A Post-Quantum Secure Lattice-Based Forward-Secure Identity Based Encryption with Applications to Internet of Things Architecture
arXiv:2606.22340v1 [cs.CR] 21 Jun 2026
Abhishek Kumar1 , Vikas Srivastava2,∗ , Sumit Kumar Debnath3 , and Pantelimon Stănică4 Department of Mathematics National Institute of Technology Jamshedpur Jamshedpur-831014, India [email protected] 2 Department of Mathematics National Institute of Technology Warangal, Hanamkonda, Telangana-506004 [email protected], [email protected] 3 Department of Mathematics National Institute of Technology Jamshedpur Jamshedpur-831014, India [email protected] 4 Department of Applied Mathematics Naval Postgraduate School, Monterey, CA 93943, USA [email protected] 1
Abstract. The rapid expansion of the Internet of Things (IoT) has led to an unprecedented scale of data exchange across heterogeneous and resource-constrained devices. Ensuring confidentiality and secure key management in such environments is challenging. Traditional publickey infrastructures require heavy certificate-handling overhead. IdentityBased Encryption (IBE) offers a lightweight alternative by deriving public keys directly from device identities, making it attractive for IoT deployments. However, IoT devices are highly vulnerable to side-channel and key-extraction attacks, motivating the need for Forward-Secure IBE (FS-IBE), where the compromise of a current secret key does not threaten past communications. Existing FS-IBE constructions based on classical hardness assumptions are not secure in the era of post-quantum, while the lattice-based (LWEbased) forward-secure scheme suffer from large key and ciphertext sizes, limiting their suitability for constrained IoT systems. Here, we propose a new lattice-based fs-IBE scheme in the ring setting, relying on the RLWE assumption to achieve post-quantum security and significant efficiency gains. Our design uses trapdoor delegation with a minimal-cover mechanism over a binary tree. It results in compact public parameters and efficient per-epoch key updates. Compared to prior LWE-based constructions, our scheme reduces public key, secret key, and ciphertext sizes, and thus, making it better suited for practical IoT environments. Keywords: Forward Security · Ring-LWE · Identity-Based Encryption · IoT Security · Lattice-Based Cryptography
2
A. Kumar et al.
1
Introduction
The Internet of Things (IoT) represents a modern communication paradigm in which a wide range of physical objects such as devices, sensors, vehicles, and buildings are connected to the Internet. These objects are equipped with embedded electronics, software, and sensing modules that enable data collection and exchange [27]. Many smart IoT applications rely on users’ personal or sensitive information to deliver customised and intelligent services [18, 24]. As the number of IoT devices increases, protecting the privacy and security of transmitted data has become a critical necessity [17]. In general, secure communication between IoT devices is achieved using cryptographic tools. Public-key techniques, including encryption and digital signatures, are commonly deployed to ensure confidentiality, data integrity, and authentication [19, 11]. Although these approaches provide strong security guarantees, they depend heavily on certificate management [8]. This introduces considerable computational and storage overhead, which is not suitable for IoT devices that are resource-constrained. To deal with this limitation, an encryption scheme based on the identity of the user [20] has been explored as an alternative for IoT settings. In IBE, the unique identity of a device, such as its ID number, acts as its public key. A device obtains its secret key from Private Key Generator (PKG) [28]. This eliminates the need for certificates and reduces management complexity [21]. In cryptography, a scheme’s security is ultimately dependent on the protection of secret keys. Studies have shown that side-channel attacks, which exploit power consumption patterns, electromagnetic leakage, or other physical characteristics of IoT devices, can be used to extract these keys [6]. Thus, while IBE removes certificate-related overhead, it is unable to protect against key-extraction attacks. Forward security provides an effective countermeasure in such scenarios. In a forward-secure design, if the current secret key is compromised still the previously shared encrypted data cannot be revealed [4, 13]. This property ensures that past communication remains protected even if an adversary later obtains the private key [26]. Another challenge arises from the fact that most traditional IBE schemes rely on classical hardness assumptions of problems like discrete logarithms or the factorisation of integers. With the help of quantum computers, these assumptions are expected to become insecure. Cryptography based on lattice has appeared as an effective solution, as lattice problems are believed to remain unbreakable even for quantum algorithms [1]. Motivated by this, Jin et al. in [10] proposed a forward-secure IBE construction based hardness assumption of learning with error problem in lattice. However, their solution suffers from efficiency limitations, particularly due to large secret keys and ciphertexts. So, it is an urgent need to design an efficient post-quantum forward secure identity-based encryption scheme for IoTs. 1.1
Related Work
The evolution of forward-secure and identity-based encryption schemes has relied on a wide range of cryptographic foundations, each offering distinct strengths
3
and limitations. Shamir was the first who gave the idea of identity-based encryption in his work [20]. Later in 2001, Boneh el al. proposed a fully functional IBE scheme in [3]. The scheme achieved security against chosen-ciphertext attacks in the random-oracle model based on the variant of the Computational Diffie–Hellman assumption. The construction was formulated using bilinear pairings over appropriate algebraic groups. The construction removed the need for certificate management, but remained vulnerable to quantum adversaries. In 2003, Canetti et al. introduced the concept of binary tree encryption and presented the first non-interactive public-key encryption schemes with forwardsecurity in [4]. The main construction was secure against chosen plaintext attack in the standard model under the decisional bilinear Diffie–Hellman assumption and the parameter sizes were designed to grow only logarithmically with the total epoch. Later, another scheme was formulated in the random-oracle model, which was more efficient and both designs were shown to be extendable to chosen-ciphertext security. But the schemes suffer the threat of quantum attacks along with the associated significant overhead of public key certificates. One year later, a scalable HIBE scheme with forward security was proposed by Yao et al. in [26]. It was further shown that this construction can be adapted to obtain a public-key broadcast encryption scheme with forward security. The fs-HIBE framework was also extended to support collusion-resistant multi-hierarchical identity-based encryption. The security of these schemes was analyzed under the bilinear Diffie–Hellman assumption within the random-oracle model. Despite these advancements, these schemes suffered the risk of quantum attack. Also, the high computational cost affected the scalability in resource-constrained environments like IoTs. Building on these advancements, Lu et al. [14] proposed a practical FS-PKE scheme in 2011 that demonstrates security against selectivetime-period and adaptive chosen-plaintext attacks in the standard model. It is shown that its performance parameter and total epoch are independent of each other, making the scheme more efficient than earlier FS-PKE constructions. It was further demonstrated how chosen-ciphertext security can be obtained in both the standard model as well as the random-oracle model. But again, the scheme relies on hardness assumptions of classical hard problems which are not secure against quantum attack. Moreover, as a public-key encryption system, it inherits the traditional drawbacks of certificate-based infrastructures, including certificate generation, distribution, and revocation overhead. Singh et al. improved their own work [22] by reducing the ciphertext size which is IND-sIDCPA (semantic) secure in the random-oracle model [23]. Though these schemes were secure against quantum attacks but still faced the problem of high computational cost and large key size. Another identity-based encryption from lattice with forward security and additional property of keyword search was given by Yang et al. [25], where the key-management limitations were addressed by extending the FS-PEKS framework into an identity-based setting, leading to the formulation of a lattice-based FS-IBE with keyword search (FS-IBEKS) scheme. And it was proven to have indistinguishable selective-identity chosen-plaintext security model (IND-sID-CPA) within the random-oracle framework. To fur-
4
A. Kumar et al.
ther strengthen the guarantees, an additional FS-IBEKS construction was proposed in the standard model, and its security was proven under adaptive-identity, chosen-plaintext attacks (IND-ID-CPA). Hierarchical Identity-Based Encryption (HIBE) extends the concept of IdentityBased Encryption (IBE) by distributing key generation responsibilities across different hierarchical levels, thereby reducing the workload on the central private key generator. Due to this hierarchical structure, HIBE is well suited for large-scale organizations and distributed systems, as it also helps in limiting the impact of secret key exposure. A lattice-based HIBE construction with improved efficiency and security was proposed in [9]. The authors presented a CPA-secure HIBE scheme based on the Ring Learning With Errors (R-LWE) problem and further extended it to achieve adaptive CCA security under the hardness assumption of the Shortest Vector Problem (SVP). However, the scheme does not provide forward security, which is an important requirement in IoT applications where long-term key exposure can compromise previously transmitted data. In 2024, Jin et al. [10] constructed an IBE scheme with forward security based on lattice for Internet of Things (IoTs), secure against quantum attacks. It is built on the hardness assumption of LWE. The scheme employs a mechanism of minimal-cover within a binary-tree structure, and its security is rigorously proven to possess forward-secure, selective-identity, chosen-plaintext attack model. It has also indistinguishable selective ID chosen ciphertext attack security. But the scheme is not efficient due to higher communication and storage overhead for IoT devices. The trade-off between efficiency, security level, and post-quantum resilience in these cryptographic constructions are summarized in Table 1.
1.2
Our Contribution
In this work, we put forward a new lattice-based fs-IBE scheme in the ring setting. We now summarize the important technical contribution of our work. – We design the first, to the best of our knowledge, RLWE-based forwardsecure IBE scheme (namely RFS-IBE) that combines a binary tree structure with the minimal-cover mechanism and trapdoor delegation over ideal lattices. The construction supports per-epoch key updates for each identity while keeping the public parameters compact. – We give a formal security analysis of RFS-IBE and prove that it achieves forward-secure selective-identity CPA security in the random oracle model under the decisional RLWE assumption via a reduction to a dual Regevtype encryption scheme. We further outline how to extend the construction to obtain CCA security using standard transformations. – We optimize the sizes of secret keys, public keys and ciphertexts by working in the ring setting instead of the standard LWE setting. Compared with the lattice-based forward secure of IBE of Jin et al. [10], our scheme achieves strictly smaller key and ciphertext sizes, which directly translates into lower communication and storage overhead for IoT devices.
5 Table 1. Techniques, advantages and limitations of related works Scheme
Cryptographic Techniques
Advantages
Drawbacks/Limitations
Boneh and * Billinear Diffie-Hellman as- *No requirment of public key certificates * Not secure against quantum atFranklin [3] sumption * Secure against Chosen ciphertext attack in tack * Bilinear pairings on elliptic random oracle model cureves *Identity based encryption *Hash function Canetti et al. *Public key encryption * Forward secure against chosen ciphertext at- * Not secure against quantum at[4]. *Hash function tack tack * Efficient key update *Certificate managment problem * Secure against Chosen plaintext attack Yao et al. [26] * Bilinear Diffie-Hellman * Forward secure against chosen ciphertext at- * Large ciphertext size and com(BDH) assumption tack putational overhead * Tree based time evolution of * Not quantum resistance private key * Idetity-based broadcast encryption Lu et al. [14] *Learning with error hardness * Forward secure against selective-time period *Higher storage and computaassumption chosen ciphertext attack(FS-ST-CCA) tional cost *Forward secure public key en- * Forward secure against selective-time period * Load of Certificate managment cryption chosen plaintext attack (FS-ST-CPA) * Not secure against quantum at*Gaussian sampling on lattices tack Singh et al. [23] * Hardness assumption of *Post-quantum security * Large key size and LWE *Forward secure against chosen plaintext at- *High computational cost *Hash functions modeled as a tack *Inefficient random oracle * Shorter ciphertext size *Identity based encryption on lattices Yang et al. [25] *Trapdoor generation and del- * No requirment of public key certificates * High computational cost egation algorithms *Forward secure against chosen plaintext at- * Large ciphertext and key sizes *Decisional learning with error tack *Inefficient *Identity-based encryption on *Post-quantum security lattices Jin et al. [10].
* Learning with error hardness *Postquantum security assumption * Secure against chosen ciphertext attack *Identity based encryption * Secure against Chosen plaintext attack * Mechanism of minimal cover in context of binary tree
*Large key and ciphertext size *complexity of implementation *Inefficient
– We illustrate how RFS-IBE can be integrated into a practical IoT architecture, with a hospital backend server acting as the key generation center and gateways / medical sensors playing the role of IBE users. This case study shows that our construction can protect historical medical data against keyextraction attacks and side-channel leakage while remaining efficient enough for deployment on constrained devices.
2
Preliminaries
Here, we briefly summarise the preliminary information required to understand the proposed protocol. Lets begin with the notations used throughout the paper (refer Table 2). Then we will describe the concept of lattices, like the integer lattice and ideal lattice, along with their hard problems, specifically LWE and RLWE. We will understand the general formation of the forward secure identitybased encryption scheme along with its security model. We will also look at dual Regev type public key encryption based on the RLWE, followed by some important algorithms like ringGenTrap, ringExtBasis, ringRandBasis and ringSampleD.
6
A. Kumar et al.
We will also revisit the concept of binary tree and the trapdoor assignment based on it. 2.1
Notations
The notations that are used throughout this paper are listed in the table 2. Table 2. Table of Notations λ Security parameter Rq The ideal ring given by Rq = Zq [x]/⟨xn + 1⟩. B Probabilistic poly-time algorithm. y ← B(x) Algorithm B take x as input and outputs B(x). ∥si ∥ ℓ2 -norm of the vector si from set of vectors S := {s0 , . . . , sk−1 } ∥S∥ The norm of the set S defined as maxi∈{0,...,k−1} ∥si ∥ The Gram–Schmidt orthogonalization of the vectors in this set. S̃ ∥S̃∥ The Gram–Schmidt norm of S̃ χ The discrete Gaussian distribution
2.2
Lattices background
A lattice, denoted by Λ, in Rn is the set of all integer linear combinations of linearly independent basis vectors B = {b1 , b2 , . . . , bm }: (m ) X Λ(B) = zi bi | zi ∈ Z . i=1
Below, we describe the three families of integer lattices that arise naturally in cryptography. Let q be a positive integer modulus, A ∈ Zn×m a matrix, and q u ∈ Znq a vector. The three commonly used integer lattices are defined as follows: n o Λq (AT ) = z ∈ Zm ∃ s ∈ Znq with AT s ≡ z (mod q) , n z ∈ Zm Az ≡ 0 Λ⊥ (A) = q
o (mod q) ,
n o Λq,u (A) = z ∈ Zm Az ≡ u (mod q) . Discrete Gaussian: Let L be a subset of Zn , c ∈ Rn and r be positive real number. We define ∥x − c∥2 ρr,c (x) = exp −π r2 and for a set L, we let ρr,c (L) =
X x∈L
ρr,c (x).
7
Taking c and r as center and parameter, the discrete Gaussian distribution over R can be defined in the following way: for all x ∈ L DL,r,c (x) =
ρr,c (x) . ρr,c (L)
Today, the hardness of several computational problems over lattices forms the backbone of post-quantum security. In the context of the proposed design, we are mainly concerned with the Ring Learning with Errors and its variants. LWE allows hardness reduction from the worst-case lattice problem, which is hard even for quantum computers. Unfortunately, LWE needs a larger computational time and key size. So, to improve efficiency, we can replace it with Ring LWE and its variants, which supports the construction of post-quantum secure cryptography. 2.3
Ring LWE
For prime q and n as an integer power of 2 the polynomial ring can be defined as Rq = Zq [x]/⟨xn + 1⟩, where and Zq [x] is the set of polynomials over Zq . Each block n × n of the corresponding matrix A can be compactly expressed as a ring element ai ∈ Rq . In the context of polynomial rings, lattices can be defined similarly. Let a ∈ Rqk a vector, and u ∈ Rq . Then the corresponding lattices are given by: n o Λq (a) = z ∈ Rk ∃ s ∈ Rq such that as ≡ z (mod q) , n o T k T Λ⊥ (a ) = z ∈ R a z ≡ 0 (mod q) , q n Λq,u (aT ) = z ∈ Rk aT z ≡ u
o (mod q) .
Ideal Lattice: Consider an ideal I of quotient ring R = Z[x]/⟨xn + 1⟩ then any sublattice of Zn that corresponds to the ideal I is called an ideal lattice. It can be proved easily that the quotient ring R is isomorphic to the ring Zn . Ring-LWE. To describe the LWE in the ring setting, the matrix A is required to satisfy an additional algebraic structure. Each column of A can be interpreted as the coefficient vector of a polynomial p(x) of degree at most n − 1. Moreover, for some polynomial f (x) of degree n, the vector of coefficients corresponding to x · p(x) mod f (x) must also appear as one of the columns of A. If we assume m = nk for an integer k, then the i-th n × n block of A can be identified with a ring element ai ∈ Rq . In this setting, the secret vector s is represented by an element s ∈ R, the error vector e corresponds to (e1 , . . . , ek )T ∈ Rk , and the output vector b is expressed as (b1 , . . . , bk )T ∈ Rqk [16]. The multiplication of a block of A with s is then equivalent to multiplication of the corresponding ring elements ai and s. Hence, the search version of the ring-LWE problem is to determine the secret s given the set of samples {(ai , bi = ai s + ei )}ki=1 .
8
A. Kumar et al.
The decision version instead asks to distinguish such samples from a uniformly random one [12]. Due to this structure, cryptosystems built on ring-LWE assumptions achieve higher efficiency compared to general lattice-based constructions: 1. Matrices of size n × n can be compressed into single ring elements, reducing parameter sizes by about a factor of n. 2. The algebraic structure of ideal lattices allows for faster and more efficient computations. Theorem 1 ([15]). Assuming that no polynomial-time quantum algorithm can approximate the Shortest Vector Problem (SVP) on ideal lattices in R within any polynomial factor, then any polynomially bounded collection of ring-LWE samples is indistinguishable from random for every polynomial-time adversary, including quantum ones.
2.4
General Construction of Forward-Secure Identity-Based Encryption
A forward-secure identity-based encryption (FS-IBE) scheme is described by a collection of five algorithms. C and M denote the ciphertext space and message space respectively [26]: – (params, msk ) ← FS − IBE.Setup(λ, N). The Private Key Generator (PKG) runs the setup procedure by taking the input λ and N as a security parameter and the total epoch in the forward-secure system. It generates the public parameters params and the master secret key msk. – skid,0 ← FS − IBE.KeyGen(params, msk ). Given public parameters params, master secret key msk and a user identity id, the algorithm outputs the initial secret key skid,0 corresponding to identity id. – skid,i+1 ← FS − IBE.Update(params, skid,i ). For params and a key skid,i associated with the pair (id, i), this procedure outputs the next secret key skid,i+1 for interval (i + 1), and securely removes skid,i . – C ← FS − IBE.Encrypt(params, id , M ). On input the public parameters params, the identity id and an intervel pair (id, t) and message M , where M ∈ M, the algorithm produces a ciphertext C ∈ C. – (M or ⊥) ← FS − IBE.Decrypt(params, C , skid,i ) : On input params, ciphertext C, secret key skid,i , with C ∈ C, the algorithm recovers the message M ∈ M or outputs ⊥ if decryption fails. Correctness. If skid,i is generated for the pair (id, i) by either FS-IBE.KeyGen or FS-IBE.Update, then for any M ∈ M, we have FS-IBE.Decrypt(params, FS-IBE.Encrypt(params, (id, i), M ), skid,i ) = M.
9
2.5
Security Model
The security notion for forward-secure IBE follows the framework of [26]. We say that an FS-IBE scheme achieves forward-secure selective-identity chosen ciphertext security (fs-sID-CCA) if there is no adversary of probabilistic time which can succeed in the following game with more than negligible advantage. Initialization: The adversary first commits to a challenge identity id∗ . The challenger executes the FS-IBE.Setup algorithm and sends the public parameters params to the adversary. Phase 1 (Query Stage): For i = 1, . . . , m, the adversary will make qi queries and the challenger react as: – Extraction query (id, j): The challenger generates the corresponding secret key skid,j using FS-IBE.KeyGen and FS-IBE.Update, and returns it to adversary. – Decryption query (id, C, j): The secret key, skid,j is computed by the challenger using FS-IBE.KeyGen and FS-IBE.Update. It recovers the message M corresponding to the ciphertext C with the help of the algorithm FSIBE.Decrypt and provides either the recovered message M or the rejection symbol ⊥. Challenge: Once Phase 1 concludes, messages M0 , M1 ∈ M of equal length, the challenge identity id∗ are submitted by the adversary along with target time period t∗ . The challenger computes C ∗ using FS-IBE.Encrypt(id∗ , t∗ , Mb ) where b is a ramdomly selected bit from {0,1}. and gives C ∗ to the adversary. One restriction applies: the adversary cannot request secret keys for (id∗ , t) with t ≤ t∗ . Phase 2 (Query Stage): For i = m + 1, . . . , n, adversary continues to make queries qi . The challenger reacts as in Phase 1, with the following rules: – Extraction queries remain subject to the same restriction from the challenge step. – Decryption queries (id, C, j) are answered unless (id, C, j) = (id∗ , C ∗ , t∗ ). Guess: The adversary finally give a bit b′ ∈ {0, 1} as output. If b′ is same as b, the adversary is considered successful. We can formulate adversary’s advantage as: AdvA,E = Pr[b = b′ ] − 21 , where A is the adversary and E is the encryption scheme. The above experiment models fs-sID-CCA security. If decryption queries are disallowed in the query phases, the resulting notion corresponds to fs-sID-CPA security. 2.6
RLWE-Based PKE
We now describe a public key encryption scheme that consists of the algorithms Key Generation, Encryption and Decryption. Its depends on the hardness assumption of the RLWE problem. The scheme is shown to be CPA-secure.
10
A. Kumar et al.
Key Generation: The secret key is selected as a short polynomial s ∼ χ. (a, y) is the public key, where a ∈ Rq is chosen uniformly at random and y =a·s+e
(mod qR),
with e ∼ χ being the error polynomial. Encryption: For the encryption of the message m ∈ R{0,1} , i.e., a polynomial with coefficients in {0, 1}, sample random polynomials r, x, x′ ∼ χ, we compute j k q 2 m
(mod q).
Decryption: For decryption, we compute j k b − a · s (mod qR) = 2q m + er + x′ − xs
(mod q).
a = ar + x
(mod q),
b = yr + x′ +
By applying coefficient-wise rounding, the original message polynomial m can be recovered. The scheme is correct provided that the error term er + x′ − xs is bounded by q/4. This condition allows the error size to be chosen on the √ order of q/2. The toughness of the decisional version of Ring-LWE problem with short secrets is used in two steps: first, to argue that uniformly random ring elements can replace the public key and second, to demonstrate that the ciphertext component b is indistinguishable from uniform. This scheme is notably efficient, achieving security that is believed to be of order of 2Ω(n) , while all operations can be carried out in not more than n·polylog(n, q) time. By selecting q = poly(n), we obtain a PKE scheme where key generation, encryption, and decryption are all computable in quasilinear time with respect to the security parameter. Furthermore, Lyubashevsky et al. [15] demonstrated that breaking this scheme is at least as hard as solving certain worst-case problems on ideal lattices, which are conjectured to require 2Ω(n) time. 2.7
Sampling Algorithms (l+pk)
(k)
(k)
Let a := [a1 , a2 , . . . , ap ] ∈ Rq where a1 ∈ Rq and ai ∈ Rq for i ∈ {2, 3, . . . p}. For S ⊆ [p] ([p] := {1, 2, . . . , p}), S = {i1 , i2 , . . . , ij }, we set as := [ai1 , . . . aij ], i.e. we select the components of a according to S, when we treat (l+k) aiu ∈ Rq (u = 1, 2 . . . j) as a component of a. Without loss of generality, we let S = [s], for some s ∈ [p]. Lemma 1 ([12]). The PPT algorithm ringGenSamplePre takes a ring element (l+k) l a ∈ Rq , a set S ⊆ [p] and a random basis Bs of Λ⊥ q (as ), a vector y ∈ Rq and a √ positive integer r ≥ ∥B̃s ∥.ω( log pk) and outputs e ← ringGenSamplePre(a, Bs , S, y, r) that are statistically close to sampling a random error vector from the distribution DΛyq (a),r .
11
New Trapdoor Generation We describe the trapdoor generation in a ring lattice. We consider a distribution χl×k over Rl×k and h ∈ Rq which is a nonzero element. The following lemma gives us a way to generate a trapdoor. Lemma 2 ([12]). There exists an algorithm ringGenTrap that takes a vector of ring element a0 = (a1 , . . . , al ), a nonzero element h ∈ Rq and a distribution χ as input, and gives a vector a = (a0 T , a1 T )T ∈ Rql+k as output and a trapdoor R = (r 1 , . . . , r k ) ∈ Rl×k . Also, as long as the distribution of (aT0 , −aT0 R) is close to uniform, the distribution of a is also close to uniform. Trapdoor Delegation Now, we describe the algorithm for trapdoor generation corresponding to the vector (aT , aT1 )T using the trapdoor of a. For discrete Gaussian sampling over ′ T cosets of Λ⊥ q (a ) with parameter r , suppose we are given an oracle O. ′
Lemma 3. The PPT algorithm ringDelTrapO , takes the oracle O, a vector a = ′ (aT , aT1 )T ∈ Rqm+k and h ∈ Rq which is non zero, and parameter r as input and ′ ′ outputs R ∈ R(m+k)×k which is a trapdoor for a with tag h [12]. Furthermore, for the randomisation of lattice basis, Cash et al. gave a technique in [5] for which we will use the notation ringRandBasis. It requires a basis of the lattice and the gaussian parameter with some restrictions, and it generates a different basis for the same lattice such that the distributions of both bases are independent of each other. 2.8
Binary Tree and Trapdoor Assignment in Lattice-Based Schemes
Lets define a d depth binary tree whose any node at level i is represented as v(i, ji ) = (v0,0 , v1,j1 , . . . , vi,ji )
0 ≤ ji ≤ 2i − 1.
where 0 ≤ i ≤ d − 1,
The path vector uniquely represents a path from node v0,0 to node vi,ji . For each level i ∈ {0, . . . , d − 1}, nodes are indexed starting with 0 from left to right [10]. Given any node vi,ji , we define a corresponding vector of ring elements aw(i,ji ) = [a, av1 ,j1 , . . . , avi ,ji ] ∈ Rq(l+(i+1)k) , where a ∈ Rql+k is a ring element generated by the algorithm ringGenTrap, and Ra ∈ Rql×k is its associated trapdoor. Each avi,ji ∈ Rqk is chosen randomly for all 0 ≤ i ≤ d − 1 and 0 ≤ ji ≤ 2i − 1. Each node vi,ji has a corresponding trapdoor Rav(i,ji ) , which can be computed (r is a parameter) via ′
Rav(i,ji ) ← ringExtBasis(Ra , av(i,ji ) , h , r).
12
A. Kumar et al.
Minimal Cover. For a given leaf node vd−1,t (where 0 ≤ t ≤ 2d − 1), we define the minimal cover as the smallest cardinality set of nodes that includes at least one ancestor of each leaf in the set {vd−1,t , vd−1,t+1 , . . . , vd−1,N −1 } and excludes all ancestors of leaves in {vd−1,0 , vd−1,1 , . . . , vd−1,t−1 }, and it is denoted by MinCov(vd−1,t ). At epoch t, for user identity id, we also define Tid,vl−1,t = {Rav(i,ji ) | v(i, ji ) ∈ MinCov(vd−1,t )}. Example: Now, we consider a binary tree of depth d = 4 and calculate the minimal cover of all the nodes of the last level. v0,0
v1,0
v1,1
v2,0
v3,0
v2,1
v3,1
v3,2
v2,2
v3,3
v3,4
v2,3
v3,5
v3,6
v3,7
Fig. 1. Toy example of binary tree and trapdoor assignment
MinCov(v3,0 ) = {v0,0 },
MinCov(v3,1 ) = {v1,1 , v2,1 , v3,1 },
MinCov(v3,2 ) = {v1,1 , v2,1 },
MinCov(v3,3 ) = {v1,1 , v3,3 },
MinCov(v3,4 ) = {v1,1 },
MinCov(v3,5 ) = {v2,3 , v3,5 },
MinCov(v3,6 ) = {v2,3 },
MinCov(v3,7 ) = {v3,7 }.
Tid,v3,0 = {Ra} , Tid,v3,1 = {Rav(3,1) , Rav(2,1) , Rav(1,1) }, where av(3,1) = [a , av1 ,0 , av2 ,0 , av3 ,1 ], av(2,1) = [a , av1 ,0 , av2 ,1 ], av(1,1) = [a , av1 ,1 ].
3
Proposed Construction of RFS-IBE
Our proposed scheme relies on the RLWE assumption, ensuring post-quantum security. It incorporates the minimal cover mechanism within a binary tree structure and employs an IBE framework to enable periodic secret key updates for
13
individual IoT devices, thereby achieving forward security. In addition to offering selective-ID and CPA security, the proposed protocol also achieves a reduction in ciphertext and key sizes. 3.1
Our Construction
– (params, msk) ←RFS-IBE.Setup(λ, N ). Given λ and N as the security parameter the total epoch of the system, the algorithm proceeds as follows: • Run ringTrapGen(ao , h) which takes a vector ao = (a1 , a2 . . . al )T ∈ Rql , h ∈ Rq which is a nonzero element and a distribution χl×k over Rl×k and gives a pair a = (aT0 , aT1 )T ∈ Rql+k and a trapdoor Ra ∈ Rl×k ; • The system is defined over (R{0,1} , C) where the plaintext space R{0,1} is the collection of polynomials with coefficient from {0,1} and C is the ciphertext space; • Outputs the params := (R, l, q, k, d, r, a, H, G) and the msk := Ra . – (skid,0 ) ←RFS-IBE.KeyGen(params, id, msk). Taking the input params, a user’s id and the master secret key and it gives the user’s initial key skid,o as output. For epoch t ∈ {0, 1, 2 . . . N − 1} and an arbitrary id and with two − Rq , we define hash functions H : {0, 1}∗ → − Rqk and G : {0, 1}∗ → (l+dk)
• aid,t = [a, aid,v1 ,j1 , . . . aid,vd−1,t+1 ] ∈ Rq Rqk ; • yid,t = G(id, t) ∈ Rq .
where H(id, vi,ji ) = aid,vi ,ji ∈
First, we consider the elements in the set MinCov(vd−1,1 ), then corresponding to each nodes in this set, trapdoor is constructed and apply the ringRandBasis algorithm. Since this algorithm is invoked during each secret key generation, we assume for simplicity that its parameters are adaptively chosen, and we omit their explicit specification. Let Tid,0 denote the resulting randomized set of trapdoors. Secondly, we compute eid,0 ← ringGenSamplePre(aid,0 , Tid,0 , S, yid,0 , r), eid,0 ∈ Rql+dk . The secret key for the identity-time pair (id, 0) is then defined as: skid,0 = (Tid,0 , eid,0 ). – (sk id,t+1 ) ←RFS-IBE.Update(params, t, id). The algorithm takes params, an intervel t, and id as input. To update skid,t , we have to update the matrix aid,t , vector yid,t and trapdoor set Tid,t (which is the collection of trapdoor for the elements in MinCov(vd−1,t+1 )). • First we update aid,t which depends on a new path obtained in the binary tree. Now, using the hash function H, we obtain new matrices and finally produces aid,t+1 .
14
A. Kumar et al.
• The yid,t is updated using G. • To update Tid,t , the elements of the set MinCov(vd−1,t+2 ) are considered. The trapdoors corresponding to each node in this set is generated and the keys corresponding to nodes MinCov(vd−1,t+1 )\MinCov(vd−1,t+2 ) are deleted. ringRandBasis is invoked to randomize the trapdoors. eid,t+1 ← GenSamplePre(aid,t+1 , Tid,t+1 , S, yid,t+1 , r), where eid,t+1 is distributed over DTid,t+1 (aid,t+1 ),r . Finally the algorithm outputs skid,t+1 = (Tid,t+1 , eid,t+1 ). – (p, c) ←RFS-IBE.Encrypt(params, b). On input params, an element b ∈ R{0,1} , an element s ∈ Rq is randomly chosen and compute jqk T ) ∈ Rq , p = (aid,t s + x) ∈ Rq(l+dk) , c = (yid,t s+x+b· 2 where x ← χ(l+dk) and x ← χ. The algorithm outputs (p, c). – (b) ←RFS-IBE.Decrypt((p, c), sk id,t ). Decryption uses skid,t . It computes b′ = c − eTid,t p ∈ Rq , and for each coefficient of ring element it gives 0 if the coefficient is closer to 0 than 2q (mod q); otherwise, it outputs 1 and we obtain b. We now show correctness. From Lemma 1, we can see that a set S can be found easily that satisfies the conditions of the algorithm ringGenSamplePre. Since all the choices satisfy the corresponding conditions, all the algorithm of the system can operate correctly. It is not difficult to get a set S satisfying the conditions of ringGenSamplePre. Since all selected parameters satisfy the imposed conditions, the algorithms of the system can operate correctly. Further, we can observe that′ the ciphertext is T given by (p, c) = (aid,t s+x, yid,t s+x+b· 2q ). On computing b we finally obtain ′ the expression (x − eTid,t x + b · 2q ). Looking at b coefficientwise, suppose the co′ efficient of rth degree of b is 0 then the rth component of b equals rth component q T of (x − eid,t x), which is close to 0 relative to 2 and when the rth component ′ of b is 1 then the rth component of b = rth component of (x − eTid,t x + b · 2q ), which is close 2q relative to 0 hence we obtain b.
3.2
Application to Internet of Things
Apart from the secure transmission of sensitive data in IoT devices, our scheme also supports secure firmware updates, particularly in industrial control systems. It is often found that unauthorized users can also access the device within
15
IoT [17]. The scheme deals with the problem of unauthorized access. Thus, the proposed scheme can be implemented in different fields like banking, defense, medical, etc., where it is necessary to secure the crucial and sensitive data transmission. Let us understand the problem associated with the gateways and IoT devices in the hospitals and health centers, which include wearable and on-body devices like fitness bands, ECG monitors, blood pressure monitors, health monitoring patches, IoT-enabled ambulances, etc., deployed in hospitals. They deal with the sensitive data of the patient. IoT devices are vulnerable to side channel attacks; also, in hospitals, they are often kept in a physically exposed environment, which increases the risk of unauthorized access. So these conditions favor corrupting the device and extracting the secret key. This may result in the exposure of the medical records of the patient, violating the privacy and personal dignity of the patient. It may further lead to discrimination in employment and insurance, and targeted scams. Based on some medical records, the patient may face blackmailing threats. If patient data is manipulated, people lose trust in the hospital, which lowers its reputation and popularity.
Fig. 2. Schematic overview of the proposed construction
Now, we will describe how our proposed construction can be used in hospitals to resolve these issues. We assign the role of Private Key Generator (PKG) to the backend server of the hospital. These gateways and devices will act like users in an Identity-Based Encryption (IBE) denoted by U1 , U2 , . . . , Uw having their corresponding unique identities. The backend server will start the RFSIBE.Setup, which will generate the params (R, l, q, k, d, r, a, H, G) and the master secret key Ra . After that, all the deployed gateways and IoT devices receive their
16
A. Kumar et al.
corresponding initial secret key skid,0 , which is generated by the algorithm RFSIBE.KeyGen. Each user Ui uses params, its unique id and the current epoch t to get the updated secret key skid,t+1 , which will be active only for (t + 1)th epoch (to facilitate these updates, we have used the mechanism of minimal cover in the context of a binary tree in the core of our construction). Now if Ui wants to send the monitored ECG of a patient denoted by b to Uj during the tth epoch, it will run the algorithm RFS-IBE.Encrypt and the ciphertext (p, c) is sent to Uj . Upon receiving the ciphertext, Uj uses its secret key skid for the decryption (refer to Figure 2). Finally, all the health records of the patient are sent to the backend server via gateways for further analysis and storage.
4
Security Analysis
Theorem 2. Assume Theorem 1 holds. The RLWE-based PKE scheme based on RLWE, proposed in Subsection 2.6 is secure against indistinguishable chosen plaintext attack. For a shared ring element a, and two hash functions G and H, then f s − ID − BT ERLW E is fs-sID-CPA secure in the random oracle model. Further, for total number of epoch N we have, Adv[ABT E , fs-ID-BTERLW E ] ≤
1 · Adv[BdualRLW E , PKE] + negl(n), N
where N is the total number of epochs in f s − ID − BT ERLW E . Proof. Assume that the f s − sID − CP A security of the f s − ID − BT ERLW E system is attacked by an adversary ABT E RLW E Before the attack, ABT E RLW E first submits a target id ∗ for the challenge phase. A PPT algorithm BdualRLW E is constructed to simulate the challenger for ABT E and attacks the RLWE-based PKE cryptosystem. BdualRLW E first chooses i∗ ∈ {0, 1, . . . , N − 1} uniformly at random as a guess for the challenge interval j. BdualRLW E is given the main parameters of the PKE cryptosystem based on RLWE, i.e. a′ ∈ R(l+dk) and y ∗ ∈ Rq . Parse a′ = [a, a′ 1,j1 , a′ 2,j2 . . . a′ d−1,i∗ +1 ], where a ∈ Rql+k and a′ i,ji ∈ Rqk for i = 1, 2, . . . , d − 1. For the simulation of the challenger against adversary ABT E RLW E , BdualRLW E sets one of the params to be a ∈ Rql+k and then sends the parameters to be adversary ABT E RLW E . ABT E RLW E may query G(·) and H(·). Let QH and QG be some poly-size constants. We assume that: – Adversary ABT E RLW E makes QH different H(·) queries. – Adversary ABT E RLW E makes QG different G(·) queries. – The random oracle query is assumed to be completed when ABT E RLW E asks for a secret key or issue a challenge. Next, the answers of all the queries issued by adversary ABT E RLwE need to be simulated by BdualRLwE , which will keep the simulated values in subsequent queries lists H and G. It answers queries as follows:
17
Queries to H(·): If id = id ∗ and vi,ji lies on the path from node v0,0 to vℓ−1,i∗ +1 , return a′i,ji . Otherwise, run ringTrapGen to generate aid,vi,ji and its trapdoor Raid,vi,j ∈ Rql+k , store them in list H, and return aid,vi,ji . i
Queries to G(·): If (id , k) = (id ∗ , i∗ ), return the y ∗ . Otherwise, return yid,k , and store ((id, k), yid,k in G. Extraction Query 1: When adversary ABT E RLW E queries secret key for the pair (id , k) = (id ∗ , k ≤ i∗ ), abort. If (id , k) = (id ∗ , k > i∗ ), BdualRLW E first establishes the corresponding vector aid∗ ,k . Note that aid∗ ,k and aid∗ ,j have at least one different component. So to answer the adversary’s random oracle query, the trapdoor of the different components can be simulated by ringTrapGen. As for the other trapdoors in Tid∗ ,k , Bdual looks up the trapdoor already listed in H and runs ringExtBasis to get them by a simple expansion of lattice basis. Now Bdual can construct the trapdoors set Tid∗ ,k with the help of ringRandBasis and then the vector eid∗ ,k is computed to adversary ABT E RLW E . If id ̸= id∗ , Bdual generate the set Tid,k , corresponding to aid,k by ringExtBasis and ringRandBasis. Then Bdual computes the error vector eid,k by the help of ringGenSamplePre with aid,k and corresponding trapdoor Tid,k and yid,k in G. Finally, Bdual gives skid,k = (Tid,k , eid,k ) to adversary ABT E . Challenge: Assume that the adversary ABT E RLW E declares to end the extraction query 1. Then ABT E RLW E submits a challenge (id ∗ , j, M0 , M1 ) and (id∗ , j) with j ≤ i∗ and never queried before. If j = i∗ , Bdual relay (M0 , M1 ) to Bdual ’s challenger, get ciphertext C ∗ , and forward to ABT E . If j ̸= i∗ , Bdual reports a failure then terminates. Extraction Query 2: Corresponding to (id, k), ABT E queries the secret key and same constraints are applied to the pair as in Extraction query 1. When ABT E outputs a guess bit, Bdual gives the same bit. The probability that the simulation aborts is exactly 1 − N1 , independent of ABT E ’s view. Conditioned on the simulation of Bdual is not abort, ABT E is statistically close to the real fs-sID-CPA game, and the answers simulated by Bdual of the random oracle queries and the answers chosen from uniform distribution are indistinguishable. Finally we claim that Bdual ’s advantage is exactly the same to ABT E ’s if the simulation is not aborted. 4.1
Achieving CCA security
An (l − 1) level IND-(s)ID-CCA secure HIBE scheme can be achieved efficiently using BCHK transformation [2] with additional overhead from any l-level (l ≥ 1) IND-(s)ID-CPA secure hierarchical IBE. In fact, we can use FO transformation [7] with low additional overhead to achieve IND-CCA security from an IND-CPA secure PKE. Though our construction has not achieved adaptive CCA security yet but it immediately follows to achieve IND-(s)ID-CCA-secure fs-IBE with
18
A. Kumar et al.
additional overhead. Adding adaptive security in our construction may cost us an increase in parameter size, which will further result in increasing the complexity of our construction.
5
Comparison and Efficiency
In this section, first, we describe the communication cost, followed by the storage cost. We will also describe the computational cost of our protocol. Communication cost refers to the amount of total data transmitted during communication. In our protocol, it mainly includes the ciphertext, updated secret key and the public parameter. The ciphertext is sent to the receiver for decryption which contains the ring elements from Rql+dk and Rq . The total number of Rq ring elements that our ciphertext contains is (l + k log(N ) + 1), that is, n(l + k log(N ) + 1) log q bits. Next, for the forward security, the secret is updated periodically, and the updated secret key is sent to the IoT devices by the Key Generation Centre (KGC). The updated secret key contains (lk log N + (l + k)) Rq , that is, n(lk log N + (l + k)) log q bits. Then we have public parameters = (R, l, q, k, d, r, a, H, G) in our communication overhead. The integer parameters contribute log(lkdr) bits, a ∈ Rl+k contributes n(l + k) log q bits and the hash functions H and G output elements which are from Rqk and Rq , respectively. Together they contribute (kn log q + n log q) bits. Hence, the total asymptotic size of the public parameters can be given by |pp| = O((l + 2k + 2)n log q). The storage cost is the amount of memory captured by the overheads in the protocol. In our protocol, the overheads that contribute to the storage cost are the msk, secret keys of the IoT devices, which keep on updating periodically and public parameters. The msk has a total of (lk) Rq elements, and it contributes n(lk) log q bits in storage. Again the public parameter and secret key contribute O((l + 2k + 2)n log q) and n((l.k) log N + (l + k)) log q bits, respectively. Now we calculate the computational cost of our protocol, which includes the total number of mathematical and cryptographic operations performed during the execution of different algorithms. The RFS − IBE.Encrypt algorithm outputs a ciphertext, which is in a pair (p, c). For p, (l + dk) Rq multiplications and (l + dk) Rq additions are required where as for c, two Rq multiplications and two Rq additions are required; thus, to execute this algorithm, we require a total of (l + dk + 2) Rq multiplications and (l + dk + 2) Rq additions. In the decryption algorithm, RFS − IBE.Decrypt, (l+dk) Rq multiplications and one Rq addition is required. In our protocol, the following trapdoor-based lattice sampling algorithm ringGenSamplePre, ringRandBasis, ringTrapGen and ringExtBasis have been invoked. In the RFS-IBE.Setup phase the algorithm ringTrapGen is invoked once to generate the ring element a and the corresponding trapdoor Ra . In the RFSIBE.KeyGen phase ringExtBasis was invoked a maximum of O(d) times whereas ringRandBasis and ringGenSamplePre were invoked once. During the RFS-IBE.Update phase ringExtBasis was invoked a maximum of O(d) times for each t ∈ {1, 2, . . . , N − 1} whereas ringRandBasis and ringGenSamplePre were invoked
19
N − 1 times each. The asymptotic invocation count of each algorithms is summarized in Table 3. Table 3. Asymptotic invocation count of algorithms Algorithm ringTrapGen ringExtBasis
In which step it is used and purpose
Number of Invocations – In RFS-IBE.Setup, to generate the initial pair (a, Ra ). 1 . – During RFS-IBE.KeyGen/ RFS-IBE.Update when ex- d.O(2d ) panding trapdoors in MinCov(vd−1,t ).
– In RFS-IBE.KeyGen, to randomize trapdoors corre- 1 + (N − 1) ≈ O(N ) sponding to all the node of MinCov(vd−1,1 ) – In each RFS-IBE.Update, to randomize the refreshed trapdoor set Tid,t . ringGenSamplePre – In RFS-IBE.KeyGen, to generate eid,0 1 + (N − 1) = N ≈ O(N ) – In each RFS-IBE.Update, to generate eid,t+1 . ringRandBasis
Here a is the ring element and Ra is the corresponding trapdoor. d represents the depth of the binary tree. N is the total number of epoch. MinCov(vi,j ) is the set of minimal cover of node vi,j . Tid,t is the set of trapdoor corresponding to all the node of MinCov(vd−1,t+t )
Comparison with the protocol of Jin et al. [10]. We now compare our RLWE-based construction with the LWE-based forward-secure IBE of Jin et al. [10]. Since m = Ω(n log q), their parameter sizes satisfy: |mpk|Jin = n · m = Ω n2 log q , |msk|Jin = m2 = Ω n2 (log q)2 , |sk|Jin ≤ m2 log N + m = Ω n2 (log q)2 log N , |ct|Jin = m log N + 1 = Ω n log q log N . In contrast, our RLWE-based ring construction replaces the full m-dimensional LWE matrices with ring elements in dimension n. As a result, our key and ciphertext sizes scale as: |mpk|ours = n(l + k), |sk|ours ≤ n lk log N + l + k ,
|msk|ours = nlk, |ct|ours = n l + k log N + 1 .
For typical settings where l and k are constants or grow at most polylogarithmically in n, all components of our scheme have asymptotic size O n · polylog(N ) , which is significantly smaller than the Ω n2 (log q)2 log N
sizes appearing in the LWE-based FS-IBE of Jin et al. [10]. This reduction arises because the ring setting compresses m-dimensional matrices into single ring elements.
20
6
A. Kumar et al.
Implementation and Comparative Benchmark Analysis
To evaluate the practical efficiency of the proposed RLWE-based forward-secure IBE scheme, a prototype implementation was developed in Python 3.10 using the NumPy library for polynomial arithmetic operations. The experiments were performed on a Linux-based system equipped with an Intel Core i5 processor and 8 GB RAM. The implementation includes the algorithms Setup, KeyGen, Update, Encrypt, and Decrypt over the ring Rq = Zq [x]/(xn + 1). The benchmark evaluation focuses on execution time and memory usage, since these parameters are important for lightweight IoT environments. The execution time was measured using Python’s time module, while memory consumption was obtained using the tracemalloc library. For comparison, the proposed construction was evaluated against the lattice-based forward-secure IBE scheme of Jin et al[10]. The comparison mainly considers the computational cost of KeyGen, Encrypt, and Decrypt operations together with memory overhead as given in table4 Table 4. Benchmark Comparison with Existing Scheme Scheme Jin et al. [10]
Operation Time (ms) Memory (KB) KeyGen 2.74 58.3 Encrypt 2.08 49.7 Decrypt 1.86 44.2 Our Proposed Scheme KeyGen 1.82 42.6 Encrypt 1.35 37.4 Decrypt 1.11 31.8
The experimental results indicate that the proposed scheme reduces both execution time and memory overhead compared with the existing lattice-based forward-secure IBE construction. The improvement is mainly achieved through the use of ring-based operations, where high-dimensional matrices are represented as compact ring elements. In addition, the binary-tree minimal cover mechanism limits the number of trapdoors required during key updates, thereby reducing storage requirements. These results demonstrate that the proposed construction is suitable for practical IoT applications requiring forward security and post-quantum protection with lower computational overhead.
7
Conclusion
In this manuscript, a lattice-based forward-secure IBE scheme in the ring setting has been presented. Forward security has been achieved through binarytree–based key updates and trapdoor delegation, while post-quantum security
21
has been ensured under the RLWE assumption. By adopting ideal-lattice techniques, reductions in key and ciphertext sizes have been obtained, leading to improved efficiency over existing LWE-based FS-IBE constructions. The scheme has therefore been made more suitable for deployment in constrained IoT environments. Further, the proposed work can be extended by incorporating additional functionalities such as Hierarchical Identity-Based Encryption (HIBE) to improve scalability and key management in large distributed IoT networks. Future research may also focus on developing a more detailed system-level implementation and practical deployment scenario, particularly in real-world environments, to further evaluate the applicability and performance of the proposed scheme.
8
Acknowledgements
This research work was supported by the Graduate Assistantships in Developing Countries(GRAID) Program by the International Mathematical Union (IMU). Vikas Srivastava acknowledges the support received from the ANRF-PMECRG project with Ref. No. ANRF/ECRG/2025/002808/PMS.
References 1. Ajtai, M.: Generating hard instances of lattice problems. In: Proceedings of the twenty-eighth annual ACM symposium on Theory of computing. pp. 99–108 (1996) 2. Boneh, D., Canetti, R., Halevi, S., Katz, J.: Chosen-ciphertext security from identity-based encryption. SIAM Journal on Computing 36(5), 1301–1328 (2007) 3. Boneh, D., Franklin, M.: Identity-based encryption from the weil pairing. In: Annual international cryptology conference. pp. 213–229. Springer (2001) 4. Canetti, R., Halevi, S., Katz, J.: A forward-secure public-key encryption scheme. In: International Conference on the Theory and Applications of Cryptographic Techniques. pp. 255–271. Springer (2003) 5. Cash, D., Hofheinz, D., Kiltz, E., Peikert, C.: Bonsai trees, or how to delegate a lattice basis. Journal of Cryptology 25(4), 601–639 (2012) 6. Devi, M., Majumder, A.: Side-channel attack in internet of things: A survey. In: Applications of Internet of Things: Proceedings of ICCCIOT 2020, pp. 213–222. Springer (2020) 7. Fujisaki, E., Okamoto, T.: Secure integration of asymmetric and symmetric encryption schemes. Journal of Cryptology 26(1), 80–101 (2013) 8. Höglund, J., Lindemer, S., Furuhed, M., Raza, S.: Pki4iot: Towards public key infrastructure for the internet of things. Computers & Security 89, 101658 (2020) 9. Jiang, X.F., Wang, T., Sun, Z.W.: Chosen-ciphertext secure hierarchical identitybased encryption from r-lwe. Journal of Computers 31(1), 320–331 (2020) 10. Jin, R., Qu, L., Chen, R., Yang, Z., Wang, Y.: A lattice-based forward secure ibe scheme for internet of things. Information Sciences 660, 120083 (2024) 11. Kelly, D., Hammoudeh, M.: Optimisation of the public key encryption infrastructure for the internet of things. In: Proceedings of the 2nd International Conference on Future Networks and Distributed Systems. pp. 1–5 (2018)
22
A. Kumar et al.
12. Lai, R.W., Cheung, H.K., Chow, S.S.: Trapdoors for ideal lattices with applications. In: International Conference on Information Security and Cryptology. pp. 239–256. Springer (2014) 13. Lu, Y.: Efficient forward-secure identity-based encryption scheme in the standard model. In: International Conference on Theoretical and Mathematical Foundations of Computer Science. pp. 62–69. Springer (2011) 14. Lu, Y., Li, J.: A practical forward-secure public-key encryption scheme. Journal of Networks 6(9), 1254 (2011) 15. Lyubashevsky, V., Peikert, C., Regev, O.: On ideal lattices and learning with errors over rings. In: Annual international conference on the theory and applications of cryptographic techniques. pp. 1–23. Springer (2010) 16. Lyubashevsky, V., Peikert, C., Regev, O.: A toolkit for ring-lwe cryptography. In: Annual international conference on the theory and applications of cryptographic techniques. pp. 35–54. Springer (2013) 17. Mohanty, T., Srivastava, V., Debnath, S.K., Das, A.K., Sikdar, B.: Quantum secure threshold private set intersection protocol for iot-enabled privacy-preserving ridesharing application. IEEE Internet of Things Journal 11(1), 1761–1772 (2023) 18. Nadikattu, A.K.R.: Iot and the issue of data privacy. International Journal of Innovations in Engineering Research and Technology 5(10), 23–26 (2018) 19. Shafagh, H., Hithnawi, A.: Security comes first, a public-key cryptography framework for the internet of things. In: 2014 IEEE International Conference on Distributed Computing in Sensor Systems. pp. 135–136. IEEE (2014) 20. Shamir, A.: Identity-based cryptosystems and signature schemes. In: Advances in Cryptology: Proceedings of CRYPTO 84 4. pp. 47–53. Springer (1985) 21. Sharma, P., Moparthi, N.R., Namasudra, S., Shanmuganathan, V., Hsu, C.H.: Blockchain-based iot architecture to secure healthcare system using identity-based encryption. Expert Systems 39(10), e12915 (2022) 22. Singh, K., Pandurangan, C., Banerjee, A.: Lattice forward-secure identity based encryption scheme. J. Internet Serv. Inf. Secur. 2(3/4), 118–128 (2012) 23. Singh, K., Pandurangan, C., Banerjee, A.: Lattice based forward-secure identity based encryption scheme with shorter ciphertext. J. Internet Serv. Inf. Secur. 3(1/2), 5–19 (2013) 24. Srivastava, V., Debnath, S.K., Stănică, P., Pal, S.K.: A multivariate identity-based broadcast encryption with applications to the internet of things. Adv. Math. Commun. 17(6), 1302–1313 (2023) 25. Yang, X., Chen, X., Huang, J., Li, H., Huang, Q.: Fs-ibeks: Forward secure identitybased encryption with keyword search from lattice. Computer Standards & Interfaces 86, 103732 (2023) 26. Yao, D., Fazio, N., Dodis, Y., Lysyanskaya, A.: Id-based encryption for complex hierarchies with applications to forward security and broadcast encryption. In: Proceedings of the 11th ACM conference on Computer and communications security. pp. 354–363 (2004) 27. Zanella, A., Bui, N., Castellani, A., Vangelista, L., Zorzi, M.: Internet of things for smart cities. IEEE Internet of Things Journal 1(1), 22–32 (2014) 28. Zhang, B., Zhang, T., Xi, Z., Chen, P., Wei, J., Liu, Y.: Secure device-to-device communication in iot: Fuzzy identity from wireless channel state information for identity-based encryption. Electronics 13(5), 984 (2024)