text:
Methods for transferring among key holders in encoding and cryptographic systems the right to decode and decrypt messages in a way that does not explicitly reveal decoding and decrypting keys used and the original messages. Such methods are more secure and more efficient than typical re-encoding and re-encryption schemes, and are useful in developing such applications as document distribution and long-term file protection.
1. A method for encrypting an original message to be passed to a recipient by way of a grantor, the method comprising the steps of:
obtaining an encrypted message representative of the original message, the encrypted message having been encrypted with a public key corresponding to the grantor according to a public key encryption scheme;
generating a public proxy key based on a private key corresponding to the recipient and on the private key corresponding to said grantor, wherein said grantor's private key and said recipient's private key are combined, and the combination of the private keys is based on said public key encryption scheme and provides that it is computationally difficult to recover the recipient's private key from the public proxy key even with the knowledge of the grantor's private key; and
applying the public proxy key to the encrypted message to transform the encrypted message into a transformed message, wherein the transformed message is decryptable by the recipient using information selected from the private key corresponding to the recipient and the available public key information, and wherein the encrypted message remains in an encrypted state while being transformed into the transformed message and is not decrypted to the original message and re-encrypted at any point during the transformation.
2. The method of
3. The method of
4. The method of
5. The method of
6. The method of
7. The method of
8. The method of
9. The method of
10. The method of
11. The method of
12. The method of
13. The method of
14. The method of
15. A method for encrypting an original message to be passed to a recipient by way of a grantor, the method comprising the steps of:
obtaining an encrypted message representative of the original message, the encrypted message having been encrypted with a public key corresponding to the grantor according to a public key encryption scheme;
generating a public proxy key based on a public key corresponding to the recipient and on the private key corresponding to the public key of said grantor, wherein said grantor's private key and said recipient's public key are combined, and the combination of said grantor's private key and said recipient's public key is based on said public key encryption scheme; and
applying the public proxy key to the encrypted message to transform the encrypted message into a transformed message, wherein the transformed message is decryptable by the recipient using information selected from the private key corresponding to the recipient's public key and the available public key information, and wherein the encrypted message remains in an encrypted state while being transformed into the transformed message and is not decrypted to the original message and re-encrypted at any point during the transformation.
16. The method of
17. The method of
18. The method of
19. The method of
20. The method of
21. The method of
22. The method of
23. The method of
24. The method of
25. The method of
26. The method of
27. The method of
28. The method of
29. The method of
30. The method of
31. The method of
This application claims the benefit of U.S. Provisional Application No. 60/128,164, filed on Apr. 6, 1999.
The invention relates to cryptographic methods, and more particularly to systems and methods for delegating decryption rights without revealing private keys or message contents.
One of the most important issues impeding the widespread distribution of digital documents via electronic commerce is the current lack of protection of the intellectual property rights of content owners during the distribution and use of those digital documents. Efforts to resolve this problem have been termed "Intellectual Property Rights Management" ("IPRM"), "Digital Property Rights Management" ("DPRM"), "Intellectual Property Management" ("IPM"), "Rights Management" ("RM"), and "Electronic Copyright Management" ("ECM").
A document, as the term is used herein, is any unit of information subject to distribution or transfer, including but not limited to correspondence, books, magazines, journals, newspapers, other papers, software, photographs and other images, audio and video clips, and other multimedia presentations. A document may be embodied in printed form on paper, as digital data on a storage medium, or in any other known manner on a variety of media.
In the world of printed documents, a work created by an author is usually provided to a publisher, which formats and prints numerous copies of the work. The copies are then sent by a distributor to bookstores or other retail outlets, from which the copies are purchased by end users.
While the low quality of copying and the high cost of distributing printed material have served as deterrents to the illegally copying of most printed documents, it is far too easy to copy, modify, and redistribute unprotected electronic documents. Accordingly, some method of protecting electronic documents is necessary to make it harder to illegally copy them. This will serve as a deterrent to copying, even if it is still possible, for example, to make hardcopies of printed documents and duplicate them the old-fashioned way.
With printed documents, there is an additional step of digitizing the document before it can be redistributed electronically; this serves as a deterrent. Unfortunately, it has been widely recognized that there is no viable way to prevent people from making unauthorized distributions of electronic documents within current general-purpose computing and communications systems such as personal computers, workstations, and other devices connected over local area networks (LANs), intranets, and the Internet. Many attempts to provide hardware-based solutions to prevent unauthorized copying have proven to be unsuccessful.
Two basic schemes have been employed to attempt to solve the document protection problem: secure containers and trusted systems.
A "secure container" (or simply an encrypted document) offers a way to keep document contents encrypted until a set of authorization conditions are met and some copyright terms are honored (e.g., payment for use). After the various conditions and terms are verified with the document provider, the document is released to the user in clear form. Commercial products such as IBM's Cryptolopes and InterTrust's Digiboxes fall into this category. Clearly, the secure container approach provides a solution to protecting the document during delivery over insecure channels, but does not provide any mechanism to prevent legitimate users from obtaining the clear document and then using and redistributing it in violation of content owners' intellectual property.
Cryptographic mechanisms are typically used to encrypt (or "encipher") documents that are then distributed and stored publicly, and ultimately privately deciphered by authorized users. This provides a basic form of protection during document delivery from a document distributor to an intended user over a public network, as well as during document storage on an insecure medium.
In the "trusted system" approach, the entire system is responsible for preventing unauthorized use and distribution of the document. Building a trusted system usually entails introducing new hardware such as a secure processor, secure storage and secure rendering devices. This also requires that all software applications that run on trusted systems be certified to be trusted. While building tamper-proof trusted systems is still a real challenge to existing technologies, current market trends suggest that open and untrusted systems such as PC's and workstations will be the dominant systems used to access copyrighted documents. In this sense, existing computing environments such as PC's and workstations equipped with popular operating systems (e.g., Windows and UNIX) and render applications (e.g., Microsoft Word) are not trusted systems and cannot be made trusted without significantly altering their architectures.
Accordingly, although certain trusted components can be deployed, one must continue to rely upon various unknown and untrusted elements and systems. On such systems, even if they are expected to be secure, unanticipated bugs and weaknesses are frequently found and exploited.
One particular issue arises in the context of document distribution, as described generally above. In the traditional model of document distribution, the content author and the publisher typically do not handle distribution; a separate party with distribution expertise is given that responsibility. Furthermore, while it is possible to encrypt a document (using standard techniques) so that multiple recipients can decrypt it, it is not usually known at the time a work is created who the ultimate users will be. It makes more sense for the distributor to determine who the end users will be, and to distribute the document to them as desired. If, as in traditional model, the original work of authorship is sent to a publisher and a distributor in the clear, that is a point of vulnerability for the work.
A similar problem arises in office settings, for example, in which it is frequently desirable to designate what is variously called a document agent, surrogate, or delegate. In this situation, it is often useful to be able to give an administrative assistant or secretary the right to decrypt certain document not intended directly for that person.
Considering the problem more broadly, in a networked environment, messages are often passed to recipients other than their initially intended ones. When message confidentiality is a concern and encrypted messages are forwarded, it is very desirable to allow one to decrypt these messages on behalf of another. To be concrete, suppose that Bob is the one who needs to read some message that is initially encrypted for Alice. One trivial solution is that Alice simply reveals her decryption key to Bob so that Bob can use it to decrypt the message himself. This requires Alice to trust Bob totally, which may not be acceptable to Alice. Another way to accomplish this task is to let Alice first decrypt the message, then re-encrypt it for Bob and finally send the newly encrypted message to Bob so that he can decrypt. Though the message is communicated securely, this solution is less efficient as it requires two decryption and one encryption operations in order for Bob to obtain the message. More importantly, in some situations such re-encryption solution is not even applicable or desirable. For example, Alice may not have access to the encrypted message, as it may be sent by its originator directly to Bob for communication efficiency and other considerations. Also, decrypting the encrypted message to a clear version, even if only for a short time, can be a substantial vulnerability.
Accordingly, it would be desirable to have an encryption/decryption framework that supports the ability to transfer the right to decode messages. Such a framework would allow a delegate to, essentially, authorize the re-encryption of a message for another party's use without first decrypting the original message. It would also be useful for this to be possible without the delegate ever having possession of the encrypted message.
How to transfer the right to decrypt from one key holder to another in a secure and efficient way is the subject of proxy encryption. Some specific proxy encryption schemes have been recently proposed to convert messages encrypted for one key into messages encrypted for another without revealing secret decryption keys and original messages to the public. Mambo and Okamoto have introduced several private, non-commutative, message-independent proxy encryption schemes. Blaze and Strauss have introduced a public, commutative, message-independent proxy encryption scheme.
In this disclosure, the same general problem is initially addressed but in the more general context of encoding schemes. Encoding schemes considered in this disclosure differ from encryption schemes or cryptosystems in that they do not necessarily have any security-related requirements. For an encoding scheme to be an encryption scheme, it is necessary that an eavesdropper, upon seeing an encoded message, should be unable to determine either the original message or the key used to decode the message. Working with encoding schemes makes it possible to build applications with lightweight security but high implementation efficiency, such as efficient massive document distribution and updating of ciphertext with new keys to protect long-term encrypted messages. In this disclosure, a class of encoding schemes is defined, and several example schemes are given. A process by which new schemes can be constructed using existing ones is also offered herein.
Several more formal proxy encryption schemes are then presented. A proxy encryption scheme is an encryption scheme that allows a designated key holder to decrypt messages on behalf of another key holder. This disclosure introduces two new proxy encryption schemes based on the known ElGamal scheme, with improved functionalities over existing proxy encryption schemes. They are public in the sense that proxy-related information and transformations can be safely made to the public, and at the same time non-commutative in terms of trust relationships among involved key holders. Applications of these new schemes to massive document distribution and file protection are also presented.
The basic idea in the methods present in this disclosure is as follows: in order for Alice to transfer the right to decode to Bob, Alice generates a transfer key t for Bob. With the transfer key t, Bob can re-encrypt the message initially encoded for Alice and subsequently decrypt it using his own key. Much like in proxy encryption, the transfer is performed in such a way that the transfer key does not explicitly reveal the decoding keys of either Alice or Bob, or the original message.
How to delegate the right to decrypt from one key holder to another in secure and efficient ways is the subject of proxy encryption. Very recently, some specific proxy encryption schemes have been proposed to convert messages encrypted for one key into messages encrypted for another without revealing secret decryption keys and original messages to the public. Mambo and Okamoto have described three proxy encryption schemes for the ElGamal and RSA encryption schemes. M. Mambo and E. Okamoto, "Proxy cryptosystems: Delegation of the power to decrypt ciphertexts," IEICE Trans. on Fundamentals, Vol. E80-A, No. 1, pp. 54-63 (1997). For the situation mentioned above, their schemes have better computational performance over the re-encryption scheme, but for security reasons require the presence of the original key holder Alice in the message conversion. Moreover, the schemes themselves do not help specifying who is the key holder that Alice wants to delegate the decryption right to. The scheme proposed by Blaze and Strauss, on the other hand, does not have these shortcomings. It is a modification of the ElGamal encryption scheme. M. Blaze and M. Strauss, "Proxy Cryptography," Draft, AT&T Research Labs, ftp://ftp.research.att.com/dist/mab/proxy.ps (May 1997). One very appearing feature of the Blaze and Strauss scheme is that it permits communicating proxy related information and performing the message conversion in public. But it introduces a more serious problem: it is commutative in the sense that Bob is able to obtain Alice's decryption key. This type of commutativity makes the proxy encryption scheme obsolete, as the entire scheme can be well simplified to giving Alice's key to Bob and letting Bob decrypt. Another issue (not necessarily a problem) created by this scheme is that once Bob has been granted the decryption right by Alice, he can decrypt all messages that are originally for Alice. This message-independence may be useful in some cases such as self-delegation but is not be desirable in many practical applications where the original key holder wants to be selective on which messages the delegated decryption is allowed.
Accordingly, the proxy encryption schemes according to the present invention, which are public and non-commutative, eliminate some of the disadvantages of other known cryptosystems.
In this disclosure, two new proxy encryption schemes are then introduced. They are all based on the ElGamal public-key encryption scheme and have comparable computational performance. Essentially, they have retained the following desirable features of the existing schemes: (i) public: the presence of the original key holder is not required after proxy information is generated, and proxy related information and operations can communicated and conducted in public; (ii) non-commutative: key holders do not have to trust each other in regard to their private decryption keys; and (iii) restricted: the key holder to whom the decryption right is delegated to is specified, and the proxy information (key) is message dependent.
Finally, delegating the right to decrypt messages is then described in the context of the Cramer-Shoup cryptosystem, which bears some advantages over other systems.
These and other features and advantages of the present invention are apparent from the Figures as fully described in the Detailed Description of the Invention.
The Figures are more fully explained in the following Detailed Description of the Invention.
The invention is described below, with reference to detailed illustrative embodiments. It will be apparent that the invention can be embodied in a wide variety of forms, some of which may be quite different from those of the disclosed embodiments. Consequently, the specific structural and functional details disclosed herein are merely representative and do not limit the scope of the invention.
An author (or publisher) 110 creates a document's original content 112 and passes it to a distributor 114 for distribution. Although it is contemplated that the author may also distribute documents directly, without involving another party as a publisher, the division of labor set forth in
The distributor 114 then passes modified content 116 to a user 118. In a typical electronic distribution model, the modified content 116 represents an re-encrypted version of the original encrypted content 112; the distributor 114 first decrypts the original content 112 and then re-encrypts it with the user 118's public key; that modified content 116 is customized solely for the single user 118. The user 118 is then able to use his private key to decrypt the modified content 116 and view the original content 112.
A payment 120 for the content 112 is passed from the user 118 to the distributor 114 by way of a clearinghouse 122. The clearinghouse 122 collects requests from the user 118 and from other users who wish to view a particular document. The clearinghouse 122 also collects payment information, such as debit transactions, credit card transactions, or other known electronic payment schemes, and forwards the collected users' payments as a payment batch 124 to the distributor 114. Of course, it is expected that the clearinghouse 122 will retain a share of the user's payment 120. In turn, the distributor 114 retains a portion of the payment batch 124 and forwards a payment 126 (including royalties) to the author and publisher 110. In one embodiment of this scheme, the distributor 114 awaits a bundle of user requests for a single document before sending anything out. When this is done, a single document with modified content 116 can be generated for decryption by all of the requesting users. This technique is well-known in the art.
In the meantime, each time the user 118 requests (or uses) a document, an accounting message 128 is sent to an audit server 130. The audit server 130 ensures that each request by the user 118 matches with a document sent by the distributor 114; accounting information 131 is received by the audit server 130 directly from the distributor 114. Any inconsistencies are transmitted via a report 132 to the clearinghouse 122, which can then adjust the payment batches 124 made to the distributor 114. This accounting scheme is present to reduce the possibility of fraud in this electronic document distribution model, as well as to handle any time-dependent usage permissions that may result in charges that vary, depending on the duration or other extent of use.
The foregoing model for electronic commerce in documents, shown in
Proxy Encoding Schemes
For simplicity, initially consider encoding schemes of the following type. An encoding system consists of four components: (i) a message space X which is a collection of possible messages, (ii) a key space K which is a set of possible keys, (iii) a computationally efficient encoding transformation E:K�X→X and (iv) a computationally efficient decoding transformation D:K�X→X. For each kεK, the encoding transformation Ek:X→X and decoding transformation Dk:XεX are injection (one-to-one) mappings on X, and they satisfy that, for every message xεX,
Such defined encoding schemes have some advantageous properties. Given an encoding scheme (X, K, E, D), each encoding transformation and its corresponding decoding transformation are inverse transformation of each other; that is, for each kεK,
Classic, symmetric-key encryption schemes are encoding schemes. Here are some of them.
XOR Scheme X. In this scheme, the message space X is the set Bn of all n-bit binary strings for some integer n>0, and so is the key space K. The number of possible messages and the number of possible keys are both 2n. For each message x and each key k, the encoding is
Multiplicative Scheme M. A message in this scheme is an element in X=Zn={0, 1, . . . , n−1 } for some integer n>0. A key is also an element a in Zn but satisfying gcd(a, n)=1, where the "gcd" function specifies the greatest common integer divisor of the two arguments. That is, the key space K consists of the elements in the multiplicative group Zn*={aεZn|gcd(a, n)=1}. The encoding of a message x with a key a is
Shift Scheme S. Messages and keys of the shift scheme are all elements in Zn={0, 1, . . . , n−1 } for some integer n>0; that is, X=K=Z. Thus, the number of messages and the number of keys in the shift scheme are all equal to n. To encode a message x with a key b, one calculates
Substitution Scheme P. This scheme is also defined over X=Zn However, the key space K=Πn consists of all permutations of elements in Zn. Thus, the total number of keys is n!. For each permutation pεΠn, the encoding is
It should be noted that the multiplicative and shift schemes are special cases of the substitution scheme which include only φ(n) and n of the n! possible permutations of n elements, respectively.
New encoding schemes can be constructed by combining existing ones. One way is to form their "product." Suppose S and S′ are two encoding schemes with the same message space X. The product of S and S′, denoted by S�S′, has the same message space X. A key of the product scheme has the form (k, k′), where k and k′ are keys of S and S′, respectively. The encoding and decoding transformations of the product scheme are defined as follows: for each key (k, k′)εK,
It is straightforward to check that the product construction is always associative: (S�S′)�S″=S�(S′�S″). If an encoding scheme S is taken to form the product with itself, one obtains the scheme S�S, denoted by S2. If the n-fold product is taken, the resulting scheme, denoted by Sn, is called an iterated encoding scheme.
A simple example to illustrate the definition of product encoding schemes is as follows.
Affine Scheme A. This scheme is also defined over X=Zn. A key of the affine scheme is a pair of integers (a, b) in Zn, where gcd(a, n)=1. The encoding transformation is
The objective of transferring the right to decode messages in any given encoding scheme (X, K, E, D) can be stated as follows: for any given message xεX and keys k,k′εK, convert in some efficient way the encoded message y=Ek(x) using the key k into the encoded message y′=Ek(x) using the key k′ so that the new message y′ can be decoded correctly using the key k′. If this can be achieved, it is said that the right to decode the message y has been transferred or delegated from the key holder of k to the key holder of k′.
In many cases, the key space K of an encoding scheme is not merely a set. Equipped with some operation "�", K may possess some mathematical structure. For instance, the key spaces of all the example schemes given in the previous section can be equipped with some operations to become mathematical groups. Table 1, below, shows some of these operations, where ∘ stands for the composition operator of permutations and
When the key space K of an encoding scheme (X, K, E, D) is a group with some operation "�", the encoding and decoding transformations may be uniquely determined by the keys. This happens when the key space K is isomorphic, as a group, to the transformation groups E={Ek|kεK} and D={Dk|kεK} formed by the encoding and decoding transformations on the message space X; that is, for any k,k′εK,
It can be easily checked that all the schemes given in Table 1 above are key-determined. Key-determined encoding schemes permit a systematic way to transfer the right to decode messages from one key holder to another. With the isomorphism between the key space and the transformation groups, the composition of the decoding transformation with one key k and the encoding transformation with another key k′ can then be viewed as the encoding transformation determined by the composed key k−1�k. Let (X, K, E, D) be a key-determined encoding scheme. Suppose y=Ek(x) is the encoded version of the message xεX with the key kεK. The right to decode the encoded message of x can be transferred from the key holder of k to the key holder of k′ in the two-step algorithm shown in
First, generate a transfer key t=k−1�k (step 310). Then encode the message with the transfer key t according to y′=Et(y) (step 312).
The algorithm is correct thanks to the property of the key space being isomorphic to the encoding and decoding transformation groups. The correctness can be verified as follows:
The generality of the algorithm makes it immediate to derive the transference steps for the example schemes set forth above. Referring again to
For the Multiplicative Scheme M over Zn*, to convert y=Ea(x) to y′=Ea′(x), first generate a transfer key t=a′a−1(mod n) (step 310). Then encode the message with the transfer key t according to y′=ty(mod n) (step 312).
For the Shift Scheme S over Zn, to convert y=Eb(x) to y′=Eb′(x), first generate a transfer key t=b′−b (mod n) (step 310). Then encode the message with the transfer key t according to y′=y+t(mod n) (step 312).
For the Substitution Scheme P over Πn, to convert y=Ep(x) to y′=Ep′(x), first generate a transfer key t=p−1∘p′ (step 310). Then encode the message with the transfer key t according to y′=t(y) (step 312).
As will be described below, it is also possible to transfer the right to decode in product schemes of not only key-determined encoding but also commuting schemes. In order to define commuting schemes, it is necessary to characterize encoding schemes that are essentially equivalent. Suppose that S=(X, K, E, D) and S′=(X, K′, E′, D) are two encoding schemes with the same message space X. S is said to be equivalent to S′, denoted by S≡S′, if there is a bijective (one-to-one and onto) mapping h:K→K′ such that for each message xεX and for each key kεK,
The scheme equivalence relation allows one to characterize encoding schemes in several ways. An encoding scheme S is said to be idempotent if S2≡S. Many of the encoding schemes are idempotent, including the XOR, multiplicative, shift, substitution, and affine schemes. If a scheme S is idempotent, then there is no point in using the product scheme S2, as it requires an extra key but provides no more functionality.
Another characterization on encoding schemes using the scheme equivalence relation ≡ is that of commuting schemes. Two encoding schemes S and S′ are said to commute if S�S′≡S′�S. Trivially, any scheme commutes with itself. A not-so-trivial example is that of the multiplicative scheme M and the shift scheme S. To see that they commute, i.e., M�S≡S�M, one can compare the equations
Product schemes of key-determined and commuting encoding schemes enjoy a systematic way of transferring the right to decode messages. Let S1�S2 be the product scheme of two key-determined and commuting encoding schemes. Suppose that h=(h1, h2):K2�K1→K1�K2 is the mapping that makes S2�S1 isomorphic to S1�S2, where h1:K2�K1→K1 and h2:K2�K1→K2. First, observe that the product scheme is also key-determined; the product key space K1�K2 is a group with respect to the operation * defined by
Now, the right to decode the encoded message of x can be transferred from the key holder of k to the key holder of another key k′ in the two-step algorithm shown in
The correctness of the transference algorithm is verified by the following equality:
The method is best illustrated with the following example, applying the affine cipher A over Zn. Since A=M�S, and M and S are key-determined, commuting schemes, the method described above applies to the affine scheme. As seen before, it is the mapping h(b, a)=(a, ab) that makes S�M isomorphic to M�S. Thus, h1(b, a)=a and h2(a, b)=ab (mod n). The transfer key t from (a, b) to (a′, b′) can be derived as
The methods presented herein for transferring the right to decode messages are transitive. This means that two sequential transfers from Alice to Bob and then from Bob to Carol are equivalent to a direct transfer from Alice to Carol. It is important to note that, in each of the example schemes, a transfer key is also a key of the scheme.
Accordingly, two transfer keys used in the two sequential transfers can be combined to form a transfer key for the direct transfer. Take the affine scheme as an example. Let k=(a, b), k′=(a′, b′), and k″=(a″, b″) be the keys for Alice, Bob, and Carol, respectively. Then the transfer keys are t=(a′a−1, −a′a−1b+b′) from Alice to Bob, t′=(a″a′−1,−aa″a′−1b′+b″) from Bob to Carol, and t″=(a″a−1,−a″a−1b+b″) from Alice to Carol. It is straightforward to verify that the composition of t and t′ as keys in the affine scheme yields t″:
It should be noted also that, for the schemes X, M, and S, the transfer key generation step is equivalent to "decoding" k′ with k. Thus, the computation needed in the transfer is the same as the one used in the decoding-and-re-encoding method for these schemes. One may think that the new method shows no improvement in this efficiency regard, but it has been found that the transfer key is message-independent and hence needs to be computed only once. When the number of messages m involved in the transfer increases, this feature will cut the computation required by the re-encoding method by half. Moreover, the transfer key t does not leak any useful information on the keys k and k′, and a transfer performed according to the methods set forth herein will not reveal the message x. These properties make the proposed method appealing when the security of the message x and the decoding keys k and k′ is an issue during a transfer.
A typical system configuration capable of carrying out the methods described with reference to
Proxy Encryption Schemes
The rest of the disclosure, directed to more formal proxy encryption schemes, rather than encoding schemes, is organized as follows. First, a generic proxy encryption scheme is described and characterized according to several criteria. The several following paragraphs fix set forth notation that will be used throughout the disclosure and recall the ElGamal public-key encryption scheme. For the purpose of comparison, this disclosure then lists two existing proxy encryption schemes and examines their properties in comparison to the present invention. Details on the two new proxy encryption schemes are then introduced, together with their security and performance analysis. Applications of these new schemes to massive document distribution and file protection are given thereafter.
As indicated in the introduction, the goal of proxy encryption is to delegate the decryption right from one to another in secure and efficient ways. For the discussion that follows, it is convenient to define the roles of parties that may be involved in proxy encryption. Two most important roles are those of grantor and grantee. A grantor is an original key holder of encrypted messages who wants to delegate the decryption right to someone else. A grantee is a key holder designated to perform decryption on behalf of a grantor and thus act as grantor's decryption proxy. In the motivating example in the introduction, Alice is the grantor while Bob is the grantee. Other roles may include an encryptor who is an one that originally encrypts messages for the grantor, and a facilitator who may help to perform some message processing tasks, such as transforming messages encrypted for the grantor into messages encrypted for the grantee. Certainly, it is not necessary that all these roles are played by different parties. For example, a party may play roles of the grantor and facilitator, as in the Mambo and Okamoto schemes discussed below.
With these roles in place, a proxy encryption scheme is just a description of how a grantor, possibly with some aid from a facilitator, delegates a grantor the right to decrypt messages originally generated by an encryptor for the grantor. A proxy encryption scheme may consist of four generic steps: message encryption, proxy key generation, proxy transformation and message decryption. These steps will be described in further detail below, with reference to
1. Message encryption E: The encryptor generates an encrypted message using grantor's encryption key and delivers it to the grantor (step 510).
2. Proxy generation π: To delegate the decryption right to the grantee, the grantor generates a proxy key π as a commitment token that allows the grantee to decrypt the message encrypted for the grantor (step 512).
3. Proxy transformation Π: When necessary, the facilitator performs a proxy transformation Π, possibly using the proxy key π, to convert the message encrypted for the grantor to a message encrypted for the grantee (step 514).
4. Message decryption D: Upon receiving the transformed message and possibly the proxy key π, the grantee decrypts the message (step 516).
Accordingly, it should be observed that the generic scheme above covers the two straightforward solutions to proxy encryption mentioned in the introduction. The re-encryption scheme is a special case where the grantor (Alice) is also the facilitator who actually decrypts the message and then encrypts for the grantee (Bob), and the proxy π can be considered as a collection of grantor's decryption key and grantee's encryption key, which is used only by the grantor and not by the grantee. The scheme of passing grantor's decryption key to the grantee is another special case of the generic scheme, where the proxy key is the decryption key and the proxy transformation is the identity transformation.
However, not all schemes that can be derived from the generic one above are qualified as proxy encryption schemes. Intuitively, a proxy encryption scheme has to satisfy some basic requirements, namely delegation, security, transmitivity and performance, as described below.
Delegation. To ensure that, at the end of the message decryption step, the grantee is able to recover the original message correctly, the following equation must hold for any message m:
In addition to the correctness above, the functionality of delegation should be guaranteed. In one form, this means that, after the proxy key is issued and the proxy transformation is completed, the message decryption step should require no private information from the grantor, and it should be carried out solely by the grantee. In another form, this is equivalent to undeniability of the delegation from the grantor; that is, once the proxy key is created and proxy transformation is performed, the grantor should not be able to deny the delegation, without seeking other means such as preventing the grantee from obtaining the proxy key and receiving the transformed message. As a consequence of this functionality, the grantor's decryption key can be destroyed with grantee's decryption key and possibly the proxy key maintaining the ability to decrypt the message. (This is useful in the file protection application later in Section 6.)
Security. In essence, a proxy encryption scheme is also an encryption scheme at least from the grantee's point of view. The introduction of proxy keys and transformations must in no way compromise security and privacy of the encryption. Thus, it should be at least computationally hard for any unauthorized third party to recover the original message and decryption keys of the grantor and grantee from publicly available information.
Moreover, forging valid proxy keys by any untrusted party should be very hard. It must be clear, though, that generating the proxy key π requires knowledge of at least the decryption key of the grantor; otherwise the underlying encryption system is not secure.
Transitivity. Naturally, the proxy relationship should be transitive. After the grantor delegates the decryption right, the grantee should be able to act as a new grantor to delegate the right further to another grantee, by just following the same scheme. Moreover, it should be possible for someone, say the first grantor, to delegate the right directly to a new grantee by combining all intermediate proxy keys into one proxy key and composing all consecutive proxy transformations into one transformation.
Performance. As the re-encryption scheme is an intuitive, straightforward solution to proxy encryption and it satisfies the above delegation, security and transmitivity requirements, any practically useful proxy encryption scheme should have no degradation in computational performance when compared with the re-encryption scheme.
Proxy encryption schemes may vary according to their application requirements. They can be categorized according to many aspects. Obvious ones include whether they are public-key or private-key based, and whether their security measures are perfect in the information theoretical sense or rely on intractability of some computational problems. The following aspects ones are related to the proxy key and transformation.
Confidentiality. While secrecy of messages and decryption keys has to be enforced, secrecy of proxy keys and proxy transformations may not be a mandatory requirement. A scheme is called public if proxy keys it generates may be published without compromising its security and proxy transformations applied in untrusted environments; otherwise, the scheme is private. In a private scheme, when a proxy key is transferred from the grantor to the facilitator and grantee, care must be taken to protect the proxy key from disclosure. As a result, the proxy transformation which uses the proxy key must be performed in private as well.
Commutativity. In terms of messages, the grantee must be unconditionally trusted by the grantor, since proxy encryption by definition allows the former to decrypt on behalf of the latter. However, the trust model may be different for their private information. A proxy encryption scheme is commutative if the grantor and grantee have to trust each other with regard to their private keys; otherwise, it is non-commutative. A commutative example is that the proxy key is such created that either one of the grantor and grantee can obtain other's decryption key from it. Whenever this is the case, the proxy encryption mechanism may be simplified to a key exchange protocol that allows the grantee to use grantor's decryption key to decrypt the encrypted messages directly.
Generality. In many cases, the grantor wants to restrict the scope of the delegated decryption right. Often intended restrictions include that the proxy key may only be used by a designated grantee, that the proxy key may only be applicable to a specific message, or that the proxy transformation may only be applied by a specific facilitator. For example, when a proxy encryption scheme is used in some applications like key escrow, it would be ideal that proxy keys are independent of messages they will apply to. But for occasional delegation such as securely specifying inheritance in someone's will, it may be highly desirable that a proxy key can only be restricted to a designated party (e.g., a grandchild), applicable to a specific message (e.g., some portion of the will) and possibly used in the proxy transformation by a particular party (an attorney).
Degenerateness. When used in the extreme situation where the grantor and grantee are a same person with a same decryption key, a proxy encryption scheme should reduce to a regular encryption scheme, without introducing any complications (such as non-trivial proxy keys and transformations, and the requirement of an extra facilitator).
As will be shown below, the Mambo and Okamoto schemes are private and non-commutative. Proxy keys in their schemes can be either message-independent or dependent but are not restricted to designated grantees. The Blaze and Strauss scheme is just opposite: it is public but commutative, and its proxy keys are message-independent but uniquely associated with designated grantees. In comparison, the schemes according to the invention set forth herein are public and non-commutative, and their proxy keys are message-dependent and restricted to designated grantees.
Proxy Encryption Using the ElGamal Cryptosystem
As the proxy encryption schemes discussed below in this disclosure will all be based on discrete logarithms in multiplicative groups, a formal setting which is common to all these encryption schemes is hereby adopted. The notation used herein recalls the ElGamal encryption scheme. Encryption schemes based on discrete logarithms are particularly advantageous because of their technical advantages over RSA-type schemes and their natural generalizations to many finite groups such as elliptic curve groups over finite fields.
As set forth above, for any natural number n, let Zn={0, 1, . . . , n−1} denote the ring of integers modulo n, and let Zn*={mεZn|gcd(m, n)=1} denote the multiplicative group of Zn. Note that, when n is a prime, Zn*={1, . . . , n−1}. For a modulo n and a number a that is relatively prime to n, let a−1 denote the multiplicative inverse of a modulo n; that is, a−1 is the element that satisfies aa−1≡1(mod n).
An element a of Zp* is said to be of order m if the number of its powers modulo n is m. A generator g of Zn*, if it exists, is an element of order |Zn*| (the size of Zn*); in this case, Zn* is a cyclic group. When n is a prime, every element of Zn* except 1 is a generator of Zn*.
Let Zn* be a cyclic group with a generator g. The discrete logarithm of an element x to the base g, denoted as loggx, is the unique integer a, 0≦a≦n−1, such that x=ga(mod n). The discrete logarithm problem is that, given a prime p, a generator g of Zp*, and an element xεZp*, find the integer a, 0≦a≦p−2, such that ga≡x(mod p).
A very closely related problem is the Diffie-Hellman problem: given a prime p, a generator g of Zp*, and elements ga(mod p) and gb(mod p), find gab(mod p). The discrete-logarithm problem is at least as hard as the Diffie-Hellman problem, because any solution to the former problem can be used to solve the latter problem.
The ElGamal encryption scheme shown in
Referring now to
To encrypt a message m to be sent to user A with public key α, a random number kεZp−*, is uniformly chosen (step 616), and a pair of numbers (r,s), together representing the encrypted message to be sent to A, is calculated (step 618) as follows:
To decrypt the message (r,s), the recipient A recovers the message m (step 620) by calculating
Note that the selection of the public parameters is intended to establish equation gp−1(mod p)≡1 (Fermat's little theorem). These parameters should be authentically known to all users. They can be chosen, say, by some trusted authority. Also, the way that private key a is chosen ensures that the inverse a−1 of a modulo p−1 exists and is unique.
Unlike the RSA public-key encryption scheme, the ElGamal scheme is non-deterministic, since the encrypted message also depends on the random number k. Indeed, it is similar in nature to the Diffie-Hellman key exchange protocol; the key established between the sender and receiver for encrypting and decrypting the message m is gak(mod p) from r=gk(mod p) (part of the encrypted message) and α=ga(mod p) (the public key of A). Nevertheless, the security of the ElGamal encryption scheme relies on the intractability of the discrete logarithm problem and the Diffie-Hellman problem. To date, practice in seeking optimal algorithms for the discrete logarithm problem has not found any efficient (polynomial-time) solution. It is similar to the situation for the integer factorization problem upon which security of the RSA scheme is based. Moreover, it has also been shown that, for some primes p, solving the discrete logarithm problem is at least as hard as solving the factorization problem of a same size. This implies that for those ps, the ElGamal scheme is at least as secure as the RSA scheme.
Very recently, several proxy encryption schemes have been proposed. All these schemes follow the generic proxy encryption scheme in delegating the decryption right: the encryptor sends an encrypted message to the grantor A, who then delegates the decryption right to grantee B by creating the proxy key, and after the proxy transformation is completed the grantee B finally decrypts the message. Two representative and known proxy encryption schemes are presented below: one from Mambo and Okamoto and the other from Blaze and Strauss, both of which are variations on the ElGamal scheme. Since they have the same scheme setup as the ElGamal scheme, the setup (see steps 610-614 of
Mambo and Okamoto have proposed three proxy encryption schemes: two are based on the ElGamal scheme and the other is based on the RSA scheme. The one shown in
Referring now to
To delegate the decryption right to a grantee B, the grantor A creates a proxy key π by uniformly choosing a random number a′εZp−1* (step 714) and calculating π=aa′(mod(p−1)) (step 716). Then, A delivers the proxy key π to B (step 718) in a secure manner (e.g., by encrypting it with B's public key) and keeps the value of a′ private.
To allow B to decrypt the message, A calculates r′=ra′
Upon receiving the transformed message (r′, s) and the proxy key π, B decrypts the message m (step 722) by calculating m=s(r′π)−1(mod p).
This proxy encryption scheme uses the encryption and decryption components of the ElGamal scheme, except B's private key is replaced by the proxy key π. It is correct because, when using π to decrypt the transformed message (r′, s), the following holds:
The security of this scheme is evaluated in two aspects. The complexity for anyone, including the grantee B, to discover grantor A's private key a based on all the available information is as same as the one for solving the discrete logarithm problem. The difficulty for anyone, even with the proxy key, to impersonate A to transform the encrypted message (i.e., to generate (r′, s)) is the same as the one for solving the Diffie-Hellman problem.
This scheme has several very appealing features. First, its security implies that it is hard for B to recover A's private key. In this sense, there is no need for A to trust B, and hence the scheme is non-commutative. Second, the proxy key π generated is message-independent. B can use it to decrypt all the messages transformed by A. Third, this scheme satisfies the transmitivity requirement. Upon receiving both the proxy key π and the transformed message (r′, s), the delegated user B can further delegate the proxy to another user C, by treating π as the private key a and (r′, s) as (r, s) and repeating the proxy generation and transformation. Fourth, the scheme requires less computational efforts than the re-encryption scheme.
However, implementing proxy encryption in the manner of this scheme has several shortcomings. First, the proxy key contains no information about the delegated grantee B; it is solely derived from grantor A's private key. Moreover, the message decryption performed by B does not need B's private decryption key either. Consequently, the message can be recovered by anyone that gets hold of the proxy key and encrypted message, not necessarily B. Thus, B can ask anyone to decrypt the message by directly passing the proxy information. In many cases, this is not desirable; A should be able to specify the key holder who is to act on A's behalf.
Second, the proxy key π has to be a secret between A and B and needs to be transmitted from A to B in a secure manner. As a result of π containing no information of B and (r′, s) being possibly communicated in public, revealing π is essentially equal to disclosing the message.
Third, the proxy transformation has to be conducted by A. The value a′ used in the transformation is a secret to A and it is vital to preventing B from knowing A's decryption key a.
In short, the scheme is non-commutative and message-independent, but private and unable to specify the designated grantee.
Blaze and Strauss have described another public-key proxy encryption scheme. As can be seen in
Turning now to
To delegate the decryption right to a grantee B, the grantor A creates a proxy key π by obtaining B's private decryption key b (step 814) and computing π=a−1b(mod(p−1)) (step 816), where a−1 is the inverse of the private key a of A modulo p−1. The proxy key π can be made public.
To use the proxy key π to convert a message (r, s) encrypted for A to a message encrypted for B, the facilitator (not necessarily A, since the proxy key π is public) computes s′=sπ(mod p)(step 818). The pair (r, s′) represents the transformed encrypted message, which can then be transmitted to B.
To decrypt the transformed message, B computes m=r(s′b
The scheme is correct, since in the message decryption
In contrast to the previous scheme, the last security feature makes it unnecessary to keep the proxy key π private. Thus, the grantor A can publicly send π to whoever (facilitator) is to perform the proxy transformation, or can simply publish it. Moreover, the scheme does not require any secret from A in order to carry out the proxy transformation, and consequently it allows anyone, trusted or not, to perform the transformation and hence eliminates the necessity of A's, as well as B's, presence in the transformation.
Also unlike the previous scheme, there is no difference to the user B between decrypting a regular encrypted message and decrypting a proxy transformed message. This elegant feature allows the user B to treat all incoming encrypted messages uniformly. In fact, it is possible for an untrusted facilitator or server to perform the proxy transformation and then forward the message to the user B.
In spite of these desirable features, this scheme is commutative; the involved key holders A and B must trust one another bilaterally. B can learn A's secret key a (by multiplying the proxy key by b−1). In addition, the proxy key is also message-independent, as it is in the previous scheme, which delegates B the right to decrypt all messages encrypted for A's private key a. Accordingly, this scheme is public and message-independent but commutative.
Two proxy encryption schemes according to the invention are presented herein, and then analyzed in regard to their security, commutativity and performance. Like the private proxy scheme, they are non-commutative, and at the same time, they support public proxy keys and transformations in the fashion the commutative proxy scheme does. However, they differ from the private and commutative schemes in that they are message dependent. Moreover, their overall performance is better than the ElGamal-based re-encryption scheme.
Again, these schemes share the same scheme setup of the ElGamal scheme, and they assume that a grantor A delegates the decryption right to a grantee B.
To understand how to adapt the ElGamal scheme into a proxy encryption scheme, it is helpful to examine some details of the ElGamal scheme. It should be noted that the r component of the encrypted message m is independent of the recipient A's private key a and public key α. As s=mαk(mod p)=mgka(mod p), α is only used in the s component, and a is implicitly embedded in s's exponent. Thus, it is sufficient for the proxy transformation to convert the message encrypted for A into the message encrypted for B by removing A's private key a from s and replacing it with B's private key b. In order to prevent B from obtaining A's private key a, the function to generate the proxy key must be somehow "one-way." Indeed, this can be achieved with aid of the random number k as follows:
The above discussion leads to the scheme in
Referring now to
To delegate the decryption right to a grantee B, grantor A creates a proxy key π by obtaining B's authentic decryption key b (step 914) and calculating π=rb−a(mod p) (step 916).
The message is transformed from (r, s) to (r, s′) by calculating s′=sπ(mod p) (step 918). The message m is then decrypted by B from (r, s′) by computing m=s−1(rb)−1(mod p) (step 920).
Clearly, this scheme uses the message encryption and decryption steps of the ElGamal scheme. It is correct as the message m can be recovered from
A nice feature of this scheme is that, not only do regular and proxy encrypted messages appear no different to the grantee B, but also the scheme coincides with the ElGamal scheme when A and B are the same user with the same key; in this case, the proxy value π is equal to 1 and the proxy transformation is the identity transformation.
It is easy to see that the scheme is transitive. Upon receiving the proxy transformed message, the grantee B can act like the grantor A to further delegate the decryption right to, say, another grantee C by repeating the proxy generation step with the keys b and c in place of a and b.
Also like the commutative scheme, the proxy generation step requires both A's and B's private keys in order to generate the proxy key π. As an alternative, this step can be carried out by anyone that is trusted by both A and B. As noted above, A's private key is definitely needed, as otherwise anyone can issue a proxy key to recover the message and the underlying encryption scheme is not secure. To establish and communicate B's private key b, many key-exchange protocols such as the Diffie-Hellman key exchange may be used. As shown in further detail below, in some practical applications the requirement of the key b either is not a problem or can be relaxed.
But unlike the private and commutative schemes, this scheme does not make it easy for the grantee B to decrypt messages encrypted for A other than the intended one. Clearly, the proxy key π contains a piece of information that is specific to the encrypted message m, namely, the random number k. In this sense, the proxy scheme is message-dependent. Moreover, the scheme is non-commutative in the sense that it is hard for B to discover A's private key a. This fact, together with the performance of the scheme will be established after presenting the next scheme.
Note that, in the previous scheme, the proxy transformation only changes the s component of the encrypted message. Since s is the part that actually carries the information about the message m, the scheme may not be efficient when m is a very long message. For example, the proxy key generated would be as long as the message and the effort spent in the proxy transformation would be linear with regard to the length of the entire message.
The scheme presented in
As shown in
To delegate the decryption right to a grantee B, grantor A creates a proxy key π by obtaining B's authentic decryption key b (step 1014) and calculating π=(sa
The message is transformed from (r, s) to (r, s′) by calculating s′=sπ(mod p) (step 1018). The message m is then decrypted by B from (r, s′) by computing m=r(s′b
This Scheme is Correct Since
Due to their similarity in nature, only the first of the two new schemes is analyzed in this section in regard to its security and non-commutativity. An almost same discussion can be carried out for the second scheme. In addition, though the first scheme (as well as the second scheme) is transitive and its security may involve more than two key holders, the analysis to be given only considers the two-key-holder case; the general case is also similar. For presentation clarity, the phrase "(mod p)" will be omitted in this subsection; its occurrence should be clear from context.
Recall that, other than the scheme parameters (p, g), the public information available from the scheme includes
For the reasons set forth below, the scheme is computationally secure. It is hard to recover the message m and secret keys a and b from the public information, provided that the Diffie-Hellman and discrete-logarithm problems are hard to solve. Since the proxy key is part of the public information, this implies publishing it compromises neither the message nor the secret keys. A consequence of this is that it is also hard for anyone to forge a valid proxy key in a systematic manner. Beyond that, the scheme is shown to be non-commutative in the sense that even with B's private key, it is still hard to recover A's private key. If the proxy key is indeed generated by a third party trusted by both A and B, this fact implies that it is not necessary for B to trust A either. This is a significant improvement over the commutative scheme.
Moreover, as stated above, the proxy encryption schemes of the invention are more efficient than re-encrypting a message. Below, in Table 2, is the performance of the two proxy encryption schemes according to the invention described herein compared with the re-encryption scheme using the ElGamal algorithm, in terms of the amount of computation they require. In Table 2, the numbers of multiplication operations, exponentiation operations, and inversions, all performed modulo p, are listed for these schemes.
Note that the total number of operations for re-encryption using the ElGamal scheme is twice the number of operations for a single ElGamal encryption and decryption, since the message must first be encrypted, then decrypted, then re-encrypted, then re-decrypted. Moreover, the computation in the second scheme can be optimized by (i) pre-computing the inverses a−1 and b−1 in the scheme setup step and (ii) multiplying the two exponential components (modulo (p−1)) in the proxy generation step instead of using two exponentiations. The second set of numbers under the second scheme result from this optimization. Overall, the inventive proxy encryption schemes presented herein have better performance than the simple, ElGamal-based re-encryption scheme.
Public and non-commutative proxy encryption schemes provide a key mechanism for implementing a wide range of applications. Massive document distribution and file protection are two key motivations for this disclosure. These applications correspond to two typical situations for proxy encryption. The former is related to the case where the grantor is the one who encrypts the message at the first place, while the latter is to self-delegation in which the grantor and grantee are the same key holder but with different keys.
Again, note that a document refers to any digital file whose content could text, graphics, audio, video, executable or even multi-media. Usually, a document is large in size, even after compression. Because public-key algorithms tend to be very slow when compared with conventional private-key algorithms such as DES, IDEA and RC4, and private-key algorithms require establishing secret keys to begin with, the most practical approach to massive and secure distribution of documents over networks is to combine the private-key and public-key encryption mechanisms. Typically, an efficient private-key algorithm is used to encrypt the document by using a randomly generated key, called the session key, and the public key for each document recipient is used to encrypt this session key. Recipients use their private keys to recover the secret session key and then use it to decrypt the document.
Indeed, the above document distribution approach has the proxy encryption flavor; the owner encrypts the document first using a private-key scheme and then grants the decryption right, upon request, to its recipients via a public-key scheme. It turns out that, either one of the two new proxy encryption schemes can be used to combine the best features of the approach into a single, normal encryption scheme.
Take the second scheme set forth above (
The second observation is that, if the grantor A is the one who encrypts the message m, then A can keep the random number k private and use B's public key β=gb(mod p), instead of B's private key b, to generate the proxy key:
These two observations lead to the document distribution scheme shown in
Referring now to
To encrypt a document m, owner A first chooses a uniformly random number kεZp−1* (step 1112) and calculates a session key K=gk(mod p) (step 1114). The encrypted document (r, s) is then calculated as follows:
Upon request from a recipient B for the encrypted document (r, s), A first obtains B's authentic public key β (step 1118) and retrieves k from the pair (s, k) (step 1120). A then computes πB=βks−1(mod p) (step 1122), where s−1 is the inverse of s modulo p, as the proxy key for B.
The document is then transformed by computing s′=sπB(mod p) (step 1124); the pair (r, s′) represents the transformed document customized for B.
To decrypt the customized document (r, s′) and retrieve the original document m, B first recovers the session key by calculating K=s′b
As described above, an adaptation of the present invention is also applicable to a file protection application. Usually, file protection in insecure systems such as laptops and networked hardware involves long-term encryption of files. Thus, encryption keys used for file encryption have much longer lifetimes than their communication counterparts. While a user's primary, long-term, secret key may be the fundamental representation of a network identity of the user, there is a danger that it might get compromised if it is used for many files over a long period of time. If the primary key is lost or stolen, not only are contents of the files encrypted with it disclosed, but also the user loses personal information based on the key such as credit card account, social security number, and so on. Therefore, it is often preferable to use an on-line method in which a new decryption key is derived from the primary key every time a file needs to be encrypted and gets updated on a regular basis.
With the proxy encryption schemes set forth herein, new decryption keys can be generated and constantly updated through self-delegation to keep them fresh. Once a new key is created and a corresponding proxy key generated, the old secret key can be destroyed, with the new key and proxy key maintaining the ability to decrypt the file.
As shown in
Whenever necessary or desired, for example every few weeks or after a predetermined number of document accesses, the smart card generates another uniform random number a′εZp−1* (step 1214) and computes s′=(sa
To recover the original file m from its encrypted version (r, s), the processor on the smart card uses the latest decryption key a to compute m=rsa
Note that the file encryption step can start with any secret key it generates, not necessarily the smart card's private key.
To keep encrypted files fresh by updating encryption data with a piece of smart-card-generated information helps to maintain single useful copies of protected files. This, in some sense, provides copy protection as well. Moreover, the non-commutativity of the scheme renders previous copies of the files useless, as the corresponding secret information stored in the smart card has been changed (and preferably destroyed).
Proxy Encryption Using the Cramer-Shoup Cryptosystem
Although the foregoing examples and algorithms all employ various adaptations of the ElGamal cryptosystem, it should be noted that other cryptosystems can also be adapted by a scheme according to the invention.
For example, the Cramer-Shoup public-key cryptosystem is a recently proposed cryptosystem that is the first practical public-key system to be provably immune to the adaptive chosen ciphertext attack. See R. Cramer and V. Shoup, "A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack," Proceedings of CRYPTO 98, Springer Verlag LNCS, vol. 1462, pp. 13-25 (1998). The adaptive chosen ciphertext attack assumes that the attacker can obtain decryptions of any chosen ciphertexts other than the target ciphertext. For example, if the target ciphertext for which the plaintext is wanted is c, then the attacker is assumed to have access to a "decryption oracle" which will decrypt any ciphertext except c, including for example c+1, 4c, etc. RSA and ElGamal fall easily to this kind of attack; A different, but equivalent, notion of security against active attacks is called non-malleability; however, known non-malleable systems are not practical.
Set forth below in
Referring initially to
A good example of the group G is the subgroup of order q in the multiplicative set Zp* for some large prime p=2q+1. In this case, a message m from the set {1, . . . , q} can be "encoded" by squaring it modulo p, resulting in an element in G, and the message m can be recovered from its encoding by computing the unique square root of its encoding modulo p, in the set {1, . . . , q}.
A key is generated as follows. First, random elements g1, g2εG are chosen (step 1312), and random elements x1, x2, y11, y12, y21, y22, y31, y32, zεZq are chosen (step 1314). Next, the group elements c=g1 x
Given a message mεG, the encryption method begins by choosing rεZq at random (step 1322). Then the ciphertext (u1, u2, e, v) is calculated as follows (step 1324):
Given the ciphertext (u1, u2, e, v), the corresponding decryption algorithm first tests if v=u1 x
The correctness of a cryptosystem can be verified by checking that the decryption of an encryption of a message yields the message. In this case, since u1=g1 r and u2=g2 r, one has u1 x
The security of this cryptosystem relies upon the difficulty in solving the Diffie-Hellman decision problem. An algorithm that solves the Diffie-Hellman decision problem is a statistical test that can effectively distinguish the following two distributions: (a) random quadruples (g1, g2, u1, u2)εG4, and (b) random quadruples (g1, g2, u1, u2)εG4, where g1, g2 are random and u1=g1 r and u2=g2 r for some random rεZq.
Related to the Diffie-Hellman decision problem are the Diffie-Hellman problem (given g, gx, and gy, compute gxy), and the discrete logarithm problem (given g and gx, compute x). Within polynomial time, the Diffie-Hellman decision problem can be reduced to the Diffie-Hellman problem which in turn can be reduced to the discrete logarithm problem. It is this relationship between the three problems that leads to the possibility of delegating the right to decrypt for the Cramer-Shoup system.
Assume that someone wants to delegate the right to decrypt from a delegator (Alice, A) to a delegatee (Bob, B). Suppose that Alice has the public key (g1, g2, c, d1, d2, d3, h) and the private key (x1, x2, y11, y12, y21, y22, y31, y32, z), and that Bob has the public key (g1′, g2′, c′, d1′, d2′, d3′, h′) and the private key (x1′, x2′, y11′, y12′, y21′, y22′, y31′, y32′, z′).
Recall, that for a given plaintext message mεG, the ciphertext message for delegator A is M=(u1, u2, e, v), where u1=g1 r, u2=g2 r, e=hrm, and v=crd1 u
Based on the ideas set forth above, to delegate the right to decrypt from A to B involves generating a transfer key π, using that transfer key to transform M into M′. In the following, it is assumed that the components g1′, g2′ of B's public key are identical to the components g1, g2 of A's public key (analogously to the ElGamal system parameters described above). Also, it is assumed that the random number r′ is the same as r. Under these two assumptions, elements u1′, u2′ of B's ciphertext message are the same as elements u1, u2 of A's ciphertext message.
Referring now to
Given a message mεG, the encryption method begins by choosing rεZq at random (step 1422). Then the ciphertext (u1, u2, e, v) is calculated as follows (step 1424): u1=g1 r, u2=g2 r, e=hrm, and v=crd1 u
If B's private key is available for generating the transfer key π, that key is obtained (step 1426) and then it can be calculated (step 1428) as follows:
The recipient/delegatee is then able to decrypt the transformed cyphertext (u1, u2, e′, v′). As above, the decryption algorithm first tests if v′=u1′x
In the case where only the public key of the delegatee B can be used for delegating the right to decrypt the message from the delegator A to B, one needs to save and use the random number r used initially in encrypting the message for A. This may be a problem where the party to generate the transfer key is not A, and may not be a problem if the party is, in fact, A. In any case, if it is available, the transfer key π can be generated using B's public key as follows:
It is straightforward to verify, in either case, that the delegatee B can use his own private key to decrypt the ciphertext (u1′, u2′, e′, v′) transformed by the methods set forth above. Since the mechanisms used herein on the Cramer-Shoup cryptosystem are the same as those used above on ElGamal-like cryptosystems, they are public and non-commutative, assuming the Diffie-Hellman problem and the discrete logarithm problem are difficult to solve.
As described above, through enhancing common public-key encryption schemes with the proxy encryption capability, it becomes possible to support flexible designated decryption. This disclosure has presented two public and non-commutative proxy encryption schemes, which have inherited the merits of the existing schemes and discarded their shortcomings. The new schemes have been shown to have direct applications to massive document distribution and file protection. The basic idea of these new schemes has also been applied to cryptosystems of other types such as the Cramer-Shoup cryptosystem, enhancing them into proxy encryption schemes.
While the various aspects of the present invention have been described with reference to several aspects and their embodiments, those embodiments are offered by way of example, not by way of limitation. The foregoing detailed description of the invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed, and obviously many modifications and variations are possible in light of the above teaching. The described embodiments were chosen in order to best explain the principles of the invention and its practical applications to thereby enable others skilled in the art to best utilize the invention in various embodiments and with various modifications as are suited to the particular use contemplated. Those skilled in the art will be enabled by this disclosure will be enabled by this disclosure to make various obvious additions or modifications to the embodiments described herein; those additions and modifications are deemed to lie within the scope of the present invention. It is intended that the scope of the invention be defined by the claims appended hereto.
Patent Citations
Non-Patent Citations
Referenced by
Legal Events
Original Image


text:
April 10, 2011
Cal State Northridge track & field finished up a busy weekend as the Matadors finished up their competition at the Texas Relays and also competed at UCLA's Rafer Johnson/Jackie Joyner-Kersee Invitational and the Pomona-Pitzer Invitational.
Following the solid performances of Sherrina Lofton and Desirae Gonder in the heptathlon at the Clyde Littlefield/Texas Relays in Austin, Texas, Thomas Johnson matched his career-high of 6-10.75 (2.10) in high jump to finish third. Johnson cleared his lifetime-best on his second attempt before missing all three attempts at 7-0.50.
The women's 4x400 team of Shane Mullany-Banks, Precious Watkins, Ashley Frazier and Jackie Harrison finished 13th in 3:42.32 which was just off their season-best of 3:42.16. The 4x100 relay team of Watkins, Lofton, Frazier and Gonder finished 25th in a time of 47.11.
Also competing in Texas for the Matador men, Carl Horsley finished 25th in the 100 meters setting a season-best with a time of 10.57 which matches his wind-aided time at the Cal-Nevada Championships. David Reid equaled his lifetime-best by running 10.58 which left him 27th. Michel Woodham finished 21st in the 110 meter hurdles in a season-best 14.47 which is just .07 off his lifetime-best.
Frazier also competed in the 400 hurdles and finished 21st in a time of 1:02.01.
Northridge took its group of pole vaulters to the Rafer Johnson/Jackie Joyner-Kersee Invitational at UCLA and Tiana Webberley reached her lifetime-best on the women's side as she finished first in the open division with a clearance of 12-8.75 (3.88). Jenna Hulion finished second to Webberley after equaling her season-best of 11-5.75 (3.50) and Cristi Allen was fifth with a top height of 10-0 (3.05).
Tyler Woodard led the men's vaulters with a season-best of 15-7 (4.75) which left him in a second place tie with teammate Matt Todd. Jared Thomas was 10th with a best vault of 13-7.75 (4.15).
Next it was off the Pomona-Pitzer for the remainder of the men's and women's squad. The women's throwers were led by Claire Morgan's second place finish in the discus as she tossed a season-best 146-4 (44.61). Chelsea Wordell also posted a season-best as she took seventh at 133-4 (40.63) while Jamila McIntosh also bettered her season-best with a mark of 118-4 (36.07). In the hammer, McIntosh set a season-best with a best of 158-7 (48.33) to finish 11th.
On the track for the women's squad, Vanessa Carr was 23rd in the 200 meters (26.14), Natalie Wollaston was 22nd in the 400 meters (60.67) and Desiree Karotko ran a lifetime-best 61.69. Yvonne Castillo-Urbina finished 62nd in the 800 meters (2:32.95) and 41st in the 1,500 (5:02.84).
On the men's side, Gustavo Hernandez placed 15th in the 400 meters equaling his lifetime-best of 50.18 while Fredy Santizo was 43rd in a time of 52.76. Marvin Gonzales had Northridge's top time in the 1,500 meters as he finished 51st in 4:14.02. Tawei Ma was just behind in 54th place at 4:15.86.
The pole vaulters continued their busy weekend as Todd finished second at 15-9 (4.80), Joshua Schroder was eighth in a season-best 14-9 (4.50), Thomas bettered his season-best after clearing 14-3.25 (4.35) and Alex Oleata was 21st at 13-3.50 (4.05).
The men's throwers were led by Cameron McAteer's eighth place finish in the hammer. McAteer posted a best of 171-0 (52.13), James Poet was 15th at 155-1 (42.28) and Jose Aviles posted a season-best of 136-8 (41.67) to finish 27th. Aviles had CSUN's top mark in the shot put as he finished 18th at 43-10.50 (13.37). McAteer had the Matadors best finish in the discus, finishing 22nd with a top throw of 131-4 (40.03) while Alex Murphy took 20th in the javelin with a best of 162-2 (49.43).

subset: commoncrawl


text:
Wind: 0 mph
To The Editor:
I believe it's time for our 'Town Nannies' (they use to be called the Town Fathers -- of which four out of five whom should be retired ASAP) to call off the 'Waitsfield Sign Police.'
They should use a little of their Liberal/Progressive/Control driven
foresight and make a few bucks for the town, by means other than
over-assessing property values and traffic revenues, by charging a fee
on those folks who wish to have a moderate sandwich board outside their
This might be the right time to do a test or pilot program; say during Green and Gold week to allow our merchants to advertise a special or two? They could pay a fee, say $5 a day, for this great privilege. Plus think of all the fun the 'Nannies' could have coming up with the size of the sign, the color it has to be, how far from the road, the building, how high the lettering must be, how many days it could be, etc.
In addition this could be a nice distraction from all their schemes to control everything from the number of trees you can have, to the extorting of 10 percent of a landowner's property, to packing their multi-layer boards and commissions (e.g., the CC, DRB, PC, SRC, ZBA, etc.) with a limited number of real Vermonters inside these groups of un-elected bureaucrats, while trying to get the gullible town residents to buy into a multi-million-dollar wastewater project, which will benefit only a few and become a huge financial burden upon the already overtaxed property owners in this community.
Signs may be worth a try. What do you think?
Charlie Kettles


text:
photo 1 of 220
Miesha Tate
TRAINING: In the morning I train either striking, conditioning or do technical game plan review. In the evening, it's either live MMA rounds or strength & conditioning
When and why did you start training for fighting? I started training fighting when I was 19 because I had wrestled in high school and was looking to take my ambition to the next level. What better way to do that than to get in the cage and fight your heart out?!
What ranks and titles have you held? Former Strikeforce Women's Bantamweight Champion, Women's 135lb Strikeforce Tournament Champion, 2x Freestyle Cage Fighting 135lb champion, 2009 World Team Trials Silver Medalist, 2009 Freestyle Cage Fighting Super Fight Champ, 2008 Fila Worlds Grappling Championships Silver Medalist, 2008 World Team Trials National Grappling Champion, 2005 women's high school Washington state wrestling champ. The Ultimate Fighter season 18 coach. Purple belt in BJJ.
Do you have any heroes? None
What does it mean for you to fight in the UFC? For me it means I'm one of the best in the world and I'm thankful for the opportunity that the UFC gives to the talented women in MMA
Did you go to college and if so what degree did you earn? I attended Central Washington University, no degree
What was your job before you started fighting? I was working at Costco
Specific accomplishments in amateur competition? 5-1 as an amateur
Getty Images reserves the right to pursue unauthorized users of this image or clip. If you violate our intellectual property you may be liable for: actual damages, loss of income, and profits you derive from the use of this image or clip, and, where appropriate, the costs of collection and/or statutory damages up to $150,000 (USD).


text:
Suit Separates Belted Bootcut Pant: Part of our mix-and-match Suit Separates Collection, these bootcut pants have a universally flattering fit with a wide, waist band. Wear with or without the included matching belt for two different looks.
Read what customers are saying about this product:
Rating: 4.83 out of 6 votes cast
I really like the pants but they are actually a bit big at the waist. I don't blame the pants, I am losing weight and thought the next size down would fit well. The length was a problem. I have ordered Petite before and the length was great, no hemming needed. Stitch Witchery worked just fine.
Brookings, OR
LOVE these pants!!!!
These pants are my absolute favorite. They fit me so perfectly, are super flattering, and you can't beat the price. I have several in different colors and I also have some of the matching blazers. Very classy and I get lots of compliments on them. Highly recommend!!
Baltimore, MD
awesome awesome awesomeAlice JMilwaukee,Wi
Great purchase
I purchased 10T because of my curves. Perfect size and length. I wish my shoes had fit as well as the model's but they didn't.
Dallas Diva
Dallas, TX
LOVE these pants!!!!!!!
I got 4 pairs and came back and got 3 more. They are good quality and the fit is perfect. I ordered in a size 6 and have no worries.Thanks and look for future orders.
Love these
These are perfect. I top them with a suit jacket that I had in my closet and it is perfect.
Click here to read all of this product's reviews
*Sale and Clearance pricing is available on select colors and sizes and is valid on metrostyle.com purchases only. Hurry, quantities are limited! As a result, items shown may sell out. Click quick to get your favorites before they're gone!


text:
The Town of Telluride is a Home Rule Municipality that is the county seat and the most populous town of San Miguel County in the southwestern portion of the U.S. state of Colorado.[page needed] The town is a former silver mining camp on the San Miguel River in the western San Juan Mountains. A Telluride Historic District which includes some or all of Telluride is listed on the National Register of Historic Places and further is one of Colorado's 20 National Historic Landmarks. The town population was 2,221 at U.S. Census 2000.
Telluride sits in a box canyon. Steep forested mountains and cliffs surround it. Bridal Veil Falls is at the head of the canyon. Numerous weathered ruins of old mining operations dot the hillsides. A free gondola connects the town with its companion town Mountain Village, Colorado at the base of the ski area.
Telluride and the surrounding area have featured prominently in pop culture. The town of Telluride has served as the backdrop for several television commercials, is home to an international film festival, and has been the subject of songs such as "Smugglers Blues" by Glenn Frey, an essay by Edward Abbey, and eponymous songs by The Nitty Gritty Dirt Band, Kate Wolf, and Tim McGraw, and later recorded by Josh Gracin. Telluride is also known for its ski resort and slopes during the winter as well as an extensive festival schedule during the summer.
Visit Wikipedia for more information about Telluride, Colorado.


text:
FIAT of Fredericksburg's expansive inventory of new cars, trucks and SUVs, located at 4535 Lafayette Blvd. in Fredericksburg, VA, is well stocked with vehicles to meet your every need!
Be sure to browse the latest New Vehicle Specials for up-to-date promotions, or check out our Virginia car dealership's featured vehicles, highlighting both new and used cars near Richmond. Should we not currently stock your ideal vehicle, please complete the CarFinder form and FIAT of Fredericksburg will complete the search for you!


text:
Pricing & Reservations - call 24 hours 800-242-1715
Refine Search:
958 Peiffers LaneHarrisburg, PA 17109
Phone: 717-558-8436
14.7 Miles from 17069
As low as
$ 62
per month
191 Salem Church RoadMechanicsburg, PA 17050
Phone: 717-697-4476
15.1 Miles from 17069
As low as
$ 57
per month
4751 Westport DriveMechanicsburg, PA 17055
Phone: 717-790-9100
17.2 Miles from 17069
As low as
$ 59
per month
3271 Fulling Mill RoadMiddletown, PA 17057
Phone: 717-232-2722
18.3 Miles from 17069
As low as
$ 65
per month
Questions? Call 800-242-1715
For Your Convenience:
We've selected our most common size for you: 5x10.
To begin, please select the size you're most interested in.
Save 50% on Next Month's Rent! Special (Learn More)
Free Van/Truck Rental with Move-In (Learn More)
Climate Controlled Storage (Learn More)
Drive Up Access (Learn More)
First time space renter and you more than met all my expectationsKen from Mechanicsburg, PA
July 25, 2015
My experience was outstanding. There is only one thing that I found to be somewhat frustrating. A few times when I had wanted to talk with someone the office was closed for lunch, or, they were not there for another reason. I either would have to wait until someone came back or I would have to come back at another time. No big deal.I still rate Uncle Bob's as the best and will still recommend Uncle Bob's to others.Ray from Harrisburg, PA
July 23, 2015
I am a repeat customer with Uncle Bob's and have ALWAYS been happy with the prompt assistance in the office. I have even come across some hard times and the office personnel have been able to work through the issues with me. I have no problem referring Uncle Bob's to anyone!Crystal from Middletown, PA
July 6, 2015
This is my first experience renting a storage unit. The staff were caring and helpful; and the facility is super clean, well lit and convenient. I used their truck to bring my things there for no charge and they also have a cargo cart for transporting loads indoors. I really could not feel better about leaving my things at this Uncle Bob's.Susan from Mechanicsburg, PA.
March 27, 2015
Great job uncle Bob storage. So glad you are there. I was very impressed with Dave and his staff. I checked out the location before and had some concerns. That was with the previous owners. So happy when I came back again that Dave was there and that was new management. I actually rented one space and then came back for another. Excellent customer service!Caroline from Camp Hill, PA
July 26, 2014
Someone recommended your storage units because of the free truck rental. However, we found out that we would not be able to take advantage of the free truck because we were not ready to move in a large load. We are still just moving in car loads.Mary from Mechanicsburg, PA
July 28, 2015
I did not receive a letter telling me I only had till the end of August to get out but was moving anyway but was out on the 16th of the month and should of gotten half of my rent back because I did so, I don't think that was fair to make me pay for a whole month when I was not there a whole month. And that i will tell everyone I speak too about your company before they rent from you.Daune from Red Lion, PA
July 26, 2015
Service was efficient and the unit was clear and appeared clean.William from Harrisburg, PA
June 26, 2015
The girl who waited on me was awesome. She was friendly and out going an fun to work with. I left feeling really good about choosing Uncle Bob's.from Harrisburg, PA
June 26, 2015
I needed an extra storage unit and the associate suggested one that would work for me.Tracy from North Bend, PA
May 27, 2015


text:
Skip to Content Skip to Search Skip to Utility Navigation Skip to Top Navigation Skip to Content Navigation
Science & Engineering Capabilities
- Accelerators, Electrodynamics
- Bioscience, Biosecurity, Health
- Chemical Science
- Earth, Space Sciences
- Energy
- Engineering
- High Energy Density Plasmas, Fluids
- Information Science, Computing, Applied Math
- Materials Science
- National Security, Weapons Science
- Nuclear & Particle Physics, Astrophysics, Cosmology
- Sensors, Instrumentation Systems
Science Facilities
- Electron Microscopy Lab
- Ion Beam Materials Lab
- MaRIE
- Proton Radiography
- Trident Laser Facility
Research Library
Science Briefs
Richard P. Feynman Center for Innovation
- Deploying Innovation
- Strategic Collaboration
- Innovation in New Mexico
Los Alamos Collaboration for Explosives Detection (LACED)
Postdocs, Students
User Facilities
- Center for Integrated Nanotechnologies (CINT)
- Los Alamos Neutron Science Center (LANSCE)
- National High Magnetic Field Laboratory (NHMFL)
Biosurveillance Gateway
Pathogen Databases
- HIV, HCV, Influenza, Oral Pathogen, STD
National Science Education Center
- Center for Nonlinear Studies
- Engineering Institute
- Information Science & Technology Institute
- Institute for Geophysics, Planetary Physics, and Signatures
- Institute for Materials Science
- Seaborg Institute
Employee, Retiree Resources
- Benefit Options
- New-Hire Process
- Payroll, Taxes
- Retirees
- Travel Reimbursement
- Verification of Employment
STEM Education
- STEM Education Programs
- Teachers (K–12)
- Students (K–12)
- Higher Education
- Regional Education Partners
Community Commitment
- Calendar
- Community Feature Stories
- Giving
- Economic Development
- Employee Funded Scholarships
- Publications | Community Connections
- Speakers' Bureau
- Volunteer Program
- About »
- Our History »
- History Images
Los Alamos History in Images
Los Alamos has a proud history and heritage of almost 70 years of science and innovation. The people of the Laboratory work on advanced technologies to provide the best scientific and engineering solutions to many of the nation's most crucial security challenges.
Other News from LANL
- Los Alamos National Laboratory launches new student app Students can use to learn about employment opportunities, science research, education programs and more.July 15, 2014
- Los Alamos devices capture 'Oscars of Invention' awards Safire oil-well measurement and AWS laser-based spectrometer for materials inspection capture R&D Magazine's "R&D 100s"July 3, 2014
- Scientists ignite aluminum water mix Don't worry, that beer can you're holding is not going to spontaneously burst into flames.June 30, 2014
- Hazardous devices teams showcase skills at Robot Rodeo June 24-27 Bomb squads compete in timed scenarios at Los Alamos National Laboratory.June 18, 2014
Aluminum Water Burn Rate Sequence
Research by Los Alamos National Laboratory chemist and explosives scientist Bryce Tappan, published June 24, 2014 as the cover story in the prestigiou...
Innovations for a secure nation
Lab team makes unique contributions to the first bionic eye
The Argus II will help people blinded by the rare hereditary disease retinitis pigmentosa or seniors suffering from severe macular degeneration.» All Innovations
Contact LANL
Mailing Address
P.O. Box 1663
Los Alamos, NM 87545
Journalist Queries
Communications Office
(505) 667-7000
Directory Assistance
(505) 667-5061
All Contacts, Media
Operated by Los Alamos National Security, LLC for the U.S.
Department of Energy's NNSA
© Copyright 2013-14 LANS, LLC


text:
CRESTVIEW — It has been more than a year since Crestview shortstop Dakota Dean committed to play college baseball at Louisiana State University. Dean made the commitment official Friday when he signed his national letter of intent to play for the Tigers, a powerhouse in the Southeastern Conference.
Dean follows in the footsteps of his older brother, Blake, a 2006 Crestview graduate, who earned All-America honors in 2008 and was a part of LSU's national championship team in 2009.
Dean said the familiarity he had with the Tiger program went a long way in helping him make his decision.
"It feels good to go ahead and get it over with and to finally get it done," he said. "I've been there a lot while I was growing up and I got to see how they work. And I've seen their fans and everything."
Dean said he is used to the comparisons between and his brother and he isn't worried about those comparisons continuing as he moves on to college.
"I've been compared to Blake since I was little," he said, "but he's Blake and I'm Dakota so at the end of the day it doesn't bother me."
Bulldog baseball coach Tim Gillis coached both Dean brothers and said Dakota, who like Blake swings the bat left-handed, compares very favorably to his older brother.
"You can watch them in the (batters) box and see their stance and really see similarities," Gillis said. "Blake may have more natural power, but Dakota runs better. They are two exceptional hitters."
Comparisons aside, Gillis said Dakota, who has started since his freshman year, has taken nothing for granted as he has worked toward his goal of playing college baseball.
"He's been a tireless worker ever since he has been here," Gillis said. "He's a no nonsense kind of guy. He doesn't mess around when he gets to practice.
"He's a very intense worker and he's very intense in a game. I tell you, I think the sky is the limit for him at the next level and we are excited to have him for another year."
Dean said he has been told he will play the middle infield for the Tigers, but he's not concerned about what position he'll play when he gets to LSU.
"I can play any position," he said. I can go out and play middle infield, the outfield, where ever you need me," he said. "I can run pretty good and I can swing the bat really good."
Dean, who also was a three-year starter on the Bulldog football team, hasn't completely ruled out trying to play college football.
"I'm just going to see if I get any offers for football this year," he said. "But if not, oh well, I'm going to LSU."
Even if he's drafted in June's Major League Baseball draft Dean said he will still likely end up at Louisiana State saying it would take life-changing money for him to forgo his college career.
Dean will report to LSU in June. In the mean time he has his senior baseball season to look forward to with his college decision out of the way.
"It's going to be a lot easier for me to focus on baseball," he said. "We definitely are going to compete for the district championship."
As far as Gillis is concerned whatever the challenge facing Dean either on the high school diamond or at LSU, he'll be ready for the challenge
"It's (developing as a baseball player) a constant process," Gillis said. "But his work ethic is so good that he is going to be up for the task.
Randy Dickson is the Crestview News Bulletin's sports editor. Email him at firstname.lastname@example.com, tweet him @BigRandle, or call 682-6524


text:
PARKER, Texas (AP) - The white two-story home with stately pillars overlooking a North Texas pasture where longhorns roam is instantly recognizable: This is the power seat of television's famous Ewing family.
Tourists from around the world have been flocking to Southfork Ranch in Parker since the early years of the classic series "Dallas," which ran from 1978 to 1991. The premiere last June of a new "Dallas" series has helped increase the traffic.
Officials with property owner Forever Resorts say the number of Southfork visitors has doubled to more than 300,000 annually.
The new show starts its second season Monday on the TNT cable channel. The November death of actor Larry Hagman, who starred as conniving oilman J.R. Ewing, has also spurred fans to visit Southfork.
To comment, the following rules must be followed:
Comments may be monitored for inappropriate content, but the station is under no legal obligation to do so.
If you believe a comment violates the above rules, please use the Flagging Tool to alert a Moderator.
Flagging does not guarantee removal.
Multiple violations may result in account suspension.
Decisions to suspend or unsuspend accounts are made by Station Moderators.
Questions may be sent to firstname.lastname@example.com. Please provide detailed information.