Cryptographic Reductions: Classification and Applications to Ideal - PowerPoint PPT Presentation

Cryptographic Reductions: Classification and Applications to Ideal Models Paul Baecher

Cryptographic Reductions: Classification and Applications to Ideal Models Paul Baecher

Three Ways to Argue for Cryptographic Security Cryptanalysis Empirically evaluate real-world primitives Information-theoretic arguments Disregard any resource limitations Provable security from assumptions Efficient attackers only 1

Three Ways to Argue for Cryptographic Security Provable security from assumptions Efficient attackers only 1

Provable Security Follows a Common Structure Construction “To encrypt with � construction � , take the message and. . . ” 2

Provable Security Follows a Common Structure Construction “To encrypt with � construction � , take the message and. . . ” Security proof Thm: If � assumption � , then � construction � secure. 2

Provable Security Follows a Common Structure Construction “To encrypt with � construction � , take the message and. . . ” Security proof Thm: If � assumption � , then � construction � secure in the � ideal model � . 2

Provable Security Follows a Common Structure Construction “To encrypt with � construction � , take the message and. . . ” Security proof Thm: If � assumption � , then � construction � secure in the � ideal model � . Idealized primitive 2

Ideal Models Provide the “Best Possible” Primitive Ideal model Real life Random oracle MD5, SHA3, . . . Ideal cipher DES, AES, . . . 3

Ideal Models Provide the “Best Possible” Primitive Ideal model Real life Random oracle MD5, SHA3, . . . Ideal cipher DES, AES, . . . Pick a random function from the set of all functions from k to n bits. 3

Comparing Two Constructions with Ideal-Model Proofs is Difficult If � assump � , then � constr 1 � If � assump � , then � constr 2 � secure in the � ideal model � . secure in the � ideal model � . 4

Comparing Two Constructions with Ideal-Model Proofs is Difficult If � assump � , then � constr 1 � If � assump � , then � constr 2 � secure in the � ideal model � . secure in the � ideal model � . Idealized primitive 4

Comparing Two Constructions with Ideal-Model Proofs is Difficult If � assump � , then � constr 1 � If � assump � , then � constr 2 � secure in the � ideal model � . secure in the � ideal model � . Idealized primitive � constr 1 � 4

Comparing Two Constructions with Ideal-Model Proofs is Difficult If � assump � , then � constr 1 � If � assump � , then � constr 2 � secure in the � ideal model � . secure in the � ideal model � . Idealized primitive � constr 1 � � constr 2 � 4

Comparing Two Constructions with Ideal-Model Proofs is Difficult If � assump � , then � constr 1 � If � assump � , then � constr 2 � secure in the � ideal model � . secure in the � ideal model � . Idealized primitive � constr 1 � � constr 2 � AES 4

Comparing Two Constructions with Ideal-Model Proofs is Difficult If � assump � , then � constr 1 � If � assump � , then � constr 2 � secure in the � ideal model � . secure in the � ideal model � . Idealized primitive � constr 1 � � constr 2 � DES 4

Comparing Two Constructions with Ideal-Model Proofs is Difficult If � assump � , then � constr 1 � If � assump � , then � constr 2 � secure in the � ideal model � . secure in the � ideal model � . Idealized primitive � constr 1 � ? � constr 2 � DES 4

Comparisons Might Still Be Possible Without Fully Understanding Ideal Primitives Can we compare constructions relative to each other? How do popular constructions compare? 5

Oracle reducibility enables sound comparisons of cryptographic constructions whose proofs are in ideal models. 6

Outline [BF11,BFFS13] Oracle reducibility A versatile comparison paradigm Ideal-cipher comparisons Blockcipher-based compression functions Random-oracle comparisons ElGamal-type encryption schemes 7

Outline [BF11,BFFS13] Oracle reducibility A versatile comparison paradigm Ideal-cipher comparisons Blockcipher-based compression functions Random-oracle comparisons ElGamal-type encryption schemes 7

What Makes � constr 1 � Secure Also Makes � constr 2 � Secure Idealized primitive � constr 1 � � constr 2 � 8

What Makes � constr 1 � Secure Also Makes � constr 2 � Secure Idealized primitive � constr 1 � � constr 2 � E 8

What Makes � constr 1 � Secure Can be Adjusted to Make � constr 2 � Secure Idealized primitive � constr 2 � � constr 1 � 9

What Makes � constr 1 � Secure Can be Adjusted to Make � constr 2 � Secure Idealized primitive � constr 2 � � constr 1 � E 9

What Makes � constr 1 � Secure Can be Adjusted to Make � constr 2 � Secure Idealized primitive � constr 2 � � constr 1 � E T ( E ) 9

Formally Defining [ B F11, B FFS13] Oracle Reducibility Direct reducibility Free reducibility Any oracle O that makes C O There exists T s.t. any oracle 1 secure also makes C O that makes C O 2 secure 1 secure also makes C T O secure 2 10

Formally Defining [ B F11, B FFS13] Oracle Reducibility Direct reducibility Free reducibility Any oracle O that makes C O There exists T s.t. any oracle ⇒ 1 secure also makes C O that makes C O 2 secure 1 secure also makes C T O secure 2 10

Outline Oracle reducibility A versatile comparison paradigm Ideal-cipher comparisons [BFFS13] Blockcipher-based compression functions Random-oracle comparisons ElGamal-type encryption schemes 11

Compression Functions Securely Shrink Their Input Building block for hash functions K 2 n -to- n compression Built from a blockcipher M E Design from [PGV93] Collision resistant if E ideal E ( K , M ) ⊕ M Proof due to [BRSS10] 12

PGV Functions 1 2 3 4 5 6 7 8 9 10 11 12 13

PGV Functions [ B FFS13] Fall Into Two Groups 1 4 2 3 5 8 6 7 9 12 10 11 direct reducibility within direct reducibility within 13

PGV Functions [ B FFS13] Fall Into Two Groups 1 4 2 3 separation (direct) 5 8 � 6 7 reducibility (free) 9 12 10 11 13

PGV Functions [ B FFS13] Fall Into Two Groups f r e e r e d u c t i o n 1 4 2 3 separation (direct) 5 8 � 6 7 reducibility (free) 9 12 10 11 13

Free Reduction From PGV 2 to PGV 1 M M K K 1 2 1 secure ⇒ PGV T E PGV E There exists T s.t. for any E : secure 2 E 14

Free Reduction From PGV 2 to PGV 1 M M K K 1 2 1 secure ⇒ PGV T E PGV E There exists T s.t. for any E : secure 2 T E ( K , M ) := E ( K , M ) ⊕ K E 14

Free Reduction From PGV 2 to PGV 1 M M K K 1 2 1 secure ⇒ PGV T E PGV E There exists T s.t. for any E : secure 2 T E ( K , M ) := E ( K , M ) ⊕ K M K E E 14

Free Reduction From PGV 2 to PGV 1 M M K K 1 2 1 secure ⇒ PGV T E PGV E There exists T s.t. for any E : secure 2 T E ( K , M ) := E ( K , M ) ⊕ K M T K E 14

Free Reduction From PGV 2 to PGV 1 M M K K 1 2 1 secure ⇒ PGV T E PGV E There exists T s.t. for any E : secure 2 T E ( K , M ) := E ( K , M ) ⊕ K M M T T ≡ K K E E 14

PGV Functions [ B FFS13] Fall Into Two Groups 1 4 2 3 separation (direct) 5 8 � 6 7 reducibility (free) 9 12 10 11 15

Groups are Incomparable, No Clear Winner No direct reducibility from #1 to #2 Or vice versa Free reducibility “switches” group But no simultaneous security for both 16

Groups are Incomparable, No Clear Winner � #1 secure E s.t. No direct reducibility from #1 to #2 #2 ??? Or vice versa Free reducibility “switches” group But no simultaneous security for both 16

Groups are Incomparable, No Clear Winner � #1 secure E s.t. No direct reducibility from #1 to #2 #2 ??? Or vice versa T Free reducibility “switches” group � #1 ??? T ( E ) s.t. But no simultaneous security for both #2 secure 16

Groups are Incomparable, No Clear Winner � #1 secure T ( T ( E )) s.t. No direct reducibility from #1 to #2 #2 ??? Or vice versa T Free reducibility “switches” group � #1 ??? T ( E ) s.t. But no simultaneous security for both #2 secure 16

Outline Oracle reducibility A versatile comparison paradigm Ideal-cipher comparisons Blockcipher-based compression functions Random-oracle comparisons [BF11] ElGamal-type encryption schemes 17

Cryptographic Constructions Often Undergo Iterative Improvements Feasibility result Not practical, but it works Practical result Simpler, tighter, faster, . . . Further improvements Milder or fewer assumptions 18

Cryptographic Constructions Often Undergo Iterative Improvements Further improvements Milder or fewer assumptions 18

An “Improved” Construction May be Worse in Other Ways If a 1 holds, then C ′ is secure If a 1 and a 2 hold, then C is ? < secure in � ideal model � . in � ideal model � . 19