Making malicious security orders of magnitude more efficient than previous efficient than previous FAST DISTRIBUTED RSA KEY GENERATION FOR FAST DISTRIBUTED RSA KEY GENERATION FOR semi-honest SEMI-HONEST AND MALICIOUS ADVERSARIES Tore Frederiksen 3 , Yehuda Lindell 1,2 , Valery Osheter 2 , Benny Pinkas 1 15 min vs. 41 sec 15 min vs. 41 sec 3: 1: 2:
OUTLINE • Introduction • Semi-honest construction • Malicious construction • Efficiency • Conclusion • Conclusion 06-10-2018 Page 2
INTRODUCTION – PUBLIC KEY ENCRYPTION m m 06-10-2018 Page 3
INTRODUCTION – DISTRIBUTED PKE m 06-10-2018 Page 4
INTRODUCTION – MOTIVATION • Sometimes it can also be used for distributed signature schemes schemes – Which is an end in itself • Relevant for MPC protocols – CDN01, semi-homomorphic PKE – DPSZ12, somewhat-homomorphic PKE – DPSZ12, somewhat-homomorphic PKE • Cloud based key management – – 06-10-2018 Page 5
INTRODUCTION – RSA • 06-10-2018 Page 6
INTRODUCTION – DISTRIBUTED RSA • 06-10-2018 Page 7
INTRODUCTION – DISTRIBUTED RSA • 06-10-2018 Page 8
INTRODUCTION – INTUITION Candidate generation Candidate generation Construct modulus Verify modulus Construct keys 06-10-2018 Page 9
OUTLINE • Introduction • Semi-honest construction • Malicious construction • Efficiency • Conclusion • Conclusion 06-10-2018 Page 10
SEMI-HONEST – CANDIDATE GENERATION • 06-10-2018 Page 11
SEMI-HONEST – CONSTRUCT MODULUS • 06-10-2018 Page 12
SEMI-HONEST – VERIFY MODULUS • Biprimality test [BF01] False positive positive prob ½ Repeat 06-10-2018 Page 14
SEMI-HONEST – CONSTRUCT KEYS • 06-10-2018 Page 16
OUTLINE • Introduction • Semi-honest construction • Malicious construction • Efficiency • Conclusion • Conclusion 06-10-2018 Page 17
MALICIOUS – IDEA • Allow adversary to fail good candidates • Accepted key must be “good” without leakage • Accepted key must be “good” without leakage • Selective failure prevention • Input consistency • Correctness of biprimality • Correctness of biprimality 06-10-2018 Page 18
MALICIOUS – STEPS • Selective failure prevention – Do OT on random, linear encoding – Do OT on random, linear encoding – Use linearity to obtain correct product – Randomness ensures leakage on encoding does not leak on input • Input consistency – Commitments based on AES encryption – Zero-knowledge of correct encryption – Very efficient commit-many-open-few – Very efficient commit-many-open-few • Correctness of biprimality (zero-knowledge) – Almost standard proof-of-knowledge of discrete log – Few “commitments” on top to ensure composability 06-10-2018 Page 19
MALICIOUS – CONSISTENCY • “Commitment” by encrypting using AES • Efficient commit-many-open-few 06-10-2018 Page 21
MALICIOUS – VERIFY MODULUS 06-10-2018 Page 22
MALICIOUS – VERIFY MODULUS Zero-knowledge 06-10-2018 Page 23
OUTLINE • Introduction • Semi-honest construction • Malicious construction • Efficiency • Conclusion • Conclusion 06-10-2018 Page 24
EFFICIENCY – IMPLEMENTATION 2048 RSA • 06-10-2018 Page 26
IMPLEMENTATION – EXPERIMENTS Malicious! • Azure using multi-threaded Xeon machine • Single-thread min 56, max 598, average 182 seconds • 8-thread, average 41 seconds • Best previous 15 minutes for semi-honest [HMR+12] Phase Percentage Candidate generation 10 Construct modulus Construct modulus 55 55 Verify modulus 6 Zero-knowledge 16* Other 13 06-10-2018 Page 27
OUTLINE • Introduction • Semi-honest construction • Malicious construction • Efficiency • Conclusion • Conclusion 06-10-2018 Page 28
CONCLUSION • New protocol for malicious distributed RSA generation – Malicious security almost for free – Malicious security almost for free – No specific number theoretic assumptions – Implementation • New efficient commit-many-open-few protocol • Effective selective failure prevention for multiplication using OT 06-10-2018 Page 29
Thank you for your attention! Tore Frederiksen Cryptography Engineer tore.frederiksen@alexandra.dk Cutting-edge IT research and technology
Recommend
More recommend
