Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F. Lai 1,2 , Raymond K. H. Tai 2 , Harry W. H. Wong 2 , Sherman S. M. Chow 2 1 Friedrich-Alexander University Erlangen-Nuremberg 2 Chinese University of Hong Kong
Useful multi-key homomorphic signatures likely require strong assumptions. Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 1/16
Overview We introduce a strong but natural unforgeability notion of (multi-key) homomorphic signatures. Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 2/16
Overview We introduce a strong but natural unforgeability notion of (multi-key) homomorphic signatures. The property is essential for natural applications, e.g., verifiable MPC. Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 2/16
Overview We introduce a strong but natural unforgeability notion of (multi-key) homomorphic signatures. The property is essential for natural applications, e.g., verifiable MPC. We draw connections of the notion to zk-SNARG/Ks. Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 2/16
Homomorphic Signatures I signed m . σ A Alice Evaluator Verifier m
Homomorphic Signatures You can evaluate any function on it. σ A Alice Evaluator Verifier m
Homomorphic Signatures Let’s do f ( m ) . σ A Alice Evaluator Verifier f ( m ) , f
Homomorphic Signatures Looks legit. σ A Alice Evaluator Verifier f ( m ) , f Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 3/16
Unforgeability of Homomorphic Signatures I signed m . σ A Adversary Alice Verifier m
Unforgeability of Homomorphic Signatures You can evaluate any function on it. σ A Adversary Alice Verifier m
Unforgeability of Homomorphic Signatures Let’s pretend m ∗ = f ( m ) . σ A Adversary Alice Verifier m ∗ , f
Unforgeability of Homomorphic Signatures Smells fishy. σ A Adversary Alice Verifier m ∗ , f Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 4/16
Multi-key Homomorphic Signatures [FMNP, Asiacrypt16] I signed m A . σ A Alice m A I signed m B . Evaluator Verifier σ B Bob m B
Multi-key Homomorphic Signatures [FMNP, Asiacrypt16] You can evaluate any function on them. Alice Evaluator Verifier σ A m A , σ B m B Bob
Multi-key Homomorphic Signatures [FMNP, Asiacrypt16] Let’s do f ( m A , m B ) . Alice A , B Evaluator σ Verifier f ( m A , m B ) , f Bob
Multi-key Homomorphic Signatures [FMNP, Asiacrypt16] Looks legit. Alice A , B Evaluator σ Verifier f ( m A , m B ) , f Bob Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 5/16
Unforgeability of Multi-key Homomorphic Signatures [FMNP, Asiacrypt16] I signed m A . σ A Alice m A I signed m B . Adversary Verifier σ B Bob m B
Unforgeability of Multi-key Homomorphic Signatures [FMNP, Asiacrypt16] You can evaluate any function on them. Alice Adversary Verifier σ A m A , σ B m B Bob
Unforgeability of Multi-key Homomorphic Signatures [FMNP, Asiacrypt16] Let’s pretend m ∗ = f ( m A , m B ) . Alice A , B Adversary σ Verifier m ∗ , f Bob
Unforgeability of Multi-key Homomorphic Signatures [FMNP, Asiacrypt16] Smells fishy. Alice A , B Adversary σ Verifier m ∗ , f Bob Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 6/16
Insider Attack? I signed m A . σ A Alice m A Here is my secret key sk B . Adversary Verifier Bob
Insider Attack? You can evaluate any function on them. σ A m A Alice Let’s mess with Alice. Adversary Verifier Bob
Insider Attack? Let’s pretend m ∗ = f ( m A , m B ) . Alice A , B Adversary Verifier σ m ∗ , f Bob
Insider Attack? Sounds...... legit? Alice A , B Adversary Verifier σ m ∗ , f Bob Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 7/16
Unforgeability of (Multi-Key) Homomorphic Signatures under Insider Corruption • A can query sign oracle on ( id , m ) , which does the following: • Generate ( pk id , sk id ) and record id as honest if not done already. • Sign m using sk id as σ id m and record m in the set M id . • Return ( pk id , σ id m ) . Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 8/16
Unforgeability of (Multi-Key) Homomorphic Signatures under Insider Corruption • A can query sign oracle on ( id , m ) , which does the following: • Generate ( pk id , sk id ) and record id as honest if not done already. • Sign m using sk id as σ id m and record m in the set M id . • Return ( pk id , σ id m ) . • A produces ( f ∗ , { pk ∗ id 1 ,..., pk ∗ id k } , m ∗ , σ ∗ ) . Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 8/16
Unforgeability of (Multi-Key) Homomorphic Signatures under Insider Corruption • A can query sign oracle on ( id , m ) , which does the following: • Generate ( pk id , sk id ) and record id as honest if not done already. • Sign m using sk id as σ id m and record m in the set M id . • Return ( pk id , σ id m ) . • A produces ( f ∗ , { pk ∗ id 1 ,..., pk ∗ id k } , m ∗ , σ ∗ ) . • A wins if the following hold: • Vf ( f ∗ , { pk ∗ id 1 ,..., pk ∗ id k } , m ∗ , σ ∗ ) = 1. • If id is honest, then pk ∗ id = pk id . • m ∗ is not in the range of f ∗ , when the inputs of honest id are restricted to those recorded in M id , � � � m i ∈ M id i is malicious i.e. , m ∗ / f ∗ ( m 1 ,..., m k ) : ∈ m i ∈ M id i id i is honest Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 8/16
Unforgeability of (Multi-Key) Homomorphic Signatures under Insider Corruption • A can query sign oracle on ( id , m ) , which does the following: • Generate ( pk id , sk id ) and record id as honest if not done already. • Sign m using sk id as σ id m and record m in the set M id . • Return ( pk id , σ id m ) . • A produces ( f ∗ , { pk ∗ id 1 ,..., pk ∗ id k } , m ∗ , σ ∗ ) . • A wins if the following hold: • Vf ( f ∗ , { pk ∗ id 1 ,..., pk ∗ id k } , m ∗ , σ ∗ ) = 1. • If id is honest, then pk ∗ id = pk id . • m ∗ is not in the range of f ∗ , when the inputs of honest id are restricted to those recorded in M id , � � � m i ∈ M id i is malicious i.e. , m ∗ / f ∗ ( m 1 ,..., m k ) : ∈ m i ∈ M id i id i is honest Remark • The definition still makes sense even with one key, i.e. , k = 1. • It means that even the signer cannot produce σ m , f for m not in the range of f . Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 8/16
Why is the notion meaningful? Example 1: Number of keys k > 1 • f ∗ ( m 1 ,..., m k ) = MAJORITY ( m 1 ,..., m k ) • id k malicious • id i honest, M id i = { NO } , for all i = 1 ,..., k − 1 id k } , m ∗ = YES , σ ∗ ) • Infeasible to forge ( MAJORITY , { pk ∗ id 1 ,..., pk ∗ Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 9/16
Why is the notion meaningful? Example 1: Number of keys k > 1 • f ∗ ( m 1 ,..., m k ) = MAJORITY ( m 1 ,..., m k ) • id k malicious • id i honest, M id i = { NO } , for all i = 1 ,..., k − 1 id k } , m ∗ = YES , σ ∗ ) • Infeasible to forge ( MAJORITY , { pk ∗ id 1 ,..., pk ∗ Example 2: Number of keys k = 1 • C : Unsatisfiable Boolean circuit • f ∗ ( m ) = C ( m ) • Infeasible to forge ( C , pk , m ∗ = 1 , σ ∗ ) Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 9/16
Other Properties of (Multi-key) Homomorphic Signatures (Weakly) Context-Hiding σ f ( m ) , f reveals nothing about m . Succinctness Size of σ f ( m ) , f is independent of the size of m and f . Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 10/16
Preliminary: zk-(O-)SNARG/Ks Argument systems which allow a prover to prove to the verifier: There exists a witness w such that the relation R ( x , w ) = 1 holds for the statement x. zero-knowledge : Proofs reveal nothing about witnesses. Oracle : Sound even if the prover has access to certain ( e.g. , signing) oracles. Succinct : Proof size is independent of witness size. Non-Interactive : The prover only sends 1 message to the verifier. ARGguments : The system is computationally sound. ARguments of Knowledge : There exists an extractor which extracts witnesses from provers. Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 11/16
Roadmap • zk-(O-)SNARKs + Signatures = ⇒ Insider Unforgeable Multi-key Homomorphic Signatures. Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 12/16
Roadmap • zk-(O-)SNARKs + Signatures = ⇒ Insider Unforgeable Multi-key Homomorphic Signatures. • 1-key 1-hop Insider Unforgeable Homomorphic Signatures = ⇒ zk-SNARGs Multi-Key Homomorphic Signatures Unforgeable under Insider Corruption Russell W. F . Lai 12/16
Recommend
More recommend
