FAST DISTRIBUTED RSA KEY GENERATION FOR FAST DISTRIBUTED RSA KEY - PowerPoint PPT Presentation

Making malicious security orders of magnitude more efficient than previous efficient than previous FAST DISTRIBUTED RSA KEY GENERATION FOR FAST DISTRIBUTED RSA KEY GENERATION FOR semi-honest SEMI-HONEST AND MALICIOUS ADVERSARIES Tore Frederiksen 3 , Yehuda Lindell 1,2 , Valery Osheter 2 , Benny Pinkas 1 15 min vs. 41 sec 15 min vs. 41 sec 3: 1: 2:

OUTLINE • Introduction • Semi-honest construction • Malicious construction • Efficiency • Conclusion • Conclusion 06-10-2018 Page 2

INTRODUCTION – PUBLIC KEY ENCRYPTION m m 06-10-2018 Page 3

INTRODUCTION – DISTRIBUTED PKE m 06-10-2018 Page 4

INTRODUCTION – MOTIVATION • Sometimes it can also be used for distributed signature schemes schemes – Which is an end in itself • Relevant for MPC protocols – CDN01, semi-homomorphic PKE – DPSZ12, somewhat-homomorphic PKE – DPSZ12, somewhat-homomorphic PKE • Cloud based key management – – 06-10-2018 Page 5

INTRODUCTION – RSA • 06-10-2018 Page 6

INTRODUCTION – DISTRIBUTED RSA • 06-10-2018 Page 7

INTRODUCTION – DISTRIBUTED RSA • 06-10-2018 Page 8

INTRODUCTION – INTUITION Candidate generation Candidate generation Construct modulus Verify modulus Construct keys 06-10-2018 Page 9

OUTLINE • Introduction • Semi-honest construction • Malicious construction • Efficiency • Conclusion • Conclusion 06-10-2018 Page 10

SEMI-HONEST – CANDIDATE GENERATION • 06-10-2018 Page 11

SEMI-HONEST – CONSTRUCT MODULUS • 06-10-2018 Page 12

SEMI-HONEST – VERIFY MODULUS • Biprimality test [BF01] False positive positive prob ½ Repeat 06-10-2018 Page 14

SEMI-HONEST – CONSTRUCT KEYS • 06-10-2018 Page 16

OUTLINE • Introduction • Semi-honest construction • Malicious construction • Efficiency • Conclusion • Conclusion 06-10-2018 Page 17

MALICIOUS – IDEA • Allow adversary to fail good candidates • Accepted key must be “good” without leakage • Accepted key must be “good” without leakage • Selective failure prevention • Input consistency • Correctness of biprimality • Correctness of biprimality 06-10-2018 Page 18

MALICIOUS – STEPS • Selective failure prevention – Do OT on random, linear encoding – Do OT on random, linear encoding – Use linearity to obtain correct product – Randomness ensures leakage on encoding does not leak on input • Input consistency – Commitments based on AES encryption – Zero-knowledge of correct encryption – Very efficient commit-many-open-few – Very efficient commit-many-open-few • Correctness of biprimality (zero-knowledge) – Almost standard proof-of-knowledge of discrete log – Few “commitments” on top to ensure composability 06-10-2018 Page 19

MALICIOUS – CONSISTENCY • “Commitment” by encrypting using AES • Efficient commit-many-open-few 06-10-2018 Page 21

MALICIOUS – VERIFY MODULUS 06-10-2018 Page 22

MALICIOUS – VERIFY MODULUS Zero-knowledge 06-10-2018 Page 23

OUTLINE • Introduction • Semi-honest construction • Malicious construction • Efficiency • Conclusion • Conclusion 06-10-2018 Page 24

EFFICIENCY – IMPLEMENTATION 2048 RSA • 06-10-2018 Page 26

IMPLEMENTATION – EXPERIMENTS Malicious! • Azure using multi-threaded Xeon machine • Single-thread min 56, max 598, average 182 seconds • 8-thread, average 41 seconds • Best previous 15 minutes for semi-honest [HMR+12] Phase Percentage Candidate generation 10 Construct modulus Construct modulus 55 55 Verify modulus 6 Zero-knowledge 16* Other 13 06-10-2018 Page 27

OUTLINE • Introduction • Semi-honest construction • Malicious construction • Efficiency • Conclusion • Conclusion 06-10-2018 Page 28

CONCLUSION • New protocol for malicious distributed RSA generation – Malicious security almost for free – Malicious security almost for free – No specific number theoretic assumptions – Implementation • New efficient commit-many-open-few protocol • Effective selective failure prevention for multiplication using OT 06-10-2018 Page 29

Thank you for your attention! Tore Frederiksen Cryptography Engineer tore.frederiksen@alexandra.dk Cutting-edge IT research and technology