https://orcid.org/0000-0002-8595-0384
Figures
Abstract
As cloud storage becomes increasingly commonplace alongside the expansion of data sharing practices, how to achieve secure data sharing and user revocation while ensuring data confidentiality has become a key issue. Proxy re-encryption enables ciphertext originally designated for one user to be transformed by a semi-trusted proxy for another user, while identity-based encryption offers a simplified approach to key administration. However, most existing frameworks employ bilinear pairings, which suffer from susceptibility to quantum threats, and generally lack efficient revocation mechanisms. To tackle these challenges, we present an identity-based directly revocable proxy re-encryption scheme (IBPRE-DR) based on the Learning With Errors (LWE) assumption. This scheme enables data owners to directly revoke user permissions without requiring a key generation center (KGC) to frequently update user keys, supporting immediate and dynamic access control. The mechanism uses a complete subtree algorithm to achieve efficient revocation. Additionally, a dual-key mechanism distinguishes re-encryption keys from decryption keys, effectively resisting collusion attacks and further enhancing data security. Furthermore, the private key length for each user remains fixed, supporting multi-bit encryption. We present a formal definition of IBPRE-DR’s security, along with a standard-model security proof. To the best of our knowledge, this is the first lattice-based identity-based proxy re-encryption scheme that integrates direct user revocation under the standard LWE assumption. Both experimental results and theoretical analysis confirm the scheme’s effectiveness and feasibility.
Citation: Li J, Jiang M, Guo Y (2026) An efficient lattice-based identity-based proxy Re-encryption scheme with direct revocation for cloud storage. PLoS One 21(8): e0355279. https://doi.org/10.1371/journal.pone.0355279
Editor: Chun-Wei Yang, China Medical University Taiwan, TAIWAN
Received: April 13, 2026; Accepted: July 20, 2026; Published: August 12, 2026
Copyright: © 2026 Li et al. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
Data Availability: All relevant data underlying the findings of this study are included within the manuscript, including the experimental parameter settings, hardware and software environment, estimated key/ciphertext sizes, and running-time results. The source code used for the simulation-based performance evaluation is publicly available in the GitHub repository at https://github.com/Li-create6/Proxy_Re-encryption.
Funding: This study was funded by the National Natural Science Foundation of China (61902140), and the Program of the Natural Science Foundation of Anhui Higher Education Institutions (2025AHGXZK20015). The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.
Competing interests: The authors have declared that no competing interests exist.
1. Introduction
As cloud storage services become increasingly popular, data outsourcing has become a prevalent approach for both organizations and individual users [1]. However, placing confidential information on cloud platforms that are not fully trusted raises significant privacy and security concerns. To preserve the confidentiality of information, data owners commonly apply encryption techniques to their datasets prior to uploading them to external storage environments. This, in turn, introduces a new challenge: how to securely and flexibly share the encrypted data with other authorized users without performing decryption.
Proxy re-encryption (PRE) provides a powerful cryptographic primitive to address this challenge. The notion of PRE was first introduced by Blaze et al. [2]. In a PRE system, a semi-trusted proxy is allowed to transform a ciphertext encrypted under one user’s public key into a ciphertext that can be decrypted by another user, without learning any information about the underlying plaintext.
Identity-based proxy re-encryption (IB-PRE) further simplifies key management by eliminating the need for traditional public key certificates. Instead, a user’s identity string (e.g., email address or unique identifier) is used directly as their public key. According to the delegation direction, IB-PRE schemes can be divided into unidirectional and bidirectional constructions. Bidirectional schemes can generally be derived from unidirectional ones through standard transformations. Ateniese et al. [3] summarized the main features of PRE as follows:
Non-interactivity: A trusted authority does not need to generate the re-encryption key , as it can be produced from the public keys of users A and B.
Proxy Transparency: Both the delegating party and the receiving user remain unaware of the proxy’s involvement in the re-encryption process.
Key Optimality: The length of user B’s private key does not increase with the number of delegations received, remaining fixed irrespective of how many re-encryption permissions are granted.
Collusion Resistance (also referred to as Master Private Key Security): Even under collusion attacks involving the proxy together with user B, user A’s private key remains secure from derivation.
Non-transitivity: In the unidirectional setting, it is infeasible for the proxy to further delegate decryption rights specifically, even with knowledge of both and
, it cannot derive
.
Singh et al. [4] presented the first IB-PRE scheme built upon lattices, which supports anonymity, bidirectionality, and multi-hop functionality. Kirshanova [5] presented the inaugural lattice-based PRE scheme supporting unidirectional delegation, featuring collusion resistance and non-interactivity. Subsequently, many proxy re-encryption designs have been put forward [6–12]. Wu et al. [13] presented a lattice-based multi-hop, unidirectional IB-PRE scheme that achieves functional separation between decryption and re-encryption key generation through a dual private key mechanism. Zhang et al. [14] proposed a scheme enabling quantum-safe cloud data sharing and fine-grained keyword retrieval. Wang et al. [15] introduced the first lattice-based revocable identity-based proxy re-encryption (RIB-VPRE) scheme. Wang et al. [16] introduced the first lattice-based revocable IBEET scheme for mobile cloud computing. Their scheme addresses key exposure risks caused by device loss, resists quantum attacks, and achieves both efficiency and security.
However, existing IB-PRE schemes generally lack efficient and direct user revocation mechanisms, which limits their applicability in dynamic and large-scale cloud environments. In practical systems, revocation refers to the ability to immediately invalidate a specific user’s decryption capability without modifying the underlying encryption algorithm or affecting other legitimate users, thereby enabling flexible and dynamic access control. Revocation mechanisms can be categorized into two types:
Direct Revocation: The revocation operation is performed by the sender while executing the encryption operation by explicitly specifying a revocation list (RL). This approach does not require the key generation center (KGC) to update keys on a regular basis. When , the revoked user is immediately unable to decrypt the ciphertext, and the revocation takes effect instantly.
Indirect Revocation: The revocation operation requires the KGC to periodically publish key update information. Users who have not been revoked are required to periodically refresh their keys; otherwise, they will be unable to decrypt.
1.1. Related work
Revocable Encryption. User revocation is a fundamental requirement in secure cloud data sharing systems. Boldyreva et al. [17] proposed the first identity-based encryption (IBE) scheme with indirect revocation, reducing the complexity of key updates from linear to logarithmic. Subsequently, Shi et al. [18] introduced a directly revocable encryption scheme based on verifiable key-policy attributes, enabling more flexible revocation management. To support dynamic access control in cloud environments, Ge et al. [19] proposed an identity-based broadcast proxy re-encryption scheme with key revocation, allowing cloud servers to revoke users without relying on the data owner’s private key. Ge et al. [20] further incorporated direct revocation into attribute-based proxy re-encryption (ABE-PRE), while Li et al. [21] designed a fast revocable ABE scheme with data integrity protection. Although these schemes improve revocation efficiency, their security mainly relies on classical hardness assumptions such as integer factorization and discrete logarithms, which are vulnerable to quantum attacks.
Lattice-Based Revocable Encryption. To address the threat posed by quantum computing, lattice-based cryptography has emerged as one of the most promising post-quantum cryptographic paradigms. Chen et al. [22] proposed the first lattice-based revocable IBE scheme, extending revocation functionality into the post-quantum setting. Zhao et al. [23] further constructed a revocable attribute-based encryption scheme under the R-LWE assumption, while Huang et al. [24] developed a lattice-based integrated revocable IBE scheme supporting anonymity, decryption key exposure resistance, and online/offline encryption. More recently, Wang et al. [16] proposed a lattice-based revocable IBE with equality test (RIBEET) for mobile cloud computing, combining user revocation, equality testing, and adaptive security. Chen et al. [25] designed a revocable attribute-based encryption scheme with efficient cloud-assisted verification for smart healthcare applications, where verification tags are dynamically updated during revocation. Huang et al. [26] introduced an efficient lattice-based revocable ABE scheme resistant to decryption key exposure for cloud file sharing. These studies demonstrate the effectiveness of lattice techniques in achieving quantum-resistant revocation and access control.
Lattice-Based Proxy Re-Encryption and Cloud Data Sharing. In parallel, researchers have explored advanced lattice-based cryptographic mechanisms for secure cloud data sharing. Feng et al. [27] proposed a blockchain-assisted lattice-based attribute-based searchable encryption framework integrating threshold key management and on-chain revocation, enabling secure and auditable data sharing. To enhance accountability and revocation in proxy re-encryption systems, Lin et al. [28] developed a lattice-based traceable and directly revocable attribute-based proxy re-encryption scheme with fair verification for medical IoT environments. Ahmad et al. [29] proposed a quantum-safe multi-factor authentication protocol for cloud-assisted Medical IoT systems, focusing on authentication and key agreement rather than proxy re-encryption or data sharing mechanisms. Beyond encryption mechanisms, Ahmad and Jagatheswari [30] proposed PQ-ABS, a post-quantum aggregate blind signature scheme based on Module-LWE and Module-SIS assumptions for anonymous authentication in blockchain-enabled Internet of Medical Things (IoMT). Ahmad and Jagatheswari [31] further proposed a quantum-secure lightweight fuzzy-extractor-based user authentication scheme for the Internet of Medical Things. Constructed on the RLWE assumption, the scheme employs fuzzy extractors to tolerate biometric variations and provides efficient mutual authentication and key agreement with formal security verification. In addition, Ahmad and Jagatheswari [32] presented a quantum-safe mutual authentication scheme for Internet of Healthcare Things (IoHT) using blockchain, which integrates lattice-based cryptography with blockchain technology to establish secure and decentralized authentication. The scheme enhances resistance against quantum attacks while ensuring data integrity, traceability, and secure access in healthcare environments.
Although significant progress has been made in revocable encryption, lattice-based access control, and post-quantum cloud data sharing, several limitations remain. Most existing revocable lattice-based schemes rely on periodic key-update generation and distribution by the KGC, making revocation timeliness dependent on the availability of update information. Furthermore, many existing lattice-based constructions focus on IBE or ABE settings and do not support proxy re-encryption. Even among proxy re-encryption schemes, direct revocation and immediate access control remain largely unexplored in identity-based lattice settings. To address these limitations, we propose the first lattice-based identity-based proxy re-encryption scheme with direct revocation (IBPRE-DR). In our construction, the data owner maintains the revocation list and embeds revocation information directly into the encryption process, enabling immediate revocation without periodic key updates while preserving post-quantum security under the LWE assumption. A summary of recent revocable encryption and authentication schemes is provided in Table 1.
1.2. Our contributions
We construct a dual-key mechanism based on the trapdoor sampling algorithm proposed by Micciancio [33]. In this design, each user is associated with two functionally independent keys, where one is used for generating re-encryption keys and the other is used for decryption. This separation ensures that re-encryption keys and decryption keys are derived from distinct trapdoor components, thereby preventing key leakage and achieving collusion resistance. Even if a proxy colludes with an authorized delegatee, only partial key information is available, which is insufficient to recover the delegator’s private key.
During the user management phase, a full binary tree with N leaf nodes is constructed, where each user is mapped to a unique leaf node. Key generation leverages the dual-key structure to derive the corresponding basis for both re-encryption and decryption operations. The re-encryption key is generated from one component of the trapdoor basis, while the decryption key is derived from the other component and is used for decrypting both original and re-encrypted ciphertexts.
To support efficient revocation, the KUNodes algorithm is applied to the binary tree to compute a minimal node set covering all non-revoked users. This allows users to verify their revocation status by checking whether their corresponding path intersects with the computed node set, avoiding the need for exhaustive user traversal. The construction also supports multi-bit encryption, while keeping the length of each user’s private key fixed regardless of the number of encrypted bits.
During the encryption phase, the data owner directly specifies RL. This enables immediate access control and avoids the need for a continuously online KGC, which is required in traditional indirect revocation schemes. Therefore, the proposed scheme is suitable for dynamic cloud environments.
2. Preliminaries
We use bold lowercase symbols (e.g., ) to denote column vectors and bold uppercase letters (e.g.,
) to denote matrices. The discrete Gaussian distribution over a lattice L with standard deviation
is denoted by
. For a given vector
, let
be its
norm. For a matrix
,
represents the maximum
norm of its column vectors. The Gram–Schmidt orthogonalization of
is denoted by
, and
denotes its spectral norm. In this context, we have
and
. In addition, a vertical bar is used to indicate the horizontal concatenation of vectors or matrices (e.g.,
), and a comma to denote vertical concatenation (e.g.,
). The main notation used throughout this paper is summarized in Table 2.
2.1. q-ary lattice
Definition 1. For positive integers m,n and q a prime modulus. Given and
, the corresponding q-ary lattices are given as follows:
If , then
; that is,
can be viewed as a shifted version of
.
Lemma 1. ([2,34]). For q > 2 and . Let
be a short basis of the lattice
. Suppose
, and let
and
. It follows that:
- There is a PPT algorithm
which generates a matrix
(i.e.,
) such that the distribution of
is statistically close to
2.2. Computational assumptions
Definition 2. (LWE Hardness Assumption [35–38]) Let q denote a prime modulus, an integer n satisfying , and a distribution
defined on
. An instance of the
problem is specified via a challenge oracle
that the adversary can query, which operates either as a noise-injected pseudorandom oracle
parameterized by a secret vector
, or as a uniformly random oracle
. Concretely:
generates sample pairs of the form
, the secret vector
is selected uniformly at random, each
is independently sampled from the uniform distribution, and the noise term
is taken from
.
: Uniformly random instances in
are generated by
.
The search-LWE problem asks the adversary to recover the secret vector s given a polynomial number of samples from . The decision-LWE problem asks the adversary to distinguish the sample pairs generated by
from those generated by O$.
Lemma 2. (Leftover Hash Lemma over LWE [39]). Consider a prime modulus q > 2 and the condition . Here, k = k(n) is taken as a polynomial. Let the matrices
,
, and
be chosen uniformly at random. Subsequently, given an arbitrary vector
, the subsequent distributions are computationally indistinguishable:
Lemma 3. (Worst-Case Hardness of LWE [18]). If the LWEn,q,χ problem admits an efficient distinguisher under the parameter constraints for some function B = B(n) and m = poly(n), then one can construct a quantum algorithm for the worst-case SIVP
problem, as well as a classical algorithm for
, where the approximation factor is given by
.
2.3. Trapdoor and sampling algorithms
Definition 3.(G-matrix) [33,40,41]. For integer parameters satisfying and
, we define
. There exists a structured matrix
, where
. A public basis
exists for the lattice
, with the property that
. Additionally, a deterministic function
is defined, satisfying
and
for every
. Moreover, if
, the matrix
can be expanded into
by adding zero columns on the right.
Definition 4.(G-trapdoor) [33,40,41]. Let integers q and n satisfy and
, and define
, w = nk, and
. Consider matrices
and
satisfying
. The
-trapdoor corresponding to
takes the form of a matrix
, an invertible matrix
for which the following condition holds:
where is the label (or tag) associated with the trapdoor.
Lemma 4. ([39,41]). For integers ,
, and
, there exists a PPT algorithm
that produces a full-rank matrix
together with a short basis
for the lattice
. Furthermore, the resulting matrix
lies statistically near uniform, and the Gram–Schmidt norm of
meets the bound
.
The polynomial-time algorithm takes as input two matrices
and
, a trapdoor
for the lattice
, and a parameter
. The algorithm
returns a basis
of
such that
.
For the polynomial-time algorithm , it takes as input matrices
,
, a small-norm matrix
, the trapdoor
corresponding to the lattice
, along with a parameter s satisfying
. The algorithm
returns a basis
for
with the property that
.
For the polynomial-time algorithm , with matrices
,
, a short basis
associated with the lattice
, and a parameter s chosen such that
, it returns a matrix
whose distribution is statistically close to
, where
.
For the polynomial-time algorithm , it takes as input matrices
, a low-norm matrix
, a short basis
for the lattice
, a matrix
, and a parameter
. Running
outputs a matrix
whose distribution is statistically close to
, where
.
Here, we introduce a variant of the SampleRight algorithm, denoted as SampleRightExtend, that supports the security analysis of the proposed framework. The algorithm is described as follows:
Lemma 5. Take integers ,
, and
. Set the parameter s such that
. With matrices
, two matrices
of small norm, a short basis
of the lattice
, and a uniformly chosen
, a probabilistic polynomial-time algorithm
exists. This algorithm produces a matrix
whose distribution is statistically indistinguishable from
, where
, with
,
for
and
is an invertible tag matrix.
2.4. Full-Rank Difference (FRD) Encoding [39]
In this scheme, we employ a Full-Rank Difference (FRD) function to encode user identities: . Suppose n > 1 and that q is an odd prime with
. The FRD function is defined to satisfy the conditions below:
- For any two distinct elements
where
, the difference matrix
has full rank;
- When the input is the zero vector
, the FRD function outputs
.
- H is computable in polynomial time.
2.5. Complete subtree
In this construction, a complete binary tree structure [42] is employed to enhance efficiency. Its main purpose is to reduce the computational cost of handling ciphertexts for non-revoked users from linear complexity into a logarithmic scale. Specifically, let BT be a binary tree in which each leaf node is associated with a user identity id, and let root denote the root node of BT. We define as the sequence of nodes along the path from the leaf linked to id upward to the root. For any internal node y, let
and
denote its left and right child nodes. We denote by RL the revocation list, which maintains the identifiers of users subject to revocation. Based on this structure,
is used to compute a minimal covering set Y that represents all non-revoked users. The procedure of
is described in Table 3.
The operation of the KUNodes(BT, RL) algorithm is exemplified in Fig 1. Suppose that users id1 and id5 are revoked, i.e., . According to the KUNodes(BT, RL) algorithm, the minimal covering set is Y = {5, 7, 9, 13}. For a non-revoked user id8, whose corresponding leaf node is 15, we have Path(BT, id8) = Path(15) = {1, 3, 7, 15}. Then
, which allows the non-revoked user to identify a valid covering node for decryption.
3. System definition
3.1. System model
Fig 2 presents the system framework scheme. We define the system to include five types of entities, described as follows: KGC, Data Owner (User A), Proxy, Data User (User B), and Cloud Server.
- KGC: Initializes the system framework and generates the master public/private key pair. It generates partial private keys for all users (including data owners, data users, and the proxy) based on their identities. After the user registration phase, the KGC does not participate in daily data sharing and re-encryption processes.
- Data Owner: The data owner, such as a company manager or department director, is considered fully trusted. When a staff member joins or leaves the organization, the data owner updates access permissions by revoking the corresponding user. The data owner encrypts the data before uploading it to the cloud server.
- Proxy: The initial ciphertext, which is generated using the public key of the data owner, is obtained from the cloud server. The proxy retrieves the original ciphertext from the cloud server, uses the re-encryption key to transform it into a new ciphertext, and uploads the transformed ciphertext back to the cloud server. The authorized data user can then decrypt it with the corresponding private key.
- Data User: The data user, such as a company employee, downloads the ciphertext from the cloud server and decrypts it with the private key to recover the plaintext.
- Cloud Server: The cloud server provides data storage and retrieval services. It stores both the original ciphertext uploaded by the data owner and the transformed ciphertext generated by the proxy, responds to users’ requests, and returns the corresponding ciphertext.
The proxy and the cloud server are modeled as semi-trusted honest-but-curious entities. They are assumed to follow the prescribed protocol honestly, while possibly attempting to infer sensitive information from the ciphertexts, re-encryption keys, and intermediate values available to them.
3.2. Identity-based direct revocation proxy re-encryption scheme
We define the IBPRE-DR construction, which includes seven algorithms described as follows: Setup, KeyGen, Encrypt, ReKeyGen, ReEncrypt, Decrypt, and ReDecrypt. Each algorithm is specified below:
Setup: A semi-trusted authority executes this algorithm. The algorithm receives the security parameter
and outputs the master public key
, the master secret key
, and a state list
.
KeyGen: Taking the master secret key
and a user identity
as input, it produces the corresponding private key
.
Encrypt: On input the master public key
, the identity
belonging to user A, a message
, and the revocation list
, the algorithm outputs a ciphertext
.
ReKeyGen: On input the private key
of user A, the identities
and
of users A and B, respectively, and the state list
, the algorithm outputs a re-encryption key
, where
. If
, the state list is updated as
.
ReEncrypt: On input the master public key
, the ciphertext
, and the re-encryption key
, the algorithm outputs a re-encrypted ciphertext
, where
and
.
Decrypt: On input the identity
, the decryption key
, and the original ciphertext
, the algorithm outputs the message
.
ReDecrypt: On input the identity
, the decryption key
, and the re-encrypted ciphertext
, the algorithm outputs the message
.
Correctness: A revocable proxy re-encryption scheme satisfies correctness if it fulfills the properties outlined below. With produced by
and
, there exists a negligible function
such that:
3.3. Security model
We define selective-identity chosen-plaintext security (IND-sID-CPA) for the IBPRE-DR using the following game between a challenger and an adversary
.
Init: challenge identity
and a revocation list
are announced by the adversary
.
Setup: Upon executing , the challenger
produces the master public key
alongside the master secret key
. The public parameters
are then provided to
, while
is retained as confidential.
Phase 1: Throughout the game, may adaptively issue polynomially many queries of the following forms:
Private key query :
issues a private key query for an identity
where
; alternatively the challenger returns
.
executes
and returns
to
.
Re-encryption key query :
submits a pair
. If
and
, the challenger returns
. Otherwise,
runs
, returns the re-encryption key
, and updates the state list
.
Re-encryption query :
submits an identity pair and a ciphertext. If the re-encryption key already exists (or if
), the challenger directly executes
and returns the result. Otherwise, if
, the challenger first generates the re-encryption key via
, updates
, then performs
and returns the re-encrypted ciphertext
.
Challenge: chooses two messages μ0 and μ1 of identical length and submits them, along with the designated target identity
during the initialization stage. The challenger
then selects a random bit
and generates the challenge ciphertext
. Subsequently,
is returned to
.
Phase 2: The adversary continues to issue queries as in Phase 1 under the same constraints.
Guess: produces a bit
as its guess. If
,
is considered successful and the experiment outputs 1; otherwise, the output is 0.
The adversary ’s advantage in the aforementioned game is given by
Definition 5. In the standard model, the presented IBPRE-DR scheme is considered IND-sID-CPA secure if, for any adversary performing in probabilistic polynomial time, the associated advantage
is a negligible function of the security parameter
.
4. IBPRE-DR Scheme
The IBPRE-DR scheme consists of the following seven algorithms.
Setup:
- Input a security parameter
and the maximum number of users N. Run
to obtain a matrix
and its associated trapdoor
. The generated trapdoor satisfies
, and
is subsequently set such that
.
- Randomly choose two matrices
and
.
- Construct a complete binary tree
containing N leaf nodes. For any node
, randomly select a uniformly distributed matrix
. Set the initial state list
.
- The master public key is defined as
, while the master secret key is defined as
.
KeyGen:
- Input the master secret key
and a user identity
.
- Encode the identity as
. Denote
.
- Run
to derive a basis
for the lattice
satisfying
.
- Run
to obtain a matrix
such that
.
- Output the private key as
.
Encrypt:
- Input the master public key
, the identity
of user A, a message
, and the revocation list
.
- Select a uniformly random vector
, noises
,
, and for
, randomly select two matrices
.
- Let
, and define
, where
is the identity matrix.
- Compute the ciphertext components:
where.
- Output the ciphertext
.
ReKeyGen:
- If
already contains
, return
; otherwise, insert
into
by setting
.
- Let
, and
.
- For
, run
, satisfying
, where
.
- Output the re-encryption key
, where
, and update the state
.
ReEncrypt:
- Input user A’s ciphertext
, master public key
, and re-encryption key
.
- Compute
, where
and
.
- Output the re-encrypted ciphertext
, where
and
.
Decrypt:
- Input the identity
, the private key
, and the ciphertext
.
- Compute the intermediate vector:
- Recover each message bit
for
as:
wheredenotes the i-th component of
.
- Output the message vector
.
ReDecrypt:
- Input the identity
, the private key
, and the re-encrypted ciphertext
.
- For each valid pair
, compute the intermediate vector:
- Recover each message bit
for
as:
wheredenotes the i-th component of
.
- If there exists a valid pair
such that the above condition holds for all i, output the message vector
; otherwise, output
.
We illustrate the workflow of the proposed IBPRE-DR scheme in Fig 3. The Key Generation Center (KGC) serves as the central authority responsible for system initialization and private key generation. Alice and Bob first register their identities with the KGC. Based on the registered identities, the KGC generates the corresponding private keys and securely distributes them to the respective users.
Alice encrypts the message under her identity and sends the resulting ciphertext to the proxy through a secure communication channel. The proxy then uses the corresponding re-encryption key to transform Alice’s ciphertext into a ciphertext intended for Bob, without learning any information about the underlying plaintext.
During decryption, the revocation status of Bob is checked according to the revocation list. If Bob’s identity is included in the revocation list, he is not allowed to decrypt the ciphertext. Otherwise, Bob uses his private decryption key to recover the original plaintext from the re-encrypted ciphertext.
4.1. Parameters and correctness
4.1.1. Parameters.
The following parameter settings are adopted to ensure the scheme’s correctness and security:
- (1) Security and dimension parameters:
- Security parameter
;
- Maximum number of users N;
- Identity encoding dimension
;
- Message encoding dimension
;
- Number of columns in matrices
;
- Noise bound condition: q/B > 4(m + 1)8, where B is the noise bound.
- Security parameter
- (2) Gaussian parameters:
- For key generation algorithms
and
:
;
- For decryption algorithm
:
, ensuring noise remains manageable;
- For re-encryption key generation procedures
and
:
, to account for noise accumulation during encryption.
- For key generation algorithms
Following the concrete parameter selection method used in several LWE-based schemes, we instantiate the underlying LWE parameters for practical performance evaluation as follows. To target an estimated 128-bit post-quantum security level, we set n = 1024, , and choose a 27-bit prime modulus q.
4.1.2. Correctness.
Decryption of the original ciphertext. Let be the private key of user A. For the original ciphertext
, the decoding procedure only uses the components
and
. Since
and
hold with overwhelming probability, we have
The noise term satisfies
Therefore, for each component i, we have . Since
, the value
is closer to 0 when
, and closer to
when
. Hence, the threshold decoding algorithm correctly recovers each bit
, and consequently recovers the message vector
with overwhelming probability.
Re-encryption of the original ciphertext. Let y be a valid node such that . The corresponding re-encrypted ciphertext component is denoted by
. Given the re-encryption key
, where
and
with overwhelming probability, we have
The noise term satisfies
Thus, the re-encrypted ciphertext component has the same form as a ciphertext encrypted under , except for a bounded noise term. Under the chosen parameter setting, this noise remains below the decoding threshold. Therefore, user B can correctly recover the message vector
with overwhelming probability.
Decryption of the re-encrypted ciphertext . Let
be the private key of user B. Since
and
hold with overwhelming probability, we have
If the noise term is bounded by the decoding threshold, namely
then each component can be correctly decoded as
Therefore, user B correctly recovers the message vector from the re-encrypted ciphertext with overwhelming probability.
To analyze revocation correctness, we consider the following two cases.
- Case 1:
. If user B is not revoked, then there exists at least one node on
that is also included in
. That is,
Let y be such a valid node and set . Then the corresponding ciphertext component can be used in the re-decryption algorithm. The resulting noise term is bounded as follows:
Therefore, the noise remains below the decoding threshold. Hence, the threshold decoding algorithm correctly recovers each bit , and consequently recovers the message vector
with overwhelming probability.
In this case, no valid pair can be found for the re-decryption procedure. Therefore, the re-decryption algorithm cannot obtain a valid ciphertext component for user B, and it outputs
.
4.2. Security
Theorem 4.1. Assume that the decisional problem is hard for any probabilistic polynomial-time adversary. Then the proposed IBPRE-DR scheme is IND-sID-CPA secure in the standard model. More precisely, for any PPT adversary
making polynomially many private-key, re-encryption-key, and re-encryption queries, there exists a PPT LWE distinguisher
such that
Since , where
, the reduction loss is linear in the number of revocation-related challenge components and remains polynomial in the security parameter.
Proof. We prove the theorem by a sequence of games. Let
where denotes the event that the adversary correctly guesses the challenge bit in
.
Query Restrictions. Before presenting the games, we specify the legal query restrictions in the IND-sID-CPA experiment. In the selective-identity setting, the adversary first commits to a challenge identity
and a challenge revocation list
. The following restrictions are imposed to prevent trivial attacks:
- Private-key queries:
is not allowed to query the private key of the challenge identity
.
- Re-encryption-key queries: The adversary is not allowed to query a re-encryption key from the challenge identity
to any identity
satisfying
.
- Re-encryption queries:
is not allowed to submit the challenge ciphertext to the re-encryption oracle in a way that produces a ciphertext decryptable by a non-revoked user.
All other queries are answered normally according to the corresponding algorithms.
Game Sequence. Through a sequence of four games, we show that the advantage of any PPT adversary is negligible.
is the original IND-sID-CPA security game as defined in Definition 5.
modifies the distribution of the public parameters using the Leftover Hash Lemma.
replaces the trapdoor-based query responses with simulated responses using a public trapdoor.
- Game3 replaces the challenge ciphertext with a uniformly random element, yielding zero adversary advantage.
We prove that consecutive games are indistinguishable: and
are statistically indistinguishable;
and
are statistically indistinguishable; and
and
are computationally indistinguishable under the LWE hardness assumption. Therefore,
’s advantage in
is negligible.
- Game0. This is the real IND-sID-CPA security game defined in Section 3.3. The challenger runs the real setup algorithm to obtain
, and answers all legal oracle queries honestly. In the challenge phase, the adversary submits two equal-length messages
. The challenger chooses a random bit
and returns the challenge ciphertext
. By definition,
- Game1. This game modifies the generation of some public matrices, while keeping the adversary’s view statistically close to that in
.
First, instead of choosing uniformly at random, the challenger samples a small matrix
and sets
Therefore, for the challenge identity , we have
Next, for each node , the challenger samples a small matrix
and defines
All other public parameters are generated in the same way as in .
By the leftover hash lemma, the distributions of and
are statistically close to uniform over the corresponding matrix spaces. Hence, the public parameters generated in
are statistically indistinguishable from those in
. It follows that
- Game 2. In this game, the challenger
modifies the generation of
. Instead of generating
by the trapdoor generation algorithm,
chooses
uniformly at random and does not possess the trapdoor
. All other public parameters are generated as in
. Since the distribution of the matrix output by
is statistically close to uniform over
, and since
is never given to the adversary, this modification is statistically hidden from
.
Although does not know
, it can still answer all admissible oracle queries by using the trapdoor
of the gadget matrix
. The simulations of the oracle queries are described as follows.
Since , the matrix
satisfies the full-rank difference property. Therefore, the challenger can use
to derive a trapdoor for the right part of
. Specifically,
runs
which outputs a short basis for
. Then
runs
obtaining such that
. Finally,
returns the private key
to the adversary.
: The challenger responds to every admissible re-encryption-key query from
to
. For a node y, define the extended matrix
. The simulation is divided into the following two cases.
- Case 1:
. In this case,
. Since
satisfies the full-rank difference property,
can use
to sample a short matrix
. It runs
obtainingsuch that
. The challenger returns
as the re-encryption key.
- Case 2:
and
is revoked with respect to
. Since
, for every node
, we have
. Therefore, by the construction in
, we have
. Moreover,
. Hence, the extended matrix for
and node y is
. Although the identity component does not contain a gadget term, the node component contains
. Thus,
can still use
to sample the re-encryption key. Specifically, it runs
obtainingsuch that
. The challenger returns
as the re-encryption key.
: For an admissible re-encryption query,
first obtains the corresponding simulated re-encryption key
as described in
. Then it runs the public re-encryption algorithm
and returns the resulting re-encrypted ciphertext to the adversary.
Using the above simulation, the challenger can answer all admissible queries without knowing . Moreover, by the standard properties of
,
, and
, the simulated private keys and re-encryption keys are statistically close to those generated in the real scheme. Therefore, the adversary’s view in
is statistically indistinguishable from that in
, and we have
- Game 3. This game is identical to
, except that the challenge ciphertext is replaced with a uniformly random ciphertext of the same form. In
, the challenge ciphertext is
where
and, for each,
We transform into
through a sequence of hybrid games defined over the underlying LWE samples used in the challenge ciphertext. In each hybrid, one underlying LWE-type sample is replaced by a uniformly random vector of the same dimension, and all ciphertext components derived from that sample are updated consistently. In particular, the identity-related component
, the message-masking component
, and the revocation-related components associated with
are replaced through at most
hybrid transitions. Each transition is computationally indistinguishable from the previous one under the decisional LWE assumption. The transformed error terms, such as , remain bounded under the parameter settings and are treated as part of the corresponding LWE-type ciphertext components.
If any two consecutive hybrids can be distinguished with non-negligible advantage, then this distinguisher can be used to construct a PPT algorithm that distinguishes LWE samples from uniformly random samples.
Therefore, there exists a PPT LWE distinguisher such that
In , the challenge ciphertext is uniformly random and independent of the challenge bit b. Hence, the adversary obtains no information about whether
or
was encrypted. Therefore,
Combining all game transitions, we obtain
Since the decisional LWE problem is assumed to be hard, the advantage of is negligible. Therefore,
is negligible. This proves that the proposed IBPRE-DR scheme is IND-sID-CPA secure in the standard model.
4.3. Comparison
The proposed IBPRE-DR scheme is compared with representative related schemes from several aspects, including security properties, functional features, theoretical complexity, computational overhead, estimated key and ciphertext sizes, and experimental running time. Specifically, Tables 4 and 5 summarize the security and functionality comparisons, Table 6 presents the theoretical comparison of identity-based revocable schemes, Table 7 compares the computational overhead of revocable proxy re-encryption schemes, Table 8 reports the estimated key and ciphertext sizes under the experimental parameters, and Table 9 gives the measured running time of the main algorithms.
Moreover, we conduct simulation experiments for the proposed scheme and representative related schemes under the same experimental setting. The experiments are performed on a machine equipped with an NVIDIA RTX 2080Ti GPU, an Intel Core i7-10510U CPU, and 16 GB of RAM. The implementation is written in C++ using the NTL library for modular arithmetic and matrix operations. Microsoft Visual Studio 2022 is used as the compilation and execution environment. The experimental parameters are set as n = 32 and q = 65536. We have m = 256. The revocation-related parameters are set as N = 50,100,200,500,1000 and . For the storage estimates, Y=
denotes the number of covering nodes generated by the complete subtree algorithm, and
denotes the length of the identity path. The reported running time is given as the average over these 10 executions.
As shown in Table 5, the proposed IBPRE-DR scheme provides a richer set of functionalities than existing related schemes. Specifically, our construction simultaneously supports identity-based proxy re-encryption, multi-bit message encryption, direct user revocation, and collusion resistance. In contrast, schemes [22] and [15] do not support multi-bit encryption or direct revocation, while scheme [19] relies on indirect revocation mechanisms. Moreover, unlike existing revocable schemes that require periodic key-update generation and distribution by the KGC, the proposed scheme eliminates KGC update overhead by allowing the data owner to directly manage the revocation list during encryption. Therefore, the proposed scheme achieves more flexible and timely access control for cloud data sharing environments.
Table 4 compares the security properties of the proposed scheme with representative related works. It can be observed that schemes [19] and [20] are constructed under traditional hardness assumptions and therefore do not provide resistance against quantum adversaries. By contrast, schemes [22], [15], and the proposed scheme are based on the LWE assumption, which is widely regarded as a standard foundation for post-quantum cryptography. Furthermore, the proposed IBPRE-DR scheme achieves IND-sID-CPA security under the LWE assumption while maintaining support for direct revocation and collusion resistance. Consequently, the proposed construction offers a stronger combination of security guarantees and practical functionality for post-quantum cloud data sharing applications.
Table 6 compares the proposed scheme with representative identity-based revocable schemes in terms of key size, ciphertext size, and revocation authority. As shown in the table, our scheme keeps the user secret key size constant and shifts the revocation workload from the KGC to the encryptor, while the ciphertext size increases with the covering node set.
The computational efficiency of our scheme relative to Wang’s revocable proxy re-encryption scheme is shown in Table 7. TSP, TSBL, TSL, and TExtRnd denote the time consumed by the algorithms ,
,
, and
, respectively. TMvmul represents the time consumed by matrix-vector multiplication operations performed in the group
.
and
denote the time for homomorphic signature generation and homomorphic signature evaluation, respectively. Here,
.
Qualitative discussion and trade-offs. The comparisons in Table 4–7 show that different schemes achieve different balances among security, functionality, and efficiency. Classical pairing-based PRE or ABPRE schemes can support flexible access control and revocation, but their security relies on traditional hardness assumptions and therefore they are not resistant to quantum attacks. In contrast, lattice-based schemes provide a promising post-quantum foundation, but many existing lattice-based revocable IBE or ABE schemes do not support proxy re-encryption, which limits their applicability in encrypted cloud data sharing scenarios where ciphertext transformation is required.
Compared with indirect revocation schemes, the main advantage of the proposed IBPRE-DR scheme is that revocation is enforced directly by the data owner during encryption. Therefore, the KGC does not need to periodically generate and distribute key-update information for non-revoked users. This design improves revocation timeliness and reduces the online management burden of the KGC. Moreover, the proposed scheme simultaneously supports identity-based proxy re-encryption, multi-bit encryption, direct revocation, and collusion resistance under the LWE assumption, making it suitable for post-quantum cloud data sharing environments with dynamic user membership.
However, these advantages come with certain trade-offs. Since the proposed scheme uses a complete subtree revocation mechanism, the ciphertext contains components associated with the covering set . As a result, the ciphertext size and part of the encryption/re-encryption overhead depend on the number of covering nodes. In general, the size of this covering set is related to the number of revoked users and the total number of users, and is bounded by
, where
. Therefore, when the system scale N is very large or the number of revoked users increases significantly, the ciphertext size and revocation-related computation may also increase.
Thus, the proposed scheme trades a moderate increase in ciphertext and revocation-management overhead for direct revocation, reduced KGC update burden, collusion resistance, and post-quantum security. It is particularly suitable for cloud storage scenarios in which user membership changes dynamically and revoked users should be excluded immediately without waiting for periodic key updates. For extremely large-scale deployments, further optimization of the revocation structure or the adoption of more compact lattice assumptions would be meaningful future research directions.
We estimate the storage costs under the experimental parameter setting used in our implementation: Here, denotes the number of non-revoked covering nodes, and
denotes the length of the identity path. The values in Table 8 reflect the actual storage overhead in our implementation and are used for the experimental evaluation in Section 4.3.
Table 9 reports the average running time of each algorithm in the proposed IBPRE-DR scheme under different numbers of system users N. Each value is the average of 10 executions.
Fig 4, Fig 5, Fig 6, Fig 7 illustrates the time costs of system setup, Key Generation, re-encryption key generation, and re-encryption. Where RIB-VPRE is [15].
As depicted in Fig 4, the system setup procedure exhibits a time cost that grows in direct proportion to the total user count. This is because the initialization process requires generating and assigning binary tree nodes and associated keys for each user. While the time cost grows in proportion to the user count, the slope is relatively gentle, making the overhead acceptable even in large-scale systems. When contrasted with existing indirect revocation schemes built on lattices, our scheme does not require pre-generating a large number of update keys during the setup phase.
Fig 5, The computational overhead of the RIB‑VPRE scheme increases in an approximately linear fashion with a modest slope, indicating that its dominant operations scale directly with the number of users while maintaining low per‑user cost. In contrast, our scheme achieves higher efficiency for small‑scale systems by circumventing the pre‑generation of numerous update keys. However, as the user population expands, the cumulative overhead arising from binary‑tree node management, matrix‑vector multiplications, and path‑based key derivation grows more rapidly, causing the time cost of our scheme to exceed that of RIB‑VPRE in large‑scale settings. Nevertheless, for medium‑scale deployments (), our scheme still delivers performance that is comparable to, or even better than, that of RIB‑VPRE.
Fig 6 depicts the time cost of re-encryption key generation. The time needed for re-encryption key generation scales logarithmically with respect to the total user count. This is due to the use of a binary tree structure for managing user revocation, where key generation only needs to cover the path nodes related to non-revoked users rather than all users.
As shown in Fig 7, the computational overhead incurred during the re-encryption phase remains largely unaffected with respect to the total user count. Instead, it is primarily influenced by the structure of the ciphertext and the computational complexity corresponding to the re-encryption key. Our scheme’s re-encryption operation involves only matrix-vector multiplications and a small amount of noise operations, resulting in low computational overhead. In contrast, some existing schemes require complex homomorphic operations or multiple key derivations during re-encryption, leading to time costs which grow as the user base expands.
4.4. Discussion on the choice of the LWE assumption
The proposed IBPRE-DR scheme is constructed under the standard Learning With Errors (LWE) assumption. We acknowledge that Ring-LWE (RLWE) and Module-LWE (MLWE) are generally considered more efficient in practical implementations due to their compact key and ciphertext representations as well as the availability of fast polynomial arithmetic techniques such as the Number Theoretic Transform (NTT).
However, the primary objective of this work is not to optimize the underlying lattice representation but to realize an efficient identity-based proxy re-encryption scheme with direct revocation. The proposed construction relies on GPV-style trapdoor delegation techniques, including TrapGen, SampleBasisLeft, SamplePre, and SampleLeft, which are naturally defined in the matrix-lattice setting and provide a flexible framework for identity embedding, re-encryption key generation, and binary-tree-based revocation management.
Moreover, the efficiency improvements achieved by the proposed scheme mainly originate from the direct revocation mechanism. Unlike traditional revocable lattice-based constructions that require periodic key-update generation and distribution by the KGC, our scheme allows the encryptor to directly specify the revocation list during encryption. As a result, the workload of the KGC and the communication overhead associated with key updates are significantly reduced.
Therefore, while RLWE and MLWE based constructions may offer superior low-level efficiency in terms of key size and arithmetic operations, the efficiency gains claimed in this work are primarily achieved at the protocol level through the elimination of update-key management and the simplification of revocation operations. Exploring RLWE- or MLWE-based direct revocable proxy re-encryption schemes remains an interesting direction for future research.
4.5. Discussion
Discussion on Formal Verification Tools. Formal verification tools such as AVISPA and ProVerif are widely used to analyze security protocols under symbolic security models, particularly for verifying secrecy and authentication properties in message-exchange protocols [44–46]. These tools are based on symbolic abstractions of cryptographic primitives and are effective for detecting attacks such as replay, impersonation, and man-in-the-middle attacks in protocol executions.
However, the proposed IBPRE-DR scheme is a lattice-based identity-based proxy re-encryption construction whose security is defined through IND-sID-CPA indistinguishability and proven by reduction to the hardness of the Learning With Errors (LWE) problem [47–49]. Such computational indistinguishability-based security properties and lattice hardness assumptions cannot be directly verified by symbolic protocol verification tools such as AVISPA. Therefore, the primary security guarantee of the proposed scheme is established through the game-based cryptographic proof presented in this paper.
Nevertheless, automated symbolic verification remains valuable for protocol-level authentication or key-establishment layers that may be built on top of the proposed encryption scheme. Extending the proposed framework with such an authenticated protocol layer and verifying it using tools such as AVISPA or ProVerif is an interesting direction for future work.
5. Limitations and future work
Although the proposed IBPRE-DR scheme achieves direct revocation and post-quantum security under the standard LWE assumption, some limitations remain. Since the construction is based on matrix-based LWE, its public parameters, private keys, and ciphertexts may be larger than those of schemes built from more compact structured lattice assumptions, such as Ring-LWE (RLWE) and Module-LWE (MLWE). Therefore, designing RLWE- or MLWE-based variants of the proposed scheme is an important direction for future work.
In addition, the current scheme focuses mainly on encryption, re-encryption, and revocation mechanisms. In future work, we will consider integrating authentication mechanisms into the framework and using formal verification tools such as AVISPA to analyze extended system-level protocols that combine authentication, encryption, re-encryption, and revocation.
6. Conclusion
To the best of our knowledge, IBPRE-DR is the first lattice-based identity-based proxy re-encryption scheme that integrates direct user revocation under the standard LWE assumption. We have shown that IBPRE-DR is IND-sID-CPA secure in the standard model and resistant to quantum attacks. During the key generation stage, a dual-key approach is employed, providing each user with two keys for re-encryption key generation and ciphertext decryption, respectively. Even under collusion involving the proxy and an authorized data user, they cannot derive the data owner’s private key from their partial private keys, thereby achieving collusion resistance. Furthermore, this scheme supports multi-bit encryption and incorporates an efficient revocation mechanism. By allowing the data owner to specify the revocation list during encryption, the scheme eliminates the need for the KGC to periodically refresh keys for non-revoked users. This reduces the KGC update overhead from to nearly zero and removes the communication cost and latency associated with key updates. This enables immediate revocation and makes the scheme effective for cloud storage environments with dynamic user populations.
References
- 1. Wen J, Bai L, Yang Z, Zhang H, Wang H, He D. LaRRS: lattice-based revocable ring signature and its application for VANETs. IEEE Trans Veh Technol. 2024;73(1):739–53.
- 2.
Blaze M, Bleumer G, Strauss M. Divertible protocols and atomic proxy cryptography. In: International Conference on the Theory and Applications of Cryptographic Techniques. Springer; 1998. p.127–44.
- 3. Ateniese G, Fu K, Green M, Hohenberger S. Improved proxy re-encryption schemes with applications to secure distributed storage. ACM Trans Inf Syst Secur. 2006;9(1):1–30.
- 4. Singh K, Rangan CP, Banerjee AK. Lattice based identity based proxy re-encryption scheme. J Internet Serv Inf Secur. 2013;3(3/4):38–51.
- 5.
Kirshanova E. Proxy Re-encryption from Lattices. Lecture notes in computer science. Springer Berlin Heidelberg; 2014. p. 77–94. https://doi.org/10.1007/978-3-642-54631-0_5
- 6. Dong C, Yang K, Qiu J, Chen Y. Outsourced revocable identity‐based encryption from lattices. Trans Emerging Tel Tech. 2018;30(11):e3529.
- 7. Dutta P, Susilo W, Duong DH, Roy PS. Collusion-resistant identity-based proxy re-encryption: lattice-based constructions in standard model. Theor Comput Sci. 2021;871:16–29.
- 8.
Fan X, Liu FH. Various proxy re-encryption schemes from lattices. Cryptology ePrint Archive. 2016.
- 9. Hou J, Jiang M, Guo Y, Song W. Efficient identity-based multi-bit proxy re-encryption over lattice in the standard model. J Inf Secur Appl. 2019;47:329–34.
- 10. Jiang MM, Hu YP, Wang BC, Wang FH, Lai QQ. Lattice‐based multi‐use unidirectional proxy re‐encryption. Secur Commun Netw. 2015;8(18):3796–803.
- 11. Katsumata S, Matsuda T, Takayasu A. Lattice-based revocable (hierarchical) IBE with decryption key exposure resistance. Theor Comput Sci. 2020;809:103–36.
- 12. Li J, Qiao Z, Zhang K, Cui C. A lattice-based homomorphic proxy re-encryption scheme with strong anti-collusion for cloud computing. Sensors (Basel). 2021;21(1):288. pmid:33406662
- 13. Wu L, Yang X, Zhang M, Liu L. New identity based proxy re-encryption scheme from lattices. China Commun. 2019;16(10):174–190.
- 14. Zhang X, Tang Y, Wang H, Xu C, Miao Y, Cheng H. Lattice-based proxy-oriented identity-based encryption with keyword search for cloud storage. Inf Sci. 2019;494:193–207.
- 15.
Wang X, Wang Y, Wang M. Lattice-based revocable identity-based proxy re-encryption with re-encryption verifiability. In: International Conference on Wireless Algorithms, Systems, and Applications. Springer; 2022. p. 535–544.
- 16. Wang H, Liao Y, Zhang Z, Dong Y, Zhou S. Lattice-based revocable IBEET scheme for mobile cloud computing. IEEE Trans Cloud Comput. 2025;13(3):807–820.
- 17.
Boldyreva A, Goyal V, Kumar V. Identity-based encryption with efficient revocation. In: Proceedings of the 15th ACM conference on Computer and communications security; 2008. p. 417–426. https://doi.org/10.1145/1455770.1455823
- 18. Shi Y, Zheng Q, Liu J, Han Z. Directly revocable key-policy attribute-based encryption with verifiable ciphertext delegation. Inf Sci. 2015;295:221–231.
- 19. Ge C, Liu Z, Xia J, Fang L. Revocable identity-based broadcast proxy re-encryption for data sharing in clouds. IEEE Trans Dependable Secure Comput. 2021;18(3):1214–1226.
- 20.
Ge C, Susilo W, Liu Z, Baek J, Luo X, Fang L. Attribute-based proxy re-encryption with direct revocation mechanism for data sharing in clouds. In: Proceedings of the ACM Turing Award Celebration Conference - China 2023; 2023. p. 164–165. https://doi.org/10.1145/3603165.3607460
- 21. Li Y, Zhu L, Deng Y, Zhang Q, Wang Z, Cao Z. Fast revocable attribute-based encryption with data integrity for Internet of Things. J Syst Archit. 2025;168:103551.
- 22.
Chen J, Lim HW, Ling S, Wang H, Nguyen K. Revocable identity-based encryption from lattices. Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2012. p. 390–403. https://doi.org/10.1007/978-3-642-31448-3_29
- 23. Zhao S, Jiang R, Bhargava B. RL-ABE: A revocable lattice attribute based encryption scheme based on R-LWE problem in cloud storage. IEEE Trans Serv Comput. 2022;15(2):1026–35.
- 24. Huang H, Li J, Bi S, Yuan Q. An efficient lattice-based integrated revocable identity-based encryption. Sci Rep. 2025;15(1):16729. pmid:40368979
- 25. Chen Z, Han L, Hu B. Revocable attribute-based encryption with efficient and secure verification in smart health systems. Mathematics. 2025;13(9):1541.
- 26. Huang B, Gao J, Li X. Efficient lattice-based revocable attribute-based encryption against decryption key exposure for cloud file sharing. J Cloud Comput. 2023;12(1):37. pmid:36937653
- 27. Feng Z, Yang W, Hu Y, Yin Y, Ma T, Tian X, et al. Blockchain-enabled lattice-based attribute-based searchable encryption with instant revocation. Electronics. 2026;15(11):2471.
- 28. Lin J, Li J, Di X, Yan G. A lattice-based traceable and direct revocable ABPRE with fair verification for data sharing in medical Internet of Things. IEEE Internet Things J. 2026;13(13):28476–89.
- 29. Ahmad A, Jagatheswari S. Quantum safe multi-factor user authentication protocol for cloud-assisted medical IoT. IEEE Access. 2025;13:3532–45.
- 30. Ahmad A, Jagatheswari S. PQ-ABS: post-quantum aggregate blind signature-based anonymous authentication for blockchain-enabled IoMT. IEEE Trans Inf Forensics Secur. 2026;21:1542–51.
- 31. Ahmad A, Jagatheswari S, Praveen R. Quantum-secure lightweight fuzzy extractor based user authentication scheme for internet of medical things. Soft Comput. 2026;30(2):787–808.
- 32. Ahmad A, Srirangan J. Quantum-safe mutual authentication scheme for IoHT using blockchain. Results Eng. 2025;28:106945.
- 33.
Micciancio D, Peikert C. Trapdoors for lattices: simpler, tighter, faster, smaller. In: Annual International Conference on the Theory and Applications of Cryptographic Techniques; 2012. p. 700–18.
- 34. Luo F, Al-Kuwari S, Wang F, Chen K. Attribute-based proxy re-encryption from standard lattices. Theor Comput Sci. 2021;865:52–62.
- 35.
Agrawal S, Boneh D, Boyen X. Lattice basis delegation in fixed dimension and shorter-ciphertext hierarchical IBE. In: Annual Cryptology Conference; 2010. p. 98–115.
- 36.
Applebaum B, Cash D, Peikert C, Sahai A. Fast cryptographic primitives and circular-secure encryption based on hard learning problems. In: Annual International Cryptology Conference; 2009. p. 595–618.
- 37.
Gentry C, Peikert C, Vaikuntanathan V. Trapdoors for hard lattices and new cryptographic constructions. In: Proceedings of the fortieth annual ACM symposium on Theory of computing; 2008. p. 197–206. https://doi.org/10.1145/1374376.1374407
- 38. Zhu Z-W, Huang R-W. A secure multi-party computation protocol without CRS supporting multi-bit encryption. PLoS One. 2022;17(3):e0265572. pmid:35303034
- 39.
Agrawal S, Boneh D, Boyen X. Efficient lattice (H)IBE in the standard model. In: Annual International Conference on the Theory and Applications of Cryptographic Techniques; 2010. p. 553–572.
- 40.
Boneh D, Gentry C, Gorbunov S, Halevi S, Nikolaenko V, Segev G, et al. Fully key-homomorphic encryption, arithmetic circuit ABE and compact garbled circuits. In: Annual International Conference on the Theory and Applications of Cryptographic Techniques; 2014. p. 533–556.
- 41. Cash D, Hofheinz D, Kiltz E, Peikert C. Bonsai trees, or how to delegate a lattice basis. J Cryptol. 2011;25(4):601–39.
- 42.
Naor D, Naor M, Lotspiech J. Revocation and tracing schemes for stateless receivers. In: Annual International Cryptology Conference; 2001. p. 41–62.
- 43. Takayasu A, Watanabe Y. Revocable identity-based encryption with bounded decryption key exposure resistance: Lattice-based construction and more. Theor Comput Sci. 2021;849:64–98.
- 44. Dolev D, Yao A. On the security of public key protocols. IEEE Trans Inf Theory. 1983;29(2):198–208.
- 45.
Armando A, Basin D, Boichut Y, Chevalier Y, Compagna L, Cuellar J, et al. The AVISPA tool for the automated validation of internet security protocols and applications.International conference on computer aided verification. Berlin, Heidelberg: Springer Berlin Heidelberg; 2005. p. 281–285.
- 46. Blanchet B. Modeling and verifying security protocols with the applied pi calculus and ProVerif. Found Trends Priv Secur. 2016;1(1–2):1–135.
- 47. Regev O. On lattices, learning with errors, random linear codes, and cryptography. J ACM. 2009;56(6):1–40.
- 48. Peikert C. A decade of lattice cryptography. Found Trends Theor Comput Sci. 2016;10(4):283–424.
- 49.
National Institute of Standards and Technology. FIPS 203: Module-lattice-based key-encapsulation mechanism standard. Gaithersburg, MD, USA: National Institute of Standards and Technology, 2024.