Generic Construction of UC-Secure Oblivious Transfer O. Blazy , - PowerPoint PPT Presentation

Generic Construction of UC-Secure Oblivious Transfer O. Blazy , C.Chevalier O. Blazy (Xlim) Generic OT 1 / 20

Global Framework 1 Cryptographic Tools 2 1-out-of- t Oblivious Transfer 3 Instantiation 4 Conclusion 5 O. Blazy (Xlim) Generic OT 2 / 20

Global Framework 1 Cryptographic Tools 2 1-out-of- t Oblivious Transfer 3 Instantiation 4 Conclusion 5 O. Blazy (Xlim) Generic OT 2 / 20

Global Framework 1 Cryptographic Tools 2 1-out-of- t Oblivious Transfer 3 Instantiation 4 Conclusion 5 O. Blazy (Xlim) Generic OT 2 / 20

Global Framework 1 Cryptographic Tools 2 1-out-of- t Oblivious Transfer 3 Instantiation 4 Conclusion 5 O. Blazy (Xlim) Generic OT 2 / 20

Global Framework 1 Cryptographic Tools 2 1-out-of- t Oblivious Transfer 3 Instantiation 4 Conclusion 5 O. Blazy (Xlim) Generic OT 2 / 20

Global Framework 1 Motivation Cryptographic Tools 2 1-out-of- t Oblivious Transfer 3 Instantiation 4 Conclusion 5 O. Blazy (Xlim) Generic OT 3 / 20

Conditional Actions Oblivious Transfer Database User C ( line ) ← − − − − − − − − − − − − − − − DB [ line ] − − − − − − − − − − − − − − − → � The User learns the value of line but nothing else. � The Database learns nothing. O. Blazy (Xlim) Generic OT 4 / 20

Semantic security Only the requested line should be learned by the User O. Blazy (Xlim) Generic OT 5 / 20

Semantic security Only the requested line should be learned by the User Oblivious The authority should not learn which line was requested O. Blazy (Xlim) Generic OT 5 / 20

Global Framework 1 Cryptographic Tools 2 Encryption Scheme Chameleon Hash Scheme Smooth Projective Hash Function 1-out-of- t Oblivious Transfer 3 Instantiation 4 Conclusion 5 O. Blazy (Xlim) Generic OT 6 / 20

Definition (Encryption Scheme) E = ( Setup , KeyGen , Encrypt , Decrypt ) : Setup ( K ) : param; KeyGen ( param ) : public encryption key pk, private decryption key dk; Encrypt ( pk , m ; r ) : ciphertext c on m ∈ M and pk; Decrypt ( dk , c ) : decrypts c under dk. Indistinguishability under Chosen Ciphertext Attack O. Blazy (Xlim) Generic OT 7 / 20

Definition (Chameleon Hash Scheme) CH = ( Setup , KeyGen , CH , Coll ) : Setup ( K ) : param; KeyGen ( param ) : outputs the chameleon hash key ck and the trapdoor tk; CH ( ck , m ; r ) : Picks r , and outputs the hash a ; Coll ( ck , m , r , m ′ , tk ) : Takes tk, ( m , r ) and m ′ , and outputs r ′ such that CH ( ck , m ; r ) = CH ( ck , m ′ ; r ′ ) . Extra Procedures (Verification) VKeyGen ( ck ) : Outputs vk and vtk. ⊥ or public if publicly verifiable. Valid ( ck , vk , m , a , d , vtk ) : Allows to check that d opens a to m . Collision Resistance ∗ O. Blazy (Xlim) Generic OT 8 / 20

Definition (Chameleon Hash Scheme) CH = ( Setup , KeyGen , CH , Coll ) : Setup ( K ) : param; KeyGen ( param ) : outputs the chameleon hash key ck and the trapdoor tk; CH ( ck , m ; r ) : Picks r , and outputs the hash a and verification value d ; Coll ( ck , m , r , m ′ , tk ) : Takes tk, ( m , r ) and m ′ , and outputs r ′ such that CH ( ck , m ; r ) = CH ( ck , m ′ ; r ′ ) . Extra Procedures (Verification) VKeyGen ( ck ) : Outputs vk and vtk. ⊥ or public if publicly verifiable. Valid ( ck , vk , m , a , d , vtk ) : Allows to check that d opens a to m . Collision Resistance ∗ O. Blazy (Xlim) Generic OT 8 / 20

Definition (Smooth Projective Hash Functions) [CS02] Let { H } be a family of functions: X , domain of these functions L , subset (a language) of this domain such that, for any point x in L , H ( x ) can be computed by using either a secret hashing key hk: H ( x ) = Hash L ( hk ; x ) ; or a public projected key hp: H ′ ( x ) = ProjHash L ( hp ; x , w ) Public mapping hk �→ hp = ProjKG L ( hk , x ) O. Blazy (Xlim) Generic OT 9 / 20

Properties For any x ∈ X , H ( x ) = Hash L ( hk ; x ) For any x ∈ L , H ( x ) = ProjHash L ( hp ; x , w ) w witness that x ∈ L Smoothness For any x �∈ L , H ( x ) and hp are independent Pseudo-Randomness For any x ∈ L , H ( x ) is pseudo-random, without a witness w O. Blazy (Xlim) Generic OT 10 / 20

Properties For any x ∈ X , H ( x ) = Hash L ( hk ; x ) For any x ∈ L , H ( x ) = ProjHash L ( hp ; x , w ) w witness that x ∈ L Smoothness For any x �∈ L , H ( x ) and hp are independent Pseudo-Randomness For any x ∈ L , H ( x ) is pseudo-random, without a witness w O. Blazy (Xlim) Generic OT 10 / 20

Properties For any x ∈ X , H ( x ) = Hash L ( hk ; x ) For any x ∈ L , H ( x ) = ProjHash L ( hp ; x , w ) w witness that x ∈ L Smoothness For any x �∈ L , H ( x ) and hp are independent Pseudo-Randomness For any x ∈ L , H ( x ) is pseudo-random, without a witness w O. Blazy (Xlim) Generic OT 10 / 20

Global Framework 1 Cryptographic Tools 2 1-out-of- t Oblivious Transfer 3 Definition Our Generic Construction Security Instantiation 4 Conclusion 5 O. Blazy (Xlim) Generic OT 11 / 20

Oblivious Transfer [Rab81] A user U wants to access a line ℓ in a database D composed of t of them: U learns nothing more than the value of the line ℓ D does not learn which line was accessed by U Correctness: if U request a single line, he learns it Security Notions Oblivious: D does not know learn which line was accessed ; Semantic Security: U does not learn any information about the other lines. O. Blazy (Xlim) Generic OT 12 / 20

Oblivious Transfer [Rab81] A user U wants to access a line ℓ in a database D composed of t of them: U learns nothing more than the value of the line ℓ D does not learn which line was accessed by U Correctness: if U request a single line, he learns it Security Notions Oblivious: D does not know learn which line was accessed ; Semantic Security: U does not learn any information about the other lines. O. Blazy (Xlim) Generic OT 12 / 20

Oblivious Transfer [Rab81] A user U wants to access a line ℓ in a database D composed of t of them: U learns nothing more than the value of the line ℓ D does not learn which line was accessed by U Correctness: if U request a single line, he learns it Security Notions Oblivious: D does not know learn which line was accessed ; Semantic Security: U does not learn any information about the other lines. O. Blazy (Xlim) Generic OT 12 / 20

Generic bit UC Commitment User picks a bit b , random r , d 1 − b ,� s , and computes ( a , d b ) = CH ( ck , b ; r ) He then computes C = Encrypt ( d 0 , d 1 ; � s ) . SPHF Compatibility If the encryption is SPHF friendly, then one can build an SPHF on the language of valid encryption of a chameleon information. L b = { c |∃ d 1 − b , s , Valid ( ck , vk , b , a , d b , vtk ) ∧ c = Encrypt ( d 0 , d 1 ; s ) } O. Blazy (Xlim) Generic OT 13 / 20

Generic bit UC Commitment User picks a bit b , random r , d 1 − b ,� s , and computes ( a , d b ) = CH ( ck , b ; r ) He then computes C = Encrypt ( d 0 , d 1 ; � s ) . SPHF Compatibility If the encryption is SPHF friendly, then one can build an SPHF on the language of valid encryption of a chameleon information. L b = { c |∃ d 1 − b , s , Valid ( ck , vk , b , a , d b , vtk ) ∧ c = Encrypt ( d 0 , d 1 ; s ) } O. Blazy (Xlim) Generic OT 13 / 20

Generic bit UC Commitment User picks a bit b , random r , d 1 − b ,� s , and computes ( a , d b ) = CH ( ck , b ; r ) He then computes C = Encrypt ( d 0 , d 1 ; � s ) . SPHF Compatibility If the encryption is SPHF friendly, then one can build an SPHF on the language of valid encryption of a chameleon information. L b = { c |∃ d 1 − b , s , Valid ( ck , vk , b , a , d b , vtk ) ∧ c = Encrypt ( d 0 , d 1 ; s ) } O. Blazy (Xlim) Generic OT 13 / 20

Generic bit UC Commitment User picks a bit b , random r , d 1 − b ,� s , and computes ( a , d b ) = CH ( ck , b ; r ) He then computes C = Encrypt ( d 0 , d 1 ; � s ) . SPHF Compatibility If the encryption is SPHF friendly, then one can build an SPHF on the language of valid encryption of a chameleon information. L b = { c |∃ d 1 − b , s , Valid ( ck , vk , b , a , d b , vtk ) ∧ c = Encrypt ( d 0 , d 1 ; s ) } O. Blazy (Xlim) Generic OT 13 / 20

Generic 1-out-of- t Oblivious Transfer User U picks ℓ : For each bit, picks random r i , d 1 − ℓ i , i , and computes ( a i , d ℓ i , i ) = CH ( ck , ℓ i ; r i ) He then computes C = Encrypt ( � d ; � s ) and sends C , � a . For each line L j , server S computes hk j , hp j , and H j = Hash L j ( hk j , C ) , M j = H j ⊕ L j and sends M j , hp j . For the line ℓ , user computes H ′ ℓ = ProjHash L ℓ ( hp ℓ , C ,� s ℓ ) , and then L ℓ = M ℓ ⊕ H ′ ℓ O. Blazy (Xlim) Generic OT 14 / 20

Generic 1-out-of- t Oblivious Transfer User U picks ℓ : For each bit, picks random r i , d 1 − ℓ i , i , and computes ( a i , d ℓ i , i ) = CH ( ck , ℓ i ; r i ) He then computes C = Encrypt ( � d ; � s ) and sends C , � a . For each line L j , server S computes hk j , hp j , and H j = Hash L j ( hk j , C ) , M j = H j ⊕ L j and sends M j , hp j . For the line ℓ , user computes H ′ ℓ = ProjHash L ℓ ( hp ℓ , C ,� s ℓ ) , and then L ℓ = M ℓ ⊕ H ′ ℓ O. Blazy (Xlim) Generic OT 14 / 20