Light Lightweight Cryptography Pascal Lafourcade (LIMOS, France) - PowerPoint PPT Presentation

Light Lightweight Cryptography Pascal Lafourcade (LIMOS, France) Takaaki Mizuki (Tohoku University, Japan) Atsuki Nagao (Ochanomizu University, Japan) Kazumasa Shinagawa (Tokyo Tech / AIST, Japan) 1

2

3

4

5

6

Material 7

Agenda 1. Introduction • Physical cryptography • Related works 2. Light cryptography • Model • Set-Intersection protocol • Min/Max protocol • Addition protocol 3. Conclusion 8

Agenda 1. Introduction • Physical cryptography • Related works 2. Light cryptography • Model • Set-Intersection protocol • Min/Max protocol • Addition protocol 3. Conclusion 9

Background • Modern cryptography is more and more used and complex • Teaching cryptography is hard • Complex algorithm • Security • Deep mathematics • Not visualized OUR GOAL : a good educational tool for cryptography 10

Physical cryptography • Cryptography using physical objects (e.g. playing cards) • Suitable for education • Good visualization • Concrete • Introduction to cryptographic concepts • No need of mathematics knowledge 11

Light cryptography New model of physical cryptography • Computation based on light and shadows • Easy to understand • Secure 12

Related works • Zero-knowledge proof for “Where’ s Wally” [1] • Proof that “I know Wally’ s position” without revealing the position • Visual secret sharing [2] • Secret image is reconstructed by stacking two transparent sheets • Card-based protocols [3] • Secure computation protocol using a deck of cards (like playing cards) [1] Naor, Naor, and Reingold, “Applied Kid Cryptography or How To Convince Your Children You Are Not Cheating”, EUROCRYPT 1999. [2] Naor and Shamir, “Visual Cryptography”, EUROCRYPT 1994. [3] den Boer, “More Efficient Match-Making and Satisfiability The Five Card Trick”, EUROCRYPT 1989. 13

Agenda 1. Introduction • Physical cryptography • Related works 2. Light cryptography • Model • Set-Intersection protocol • Min/Max protocol • Addition protocol 3. Conclusion 14

Properties of shadows • It is sometimes hard to imagine its original shape from shadows 15

16

Properties of shadows The resulting shadow is the union of shadows Shadow addition 17

Protocols of Light Cryptography • Start: Each party has a secret input x i • Goal: Compute a joint function f(x 1 , x 2 , …, x n ) with hiding secrets 1. Each party has an input sheet 2. Depending on own input, each party makes holes in the sheet hole Step 2 Input sheet if x i = 0 if x i = 1 18

Protocols of Light Cryptography 3. Each party inserts own input sheet in the hiding box (B) 4. (A) is illuminating by the light 5. The result image is printed on the screen A net of the box 19

<latexit sha1_base64="i7hWC0vdcfMUI6A2sTujQSDq0gQ=">ACZXichVFNSwJBGH7cvswy7YMIOiSJ0UlGOxSdpC4d/cgPUJHdbazFdXfZXQUT/0B0rQ6dCiKin9GlP9DBXxDR0aBLh17XhSip3mFmnmfd5ZkYyVMWyGet6hJHRsfEJ76Rvato/EwjOzuUsvWHKPCvrqm4WJNHiqLxrK3YKi8YJhfrksrzUm23v59vctNSdG3fbhm8XBcPNaWqyKJNVLrUqQTDLMqcCA2DmAvCcCOpB29RwgF0yGigDg4NmEVIixqRcTAYBXRps4k5Di7HN04CNtg7I4ZYjE1mg8pFXRZTVa92tajlqmU1TqJilDiLAndsd67JHdsxf28WutlOj76VFszTQcqMSOFnKvP+rqtNs4+hL9adnG1VsOV4V8m4TP8W8kDfPL7oZbTkfYau2av5P+KdkD3UBrvsk3KZ6+hI8+IPbzuYdBLh6NbUTjqXg4seN+hRfLWMU6vfcmEthDElk6t4pTnOHc8yz4hQVhcZAqeFzNPL6FsPIJ3sWKZQ=</latexit> How to “securely” have an agreement Alice Bob Determine the current situation Yes Yes → agreement without revealing inputs directly Yes No } → disagreement No Yes No No if Yes if No 20

<latexit sha1_base64="i7hWC0vdcfMUI6A2sTujQSDq0gQ=">ACZXichVFNSwJBGH7cvswy7YMIOiSJ0UlGOxSdpC4d/cgPUJHdbazFdXfZXQUT/0B0rQ6dCiKin9GlP9DBXxDR0aBLh17XhSip3mFmnmfd5ZkYyVMWyGet6hJHRsfEJ76Rvato/EwjOzuUsvWHKPCvrqm4WJNHiqLxrK3YKi8YJhfrksrzUm23v59vctNSdG3fbhm8XBcPNaWqyKJNVLrUqQTDLMqcCA2DmAvCcCOpB29RwgF0yGigDg4NmEVIixqRcTAYBXRps4k5Di7HN04CNtg7I4ZYjE1mg8pFXRZTVa92tajlqmU1TqJilDiLAndsd67JHdsxf28WutlOj76VFszTQcqMSOFnKvP+rqtNs4+hL9adnG1VsOV4V8m4TP8W8kDfPL7oZbTkfYau2av5P+KdkD3UBrvsk3KZ6+hI8+IPbzuYdBLh6NbUTjqXg4seN+hRfLWMU6vfcmEthDElk6t4pTnOHc8yz4hQVhcZAqeFzNPL6FsPIJ3sWKZQ=</latexit> How to “securely” have an agreement Alice Bob Determine the current situation Yes Yes → agreement without revealing inputs directly Yes No } → disagreement No Yes Computation of an AND No No if Yes if No 21

<latexit sha1_base64="i7hWC0vdcfMUI6A2sTujQSDq0gQ=">ACZXichVFNSwJBGH7cvswy7YMIOiSJ0UlGOxSdpC4d/cgPUJHdbazFdXfZXQUT/0B0rQ6dCiKin9GlP9DBXxDR0aBLh17XhSip3mFmnmfd5ZkYyVMWyGet6hJHRsfEJ76Rvato/EwjOzuUsvWHKPCvrqm4WJNHiqLxrK3YKi8YJhfrksrzUm23v59vctNSdG3fbhm8XBcPNaWqyKJNVLrUqQTDLMqcCA2DmAvCcCOpB29RwgF0yGigDg4NmEVIixqRcTAYBXRps4k5Di7HN04CNtg7I4ZYjE1mg8pFXRZTVa92tajlqmU1TqJilDiLAndsd67JHdsxf28WutlOj76VFszTQcqMSOFnKvP+rqtNs4+hL9adnG1VsOV4V8m4TP8W8kDfPL7oZbTkfYau2av5P+KdkD3UBrvsk3KZ6+hI8+IPbzuYdBLh6NbUTjqXg4seN+hRfLWMU6vfcmEthDElk6t4pTnOHc8yz4hQVhcZAqeFzNPL6FsPIJ3sWKZQ=</latexit> How to “securely” have an agreement Alice Bob Determine the current situation Yes Yes → agreement without revealing inputs directly Yes No } → disagreement No Yes Computation of an AND No No NOBODY LEARNS OTHER CHOICE if Yes if No 22

Schedule a meeting for next month? 23

Transparent sheets • Input sheets also can be implemented by transparent sheets • Each party fills it by a black pen or a black-colored seals black pen transparent Depending on input, some circles The black image is printed on are filled by a black pen transparent sheets 24

Input sheet Scheduling (set-intersection) Alice’ s result schedule Bob’ s schedule NOBODY LEARNS OTHER CHOICE 25

Compute the maximum of salaries ? 26

Input sheet Max protocol Alice’ s input = 33 Bob’ s input = 16 result = 33 NOBODY LEARNS OTHER CHOICE 27

Compute the minimum of salaries ? 28

Input sheet Min protocol Alice’ s input = 24 Bob’ s input = 70 result = 24 29 NOBODY LEARNS OTHER CHOICE

Compute who is the millionaire? 30

Input sheet Max with name Alice’ s input = 33 Bob’ s input = 50 Carol’ s input = 50 NOBODY LEARNS OTHER CHOICE 31

Compute the sum of numbers ? 32

Addition protocol 0 Input sheet: Bob’ s Carol’ s Alice’ s input = 2 input = 3 input = 1 • The output image is randomized • If two circles are collude, the output is not correct 33

Addition protocol 1 Input sheet: Bob’ s Carol’ s Alice’ s input = 2 input = 3 input = 1 • The output image is randomized • If two circles are collude, the output is not correct 34

Addition protocol 2 Input sheet: Bob’ s Carol’ s Alice’ s input = 2 input = 3 input = 1 • Use instead of • The collision probability is reduced 35

Conclusion CONTRIBUTIONS: • Light cryptography is a new model of physical cryptography • Secure computation based on light and shadows : - Max/Minimum - Addition - Schedule 36

Future directions • Use it in cryptography courses Design Feedback Test • Designe more protocols : Subtraction ? Multiplication ? • Study more about physical cryptography 37

Questions ? 38