$\mathpzc{B}(\mathsf{cPKE}.\mathsf{ek}^{*}_{0},\mathsf{cPKE}.\mathsf{ek}^{*}_{1},\mathpzc{dk}^{*})$:

It works as follows.

1. 1.

Generate $(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{cPKE}.\mathsf{dk}_{i,b})\leftarrow\mathsf{cPKE}.\mathsf{KG}(1^{\lambda})$ for $i\in[\lambda]\setminus\{j\}$ and $b\in\{0,1\}$ and set $\mathsf{cPKE}.\mathsf{ek}_{j,b}\coloneqq\mathsf{cPKE}.\mathsf{ek}^{*}_{b}$ for $b\in\{0,1\}$. Set $\mathsf{ek}\coloneqq\{\mathsf{cPKE}.\mathsf{ek}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ and

[TABLE]

This implicitly defines $\mathsf{vk}\coloneqq\{\mathsf{cPKE}.\mathsf{dk}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ where $\mathsf{cPKE}.\mathsf{dk}_{j,b}$ is the decryption key corresponding to $\mathsf{cPKE}.\mathsf{dk}_{j,b}$ chosen by the external challenger for $b\in\{0,1\}$ (but $\mathpzc{B}$ cannot know $\mathsf{vk}$). 2. 2.

Send $\mathsf{ek}$ and $\mathpzc{dk}$ to $\mathpzc{A}$ and receives the verification query $\widetilde{\mathpzc{dk}}$ from $\mathpzc{A}$. 3. 3.

Apply a binary-outcome measurement $(\bm{I}-\Pi_{\mathrm{vrfy}}^{\mathsf{vk}},\Pi_{\mathrm{vrfy}}^{\mathsf{vk}})$ on $\widetilde{\mathpzc{dk}}$. This is possible by simulating the projection on \{{\color[rgb]{.5,.5,.5}{\mathsf{DK}_{i}}}\}_{i\neq j} by itself while forwarding {\color[rgb]{.5,.5,.5}{\mathsf{DK}_{j}}} to its own verification oracle. If the outcome is [math], output [math]. Otherwise, return $\top$ to $\mathpzc{A}$ as the response from the oracle. 4. 4.

Choose $\mathsf{m}^{*}_{i,b}\leftarrow\{0,1\}^{\ell}$ for $i\in[\lambda]$ and $b\in\{0,1\}$ and $a_{i}\leftarrow\{0,1\}$ for $i\in[\lambda]\setminus\{j\}$, send $(\mathsf{m}^{*}_{j,0},\mathsf{m}^{*}_{j,1})$ to the external challenger, and receive $(\mathsf{cPKE}.\mathsf{ct}^{*}_{0},\mathsf{cPKE}.\mathsf{ct}^{*}_{1})$ from the challenger. This implicitly defines $a_{j}\leftarrow\{0,1\}$ and $\beta\leftarrow\{0,1\}$ where the challenger generates $\mathsf{cPKE}.\mathsf{ct}^{*}_{0}\coloneqq\mathsf{cPKE}.\mathsf{Enc}(\mathsf{cPKE}.\mathsf{ek}_{j},m^{*}_{j,a_{j}})$ and $\mathsf{cPKE}.\mathsf{ct}^{*}_{1}\coloneqq\mathsf{cPKE}.\mathsf{Enc}(\mathsf{cPKE}.\mathsf{ek}_{j},m^{*}_{j,a_{j}\oplus\beta})$ (but $\mathpzc{B}$ cannot know $a_{j}$ or $\beta$).181818Here, $\beta$ plays the role of $b$ in the experiment $\mathsf{Exp}_{\mathsf{cPKE},\mathpzc{B}}^{\mathsf{coic}\mbox{-}\mathsf{kla}}(1^{\lambda})$ in Definition 4.11. This is because $b$ is used in another meaning in this section. 5. 5.

Generate $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}\leftarrow,\mathsf{cPKE}.\mathsf{Enc}(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{m}^{*}_{i,a_{i}\oplus b})$ for $i\in[\lambda]\setminus\{j\}$ and $b\in\{0,1\}$, set $\mathsf{cPKE}.\mathsf{ct}^{*}_{j,b}\coloneqq\mathsf{cPKE}.\mathsf{ct}^{*}_{b}$ for $b\in\{0,1\}$, send $\mathsf{ct}^{*}\coloneqq\{\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ to $\mathpzc{A}$, and receive $\mathsf{m}^{\prime}=\mathsf{m}^{\prime}_{1}\|\ldots\|\mathsf{m}^{\prime}_{\lambda}$ from $\mathpzc{A}$. 6. 6.

Output $1$ if $\mathsf{m}^{\prime}_{i}\in\{\mathsf{m}^{*}_{i,0},\mathsf{m}^{*}_{i,1}\}$ for all $i\in[\lambda]$ and otherwise output [math].

We have

[TABLE]

where $(\mathsf{cPKE}.\mathsf{ek}^{*}_{0},\mathsf{cPKE}.\mathsf{dk}^{*}_{0})\leftarrow\mathsf{cPKE}.\mathsf{KG}(1^{\lambda})$, $(\mathsf{cPKE}.\mathsf{ek}^{*}_{1},\mathsf{cPKE}.\mathsf{dk}^{*}_{1})\leftarrow\mathsf{cPKE}.\mathsf{KG}(1^{\lambda})$, and $\mathpzc{dk}^{*}\coloneqq\frac{1}{\sqrt{2}}(\ket{\mathsf{cPKE}.\mathsf{dk}^{*}_{0}}+\ket{\mathsf{cPKE}.\mathsf{dk}^{*}_{1}})$. Thus, $\left|\Pr[\mathsf{Hyb}_{1.j+1}=1]-\Pr[\mathsf{Hyb}_{1.j}=1]\right|={\mathsf{negl}}(\lambda)$ by the CoIC-KLA security of $\mathsf{cPKE}$. This completes the proof of Lemma 5.3. ∎

Lemma 5.4.

If $\Pr[\mathsf{Hyb}_{5}=1]={\mathsf{negl}}(\lambda)$, then it holds that $\Pr[\mathsf{Hyb}_{4}=1]={\mathsf{negl}}(\lambda)$.

Proof.

Let $\epsilon\coloneqq\Pr[\mathsf{Hyb}_{4}=1]$. For $\mathsf{vk}=\{\mathsf{cPKE}.\mathsf{dk}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ and $\mathbf{b}=b_{1}\|\ldots\|b_{\lambda}\in\{0,1\}^{\lambda}$, let $\mathsf{E}_{\mathbf{b}}^{\mathsf{vk}}$ be the event that $\mathsf{vk}$ is chosen as a verification key and $\mathsf{m}^{\prime}_{i}=\mathsf{m}^{*}_{i,b_{i}}$ for all $i\in[\lambda]$. Let $\widetilde{\mathpzc{dk}}_{\mathbf{b}}^{\mathsf{vk}}$ be the state of the returned key conditioned on $\mathsf{E}_{\mathbf{b}}^{\mathsf{vk}}$. Clearly, we have

[TABLE]

Let $\mathtt{Good}$ be a subset defined as

[TABLE]

Then, by a standard averaging argument, it holds that

[TABLE]

For $\mathsf{vk}=\{\mathsf{cPKE}.\mathsf{dk}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ and $\mathbf{b}=b_{1}\|\ldots\|b_{\lambda}$, let $\Pi_{\neq\mathbf{b}}^{\mathsf{vk}}$ be a projection defined as follows:

[TABLE]

Then, by the definition of $\mathsf{Hyb}_{5}$, one can see that

[TABLE]

Then, we show the following proposition.

Proposition 5.5.

For any $(\mathsf{vk},\mathbf{b})\in\mathtt{Good}$, it holds that

[TABLE]

Proof of Proposition 5.5.

By diagonalization, we can write

[TABLE]

where $0<p_{j}\leq 1$, $\sum_{j=1}^{N}p_{j}=1$, and $\left|\bra{\psi_{j}}\ket{\psi_{j}}\right|=1$. For each $j\in[N]$, it holds that

[TABLE]

where the inequalities in the third and fourth lines follow from Cauchy–Schwarz inequality.

Then, it holds that

[TABLE]

Since we assume $(\mathsf{vk},\mathbf{b})\in\mathtt{Good}$, it holds that $\Tr(\Pi_{\mathrm{vrfy}}^{\mathsf{vk}}\widetilde{\mathpzc{dk}}_{\mathbf{b}}^{\mathsf{vk}})\geq\frac{\epsilon}{2}$. By combining the above, Proposition 5.5 is proven. ∎

Then, we have

[TABLE]

where the second inequality follows from Proposition 5.5 and the third inequality follows from Eq. 74. Recalling that $\epsilon=\Pr[\mathsf{Hyb}_{4}=1]$, the above inequality implies Lemma 5.4. ∎

Lemma 5.6.

It holds that $\Pr[\mathsf{Hyb}_{8}=1]={\mathsf{negl}}(\lambda)$ if $\mathsf{cPKE}$ is OW-CPA secure.

Proof.

For clarity, we give the full description of $\mathsf{Hyb}_{8}$ below.

$\mathsf{Hyb}_{8}$:

It works as follows:

1. 1.

The challenger chooses $i^{*}\leftarrow[\lambda]$ and $b^{*}\in\{0,1\}$, generates $(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{cPKE}.\mathsf{dk}_{i,b})\leftarrow\mathsf{cPKE}.\mathsf{KG}(1^{\lambda})$ for $i\in[\lambda]$ and $b\in\{0,1\}$, sets $\mathsf{ek}\coloneqq\{\mathsf{cPKE}.\mathsf{ek}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ and

[TABLE]

and sends $\mathsf{ek}$ and $\mathpzc{dk}$ to $\mathpzc{A}$. 2. 2.

$\mathpzc{A}$ queries $\widetilde{\mathpzc{dk}}$ to the verification oracle. The challenger returns $\top$ to $\mathpzc{A}$ as the response from the oracle. 3. 3.

The challenger chooses $\mathsf{m}^{*}_{i,b}\leftarrow\{0,1\}^{\ell}$ for $i\in[\lambda]$ and $b\in\{0,1\}$, generates $\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}\leftarrow\mathsf{cPKE}.\mathsf{Enc}(\mathsf{cPKE}.\mathsf{ek}_{i,b},\mathsf{m}^{*}_{i,b})$ for $i\in[\lambda]$ and $b\in\{0,1\}$, and sends $\mathsf{ct}^{*}\coloneqq\{\mathsf{cPKE}.\mathsf{ct}^{*}_{i,b}\}_{i\in[\lambda],b\in\{0,1\}}$ to $\mathpzc{A}$. 4. 4.

$\mathpzc{A}$ outputs $\mathsf{m}^{\prime}=\mathsf{m}^{\prime}_{1}\|\ldots\|\mathsf{m}^{\prime}_{\lambda}$. The challenger outputs [math] as the final output of the experiment if $\mathsf{m}^{\prime}_{i}\notin\{\mathsf{m}^{*}_{i,0},\mathsf{m}^{*}_{i,1}\}$ for some $i\in[\lambda]$. 5. 5.

Otherwise, the challenger measures $\widetilde{\mathpzc{dk}}$ in the computational basis, and let $\{\widetilde{b}_{i},\mathsf{cPKE}.\widetilde{\mathsf{dk}}_{i}\}_{i\in[\lambda]}$ be the outcome. If there is $i\in[\lambda]$ such that $\mathsf{cPKE}.\widetilde{\mathsf{dk}}_{i}\neq\mathsf{cPKE}.\mathsf{dk}_{i,\widetilde{b}_{i}}$, the challenger outputs [math] as the final outcome of this experiment. Otherwise, define $\mathbf{b}=b_{1}\|\ldots\|b_{\lambda}\in\{0,1\}^{\lambda}$ in such a way that $\mathsf{m}^{\prime}_{i}=\mathsf{m}^{*}_{i,b_{i}}$ for $i\in[\lambda]$. Note that such $\mathbf{b}$ must exist since this step is invoked only when the challenger does not output [math] in Step 4.191919If $\mathsf{m}^{*}_{i,0}=\mathsf{m}^{*}_{i,1}$ (which happens with a negligible probability), then we set $b_{i}\coloneqq 0$. If $\widetilde{b}_{i^{*}}\neq b_{i^{*}}$, the challenger outputs $1$ and otherwise [math] as the final output of the experiment.

Suppose that we simulate $\mathsf{Hyb}_{8}$ for $\mathpzc{A}$ while embedding a problem instance of the OW-CPA security of $\mathsf{cPKE}$ into $\mathsf{cPKE}.\mathsf{ek}_{i^{*},b^{*}\oplus 1}$ and $\mathsf{cPKE}.\mathsf{ct}^{*}_{i^{*},b^{*}\oplus 1}$. Remark that this is possible without knowing $\mathsf{cPKE}.\mathsf{dk}_{i^{*},b^{*}\oplus 1}$. Suppose that $\mathsf{Hyb}_{8}=1$ occurs in the simulated execution. Then, we in particular have $\mathsf{m}^{\prime}_{i^{*}}=\mathsf{m}^{*}_{i^{*},b_{i^{*}}}$, $\mathsf{cPKE}.\widetilde{\mathsf{dk}}_{i^{*}}=\mathsf{cPKE}.\mathsf{dk}_{i^{*},\widetilde{b}_{i^{*}}}$, and $\widetilde{b}_{i^{*}}\neq b_{i^{*}}$. We consider the following two sub-cases.

If $b_{i^{*}}=b^{*}$, then we have $\widetilde{b}_{i^{*}}=b^{*}\oplus 1$. This implies $\mathsf{cPKE}.\widetilde{\mathsf{dk}}_{i^{*}}=\mathsf{cPKE}.\mathsf{dk}_{i^{*},b^{*}\oplus 1}$. Then we can decrypt $\mathsf{cPKE}.\mathsf{ct}_{i^{*},b^{*}\oplus 1}$ by honestly running the decryption algorithm with $\mathsf{cPKE}.\mathsf{dk}_{i^{*},b^{*}\oplus 1}$. This contradicts the OW-CPA security of $\mathsf{cPKE}$. 2. 2.

If $b_{i^{*}}\neq b^{*}$, then we have $\mathsf{m}^{\prime}_{i^{*}}=\mathsf{m}^{*}_{i^{*},b^{*}\oplus 1}$, which is the message encrypted in $\mathsf{cPKE}.\mathsf{ek}_{i^{*},b^{*}\oplus 1}$. This means that we can break the OW-CPA security of $\mathsf{cPKE}$.

Neither of them occurs with a non-negligible probability assuming the OW-CPA security of $\mathsf{cPKE}$. Thus, $\Pr[\mathsf{Hyb}_{8}=1]={\mathsf{negl}}(\lambda)$. This completes the proof of Lemma 5.6. ∎

This completes the proof of Theorem 5.2. ∎

Remark 5.7 (On OMUR).

We can show that $\mathsf{SKL}$ constructed above also satisfies OMUR. Since there is a generic conversion to add OMUR as shown in Lemma 3.10 anyway, we only give a proof sketch.

We reduce OMUR to 1-key OW-KLA security. Suppose that there is an adversary that breaks OMUR, i.e., passes the verification twice. Then roughly speaking, we can use it to break 1-key OW-KLA security by sending one of them to the verification oracle and using the other one to decrypt the challenge message. There is an issue that the reduction algorithm may make only one verification query while the adversary against OMUR may make arbitrarily many verification queries. To resolve this issue, we can use a similar idea to that used in the proof of Lemma 3.10. The reduction algorithm guesses the first two queries to be accepted. Conditioned on that the guess is correct, the reduction algorithm can simulate the verification oracle by simply returning $\bot$ to all queries except for the two queries that are guessed to be accepted until the adversary make the second guessed query. The guess is correct with probability $\binom{Q}{2}^{-1}$ where $Q$ is the number of queries. Thus, the reduction works with a polynomial security loss. Since we already proved that $\mathsf{SKL}$ is 1-query OW-KLA secure (Theorem 5.2), the above reduction shows that it satisfies OMUR.

6 Attribute-Based Encryption with Secure Key Leasing

6.1 Definitions

Definition 6.1 (ABE with Secure Key Leasing).

An ABE-SKL scheme $\mathsf{ABE}\textrm{-}\mathsf{SKL}$ is a tuple of six algorithms $(\mathsf{Setup},\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec},\mathpzc{Cert},\mathsf{Vrfy})$. Below, let $\mathcal{X}=\{\mathcal{X}_{\lambda}\}_{\lambda}$, $\mathcal{Y}=\{\mathcal{Y}_{\lambda}\}_{\lambda}$, and $R=\{R_{\lambda}:\mathcal{X}_{\lambda}\times\mathcal{Y}_{\lambda}\to\{0,1\}\}_{\lambda}$ be the ciphertext space, the key attribute space, and the associated relation of $\mathsf{ABE}\textrm{-}\mathsf{SKL}$, respectively.

$\mathsf{Setup}(1^{\lambda})\rightarrow(\mathsf{pk},\mathsf{msk})$:

The setup algorithm takes a security parameter $1^{\lambda}$, and outputs a public key $\mathsf{pk}$ and master secret key $\mathsf{msk}$.

$\mathpzc{KG}(\mathsf{msk},y)\rightarrow(\mathpzc{usk},\mathsf{vk})$:

The key generation algorithm takes a master secret key $\mathsf{msk}$ and a key attribute $y\in\mathcal{Y}$, and outputs a user secret key $\mathpzc{usk}$ and a verification key $\mathsf{vk}$.

$\mathsf{Enc}(\mathsf{pk},x,m)\rightarrow\mathsf{ct}$:

The encryption algorithm takes a public key $\mathsf{pk}$, a ciphertext attribute $x\in\mathcal{X}$, and a plaintext $m$, and outputs a ciphertext $\mathsf{ct}$.

$\mathpzc{Dec}(\mathpzc{usk},x,\mathsf{ct})\rightarrow z$:

The decryption algorithm takes a user secret key $\mathpzc{usk}$, a ciphertext attribute $x$, and a ciphertext $\mathsf{ct}$ and outputs a value $z\in\{\bot\}\cup\{0,1\}^{\ell}$.

$\mathpzc{Vrfy}(\mathsf{vk},\mathpzc{usk}^{\prime})\rightarrow\top/\bot$:

The verification algorithm takes a verification key $\mathsf{vk}$ and a quantum state $\mathpzc{usk}^{\prime}$, and outputs $\top$ or $\bot$.

Decryption correctness:

For every $x\in\mathcal{X}$ and $y\in\mathcal{Y}$ satisfying $R(x,y)=1$, we have

[TABLE]

Verification correctness:

For every $y\in\mathcal{Y}$, we have

[TABLE]

Definition 6.2 (Adaptive Indistinguishability against Key Leasing Attacks).

We say that an ABE-SKL scheme $\mathsf{ABE}\textrm{-}\mathsf{SKL}$ for relation $R:\mathcal{X}\times\mathcal{Y}\to\{0,1\}$ is secure against adaptive indistinguishability against key leasing attacks (Ada-IND-KLA), if it satisfies the following requirement, formalized from the experiment $\mathsf{Exp}_{\mathpzc{A},\mathsf{ABE}\textrm{-}\mathsf{SKL}}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(1^{\lambda},\mathsf{coin})$ between an adversary $\mathpzc{A}$ and a challenger:

At the beginning, the challenger runs $(\mathsf{pk},\mathsf{msk})\leftarrow\mathsf{Setup}(1^{\lambda})$ and initialize the list $L_{\mathtt{\mathpzc{KG}}}$ to be an empty set. Throughout the experiment, $\mathpzc{A}$ can access the following oracles.

$O_{\mathtt{\mathpzc{KG}}}(y)$:

Given $y$, it finds an entry of the form $(y,\mathsf{vk},V)$ from $L_{\mathtt{\mathpzc{KG}}}$. If there is such an entry, it returns $\bot$. Otherwise, it generates $(\mathpzc{usk},\mathsf{vk})\leftarrow\mathpzc{KG}(\mathsf{msk},y)$, sends $\mathpzc{usk}$ to $\mathpzc{A}$, and adds $(y,\mathsf{vk},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$.

$O_{\mathtt{\mathpzc{Vrfy}}}(y,\mathpzc{usk}^{\prime})$:

*Given $(y,\mathpzc{usk}^{\prime})$, it finds an entry $(y,\mathsf{vk},V)$ from $L_{\mathtt{\mathpzc{KG}}}$. (If there is no such entry, it returns $\bot$.) It then runs $d\coloneqq\mathpzc{Vrfy}(\mathsf{vk},\mathpzc{usk}^{\prime})$ and returns $d$ to $\mathpzc{A}$. If $V=\bot$, it updates the entry into $(y,\mathsf{vk},d)$. * 2. 2.

When $\mathpzc{A}$ sends $(x^{*},m_{0},m_{1})$ to the challenger, the challenger checks if for any entry $(y,\mathsf{vk},V)$ in $L_{\mathtt{\mathpzc{KG}}}$ such that $R(x^{*},y)=1$, it holds that $V=\top$. If so, the challenger generates $\mathsf{ct}^{*}\leftarrow\mathsf{Enc}(\mathsf{pk},x^{*},m_{\mathsf{coin}})$ and sends $\mathsf{ct}^{*}$ to $\mathpzc{A}$. Otherwise, the challenger outputs [math]. 3. 3.

$\mathpzc{A}$* continues to make queries to $O_{\mathtt{\mathpzc{KG}}}(\cdot)$ and $O_{\mathtt{\mathpzc{Vrfy}}}(\cdot,\cdot)$. However, $\mathpzc{A}$ is not allowed to send a key attribute $y$ such that $R(x^{*},y)=1$ to $O_{\mathtt{\mathpzc{KG}}}$.* 4. 4.

$\mathpzc{A}$* outputs a guess $\mathsf{coin}^{\prime}$ for $\mathsf{coin}$. The challenger outputs $\mathsf{coin}^{\prime}$ as the final output of the experiment.*

For any QPT $\mathpzc{A}$, it holds that

[TABLE]

Remark 6.3.

In Definition 6.2, the key generation oracle returns $\bot$ if the same $y$ is queried more than once. To handle the situation where multiple keys for the same attribute $y$ are generated, we need to manage indices for $y$ such as $(y,1,vk_{1},V_{1}),(y,2,vk_{2},V_{2})$. Although we can reflect the index management in the definition, it complicates the definition and prevents readers from understanding the essential idea. Thus, we use the simplified definition above.

We also consider relaxed versions of the above security notion.

Definition 6.4 (Selective indistinguishability against key leasing attacks).

We consider selective indistinguishability against key leasing attacks (Sel-IND-KLA). For doing so, we consider the same security game as that for Ada-IND-KLA except that the adversary $\mathpzc{A}$ should declare its target $x^{*}$ at the beginning of the game (even before it is given $\mathsf{pk}$). We then define the advantage $\mathsf{Adv}_{\mathsf{ABE}\textrm{-}\mathsf{SKL},\mathpzc{A}}^{\mathsf{sel}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(\lambda)$ for the selective case similarly. We say $\mathsf{ABE}\textrm{-}\mathsf{SKL}$ is secure against selective indistinguishability against key leasing attack if for any QPT adversary $\mathpzc{A}$, $\mathsf{Adv}_{\mathsf{ABE}\textrm{-}\mathsf{SKL},\mathpzc{A}}^{\mathsf{sel}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(\lambda)$ is negligible.

We also consider the following security notion where we introduce additional restriction that the number of distinguishing keys that are issued (and eventually returned) before $\mathsf{ct}^{*}$ is generated is bounded by some predetermined parameter $q$. Here, distinguishing key refers to a key that can decrypt the challenge ciphertext if it is not returned.

Definition 6.5 (Bounded Distinguishing Key Ada-IND-KLA/Sel-IND-KLA for ABE).

For defining bounded distinguishing key Ada-IND-KLA security, we consider the same security game as that for Ada-IND-KLA (i.e., $\mathsf{Exp}_{\mathpzc{A},\mathsf{ABE}\textrm{-}\mathsf{SKL}}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(1^{\lambda},\mathsf{coin})$) except that we change the step 2 in Definition 6.2 with the following:

• 2’

When $\mathpzc{A}$ sends $(x^{*},m_{0},m_{1})$ to the challenger, the challenger checks if there are at most $q$ entries $(y,\mathsf{vk},V)$ in $L_{\mathtt{\mathpzc{KG}}}$ such that $R(x^{*},y)=1$ and for all these entries, $V=\top$. If so, the challenger generates $\mathsf{ct}^{*}\leftarrow\mathsf{Enc}(\mathsf{pk},x^{*},m_{\mathsf{coin}})$ and sends $\mathsf{ct}^{*}$ to $\mathpzc{A}$. Otherwise, the challenger outputs [math].

We then define the advantage \mathsf{Adv}_{\mathsf{ABE}\textrm{-}\mathsf{SKL},\mathpzc{A},{\color[rgb]{1,0,0}{q}}}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(\lambda) similarly to $\mathsf{Adv}_{\mathsf{ABE}\textrm{-}\mathsf{SKL},\mathpzc{A}}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(\lambda)$. We say $\mathsf{ABE}\textrm{-}\mathsf{SKL}$ is $q$-bounded distinguishing key Ada-IND-KLA secure if for any QPT adversary $\mathpzc{A}$, $\mathsf{Adv}_{\mathsf{ABE}\textrm{-}\mathsf{SKL},\mathpzc{A},q}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(\lambda)$ is negligible. We also define $q$-bounded distinguishing key Sel-IND-KLA security analogously by enforcing the adversary to output its target $x^{*}$ at the beginning of the game.

We emphasize that while the number of distinguishing keys that the adversary can obtain in the game is bounded by a fixed polynomial, the number of non-distinguishing keys (i.e., keys for $y$ with $R(x^{*},y)=0$) can be unbounded.

6.2 1-Bounded Distinguishing Key Construction

We construct an ABE-SKL scheme $\mathsf{1ABE}=(\mathsf{Setup},\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec},\mathpzc{Vrfy})$ for relation $R:\mathcal{X}\times\mathcal{Y}\to\{0,1\}$ with $1$-bounded distinguishing key Ada-IND-KLA/Sel-IND-KLA security whose message space is $\{0,1\}^{\ell}$ by using the following building blocks.

• •

IND-KLA secure PKE-SKL $\mathsf{SKL}.(\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec},\mathpzc{Vrfy})$. Without loss of generality, we assume that $\mathsf{skl}.\mathsf{ek}\in\{0,1\}^{\ell_{\mathsf{ek}}}$ and the randomness space used by $\mathsf{SKL}.\mathsf{Enc}$ is $\{0,1\}^{\ell_{\mathsf{rand}}}$ for some $\ell_{\mathsf{ek}}(\lambda)$ and $\ell_{\mathsf{rand}}(\lambda)$. We also assume that the message space of $\mathsf{SKL}$ is $\{0,1\}^{\ell}$.

• •

Adaptively/Selectively secure ABE $\mathsf{ABE}.(\mathsf{Setup},\mathsf{KG},\mathsf{Enc},\mathsf{Dec})$ for relation $R$ with message space $\{0,1\}^{\lambda}$.

• •

A garbling scheme $\mathsf{GC}=(\mathsf{Grbl},\mathsf{GCEval})$. Without loss of generality, we assume that the labels of $\mathsf{GC}$ are in $\{0,1\}^{\lambda}$.

$\mathsf{Setup}(1^{\lambda})$:

• •

For $i\in[\ell_{\mathsf{ek}}]$ and $b\in\{0,1\}$, run $(\mathsf{abe}.\mathsf{pk}_{i,b},\mathsf{abe}.\mathsf{msk}_{i,b})\leftarrow\mathsf{ABE}.\mathsf{Setup}(1^{\lambda})$.

• •

Output $(\mathsf{pk},\mathsf{msk})\coloneqq(\{\mathsf{abe}.\mathsf{pk}_{i,b}\}_{i\in[\ell_{\mathsf{ek}}],b\in\{0,1\}},\{\mathsf{abe}.\mathsf{msk}_{i,b}\}_{i\in[\ell_{\mathsf{ek}}],b\in\{0,1\}})$.

$\mathpzc{KG}(\mathsf{msk},y)$:

• •

Generate $(\mathsf{skl}.\mathsf{ek},\mathsf{skl}.\mathpzc{dk},\mathsf{skl}.\mathsf{vk})\leftarrow\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$.

• •

Run $\mathsf{abe}.\mathsf{sk}_{i}\leftarrow\mathsf{ABE}.\mathsf{KG}(\mathsf{ABE}.\mathsf{msk}_{i,\mathsf{skl}.\mathsf{ek}[i]},y)$ for $i\in[\ell_{\mathsf{ek}}]$, where $\mathsf{skl}.\mathsf{ek}[i]$ denotes the $i$-th bit of the binary string $\mathsf{skl}.\mathsf{ek}$.

• •

Output $\mathpzc{usk}\coloneqq(\{\mathsf{abe}.\mathsf{sk}_{i}\}_{i\in[\ell_{\mathsf{ek}}]},\mathsf{skl}.\mathsf{ek},\mathsf{skl}.\mathpzc{dk})$ and $\mathsf{vk}\coloneqq\mathsf{skl}.\mathsf{vk}$.

$\mathsf{Enc}(\mathsf{pk},x,m)$:

• •

Choose $\mathsf{R}\leftarrow\{0,1\}^{\ell_{\mathsf{rand}}}$.

• •

Construct circuit $E[m,\mathsf{R}]$, which is a circuit that takes as input an encryption key $\mathsf{skl}.\mathsf{ek}$ of $\mathsf{SKL}$ and outputs $\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek},m;\mathsf{R})$.

• •

Compute $(\{\mathsf{lab}_{i,b}\}_{i\in[\ell_{\mathsf{ek}}],b\in\{0,1\}},\widetilde{E})\leftarrow\mathsf{Grbl}(1^{\lambda},E[m,\mathsf{R}])$.

• •

Run $\mathsf{abe}.\mathsf{ct}_{i,b}\leftarrow\mathsf{ABE}.\mathsf{Enc}(\mathsf{abe}.\mathsf{pk}_{i,b},x,\mathsf{lab}_{i,b})$ for $i\in[\ell_{\mathsf{ek}}]$ and $b\in\{0,1\}$.

• •

Output $\mathsf{ct}\coloneqq(\{\mathsf{abe}.\mathsf{ct}_{i,b}\}_{i\in[\ell_{\mathsf{ek}}],b\in\{0,1\}},\widetilde{E})$.

$\mathpzc{Dec}(\mathpzc{usk},x,\mathsf{ct})$:

• •

Parse $\mathpzc{usk}=(\{\mathsf{abe}.\mathsf{sk}_{i}\}_{i\in[\ell_{\mathsf{ek}}]},\mathsf{skl}.\mathsf{ek},\mathsf{skl}.\mathpzc{dk})$ and $\mathsf{ct}=(\{\mathsf{abe}.\mathsf{ct}_{i,b}\}_{i\in[\ell_{\mathsf{ek}}],b\in\{0,1\}},\widetilde{E})$.

• •

Compute $\mathsf{lab}_{i}\leftarrow\mathsf{ABE}.\mathsf{Dec}(\mathsf{ABE}.\mathsf{sk}_{i},x,\mathsf{abe}.\mathsf{ct}_{i,\mathsf{skl}.\mathsf{ek}[i]})$ for $i\in[\ell_{\mathsf{ek}}]$.

• •

Compute $\mathsf{skl}.\mathsf{ct}=\mathsf{GCEval}(\widetilde{E},\{\mathsf{lab}_{i}\}_{i\in[\ell_{\mathsf{ek}}]})$.

• •

Compute and output $m^{\prime}\leftarrow\mathsf{SKL}.\mathpzc{Dec}(\mathsf{skl}.\mathpzc{dk},\mathsf{skl}.\mathsf{ct})$.

$\mathpzc{Vrfy}(\mathsf{vk},\mathpzc{usk}^{\prime})$:

• •

Parse $\mathsf{vk}=\mathsf{skl}.\mathsf{vk}$ and $\mathpzc{usk}^{\prime}=(\{\mathsf{abe}.\mathsf{sk}_{i}\}_{i\in[\ell_{\mathsf{ek}}]},\mathsf{skl}.\mathsf{ek}^{\prime},\mathsf{skl}.\mathpzc{dk}^{\prime})$.

• •

Compute and output $\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk},\mathsf{skl}.\mathpzc{dk}^{\prime})$.

We show that the scheme satisfies decryption correctness. To see this, we first observe that the decryption algorithm correctly recovers labels of $\widetilde{E}$ corresponding to the input $\mathsf{skl}.\mathsf{ek}$ by the correctness of $\mathsf{ABE}$. Therefore, $\mathsf{skl}.\mathsf{ct}$ recovered by the garbled circuit evaluation equals to $\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek},m;\mathsf{R})$ by the correctness of $\mathsf{GC}$. Then, the message $m$ is recovered in the last step by the correctness of $\mathsf{SKL}$. We can also see that the verification correctness follows from that of $\mathsf{SKL}$.

Theorem 6.6.

If $\mathsf{ABE}$ is adaptively (resp., selectively) secure, $\mathsf{GC}$ is secure, and $\mathsf{SKL}$ is IND-KLA secure, then $\mathsf{1ABE}$ above is $1$-bounded distinguishing key Ada-IND-KLA (resp., Sel-IND-KLA) secure.

Proof of Theorem 6.6.

Here, we first focus on the proof for the case of Ada-IND-KLA and later mention the necessary modifications for the case of Sel-IND-KLA. Let $Q$ be the upper bound on the number of key queries to $O_{\mathtt{\mathpzc{KG}}}$ before the challenge phase. We define a sequence of hybrid games.

$\mathsf{Hyb}_{0}$:

This is the same as $\mathsf{Exp}_{\mathsf{1ABE},\mathpzc{A},1}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(1^{\lambda},0)$. More specifically, it is as follows.

1. 1.

The challenger generates $(\mathsf{abe}.\mathsf{pk}_{i,b},\mathsf{abe}.\mathsf{msk}_{i,b})\leftarrow\mathsf{ABE}.\mathsf{Setup}(1^{\lambda})$ for $i\in[\ell_{\mathsf{ek}}]$ and $b\in\{0,1\}$ and sends $\mathsf{pk}\coloneqq\{\mathsf{abe}.\mathsf{pk}_{i,b}\}_{i,b}$ to the adversary $\mathpzc{A}$. The challenger then initializes the list $L_{\mathtt{\mathpzc{KG}}}$ to be an empty set. $\mathpzc{A}$ can access the following oracles.

$O_{\mathtt{\mathpzc{KG}}}(y^{(j)})$:

Given the $j$-th query $y^{(j)}$ with $j\in[Q]$, if there is an entry of the form $(y^{(j)},\mathsf{vk},V)$, it outputs $\bot$. Otherwise, it generates $(\mathsf{skl}.\mathsf{ek}^{(j)},\mathsf{skl}.\mathpzc{dk}^{(j)},\mathsf{skl}.\mathsf{vk}^{(j)})\leftarrow\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$ and $\mathsf{abe}.\mathsf{sk}^{(j)}_{i}\leftarrow\mathsf{ABE}.\mathsf{KG}(\mathsf{abe}.\mathsf{msk}_{i,\mathsf{skl}.\mathsf{ek}^{(j)}[i]},y^{(j)})$ for $i\in[\ell_{\mathsf{ek}}]$, where $\mathsf{skl}.\mathsf{ek}^{(j)}[i]$ is the $i$-th bit of the binary string $\mathsf{skl}.\mathsf{ek}^{(j)}$. It then sends $\mathpzc{usk}^{(j)}\coloneqq(\{\mathsf{abe}.\mathsf{sk}^{(j)}_{i}\}_{i},\mathsf{skl}.\mathpzc{dk}^{(j)})$ to $\mathpzc{A}$ and adds $(y^{(j)},\mathsf{skl}.\mathsf{vk}^{(j)},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$.

$O_{\mathtt{\mathpzc{Vrfy}}}(y,\mathpzc{usk}^{\prime})$:

Given $(y,\mathpzc{usk}^{\prime})$, it finds an entry $(y,\mathsf{vk},V)$ from $L_{\mathtt{\mathpzc{KG}}}$ and parse $\mathpzc{usk}^{\prime}=(\{\mathsf{abe}.\mathsf{sk}^{\prime}_{i}\}_{i},\mathsf{skl}.\mathpzc{usk}^{\prime})$. (If there is no such entry, it returns $\bot$.) It then parses $\mathsf{vk}=\mathsf{skl}.\mathsf{vk}$ and returns $d\coloneqq\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk},\mathsf{skl}.\mathpzc{dk}^{\prime})$ to $\mathpzc{A}$. It finally updates the entry into $(y,\mathsf{vk},d)$ if $V=\bot$. 2. 2.

When $\mathpzc{A}$ sends $(x^{*},m_{0},m_{1})$ to the challenger, the challenger checks whether there is at most one entry $(y,\mathsf{vk},V)$ in $L_{\mathtt{\mathpzc{KG}}}$ such that $R(x^{*},y)=1$ and for that entry $V=\top$ holds. If so, the challenger generates $(\{\mathsf{lab}_{i,b}\}_{i\in[\ell_{\mathsf{ek}}],b\in\{0,1\}},\widetilde{E})\leftarrow\mathsf{Grbl}(1^{\lambda},E[m_{0},\mathsf{R}])$ and computes $\mathsf{abe}.\mathsf{ct}_{i,b}\leftarrow\mathsf{ABE}.\mathsf{Enc}(\mathsf{abe}.\mathsf{pk}_{i,b},x^{*},\mathsf{lab}_{i,b})$ for $i\in[\ell_{\mathsf{ek}}]$ and $b\in\{0,1\}$. It then sends $\mathsf{ct}^{*}\coloneqq(\{\mathsf{abe}.\mathsf{ct}_{i,b}\}_{i,b},\widetilde{E})$ to $\mathpzc{A}$. Otherwise (i.e., if there are multiple entries with $R(x^{*},y)=1$ or if there is an entry with $R(x^{*},y)=1$ and $V=\bot$), it aborts the game and outputs [math]. 3. 3.

$\mathpzc{A}$ continues to make queries to $O_{\mathtt{\mathpzc{KG}}}(\cdot)$ and $O_{\mathtt{\mathpzc{Vrfy}}}(\cdot,\cdot)$. However, $\mathpzc{A}$ is not allowed to send a key attribute $y$ such that $R(x^{*},y)=1$ to $O_{\mathtt{\mathpzc{KG}}}$. 4. 4.

$\mathpzc{A}$ outputs a guess $\mathsf{coin}^{\prime}$ for $\mathsf{coin}$. The challenger outputs $\mathsf{coin}^{\prime}$ as the final output of the experiment.

$\mathsf{Hyb}_{1}$:

This game is the same as $\mathsf{Hyb}_{0}$ except that the challenger chooses random $\tilde{j}\leftarrow[Q]$ at the beginning of the game. Then, right before it computes the challenge ciphertext, the challenger finds an index $j^{*}\in[Q]$ such that $R(x^{*},y^{(j^{*})})=1$. If there is no such a query, we define $j^{*}\coloneqq 1$.202020Note that if there are multiple indices $j^{*}$ satisfying the above, the challenger aborts and outputs [math] as specified in the previous game. Therefore, there is at most one such $j^{*}$.

The challenger then checks whether $\tilde{j}=j^{*}$. If so, the challenger continues the game until $\mathpzc{A}$ outputs its guess. Otherwise, it aborts the game and outputs [math] as the outcome of the game.

Since the choice of $\tilde{j}$ is independent from the view of $\mathpzc{A}$ and the outcome of the game is $1$ only when $\tilde{j}=j^{*}$, we can easily see that $\Pr[\mathsf{Hyb}_{1}=1]=\Pr[\mathsf{Hyb}_{0}=1]/Q$.

$\mathsf{Hyb}_{2}$:

This game is the same as $\mathsf{Hyb}_{1}$ except for the way $\{\mathsf{abe}.\mathsf{ct}_{i,b}\}_{i,b}$ is generated. Namely, we generate $\mathsf{abe}.\mathsf{ct}_{i,b}$ as $\mathsf{abe}.\mathsf{ct}_{i,b}\leftarrow\mathsf{ABE}.\mathsf{Enc}(\mathsf{abe}.\mathsf{pk}_{i,b},\mathsf{lab}_{i,\mathsf{skl}.\mathsf{ek}^{(j^{*})}[i]})$ for $i\in[\ell_{\mathsf{ek}}]$ and $b\in\{0,1\}$.

We observe that the labels being encrypted are changed only for positions of the form $(i,1\oplus\mathsf{lab}_{i,\mathsf{skl}.\mathsf{ek}^{(j^{*})}[i]})$. The adversary $\mathpzc{A}$ cannot notice the change since it is not given any secret key that can decrypt the ABE ciphertexts for these positions. To check this, recall that there is at most one index $j^{*}$ such that $R(x^{*},y^{(j^{*})})=1$ and for the corresponding key query, the adversary is given ABE secret keys for positions of the form $(i,\mathsf{lab}_{i,\mathsf{skl}.\mathsf{ek}^{(j^{*})}[i]})$, but not for $(i,\mathsf{lab}_{i,1\oplus\mathsf{skl}.\mathsf{ek}^{(j^{*})}[i]})$. Hence, we obtain $\absolutevalue{\Pr[\mathsf{Hyb}_{1}=1]-\Pr[\mathsf{Hyb}_{2}=1]}={\mathsf{negl}}(\lambda)$ by the adaptive security of $\mathsf{ABE}$. See Lemma 6.7 for the detail.

$\mathsf{Hyb}_{3}$:

This game is the same as $\mathsf{Hyb}_{2}$ except for the way $\mathsf{ct}^{*}$ is generated. In particular, to generate $\mathsf{ct}^{*}$, we first run $(\{\mathsf{lab}_{i}\}_{i\in[\ell_{\mathsf{ek}}]},\widetilde{E})\leftarrow\mathsf{Sim.GC}(1^{\lambda},\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}^{(j^{*})},m_{0};\mathsf{R}))$ and then compute $\mathsf{abe}.\mathsf{ct}_{i,b}\leftarrow\mathsf{ABE}.\mathsf{Enc}(\mathsf{abe}.\mathsf{pk}_{i,b},\mathsf{lab}_{i})$ for $i\in[\ell_{\mathsf{ek}}]$ and $b\in\{0,1\}$.

We claim that this game is indistinguishable from the previous one. To see this, it suffices to show that $(\{\mathsf{lab}_{i,\mathsf{skl}.\mathsf{ek}^{(j^{*})}[i]}\}_{i},\widetilde{E})$ computed by $(\{\mathsf{lab}_{i,b}\}_{i,b},\widetilde{E})\leftarrow\mathsf{Grbl}(1^{\lambda},E[m_{0},\mathsf{R}])$ and $(\{\mathsf{lab}_{i}\}_{i\in[\ell_{\mathsf{ek}}]},\widetilde{E})$ computed by $(\{\mathsf{lab}_{i}\}_{i\in[\ell_{\mathsf{ek}}]},\widetilde{E})\leftarrow\mathsf{Sim.GC}(1^{\lambda},\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}^{(j^{*})},m_{0};\mathsf{R}))$ are computationally indistinguishable. This immediately follows from the security of the garbled circuit, since we have

[TABLE]

by the definition of $E$. Hence, we obtain $\absolutevalue{\Pr[\mathsf{Hyb}_{2}=1]-\Pr[\mathsf{Hyb}_{3}=1]}={\mathsf{negl}}(\lambda)$.

$\mathsf{Hyb}_{4}$:

This game is the same as $\mathsf{Hyb}_{3}$ except that the challenger chooses $(\{\mathsf{lab}_{i}\}_{i},\widetilde{E})$ by $(\{\mathsf{lab}_{i}\}_{i\in[\ell_{\mathsf{ek}}]},\widetilde{E})\leftarrow\mathsf{Sim.GC}(1^{\lambda},\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}^{(j^{*})},m_{1};\mathsf{R}))$ instead of $(\{\mathsf{lab}_{i}\}_{i\in[\ell_{\mathsf{ek}}]},\widetilde{E})\leftarrow\mathsf{Sim.GC}(1^{\lambda},\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}^{(j^{*})},m_{0};\mathsf{R}))$.

To show that $\absolutevalue{\Pr[\mathsf{Hyb}_{3}=1]-\Pr[\mathsf{Hyb}_{4}=1]}={\mathsf{negl}}(\lambda)$, it suffices to show that $\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}^{(j^{*})},m_{0};\mathsf{R})$ is indistinguishable from $\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}^{(j^{*})},m_{1};\mathsf{R})$ for $\mathpzc{A}$, if it makes $O_{\mathtt{\mathpzc{Vrfy}}}$ output $\top$ on input $(y^{(j^{*})},\mathpzc{usk}^{\prime})$ for some $\mathpzc{usk}^{\prime}$ before the challenge ciphertext is given to $\mathpzc{A}$. The indistinguishability follows from the security of $\mathsf{SKL}$, since the fact that $\mathpzc{A}$ passes the verification $O_{\mathtt{\mathpzc{Vrfy}}}$ implies that $\mathpzc{A}$ submitted $\mathsf{skl}.\mathpzc{dk}^{\prime}$ such that $\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk}^{(j^{*})},\mathsf{skl}.\mathpzc{dk}^{\prime})=\top$ before it is given the challenge ciphertext and therefore it has no longer the ability to decrypt the ciphertext. To turn this intuition into a formal reduction, we have to embed the public key of $\mathsf{SKL}$ into the answer to the $j^{*}$-th key generation query. Since the reduction algorithm does not know $j^{*}$ until $\mathpzc{A}$ submits $(x^{*},m_{0},m_{1})$, it can only guess it. The change in $\mathsf{Hyb}_{1}$ is introduced in order to incorporate the guess into the game so that the reduction is possible. We refer to Lemma 6.8 for the formal proof for $\absolutevalue{\Pr[\mathsf{Hyb}_{3}=1]-\Pr[\mathsf{Hyb}_{4}=1]}={\mathsf{negl}}(\lambda)$.

$\mathsf{Hyb}_{5}$:

This is the same as $\mathsf{Exp}_{\mathsf{1ABE},\mathpzc{A},1}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(1^{\lambda},1)$.

From the above discussion, we have

[TABLE]

We then observe that $\mathsf{Hyb}_{5}$ (resp., $\mathsf{Hyb}_{4}$) is the same as $\mathsf{Hyb}_{0}$ (resp., $\mathsf{Hyb}_{3}$) except that $m_{1}$ is used for the encryption instead of $m_{0}$. Therefore, we obtain $\absolutevalue{Q\Pr[\mathsf{Hyb}_{4}=1]-\Pr[\mathsf{Hyb}_{5}=1]}\leq{\mathsf{negl}}(\lambda)$ analogously to Eq. (98) by considering similar sequence of the games with $m_{0}$ being replaced by $m_{1}$ in reverse order. We therefore have

[TABLE]

as desired. It remains to prove Lemmata 6.7 and 6.8.

Lemma 6.7.

$\absolutevalue{\Pr[\mathsf{Hyb}_{1}=1]-\Pr[\mathsf{Hyb}_{2}=1]}={\mathsf{negl}}(\lambda)$* if $\mathsf{ABE}$ is adaptively secure.*

Proof.

This can be reduced to the adaptive security of $\mathsf{ABE}$ by a standard hybrid argument where we modify the way of generating $\mathsf{ABE}.\mathsf{ct}_{i,1\oplus\mathsf{skl}.\mathsf{ek}^{(j^{*})}[i]}$ for each $i\in[\ell_{\mathsf{ek}}]$ one by one. More precisely, the reduction works as follows.

We define additional hybrids $\mathsf{Hyb}_{1.k}$ for $k\in[\ell_{\mathsf{ek}}]$ as follows.

$\mathsf{Hyb}_{1.k}$:

This is identical to $\mathsf{Hyb}_{1}$ except that $\mathsf{abe}.\mathsf{ct}_{i,1\oplus\mathsf{skl}.\mathsf{ek}^{(j^{*})}[i]}$ is generated as

[TABLE]

for $i\in[\lambda]$.

Clearly, we have $\mathsf{Hyb}_{1}=\mathsf{Hyb}_{1.1}$ and $\mathsf{Hyb}_{2}=\mathsf{Hyb}_{1.\ell_{\mathsf{ek}}+1}$. Thus, it suffices to prove that $\left|\Pr[\mathsf{Hyb}_{1.k+1}=1]-\Pr[\mathsf{Hyb}_{1.k}=1]\right|={\mathsf{negl}}(\lambda)$ for all $k\in[\ell_{\mathsf{ek}}]$. Remark that the only difference between $\mathsf{Hyb}_{1.k+1}$ and $\mathsf{Hyb}_{1.k}$ is the way of generating $\mathsf{abe}.\mathsf{ct}_{k,1\oplus\mathsf{skl}.\mathsf{ek}^{(j^{*})}[i]}$. To show that $\left|\Pr[\mathsf{Hyb}_{1.k+1}=1]-\Pr[\mathsf{Hyb}_{1.k}=1]\right|={\mathsf{negl}}(\lambda)$, we construct $\mathpzc{B}$ against adaptive security of $\mathsf{ABE}$ as follows.

$\mathpzc{B}(\mathsf{abe}.\mathsf{pk})$:

It works as follows.

1. 1.

It chooses $\tilde{j}\leftarrow[Q]$ and $(\mathsf{skl}.\mathsf{ek}^{(j)},\mathsf{skl}.\mathpzc{dk}^{(j)},\mathsf{skl}.\mathsf{vk}^{(j)})\leftarrow\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$ for $j\in[Q]$. 2. 2.

Generate $(\mathsf{abe}.\mathsf{pk}_{i,b},\mathsf{abe}.\mathsf{msk}_{i,b})\leftarrow\mathsf{ABE}.\mathsf{KG}(1^{\lambda})$ for $(i,b)\in[\ell_{\mathsf{ek}}]\times\{0,1\}\backslash\{(k,1\oplus\mathsf{skl}.\mathsf{ek}^{(\tilde{j})}[k])\}$. Set $\mathsf{abe}.\mathsf{pk}_{k,1\oplus\mathsf{skl}.\mathsf{ek}^{(\tilde{j})}[k]}\coloneqq\mathsf{abe}.\mathsf{pk}$ and send $\mathsf{pk}\coloneqq\{\mathsf{abe}.\mathsf{pk}_{i,b}\}_{i,b}$ to $\mathpzc{A}$. 3. 3.

$\mathpzc{B}$ initializes the list $L_{\mathtt{\mathpzc{KG}}}$ to be an empty set and simulates the following oracles for $\mathpzc{A}$.

$O_{\mathtt{\mathpzc{KG}}}(y^{(j)})$:

Given the $j$-th query $y^{(j)}$ with $j\in[Q]$, if there is an entry of the form $(y^{(j)},\mathsf{vk},V)$, it outputs $\bot$. Otherwise, it generates $\mathsf{abe}.\mathsf{sk}^{(j)}_{i}\leftarrow\mathsf{ABE}.\mathsf{KG}(\mathsf{abe}.\mathsf{msk}_{i,\mathsf{skl}.\mathsf{ek}^{(j)}[i]},y^{(j)})$ for $i\in[\ell_{\mathsf{ek}}]\backslash\{k\}$. To simulate $\mathsf{abe}.\mathsf{sk}^{(j)}_{k}$, $\mathpzc{B}$ preceeds as follows. If $\mathsf{skl}.\mathsf{ek}^{(j)}[k]=1\oplus\mathsf{skl}.\mathsf{ek}^{(\tilde{j})}[k]$, it queries $y^{(j)}$ to its challenger. The challenger runs

[TABLE]

and returns it to $\mathpzc{B}$. $\mathpzc{B}$ then sets $\mathsf{abe}.\mathsf{sk}^{(j)}_{k}\coloneqq\mathsf{abe}.\mathsf{sk}$. Otherwise (i.e., if $\mathsf{skl}.\mathsf{ek}^{(j)}[k]=\mathsf{skl}.\mathsf{ek}^{(\tilde{j})}[k]$), it runs $\mathsf{abe}.\mathsf{sk}^{(j)}_{k}\leftarrow\mathsf{ABE}.\mathsf{KG}(\mathsf{abe}.\mathsf{msk}_{k,\mathsf{skl}.\mathsf{ek}^{(j)}[k]},y^{(j)})$. It then sends $\mathpzc{usk}^{(j)}\coloneqq(\{\mathsf{abe}.\mathsf{sk}^{(j)}_{i}\}_{i},\mathsf{skl}.\mathpzc{dk}^{(j)})$ to $\mathpzc{A}$ and adds $(y^{(j)},\mathsf{skl}.\mathsf{vk}^{(j)},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$.

$O_{\mathtt{\mathpzc{Vrfy}}}(y,\mathpzc{usk}^{\prime})$:

Given $(y,\mathpzc{usk}^{\prime})$, it finds an entry $(y,\mathsf{vk},V)$ from $L_{\mathtt{\mathpzc{KG}}}$ and parse $\mathpzc{usk}^{\prime}=(\{\mathsf{abe}.\mathsf{sk}^{\prime}_{i}\}_{i},\mathsf{skl}.\mathpzc{usk}^{\prime})$. (If there is no such entry, it returns $\bot$.) It then parses $\mathsf{vk}=\mathsf{skl}.\mathsf{vk}$ and returns $d\coloneqq\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk},\mathsf{skl}.\mathpzc{dk}^{\prime})$ to $\mathpzc{A}$. It finally updates the entry into $(y,\mathsf{vk},d)$ if $V=\bot$. 4. 4.

When $\mathpzc{A}$ sends $(x^{*},m_{0},m_{1})$ to the challenger, $\mathpzc{B}$ checks whether there are multiple entries $(y,\mathsf{vk},V)$ in $L_{\mathtt{\mathpzc{KG}}}$ such that $R(x^{*},y)=1$ or there is an entry $(y,\mathsf{vk},V)$ in $L_{\mathtt{\mathpzc{KG}}}$ with $R(x^{*},y)=1$ and $V=\top$. If so, $\mathpzc{B}$ aborts the game and outputs [math] as its guess. Otherwise, $\mathpzc{B}$ defines $j^{*}\in[Q]$ as in $\mathsf{Hyb}_{1}$. It then aborts and outputs [math] if $j^{*}\neq\tilde{j}$. Otherwise, $\mathpzc{B}$ computes $\mathsf{ct}^{*}$ as follows. It first chooses $\mathsf{R}\leftarrow\{0,1\}^{\ell_{\mathsf{rand}}}$ and computes $(\{\mathsf{lab}_{i,b}\}_{i\in[\ell_{\mathsf{ek}}],b\in\{0,1\}},\widetilde{E})\leftarrow\mathsf{Grbl}(1^{\lambda},E[m_{0},\mathsf{R}])$. It then computes $\mathsf{abe}.\mathsf{ct}_{i,b}$ for $(i,b)\in[\ell_{\mathsf{ek}}]\times\{0,1\}\backslash\{(k,1\oplus\mathsf{skl}.\mathsf{ek}^{(j^{*})}[k])\}$ as in Equation 99. $\mathpzc{B}$ then submits $(\mathsf{lab}_{k,\mathsf{skl}.\mathsf{ek}^{(j^{*})}[k]},\mathsf{lab}_{k,1\oplus\mathsf{skl}.\mathsf{ek}^{(j^{*})}[k]})$ to its challenger. Then, the challenger runs

[TABLE]

and gives $\mathsf{abe}.\mathsf{ct}$ to $\mathpzc{B}$, where $\overline{\mathsf{coin}}\in\{0,1\}$ is the coin chosen by the challenger. Then, $\mathpzc{B}$ sets $\mathsf{abe}.\mathsf{ct}_{k,1\oplus\mathsf{skl}.\mathsf{ek}^{(j^{*})}[k]}\coloneqq\mathsf{abe}.\mathsf{ct}$ and gives $\mathsf{ct}^{*}\coloneqq(\{\mathsf{abe}.\mathsf{ct}_{i,b}\}_{i,b},\widetilde{E})$ to $\mathpzc{A}$. 5. 5.

$\mathpzc{A}$ then continues to make queries to $O_{\mathtt{\mathpzc{KG}}}(\cdot)$ and $O_{\mathtt{\mathpzc{Vrfy}}}(\cdot,\cdot)$. $\mathpzc{B}$ answers the queries in the same manner as before the challenge query. 6. 6.

$\mathpzc{A}$ finally outputs its guess. $\mathpzc{B}$ outputs the same bit as its guess.

We first argue that $\mathpzc{B}$ does not make any prohibited key query. To see this, we first observe that for every key query $y$ that $\mathpzc{B}$ makes, there exists $j$ such that $y=y^{(j)}$. We then observe that $R(x^{*},y^{(j)})=0$ for $j\neq j^{*}$ and $\mathpzc{B}$ does not make a key query for $y^{(j^{*})}$ in the above simulation.

We have

[TABLE]

where the probabilities are taken over the randomness used in the respective games. Thus, $\left|\Pr[\mathsf{Hyb}_{1.k+1}=1]-\Pr[\mathsf{Hyb}_{1.k}=1]\right|={\mathsf{negl}}(\lambda)$ by the adaptive security of $\mathsf{ABE}$. This completes the proof of Lemma 6.7.

∎

Lemma 6.8.

$\absolutevalue{\Pr[\mathsf{Hyb}_{3}=1]-\Pr[\mathsf{Hyb}_{4}=1]}={\mathsf{negl}}(\lambda)$* if $\mathsf{SKL}$ is IND-KLA secure.*

Proof.

This can be reduced to the IND-KLA security security of $\mathsf{SKL}$. To do so, we construct an adversary $\mathpzc{B}$ against IND-KLA security of the scheme with advantage $\absolutevalue{\Pr[\mathsf{Hyb}_{3}=1]-\Pr[\mathsf{Hyb}_{4}=1]}$ as follows.

$\mathpzc{B}(\mathsf{skl}.\mathsf{ek},\mathsf{skl}.\mathpzc{dk})$:

It works as follows.

1. 1.

It chooses $\tilde{j}\leftarrow[Q]$ and $(\mathsf{skl}.\mathsf{ek}^{(j)},\mathsf{skl}.\mathpzc{dk}^{(j)},\mathsf{skl}.\mathsf{vk}^{(j)})\leftarrow\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$ for $j\in[Q]\backslash\{\tilde{j}\}$. It then sets $(\mathsf{skl}.\mathsf{ek}^{(\tilde{j})},\mathsf{skl}.\mathpzc{dk}^{(\tilde{j})})\coloneqq(\mathsf{skl}.\mathsf{ek},\mathsf{skl}.\mathpzc{dk})$. It then generates $(\mathsf{abe}.\mathsf{pk}_{i,b},\mathsf{abe}.\mathsf{msk}_{i,b})\leftarrow\mathsf{ABE}.\mathsf{Setup}(1^{\lambda})$ for $i\in[\ell_{\mathsf{ek}}]$ and $b\in\{0,1\}$ and sends $\mathsf{pk}\coloneqq\{\mathsf{abe}.\mathsf{pk}_{i,b}\}_{i,b}$ to the adversary $\mathpzc{A}$. 2. 2.

$\mathpzc{B}$ initializes the list $L_{\mathtt{\mathpzc{KG}}}$ to be an empty set and simulates the following oracles for $\mathpzc{A}$.

$O_{\mathtt{\mathpzc{KG}}}(y^{(j)})$:

Given the $j$-th query $y^{(j)}$ with $j\in[Q]$, if there is an entry of the form $(y^{(j)},\mathsf{vk},V)$, it outputs $\bot$. Otherwise, it generates $\mathsf{abe}.\mathsf{sk}^{(j)}_{i}\leftarrow\mathsf{ABE}.\mathsf{KG}(\mathsf{abe}.\mathsf{msk}_{i,\mathsf{skl}.\mathsf{ek}^{(j)}[i]},y^{(j)})$ for $i\in[\ell_{\mathsf{ek}}]$. It then returns $\mathpzc{usk}^{(j)}\coloneqq(\{\mathsf{abe}.\mathsf{sk}^{(j)}_{i}\}_{i},\mathsf{skl}.\mathpzc{dk}^{(j)})$ to $\mathpzc{A}$ and adds $(y^{(j)},\mathsf{skl}.\mathsf{vk}^{(j)},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$.

$O_{\mathtt{\mathpzc{Vrfy}}}(y,\mathpzc{usk}^{\prime})$:

Given $(y,\mathpzc{usk}^{\prime})$, it finds an entry $(y,\mathsf{vk},V)$ from $L_{\mathtt{\mathpzc{KG}}}$ and parses $\mathpzc{usk}^{\prime}=(\{\mathsf{abe}.\mathsf{sk}^{\prime}_{i}\}_{i},\mathsf{skl}.\mathpzc{dk}^{\prime})$. (If there is no such entry, it returns $\bot$.) If $y=y^{(j)}$ for $j\neq\tilde{j}$, $\mathpzc{B}$ returns $d\coloneqq\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk}^{(j)},\mathsf{skl}.\mathpzc{dk}^{\prime})$ to $\mathpzc{A}$. Otherwise (i.e., if $y=y^{(\tilde{j})}$), $\mathpzc{B}$ submits $\mathsf{skl}.\mathpzc{dk}^{\prime}$ to its verification oracle. Then,

[TABLE]

is computed and returned to $\mathpzc{B}$. $\mathpzc{B}$ then returns $d$ to $\mathpzc{A}$. It finally updates the entry into $(y,\mathsf{vk},d)$ if $V=\bot$. 3. 3.

When $\mathpzc{A}$ sends $(x^{*},m_{0},m_{1})$ to the challenger, $\mathpzc{B}$ checks whether there are multiple entries $(y,\mathsf{vk},V)$ in $L_{\mathtt{\mathpzc{KG}}}$ such that $R(x^{*},y)=1$ or there is an entry $(y,\mathsf{vk},V)$ in $L_{\mathtt{\mathpzc{KG}}}$ with $R(x^{*},y)=1$ and $V=\top$. If so, $\mathpzc{B}$ aborts the game and outputs [math] as its guess. Otherwise, $\mathpzc{B}$ defines $j^{*}\in[Q]$ as in $\mathsf{Hyb}_{1}$. It then aborts and outputs [math] if $j^{*}\neq\tilde{j}$. Otherwise, $\mathpzc{B}$ computes $\mathsf{ct}^{*}$ as follows. It first submits $(m_{0},m_{1})$ to its challenger. Then, the challenger runs

[TABLE]

and returns it to $\mathpzc{B}$, where $\overline{\mathsf{coin}}\in\{0,1\}$ is the coin chosen by the challenger. $\mathpzc{B}$ then runs $(\{\mathsf{lab}_{i}\}_{i\in[\ell_{\mathsf{ek}}]},\widetilde{E})\leftarrow\mathsf{Sim.GC}(1^{\lambda},\mathsf{skl}.\mathsf{ct})$ and computes $\mathsf{abe}.\mathsf{ct}_{i,b}\leftarrow\mathsf{ABE}.\mathsf{Enc}(\mathsf{abe}.\mathsf{pk}_{i,b},\mathsf{lab}_{i})$ for $i\in[\ell_{\mathsf{ek}}]$ and $b\in\{0,1\}$. Then, $\mathpzc{B}$ sets $\mathsf{ct}^{*}\coloneqq(\{\mathsf{abe}.\mathsf{ct}_{i,b}\}_{i,b},\widetilde{E})$ and gives it to $\mathpzc{A}$. 4. 4.

$\mathpzc{A}$ then continues to make queries to $O_{\mathtt{\mathpzc{KG}}}(\cdot)$ and $O_{\mathtt{\mathpzc{Vrfy}}}(\cdot,\cdot)$. $\mathpzc{B}$ answers the queries in the same manner as before the challenge query. 5. 5.

$\mathpzc{A}$ finally outputs its guess. $\mathpzc{B}$ outputs the same bit as its guess.

We then have

[TABLE]

where the probabilities are taken over the randomness used in the respective games. Thus, $\left|\Pr[\mathsf{Hyb}_{3}=1]-\Pr[\mathsf{Hyb}_{4}=1]\right|={\mathsf{negl}}(\lambda)$ by the security of $\mathsf{SKL}$. This completes the proof of Lemma 6.8. ∎

This completes the proof of Theorem 6.6 for the case of adaptive security.

The proof for selective security.

The statement for selective security can be obtained immediately by considering the same sequence of games as adaptive security case with natural adaptations. In particular, we modify the reduction algorithm in Lemma 6.7 so that it outputs $x^{*}$ at the beginning of the game right after given $x^{*}$ from $\mathpzc{A}$.

An alternative option is to consider a simpler proof that is tailored to selective setting. This is possible because the proof obtained by adapting the adaptive setting to the selective setting includes a redundant step. In particular, we consider a sequence of games without $\mathsf{Hyb}_{1}$. The reason why $\mathsf{Hyb}_{1}$ is not necessary is that in the selective setting, the reduction algorithm obtains $x^{*}$ at the beginning of the game and can use this information throughout the game. In particular, whenever $\mathpzc{A}$ makes a key query $y^{(j)}$, the reduction algorithm can check whether $j^{*}=j$ holds or not by computing the value of $R(x^{*},y^{(j)})$ and there is no need to guess it. By introducing this change, we can improve the reduction cost to be independent of $Q$. ∎

6.3 $Q$-Bounded Distinguishing Key Construction

We construct an ABE-SKL scheme $\mathsf{qABE}=(\mathsf{Setup},\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec},\mathpzc{Vrfy})$ for relation $R:\mathcal{X}\times\mathcal{Y}\to\{0,1\}$ with $q$-bounded distinguishing key Ada-IND-KLA (resp., Sel-IND-KLA) security from an ABE-SKL scheme $\mathsf{1ABE}=\mathsf{1ABE}.(\mathsf{Setup},\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec},\mathpzc{Vrfy})$ for the same relation $R$ with $1$-bounded distinguishing key Ada-IND-KLA (resp., Sel-IND-KLA) security. We note that the construction here is essentially the same as [ISV*+*17], which converts a single collusion secure ABE scheme into a $q$-bounded collusion secure ABE. However, our proof is more complex reflecting the fact that the adversary is allowed to make unbounded number of key queries (though the number of distinguishing keys is bounded).

The following construction uses parameters $v\coloneqq v(\lambda)$ and $w\coloneqq w(\lambda)$. We will set the parameters in Theorem 6.9.

$\mathsf{Setup}(1^{\lambda})$:

• •

For $i\in[v]$ and $j\in[w]$, run $(\mathsf{1abe}.\mathsf{pk}_{i,j},\mathsf{1abe}.\mathsf{msk}_{i,j})\leftarrow\mathsf{1ABE}.\mathsf{Setup}(1^{\lambda})$.

• •

Output $(\mathsf{pk},\mathsf{msk})\coloneqq(\{\mathsf{1abe}.\mathsf{pk}_{i,j}\}_{i\in[v],j\in[w]},\{\mathsf{1abe}.\mathsf{msk}_{i,j}\}_{i\in[v],j\in[w]})$.

$\mathpzc{KG}(\mathsf{msk},y)$:

• •

For $i\in[v]$, choose $j_{i}\leftarrow[w]$.

• •

Run $(\mathsf{1abe}.\mathsf{vk}_{i},\mathsf{1abe}.\mathpzc{usk}_{i})\leftarrow\mathsf{1ABE}.\mathpzc{KG}(\mathsf{1abe}.\mathsf{msk}_{i,j_{i}},y)$ for $i\in[v]$.

• •

Output $\mathpzc{usk}\coloneqq\{j_{i},\mathsf{1abe}.\mathpzc{usk}_{i}\}_{i\in[v]}$ and $\mathsf{vk}\coloneqq\{\mathsf{1abe}.\mathsf{vk}_{i}\}_{i\in[v]}$.

$\mathsf{Enc}(\mathsf{pk},x,m)$:

• •

Choose $\mu_{1},\ldots,\mu_{v-1}\leftarrow\{0,1\}^{\ell}$ and set $\mu_{v}\coloneqq(\oplus_{i\in[v-1]}\mu_{i})\oplus m$, where $\oplus$ denotes bit-wise XOR here.

• •

Run $\mathsf{1abe}.\mathsf{ct}_{i,j}\leftarrow\mathsf{1ABE}.\mathsf{Enc}(\mathsf{1abe}.\mathsf{pk}_{i,j},x,\mu_{i})$ for $i\in[v]$ and $j\in[w]$.

• •

Output $\mathsf{ct}\coloneqq\{\mathsf{1abe}.\mathsf{ct}_{i,j}\}_{i\in[v],j\in[w]}$.

$\mathpzc{Dec}(\mathpzc{usk},x,\mathsf{ct})$:

• •

Parse $\mathpzc{usk}\coloneqq\{j_{i},\mathsf{1abe}.\mathpzc{usk}_{i}\}_{i\in[v]}$ and $\mathsf{ct}\coloneqq\{\mathsf{1abe}.\mathsf{ct}_{i,j}\}_{i\in[v],j\in[w]}$.

• •

Compute $\mu^{\prime}_{i}\leftarrow\mathsf{1ABE}.\mathsf{Dec}(\mathsf{1abe}.\mathpzc{usk}_{i},x,\mathsf{1abe}.\mathsf{ct}_{i,j_{i}})$ for $i\in[v]$.

• •

Compute and output $m^{\prime}\coloneqq\oplus_{i\in[v]}\mu^{\prime}_{i}$.

$\mathpzc{Vrfy}(\mathsf{vk},\mathpzc{usk}^{\prime})$:

• •

Parse $\mathsf{vk}=\{\mathsf{1abe}.\mathsf{vk}_{i}\}_{i\in[v]}$ and $\mathpzc{usk}^{\prime}\coloneqq\{j_{i},\mathsf{1abe}.\mathpzc{usk}^{\prime}_{i}\}_{i\in[v]}$.

• •

Compute $d_{i}\leftarrow\mathsf{1ABE}.\mathpzc{Vrfy}(\mathsf{1abe}.\mathsf{vk}_{i},\mathsf{1abe}.\mathpzc{usk}^{\prime}_{i})$ for $i\in[v]$.

• •

If $d_{i}=\top$ for all $i\in[v]$, output $\top$. Otherwise, output $\bot$.

It is straightforward to see that the decryption correctness and the verification correctness of the above scheme follow from those of $\mathsf{1ABE}$.

Theorem 6.9.

Assuming $\mathsf{1ABE}$ is $1$-bounded distinguishing key Ada-IND-KLA (resp., Sel-IND-KLA) secure, $\mathsf{qABE}$ is $q$-bounded distinguishing key Ada-IND-KLA (resp., Sel-IND-KLA) secure if we set the parameters as follows:

• •

For the adaptive case, we assume that the size of the ciphertext attribute space $|\mathcal{X}_{\lambda}|$ is bounded by $2^{n(\lambda)}$ for some polynomial function $n(\lambda)$. We then set $v=2(\lambda+n)$ and $w=q^{2}$.

• •

For the selective case, we set $v=\lambda$ and $w=q^{2}$.

Proof of Theorem 6.9.

Here, we first focus on the proof for the case of $q$-bounded distinguishing key Ada-IND-KLA and later mention the difference for the case of $q$-bounded distinguishing key Sel-IND-KLA. We define a sequence of hybrid games.

$\mathsf{Hyb}_{0}$:

This is the same as $\mathsf{Exp}_{\mathsf{qABE},\mathpzc{A},q}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(1^{\lambda},0)$. More specifically, it is as follows.

1. 1.

The challenger generates $(\mathsf{1abe}.\mathsf{pk}_{i,j},\mathsf{1abe}.\mathsf{msk}_{i,j})\leftarrow\mathsf{1ABE}.\mathsf{Setup}(1^{\lambda})$ for $i\in[v]$ and $j\in[w]$ and sends $\mathsf{pk}\coloneqq\{\mathsf{1abe}.\mathsf{pk}_{i,j}\}_{i,j}$ to the adversary $\mathpzc{A}$. The challenger then initializes the list $L_{\mathtt{\mathpzc{KG}}}$ to be an empty set. $\mathpzc{A}$ can access the following oracles.

$O_{\mathtt{\mathpzc{KG}}}(y^{(k)})$:

Given the $k$-th query $y^{(k)}$ with $k\in[Q]$, if there is an entry of the form $(y^{(k)},\mathsf{vk},V)$, it outputs $\bot$. Otherwise, it chooses $j_{i}^{(k)}\leftarrow[w]$ for $i\in[v]$ and runs $(\mathsf{1abe}.\mathsf{vk}_{i}^{(k)},\mathsf{1abe}.\mathpzc{usk}_{i}^{(k)})\leftarrow\mathsf{1ABE}.\mathpzc{KG}(\mathsf{1abe}.\mathsf{msk}_{i,j_{i}},y^{(k)})$ for $i\in[v]$. It then returns $\mathpzc{usk}^{(k)}\coloneqq\{j_{i}^{(k)},\mathsf{1abe}.\mathpzc{usk}_{i}^{(k)}\}_{i\in[v]}$ and $\mathsf{vk}^{(k)}\coloneqq\{\mathsf{1abe}.\mathsf{vk}_{i}^{(k)}\}_{i\in[v]}$ to $\mathpzc{A}$ and adds $(y^{(k)},\mathsf{vk}^{(k)},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$.

$O_{\mathtt{\mathpzc{Vrfy}}}(y,\mathpzc{usk}^{\prime})$:

Given $(y,\mathpzc{usk}^{\prime})$, it finds an entry $(y,\mathsf{vk},V)$ from $L_{\mathtt{\mathpzc{KG}}}$ and parses $\mathpzc{usk}^{\prime}=\{j_{i},\mathpzc{usk}_{i}^{\prime}\}_{i}$. (If there is no such entry, it returns $\bot$.) It then computes $d_{i}\coloneqq\mathsf{1ABE}.\mathpzc{Vrfy}(\mathsf{1abe}.\mathsf{vk}_{i},\mathpzc{usk}^{\prime}_{i})$ for $i\in[v]$ and checks if $d_{i}=\top$ for all $i\in[v]$. If so, it returns $d\coloneqq\top$ to $\mathpzc{A}$. Otherwise, it returns $d\coloneqq\bot$ to $\mathpzc{A}$. It finally updates the entry into $(y,\mathsf{vk},d)$ if $V=\bot$. 2. 2.

When $\mathpzc{A}$ sends $(x^{*},m_{0},m_{1})$ to the challenger, the challenger computes the set $K_{x^{*}}\coloneqq\{k\in[Q_{1}]:R(x^{*},y^{(k)})=1\}$, where $Q_{1}\leq Q$ is the number of key queries made by $\mathpzc{A}$ so far. If we have $V=\top$ for all entries of the form $(y^{(k)},\mathsf{vk},V)$ in $L_{\mathtt{\mathpzc{KG}}}$ with $k\in K_{x^{*}}$ and $|K_{x^{*}}|\leq q$, the challenger chooses $\mu_{1},\ldots,\mu_{v-1}\leftarrow\{0,1\}^{\ell}$, sets $\mu_{v}\coloneqq(\oplus_{i\in[v-1]}\mu_{i})\oplus m_{0}$, and computes $\mathsf{1abe}.\mathsf{ct}_{i,j}\leftarrow\mathsf{1ABE}.\mathsf{Enc}(\mathsf{1abe}.\mathsf{pk}_{i,j},x^{*},\mu_{i})$ for $i\in[v]$ and $j\in[w]$. It then sends $\mathsf{ct}^{*}\coloneqq\{\mathsf{1abe}.\mathsf{ct}_{i,j}\}_{i,j}$ to $\mathpzc{A}$. Otherwise (i.e., if $|K_{x^{*}}|>q$ or if there is an entry of the form $(y^{(k)},\mathsf{vk},\bot)$ for some $k\in K_{x^{*}}$), it aborts the game and outputs [math]. 3. 3.

$\mathpzc{A}$ continues to make queries to $O_{\mathtt{\mathpzc{KG}}}(\cdot)$ and $O_{\mathtt{\mathpzc{Vrfy}}}(\cdot,\cdot)$. However, $\mathpzc{A}$ is not allowed to send a key attribute $y$ such that $R(x^{*},y)=1$ to $O_{\mathtt{\mathpzc{KG}}}$. 4. 4.

$\mathpzc{A}$ outputs a guess $\mathsf{coin}^{\prime}$ for $\mathsf{coin}$. The challenger outputs $\mathsf{coin}^{\prime}$ as the final output of the experiment.

$\mathsf{Hyb}_{1}$:

This game is the same as $\mathsf{Hyb}_{0}$ except for the way $\mathsf{ct}^{*}$ is generated. In particular, when $\mathpzc{A}$ submits $(x^{*},m_{0},m_{1})$, the challenger aborts the game and outputs [math] as the outcome of the game if there is no $i^{*}$ such that $\{j_{i^{*}}^{(k)}\}_{k\in K_{x^{*}}}$ are all distinct. Otherwise, the challenger continues the game as specified in $\mathsf{Hyb}_{0}$ .

We observe that unless there is no such $i^{*}$, the game is the same as the previous one. We bound the probability of this occuring. Let us first consider the case where $\mathpzc{A}$ fixes its target $x^{*}$ at the beginning of the game (i.e., selective security setting). In this case, by simple probability calculation, we can show that the probability that $i^{*}$ does not exist is exponentially small in the parameter $v$. However, in the adaptive case, the adversary can adaptively choose $x^{*}$ dependent on the values of $\{j_{i}^{(k)}\}_{i\in[v],k\in[Q]}$ and the proof for the selective case no longer works. To deal with the added flexibility given to the adversary, we use the union bound over all $x\in\mathcal{X}$ and then use the above bound for each fixed $x$. This requires the parameter $v$ to grow dependent on the size of $\log|\mathcal{X}_{\lambda}|$ so that the sum of the probabilities is still small enough even after taking the union bound. Based on the above discussion, we can prove $\absolutevalue{\Pr[\mathsf{Hyb}_{0}=1]-\Pr[\mathsf{Hyb}_{1}=1]}={\mathsf{negl}}(\lambda)$. We refer to Lemma 6.10 for the detail.

$\mathsf{Hyb}_{2}$:

This game is the same as $\mathsf{Hyb}_{1}$ except that the challenger chooses random $\tilde{i}\leftarrow[v]$ at the beginning of the game. Then, right before the challenger computes $\mathsf{ct}^{*}$, it checks whether $\tilde{i}=i^{*}$, where $i^{*}$ is the smallest index such that $\{j_{i^{*}}^{(k)}\}_{k\in K_{x^{*}}}$ are all distinct. 212121Note that $i^{*}$ is not defined until $\mathpzc{A}$ chooses $x^{*}$. If so, the challenger continues the game until $\mathpzc{A}$ outputs its guess. Otherwise, it aborts the game and outputs [math] as the outcome of the game.

Since the choice of $\tilde{i}$ is independent from the view of $\mathpzc{A}$ and the outcome of the game is $1$ only when $\tilde{i}=i^{*}$, we can easily see that $\Pr[\mathsf{Hyb}_{2}=1]=\Pr[\mathsf{Hyb}_{1}=1]/v$.

$\mathsf{Hyb}_{3}$:

This is the same as $\mathsf{Hyb}_{2}$ except for how $\mu_{1},\ldots,\mu_{v}$ are generated. In particular, $\mathpzc{A}$ first chooses $\mu_{1},\ldots,\mu_{v}\leftarrow\{0,1\}^{\ell}$ and discards $\mu_{i^{*}}$. It then sets $\mu_{i^{*}}\coloneqq(\oplus_{i\in[v]\backslash\{i^{*}\}})\oplus m_{0}$. It can be easily seen that the distribution of $\mu_{1},\ldots,\mu_{v}$ is unchanged from the previous game and thus we have $\Pr[\mathsf{Hyb}_{2}=1]=\Pr[\mathsf{Hyb}_{3}=1]$.

$\mathsf{Hyb}_{4}$:

This is the same as $\mathsf{Hyb}_{3}$ except that $\mu_{i^{*}}$ is set as $\mu_{i^{*}}\coloneqq(\oplus_{i\in[v]\backslash\{i^{*}\}}\mu_{i})\oplus m_{1}$.

We claim that this change is not noticed by $\mathpzc{A}$ by the security of the underlying $\mathsf{1ABE}$. To show this, we first observe that the game differs from the previous one only in how $\{\mathsf{1abe}.\mathsf{ct}_{i^{*},j}\}_{j\in[w]}$ are generated. We then change each plaintext encrypted in $\{\mathsf{1abe}.\mathsf{ct}_{i^{*},j}\}_{j}$ one by one by using the security of the underlying $\mathsf{1ABE}$. This is possible since for each $\mathsf{1ABE}$ instance with index $(i^{*},j)$, $\mathpzc{A}$ is given only at most one distinguishing key by the change we introduced in $\mathsf{Hyb}_{1}$ and thus we can use the security of $\mathsf{1ABE}$ for such instances. We therefore have $\absolutevalue{\Pr[\mathsf{Hyb}_{3}=1]-\Pr[\mathsf{Hyb}_{4}=1]}={\mathsf{negl}}(\lambda)$. We refer to Lemma 6.11 for the detail.

$\mathsf{Hyb}_{5}$:

This is the same as $\mathsf{Exp}_{\mathsf{qABE},\mathpzc{A},q}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(1^{\lambda},1)$.

From the above discussion, we have

[TABLE]

We then observe that $\mathsf{Hyb}_{5}$ (resp., $\mathsf{Hyb}_{4}$) is the same as $\mathsf{Hyb}_{0}$ (resp., $\mathsf{Hyb}_{3}$) except that $m_{1}$ is used for the encryption instead of $m_{0}$. Therefore, we obtain $\absolutevalue{v\Pr[\mathsf{Hyb}_{4}=1]-\Pr[\mathsf{Hyb}_{5}=1]}\leq{\mathsf{negl}}(\lambda)$ analogously to Eq. (105) by considering similar sequence of games with $m_{0}$ being replaced by $m_{1}$ in a reverse order. We therefore have

[TABLE]

as desired. It remains to prove Lemmata 6.10 and 6.11.

Lemma 6.10.

$\absolutevalue{\Pr[\mathsf{Hyb}_{0}=1]-\Pr[\mathsf{Hyb}_{1}=1]}={\mathsf{negl}}(\lambda)$* holds both for selective and adaptive settings.*

Proof.

We first show the statement for the selective case. The proof for this case is the same as [ISV*+*17, Lemma 1], but we provide the proof here for completeness. In the selective case, the probability that $\{j_{i}^{(k)}\}_{k\in K_{x^{*}}}$ are not all distinct for some fixed $i$ is

[TABLE]

Therefore, the probability that there is no $i^{*}$ satisfying the requirement is at most

[TABLE]

which is negligible when $v=\lambda$ and $w=q^{2}$ since

[TABLE]

We then consider the adaptive case. We have

[TABLE]

where the probabilities are taken over all randomness used in the game. In the above, third line follows from the same analysis as the selective case and the forth and the fifth lines follow from our parameter setting. ∎

Lemma 6.11.

If $\mathsf{1ABE}$ is $1$-bounded distinguishing key Ada-IND-KLA, $\absolutevalue{\Pr[\mathsf{Hyb}_{3}=1]-\Pr[\mathsf{Hyb}_{4}=1]}={\mathsf{negl}}(\lambda)$.

Proof.

This can be reduced to the $1$-bounded distinguishing key Ada-IND-KLA security of $\mathsf{1ABE}$ by a standard hybrid argument, where we modify the plaintext encrypted in $\mathsf{1abe}.\mathsf{ct}_{i^{*},j}$ for each $j\in[w]$ one by one. More precisely, the reduction works as follows.

We define additional hybrids $\mathsf{Hyb}_{3.k}$ for $k\in[w]$ as follows. In the following, let $\xi_{b}\coloneqq(\oplus_{i\in[v]\backslash\{i^{*}\}}\mu_{i})\oplus m_{b}$ for $b\in\{0,1\}$.

$\mathsf{Hyb}_{3.\tau}$:

This is identical to $\mathsf{Hyb}_{3}$ except that $\mathsf{1abe}.\mathsf{ct}_{i^{*},j}$ is generated as

[TABLE]

for $j\in[\lambda]$.

Clearly, we have $\mathsf{Hyb}_{3}=\mathsf{Hyb}_{3.1}$ and $\mathsf{Hyb}_{4}=\mathsf{Hyb}_{3.w+1}$. Thus, it suffices to prove that $\left|\Pr[\mathsf{Hyb}_{3.\tau+1}=1]-\Pr[\mathsf{Hyb}_{3.\tau}=1]\right|={\mathsf{negl}}(\lambda)$ for all $\tau\in[w]$. Remark that the only difference between $\mathsf{Hyb}_{3.\tau+1}$ and $\mathsf{Hyb}_{3.\tau}$ is the way of generating $\mathsf{1abe}.\mathsf{ct}_{i^{*},\tau}$. To show that $\left|\Pr[\mathsf{Hyb}_{3.\tau+1}=1]-\Pr[\mathsf{Hyb}_{3.\tau}=1]\right|={\mathsf{negl}}(\lambda)$, we construct $\mathpzc{B}$ against the security of $\mathsf{1ABE}$ as follows.

$\mathpzc{B}(\mathsf{1abe}.\mathsf{pk})$:

It works as follows.

1. 1.

It first chooses random $\tilde{i}\leftarrow[v]$. 2. 2.

The challenger generates $(\mathsf{1abe}.\mathsf{pk}_{i,j},\mathsf{1abe}.\mathsf{msk}_{i,j})\leftarrow\mathsf{1ABE}.\mathsf{Setup}(1^{\lambda})$ for $(i,j)\in([v]\times[w])\backslash\{(\tilde{i},k)\}$. It then sets $\mathsf{1abe}.\mathsf{pk}_{\tilde{i},k}\coloneqq\mathsf{1abe}.\mathsf{pk}$ and sends $\mathsf{pk}\coloneqq\{\mathsf{1abe}.\mathsf{pk}_{i,j}\}_{i,j}$ to the adversary $\mathpzc{A}$. It then initializes the list $L_{\mathtt{\mathpzc{KG}}}$ to be an empty set. $\mathpzc{B}$ then simulates the following oracles for $\mathpzc{A}$.

$O_{\mathtt{\mathpzc{KG}}}(y^{(k)})$:

Given the $k$-th query $y^{(k)}$ with $k\in[Q]$ from $\mathpzc{A}$, $\mathpzc{B}$ returns $\bot$ to $\mathpzc{A}$ if there is an entry of the form $(y^{(k)},\mathsf{vk},V)$. Otherwise, it chooses $j_{i}^{(k)}\leftarrow[w]$ for $i\in[v]$ and runs $(\mathsf{1abe}.\mathsf{vk}_{i}^{(k)},\mathsf{1abe}.\mathpzc{usk}_{i}^{(k)})\leftarrow\mathsf{1ABE}.\mathpzc{KG}(\mathsf{1ABE}.\mathsf{msk}_{i,j_{i}},y^{(k)})$ for $i\in[v]\backslash\{\tilde{i}\}$. If $j_{\tilde{i}}^{(k)}=\tau$, it sends $y^{(k)}$ to its key generation oracle and is given

[TABLE]

Then, it sets $\mathsf{1abe}.\mathpzc{usk}^{(k)}_{\tilde{i}}\coloneqq\mathsf{1abe}.\mathpzc{usk}$. Otherwise (i.e., if $j_{\tilde{i}}^{(k)}\neq\tau$), it runs $(\mathsf{1abe}.\mathsf{vk}_{\tilde{i}}^{(k)},\mathsf{1abe}.\mathpzc{usk}_{\tilde{i}}^{(k)})\leftarrow\mathsf{ABE}.\mathpzc{KG}(\mathsf{1ABE}.\mathsf{msk}_{{\tilde{i}},j_{\tilde{i}}},y^{(k)})$ by itself. Finally, $\mathpzc{B}$ returns $\mathpzc{usk}^{(k)}\coloneqq\{j_{i}^{(k)},\mathsf{1abe}.\mathpzc{usk}_{i}^{(k)}\}_{i\in[v]}$ to $\mathpzc{A}$ and adds $(y^{(k)},\mathsf{vk}^{(k)},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$, where $\mathsf{vk}^{(k)}\coloneqq\{\mathsf{1abe}.\mathsf{vk}_{i}^{(k)}\}_{i\in[v]}$.

$O_{\mathtt{\mathpzc{Vrfy}}}(y,\mathpzc{usk}^{\prime})$:

Given $(y,\mathpzc{usk}^{\prime})$, it finds an entry $(y,\mathsf{vk},V)$ from $L_{\mathtt{\mathpzc{KG}}}$ and parses $\mathpzc{usk}^{\prime}=\{j_{i},\mathpzc{usk}_{i}^{\prime}\}_{i}$. (If there is no such entry, it returns $\bot$.) It then computes $d_{i}\coloneqq\mathsf{1ABE}.\mathpzc{Vrfy}(\mathsf{1abe}.\mathsf{vk}_{i},\mathpzc{usk}^{\prime}_{i})$ for $i\in[v]$. If $j_{\tilde{i}}=\tau$, $\mathpzc{B}$ makes a query to its own verification oracle to obtain

[TABLE]

Otherwise, $\mathpzc{B}$ runs $d_{\tilde{i}}\coloneqq\mathsf{1ABE}.\mathpzc{Vrfy}(\mathsf{1abe}.\mathsf{vk}_{\tilde{i},\tau},\mathpzc{usk}^{\prime}_{\tilde{i}})$ by itself. Finally, it checks if $d_{i}=\top$ for all $i\in[v]$. If so, it returns $d\coloneqq\top$ to $\mathpzc{A}$. Otherwise, it returns $d\coloneqq\bot$ to $\mathpzc{A}$. It finally updates the entry into $(y,\mathsf{vk},d)$ if $V=\bot$. 3. 3.

When $\mathpzc{A}$ sends $(x^{*},m_{0},m_{1})$ to the challenger, $\mathpzc{B}$ aborts and outputs [math] if either $|K_{x^{*}}|>q$ or there is an entry of the form $(y^{(k)},\mathsf{vk},\bot)$ for some $k\in K_{x^{*}}$. It also aborts and outputs [math] if $i^{*}\neq\tilde{i}$, which includes the case that there is no $i^{*}$ satisfying the properties we defined in $\mathsf{Hyb}_{1}$. Otherwise, it chooses $\mu_{1},\ldots,\mu_{v}\leftarrow\{0,1\}^{\ell}$ and sets $\xi_{0}\coloneqq(\oplus_{i\in[v]\backslash\{i^{*}\}}\mu_{i})\oplus m_{0}$ and $\xi_{1}\coloneqq(\oplus_{i\in[v]\backslash\{i^{*}\}}\mu_{i})\oplus m_{1}$. It then computes $\mathsf{1abe}.\mathsf{ct}_{i,j}\leftarrow\mathsf{1ABE}.\mathsf{Enc}(\mathsf{1abe}.\mathsf{pk}_{i,j},x^{*},\mu_{i})$ for $i\in[v]\backslash\{i^{*}\}$ and $j\in[w]$ and $\mathsf{1abe}.\mathsf{ct}_{i^{*},j}$ for $j\in[w]\backslash\{\tau\}$ as Equation 106. It then submits $(\xi_{0},\xi_{1})$ to its challenger. Then,

[TABLE]

is run and $\mathsf{1abe}.\mathsf{ct}$ is returned to $\mathpzc{B}$, where $\overline{\mathsf{coin}}$ is the random bit chosen by $\mathpzc{B}$’s challenger. Finally, $\mathpzc{B}$ sets $\mathsf{1abe}.\mathsf{ct}_{i^{*},\tau}\coloneqq\mathsf{1abe}.\mathsf{ct}$ and sends $\mathsf{ct}^{*}\coloneqq\{\mathsf{1abe}.\mathsf{ct}_{i,j}\}_{i,j}$ to $\mathpzc{A}$. 4. 4.

$\mathpzc{A}$ continues to make queries to $O_{\mathtt{\mathpzc{KG}}}(\cdot)$ and $O_{\mathtt{\mathpzc{Vrfy}}}(\cdot,\cdot)$. However, $\mathpzc{A}$ is not allowed to send a key attribute $y$ such that $R(x^{*},y)=1$ to $O_{\mathtt{\mathpzc{KG}}}$. 5. 5.

$\mathpzc{A}$ outputs a guess $\mathsf{coin}^{\prime}$ for $\mathsf{coin}$. The challenger outputs $\mathsf{coin}^{\prime}$ as the final output of the experiment.

We first argue that $\mathpzc{B}$ does not make more than two distinguishing key queries. This is because $\mathpzc{B}$ aborts and outputs [math] before it makes a challenge query if there is no $i^{*}$ with the required conditions. For such $i^{*}$, we have that $\{j^{(k)}_{i^{*}}\}_{k\in K_{x^{*}}}$ are all distinct and thus in particular, $\mathpzc{B}$ needs to simulate only single distinguishing key for the $(i^{*},\tau)$-th instance, to which the reduction algorithm embeds the $\mathsf{1ABE}$ instance.

We then have

[TABLE]

where the probabilities are taken over the randomness used in the respective games. Thus, $\left|\Pr[\mathsf{Hyb}_{3}=1]-\Pr[\mathsf{Hyb}_{4}=1]\right|={\mathsf{negl}}(\lambda)$ by the adaptive security of $\mathsf{1ABE}$. This completes the proof of Lemma 6.11.

∎

This completes the proof of Theorem 6.9 for the case of adaptive security.

The proof for selective security.

The proof for selective security can be obtained immediately by considering the same sequence of games as adaptive security case with natural adaptations. There are two main differences. The proof for Lemma 6.10 requires different parameters for selective and adaptive cases. We refer to the proof of the lemma for the detail. Another difference is that we modify the reduction algorithm in Lemma 6.11 so that it outputs $x^{*}$ at the beginning of the game right after given $x^{*}$ from $\mathpzc{A}$. ∎

6.4 Instantiations

Here, we explain new schemes that can be obtained by applying the conversions that we showed in Sections 6.2 and 6.3 to existing IBE/ABE schemes. Our constructions are fully generic and can upgrade almost all ABE schemes222222 Our conversion in Section 6.3 for the adaptive security case poses the restriction that the size of the cipheretxt attribute space of the ABE should be bounded by $2^{{\mathrm{poly}}(\lambda)}$ for some polynomial ${\mathrm{poly}}(\lambda)$. This means that we cannot apply the conversion for adaptively secure ABE for DFA for example, since the ciphertext attribute is of unbounded length and there is no such bound for the size of the ciphertext attribute space. However, we do not know any concrete ABE scheme from standard assumptions for which we cannot apply our conversion. into the one with the security against key leasing attacks with the help of IND-KLA secure PKE-SKL scheme, which can be instantiated from any (post quantum) PKE. Here, we mention some instantiations, all of which are obtained from the standard LWE assumption.

• •

If we start from selectively secure ABE scheme for circuits [GVW13, BGG*+*14] and apply the conversions in Sections 6.2 and 6.3, we obtain an ABE-SKL scheme for circuits with $q$-bounded distinguishing key Sel-IND-KLA security for any $q={\mathrm{poly}}(\lambda)$.

• •

If we start from adaptively secure ABE for inner products over the integer [KNYY20] and apply the conversions in Sections 6.2 and 6.3, we obtain an ABE-SKL scheme for the same predicate with $q$-bounded distinguishing key Ada-IND-KLA security for any $q={\mathrm{poly}}(\lambda)$. We note that the conversion in Section 6.3 for adaptive security case can be applied for the scheme, since the size of the ciphertext attribute space is bounded by $2^{{\mathrm{poly}}(\lambda)}$ for the primitive. Similar implications can be obtained for adaptively secure $t$-CNF formulae for $t=O(1)$ [Tsa19] and fuzzy IBE for small universe [KNYY20].

• •

If we start from adaptively (resp., selectively) secure IBE [ABB10, CHKP10] and apply the conversion in Section 6.2, we obtain IBE-SKL scheme with $1$-bounded distinguishing key Ada-IND-KLA (resp., Sel-IND-KLA) security. We note that $1$-bounded distinguishing key security for the case of IBE is a more natural security notion than that for the case of ABE with other relations since there is only one attribute that is eligible for decrypting a ciphertext in the case of IBE (i.e., the identity that is associated with the ciphertext), whereas there can be exponentially many such attributes in general.

7 Public-Key Functional Encryption with Secure Key Leasing

7.1 Definitions

Definition 7.1 (PKFE with Secure Key Leasing).

A PKFE-SKL scheme $\mathsf{PKFE\textrm{-}SKL}$ is a tuple of six algorithms $(\mathsf{Setup},\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec},\mathpzc{Cert},\mathsf{Vrfy})$. Below, let $\mathcal{X}$, $\mathcal{Y}$, and $\mathcal{F}$ be the plaintext, output, and function spaces of $\mathsf{PKFE\textrm{-}SKL}$, respectively.

$\mathsf{Setup}(1^{\lambda})\rightarrow(\mathsf{pk},\mathsf{msk})$:

The setup algorithm takes a security parameter $1^{\lambda}$, and outputs a public key $\mathsf{pk}$ and master secret key $\mathsf{msk}$.

$\mathpzc{KG}(\mathsf{msk},f)\rightarrow(\mathpzc{fsk},\mathsf{vk})$:

The key generation algorithm takes a master secret key $\mathsf{msk}$ and a function $f\in\mathcal{F}$, and outputs a functional decryption key $\mathpzc{fsk}$ and a verification key $\mathsf{vk}$.

$\mathsf{Enc}(\mathsf{pk},x)\rightarrow\mathsf{ct}$:

The encryption algorithm takes a public key $\mathsf{pk}$ and a plaintext $x\in\mathcal{X}$, and outputs a ciphertext $\mathsf{ct}$.

$\mathpzc{Dec}(\mathpzc{fsk},\mathsf{ct})\rightarrow\widetilde{x}$:

The decryption algorithm takes a functional decryption key $\mathpzc{fsk}$ and a ciphertext $\mathsf{ct}$, and outputs a value $\tilde{x}$.

$\mathpzc{Vrfy}(\mathsf{vk},\mathpzc{fsk}^{\prime})\rightarrow\top/\bot$:

The verification algorithm takes a verification key $\mathsf{vk}$ and a quantum state $\mathpzc{fsk}^{\prime}$, and outputs $\top$ or $\bot$.

Decryption correctness:

For every $x\in\mathcal{X}$ and $f\in\mathcal{F}$, we have

[TABLE]

Verification correctness:

For every $f\in\mathcal{F}$, we have

[TABLE]

Remark 7.2.

Although Kitagawa and Nishimaki [KN22a] require SKFE-SKL to have classical certificate generation algorithm for deletion, we do not since it is optional. If there exists a PKE-SKL scheme that has a classical certificate generation algorithm, our PKFE-SKL scheme in Section 7.2 also has a classical certificate generation algorithm.

Definition 7.3 (Adaptive Indistinguishability against Key Leasing Attacks).

We say that a PKFE-SKL scheme $\mathsf{PKFE\textrm{-}SKL}$ for $\mathcal{X},\mathcal{Y}$, and $\mathcal{F}$ is an adaptively indistinguishable secure against key leasing attacks (Ada-IND-KLA), if it satisfies the following requirement, formalized from the experiment $\mathsf{Exp}_{\mathpzc{A},\mathsf{PKFE\textrm{-}SKL}}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(1^{\lambda},\mathsf{coin})$ between an adversary $\mathpzc{A}$ and a challenger:

At the beginning, the challenger runs $(\mathsf{pk},\mathsf{msk})\leftarrow\mathsf{Setup}(1^{\lambda})$. Throughout the experiment, $\mathpzc{A}$ can access the following oracles.

$O_{\mathtt{\mathpzc{KG}}}(f)$:

Given $f$, it finds an entry $(f,\mathsf{vk},V)$ from $L_{\mathtt{\mathpzc{KG}}}$. If there is such an entry, it returns $\bot$. Otherwise, it generates $(\mathpzc{fsk},\mathsf{vk})\leftarrow\mathpzc{KG}(\mathsf{msk},f)$, sends $\mathpzc{fsk}$ to $\mathpzc{A}$, and adds $(f,\mathsf{vk},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$.

$O_{\mathtt{\mathpzc{Vrfy}}}(f,\mathpzc{fsk}^{\prime})$:

*Given $(f,\mathpzc{fsk}^{\prime})$, it finds an entry $(f,\mathsf{vk},V)$ from $L_{\mathtt{\mathpzc{KG}}}$. (If there is no such entry, it returns $\bot$.) It computes $d\leftarrow\mathpzc{Vrfy}(\mathsf{vk},\mathpzc{fsk}^{\prime})$ and sends $d$ to $\mathpzc{A}$. If $V=\top$, it does not update $L_{\mathtt{\mathpzc{KG}}}$. Else if $V=\bot$, it updates the entry by setting $V\coloneqq d$. * 2. 2.

When $\mathpzc{A}$ sends $(x_{0}^{*},x_{1}^{*})$ to the challenger, the challenger checks if for any entry $(f,\mathsf{vk},V)$ in $L_{\mathtt{\mathpzc{KG}}}$ such that $f(x_{0}^{*})\neq f(x_{1}^{*})$, it holds that $V=\top$. If so, the challenger generates $\mathsf{ct}^{*}\leftarrow\mathsf{Enc}(\mathsf{pk},x_{\mathsf{coin}}^{*})$ and sends $\mathsf{ct}^{*}$ to $\mathpzc{A}$. Otherwise, the challenger outputs [math]. Hereafter, $\mathpzc{A}$ is not allowed to send a function $f$ such that $f(x_{0}^{*})\neq f(x_{1}^{*})$ to $O_{\mathtt{\mathpzc{KG}}}$. 3. 3.

$\mathpzc{A}$* outputs a guess $\mathsf{coin}^{\prime}$ for $\mathsf{coin}$. The challenger outputs $\mathsf{coin}^{\prime}$ as the final output of the experiment.*

For any QPT $\mathpzc{A}$, it holds that

[TABLE]

Remark 7.4.

Definition 7.3 assumes that the adversary does not get more than one decryption key for the same $f$ for simplification as Remark 6.3.

7.2 Constructions

We describe our PKFE-SKL scheme in this section. We construct a PKFE-SKL scheme $\mathsf{PKFE\textrm{-}SKL}=(\mathsf{Setup},\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec},\mathpzc{Vrfy})$ by using the following building blocks.

• •

IND-KLA secure PKE-SKL $\mathsf{SKL}=\mathsf{SKL}.(\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec},\mathpzc{Vrfy})$.

• •

Adaptively secure PKFE $\mathsf{FE}=\mathsf{FE}.(\mathsf{Setup},\mathsf{KG},\mathsf{Enc},\mathsf{Dec})$.

• •

Adaptively single-ciphertext function private SKFE $\mathsf{SKFE}=\mathsf{SKFE}.(\mathsf{Setup},\mathsf{KG},\mathsf{Enc},\mathsf{Dec})$.

• •

Pseudorandom-secure SKE $\mathsf{SKE}=\mathsf{SKE}.(\mathsf{Enc},\mathsf{Dec})$.

• •

Puncturable PRF $\mathsf{PRF}=(\mathsf{PRF}.\mathsf{Gen},\mathsf{F},\mathsf{Puncture})$.

We set $\ell_{\mathsf{pad}}\coloneqq\absolutevalue{\mathsf{skfe}.\mathsf{ct}}-\absolutevalue{x}$ and $\ell_{\mathsf{ske}}\coloneqq\absolutevalue{\mathsf{ske}.\mathsf{ct}}$, where $\absolutevalue{x}$ is the input length of $\mathsf{PKFE\textrm{-}SKL}$, $\absolutevalue{\mathsf{skfe}.\mathsf{ct}}$ is the ciphertext length of $\mathsf{SKFE}$, and $\absolutevalue{\mathsf{ske}.\mathsf{ct}}$ is the ciphertext length of $\mathsf{SKE}$.

$\mathsf{Setup}(1^{\lambda})$:

• •

Generate $(\mathsf{fe}.\mathsf{pk},\mathsf{fe}.\mathsf{msk})\leftarrow\mathsf{FE}.\mathsf{Setup}(1^{\lambda})$.

• •

Output $(\mathsf{pk},\mathsf{msk})\coloneqq(\mathsf{fe}.\mathsf{pk},\mathsf{fe}.\mathsf{msk})$.

$\mathpzc{KG}(\mathsf{msk},f)$:

• •

Generate $(\mathsf{skl}.\mathsf{ek},\mathsf{skl}.\mathpzc{sk},\mathsf{skl}.\mathsf{vk})\leftarrow\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$.

• •

Choose $\mathsf{ske}.\mathsf{ct}\leftarrow\{0,1\}^{\ell_{\mathsf{ske}}}$.

• •

Construct a circuit $W[f,\mathsf{skl}.\mathsf{ek},\mathsf{ske}.\mathsf{ct}]$, which is described in Figure 1.

• •

Generate $\mathsf{fe}.\mathsf{sk}_{W}\leftarrow\mathsf{FE}.\mathsf{KG}(\mathsf{fe}.\mathsf{msk},W[f,\mathsf{skl}.\mathsf{ek},\mathsf{ske}.\mathsf{ct}])$.

• •

Output $\mathpzc{fsk}\coloneqq(\mathsf{fe}.\mathsf{sk}_{W},\mathsf{skl}.\mathpzc{sk})$ and $\mathsf{vk}\coloneqq\mathsf{skl}.\mathsf{vk}$.

$\mathsf{Enc}(\mathsf{pk},x)$:

• •

Choose $\mathsf{K}\leftarrow\mathsf{PRF}.\mathsf{Gen}(1^{\lambda})$.

• •

Compute $\mathsf{fe}.\mathsf{ct}\leftarrow\mathsf{FE}.\mathsf{Enc}(\mathsf{fe}.\mathsf{pk},(x\|0^{\ell_{\mathsf{pad}}},\bot,\mathsf{K}))$.

• •

Output $\mathsf{ct}\coloneqq\mathsf{fe}.\mathsf{ct}$.

$\mathpzc{Dec}(\mathpzc{fsk},\mathsf{ct})$:

• •

Parse $\mathpzc{fsk}=(\mathsf{fe}.\mathsf{sk},\mathsf{skl}.\mathpzc{sk})$ and $\mathsf{ct}=\mathsf{fe}.\mathsf{ct}$.

• •

Compute $\mathsf{skl}.\mathsf{ct}\leftarrow\mathsf{FE}.\mathsf{Dec}(\mathsf{fe}.\mathsf{sk},\mathsf{fe}.\mathsf{ct})$.

• •

Compute and output $y\leftarrow\mathsf{SKL}.\mathpzc{Dec}(\mathsf{skl}.\mathpzc{sk},\mathsf{skl}.\mathsf{ct})$.

$\mathpzc{Vrfy}(\mathsf{vk},\mathpzc{fsk}^{\prime})$:

• •

Parse $\mathsf{vk}=\mathsf{skl}.\mathsf{vk}$ and $\mathpzc{fsk}^{\prime}=(\mathsf{fe}.\mathsf{sk}^{\prime},\mathsf{skl}.\mathpzc{sk}^{\prime})$.

• •

Compute and output $\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk},\mathsf{skl}.\mathpzc{sk}^{\prime})$.

Correctness.

The decryption correctness of $\mathsf{PKFE\textrm{-}SKL}$ follows from the correctness of $\mathsf{FE}$ and the decryption correctness of $\mathsf{SKL}$. The verification correcntess of $\mathsf{PKFE\textrm{-}SKL}$ follows from the verification correcntess of $\mathsf{SKL}$.

7.3 Security Proofs

We prove the security of $\mathsf{PKFE\textrm{-}SKL}$.

Theorem 7.5.

If $\mathsf{PKFE}$ is adaptively secure, $\mathsf{SKFE}$ is adaptively single-ciphertext function private, $\mathsf{PRF}$ is a secure punctured PRF, and $\mathsf{SKE}$ has the ciphertext pseudorandomness, then $\mathsf{PKFE\textrm{-}SKL}$ above is Ada-IND-KLA.

Theorem 7.6.

If $\mathsf{PKFE}$ is $q$-bounded adaptively secure, $\mathsf{SKFE}$ is adaptively single-ciphertext function private, $\mathsf{PRF}$ is a secure punctured PRF, and $\mathsf{SKE}$ has the ciphertext pseudorandomness, then $\mathsf{PKFE\textrm{-}SKL}$ above is $q$-bounded Ada-IND-KLA.

The proof of Theorem 7.6 is almost the same as that of Theorem 7.5. Hence, we focus on the proof of Theorem 7.5. We can also consider a simulation-based security for $q$-bounded security as Kitagawa and Nishimaki [KN22a] and believe that we can achieve it using a similar technique. However, it is out of scope of this work.

Proof of Theorem 7.5.

In the proof, we embed an SKFE ciphertext $\mathsf{skfe}.\mathsf{ct}\leftarrow\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x,\bot,\mathsf{K},0,\bot))$ into the challenge ciphertext. More specifically, we generate $\mathsf{fe}.\mathsf{ct}\leftarrow\mathsf{PKFE}.\mathsf{Enc}(\mathsf{fe}.\mathsf{pk},(\mathsf{skfe}.\mathsf{ct},\mathsf{ske}.\mathsf{sk},\bot))$ and $\mathsf{ske}.\mathsf{ct}\leftarrow\mathsf{SKE}.\mathsf{Enc}(\mathsf{ske}.\mathsf{sk},\mathsf{SKFE}.\mathsf{KG}(\mathsf{skfe}.\mathsf{msk},T[f,\mathsf{skl}.\mathsf{ek}]))$, where $T[f,\mathsf{skl}.\mathsf{ek}]$ is described in Figure 2. By using this embedding, we can use the function privacy of $\mathsf{SKFE}$ and can alter both plaintexts and functions in the proof.

Let $q$ be the total number of key queries to $O_{\mathtt{\mathpzc{KG}}}$. In the collusion-resistant setting, $q$ is an unbounded polynomial. Note that even if $q$ is an unbounded polynomial, we need only ${\mathrm{poly}}(\lambda)$ bits to describe $q$ as an integer. We assume that the adversary does not send the same $f$ to $O_{\mathtt{\mathpzc{KG}}}$ more than once without loss of generality. We define a sequence of hybrid games.

$\mathsf{Hyb}_{0}$:

This is the same as $\mathsf{Exp}_{\mathsf{PKFE\textrm{-}SKL},\mathpzc{A}}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(1^{\lambda},0)$. More specifically, it is as follows.

1. 1.

The challenger generates $(\mathsf{fe}.\mathsf{pk},\mathsf{fe}.\mathsf{msk})\leftarrow\mathsf{FE}.\mathsf{Setup}(1^{\lambda})$ and sends $\mathsf{pk}\coloneqq\mathsf{fe}.\mathsf{pk}$ to $\mathpzc{A}$. $\mathpzc{A}$ can access the following oracles.

$O_{\mathtt{\mathpzc{KG}}}(f_{i})$:

Given $f_{i}$, it generates $(\mathsf{skl}.\mathsf{ek}_{i},\mathsf{skl}.\mathpzc{sk}_{i},\mathsf{skl}.\mathsf{vk}_{i})\leftarrow\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$, $\mathsf{ske}.\mathsf{ct}_{i}\leftarrow\{0,1\}^{\ell_{\mathsf{ske}}}$, and $\mathsf{fe}.\mathsf{sk}_{W,i}\leftarrow\mathsf{FE}.\mathsf{KG}(\mathsf{fe}.\mathsf{msk},W[f_{i},\mathsf{skl}.\mathsf{ek}_{i},\mathsf{ske}.\mathsf{ct}_{i}])$, sends $\mathpzc{fsk}_{i}\coloneqq(\mathsf{fe}.\mathsf{sk}_{W,i},\mathsf{skl}.\mathpzc{sk}_{i})$ to $\mathpzc{A}$, and adds $(f_{i},\mathsf{vk}_{i},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$.

$O_{\mathtt{\mathpzc{Vrfy}}}(f_{i},\mathpzc{fsk}^{\prime}_{i})$:

Given $(f_{i},\mathpzc{fsk}^{\prime}_{i})$, it finds an entry $(f_{i},\mathsf{vk}_{i},V_{i})$ from $L_{\mathtt{\mathpzc{KG}}}$ and parse $\mathpzc{fsk}^{\prime}_{i}=(\mathsf{fe}.\mathsf{sk}^{\prime}_{i},\mathsf{skl}.\mathpzc{sk}^{\prime}_{i})$. (If there is no such entry, it returns $\bot$.) It returns $d\coloneqq\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk},\mathsf{skl}.\mathpzc{sk}^{\prime})$. If $V_{i}=\top$, it does not update the entry. Otherwise, it updates the entry by setting $V_{i}\coloneqq d$. 2. 2.

When $\mathpzc{A}$ sends $(x_{0}^{*},x_{1}^{*})$ to the challenger, the challenger checks if for any entry $(f,\mathsf{vk},V)$ in $L_{\mathtt{\mathpzc{KG}}}$ such that $f(x_{0}^{*})\neq f(x_{1}^{*})$, it holds that $V=\top$. If so, the challenger generates $\mathsf{K}\leftarrow\mathsf{PRF}.\mathsf{Gen}(1^{\lambda})$ and $\mathsf{fe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{FE}.\mathsf{Enc}(\mathsf{fe}.\mathsf{pk},(x_{\mathsf{coin}}^{\ast}\|0^{\ell_{\mathsf{pad}}},\bot,\mathsf{K}))$ and sends $\mathsf{ct}^{*}\coloneqq\mathsf{fe}.\mathsf{ct}^{\ast}$ to $\mathpzc{A}$. Otherwise, the challenger outputs [math]. Hereafter, $\mathpzc{A}$ is not allowed to send a function $f$ such that $f(x_{0}^{*})\neq f(x_{1}^{*})$ to $O_{\mathtt{\mathpzc{KG}}}$. 3. 3.

$\mathpzc{A}$ outputs a guess $\mathsf{coin}^{\prime}$ for $\mathsf{coin}$. The challenger outputs $\mathsf{coin}^{\prime}$ as the final output of the experiment.

$\mathsf{Hyb}_{1}$:

This is the same as $\mathsf{Hyb}_{0}$ except that for all $i\in[q]$, we generate $\mathsf{ske}.\mathsf{ct}_{i}\leftarrow\mathsf{SKE}.\mathsf{Enc}(\mathsf{ske}.\mathsf{sk},\mathsf{skfe}.\mathsf{sk}_{i})$, where $\mathsf{skfe}.\mathsf{sk}_{i}\leftarrow\mathsf{SKFE}.\mathsf{KG}(\mathsf{skfe}.\mathsf{msk},T[f_{i},\mathsf{skl}.\mathsf{ek}_{i}])$ and $(\mathsf{skl}.\mathsf{ek}_{i},\mathsf{skl}.\mathpzc{sk}_{i},\mathsf{skl}.\mathsf{vk}_{i})\leftarrow\mathsf{SKL}.\mathsf{KeyGen}(1^{\lambda})$. Note that the SKE secret key $\mathsf{ske}.\mathsf{sk}$ never appears in the view of $\mathpzc{A}$. Hence, we obtain $\absolutevalue{\Pr[\mathsf{Hyb}_{0}=1]-\Pr[\mathsf{Hyb}_{1}=1]}={\mathsf{negl}}(\lambda)$ by the security of $\mathsf{SKE}$.

$\mathsf{Hyb}_{2}$:

This is the same as $\mathsf{Hyb}_{1}$ except that we generate $\mathsf{fe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{PKFE}.\mathsf{Enc}(\mathsf{fe}.\mathsf{pk},(\mathsf{skfe}.\mathsf{ct}^{\ast},\mathsf{ske}.\mathsf{sk},\bot))$, where $\mathsf{skfe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x_{0}^{\ast},\bot,\mathsf{K},0,\bot))$. By the definition of $W$ described in Figure 1, if we decrypt $\mathsf{fe}.\mathsf{ct}^{\ast}$ by $\mathsf{fe}.\mathsf{sk}_{i}$, we obtain

• •

$\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{i},f(x_{0}^{\ast});\mathsf{F}_{\mathsf{K}}(\mathsf{skl}.\mathsf{ek}_{i}))$ in $\mathsf{Hyb}_{1}$ since the plaintext in $\mathsf{fe}.\mathsf{ct}^{\ast}$ is $(x_{0}^{\ast}\|0^{\ell_{\mathsf{pad}}},\bot,\mathsf{K})$,

• •

$z_{i}=\mathsf{SKFE}.\mathsf{Dec}(\mathsf{skfe}.\mathsf{sk}_{i},\mathsf{skfe}.\mathsf{ct}^{\ast})$ in $\mathsf{Hyb}_{2}$ since $\mathsf{ske}.\mathsf{ct}$ is a ciphertext of $\mathsf{skfe}.\mathsf{sk}_{i}$ and the plaintext in $\mathsf{fe}.\mathsf{ct}^{\ast}$ is $(\mathsf{skfe}.\mathsf{ct}^{\ast},\mathsf{ske}.\mathsf{sk},\bot)$, where $\mathsf{skfe}.\mathsf{ct}^{\ast}=\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x_{0}^{\ast},\bot,\mathsf{K},0,\bot))$. By the correctness of $\mathsf{SKFE}$, $z_{i}=\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{i},f(x_{0}^{\ast});\mathsf{F}_{\mathsf{K}}(\mathsf{skl}.\mathsf{ek}_{i}))$.

That is, for all $i\in[q]$, it holds that $W[f_{i},\mathsf{skl}.\mathsf{ek}_{i},\mathsf{ske}.\mathsf{ct}_{i}](x_{0}^{\ast}\|0^{\ell_{\mathsf{pad}}},\bot,\mathsf{K})=W[f_{i},\mathsf{skl}.\mathsf{ek}_{i},\mathsf{ske}.\mathsf{ct}_{i}](\mathsf{skfe}.\mathsf{ct}^{\ast},\mathsf{ske}.\mathsf{sk},\bot)$. Hence, we can use the security of $\mathsf{PKFE}$ and obtain $\absolutevalue{\Pr[\mathsf{Hyb}_{1}=1]-\Pr[\mathsf{Hyb}_{2}=1]}={\mathsf{negl}}(\lambda)$. See Lemma C.1 for the detail.

After this game, we can focus on $\mathsf{SKFE}$.

$\mathsf{Hyb}_{3}$:

This is the same as $\mathsf{Hyb}_{2}$ except that we generate $\mathsf{skfe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},0,\bot))$ and $\mathsf{skfe}.\mathsf{sk}_{i}\leftarrow\mathsf{SKFE}.\mathsf{KG}(\mathsf{skfe}.\mathsf{msk},T_{\mathsf{hyb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i])$, where $T_{\mathsf{hyb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i]$ is described in Figure 3. Since $i\in[q]$, it holds that $T_{\mathsf{hyb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i](x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},0,\bot)=T[f_{i},\mathsf{skl}.\mathsf{ek}_{i}](x_{0}^{\ast},\bot,\mathsf{K},0,\bot)$ for all $i\in[q]$. Hence, by the adaptively single-ciphertext function privacy of $\mathsf{SKFE}$, we obtain $\absolutevalue{\Pr[\mathsf{Hyb}_{2}=1]-\Pr[\mathsf{Hyb}_{3}=1]}={\mathsf{negl}}(\lambda)$. See Lemma C.2 for the detail.

$\mathsf{Hyb}_{3}^{j}$:

This is the same as $\mathsf{Hyb}_{3}$ except that we generate $\mathsf{skfe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},j,\bot))$. Apparently, $\mathsf{Hyb}_{3}^{0}$ is the same as $\mathsf{Hyb}_{3}$. We show it holds that $\absolutevalue{\Pr[\mathsf{Hyb}_{3}^{j-1}=1]-\Pr[\mathsf{Hyb}_{3}^{j}=1]}={\mathsf{negl}}(\lambda)$ for $j\in[q]$ in Lemma 7.7.

$\mathsf{Hyb}_{4}$:

This is the same as $\mathsf{Hyb}_{3}^{q}$ except that we generate $\mathsf{skfe}.\mathsf{sk}_{i}\leftarrow\mathsf{SKFE}.\mathsf{KG}(\mathsf{skfe}.\mathsf{msk},T[f_{i},\mathsf{skl}.\mathsf{ek}_{i}])$ and $\mathsf{skfe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x_{1}^{\ast},\bot,\mathsf{K},0,\bot))$. Recall that in $\mathsf{Hyb}_{3}^{q}$, we use $\mathsf{skfe}.\mathsf{sk}_{i}\leftarrow\mathsf{SKFE}.\mathsf{KG}(\mathsf{skfe}.\mathsf{msk},T_{\mathsf{hyb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i])$ and $\mathsf{skfe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},q,\bot))$. By the definition of $T_{\mathsf{hyb}}$ and $T$, it holds that for all $i\in[q]$,

[TABLE]

Hence, we can use the adaptively single-ciphertext function privacy of $\mathsf{SKFE}$ and obtain $\absolutevalue{\Pr[\mathsf{Hyb}_{3}^{q}=1]-\Pr[\mathsf{Hyb}_{4}=1]}={\mathsf{negl}}(\lambda)$. See Lemma C.3 for the detail.

Now, we use $x_{1}^{\ast}$ instead of $x_{0}^{\ast}$ and erased $x_{0}^{\ast}$ in the challenge ciphertext. Hence, we focus on $\mathsf{PKFE}$ again and undo the changes from $\mathsf{Hyb}_{1}$ to $\mathsf{Hyb}_{2}$ and from $\mathsf{Hyb}_{0}$ to $\mathsf{Hyb}_{1}$.

$\mathsf{Hyb}_{5}$:

This is the same as $\mathsf{Hyb}_{4}$ except that we generate $\mathsf{fe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{PKFE}.\mathsf{Enc}(\mathsf{fe}.\mathsf{pk},(x_{1}^{\ast}\|0^{\ell_{\mathsf{pad}}},\bot,\mathsf{K}))$. This is the reverse transition from $\mathsf{Hyb}_{1}$ to $\mathsf{Hyb}_{2}$, so we obtain $\absolutevalue{\Pr[\mathsf{Hyb}_{4}=1]-\Pr[\mathsf{Hyb}_{5}=1]}={\mathsf{negl}}(\lambda)$ by the security of PKFE as the proof of Lemma C.1.

$\mathsf{Hyb}_{6}$:

This is the same as $\mathsf{Hyb}_{5}$ except that we generate $\mathsf{ske}.\mathsf{ct}_{i}\leftarrow\{0,1\}^{\ell}$. As the transition from $\mathsf{Hyb}_{0}$ to $\mathsf{Hyb}_{1}$, we obtain $\absolutevalue{\Pr[\mathsf{Hyb}_{5}=1]-\Pr[\mathsf{Hyb}_{6}=1]}={\mathsf{negl}}(\lambda)$ by the ciphertext pseudorandomness of SKE. It is easy to see that $\mathsf{Hyb}_{6}$ is the same as $\mathsf{Exp}_{\mathsf{PKFE\textrm{-}SKL},\mathpzc{A}}^{\mathsf{ada}\mbox{-}\mathsf{ind}\mbox{-}\mathsf{kla}}(1^{\lambda},1)$.

If we prove Lemma 7.7, we complete the proof of Theorem 7.5. ∎

Lemma 7.7.

For all $j\in[q]$, it holds that $\absolutevalue{\Pr[\mathsf{Hyb}_{3}^{j-1}=1]-\Pr[\mathsf{Hyb}_{3}^{j}=1]}={\mathsf{negl}}(\lambda)$ if $\mathsf{SKFE}$ is fully function private, $\mathsf{SKL}$ is IND-KLA, and $\mathsf{PRF}$ is a puncturable PRF.

Proof.

We define a sequence of hybrid games.

$\mathsf{G}_{0}$:

This is the same as $\mathsf{Hyb}_{3}^{j-1}$. That is, $\mathsf{skfe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},j-1,\bot))$ and $\mathsf{skfe}.\mathsf{sk}_{i}\leftarrow\mathsf{SKFE}.\mathsf{KG}(\mathsf{skfe}.\mathsf{msk},T_{\mathsf{hyb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i])$.

$\mathsf{G}_{1}$:

This is the same as $\mathsf{G}_{0}$ except that we generate $\mathsf{skfe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},j,\mathsf{skl}.\mathsf{ct}^{\ast}))$, where $\mathsf{skl}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{j},f_{j}(x_{0}^{\ast});\mathsf{F}_{\mathsf{K}}(\mathsf{skl}.\mathsf{ek}_{j}))$ and $\mathsf{skfe}.\mathsf{sk}_{i}\leftarrow\mathsf{SKFE}.\mathsf{KG}(\mathsf{skfe}.\mathsf{msk},T_{\mathsf{emb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i])$, where $T_{\mathsf{emb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i]$ is described in Figure 4. By the definitions of $T_{\mathsf{hyb}}$ and $T_{\mathsf{emb}}$, it holds that

[TABLE]

for all $i\in[q]$ since $\mathsf{skl}.\mathsf{ct}^{\ast}$ is an encryption of $f_{j}(x_{0}^{\ast})$. Hence, by the adaptively single-ciphertext function privacy of $\mathsf{SKFE}$, we obtain $\absolutevalue{\Pr[\mathsf{G}_{0}=1]-\Pr[\mathsf{G}_{1}=1]}={\mathsf{negl}}(\lambda)$. See Lemma C.4 for the detail.

$\mathsf{G}_{2}$:

This is the same as $\mathsf{G}_{1}$ except that we use a punctured PRF key $\mathsf{K}_{\neq\mathsf{skl}.\mathsf{ek}_{j}}=\mathsf{Puncture}(\mathsf{K},\mathsf{skl}.\mathsf{ek}_{j})$. By the functionality of punctured PRF keys, it holds that

[TABLE]

for all $i\in[q]$. Note that $T_{\mathsf{emb}}$ directly uses $\mathsf{skl}.\mathsf{ct}^{\ast}$ instead of computing $\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{j},f_{j}(x_{0}^{\ast});\mathsf{F}_{\mathsf{K}}(\mathsf{skl}.\mathsf{ek}_{j}))$, so $\mathsf{K}_{\neq\mathsf{skl}.\mathsf{ek}_{j}}$ is sufficient for the functional equivalence. The only difference between the two games is whether the PRF key is $\mathsf{K}$ or $\mathsf{K}_{\neq\mathsf{skl}.\mathsf{ek}_{j}}$. Hence, we can use the adaptively single-ciphertext function privacy of $\mathsf{SKFE}$ and obtain $\absolutevalue{\Pr[\mathsf{G}_{1}=1]-\Pr[\mathsf{G}_{2}=1]}={\mathsf{negl}}(\lambda)$. We omit the proof since it is easy.

$\mathsf{G}_{3}$:

This is the same as $\mathsf{G}_{2}$ except that we generate $\mathsf{skl}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{j},f_{j}(x_{0}^{\ast}))$. That is, we use uniform randomness for generating $\mathsf{skl}.\mathsf{ct}^{\ast}$. By the punctured pseudorandomness of $\mathsf{PRF}$, we obtain $\absolutevalue{\Pr[\mathsf{G}_{2}=1]-\Pr[\mathsf{G}_{3}=1]}={\mathsf{negl}}(\lambda)$. We omit the proof since it is easy.

$\mathsf{G}_{4}$:

This is the same as $\mathsf{G}_{3}$ except that we generate $\mathsf{skl}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{j},f_{j}(x_{1}^{\ast}))$. We consider two cases.

• •

If $(f_{j},\mathsf{vk}_{j},\bot)$ is recorded in $L_{\mathtt{\mathpzc{KG}}}$, that is, valid $\mathpzc{fsk}_{j}$ is not returned, it must hold that $f_{j}(x_{0}^{\ast})=f_{j}(x_{1}^{\ast})$ by the requirement of Ada-IND-KLA security. In this case, the distribution of $\mathsf{skl}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{j},f_{j}(x_{0}^{\ast}))$ is trivially the same as that of $\mathsf{skl}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{j},f_{j}(x_{1}^{\ast}))$. Hence, we obtain $\Pr[\mathsf{G}_{3}=1]=\Pr[\mathsf{G}_{4}=1]$.

• •

If $(f_{j},\mathsf{vk}_{j},\top)$ is recorded in $L_{\mathtt{\mathpzc{KG}}}$, that is, it is certified that the adversary returned valid $\mathpzc{fsk}_{j}$, it could hold that $f_{j}(x_{0}^{\ast})\neq f_{j}(x_{1}^{\ast})$ by the requirement of Ada-IND-KLA security. In this case, we use IND-KLA security of $\mathsf{SKL}$ since $\mathsf{skl}.\mathpzc{sk}_{j}$ was returned. We have that $\mathsf{skl}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{j},f_{j}(x_{0}^{\ast}))$ is computationally indistinguishable from $\mathsf{skl}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{j},f_{j}(x_{1}^{\ast}))$. Hence, we obtain $\absolutevalue{\Pr[\mathsf{G}_{3}=1]-\Pr[\mathsf{G}_{4}=1]}={\mathsf{negl}}(\lambda)$ in this case. See Lemma C.5 for the detail.

Hence, we obtain $\absolutevalue{\Pr[\mathsf{G}_{3}=1]-\Pr[\mathsf{G}_{4}=1]}={\mathsf{negl}}(\lambda)$ in either cases.

$\mathsf{G}_{5}$:

This is the same as $\mathsf{G}_{4}$ except that we undo the change in $\mathsf{G}_{3}$. That is, we use $\mathsf{F}_{\mathsf{K}}(\mathsf{skl}.\mathsf{ek}_{j})$ for the randomness of $\mathsf{skl}.\mathsf{ct}^{\ast}$. We obtain $\absolutevalue{\Pr[\mathsf{G}_{4}=1]-\Pr[\mathsf{G}_{5}=1]}={\mathsf{negl}}(\lambda)$ by the punctured pseudorandomness of $\mathsf{PRF}$. We omit the proof since it is easy.

$\mathsf{G}_{6}$:

This is the same as $\mathsf{G}_{5}$ except that we undo the change in $\mathsf{G}_{2}$. That is, we use a unpunctured PRF key $\mathsf{K}$. We obtain $\absolutevalue{\Pr[\mathsf{G}_{1}=1]-\Pr[\mathsf{G}_{2}=1]}={\mathsf{negl}}(\lambda)$ by the adaptively single-ciphertext function privacy as the transition from $\mathsf{G}_{1}$ to $\mathsf{G}_{2}$. So, we omit the proof.

$\mathsf{G}_{7}$:

This is the same as $\mathsf{G}_{6}$ except that we undo the change in $\mathsf{G}_{1}$, but the index is still $j$. That is, we use $\mathsf{skfe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},j,\bot))$ and $\mathsf{skfe}.\mathsf{sk}_{i}\leftarrow\mathsf{SKFE}.\mathsf{KG}(\mathsf{skfe}.\mathsf{msk},T_{\mathsf{hyb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i])$. We obtain $\absolutevalue{\Pr[\mathsf{G}_{6}=1]-\Pr[\mathsf{G}_{7}=1]}={\mathsf{negl}}(\lambda)$ by the adaptively single-ciphertext function privacy of $\mathsf{SKFE}$. The proof is similar to that of Lemma C.4. So, we omit the proof.

It is easy to see that $\mathsf{G}_{7}$ is the same as $\mathsf{Hyb}_{3}^{j}$. Therefore, we complete the proof. ∎

By Theorems 7.6, 2.16, 2.8, 2.3, 2.19 and 5.1, we obtain the following corollary.

Corollary 7.8.

If there exists IND-CPA secure PKE, there exists $q$-bounded Ada-IND-KLA PKFE-SKL for $\mathsf{P/poly}$.

By Theorems 7.5, 2.16, 2.8, 2.3 and 5.1 and known theorems about PKFE [GS16, LM16, KNTY19], we obtain the following corollary.

Corollary 7.9.

If there exists single-key selective-message-function secure242424The adversary must select the target plaintext pair and function at the beginning of the game. This is the same as weakly selective security by Garg and Srinivasan [GS16]. and weakly compact PKFE for $\mathsf{P/poly}$, there exists Ada-IND-KLA PKFE for $\mathsf{P/poly}$.

Acknowledgement

We thank Jiayu Zhang for pointing out a technical similarity to [Zha21, Zha22], Prabhanjan Ananth for discussions on the relationship between our work and their concurrent work [APV23], and anonymous reviewers of QIP 2023 and Eurocrypt 2023 for their valuable comments. This work was supported in part by the DST “Swarnajayanti” fellowship, Cybersecurity Center of Excellence, IIT Madras, National Blockchain Project and the Algorand Centres of Excellence programme managed by Algorand Foundation. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of sponsors. The fourth author was partially supported by JST AIP Acceleration Research JPMJCR22U5 and JSPS KAKENHI Grant Number 19H01109, Japan.

Appendix A SDE Implies PKE-SKL

In this section, we discuss the relationship between SDE and PKE-SKL. There are many incomparable security definitions for SDE in the literature. Coladangelo et al. [CLLZ21] defined two incomparable security definitions called CPA-style anti-piracy and random challenge anti-piracy.252525They actually also defined stronger variants of them called strong anti-piracy security and strong anti-piracy against random plaintexts. See [CLLZ21, Definition 6.11 and D.4 in the full version] for the detail. All constructions of SDE in [CLLZ21] are shown to satisfy both CPA-style anti-piracy and random challenge anti-piracy. Georgiou and Zhandry [GZ20] defined yet another security definition, which is similar to but slightly different from CPA-style anti-piracy of [CLLZ21].262626We note that [GZ20] appeared before [CLLZ21]. Though we do not see any relationships between security notions in [GZ20] and [CLLZ21], it seems possible to prove that the construction given in [GZ20] satisfies both CPA-style anti-piracy and random challenge anti-piracy of [CLLZ21] because it is very similar to one of the schemes given in [CLLZ21].272727Here, we are referring to the construction of SDE based on one-shot signatures and extractable witness encryption in [GZ20, Section 5]. For proving that the scheme satisfies the security notions of [CLLZ21], we will need to go trough the “strong” variants of them similarly to [CLLZ21].

In the following, we show that SDE with random challenge anti-piracy implies IND-KLA secure PKE-SKL. This means that all known constructions of SDE can be used to construct PKE-SKL.

The definitions of SDE and its random challenge anti-piracy are given below. The syntax of SDE is identical to that of PKE except that the key generation and decryption algorithms are quantum and the decryption key is quantum.

Definition A.1 (Single-Decryptor Encryption).

A single-decryptor encryption (SDE) scheme $\mathsf{SDE}$ is a tuple of three algorithms $(\mathpzc{KG},\mathsf{Enc},\mathpzc{Dec})$. Below, let $\mathcal{X}$ be the message space of $\mathsf{SDE}$.

$\mathpzc{KG}(1^{\lambda})\rightarrow(\mathsf{ek},\mathpzc{dk})$:

The key generation algorithm takes a security parameter $1^{\lambda}$, and outputs an encryption key $\mathsf{ek}$ and a decryption key $\mathpzc{dk}$.

$\mathsf{Enc}(\mathsf{ek},\mathsf{m})\rightarrow\mathsf{ct}$:

The encryption algorithm takes an encryption key $\mathsf{ek}$ and a message $\mathsf{m}\in\mathcal{X}$, and outputs a ciphertext $\mathsf{ct}$.

$\mathpzc{Dec}(\mathpzc{dk},\mathsf{ct})\rightarrow\tilde{\mathsf{m}}$:

The decryption algorithm takes a decryption key $\mathpzc{dk}$ and a ciphertext $\mathsf{ct}$, and outputs a value $\tilde{\mathsf{m}}$.

Correctness:

For every $\mathsf{m}\in\mathcal{X}$, we have

[TABLE]

In the following definition of random challenge anti-piracy, we use the notion of quantum programs with classical inputs and outputs as defined in Definition 4.7.

Definition A.2 (Random Challenge Anti-Piracy).

We say that an SDE scheme $\mathsf{SDE}$ with the message space $\mathcal{X}$ satisfies random-challenge anti-piracy, if it satisfies the following requirement, formalized from the experiment $\mathsf{Exp}_{\mathsf{SDE},\mathpzc{A}}^{\mathsf{rand}\mbox{-}\mathsf{chal}}(1^{\lambda})$ between an adversary $\mathpzc{A}$ and a challenger $\mathpzc{C}$:

$\mathpzc{C}$* runs $(\mathsf{ek},\mathpzc{dk})\leftarrow\mathpzc{KG}(1^{\lambda})$ and sends $\mathsf{ek}$ and $\mathpzc{dk}$ to $\mathpzc{A}$.* 2. 2.

$\mathpzc{A}$* sends two (possibly entangled) quantum programs $(\mathpzc{D}_{0},\mathpzc{D}_{1})$ with classical inputs and outputs to $\mathpzc{C}$.* 3. 3.

For $b\in\{0,1\}$, $\mathpzc{C}$ chooses $\mathsf{m}^{*}_{b}\leftarrow\mathcal{X}$, generates $\mathsf{ct}^{*}_{b}\leftarrow\mathsf{Enc}(\mathsf{ek},\mathsf{m}^{*}_{b})$, and runs $\mathpzc{D}_{b}$ on input $\mathsf{ct}^{*}_{b}$ to obtain an output $\mathsf{m}_{b}$. $\mathpzc{C}$ outputs $1$ if $\mathsf{m}_{b}=\mathsf{m}^{*}_{b}$ for $b\in\{0,1\}$ and otherwise outputs [math] as the final output of the experiment.

For any QPT $\mathpzc{A}$, it holds that

[TABLE]

We prove the following theorem.

Theorem A.3.

If there exists an SDE scheme that satisfies random challenge anti-piracy, there exists an IND-KLA secure PKE-SKL scheme.

Proof.

Let $\mathsf{SDE}=(\mathsf{SDE}.\mathpzc{KG},\mathsf{SDE}.\mathsf{Enc},\mathsf{SDE}.\mathpzc{Dec})$ be an SDE scheme that satisfies random challenge anti-piracy. By Theorem 3.9, it suffices to construct a one-query OW-KLA secure PKE-SKL scheme. We construct a one-query OW-KLA secure PKE-SKL scheme $\mathsf{SKL}=(\mathsf{SKL}.\mathpzc{KG},\mathsf{SKL}.\mathsf{Enc},\mathsf{SKL}.\mathpzc{Dec},\mathsf{SKL}.\mathpzc{Vrfy})$ as follows.

$\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$:

Run $(\mathsf{sde}.\mathsf{ek},\mathsf{sde}.\mathpzc{dk})\leftarrow\mathsf{SDE}.\mathpzc{KG}(1^{\lambda})$ and output $\mathsf{skl}.\mathsf{ek}\coloneqq\mathsf{sde}.\mathsf{ek}$, $\mathsf{skl}.\mathpzc{dk}\coloneqq\mathsf{sde}.\mathpzc{dk}$, and $\mathsf{skl}.\mathsf{vk}\coloneqq\mathsf{sde}.\mathsf{ek}$.

$\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek},\mathsf{m})$:

This is identical to $\mathsf{SDE}.\mathsf{Enc}$.

$\mathsf{SKL}.\mathpzc{Dec}(\mathpzc{dk},\mathsf{ct})$:

This is identical to $\mathsf{SDE}.\mathpzc{Dec}$.

$\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk},\mathsf{skl}.\widetilde{\mathpzc{dk}})$:

Parse $\mathsf{skl}.\mathsf{vk}=\mathsf{sde}.\mathsf{ek}$, choose $\mathsf{m}^{*}\leftarrow\mathcal{X}$, run $\mathsf{ct}^{*}\leftarrow\mathsf{SDE}.\mathsf{Enc}(\mathsf{sde}.\mathsf{ek},\mathsf{m}^{*})$ and $\mathsf{m}\leftarrow\mathsf{SDE}.\mathpzc{Dec}(\mathsf{skl}.\widetilde{\mathpzc{dk}},\mathsf{ct}^{*})$, and output $\top$ if and only if $\mathsf{m}=\mathsf{m}^{*}$.

Suppose that $\mathsf{SKL}$ is not one-query OW-KLA secure. Let $\mathpzc{A}$ be a QPT adversary that breaks the one-query OW-KLA security of $\mathsf{SKL}$. We construct a QPT adversary $\mathpzc{B}$ that breaks the random challenge anti-piracy of $\mathsf{SDE}$ as follows.

$\mathpzc{B}(\mathsf{sde}.\mathsf{ek},\mathsf{sde}.\mathpzc{dk})$:

Set $\mathsf{skl}.\mathsf{ek}\coloneqq\mathsf{sde}.\mathsf{ek}$, $\mathsf{skl}.\mathpzc{dk}\coloneqq\mathsf{sde}.\mathpzc{dk}$, and $\mathsf{skl}.\mathsf{vk}\coloneqq\mathsf{sde}.\mathsf{ek}$ and sends $(\mathsf{skl}.\mathsf{ek},\mathsf{skl}.\mathpzc{dk},\mathsf{skl}.\mathsf{vk})$ to $\mathpzc{A}$. When $\mathpzc{A}$ makes a verification query $\mathsf{skl}.\widetilde{\mathpzc{dk}}$, $\mathpzc{B}$ returns $1$ to $\mathpzc{A}$ as the response from the oracle. Let $\mathpzc{D}_{0}$ be the quantum program with classical inputs and outputs that takes $\mathsf{ct}$ as input and outputs $\mathsf{m}\leftarrow\mathsf{SDE}.\mathpzc{Dec}(\mathsf{skl}.\widetilde{\mathpzc{dk}},\mathsf{ct})$. When $\mathpzc{A}$ sends $\mathsf{RequestChallenge}$, let $\mathpzc{D}_{1}$ be the quantum program with classical inputs and outputs, in which $\mathpzc{A}$’s internal state is hardwired, that takes $\mathsf{ct}$ as input, runs the rest of $\mathpzc{A}$ on the challenge ciphertext $\mathsf{ct}$, and outputs $\mathpzc{A}$’s output $\mathsf{m}$. Output $(\mathpzc{D}_{0},\mathpzc{D}_{1})$.

By the construction of $\mathpzc{B}$ and the deferred measurement principle, it is immediate to see that $\mathsf{Adv}_{\mathsf{SDE},\mathpzc{B}}^{\mathsf{rand}\mbox{-}\mathsf{chal}}(\lambda)=\mathsf{Adv}_{\mathsf{SKL},\mathpzc{A}}^{\mathsf{ow}\mbox{-}\mathsf{kla}}(\lambda)$. Thus, $\mathpzc{B}$ breaks the random challenge anti-piracy of $\mathsf{SDE}$, which is contradiction. Therefore, $\mathsf{SKL}$ is one-query OW-KLA secure. ∎

Remark A.4 (On CPA-Style Anti-Piracy).

We do not know if SDE with CPA-style anti-piracy implies PKE-SKL. On the other hand, it seems possible to show that SDE with the “strong” variant of CPA-style anti-piracy (called strong anti piracy [CLLZ21, Definition 6.11 in the full version]) implies PKE-SKL. In the single-bit encryption setting, the security roughly means that the adversary given one decryption key cannot generate two “good” distinguishers that distinguish encryptions of [math] and $1$. Then our idea is to construct a PKE-SKL scheme whose verification algorithm accepts if a returned decryption key gives a “good” distinguisher. Then the strong anti piracy ensures that if the adversary passes the verification, then it cannot keep a “good” distinguisher, which in particular means that it cannot distinguish encryptions of [math] and $1$. Thus, the PKE-SKL scheme is one-query IND-KLA secure.

Appendix B OW-CPA from CoIC-KLA

We show the following lemma.

Lemma B.1.

If a PKE scheme with a super-polynomial-size message space is CoIC-KLA secure, then it is OW-CPA secure.

Proof.

Let $\mathsf{PKE}=(\mathsf{KG},\mathsf{Enc},\mathsf{Dec})$ be a CoIC-KLA secure PKE scheme with the message space $\mathcal{X}$ such that $|\mathcal{X}|$ is super-polynomial in $\lambda$. Toward contradiction, suppose that it is not OW-CPA secure. Let $\mathpzc{A}$ be an adversary that breaks OW-CPA security of $\mathsf{PKE}$. Then we construct $\mathpzc{B}$ that breaks CoIC-KLA security of $\mathsf{PKE}$ as follows.

$\mathpzc{B}(\mathsf{ek}_{0},\mathsf{ek}_{1},\mathpzc{dk})$:

Measure $\mathpzc{dk}$ to get $(\beta,\mathsf{dk}_{\beta})$ for $\beta\in\{0,1\}$. Choose $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})\leftarrow\mathcal{X}^{2}$ and send $(\mathsf{m}_{0}^{*},\mathsf{m}_{1}^{*})$ to the challenger (without making any oracle query). Upon receiving $(\mathsf{ct}^{*}_{0},\mathsf{ct}^{*}_{1})$ from the challenger, run $\mathsf{m}_{\beta}^{\prime}\leftarrow\mathsf{Dec}(\mathsf{dk}_{\beta},\mathsf{ct}^{*}_{\beta})$ and $\mathsf{m}_{\beta\oplus 1}^{\prime}\leftarrow\mathpzc{A}(\mathsf{ek}_{\beta\oplus 1},\mathsf{ct}^{*}_{\beta\oplus 1})$ and output [math] if $\mathsf{m}_{0}^{\prime}=\mathsf{m}_{1}^{\prime}$ and $1$ otherwise.

Note that the challenger implicitly chooses $a,b\leftarrow\{0,1\}$ and generates $\mathsf{ct}^{*}_{0}\leftarrow\mathsf{Enc}(\mathsf{ek}_{0},\mathsf{m}^{*}_{a})$ and $\mathsf{ct}^{*}_{1}\leftarrow\mathsf{Enc}(\mathsf{ek}_{1},\mathsf{m}^{*}_{a\oplus b})$. $\mathpzc{B}$’s goal is to guess $b$.

If $b=0$, by the correctness of $\mathsf{PKE}$, we have $\Pr[\mathsf{m}^{\prime}_{\beta}=\mathsf{m}^{*}_{a}]=1-{\mathsf{negl}}(\lambda)$. By the assumption that $\mathpzc{A}$ breaks OW-CPA security, $\Pr[\mathsf{m}^{\prime}_{\beta\oplus 1}=\mathsf{m}^{*}_{a}]$ is non-negligible. In particular, $\Pr[\mathpzc{B}(\mathsf{ek}_{0},\mathsf{ek}_{1},\mathpzc{dk})\rightarrow 0|b=0]$ is non-negligible. If $b=1$, by the correctness of $\mathsf{PKE}$, we have $\Pr[\mathsf{m}^{\prime}_{\beta}=\mathsf{m}^{*}_{a+\beta}]=1-{\mathsf{negl}}(\lambda)$. On the other hand, $\mathsf{ct}^{*}_{\beta\oplus 1}$ contains no information of $\mathsf{m}^{*}_{a\oplus\beta}$. Therefore, $\Pr[\mathsf{m}^{\prime}_{\beta\oplus 1}=\mathsf{m}^{*}_{a\oplus\beta}]\leq 1/|\mathcal{X}|={\mathsf{negl}}(\lambda)$. Thus, $\Pr[\mathpzc{B}(\mathsf{ek}_{0},\mathsf{ek}_{1},\mathpzc{dk})\rightarrow 0|b=1]={\mathsf{negl}}(\lambda)$. Thus, $|2\Pr[\mathpzc{B}(\mathsf{ek}_{0},\mathsf{ek}_{1},\mathpzc{dk})\rightarrow b]-1|=|\Pr[\mathpzc{B}(\mathsf{ek}_{0},\mathsf{ek}_{1},\mathpzc{dk})\rightarrow 0|b=0]-\Pr[\mathpzc{B}(\mathsf{ek}_{0},\mathsf{ek}_{1},\mathpzc{dk})\rightarrow 0|b=1]|$ is non-negligible. This contradicts the assumed CoIC-KLA security. Thus, $\mathsf{PKE}$ is OW-CPA secure. ∎

Appendix C Deferred Proofs for PKFE-SKL

In this section, we present the deferred proofs in Section 7.

Lemma C.1.

If $\mathsf{PKFE}$ is adaptively secure, it holds that $\absolutevalue{\Pr[\mathsf{Hyb}_{1}=1]-\Pr[\mathsf{Hyb}_{2}=1]}={\mathsf{negl}}(\lambda)$.

Proof.

We construct an adversary $\mathpzc{B}$ for $\mathsf{PKFE}$ by using the distinguisher $\mathpzc{D}$ for these two games.

$\mathpzc{B}$ is given $\mathsf{fe}.\mathsf{pk}$ and sends $\mathsf{pk}\coloneqq\mathsf{fe}.\mathsf{pk}$ to $\mathpzc{D}$. $\mathpzc{B}$ also generates $\mathsf{ske}.\mathsf{sk}\leftarrow\{0,1\}^{\lambda}$ and $\mathsf{skfe}.\mathsf{msk}\leftarrow\mathsf{SKFE}.\mathsf{Setup}(1^{\lambda})$. 2. 2.

When $\mathpzc{D}$ sends $f_{i}$ to $O_{\mathtt{\mathpzc{KG}}}$, $\mathpzc{B}$ generates $(\mathsf{skl}.\mathsf{ek}_{i},\mathsf{skl}.\mathpzc{sk}_{i},\mathsf{skl}.\mathsf{vk}_{i})\leftarrow\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$, $\mathsf{skfe}.\mathsf{sk}_{i}\leftarrow\mathsf{SKFE}.\mathsf{KG}(\mathsf{skfe}.\mathsf{msk},V[f_{i},\mathsf{skl}.\mathsf{ek}_{i}])$, and $\mathsf{ske}.\mathsf{ct}_{i}\leftarrow\mathsf{SKE}.\mathsf{Enc}(\mathsf{ske}.\mathsf{sk},\mathsf{skfe}.\mathsf{sk}_{i})$. Then, $\mathpzc{B}$ sends $W[f_{i},\mathsf{skl}.\mathsf{ek}_{i},\mathsf{ske}.\mathsf{ct}_{i}]$ to its challenger and receives $\mathsf{fe}.\mathsf{sk}_{W,i}\leftarrow\mathsf{FE}.\mathsf{KG}(\mathsf{fe}.\mathsf{msk},W[f_{i},\mathsf{skl}.\mathsf{ek}_{i},\mathsf{ske}.\mathsf{ct}_{i}])$. $\mathpzc{B}$ returns $\mathpzc{fsk}_{i}\coloneqq(\mathsf{fe}.\mathsf{sk}_{W,i},\mathsf{skl}.\mathpzc{sk}_{i})$ to $\mathpzc{D}$ and adds $(f_{i},\mathsf{skl}.\mathsf{vk}_{i},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$. 3. 3.

When $\mathpzc{D}$ sends $(f_{i},\mathpzc{fsk}_{i}^{\prime})$ to $O_{\mathtt{\mathpzc{Vrfy}}}$, $\mathpzc{B}$ finds an entry $(f_{i},\mathsf{skl}.\mathsf{vk}_{i},V_{i})$ from $L_{\mathtt{\mathpzc{KG}}}$ and parses $\mathpzc{fsk}_{i}^{\prime}=(\mathsf{fe}.\mathsf{sk}_{i}^{\prime},\mathsf{skl}.\mathpzc{sk}_{i}^{\prime})$. $\mathpzc{B}$ returns $d\coloneqq\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk}_{i},\mathsf{skl}.\mathpzc{sk}_{i}^{\prime})$. If $V_{i}=\top$, $\mathpzc{B}$ does not update the entry. Otherwise, $\mathpzc{B}$ updates the entry by setting $V_{i}\coloneqq d$. 4. 4.

When $\mathpzc{D}$ sends $(x_{0}^{\ast},x_{1}^{\ast})$, $\mathpzc{B}$ generates $\mathsf{K}\leftarrow\mathsf{PRF}.\mathsf{Gen}(1^{\lambda})$, $\mathsf{skfe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x_{0}^{\ast},\bot,\mathsf{K},0,\bot))$. $\mathpzc{B}$ sets $X_{0}^{\ast}\coloneqq(x_{0}^{\ast}\|0^{\ell_{\mathsf{pad}}},\bot,\mathsf{K})$ and $X_{1}^{\ast}\coloneqq(\mathsf{skfe}.\mathsf{ct}^{\ast},\mathsf{ske}.\mathsf{sk},\bot)$, sends $(X_{0}^{\ast},X_{1}^{\ast})$ to its challenger, and receives $\mathsf{fe}.\mathsf{ct}^{\ast}$. $\mathpzc{B}$ passes $\mathsf{ct}^{\ast}\coloneqq\mathsf{fe}.\mathsf{ct}^{\ast}$ to $\mathpzc{D}$. 5. 5.

$\mathpzc{B}$ outputs what $\mathpzc{D}$ outputs.

By the definition of $W$ described in Figure 1, if we decrypt $\mathsf{fe}.\mathsf{ct}^{\ast}$ by $\mathsf{fe}.\mathsf{sk}_{W,i}$, we obtain

• •

$\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{i},f(x_{0});\mathsf{F}_{\mathsf{K}}(\mathsf{skl}.\mathsf{ek}_{i}))$ if $\mathsf{fe}.\mathsf{ct}^{\ast}$ is generated from $X_{0}^{\ast}$,

• •

$z_{i}=\mathsf{SKFE}.\mathsf{Dec}(\mathsf{skfe}.\mathsf{sk}_{i},\mathsf{skfe}.\mathsf{ct}^{\ast})$ if $\mathsf{fe}.\mathsf{ct}^{\ast}$ is generated from $X_{1}^{\ast}$ since $\mathsf{ske}.\mathsf{ct}_{i}$ is a ciphertext of $\mathsf{skfe}.\mathsf{sk}_{i}$, where $\mathsf{skfe}.\mathsf{ct}^{\ast}=\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},(x_{0}^{\ast},\bot,\mathsf{K},0,\bot))$. By the correctness of $\mathsf{SKFE}$ and the definition of $T[f_{i},\mathsf{skl}.\mathsf{ek}_{i}]$, it holds that $z_{i}=\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{i},f(x_{0}^{\ast});\mathsf{F}_{\mathsf{K}}(\mathsf{skl}.\mathsf{ek}_{i}))$.

That is, for all $i\in[q]$, it holds that $W[f_{i},\mathsf{skl}.\mathsf{ek}_{i},\mathsf{ske}.\mathsf{ct}_{i}](X_{0}^{\ast})=W[f_{i},\mathsf{skl}.\mathsf{ek}_{i},\mathsf{ske}.\mathsf{ct}_{i}](X_{1}^{\ast})$, and $\mathpzc{B}$ is a valid adversary of PKFE.

It is easy to see that if $\mathsf{fe}.\mathsf{ct}^{\ast}$ is an encryption of $X_{0}^{\ast}$ and $X_{1}^{\ast}$, $\mathpzc{B}$ perfectly simulates $\mathsf{Hyb}_{1}$ and $\mathsf{Hyb}_{2}$, respectively. This completes the proof. ∎

Lemma C.2.

If $\mathsf{SKFE}$ is adaptively single-ciphertext function private, it holds that $\absolutevalue{\Pr[\mathsf{Hyb}_{2}=1]-\Pr[\mathsf{Hyb}_{3}=1]}={\mathsf{negl}}(\lambda)$.

Proof.

We construct an adversary $\mathpzc{B}$ for $\mathsf{SKFE}$ by using the distinguisher $\mathpzc{D}$ for these two games.

$\mathpzc{B}$ generates $(\mathsf{fe}.\mathsf{pk},\mathsf{fe}.\mathsf{msk})\leftarrow\mathsf{FE}.\mathsf{Setup}(1^{\lambda})$ and $\mathsf{ske}.\mathsf{sk}\leftarrow\{0,1\}^{\lambda}$, and sends $\mathsf{pk}\coloneqq\mathsf{fe}.\mathsf{pk}$ to $\mathpzc{D}$. 2. 2.

When $\mathpzc{D}$ sends $f_{i}$ to $O_{\mathtt{\mathpzc{KG}}}$, $\mathpzc{B}$ generates $(\mathsf{skl}.\mathsf{ek}_{i},\mathsf{skl}.\mathpzc{sk}_{i},\mathsf{skl}.\mathsf{vk}_{i})\leftarrow\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$, sends a key query $(F_{0,i},F_{1,i})\coloneqq(T[f_{i},\mathsf{skl}.\mathsf{ek}_{i}],T_{\mathsf{hyb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i])$ to its challenger, and receives $\mathsf{skfe}.\mathsf{sk}_{i}$. $\mathpzc{B}$ also generates $\mathsf{ske}.\mathsf{ct}_{i}\leftarrow\mathsf{SKE}.\mathsf{Enc}(\mathsf{ske}.\mathsf{sk},\mathsf{skfe}.\mathsf{sk}_{i})$ and $\mathsf{fe}.\mathsf{sk}_{W,i}\leftarrow\mathsf{FE}.\mathsf{KG}(\mathsf{fe}.\mathsf{msk},W[f_{i},\mathsf{skl}.\mathsf{ek}_{i},\mathsf{ske}.\mathsf{ct}_{i}])$. $\mathpzc{B}$ returns $\mathpzc{fsk}_{i}\coloneqq(\mathsf{fe}.\mathsf{sk}_{W,i},\mathsf{skl}.\mathpzc{sk}_{i})$ to $\mathpzc{D}$ and adds $(f_{i},\mathsf{skl}.\mathsf{vk}_{i},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$. 3. 3.

When $\mathpzc{D}$ sends $(f_{i},\mathpzc{fsk}_{i}^{\prime})$ to $O_{\mathtt{\mathpzc{Vrfy}}}$, $\mathpzc{B}$ finds an entry $(f_{i},\mathsf{skl}.\mathsf{vk}_{i},V_{i})$ from $L_{\mathtt{\mathpzc{KG}}}$ and parses $\mathpzc{fsk}_{i}^{\prime}=(\mathsf{fe}.\mathsf{sk}_{i}^{\prime},\mathsf{skl}.\mathpzc{sk}_{i}^{\prime})$. $\mathpzc{B}$ returns $d\coloneqq\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk}_{i},\mathsf{skl}.\mathpzc{sk}_{i}^{\prime})$. If $V_{i}=\top$, $\mathpzc{B}$ does not update the entry. Otherwise, $\mathpzc{B}$ updates the entry by setting $V_{i}\coloneqq d$. 4. 4.

When $\mathpzc{D}$ sends $(x_{0}^{\ast},x_{1}^{\ast})$, $\mathpzc{B}$ generates $\mathsf{K}\leftarrow\mathsf{PRF}.\mathsf{Gen}(1^{\lambda})$, sets $X_{0}^{\ast}\coloneqq(x_{0}^{\ast},\bot,\mathsf{K},0,\bot)$ and $X_{1}^{\ast}\coloneqq(x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},0,\bot)$, sends an encryption query $(X_{0}^{\ast},X_{1}^{\ast})$ to its challenger, and receives $\mathsf{skfe}.\mathsf{ct}^{\ast}$. $\mathpzc{B}$ also generates $\mathsf{fe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{FE}.\mathsf{Enc}(\mathsf{fe}.\mathsf{pk},(\mathsf{skfe}.\mathsf{ct}^{\ast},\mathsf{ske}.\mathsf{sk},\bot))$ and passes $\mathsf{ct}^{\ast}\coloneqq\mathsf{fe}.\mathsf{ct}^{\ast}$ to $\mathpzc{D}$. 5. 5.

$\mathpzc{B}$ outputs what $\mathpzc{D}$ outputs.

Since $i\in[q]$, it holds that $T_{\mathsf{hyb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i](x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},0,\bot)=T[f_{i},\mathsf{skl}.\mathsf{ek}_{i}](x_{0}^{\ast},\bot,\mathsf{K},0,\bot)$ for all $i\in[q]$. That is, $F_{0,i}(X_{0}^{\ast})=F_{1,i}(X_{1}^{\ast})$ for all $i\in[q]$ and $\mathpzc{B}$ is an valid adversary for SKFE.

If $\mathsf{skfe}.\mathsf{ct}^{\ast}$ is an encryption of $X_{0}^{\ast}$ and $\mathsf{skfe}.\mathsf{sk}_{i}$ is a functional decryption key for $F_{0,i}$, $\mathpzc{B}$ perfectly simulate $\mathsf{Hyb}_{2}$. If $\mathsf{skfe}.\mathsf{ct}^{\ast}$ is an encryption of $X_{1}^{\ast}$ and $\mathsf{skfe}.\mathsf{sk}_{i}$ is a functional decryption key for $F_{1,i}$, $\mathpzc{B}$ perfectly simulate $\mathsf{Hyb}_{3}$. This completes the proof. ∎

Lemma C.3.

If $\mathsf{SKFE}$ is adaptively single-ciphertext function private, it holds that $\absolutevalue{\Pr[\mathsf{Hyb}_{3}^{q}=1]-\Pr[\mathsf{Hyb}_{4}=1]}={\mathsf{negl}}(\lambda)$.

Proof.

We construct an adversary $\mathpzc{B}$ for $\mathsf{SKFE}$ by using the distinguisher $\mathpzc{D}$ for these two games.

$\mathpzc{B}$ generates $(\mathsf{fe}.\mathsf{pk},\mathsf{fe}.\mathsf{msk})\leftarrow\mathsf{FE}.\mathsf{Setup}(1^{\lambda})$ and $\mathsf{ske}.\mathsf{sk}\leftarrow\{0,1\}^{\lambda}$, and sends $\mathsf{pk}\coloneqq\mathsf{fe}.\mathsf{pk}$ to $\mathpzc{D}$. 2. 2.

When $\mathpzc{D}$ sends $f_{i}$ to $O_{\mathtt{\mathpzc{KG}}}$, $\mathpzc{B}$ generates $(\mathsf{skl}.\mathsf{ek}_{i},\mathsf{skl}.\mathpzc{sk}_{i},\mathsf{skl}.\mathsf{vk}_{i})\leftarrow\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$, sends a key query $(F_{0,i},F_{1,i})\coloneqq(T_{\mathsf{hyb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i],T[f_{i},\mathsf{skl}.\mathsf{ek}_{i}])$ to its challenger, and receives $\mathsf{skfe}.\mathsf{sk}_{i}$. $\mathpzc{B}$ also generates $\mathsf{ske}.\mathsf{ct}_{i}\leftarrow\mathsf{SKE}.\mathsf{Enc}(\mathsf{ske}.\mathsf{sk},\mathsf{skfe}.\mathsf{sk}_{i})$ and $\mathsf{fe}.\mathsf{sk}_{W,i}\leftarrow\mathsf{FE}.\mathsf{KG}(\mathsf{fe}.\mathsf{msk},W[f_{i},\mathsf{skl}.\mathsf{ek}_{i},\mathsf{ske}.\mathsf{ct}_{i}])$. $\mathpzc{B}$ returns $\mathpzc{fsk}_{i}\coloneqq(\mathsf{fe}.\mathsf{sk}_{W,i},\mathsf{skl}.\mathpzc{sk}_{i})$ to $\mathpzc{D}$ and adds $(f_{i},\mathsf{skl}.\mathsf{vk}_{i},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$. 3. 3.

When $\mathpzc{D}$ sends $(f_{i},\mathpzc{fsk}_{i}^{\prime})$ to $O_{\mathtt{\mathpzc{Vrfy}}}$, $\mathpzc{B}$ finds an entry $(f_{i},\mathsf{skl}.\mathsf{vk}_{i},V_{i})$ from $L_{\mathtt{\mathpzc{KG}}}$ and parses $\mathpzc{fsk}_{i}^{\prime}=(\mathsf{fe}.\mathsf{sk}_{i}^{\prime},\mathsf{skl}.\mathpzc{sk}_{i}^{\prime})$. $\mathpzc{B}$ returns $d\coloneqq\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk}_{i},\mathsf{skl}.\mathpzc{sk}_{i}^{\prime})$. If $V_{i}=\top$, $\mathpzc{B}$ does not update the entry. Otherwise, $\mathpzc{B}$ updates the entry by setting $V_{i}\coloneqq d$. 4. 4.

When $\mathpzc{D}$ sends $(x_{0}^{\ast},x_{1}^{\ast})$, $\mathpzc{B}$ generates $\mathsf{K}\leftarrow\mathsf{PRF}.\mathsf{Gen}(1^{\lambda})$, sets $X_{0}^{\ast}\coloneqq(x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},q,\bot)$ and $X_{1}^{\ast}\coloneqq(x_{1}^{\ast},\bot,\mathsf{K},0,\bot)$, sends an encryption query $(X_{0}^{\ast},X_{1}^{\ast})$ to its challenger, and receives $\mathsf{skfe}.\mathsf{ct}^{\ast}$. $\mathpzc{B}$ also generates $\mathsf{fe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{FE}.\mathsf{Enc}(\mathsf{fe}.\mathsf{pk},(\mathsf{skfe}.\mathsf{ct}^{\ast},\mathsf{ske}.\mathsf{sk},\bot))$ and passes $\mathsf{ct}^{\ast}\coloneqq\mathsf{fe}.\mathsf{ct}^{\ast}$ to $\mathpzc{D}$. 5. 5.

$\mathpzc{B}$ outputs what $\mathpzc{D}$ outputs.

By the definition of $T_{\mathsf{hyb}}$ and $T$, it holds that for all $i\in[q]$,

[TABLE]

That is, $F_{0,i}(X_{0}^{\ast})=F_{1,i}(X_{1}^{\ast})$ for all $i\in[q]$ and $\mathpzc{B}$ is an valid adversary for SKFE.

If $\mathsf{skfe}.\mathsf{ct}^{\ast}$ is an encryption of $X_{0}^{\ast}$ and $\mathsf{skfe}.\mathsf{sk}_{i}$ is a functional decryption key for $F_{0,i}$, $\mathpzc{B}$ perfectly simulate $\mathsf{Hyb}_{3}^{q}$. If $\mathsf{skfe}.\mathsf{ct}^{\ast}$ is an encryption of $X_{1}^{\ast}$ and $\mathsf{skfe}.\mathsf{sk}_{i}$ is a functional decryption key for $F_{1,i}$, $\mathpzc{B}$ perfectly simulate $\mathsf{Hyb}_{4}$. This completes the proof. ∎

Lemma C.4.

If $\mathsf{SKFE}$ is adaptively single-ciphertext function private, it holds that $\absolutevalue{\Pr[\mathsf{G}_{0}=1]-\Pr[\mathsf{G}_{1}=1]}={\mathsf{negl}}(\lambda)$.

Proof.

We construct an adversary $\mathpzc{B}$ for $\mathsf{SKFE}$ by using the distinguisher $\mathpzc{D}$ for these two games.

$\mathpzc{B}$ generates $(\mathsf{fe}.\mathsf{pk},\mathsf{fe}.\mathsf{msk})\leftarrow\mathsf{FE}.\mathsf{Setup}(1^{\lambda})$ and $\mathsf{ske}.\mathsf{sk}\leftarrow\{0,1\}^{\lambda}$, and sends $\mathsf{pk}\coloneqq\mathsf{fe}.\mathsf{pk}$ to $\mathpzc{D}$. 2. 2.

When $\mathpzc{D}$ sends $f_{i}$ to $O_{\mathtt{\mathpzc{KG}}}$, $\mathpzc{B}$ generates $(\mathsf{skl}.\mathsf{ek}_{i},\mathsf{skl}.\mathpzc{sk}_{i},\mathsf{skl}.\mathsf{vk}_{i})\leftarrow\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$, sends a key query $(F_{0,i},F_{1,i})\coloneqq(T_{\mathsf{hyb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i],T_{\mathsf{emb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i])$ to its challenger, and receives $\mathsf{skfe}.\mathsf{sk}_{i}$. $\mathpzc{B}$ also generates $\mathsf{ske}.\mathsf{ct}_{i}\leftarrow\mathsf{SKE}.\mathsf{Enc}(\mathsf{ske}.\mathsf{sk},\mathsf{skfe}.\mathsf{sk}_{i})$ and $\mathsf{fe}.\mathsf{sk}_{W,i}\leftarrow\mathsf{FE}.\mathsf{KG}(\mathsf{fe}.\mathsf{msk},W[f_{i},\mathsf{skl}.\mathsf{ek}_{i},\mathsf{ske}.\mathsf{ct}_{i}])$. $\mathpzc{B}$ returns $\mathpzc{fsk}_{i}\coloneqq(\mathsf{fe}.\mathsf{sk}_{W,i},\mathsf{skl}.\mathpzc{sk}_{i})$ to $\mathpzc{D}$ and adds $(f_{i},\mathsf{skl}.\mathsf{vk}_{i},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$. 3. 3.

When $\mathpzc{D}$ sends $(f_{i},\mathpzc{fsk}_{i}^{\prime})$ to $O_{\mathtt{\mathpzc{Vrfy}}}$, $\mathpzc{B}$ finds an entry $(f_{i},\mathsf{skl}.\mathsf{vk}_{i},V_{i})$ from $L_{\mathtt{\mathpzc{KG}}}$ and parses $\mathpzc{fsk}_{i}^{\prime}=(\mathsf{fe}.\mathsf{sk}_{i}^{\prime},\mathsf{skl}.\mathpzc{sk}_{i}^{\prime})$. $\mathpzc{B}$ returns $d\coloneqq\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk}_{i},\mathsf{skl}.\mathpzc{sk}_{i}^{\prime})$. If $V_{i}=\top$, $\mathpzc{B}$ does not update the entry. Otherwise, $\mathpzc{B}$ updates the entry by setting $V_{i}\coloneqq d$. 4. 4.

When $\mathpzc{D}$ sends $(x_{0}^{\ast},x_{1}^{\ast})$, $\mathpzc{B}$ generates $\mathsf{K}\leftarrow\mathsf{PRF}.\mathsf{Gen}(1^{\lambda})$ and $\mathsf{skl}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{j},f_{j}(x_{0}^{\ast});\mathsf{F}_{\mathsf{K}}(\mathsf{skl}.\mathsf{ek}_{j}))$, sets $X_{0}^{\ast}\coloneqq(x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},j-1,\bot)$ and $X_{1}^{\ast}\coloneqq(x_{0}^{\ast},x_{1}^{\ast},\mathsf{K},j,\mathsf{skl}.\mathsf{ct}^{\ast})$, sends an encryption query $(X_{0}^{\ast},X_{1}^{\ast})$ to its challenger, and receives $\mathsf{skfe}.\mathsf{ct}^{\ast}$. $\mathpzc{B}$ generates $\mathsf{fe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{FE}.\mathsf{Enc}(\mathsf{fe}.\mathsf{pk},(\mathsf{skfe}.\mathsf{ct}^{\ast},\mathsf{ske}.\mathsf{sk},\bot))$ and passes $\mathsf{ct}^{\ast}\coloneqq\mathsf{fe}.\mathsf{ct}^{\ast}$ to $\mathpzc{D}$. 5. 5.

$\mathpzc{B}$ outputs what $\mathpzc{D}$ outputs.

By the definitions of $T_{\mathsf{hyb}}$ and $T_{\mathsf{emb}}$, it holds that

[TABLE]

for all $i\in[j,q]$ since $\mathsf{skl}.\mathsf{ct}^{\ast}$ is an encryption of $f_{j}(x_{0})$. it also holds that

[TABLE]

for all $i\in[1,j-1]$. Hence, for all $i\in[q]$, it holds that $F_{0,i}(X_{0}^{\ast})=F_{1,i}(X_{1}\ast)$ and $\mathpzc{B}$ is an valid adversary for SKFE. If $\mathsf{skfe}.\mathsf{ct}^{\ast}$ is an encryption of $X_{0}^{\ast}$ and $\mathsf{skfe}.\mathsf{sk}_{i}$ is a functional decryption key for $F_{0,i}$, $\mathpzc{B}$ perfectly simulate $\mathsf{G}_{0}$. If $\mathsf{skfe}.\mathsf{ct}^{\ast}$ is an encryption of $X_{1}^{\ast}$ and $\mathsf{skfe}.\mathsf{sk}_{i}$ is a functional decryption key for $F_{1,i}$, $\mathpzc{B}$ perfectly simulate $\mathsf{G}_{1}$. This completes the proof. ∎

Lemma C.5.

If $\mathsf{SKL}$ IND-KLA, it holds that $\absolutevalue{\Pr[\mathsf{G}_{3}=1]-\Pr[\mathsf{G}_{4}=1]}={\mathsf{negl}}(\lambda)$.

Proof.

We focus on the case where the adversary returns a valid $\mathpzc{fsk}_{j}=(\mathsf{fe}.\mathsf{sk}_{W,j},\mathsf{skl}.\mathpzc{sk}_{j})$, which is the answer to the $j$-th key query, since $f_{j}(x_{0}^{\ast})=f_{j}(x_{1}^{\ast})$ must hold if $\mathpzc{fsk}_{j}$ is not returned. Hence $f_{j}(x_{0}^{\ast})\neq f_{j}(x_{1}^{\ast})$ is allowed in this case.

We construct an adversary $\mathpzc{B}$ for $\mathsf{SKL}$ by using the distinguisher $\mathpzc{D}$ for these two games.

$\mathpzc{B}$ is given $(\mathsf{skl}.\mathsf{ek}^{\ast},\mathsf{skl}.\mathpzc{sk}^{\ast})$ and sets $(\mathsf{skl}.\mathsf{ek}_{j},\mathsf{skl}.\mathsf{ek}_{j})\coloneqq(\mathsf{skl}.\mathsf{ek}^{\ast},\mathsf{skl}.\mathpzc{sk}^{\ast})$. 2. 2.

$\mathpzc{B}$ generates $(\mathsf{fe}.\mathsf{pk},\mathsf{fe}.\mathsf{msk})\leftarrow\mathsf{FE}.\mathsf{Setup}(1^{\lambda})$, $\mathsf{skfe}.\mathsf{msk}\leftarrow\mathsf{SKFE}.\mathsf{Setup}(1^{\lambda})$, and $\mathsf{ske}.\mathsf{sk}\leftarrow\{0,1\}^{\lambda}$, and sends $\mathsf{pk}\coloneqq\mathsf{fe}.\mathsf{pk}$ to $\mathpzc{D}$. 3. 3.

When $\mathpzc{D}$ sends the $i$-th query $f_{i}$ to $O_{\mathtt{\mathpzc{KG}}}$, if $i\neq j$, $\mathpzc{B}$ generates $(\mathsf{skl}.\mathsf{ek}_{i},\mathsf{skl}.\mathpzc{sk}_{i},\mathsf{skl}.\mathsf{vk}_{i})\leftarrow\mathsf{SKL}.\mathpzc{KG}(1^{\lambda})$. For all $i\in[q]$, $\mathpzc{B}$ generates $\mathsf{skfe}.\mathsf{sk}_{i}\leftarrow\mathsf{SKFE}.\mathsf{KG}(\mathsf{skfe}.\mathsf{msk},T_{\mathsf{emb}}[f_{i},\mathsf{skl}.\mathsf{ek}_{i},i])$, $\mathsf{ske}.\mathsf{ct}_{i}\leftarrow\mathsf{SKE}.\mathsf{Enc}(\mathsf{ske}.\mathsf{sk},\mathsf{skfe}.\mathsf{sk}_{i})$, and $\mathsf{fe}.\mathsf{sk}_{W,i}\leftarrow\mathsf{FE}.\mathsf{KG}(\mathsf{fe}.\mathsf{msk},\allowbreak W[f_{i},\mathsf{skl}.\mathsf{ek}_{i},\mathsf{ske}.\mathsf{ct}_{i}])$, and returns $\mathpzc{fsk}_{i}\coloneqq(\mathsf{fe}.\mathsf{sk}_{W,i},\mathsf{skl}.\mathpzc{sk}_{i})$ to $\mathpzc{D}$. Note that $\mathsf{skl}.\mathpzc{sk}_{j}=\mathsf{skl}.\mathpzc{sk}$ is given from the challenger. If $i\neq j$, $\mathpzc{B}$ adds $(f_{i},\mathsf{skl}.\mathsf{vk}_{i},\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$. If $i=j$, $\mathpzc{B}$ adds $(f_{j},\bot,\bot)$ to $L_{\mathtt{\mathpzc{KG}}}$. 4. 4.

When $\mathpzc{D}$ sends $(f_{i},\mathpzc{fsk}_{i}^{\prime})$ to $O_{\mathtt{\mathpzc{Vrfy}}}$, $\mathpzc{B}$ finds an entry $(f_{i},\mathsf{skl}.\mathsf{vk}_{i},V_{i})$ from $L_{\mathtt{\mathpzc{KG}}}$ and parses $\mathpzc{fsk}_{i}^{\prime}=(\mathsf{fe}.\mathsf{sk}_{i}^{\prime},\mathsf{skl}.\mathpzc{sk}_{i}^{\prime})$.

• •

If $f_{i}\neq f_{j}$, $\mathpzc{B}$ returns $d\coloneqq\mathsf{SKL}.\mathpzc{Vrfy}(\mathsf{skl}.\mathsf{vk}_{i},\mathsf{skl}.\mathpzc{sk}_{i}^{\prime})$ since $\mathsf{skl}.\mathsf{vk}_{i}\neq\bot$. If $V_{i}=\top$ $\mathpzc{B}$ does not update the entry. Otherwise, $\mathpzc{B}$ updates the entry by setting $V_{i}\coloneqq d$.

• •

Else if $f_{i}=f_{j}$, $\mathpzc{B}$ sends $\mathsf{skl}.\mathpzc{sk}_{j}^{\prime}$ to its challenger ($O_{\mathtt{\mathsf{SKL}.\mathpzc{Vrfy}}}$ of IND-KLA), receives the result $d_{j}$, and passes $d_{j}$ to $\mathpzc{D}$. If $V_{j}=\top$, $\mathpzc{B}$ does not update the entry. Otherwise, $\mathpzc{B}$ updates the entry by setting $V_{j}\coloneqq d_{j}$. 5. 5.

When $\mathpzc{D}$ sends $(x_{0}^{\ast},x_{1}^{\ast})$, $\mathpzc{B}$ generates $\mathsf{K}\leftarrow\mathsf{PRF}.\mathsf{Gen}(1^{\lambda})$ and $\mathsf{K}_{\neq\mathsf{skl}.\mathsf{ek}_{j}}=\mathsf{Puncture}(\mathsf{K},\mathsf{skl}.\mathsf{ek}_{j})$, sends $(x_{0}^{\ast},x_{1}^{\ast})$ to its challenger, and receives $\mathsf{skl}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKL}.\mathsf{Enc}(\mathsf{skl}.\mathsf{ek}_{j},f_{j}(x_{\mathsf{coin}}^{\ast}))$. $\mathpzc{B}$ generates $\mathsf{skfe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{SKFE}.\mathsf{Enc}(\mathsf{skfe}.\mathsf{msk},\allowbreak(x_{0}^{\ast},x_{1}^{\ast},\mathsf{K}_{\neq\mathsf{skl}.\mathsf{ek}_{j}},j,\mathsf{skl}.\mathsf{ct}^{\ast}))$ and $\mathsf{fe}.\mathsf{ct}^{\ast}\leftarrow\mathsf{FE}.\mathsf{Enc}(\mathsf{fe}.\mathsf{pk},(\mathsf{skfe}.\mathsf{ct}^{\ast},\mathsf{ske}.\mathsf{sk},\bot))$ and passes $\mathsf{ct}^{\ast}\coloneqq\mathsf{fe}.\mathsf{ct}^{\ast}$ to $\mathpzc{D}$. 6. 6.

$\mathpzc{B}$ outputs what $\mathpzc{D}$ outputs.

It is easy to see that $\mathpzc{B}$ perfectly simulates $\mathsf{G}_{3}$ and $\mathsf{G}_{4}$ if $\mathsf{coin}=0$ and $\mathsf{coin}=1$, respectively. This completes the proof. ∎