Fast and Secure Updatable Encryption August 10, 2020 1 Norwegian - PowerPoint PPT Presentation

Fast and Secure Updatable Encryption August 10, 2020 1 Norwegian University of Science and Technology (NTNU), Norway 2 Bergische Universität Wuppertal, Germany 1 Colin Boyd 1 Gareth T. Davies 2 Kristian Gjøsteen 1 Yao Jiang 1

Table of contents 1. Updatable Encryption 2. Security Properties 3. Relations 4. UE Constructions 5. Summary 2

Updatable Encryption

Problem Motivation: Outsourcing k 0 C 0 Enc k 0 ( m ) = C 0 3

Problem Motivation: Outsourcing k 0 C 0 Dec k 0 ( C 0 ) = m 0 • Threats: Key compromise 3

Problem Motivation: Outsourcing k 0 k 1 C 0 C 1 • Threats: Key compromise • Solution: Key rotation 3

Key Rotation: a standard approach k 0 k 1 C 0 4

Key Rotation: a standard approach k 0 k 1 m = Dec k 0 ( C 0 ) 4

Key Rotation: a standard approach k 0 k 0 k 1 Enc k 1 ( m ) = C 1 4

Key Rotation: a standard approach k 0 k 0 k 1 C 1 C 1 • Download and re-upload is infeasible even for moderate storage requirements 4

Key Rotation: Updatable Encryption (UE) ∆ 1 C 0 ∆ 1 C 1 k 0 k 1 • Key Homomorphic PRFs and their Applications Boneh, Lewi, Montgomery, Raghunathan; CRYPTO ’13 (+ ePrint 2015/220) 5

Key Rotation: Updatable Encryption (UE) ∆ 1 C 0 ∆ 1 C 1 k 0 k 1 • Client only ever needs to store one key • fresh encryptions, updated ciphertexts and tokens should all reveal nothing about plaintext • Key Homomorphic PRFs and their Applications Boneh, Lewi, Montgomery, Raghunathan; CRYPTO ’13 (+ ePrint 2015/220) 5

What Is Realistic? • Security properties: confjdentiality and integrity • What an attacker can possibly do? • What is the right security notion for UE? • Users do encryption, then server(s) update ciphertexts for millions of users • Encryption and update must be effjcient 6 Lehmann, Tackmann; Eurocrypt ’18 • Updatable Encryption with Post-Compromise Security

Security Properties

Epoch-based Corruptions C 3 k 5 k 6 k 7 … k n C 0 C 1 C 2 C 4 k 3 C 5 C 6 C n 7 • Directly obtained information: • Adversary adaptively corrupts keys and tokens • Adversary can asks for ciphertexts • Inferred information (Assume bi-directionality): 0 k 4 k 2 n 1 2 3 4 5 6 7 k 1 … … k 0 • Adversary can use this information to trivially win a security game! ∆ 1 ∆ 2 ∆ 3 ∆ 4 ∆ 5 ∆ 6 ∆ 7 C 7 … • C i + 1 and ∆ i + 1 is enough to compute C i • k i + 1 and ∆ i + 1 is enough to compute k i • k i and k i + 1 is enough to compute ∆ i + 1

Confidentiality: a motivating example k 0 C 0 Enc k 0 ( Contact A ) = C 0 8

Confidentiality: a motivating example ∆ 1 k 1 k 0 ∆ 1 C ′ C 0 0 ∆ 1 8

Confidentiality: a motivating example k 1 C ′ C 0 ∆ 1 0 8

Confidentiality: a motivating example k 1 C ′ C ′ C 1 C 1 Enc k 1 ( Contact B ) = C 1 0 0 • Which ciphertext is the newest? • How many ciphertexts are recently added? 8

Prior notions: Indistinguishability of Encryptions ( IND - ENC ) C e C m C e C e m C b 9 e C C e • Challenger checks for trivial wins Lehmann, Tackmann; Eurocrypt ’18 • Updatable Encryption with Post-Compromise Security O . Enc O . Dec m 0 , m 1 O . Next e → e + 1 A IND - ENC $ ( e , key / token ) ← − { 0 , 1 } ˜ O . Corr C ˜ ˜ e ← Enc ( m b ) k e / ∆ e C ˜ O . Upd b ′ ˜ O . Upd ˜ ˜ Only in CCA games does an adversary have access to O . Dec

Prior notions: Indistinguishability of Updates ( IND - UPD ) C e C m C e C e m C b 10 e C C e • Challenger checks for trivial wins Lehmann, Tackmann; Eurocrypt ’18 • Updatable Encryption with Post-Compromise Security O . Enc O . Dec C 0 , C 1 O . Next e → e + 1 A IND - UPD $ ( e , key / token ) ← − { 0 , 1 } ˜ O . Corr C ˜ ˜ e ← Upd ( C b ) k e / ∆ e C ˜ O . Upd b ′ ˜ O . Upd ˜ ˜ Only in CCA games does an adversary have access to O . Dec

What else do we want to achieve? 11 • None of the prior notions capture our journalist motivating example. • Can we fjnd a notion captures a ciphertext freshly created is indistinguishable from an updated ciphertext?

A New Notion for Updatable Encryption ( IND - UE ) C e 12 C m C e C e m C C C e b e • Challenger checks for trivial wins Scheme that leaks epoch number of original upload can be e - 1 IND - ENC and IND - UPD but not IND - UE O . Enc O . Dec m , C ˜ O . Next e → e + 1 $ A IND - UE ← − { 0 , 1 } ( e , key / token ) ˜ O . Corr if b = 0 : ˜ e ← Enc ( m ) C ˜ C ˜ k e / ∆ e if b = 1 : ˜ e ← Upd ( C ˜ e − 1 ) C ˜ O . Upd b ′ ˜ O . Upd ˜ ˜ Only in CCA games does an adversary have access to O . Dec IND-ENC + IND-UPD ⇏ IND-UE

Ciphertext integrity 13 C e C C e m Klooß, Lehmann and Rupp; Eurocrypt ’19 e O . Enc ˜ C ˜ O . Next e → e + 1 m ′ ← Dec (˜ A INT - CTXT e ) C ˜ ( e , key / token ) if m ′ ̸ = ⊥ : A wins O . Corr k e / ∆ e if m ′ = ⊥ : A loses O . Upd • Challenger checks for trivial wins ∗ • CPA + CTXT = ⇒ CCA? • (R)CCA secure updatable encryption with integrity protection

Relations

Relations among IND - ENC , IND - UPD and IND - UE 14 +detIND-UPD-CCA IND-ENC-CCA detIND-UPD-CCA IND-ENC-CPA detIND-UE-CCA +detIND-UPD-CPA IND-ENC-CPA detIND-UPD-CPA IND-ENC-CPA detIND-UE-CPA +randIND-UPD-CPA IND-ENC-CPA randIND-UE-CPA \ \ \ IND-ENC-CPA randIND-UPD-CPA \

Relations among CPA, CTXT and CCA 15 CPA + CTXT = ⇒ CCA for UE IND-ENC-CPA + INT-CTXT = ⇒ IND-ENC-CCA det IND-UPD-CPA + INT-CTXT = ⇒ det IND-UPD-CCA det IND-UE-CPA + INT-CTXT = ⇒ det IND-UE-CCA

UE Constructions

Secure Homomorphic Ideal-cipher Nonce-based Encryption ( SHINE ) SHINE . Enc : SHINE . Dec : N || m N || m π π − 1 Exp k 1 Exp 1 / k 1 C C C = π (N || m ) k 1 N || m = π − 1 ( C 1 / k 1 ) 16

Secure Homomorphic Ideal-cipher Nonce-based Encryption ( SHINE ) N || m N || m π π − 1 Exp k 1 ∆ 2 = k 2 / k 1 Exp 1 / k 2 Exp ∆ 2 SHINE . Upd : C 1 C 2 C 1 = π (N || m ) k 1 C 2 = π (N || m ) k 2 16

OK, but is it secure? 17 • How can we embed the challenge, with deterministic updates and adaptive security? • Partition epoch set into air-gapped segments (‘fjrewalls’) Lehmann, Tackmann; Eurocrypt ’18 • (R)CCA secure updatable encryption with integrity protection Klooß, Lehmann and Rupp; Eurocrypt ’19 • Updatable Encryption with Post-Compromise Security

Firewalls: cryptographic separation C 5 k 7 … k n C 0 C 1 C 2 C 3 C 4 C 6 k 5 C n 18 k 5 k 6 k 2 • Firewalls (insulated region) defjnition: • No key inside fjrewalls is corrupted • Tokens ‘on’ the fjrewalls are not corrupted • All tokens inside fjrewalls are corrupted 0 k 6 k 4 k 3 1 2 3 4 5 6 7 … n • Separate keys, tokens and ciphertexts using fjrewalls … k 0 k 1 k 2 ∆ 4 ∆ 1 ∆ 2 ∆ 3 ∆ 4 ∆ 5 ∆ 6 ∆ 7 ∆ 3 ∆ 5 C 7 …

OK, but is it secure? 19 • How can we embed the challenge, with deterministic updates and adaptive security? • Partition epoch set into air-gapped segments (‘fjrewalls’) • Hybrid argument across insulated regions • Embed the challenge in the i -th insulated region. Lehmann, Tackmann; Eurocrypt ’18 • (R)CCA secure updatable encryption with integrity protection Klooß, Lehmann and Rupp; Eurocrypt ’19 • Updatable Encryption with Post-Compromise Security

Hybrid argument across insulated regions 1st 0 1 2 2nd 3 4 3rd 5 6 7 . . . n N th ∆ 1 ∆ 1 ∆ 2 ∆ 3 ∆ 4 ∆ 5 ∆ 5 ∆ 6 ∆ 7 ∆ 7 . . . k 0 k 1 k 2 k 3 k 4 k 5 k 6 k 7 . . . k N k 2 k 6 k 7 C 0 C 1 C 2 tw C 3 C 4 C 5 C 6 tw C 7 . . . C N tw L L L L L L • Game 0 20

Hybrid argument across insulated regions 1st 0 1 2 2nd 3 4 3rd 5 6 7 . . . n N th ∆ 1 ∆ 1 ∆ 2 ∆ 3 ∆ 4 ∆ 5 ∆ 5 ∆ 6 ∆ 7 ∆ 7 . . . k 0 k 1 k 2 k 3 k 4 k 5 k 6 k 7 . . . k N k 2 k 6 k 7 C 0 C 1 C 2 tw C 3 C 4 C 5 C 6 tw C 7 . . . C N tw R R L L L L • Game 1 20

Hybrid argument across insulated regions 1st 0 1 2 2nd 3 4 3rd 5 6 7 . . . n N th ∆ 1 ∆ 1 ∆ 2 ∆ 3 ∆ 4 ∆ 5 ∆ 5 ∆ 6 ∆ 7 ∆ 7 . . . k 0 k 1 k 2 k 3 k 4 k 5 k 6 k 7 . . . k N k 2 k 6 k 7 C 0 C 1 C 2 tw C 3 C 4 C 5 C 6 tw C 7 . . . C N tw R R R L L L • Game 2 20

Hybrid argument across insulated regions 1st 0 1 2 2nd 3 4 3rd 5 6 7 . . . n N th ∆ 1 ∆ 1 ∆ 2 ∆ 3 ∆ 4 ∆ 5 ∆ 5 ∆ 6 ∆ 7 ∆ 7 . . . k 0 k 1 k 2 k 3 k 4 k 5 k 6 k 7 . . . k N k 2 k 6 k 7 C 0 C 1 C 2 tw C 3 C 4 C 5 C 6 tw C 7 . . . C N tw R R R R R L • Game 3 20

Hybrid argument across insulated regions 1st 0 1 2 2nd 3 4 3rd 5 6 7 . . . n N th ∆ 1 ∆ 1 ∆ 2 ∆ 3 ∆ 4 ∆ 5 ∆ 5 ∆ 6 ∆ 7 ∆ 7 . . . k 0 k 1 k 2 k 3 k 4 k 5 k 6 k 7 . . . k N k 2 k 6 k 7 C 0 C 1 C 2 tw C 3 C 4 C 5 C 6 tw C 7 . . . C N tw R R R R R R • Game N 20

OK, but is it secure? 21 Assuming DDH, and in the ideal cipher model SHINE is det IND - UE - CPA Secure

SHINE0 SHINE0 . Enc : SHINE0 . Dec : N || m || 0 t N ′ || m ′ || Z = 0 t ? π π − 1 Exp k 1 Exp 1 / k 1 C C 22

OK, but is it secure? 23 Assuming DDH, and in the ideal cipher model SHINE is INT - CTXT Secure Assuming CDH, and in the ideal cipher model Assuming DDH and CDH, and in the ideal cipher model SHINE is det IND - UE - CPA Secure SHINE is det IND - UE - CCA Secure