Everybodys a Target: Scalability in Public-Key Encryption Benedikt - PowerPoint PPT Presentation

Everybody’s a Target: Scalability in Public-Key Encryption Benedikt Auerbach 1 Federico Giacon 2 Eike Kiltz 3 1 IST Austria, Klosterneuburg, Austria 2 Gnosis Service GmbH, Berlin, Germany 3 Horst Görtz Institut für IT-Sicherheit, Ruhr-Universität Bochum, Germany May 04, 2020

Agenda ◮ multi-instance security and the scaling factor ◮ the scaling behavior of Hashed-ElGamal key encapsulation ◮ generic group lower bounds for multi-instance CDH-type problems 2 / 24

Multi-instance security ◮ usual security definition for cryptographic schemes ◮ adversary unable to compromise a single user This work: Scaling of security in the number of users How much more computational effort does it take to compromise n users compared to compromising one? 3 / 24

Multi-instance security ◮ usual security definition for cryptographic schemes ◮ adversary unable to compromise a single user This work: Scaling of security in the number of users How much more computational effort does it take to compromise n users compared to compromising one? 3 / 24

Multi-instance security ◮ usual security definition for cryptographic schemes ◮ adversary unable to compromise a single user ◮ this work: scaling of security in the number of users ◮ how much more computational effort does it take to compromise all of n users compared to compromising one? 3 / 24

Scaling behavior of cryptographic schemes effort x t compromised users 1 4 / 24

Scaling behavior of cryptographic schemes effort best case nt worst case x t n compromised users 1 4 / 24

Scaling behavior of cryptographic schemes effort best case nt actual behavior? worst case x t n compromised users 1 4 / 24

Background ◮ theory: parameters of schemes chosen such that even breaking a single instance is infeasible ◮ in particular impossible to break many instances ◮ practice: use of outdated parameters widespread ◮ breaking of single instance within reach ◮ bad scaling behavior could enable large-scale attack 5 / 24

Logjam attack ◮ bad scaling-behavior exploited in Logjam attack [ADGG+15] ◮ attacked TLS in the finite-field setting for primes of length 512 ◮ effort to break 2 20 instances only doubles compared to breaking one 6 / 24

Logjam attack Scaling behavior of ElGamal for subgroups of F ∗ p , p prime of length 512 effort Logjam attack x t 1 compromised users Effort to break 2 20 instances only doubles compared to breaking one 7 / 24

Our contributions ◮ scaling behavior; theoretical perspective ◮ adapt multi-instance security to key-encapsulation mechanisms ◮ define the scaling factor of schemes ◮ scaling behavior; application to Hashed-ElGamal (HEG) key encapsulation ◮ consider HEG for different parameter settings ◮ compute scaling factor in idealized models 8 / 24

Multi-Instance Security and the Scaling Factor 9 / 24

Reminder: key-encapsulation mechanisms ◮ Key-encapsulation mechanism KEM consists of algorithms $ ← Par par $ ( pk , sk ) ← Gen( par ) $ ( K , C ) ← Enc( par , pk ) K ← Dec( par , sk , C ) 10 / 24

Security notions for KEMs CCA: single-instance setting CCA A $ ← { 0 , 1 } b $ par ← Par $ ( pk , sk ) ← Gen( par ) $ par , pk , K ∗ , C ∗ ( K ∗ , C ∗ ) ← Enc( par , pk ) if b = 0: K ∗ ← $ C Dec( par , sk , C ) win ← [ b = b ′ ] b ′ Advantage: Adv CCA KEM (A) = Pr[ win ] − 1 / 2 11 / 24

Security notions for KEMs n -CCA: multi-instance setting [BelRisTes12] n -CCA A � $ ← { 0 , 1 } n b $ par ← Par for i ∈ { 1 , .. , n } : $ ( pk i , sk i ) ← Gen( par ) par , � pk , � K ∗ , � C ∗ $ ( K ∗ i , C ∗ i ) ← Enc( par , pk i ) if b i = 0: K ∗ i ← $ C , i Dec( par , sk i , C ) win ← [ � n i =1 b i = b ′ ] b ′ Advantage: Adv n -CCA KEM (A) = Pr[ win ] − 1 / 2 11 / 24

Scaling factor ◮ how does the security of a key-encapsulation mechanism (KEM) scale in the number of users? ◮ we define the scaling factor of KEM SF ( n ) = MinTime ( n ) MinTime (1) ◮ MinTime ( n ): running time of fastest adversary breaking n -CCA security users with success probability 1 12 / 24

Scaling factor ◮ how does the security of a key-encapsulation mechanism (KEM) scale in the number of users? ◮ we define the scaling factor of KEM SF ( n ) = MinTime ( n ) MinTime (1) ◮ MinTime ( n ): running time of fastest adversary breaking n -CCA security users with success probability 1 Lemma 1 ≤ SF ( n ) ≤ n 12 / 24

The Scaling Behavior of Hashed-ElGamal 13 / 24

Overview on our results ◮ considered KEM: Hashed-ElGamal ◮ consider variants with different shared parameters (granularity) ◮ elliptic-curve setting ◮ bounds in generic-group model and random-oracle model ◮ G group of prime order p generated by g Granularity par sk pk SF HEG ( n ) Θ( √ n ) g x high ( G , p , g ) x Θ( √ n ) ( g , g x ) medium ( G , p ) ( g , x ) (( G , p , g ) , g x ) low ⊥ (( G , p , g ) , x ) Θ( n ) 14 / 24

Overview on our results ◮ goal: bound SF HEG ( n ) = MinTime ( n ) MinTime (1) 15 / 24

Overview on our results ◮ goal: bound SF HEG ( n ) = MinTime ( n ) MinTime (1) ◮ upper bound ◮ known generic algorithms: � O ( √ np ) high/med. granularity MinTime ( n ) = O ( n √ p ) low granularity ◮ known generic bound: MinTime (1) = Ω( √ p ) 15 / 24

Overview on our results ◮ goal: bound SF HEG ( n ) = MinTime ( n ) MinTime (1) ◮ upper bound ◮ known generic algorithms: � O ( √ np ) high/med. granularity MinTime ( n ) = O ( n √ p ) low granularity ◮ known generic bound: MinTime (1) = Ω( √ p ) ◮ lower bound ◮ known generic algorithm: MinTime (1) = O ( √ p ) ◮ this work: generic-group bounds � Ω( √ np ) high/med. granularity MinTime ( n ) = Ω( n √ p ) low granularity 15 / 24

Generic-group lower bound on MinTime HEG ( n ) Overview GGM = = = = ⇒ n -CCA HEG ROM ∼ random-oracle model n -gapCDH ∼ multi-instance gap Diffie-Hellman problem AGM ∼ algebraic-group model [FKL18] n -gapDL ∼ multi-instance gap discrete-logarithm problem GGM ∼ generic-group model 16 / 24

Generic-group lower bound on MinTime HEG ( n ) Overview GGM ROM = = = = ⇒ n -gapCDH = = = = ⇒ n -CCA HEG ROM ∼ random-oracle model n -gapCDH ∼ multi-instance gap Diffie-Hellman problem AGM ∼ algebraic-group model [FKL18] n -gapDL ∼ multi-instance gap discrete-logarithm problem GGM ∼ generic-group model 16 / 24

Generic-group lower bound on MinTime HEG ( n ) Overview GGM AGM ROM = = = = ⇒ n -gapDL = = = = ⇒ n -gapCDH = = = = ⇒ n -CCA HEG ROM ∼ random-oracle model n -gapCDH ∼ multi-instance gap Diffie-Hellman problem AGM ∼ algebraic-group model [FKL18] n -gapDL ∼ multi-instance gap discrete-logarithm problem GGM ∼ generic-group model 16 / 24

Generic-group lower bound on MinTime HEG ( n ) Overview (AGM) GGM GGM ROM = = = = = = = = ⇒ ⇒ n -gapDL = = = = = ⇒ n -gapCDH = = = = ⇒ n -CCA HEG ROM ∼ random-oracle model n -gapCDH ∼ multi-instance gap Diffie-Hellman problem AGM ∼ algebraic-group model [FKL18] n -gapDL ∼ multi-instance gap discrete-logarithm problem GGM ∼ generic-group model 16 / 24

Generic-Group Lower Bounds for Multi-Instance CDH-Type Problems 17 / 24

Multi-instance CDH-type problems Multi-instance discrete logarithm problem, G = ( G , p , g ) n -DL A for i ∈ { 1 , .. , n } : $ G , � x i ← Z p X X i ← g x i win ← [ ∀ i : z i = x i ] � z Advantage: Adv n -DL (A) = Pr[ win ] 18 / 24

Multi-instance CDH-type problems Multi-instance gap discrete logarithm problem, G = ( G , p , g ) n -gapDL A for i ∈ { 1 , .. , n } : $ G , � x i ← Z p X X i ← g x i X , ˜ ˜ Y , ˜ Z � y = ˜ if g ˜ x ˜ 1 Z d ← d 0 else win ← [ ∀ i : z i = x i ] � z Advantage: Adv n -gapDL (A) = Pr[ win ] 18 / 24

Multi-instance CDH-type problems Multi-instance gap computational Diffie-Hellman problem, G = ( G , p , g ) n -gapCDH A for i ∈ { 1 , .. , n } : $ $ G , � X , � x i ← Z p ; y i ← Z p Y X i ← g x i ; Y i ← g y i X , ˜ ˜ Y , ˜ Z � y = ˜ if g ˜ x ˜ 1 Z d ← d 0 else win ← [ ∀ i : Z i = g x i y i ] � Z Advantage: Adv n -gapCDH (A) = Pr[ win ] 18 / 24

Multi-instance generic-group lower bounds Overview problem granularity MinTime Ω( √ np ) n -DL high [Yun15] Ω( √ np ) n -DL low [GDJY13] Generic-group bounds for multi-instance Diffie-Hellman-type problems ◮ G of prime order p ◮ n instances 19 / 24

Multi-instance generic-group lower bounds Overview problem granularity MinTime Ω( √ np ) n -DL high [Yun15] Ω( √ np ) n -DL low [GDJY13] this work Ω( √ np ) n -gapDL high/med. Ω( √ np ) n -gapCDH high/med. Ω( n √ p ) n -gapDL low Ω( n √ p ) n -gapCDH low Generic-group bounds for multi-instance Diffie-Hellman-type problems ◮ G of prime order p ◮ n instances 19 / 24

Multi-instance generic-group lower bounds Overview problem granularity MinTime Ω( √ np ) n -DL high [Yun15] Ω( √ np ) n -DL low [GDJY13] this work Ω( √ np ) n -gapDL high/med. Ω( √ np ) n -gapCDH high/med. Ω( n √ p ) n -gapDL low Ω( n √ p ) n -gapCDH low � n -polyDL d high Ω( np / d ) Generic-group bounds for multi-instance Diffie-Hellman-type problems ◮ G of prime order p ◮ n instances 19 / 24