The problem the researchers tackle begins with a mundane fact of modern computing: organizations rarely store only one copy of their data. To guard against hardware failures, regional outages, and even the loss of an entire data center, cloud backup services routinely replicate files across multiple servers, often operated by different providers. This multi-replica strategy improves resilience, but it creates a subtle cryptographic dilemma. If the replicas are stored as independently encrypted ciphertexts, no one can efficiently check whether two replicas actually contain the same underlying file without decrypting them, which would expose sensitive content to whichever party performs the check. If they are stored in a form that permits comparison, the comparison mechanism itself can become an attack surface. Public-key encryption with equality test, abbreviated PKEET, was invented to resolve exactly this tension, giving cloud servers a cryptographic trapdoor that lets them determine whether two ciphertexts encrypt the same plaintext without ever learning what that plaintext is.

Since the concept was introduced in the early 2010s, building on earlier searchable encryption techniques such as Boneh and colleagues’ public-key encryption with keyword search and Yang and colleagues’ first probabilistic PKEET construction, researchers have steadily refined the primitive. Tang showed how to support equality testing with authorization of different granularities, Ma and colleagues added flexible authorization, and later works extended the idea to certificateless settings for the industrial internet of things, to lattice-based constructions for post-quantum ambitions, and to outsourced equality testing tailored for cloud-based internet-of-things environments. What united nearly all of these schemes, however, was a relatively weak security notion: resistance to chosen-plaintext attacks, or CPA security. Under CPA security, an adversary is assumed to be passive with respect to the ciphertexts it wants to break—it can observe encrypted traffic and request encryptions of chosen messages, but it cannot trick the system into processing malformed ciphertexts of its own devising.

That assumption is dangerously optimistic for cloud backup, the authors argue. In a real deployment, an attacker who has compromised part of the network, a malicious insider at a cloud provider, or simply an adversary injecting crafted ciphertexts into the storage system can submit deliberately malformed encrypted data and observe how the system responds. Chosen-ciphertext attack, or CCA, security is the gold-standard defense against such active adversaries, ensuring that an attacker gains nothing from feeding the system manipulated ciphertexts. Yet every previously published publicly verifiable PKEET scheme—schemes in which the correctness of an equality-test result can be checked by any third party—offered only CPA security. The study identifies the scheme of Li, Susilo, Xia, and Zhao, published in IEEE Transactions on Dependable and Secure Computing in 2024, as the most recent state of the art, and it too falls short of the CCA barrier. For applications such as healthcare records, financial archives, and regulatory-compliant backups, where a single equality-test result may be used to justify deletion of a replica or certification of data integrity, an unforgeable and actively secure test is not a luxury but a requirement.

The new scheme closes this gap with a two-part design. First, the authors distribute the equality-testing task across the authorized cloud servers that hold the replicated ciphertexts: rather than a single server deciding whether two encrypted backups match, the servers collaboratively perform the comparison. Second, the scheme attaches to every test result a compact cryptographic proof of correctness that anyone—auditor, regulator, or the data owner—can check publicly, without any secret key and without access to the underlying plaintexts. Crucially, the construction is built so that only the authorized cloud servers are capable of generating a valid proof in the first place. This property prevents a malicious outsider from fabricating a plausible-looking attestation that two ciphertexts match, or fail to match, when they do not. In a multi-replica backup setting, this means a third party can confirm that all replicas of a critical file are consistent, or that a server is honestly reporting deduplication results, purely by verifying publicly available evidence.

The security analysis rests on foundations that have anchored public-key cryptography for two decades: the family of Diffie-Hellman assumptions over bilinear pairings. Working in the random oracle model, an idealized framework in which cryptographic hash functions are modeled as truly random functions, the authors prove three distinct guarantees. Against authorized internal adversaries—cloud servers that legitimately hold testing trapdoors but may nonetheless try to recover plaintexts—the scheme achieves one-wayness under chosen-ciphertext attacks, relying on the Bilinear Diffie-Hellman assumption together with the preimage resistance of the underlying hash function. Against unauthorized external adversaries, the scheme achieves the stronger notion of indistinguishability under chosen-ciphertext attacks, grounded in the decisional Bilinear Diffie-Hellman assumption. Separately, the authors prove that the correctness proof attached to each equality test is existentially unforgeable under chosen-message attacks, based on the Computational Diffie-Hellman assumption—a guarantee that no adversary, however adaptive, can forge a validity proof for a false test outcome.

Security of this depth usually carries a steep performance price, but the experimental evaluation suggests the cost is surprisingly modest. The researchers implemented their construction and benchmarked it against the 2024 scheme of Li and colleagues, the previous benchmark for publicly verifiable equality-test encryption. The comparison shows that the new scheme cuts the computational cost of public verification to 0.76 times that of the earlier scheme, meaning that third-party auditing of equality-test results actually becomes roughly a quarter cheaper, even as the underlying security level strengthens from CPA to CCA. Across the full workflow of encryption, test-token generation, collaborative testing, proof generation, and verification, the scheme incurs only moderate additional overhead relative to its weaker predecessor. Because public verification is typically the operation performed most often in auditing-heavy deployments—every check of a backup’s integrity invokes it—the authors argue that the scheme is not merely a theoretical advance but a practical candidate for real cloud backup systems.

The implications extend well beyond the immediate niche of multi-replica backup. Verified public-key encryption with equality test has been proposed for secure deduplication in cloud-assisted e-health systems, where hospitals replicate patient records across providers and regulators may need to audit storage consistency without ever viewing medical data. Similar needs arise in cloud-based electronic commerce, where prior work has combined equality testing with cryptographic reverse firewalls, and in privacy-preserving public auditing frameworks that trace their lineage to Wang and colleagues’ foundational work on secure cloud storage. In all of these settings, the ability to prove that an equality-test verdict is honest—without trusting the cloud provider and without decrypting anything—converts a trust relationship into a mathematical guarantee. The new CCA-secure construction means such guarantees now hold even when adversaries are actively injecting crafted ciphertexts rather than passively eavesdropping, closing the most realistic attack channel in shared cloud infrastructure.

The authors acknowledge the standard caveats that accompany proofs in the random oracle model, which is a convenient idealization rather than a faithful description of real hash functions, and the scheme’s reliance on bilinear pairings means its performance is tied to pairing-friendly curves—a consideration that future lattice-based or post-quantum variants may need to revisit. The work was supported by the National Natural Science Foundation of China, the Zhejiang Provincial ‘Leading Goose’ R&D Program, and the Zhejiang Provincial Natural Science Foundation. As enterprises migrate ever-larger archives of regulated, sensitive data into replicated cloud storage, and as auditors and courts increasingly demand cryptographic evidence rather than vendor assurances, the study marks a milestone: the first time that publicly verifiable, equality-testable encryption has been made robust against the strongest practical attackers. For the first time, an organization can let the world check that its cloud backups match—while keeping the contents of those backups secret from the world entirely.

Subject of Research: A chosen-ciphertext secure publicly verifiable public-key encryption scheme with equality test for multi-replica cloud backup.

Article Title: CCA-Secure Publicly Verifiable Public-key Encryption with Equality Test for Multi-replica Cloud Backup

Article References: CCA-Secure Publicly Verifiable Public-key Encryption with Equality Test for Multi-replica Cloud Backup. (n.d.). https://doi.org/10.1007/s11036-026-02548-y

Image Credits: AI Generated

DOI: 10.1007/s11036-026-02548-y

Keywords: cloud computing, encryption, cryptography, cloud backup, CCA security, equality test, PKEET, public verification, data deduplication, bilinear Diffie-Hellman, cloud storage security, multi-replica