New Constructions and Applications of Trapdoor DDH Groups Yannick - PowerPoint PPT Presentation

New Constructions and Applications of Trapdoor DDH Groups Yannick Seurin ANSSI, France March 1, PKC 2013 Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 1 / 27

Introduction Introduction: CDH versus DDH group G , element G ∈ G of large order CDH problem: given X = G x and Y = G y , compute G xy DDH problem: distinguish ( G x , G y , G xy ) and ( G x , G y , G z ) usual situations in cryptographic groups: CDH and DDH are both (presumably) hard 1 → e.g. prime order subgroup of Z ∗ p CDH is (presumably) hard and DDH is universally easy 2 → pairing groups Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 2 / 27

Introduction Introduction: CDH versus DDH group G , element G ∈ G of large order CDH problem: given X = G x and Y = G y , compute G xy DDH problem: distinguish ( G x , G y , G xy ) and ( G x , G y , G z ) usual situations in cryptographic groups: CDH and DDH are both (presumably) hard 1 → e.g. prime order subgroup of Z ∗ p CDH is (presumably) hard and DDH is universally easy 2 → pairing groups Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 2 / 27

Introduction Introduction: CDH versus DDH group G , element G ∈ G of large order CDH problem: given X = G x and Y = G y , compute G xy DDH problem: distinguish ( G x , G y , G xy ) and ( G x , G y , G z ) usual situations in cryptographic groups: CDH and DDH are both (presumably) hard 1 → e.g. prime order subgroup of Z ∗ p CDH is (presumably) hard and DDH is universally easy 2 → pairing groups Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 2 / 27

Introduction Introduction: trapdoor DDH groups Trapdoor DDH groups (TDDH groups): lies somewhere between cases 1 and 2: → CDH is hard, while DDH is hard unless one has some trapdoor τ introduced by Dent and Galbraith [DG06] very few constructions (hidden pairing construction by [DG06]) very few applications: simple identification scheme [DG06] statistically hiding sets [PX09] Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 3 / 27

Introduction Introduction: trapdoor DDH groups Trapdoor DDH groups (TDDH groups): lies somewhere between cases 1 and 2: → CDH is hard, while DDH is hard unless one has some trapdoor τ introduced by Dent and Galbraith [DG06] very few constructions (hidden pairing construction by [DG06]) very few applications: simple identification scheme [DG06] statistically hiding sets [PX09] Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 3 / 27

Introduction Introduction: trapdoor DDH groups Trapdoor DDH groups (TDDH groups): lies somewhere between cases 1 and 2: → CDH is hard, while DDH is hard unless one has some trapdoor τ introduced by Dent and Galbraith [DG06] very few constructions (hidden pairing construction by [DG06]) very few applications: simple identification scheme [DG06] statistically hiding sets [PX09] Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 3 / 27

Introduction Introduction: trapdoor DDH groups Trapdoor DDH groups (TDDH groups): lies somewhere between cases 1 and 2: → CDH is hard, while DDH is hard unless one has some trapdoor τ introduced by Dent and Galbraith [DG06] very few constructions (hidden pairing construction by [DG06]) very few applications: simple identification scheme [DG06] statistically hiding sets [PX09] Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 3 / 27

Introduction In this paper Our contributions: we slightly refine the original definition of trapdoor DDH groups by [DG06] we introduce static trapdoor DDH groups we give new constructions of trapdoor DDH and static trapdoor DDH groups based on standard assumptions we show that (static) trapdoor DDH groups give very simple constructions of convertible undeniable signature schemes Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 4 / 27

Introduction In this paper Our contributions: we slightly refine the original definition of trapdoor DDH groups by [DG06] we introduce static trapdoor DDH groups we give new constructions of trapdoor DDH and static trapdoor DDH groups based on standard assumptions we show that (static) trapdoor DDH groups give very simple constructions of convertible undeniable signature schemes Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 4 / 27

Introduction In this paper Our contributions: we slightly refine the original definition of trapdoor DDH groups by [DG06] we introduce static trapdoor DDH groups we give new constructions of trapdoor DDH and static trapdoor DDH groups based on standard assumptions we show that (static) trapdoor DDH groups give very simple constructions of convertible undeniable signature schemes Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 4 / 27

Introduction In this paper Our contributions: we slightly refine the original definition of trapdoor DDH groups by [DG06] we introduce static trapdoor DDH groups we give new constructions of trapdoor DDH and static trapdoor DDH groups based on standard assumptions we show that (static) trapdoor DDH groups give very simple constructions of convertible undeniable signature schemes Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 4 / 27

Outline Outline Definition of Trapdoor DDH Groups 1 New Constructions of TDDH and Static TDDH Groups 2 A TDDH group based on composite residuosity A static TDDH group based on RSA A static TDDH group based on factoring Application to Convertible Undeniable Signatures 3 Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 5 / 27

Definition of Trapdoor DDH Groups Outline Definition of Trapdoor DDH Groups 1 New Constructions of TDDH and Static TDDH Groups 2 A TDDH group based on composite residuosity A static TDDH group based on RSA A static TDDH group based on factoring Application to Convertible Undeniable Signatures 3 Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 6 / 27

Definition of Trapdoor DDH Groups TDDH group: definition Trapdoor DDH group ( G , G , τ ) ← GpGen ( 1 k ) is a trapdoor DDH group if: 1 the DDH problem is hard for ( G , G ) without the trapdoor τ 2 the CDH problem is hard even with the trapdoor τ 3 there is a distinguishing algorithm Solve ( X , Y , Z , τ ) which: always accepts when ( X , Y , Z ) is a DDH tuple (completeness) accepts with negligible probability for any adversarially generated Z ← A ( X , Y ) (soundness) When Solve always rejects on input a non-DDH tuple ( X , Y , Z ) , we say that the TDDH group has perfect soundness. Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 7 / 27

Definition of Trapdoor DDH Groups TDDH group: definition Trapdoor DDH group ( G , G , τ ) ← GpGen ( 1 k ) is a trapdoor DDH group if: 1 the DDH problem is hard for ( G , G ) without the trapdoor τ 2 the CDH problem is hard even with the trapdoor τ 3 there is a distinguishing algorithm Solve ( X , Y , Z , τ ) which: always accepts when ( X , Y , Z ) is a DDH tuple (completeness) accepts with negligible probability for any adversarially generated Z ← A ( X , Y ) (soundness) When Solve always rejects on input a non-DDH tuple ( X , Y , Z ) , we say that the TDDH group has perfect soundness. Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 7 / 27

Definition of Trapdoor DDH Groups TDDH group: definition Trapdoor DDH group ( G , G , τ ) ← GpGen ( 1 k ) is a trapdoor DDH group if: 1 the DDH problem is hard for ( G , G ) without the trapdoor τ 2 the CDH problem is hard even with the trapdoor τ 3 there is a distinguishing algorithm Solve ( X , Y , Z , τ ) which: always accepts when ( X , Y , Z ) is a DDH tuple (completeness) accepts with negligible probability for any adversarially generated Z ← A ( X , Y ) (soundness) When Solve always rejects on input a non-DDH tuple ( X , Y , Z ) , we say that the TDDH group has perfect soundness. Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 7 / 27

Definition of Trapdoor DDH Groups TDDH group: definition Trapdoor DDH group ( G , G , τ ) ← GpGen ( 1 k ) is a trapdoor DDH group if: 1 the DDH problem is hard for ( G , G ) without the trapdoor τ 2 the CDH problem is hard even with the trapdoor τ 3 there is a distinguishing algorithm Solve ( X , Y , Z , τ ) which: always accepts when ( X , Y , Z ) is a DDH tuple (completeness) accepts with negligible probability for any adversarially generated Z ← A ( X , Y ) (soundness) When Solve always rejects on input a non-DDH tuple ( X , Y , Z ) , we say that the TDDH group has perfect soundness. Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 7 / 27

Definition of Trapdoor DDH Groups TDDH group: definition Trapdoor DDH group ( G , G , τ ) ← GpGen ( 1 k ) is a trapdoor DDH group if: 1 the DDH problem is hard for ( G , G ) without the trapdoor τ 2 the CDH problem is hard even with the trapdoor τ 3 there is a distinguishing algorithm Solve ( X , Y , Z , τ ) which: always accepts when ( X , Y , Z ) is a DDH tuple (completeness) accepts with negligible probability for any adversarially generated Z ← A ( X , Y ) (soundness) When Solve always rejects on input a non-DDH tuple ( X , Y , Z ) , we say that the TDDH group has perfect soundness. Yannick Seurin (ANSSI) Trapdoor DDH Groups PKC 2013 7 / 27