Public-Key Encryption in the Bounded-Retrieval Model

453 views
387 views

Published on

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
453
On SlideShare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
6
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Public-Key Encryption in the Bounded-Retrieval Model

  1. 1. Public-Key Encryption in the Bounded-Retrieval Model<br />Earlier Today: <br />Yevgeniy covered <br />ID schemes, Signatures, Interactive Encryption/Authentication/AKA<br />Joël Alwen, YevgeniyDodis, MoniNaor,<br /> Gil Segev, ShabsiWalfish, Daniel Wichs<br />
  2. 2. Leakage Resilience and the BRM<br /><ul><li>Leakage Resilience: Cryptographic schemes that remain secure even if adversary learns partial information about sk.
  3. 3. Goal: High relative leakage.
  4. 4. Bounded Retrieval Model: Absolute size of leakage can be arbitrarily large (bits, Mb, Gb…).
  5. 5. Accommodate any leakage threshold by increasing key size flexibly.
  6. 6. No other loss of efficiency!</li></ul>[AGV09, NS09,…]<br />sk<br />f(sk)<br />leak<br />[Dzi06, CLW06,…]<br />90% of |sk|<br />
  7. 7. Why have schemes in the BRM?<br /><ul><li>Security against viruses:
  8. 8. Virus downloads arbitrary information from local storage and sends it to a remote attacker.
  9. 9. In practice, virus cannot download too much (< 10 GB).
  10. 10. Bandwidth too low, Cost too high, System security may detect.
  11. 11. Security against side-channel attacks:
  12. 12. Adversary gets some “physical output” of computation.
  13. 13. May be unreasonable to learn “too much” info, even after many physical readings.
  14. 14. How much is “too much” depends on physical implementation (few Kb - few Mb). </li></li></ul><li>Prior Work<br /><ul><li>Leakage Resilience (No BRM):
  15. 15. Symmetric-Key Authenticated Encryption [DKL09]
  16. 16. Public-KeyEncryption [AGV09, NS09, KV09]
  17. 17. Signatures [ADW09, Katz09]
  18. 18. Bounded Retrieval Model:
  19. 19. Secret Sharing [DP07]
  20. 20. Symmetric-Key Identification and Authenticated Key Agreement [Dzi06,CDD+07]
  21. 21. Public-Key ID schemes, Signatures, Authenticated Key Agreement [ADW09]
  22. 22. Now: Public-KeyEncryption in the BRM.</li></li></ul><li>Public-Key Encryption in the BRM <br /><ul><li>Goal: PKE parameterized by security parameter s (e.g. 256 bits) and leakage bound L (e.g. 256 bits - 10GB).
  23. 23. Secret Key size is flexible: |sk| = (1 + ε)L.
  24. 24. Public Keys and Ciphertexts are short, only depend on s.
  25. 25. Decryption is local. Number of bits accessed is proportional to s.
  26. 26. Naïve Attempt : “Take any leakage-resilient PKE tolerating l(|sk|) leakage. Increase security parameter s until l(|sk|) > L.”
  27. 27. Problem: Public-key/Ciphertext size depends on L. May be huge.
  28. 28. Problem: Decryption is not local.
  29. 29. Problem: Computation over groups with 10 GB description length.
  30. 30. Positive: Very Secure!</li></li></ul><li>PKE in the BRM via Composition of PKE <br /><ul><li>Attempt #1: “Compose n copies of Leakage-Resilient PKE”
  31. 31. Generate n pairs (pk1,sk1),…, (pkn, skn). Set PK = (pk1,…, pkn), SK = (sk1,…, skn).
  32. 32. To encrypt m:
  33. 33. Compute shares (s1,…, sn) such that m = s1 + …+ sn.
  34. 34. Set c1=Enc(pk1, s1),…, cn=Enc(pkn, sn).
  35. 35. Ciphertext is C = (c1 ,…, cn).
  36. 36. Hope: Composed scheme amplifies leakage from lto L = n lbitswithout unnecessary increase in security parameter.
  37. 37. Intuition: To break the composed scheme, must leak l bits about each of (sk1,…, skn).
  38. 38. Unfortunately ciphertext size, public key size and locality are still large.</li></ul>PK<br />SK<br />pk1<br />sk1<br />pk2<br />sk2<br />…<br />…<br />Can intuition be formalized? Stay tuned…<br />pkn<br />skn<br />
  39. 39. PKE in the BRM via Composition of IBE<br /><ul><li>Attempt #2: Use Leakage-Resilient IBE to Reduce Public-Key Size.
  40. 40. Generate a master-key pair (MPK, MSK) for an IBE.
  41. 41. Use MSK to generate keys sk1,…, sknfor identities 1,…,n.
  42. 42. Set PK = MPK, SK = (sk1,…, skn). Delete MSK.
  43. 43. To encrypt m:
  44. 44. Compute shares (s1,…, st) such that m = s1 + …+ st.
  45. 45. Choose t random identities IDi∊ [n].
  46. 46. Set c1=Enc(ID1, s1),…, cn=Enc(IDt, st).
  47. 47. Ciphertext is C = (ID1 ,…, IDt , c1 ,…, ct).
  48. 48. Good news: Ciphertext, Public-Key, Locality is proportional to security parameter.
  49. 49. Need leakage resilient IBE. (Of Independent Interest)
  50. 50. Is the composition secure?</li></ul>SK<br />MPK<br />sk1<br />ID=1<br />ID=2<br />sk2<br />…<br />Random Subset of [n]<br />skn<br />ID=n<br />
  51. 51. Does Composition Amplify Leakage Resilience?<br /><ul><li>Composition of Leakage-Resilient PKE (Attempt 1):
  52. 52. Intuition does not formalize into a reduction.
  53. 53. Problem: cannot simulate L bits leakage on SK = (sk1,…, skn) by leaking only l < L bits of ski.
  54. 54. Do not know of an counterexample (even artificial).
  55. 55. but black-box reductions won’t work…
  56. 56. Composition using Leakage-Resilient IBE (Attempt 2):
  57. 57. Have an (artificial) counterexample.</li></ul> Idea: secret keys of identities 1,…,n contain secret-sharing of master secret key.<br /><ul><li>Good news: composition amplifies leakage resilience for PKE/IBE of special form.
  58. 58. Based on hash-proof-systems [CS02, NS09].</li></li></ul><li>Leakage Resilience from Hash-Proof Systems<br /><ul><li>Earlier today: construction of Leakage-Resilient PKE from Hash-Proof Systems [NS09].
  59. 59. R= {(pk,sk) pairs}. Many valid sk for each pk.
  60. 60. Three algorithms (Encap, BadEncap, Decap)
  61. 61. Good encapsulation: (e, k) = Encap(pk).
  62. 62. Bad encapsulation: e = BadEncap(pk).
  63. 63. Decapsulation: k = Decap(e, sk).
  64. 64. Can’t distinguish if e is good or bad (even given sk).
  65. 65. For fixed pk, bad e: Decap(e,sk) is statistically uniform.
  66. 66. Encryption/Decryption: use k as a one-time-pad.
  67. 67. Encrypt(m, pk) = (e, k+m) where (e,k) = Encap(pk).</li></li></ul><li>Composition of Hash Proof Systems<br />Let PK = (pk1,…, pkn), SK = (sk1,…, skn).<br />Encrypt(m,pk) = (E, K+m) where<br />E = (e1,…, en, r) for (ei , ki ) = Encap(pki)<br />K = Extract(k1,…, kn; r) <br />
  68. 68. Theorem: Composition of Hash-Proof Systems Amplifies Leakage<br /><ul><li>Show that:</li></ul> E = [e1,…, en, r], Leak(SK), K = Extract(k1,…, kn; r)<br /> Where (ei,ki ) = Encap(pki)<br /> E = [e1,…, en, r], Leak(SK), K = Extract(k1,…, kn; r)<br /> Where ei = Encap(pki), ki = Decap(ei, ski) <br /> E = [e1,…, en, r], Leak(SK), K = Extract(k1,…, kn; r)<br /> Where ei = BadEncap(pki), ki = Decap(ei, ski) <br /> E = [(e1,…, en), r], Leak(SK), Uniform<br />INDISTINGUISHABLE<br />|Uniform| = n|ki | - |Leak(SK)| - O(S)<br />
  69. 69. How to get PKE in BRM?<br /><ul><li>Recap: “Attempt 1” scheme can be fixed using Hash-Proof Systems.
  70. 70. Long ciphertexts, public-keys, and no locality.
  71. 71. How to fix “Attempt 2” scheme based on IBE?
  72. 72. Need “Identity Based Hash-Proof System” (IB-HPS).
  73. 73. Formalized this new notion.
  74. 74. Result 1: IB-HPS gives us Leakage-Resilient IBE.
  75. 75. Result 2: IB-HPS gives us efficient PKE in BRM.
  76. 76. Resulting IBE is used to instantiate “Attempt 2” scheme.
  77. 77. Constructions?</li></li></ul><li>Constructing IB-HPS<br />Construction based on the [Gentry06] IBE .<br />Based on “q-ABDHA” (pairing stuff....)<br />Allows leakage of (½ - ε ) of secret key.<br />Construction based on [GPV08] IBE.<br />Based on “LWE” (lattice stuff + RO)<br />Proven as leakage-resilient IBE by [AGV09].<br />Allows leakage of (1 - ε ) of secret key.<br />

×