RCCA-SM9: securing SM9 on corrupted machines

The SM9 identity-based encryption (IBE) scheme is a cryptographic standard used in China, and has been incorporated into the ISO/IEC standard in 2021. This work primarily proposes a countermeasure to secure the SM9 IBE scheme if its implementation is tampered with or deviated from the standard specification. Such attacks, known as subversion attacks, are feasible and powerful in real-world cryptographic application scenarios. Our goal is to design a subversion-resilient variant of the SM9 IBE scheme, primarily using the cryptographic reverse firewall (CRF) proposed by Mironov and Stephens-Davidowitz at EUROCRYPT 2015. A CRF can sanitize cryptographic transcripts to eliminate covert channels, necessitating that the underlying primitive be rerandomizable. Unfortunately, the rerandomizability of the SM9 IBE scheme is disabled for ensuring security against chosen ciphertext attack (CCA). Hence, we shift our focus to a relaxed version of CCA security called RCCA security, offering security guarantees comparable to CCA security while allowing for ciphertext rerandomization. For this purpose, we design an efficient and RCCA-secure variant of the SM9 IBE scheme with provable security that can integrate with CRFs to achieve subversion resilience.