Chosen-Ciphertext Security from Subset Sum PKC 2016, 07.03.2016 - PowerPoint PPT Presentation

Chosen-Ciphertext Security from Subset Sum PKC 2016, 07.03.2016 Sebastian Faust 1 Daniel Masny 1 Daniele Venturi 2 1 Ruhr Universität Bochum 2 Sapienza University of Rome 1

Outline 1 Our Contribution 2 Subset Sum 3 CCA secure PKE 4 Tag-Based Encryption

Our Contribution State of the Art ▶ CPA-secure Public Key Encryption (PKE) from Subset Sum [LPS10]. 3

Our Contribution State of the Art ▶ CPA-secure Public Key Encryption (PKE) from Subset Sum [LPS10]. ▶ The security decreases with the message length. 3

Our Contribution State of the Art ▶ CPA-secure Public Key Encryption (PKE) from Subset Sum [LPS10]. ▶ The security decreases with the message length. ▶ Solution: split message (not possible for CCA) 3

Our Contribution State of the Art ▶ CPA-secure Public Key Encryption (PKE) from Subset Sum [LPS10]. ▶ The security decreases with the message length. ▶ Solution: split message (not possible for CCA) Our Results ▶ We construct a CCA-secure PKE from Subset Sum (using [MP12]). 3

Our Contribution State of the Art ▶ CPA-secure Public Key Encryption (PKE) from Subset Sum [LPS10]. ▶ The security decreases with the message length. ▶ Solution: split message (not possible for CCA) Our Results ▶ We construct a CCA-secure PKE from Subset Sum (using [MP12]). ▶ The security of our PKE does not decrease with the message length. 3

Outline 1 Our Contribution 2 Subset Sum 3 CCA secure PKE 4 Tag-Based Encryption

Subset Sum Subset Sum ( n , µ ) : Find secret s ∈ { 0 , 1 } n , 5

Subset Sum Subset Sum ( n , µ ) : Find secret s ∈ { 0 , 1 } n , given ( A := ( a 1 , . . . , a n ) , t := s 1 a 1 + · · · + s n a n ) ∈ Z n µ × Z µ . 5

Subset Sum Subset Sum ( n , µ ) : Find secret s ∈ { 0 , 1 } n , given ( A := ( a 1 , . . . , a n ) , t := s 1 a 1 + · · · + s n a n ) ∈ Z n µ × Z µ . Hardness of Subset Sum n δ := log µ : n Θ( 1 Θ( log 2 n ) n ) Θ( 1 ) 5

Subset Sum Subset Sum ( n , µ ) : Find secret s ∈ { 0 , 1 } n , given ( A := ( a 1 , . . . , a n ) , t := s 1 a 1 + · · · + s n a n ) ∈ Z n µ × Z µ . Hardness of Subset Sum n δ := log µ : n Θ( 1 1 Θ( log 2 n ) n ) Θ( log n ) Θ( 1 ) 1 ▶ We focus on δ = Θ( log n ) . 5

Subset Sum Subset Sum ( n , µ ) : Find secret s ∈ { 0 , 1 } n , given ( A := ( a 1 , . . . , a n ) , t := s 1 a 1 + · · · + s n a n ) ∈ Z n µ × Z µ . Hardness of Subset Sum n δ := log µ : n Θ( 1 1 Θ( log 2 n ) n ) Θ( log n ) Θ( 1 ) 1 ▶ We focus on δ = Θ( log n ) . Decisional Subset Sum [IN96]: ( A , t ) is hard to distinguish from uniform. 5

“LWE” form of Subset Sum [LPS10] ( A , t ) ∈ Z n µ × Z µ → Z m × n × Z m q q 6

“LWE” form of Subset Sum [LPS10] ( A , t ) ∈ Z n µ × Z µ → Z m × n × Z m q q Let µ = q m , 6

“LWE” form of Subset Sum [LPS10] ( A , t ) ∈ Z n µ × Z µ → Z m × n × Z m q q Let µ = q m , then we can represent a ∈ Z µ as value in Z m q : 6

“LWE” form of Subset Sum [LPS10] ( A , t ) ∈ Z n µ × Z µ → Z m × n × Z m q q Let µ = q m , then we can represent a ∈ Z µ as value in Z m q : a = a m · q m − 1 + . . . + a 1 · q 0 � = ( a m , . . . , a 1 ) T ∈ Z m q 6

“LWE” form of Subset Sum [LPS10] ( A , t ) ∈ Z n µ × Z µ → Z m × n × Z m q q Let µ = q m , then we can represent a ∈ Z µ as value in Z m q : a = a m · q m − 1 + . . . + a 1 · q 0 � = ( a m , . . . , a 1 ) T ∈ Z m q 6

“LWE” form of Subset Sum [LPS10] ( A , t ) ∈ Z n µ × Z µ → Z m × n × Z m q q Let µ = q m , then we can represent a ∈ Z µ as value in Z m q : a = a m · q m − 1 + . . . + a 1 · q 0 � = ( a m , . . . , a 1 ) T ∈ Z m q Therefore   a m a m · · · 1 n   . ... . . .  ∈ Z m × n A = ( a 1 , . . . , a n ) � =  . . q a 1 a 1 · · · n 1 6

“LWE” form of Subset Sum [LPS10] t = s 1 a 1 + · · · + s n a n ∈ Z q m , 7

“LWE” form of Subset Sum [LPS10] t = s 1 a 1 + · · · + s n a n ∈ Z q m ,       a m a m e m ( A , s ) 1 n       . . . . . .       . . . ∈ Z m = ̸ � s 1   · · · + s n     +   q ,     a 2 a 2 e 2 ( A , s ) 1 n a 1 a 1 e 1 ( A , s ) 1 n 7

“LWE” form of Subset Sum [LPS10] t = s 1 a 1 + · · · + s n a n ∈ Z q m ,       a m a m e m ( A , s ) 1 n       . . . . . .       . . . ∈ Z m = � s 1   · · · + s n    +    q ,     a 2 a 2 e 2 ( A , s ) 1 n a 1 a 1 e 1 ( A , s ) 1 n where e ( A , s ) is a vector of carries. 7

“LWE” form of Subset Sum [LPS10] t = s 1 a 1 + · · · + s n a n ∈ Z q m ,       a m a m e m ( A , s ) 1 n       . . . . . .       . . . ∈ Z m = � s 1   · · · + s n    +    q ,     a 2 a 2 e 2 ( A , s ) 1 n a 1 a 1 e 1 ( A , s ) 1 n where e ( A , s ) is a vector of carries. 7

“LWE” form of Subset Sum [LPS10] t = s 1 a 1 + · · · + s n a n ∈ Z q m ,       a m a m e m ( A , s ) 1 n       . . . . . .       . . . ∈ Z m = � s 1   · · · + s n    +    q ,     a 2 a 2 e 2 ( A , s ) 1 n a 1 a 1 e 1 ( A , s ) 1 n where e ( A , s ) is a vector of carries. 7

“LWE” form of Subset Sum [LPS10] t = s 1 a 1 + · · · + s n a n ∈ Z q m ,       a m a m e m ( A , s ) 1 n       . . . . . .       . . . ∈ Z m = � s 1    · · · + s n    +   q ,     a 2 a 2 e 2 ( A , s ) 1 n a 1 a 1 e 1 ( A , s ) 1 n where e ( A , s ) is a vector of carries. From now on, ( A , t = As + e ( A , s )) ∈ Z m × n × Z m q ( m samples). q 7

Many Samples from Subset Sum µ = q m 8

Many Samples from Subset Sum µ = q m ⇒ m samples 8

Many Samples from Subset Sum µ = q m ⇒ m samples ⇒ δ = n m · log q (easy for e.g. m = n 2 ) n log µ = 8

Many Samples from Subset Sum µ = q m ⇒ m samples ⇒ δ = n m · log q (easy for e.g. m = n 2 ) n log µ = From m to ℓ samples: ▶ given ( A , t ) ∈ Z m × n × Z m q q 8

Many Samples from Subset Sum µ = q m ⇒ m samples ⇒ δ = n m · log q (easy for e.g. m = n 2 ) n log µ = From m to ℓ samples: ▶ given ( A , t ) ∈ Z m × n × Z m q q ▶ R ← D ℓ × m , where D has sufficient min-entropy. q 8

Many Samples from Subset Sum µ = q m ⇒ m samples ⇒ δ = n m · log q (easy for e.g. m = n 2 ) n log µ = From m to ℓ samples: ▶ given ( A , t ) ∈ Z m × n × Z m q q ▶ R ← D ℓ × m , where D has sufficient min-entropy. q ▶ output ( RA , R t = RAs + Re ( A , s )) ∈ Z ℓ × n × Z ℓ q q 8

Many Samples from Subset Sum µ = q m ⇒ m samples ⇒ δ = n m · log q (easy for e.g. m = n 2 ) n log µ = From m to ℓ samples: ▶ given ( A , t ) ∈ Z m × n × Z m q q ▶ R ← D ℓ × m , where D has sufficient min-entropy. q ▶ output ( RA , R t = RAs + Re ( A , s )) ∈ Z ℓ × n × Z ℓ q q ▶ Leftover hash lemma [HILL99]: If ( A , t ) is uniform ⇒ ( A , t , RA , R t ) is uniform. 8

Many Samples from Subset Sum µ = q m ⇒ m samples ⇒ δ = n m · log q (easy for e.g. m = n 2 ) n log µ = From m to ℓ samples: ▶ given ( A , t ) ∈ Z m × n × Z m q q ▶ R ← D ℓ × m , where D has sufficient min-entropy. q ▶ output ( RA , R t = RAs + Re ( A , s )) ∈ Z ℓ × n × Z ℓ q q ▶ Leftover hash lemma [HILL99]: If ( A , t ) is uniform ⇒ ( A , t , RA , R t ) is uniform. ▶ ( RA , R t ) is not Subset Sum distributed ( Re ( A , s ) ̸ = e ( RA , s )) . 8

Outline 1 Our Contribution 2 Subset Sum 3 CCA secure PKE 4 Tag-Based Encryption

CCA secure PKE Given a One-Time Signature ( OTS ), [CHK04]: TBE + OTS → CCA-secure PKE. 10

CCA secure PKE Given a One-Time Signature ( OTS ), [CHK04]: TBE + OTS → CCA-secure PKE. Tag-Based Encryption ( TBE ): TBE = ( Gen , Enc , Dec ) . 10

CCA secure PKE Given a One-Time Signature ( OTS ), [CHK04]: TBE + OTS → CCA-secure PKE. Tag-Based Encryption ( TBE ): TBE = ( Gen , Enc , Dec ) . Correctness: For ( sk , pk ) ← Gen ( 1 n ) : Dec ( sk , τ, Enc ( pk , τ, M )) = M 10

CCA secure PKE Given a One-Time Signature ( OTS ), [CHK04]: TBE + OTS → CCA-secure PKE. Tag-Based Encryption ( TBE ): TBE = ( Gen , Enc , Dec ) . Correctness: For ( sk , pk ) ← Gen ( 1 n ) : Dec ( sk , τ, Enc ( pk , τ, M )) = M Security: 10

CCA secure PKE Adv . Given a One-Time Signature ( OTS ), ( sk , pk ) ← Gen ( 1 n ) [CHK04]: TBE + OTS → CCA-secure PKE. Tag-Based Encryption ( TBE ): M = Dec ( sk , τ, c ) TBE = ( Gen , Enc , Dec ) . · · · b ← { 0 , 1 } Correctness: c ∗ ← Enc ( pk , τ ∗ , M b ) For ( sk , pk ) ← Gen ( 1 n ) : Dec ( sk , τ, Enc ( pk , τ, M )) = M M = Dec ( sk , τ, c ) Security: For all ppt Adv . : Pr [ b ′ = b ] = 1 / 2 . · · ·