Group Action Systems Group Action Systems : : a Mathematical tool for deriving a Mathematical tool for deriving Provable Secure Cryptographic Schemes Provable Secure Cryptographic Schemes María Isabel González Vasco Universidad Rey Juan Carlos
Group Action Systems Group Action Systems : : a Mathematical tool for deriving a Mathematical tool for deriving Provable Secure Cryptographic Schemes Provable Secure Cryptographic Schemes Joint Joint works orks with with J. L. Villar (UPC) and J. L. Villar (UPC) and R. Steinwandt . Steinwandt (FAU) (FAU)
Overview Overview � Introduction M.I. González-Vasco, Bochum 05
Overview Overview � Introduction � Some basics about PHFs � Definitions � Basic Results � Cryptographic Applications M.I. González-Vasco, Bochum 05
Overview Overview � Introduction � Some basics about PHFs � Definitions � Basic Results � Cryptographic Applications � Group Action Based PHFs � Group Action Systems � Useful AcPHFs. Diversity. M.I. González-Vasco, Bochum 05
Overview Overview � Introduction � Some basics about PHFs � Definitions � Basic Results � Cryptographic Applications � Group Action Based PHFs � Group Action Systems � Useful AcPHFs. Diversity . � Examples M.I. González-Vasco, Bochum 05
Overview Overview � Introduction � Some basics about PHFs � Definitions � Basic Results � Cryptographic Applications � Group Action Based PHFs � Group Action Systems � Useful AcPHFs. Diversity � Examples � Final Remarks M.I. González-Vasco, Bochum 05
Introduction Introduction � Motivation: finding new suitable mathematical primitives for cryptographic designs. M.I. González-Vasco, Bochum 05
Introduction Introduction � Motivation: finding new suitable mathematical primitives for cryptographic designs. � Fact: work in that direction hardly exploits the constructions and theoretical frameworks available from number-theoretical cryptography. M.I. González-Vasco, Bochum 05
Introduction Introduction � Motivation: finding new suitable mathematical primitives for cryptographic designs. � Fact: work in that direction hardly exploits the constructions and theoretical frameworks available from number-theoretical cryptography. � Our Goal: adapt the existing theory of Universal Projective Hash Functions to allow constructions arising in different areas of mathematics . M.I. González-Vasco, Bochum 05
Some Some basics basics about bout PHFs PHFs
Definitions Definitions Let X, Π , S be non-empty sets, L ⊆ X, and K a finite index set. Consider H:={ H k : X a Π } k ∈ K and α : K a S. Some Basics About PHFs M.I. González-Vasco, Bochum 05
Definitions Definitions Let X, Π , S be non-empty sets, L ⊆ X, and K a finite index set. Consider H:={ H k : X a Π } k ∈ K and α : K a S. Then the tuple H = (H, K, X, L, Π , S, α ) is a projective hash family - PHF - for (X, L) provided that α (k) ≈ H k|L () (i.e., ∀ x ∈ L, k 1 , k 2 ∈ K, α (k 1 ) = α (k 2 ) ⇒ H k1 (x) = H k2 (x) ). Some Basics About PHFs M.I. González-Vasco, Bochum 05
projection α (k)… Given only Given nly the he projection (k)… Π X H k (x*) X* L H k (x) x α (k) Some Basics About PHFs M.I. González-Vasco, Bochum 05
…it could …it ould be hard be hard to to compute H compute H k outside outside L Π X H k (x*) X* L H k (x) x Some Basics About PHFs M.I. González-Vasco, Bochum 05
Definitions Definitions Moreover, we say that H = (H, K, X, L , Π , S, α ) is � ε -universal : ⇔ ∀ s ∈ S, x ∈ X\L, π ∈ Π P[H k (x) = π / α (k)=s ] ≤ ε ; Some Basics About PHFs M.I. González-Vasco, Bochum 05
Definitions Definitions Moreover, we say that H = (H, K, X, L , Π , S, α ) is � ε -universal : ⇔ ∀ s ∈ S, x ∈ X\L, π ∈ Π P[H k (x) = π / α (k)=s ] ≤ ε ; � ε -universal 2 : ⇔ ∀ s ∈ S, x ∈ X\L, x* ∈ X\(LU{x}), π , π * ∈ Π P[H k (x) = π / H k (x*) = π *, α (k)=s ] ≤ ε ; Some Basics About PHFs M.I. González-Vasco, Bochum 05
Definitions Definitions Moreover, we say that H = (H, K, X, L , Π , S, α ) is � ε -universal : ⇔ ∀ s ∈ S, x ∈ X\L, π ∈ Π P[H k (x) = π / α (k)=s ] ≤ ε ; ε -universal 2 : ⇔ ∀ s ∈ S, x ∈ X\L, x* ∈ X\(LU{x}), π , π * ∈ Π � P[H k (x) = π / H k (x*) = π *, α (k)=s ] ≤ ε ; � ε - smooth : ⇔ (x, α (k), H k (x)) and (x, α (k), π ) are ε -close for k ∈ K, x ∈ X\L and π ∈ Π chosen uniformly at random ; Some Basics About PHFs M.I. González-Vasco, Bochum 05
Definitions Definitions Moreover, we say that H = (H, K, X, L , Π , S, α ) is � ε -universal : ⇔ ∀ s ∈ S, x ∈ X\L, π ∈ Π P[H k (x) = π / α (k)=s ] ≤ ε ; ε -universal 2 : ⇔ ∀ s ∈ S, x ∈ X\L, x* ∈ X\(LU{x}), π , π * ∈ Π � P[H k (x) = π / H k (x*) = π *, α (k)=s ] ≤ ε ; � ε - smooth : ⇔ (x, α (k), H k (x)) and (x, α (k), π ) are ε -close for k ∈ K, x ∈ X\L and π ∈ Π chosen uniformly at random; � Strongly universal 2 ≈ worst case smoothness. Some Basics About PHFs M.I. González-Vasco, Bochum 05
Basic Results Basic Results � Ways of “upgrading” the weaker types of PHFs to achieve more robust types: � Universal to universal 2 - Cramer and Shoup, [EUROCRYPT 2002] � Universal to smooth - Cramer and Shoup, [EUROCRYPT 2002] � Universal 2 to strongly universal 2 Some Basics About PHFs M.I. González-Vasco, Bochum 05
Basic Results Basic Results � Ways of “upgrading” the weaker types of PHFs to achieve more robust types : � Universal to universal 2 - Cramer and Shoup, [EUROCRYPT 2002] � Universal to smooth - Cramer and Shoup, [EUROCRYPT 2002] � Universal 2 to strongly universal 2 � Methods for constructing cryptographically useful PHFs Some Basics About PHFs M.I. González-Vasco, Bochum 05
Cryptographic Cryptographic Applications pplications � Cramer and Shoup [EUROCRYPT 2002] IND-CCA Encryption Scheme in the standard model � Some Basics About PHFs M.I. González-Vasco, Bochum 05
Cryptographic Cryptographic Applications pplications � Cramer and Shoup [EUROCRYPT 2002] IND-CCA Encryption Scheme in the standard model � � Kurosawa and Desmedt [CRYPO 2004] � Hybrid encryption scheme Some Basics About PHFs M.I. González-Vasco, Bochum 05
Cryptographic Cryptographic Applications pplications � Cramer and Shoup [EUROCRYPT 2002] IND-CCA Encryption Scheme in the standard model � � Kurosawa and Desmedt [CRYPO 2004] � Hybrid encryption scheme � Genaro and Lindell [EUROCRYPT 2003] � Password based authenticated key exchange Some Basics About PHFs M.I. González-Vasco, Bochum 05
Cryptographic Cryptographic Applications pplications � Cramer and Shoup [EUROCRYPT 2002] IND-CCA Encryption Scheme in the standard model � � Kurosawa and Desmedt [CRYPO 2004] � Hybrid encryption scheme � Genaro and Lindell [EUROCRYPT 2003] � Password based authenticated key exchange � Kalai [EUROCRYPT 2005] � 2-out-of-1 oblivious transfer protocol. Some Basics About PHFs M.I. González-Vasco, Bochum 05
Cryptographic Applications Cryptographic Applications � Cramer and Shoup [EUROCRYPT 2002] � Π is the message space k is kept secret, α (k) and x are public � m ∈ Π is encrypted using H k (x) as a one time pad, for x ∈ L, i.e., � E( α (k)) (m) = (x, H k (x) ⊕ m) � IND-CCA security is achieved by appending a proof of integrity Some Basics About PHFs M.I. González-Vasco, Bochum 05
Cryptographic Cryptographic Applications pplications � Kalai [EUROCRYPT 2005] Sender’s (B) input: two strings γ 0 , γ 1 , Receiver’s (A) input: choice bit b. Goal: A learns γ b , but nothing about γ b-1 . B learns nothing about b. Some Basics About PHFs M.I. González-Vasco, Bochum 05
Cryptographic Cryptographic Applications pplications � Kalai [EUROCRYPT 2005] Sender’s (B) input: two strings γ 0 , γ 1 . Receiver’s (A) input: choice bit b. Goal: A learns γ b , but nothing about γ 1-b . B learns nothing about b. � A chooses x b ∈ L and x 1-b ∈ X\L and sends (X, x 0 , x 1 ) to B; Some Basics About PHFs M.I. González-Vasco, Bochum 05
Cryptographic Cryptographic Applications pplications � Kalai [EUROCRYPT 2005] Sender’s (B) input: two strings γ 0 , γ 1. Receiver’s (A) input: choice bit b. Goal: A learns γ b , but nothing about γ 1-b . B learns nothing about b. � A chooses x b ∈ L and x 1-b ∈ X\L and sends (X, x 0 , x 1 ) to B; B chooses independently two random keys k 0 , k 1 and sends � α (k 0 ), α (k 1 ), y 0 = γ 0 ⊕ H k0 (x 0 ) and y 1 = γ 1 ⊕ H k1 (x 1 ); Some Basics About PHFs M.I. González-Vasco, Bochum 05
Cryptographic Cryptographic Applications pplications � Kalai [EUROCRYPT 2005] Sender’s (B) input: two strings γ 0 , γ 1. Receiver’s (A) input: choice bit b. Goal: A learns γ b , but nothing about γ 1-b . B learns nothing about b. � A chooses x b ∈ L and x 1-b ∈ X\L and sends (X, x 0 , x 1 ) to B; B chooses independently two random keys k 0 , k 1 and sends � α (k 0 ), α (k 1 ), y 0 = γ 0 ⊕ H k0 (x 0 ) and y 1 = γ 1 ⊕ H k1 (x 1 ); � A retrieves γ b by computing y b ⊕ H kb (x b ) using the projection key α (k b ). Note that as x 1-b ∈ X\L, α (k 1-b ) does not give enough information for computing H k 1-b outside L. Some Basics About PHFs M.I. González-Vasco, Bochum 05
Recommend
More recommend
