CCA2 Key-Privacy for Code-Based Encryption in the Standard Model Yusuke Yoshida with Kirill Morozov and Keisuke Tanaka from Tokyo Institute of Technology, Japan 1
Contents Contents Key-Privacy for PKE Indistinguishability of keys (IK) 2
Contents Contents Key-Privacy for PKE Indistinguishability of keys (IK) Code-Based Encryption Niederreiter 3
Contents Contents Key-Privacy for PKE Indistinguishability of keys (IK) Code-Based Encryption Niederreiter CCA2 secure PKE in the standard model k-repetition paradigm 4
Contents Contents Key-Privacy for PKE Our result: Indistinguishability of keys (IK) CCA2 Key-Privacy for Code-Based Code-Based Encryption Encryption in the Standard Model Niederreiter We proved that the k-repetition CCA2 secure PKE paradigm instantiated with Niederreiter is IK-CCA2 in the standard model. in the standard model k-repetition paradigm 5
Contents Contents Key-Privacy for PKE Indistinguishability of keys (IK) Code-Based Encryption Niederreiter CCA2 secure PKE in the standard model k-repetition paradigm 6
Key-Privacy (Anonymity) for PKE Indistinguishability of keys (IK) • was proposed by Bellare et al.* *Bellare, M., Boldyreva, A., Desai, A., Pointcheval, D.: Key-privacy in public-key encryption. In: Boyd, C. (ed.) ASIACRYPT 2001. 7
Key-Privacy (Anonymity) for PKE Indistinguishability of keys (IK) • was proposed by Bellare et al.* • means a ciphertext does not leak information about pk. ? true receiver + sender who is the receiver? *Bellare, M., Boldyreva, A., Desai, A., Pointcheval, D.: Key-privacy in public-key encryption. In: Boyd, C. (ed.) ASIACRYPT 2001. 8
Key-Privacy (Anonymity) for PKE Indistinguishability of keys (IK) • was proposed by Bellare et al.* • means a ciphertext does not leak information about pk. • against CPA, CCA2 could be considered. < IK-CPA IK-CCA2 < IND-CPA IND-CCA2 cf.) *Bellare, M., Boldyreva, A., Desai, A., Pointcheval, D.: Key-privacy in public-key encryption. In: Boyd, C. (ed.) ASIACRYPT 2001. 9
Key-Privacy (Anonymity) for PKE Indistinguishability of keys (IK) • was proposed by Bellare et al.* • means a ciphertext does not leak information about pk. • against CPA, CCA2 could be considered. • does not imply / is not implied by IND security. IK-CPA IK-CCA2 ⇎ ⇎ IND-CPA IND-CCA2 *Bellare, M., Boldyreva, A., Desai, A., Pointcheval, D.: Key-privacy in public-key encryption. In: Boyd, C. (ed.) ASIACRYPT 2001. 10
Definition of IK-CPA pk 0 , pk 1 pk 0 ,sk 0 ←Gen(1 λ ) pk 1 ,sk 1 ←Gen(1 λ ) Challenger Adversary 11
Definition of IK-CPA pk 0 , pk 1 pk 0 ,sk 0 ←Gen(1 λ ) pk 1 ,sk 1 ←Gen(1 λ ) Challenger Adversary m* b ← {0, 1} c* c* ←Enc(m*,pk b ) 12
Definition of IK-CPA pk 0 , pk 1 pk 0 ,sk 0 ←Gen(1 λ ) pk 1 ,sk 1 ←Gen(1 λ ) Challenger Adversary m* b ← {0, 1} c* c* ←Enc(m*,pk b ) b’ A PKE is IK-CPA ⇔ |Pr[b = b’] – ½| is negligible 13
Definition of IK-CCA2 pk 0 , pk 1 pk 0 ,sk 0 ←Gen(1 λ ) pk 1 ,sk 1 ←Gen(1 λ ) c,0/1 Challenger Adversary m/ ⊥ m/ ⊥ ←Dec(c,sk 0/1 ) m* b ← {0, 1} c* c* ←Enc(m*,pk b ) c ≠ c*,0/1 m/ ⊥ ←Dec(c,sk 0/1 ) m/ ⊥ b’ A PKE is IK-CCA2 ⇔ |Pr[b = b’] – ½| is negligible 14
Contents Contents Key-Privacy for PKE Indistinguishability of keys (IK) Code-Based Encryption Niederreiter CCA2 secure PKE in the standard model k-repetition paradigm 15
Linear Codes A binary 𝑜, 𝑙 linear code 𝒟 * . is a 𝑙 -dimensional subspace of 𝔾 ) 16
Linear Codes A binary 𝑜, 𝑙 linear code 𝒟 * . is a 𝑙 -dimensional subspace of 𝔾 ) 1 for a generator matrix 𝐻 . * | 𝑦 ∈ 𝔾 ) = 𝑦𝐻 ∈ 𝔾 ) McEliece encryption. 17
Linear Codes A binary 𝑜, 𝑙 linear code 𝒟 * . is a 𝑙 -dimensional subspace of 𝔾 ) 1 for a generator matrix 𝐻 . * | 𝑦 ∈ 𝔾 ) = 𝑦𝐻 ∈ 𝔾 ) McEliece encryption. * | 𝐼𝑦 3 = 0 for a parity check matrix 𝐼 . = 𝑦 ∈ 𝔾 ) Niederreiter encryption. 18
Linear Codes A binary 𝑜, 𝑙 linear code 𝒟 * . is a 𝑙 -dimensional subspace of 𝔾 ) * | 𝐼𝑦 3 = 0 for a parity check matrix 𝐼 . = 𝑦 ∈ 𝔾 ) Niederreiter encryption. 19
Linear Codes A binary 𝑜, 𝑙 linear code 𝒟 * . is a 𝑙 -dimensional subspace of 𝔾 ) * | 𝐼𝑦 3 = 0 for a parity check matrix 𝐼 . = 𝑦 ∈ 𝔾 ) Niederreiter encryption. is error-correcting up to Hamming weight 𝑢 . ⇔ Can compute 𝑦 from syndrome 𝑡 = 𝐼𝑦 3 , if 𝑥𝑢 𝑦 ≤ 𝑢 . 20
Syndrome Decoding Problem Syndrome Decoding Problem Given a parity check matrix of random code 𝑆 and a syndrome 𝑡 = 𝑆𝑦 3 for a random low-weight error 𝑦 . Find 𝑦 . *Fischer, J.-B., Stern, J.: An efficient pseudo-random generator provably as secure as syndrome decoding. In: Maurer, U. (ed.) EUROCRYPT 1996. 21
Syndrome Decoding Problem Syndrome Decoding Problem Given a parity check matrix of random code 𝑆 and a syndrome 𝑡 = 𝑆𝑦 3 for a random low-weight error 𝑦 . Find 𝑦 . Decisional version of SD problem Given ( 𝑆 , u ) where u is a uniform random vector or 𝑆, 𝑡 , where s = 𝑆𝑦 3 as above. Decide, which is the case. If SD problem is hard, the decisional version is also hard*. *Fischer, J.-B., Stern, J.: An efficient pseudo-random generator provably as secure as syndrome decoding. In: Maurer, U. (ed.) EUROCRYPT 1996. 22
Niederreiter* 𝐼 < : parity check matrix of 𝑢 -error correcting code. Key generation 𝑇 : random non-singular matrix, 𝑄 : random permutation matrix Public key 𝑞𝑙 = 𝐼 = 𝑇𝐼 < 𝑄 (We assume 𝐼 is indistinguishable from random R) Secret key s 𝑙 = 𝑇, 𝐼 < , 𝑄 *Niederreiter, H.: Knapsack-type cryptosystems and algebraic coding theory. Probl. Control Inf. Theory-Probl. Upravleniya I Teorii Informatsii 15(2), 159–166 (1986) 23
Niederreiter* 𝐼 < : parity check matrix of 𝑢 -error correcting code. Key generation 𝑇 : random non-singular matrix, 𝑄 : random permutation matrix Public key 𝑞𝑙 = 𝐼 = 𝑇𝐼 < 𝑄 (We assume 𝐼 is indistinguishable from random R) Secret key s 𝑙 = 𝑇, 𝐼 < , 𝑄 * , 𝑥𝑢 𝑛 ≤ 𝑢 . Encryption Plaintext is 𝑛 ∈ 𝔾 ) Ciphertext is 𝑑 = 𝐼𝑛 3 *Niederreiter, H.: Knapsack-type cryptosystems and algebraic coding theory. Probl. Control Inf. Theory-Probl. Upravleniya I Teorii Informatsii 15(2), 159–166 (1986) 24
Niederreiter* 𝐼 < : parity check matrix of 𝑢 -error correcting code. Key generation 𝑇 : random non-singular matrix, 𝑄 : random permutation matrix Public key 𝑞𝑙 = 𝐼 = 𝑇𝐼 < 𝑄 (We assume 𝐼 is indistinguishable from random R) Secret key s 𝑙 = 𝑇, 𝐼 < , 𝑄 * , 𝑥𝑢 𝑛 ≤ 𝑢 . Encryption Plaintext is 𝑛 ∈ 𝔾 ) Ciphertext is 𝑑 = 𝐼𝑛 3 Compute 𝑄 CD 𝐷𝑝𝑠𝑠𝑓𝑑𝑢 𝑇 CD 𝑑 = 𝑄 CD 𝑄𝑛 3 = 𝑛 3 Decryption 𝐷𝑝𝑠𝑠𝑓𝑑𝑢 is the error correction algorithm for 𝐼 < . *Niederreiter, H.: Knapsack-type cryptosystems and algebraic coding theory. Probl. Control Inf. Theory-Probl. Upravleniya I Teorii Informatsii 15(2), 159–166 (1986) 25
Randomized Niederreiter* 𝐼 < : parity check matrix of 𝑢 -error correcting code. Key generation 𝑇 : random non-singular matrix, 𝑄 : random permutation matrix Public key 𝑞𝑙 = 𝐼 = 𝑇𝐼 < 𝑄 (We assume 𝐼 is indistinguishable from random R) Secret key s 𝑙 = 𝑇, 𝐼 < , 𝑄 Encryption Plaintext is 𝑛 , Take a random padding vector r * , 𝑥𝑢 𝑛||𝑠 ≤ 𝑢 . 𝑛||𝑠 ∈ 𝔾 ) Ciphertext is 𝑑 = 𝐼(𝑛||𝑠) 3 Compute 𝑄 CD 𝐷𝑝𝑠𝑠𝑓𝑑𝑢 𝑇 CD 𝑑 = 𝑄 CD 𝑄 𝑛||𝑠 3 = 𝑛||𝑠 3 Decryption Pick 𝑛 from 𝑛||𝑠 3 . *Nojima, R., Imai, H., Kobara, K., Morozov, K.: Semantic security for the McEliece cryptosystem without random oracles. Des. Codes Crypt. 49(1–3), 289–305 (2008) 26
Key-Privacy for Code-Based Encryption Yamakawa et al.* first studied key-privacy for code-based encryption, and show IK-CPA IK-CCA2 not IK-CPA McEliece *Yamakawa, S., Cui, Y., Kobara, K., Hagiwara, M., Imai, H.: On the key-privacy issue of McEliece public-key encryption. In: Bozta ̧s, S., Lu, H.-F.F. (eds.) AAECC 2007. 27
Key-Privacy for Code-Based Encryption Yamakawa et al.* first studied key-privacy for code-based encryption, and show IK-CPA IK-CCA2 not IK-CPA Randomized McEliece McEliece *Yamakawa, S., Cui, Y., Kobara, K., Hagiwara, M., Imai, H.: On the key-privacy issue of McEliece public-key encryption. In: Bozta ̧s, S., Lu, H.-F.F. (eds.) AAECC 2007. 28
Key-Privacy for Code-Based Encryption Yamakawa et al.* first studied key-privacy for code-based encryption, and show IK-CPA IK-CCA2 not IK-CPA Standard Randomized McEliece Model McEliece Random Kobara and Imai’s conversion† Persichetti’s hybrid encryption‡ Oracle *Yamakawa, S., Cui, Y., Kobara, K., Hagiwara, M., Imai, H.: On the key-privacy issue of McEliece public-key encryption. In: Bozta ̧s, S., Lu, H.-F.F. (eds.) AAECC 2007. †Kobara, K., Imai, H.: Semantically secure McEliece public-key cryptosystems-conversions for McEliece PKC. In: Kim, K. (ed.) PKC 2001. ‡Persichetti, E.: Secure and anonymous hybrid encryption from coding theory. In: Gaborit, P. (ed.) PQCrypto 2013. 29
Recommend
More recommend
