Limitations of the Meta-Reduction Technique Nils Fleischhacker - PowerPoint PPT Presentation

Preliminaries Meta-Reductions Limitations Conclusion Limitations of the Meta-Reduction Technique Nils Fleischhacker Technische Universit¨ at Darmstadt September 2, 2012 Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 1

Preliminaries Meta-Reductions Limitations Conclusion Signatures ... with Reasonable Randomization S = ( Kgen , Sign , Vrfy ) Sign sk κ Kgen σ m pk Vrfy b Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 2

Preliminaries Meta-Reductions Limitations Conclusion Signatures ... with Reasonable Randomization S = ( Kgen , Sign , Vrfy ) Sign ω sk κ Kgen σ m pk Vrfy b H ∞ ( Sign ( pk , m )) ∈ ω (log( κ )) Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 2

Preliminaries Meta-Reductions Limitations Conclusion Problems Π = ( IGen , Thresh , Vrfy ) Vrfy b κ IGen z x A Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 3

Preliminaries Meta-Reductions Limitations Conclusion Problems Π = ( IGen , Thresh , Vrfy , O ) st Vrfy b κ IGen z x A O Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 3

Preliminaries Meta-Reductions Limitations Conclusion Problems Π = ( IGen , Thresh , Vrfy , O )   z ← IGen ( κ ) st x ← A O ( z ) Exp Π   A ( κ ) :   b ← Vrfy ( z, x ) Vrfy   b output b κ IGen z x A O Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 3

Preliminaries Meta-Reductions Limitations Conclusion Problems Π = ( IGen , Thresh , Vrfy , O )   z ← IGen ( κ ) st x ← A O ( z ) Exp Π   A ( κ ) :   b ← Vrfy ( z, x ) Vrfy   b output b κ IGen z x � � ? Exp Π Pr A ( κ ) = 1 Adv A Π ( κ ) = � � ? Exp Π A O − Pr Thresh ( κ ) = 1 Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 3

Preliminaries Meta-Reductions Limitations Conclusion Reductions and Meta-Reductions A EUF - CMA Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 4

Preliminaries Meta-Reductions Limitations Conclusion Reductions and Meta-Reductions Π R A EUF - CMA Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 4

Preliminaries Meta-Reductions Limitations Conclusion Reductions and Meta-Reductions M Π Π ’ R A EUF - CMA Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 4

Preliminaries Meta-Reductions Limitations Conclusion The “Standard” Technique M R Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

Preliminaries Meta-Reductions Limitations Conclusion The “Standard” Technique z M R Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

Preliminaries Meta-Reductions Limitations Conclusion The “Standard” Technique z M pk m, m ′ ← { 0 , 1 } ∗ $ R Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

Preliminaries Meta-Reductions Limitations Conclusion The “Standard” Technique z M pk m, m ′ ← { 0 , 1 } ∗ $ m R Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

Preliminaries Meta-Reductions Limitations Conclusion The “Standard” Technique z M pk m, m ′ ← { 0 , 1 } ∗ $ m R m, σ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

Preliminaries Meta-Reductions Limitations Conclusion The “Standard” Technique z M pk m, m ′ ← { 0 , 1 } ∗ $ R m, σ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

Preliminaries Meta-Reductions Limitations Conclusion The “Standard” Technique z M pk m, m ′ ← { 0 , 1 } ∗ $ m ′ R m, σ σ ′ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

Preliminaries Meta-Reductions Limitations Conclusion The “Standard” Technique z M pk m, m ′ ← { 0 , 1 } ∗ $ m ′ R m, σ σ ′ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

Preliminaries Meta-Reductions Limitations Conclusion The “Standard” Technique z M pk m, m ′ ← { 0 , 1 } ∗ $ m ′ R m, σ σ ′ x Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

Preliminaries Meta-Reductions Limitations Conclusion The “Standard” Technique So, what’s the problem? Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 6

Preliminaries Meta-Reductions Limitations Conclusion Well, as it turns out... z R i := 0 ( sk , pk ) ← Kgen (1 κ ) pk m ω ← O ( m, i ) σ ← Sign ( sk , m ; ω ) i := i + 1 σ m ∗ , σ ∗   Vrfy ( pk , m ∗ , σ ∗ ) ? = 0 ω ∗ ← O ( m ∗ , i ) if  � �   abort   ∨ ∃ i ∈ { 0 , . . . , p } :  ∧ σ ∗ ? = Sign ( sk , m ∗ ; ω ∗ ) Find x ∈ Sol such that Vrfy ( z, x ) ? = 1 . x Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 7

Preliminaries Meta-Reductions Limitations Conclusion Well, as it turns out... z R Choose random function and output public key. i := 0 ( sk , pk ) ← Kgen (1 κ ) pk m ω ← O ( m, i ) σ ← Sign ( sk , m ; ω ) i := i + 1 σ m ∗ , σ ∗   Vrfy ( pk , m ∗ , σ ∗ ) ? = 0 ω ∗ ← O ( m ∗ , i ) if  � �   abort   ∨ ∃ i ∈ { 0 , . . . , p } :  ∧ σ ∗ ? = Sign ( sk , m ∗ ; ω ∗ ) Find x ∈ Sol such that Vrfy ( z, x ) ? = 1 . x Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 7

Preliminaries Meta-Reductions Limitations Conclusion Well, as it turns out... z R Choose random function and output public key. i := 0 ( sk , pk ) ← Kgen (1 κ ) pk m Sign using randomness computed as ω ← O ( m, i ) . ω ← O ( m, i ) σ ← Sign ( sk , m ; ω ) i := i + 1 σ m ∗ , σ ∗   Vrfy ( pk , m ∗ , σ ∗ ) ? = 0 ω ∗ ← O ( m ∗ , i ) if  � �  abort    ∨ ∃ i ∈ { 0 , . . . , p } :  ∧ σ ∗ ? = Sign ( sk , m ∗ ; ω ∗ ) Find x ∈ Sol such that Vrfy ( z, x ) ? = 1 . x Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 7

Preliminaries Meta-Reductions Limitations Conclusion Well, as it turns out... z R Choose random function and output public key. i := 0 ( sk , pk ) ← Kgen (1 κ ) pk m Sign using randomness computed as ω ← O ( m, i ) . ω ← O ( m, i ) σ ← Sign ( sk , m ; ω ) i := i + 1 σ m ∗ , σ ∗   Vrfy ( pk , m ∗ , σ ∗ ) ? Check whether forgery would = 0 ω ∗ ← O ( m ∗ , i ) if  � �  abort    have been computed by R itself. ∨ ∃ i ∈ { 0 , . . . , p } :  ∧ σ ∗ ? = Sign ( sk , m ∗ ; ω ∗ ) Find x ∈ Sol such that Vrfy ( z, x ) ? = 1 . x Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 7

Preliminaries Meta-Reductions Limitations Conclusion Well, as it turns out... z R Choose random function and output public key. i := 0 ( sk , pk ) ← Kgen (1 κ ) pk m Sign using randomness computed as ω ← O ( m, i ) . ω ← O ( m, i ) σ ← Sign ( sk , m ; ω ) i := i + 1 σ m ∗ , σ ∗   Vrfy ( pk , m ∗ , σ ∗ ) ? Check whether forgery would = 0 ω ∗ ← O ( m ∗ , i ) if  � �   abort   have been computed by R itself. ∨ ∃ i ∈ { 0 , . . . , p } :  ∧ σ ∗ ? = Sign ( sk , m ∗ ; ω ∗ ) Find x ∈ Sol such that Vrfy ( z, x ) ? Brute force solution. = 1 . x Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 7

Preliminaries Meta-Reductions Limitations Conclusion Meta-Meta-Reduction M Π Π ’ R A EUF - CMA Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 8

Preliminaries Meta-Reductions Limitations Conclusion Meta-Meta-Reduction M N Π Π ’ R A EUF - CMA Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 8

Preliminaries Meta-Reductions Limitations Conclusion Meta-Meta-Reduction M N Π Π ’ R A EUF - CMA Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 8

Preliminaries Meta-Reductions Limitations Conclusion What does it mean? pk N Sign ( sk , · ) M Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 9