An Efficient IND-CCA2-Secure Certificateless Public Key Encryption Scheme with Cryptographic Reverse Firewalls

Abstract

Secure communication in modern distributed environments such as the Internet of Things (IoT), cloud computing, and peer-to-peer systems requires cryptographic schemes that are both efficient and resilient to advanced threats. Traditional approaches such as Public Key Infrastructure (PKI) and Identity-Based Encryption (IBE) suffer from certificate management overhead and key escrow problems, respectively [1], [2]. Certificateless Public Key Encryption (CL-PKE) addresses these limitations but suffers from high computational and communication overheads [3], while Cryptographic Reverse Firewalls (CRFs) provide protection against data exfiltration in compromised systems. To address these challenges, this study developed an optimized CL-PKE-CRF scheme by implementing a single-element public key structure, sender-side precomputation of pairing operations, and independent per-user randomization using a Key Derivation Function at the Key Generation Center. These improvements reduced the redundant operations while maintaining correctness and preventing information leakage. The scheme was implemented using the Charm-Crypto library and evaluated over 1000 iterations across 128-, 192-, and 256-bit security levels. Results show an average reduction of about 25% in computational overhead, 76.6% faster subsequent encryption latency for repeated operations, and a 33% decrease in communication cost compared to the baseline model. Security analysis confirms that the scheme achieves IND-CCA2 security with negligible adversarial advantage (< 0.004) and 100% decryption correctness with zero leakage in all simulated compromise scenarios and provides strong resistance to exfiltration attacks. Overall, the developed CL-PKE-CRF scheme offers a practical and efficient solution for secure communication, particularly in resource-constrained environments such as IoT and distributed systems.