Group Encryption with Oblivious Traceability
摘要
We revisit Group Encryption (GE)—an encryption analogue of group signatures introduced by Kiayias et al. (Asiacrypt 2007). A GE system simultaneously provides anonymity and traceability for receivers who are certified group members, enabling a range of privacy-preserving applications. While prior work has extensively addressed how to trace receivers in GE, the question of why a ciphertext should be traceable remains unexplored. Unlike group signatures, where opening can be justified by the signed content, tracing in GE poses a dilemma because the underlying plaintext is confidential. To address this gap, we introduce Group Encryption with Oblivious Traceability (GEOT), an enhanced form of GE in which the traceability of a ciphertext \(\psi \) intended for receiver \(\textsf{id}\) and containing message \(\textbf{w}\) is governed by a public tracing policy \(P(\textsf{id},\textbf{w}) \in {0,1}\) . Here, \(P(\textsf{id},\textbf{w})=0\) denotes traceability, whereas \(P(\textsf{id},\textbf{w})=1\) ensures non-traceability. The traceability status is known to the sender but remains hidden from all parties except the opening authority, which learns nothing about \(\textsf{id}\) in the non-traceable case. GEOT further supports message filtering and dynamic membership, following Nguyen et al. (PKC 2021). Filtering enforces that valid ciphertexts satisfy a public policy \(F(\textbf{w})=1\) , while dynamicity enables users to join and leave the system over time. We formalize GEOT with concise syntax and rigorous security notions, and present a modular construction based on standard cryptographic primitives: signatures, public-key encryption, and non-interactive zero-knowledge proofs. We also give a concrete instantiation from code-based assumptions supporting arbitrary tracing and filtering policies represented by polynomial-size Boolean circuits. In addition to expressive filtering and tracing functionalities, our scheme achieves significant efficiency improvements over existing post-quantum GE constructions.