On the Impossibility of Tight Cryptographic Reduc:ons Christoph Bader, Tibor Jager, Yong Li, Sven Schäge Ruhr-University Bochum EUROCRYPT 2016 1
“Tight” Cryptographic Reduc:ons 1. Define a security model 2. Prove: efficient a/acker A implies efficient algorithm R that solves a “hard” problem P pk m i s i Q :mes (m*,s*) Adversary A 2
“Tight” Cryptographic Reduc:ons 1. Define a security model 2. Prove: efficient adversary A implies efficient algorithm R that solves a “hard” problem P Reduc:on R Instance of P pk m i s i Q :mes (m*,s*) Solu:on Adversary A 3
“Tight” Cryptographic Reduc:ons 1. Define a security model 2. Prove: efficient adversary A implies efficient algorithm R that solves a “hard” problem P Reduc:on R Instance of P pk m i s i Q :mes (m*,s*) Solu:on Adversary A Reduc:on R is :ght , if t R ≈ t A and succ R ≈ succ A 4
Why is :ght security interes:ng? • Do schemes with :ght security exist ? – Inherent :ghtness lower bounds? • Tightness has impact on theore:cally- sound selec:on of parameters – “Non-:ght“ reduc:on => large parameters – Tight reduc:on => smaller parameters 5
Why is :ght security interes:ng? • Do schemes with :ght security exist ? – Inherent :ghtness lower bounds? • Relevant for theore:cally-sound selec:on of parameters – “Non-:ght“ reduc:on � large parameters – Tight reduc:on � smaller parameters 6
Many Tightly-Secure Cryptosystems Digital Signatures Iden:ty-based Encryp:on Katz-Wang (CCS 2003) Chen, Wee (Crypto 2013) • • Schäge (Eurocrypt 2011) Blazy, Kiltz, Pan (Eurocrypt 2014) • • ... ... • • Pseudorandom Func:ons Public-Key Encryp:on Naor-Reingold (FOCS 1997) Bellare, Boldyreva, Micali (Eurocrypt 2000) • • Lewko-Waters (CCS 2009) Hoeeinz, Jager (Crypto 2012) • • Jager (ePrint 2016) Gay, Hoeeinz, Kiltz, Wee (Eurocrypt 2016) • • ... (best paper) • ... • Key Exchange Bader, Hoeeinz, Jager, Kiltz, Li (TCC 2015) • 7
Many Tightly-Secure Cryptosystems Digital Signatures Iden:ty-based Encryp:on Katz-Wang (CCS 2003) Chen, Wee (Crypto 2013) • • Schäge (Eurocrypt 2011) Blazy, Kiltz, Pan (Eurocrypt 2014) • • ... ... • • Pseudorandom Func:ons Public-Key Encryp:on Naor-Reingold (FOCS 1997) Bellare, Boldyreva, Micali (Eurocrypt 2000) • • Lewko-Waters (CCS 2009) Hoeeinz, Jager (Crypto 2012) • • Jager (ePrint 2016) Gay, Hoeeinz, Kiltz, Wee (Eurocrypt 2016) • • ... (best paper) • ... • Key Exchange Bader, Hoeeinz, Jager, Kiltz, Li (TCC 2015) • Which proper:es must a cryptosystem (not) have to allow for a :ght security proof? 8
Coron‘s Result* (1/2) (Eurocrypt 2002) • Digital signatures pk – single-user selng m i – unique signatures** Q :mes s i (m*,s*) * see also Kakvi and Kiltz, Eurocrypt 2012 9 ** generalized to re-randomizable signatures by Hoeeinz et al., PKC 2012
Coron‘s Result* (1/2) (Eurocrypt 2002) • Digital signatures pk – single-user selng m i – unique signatures** Q :mes s i (m*,s*) Result: If a signature scheme has unique signatures , then any security reduc:on “loses” a factor of at least 1/Q. * see also Kakvi and Kiltz, Eurocrypt 2012 10 ** generalized to re-randomizable signatures by Hoeeinz et al., PKC 2012
Coron‘s Result (2/2) (Eurocrypt 2002) Reduc:on R Instance of P pk m i s i Q :mes (m*,s*) Solu:on 11
Coron‘s Result (2/2) (Eurocrypt 2002) Meta-Reduc:on M Reduc:on R Instance of P Instance of P pk Simula:on of m i Adversary A s i Q :mes (m*,s*) Solu:on Solu:on 12
Coron‘s Result (2/2) (Eurocrypt 2002) Meta-Reduc:on M Reduc:on R Instance of P Instance of P pk Simula:on of m i Adversary A s i Q :mes (m*,s*) Solu:on Solu:on Coron shows: If a signature scheme has unique signatures , then any reduc:on R implies an algorithm M that solves P • In :me t M ≈ t R ◆ − 1 ✓ Q ✏ M ≥ ✏ R − 1 • With Q · 1 − | MsgSpace | 13
Coron‘s Result (2/2) (Eurocrypt 2002) Meta-Reduc:on M Reduc:on R Instance of P Instance of P pk Simula:on of m i Adversary A s i Q :mes (m*,s*) Solu:on Solu:on Coron shows: If a signature scheme has unique signatures , then any reduc:on R implies an algorithm M that solves P “Annoying term” • In :me t M ≈ t R ◆ − 1 ✓ Q ✏ M ≥ ✏ R − 1 • With Q · 1 − | MsgSpace | 14
Limita:ons of Coron‘s Technique • Restricted but reasonable class of reduc:ons: – Treat adversary A as a black-box – Few advanced capabili:es (e.g. seq. rewinding) • Rela:vely complex analysis 15
Limita:ons of Coron‘s Technique • Restricted but reasonable class of reduc:ons: – Treat adversary A as a black-box – Few advanced capabili:es (e.g. seq. rewinding) • Rela:vely complex analysis ◆ − 1 ✓ Q ✏ M ≥ ✏ R − 1 “Annoying term” Q · 1 − | MsgSpace | • Only useful in selngs where Q << |MsgSpace| – Acceptable for [C`02, KK`12, HJK`12] – Makes applica:on to other sePngs difficult 16
Mul:-User Security of Signatures • A receives N public keys pk 1 , ..., pk N • Q signature queries • Corrupt N-1 users • Goal: :ght security in – Number of signatures Q (m*,s*) – Number of public keys N 17
Mul:-User Security of Signatures • A receives N public keys pk 1 , ..., pk N (m i , j) • Q signature queries s i • Corrupt N-1 users • Goal: :ght security in – Number of signatures Q (m*,s*) – Number of public keys N 18
Mul:-User Security of Signatures • A receives N public keys pk 1 , ..., pk N (m i , j) • Q signature queries s i • Corrupt N-1 users j • Goal: :ght security in sk j – Number of signatures Q (m*,s*) – Number of public keys N 19
Mul:-User Security of Signatures • A receives N public keys pk 1 , ..., pk N (m i , j) • Q signature queries s i • Corrupt N-1 users j • Desired: :ght security in sk j – Number of signatures Q (m*,s*) – Number of public keys N 20
Mul:-User Security of Signatures • A receives N public keys pk 1 , ..., pk N (m i , j) • Q signature queries s i • Corrupt N-1 users j • Desired: :ght security in sk j – Number of signatures Q (m*,s*) – Number of public keys N Single-user security � mul:-user security But the reduc:on is not :ght , loses a factor 1/N 21
Applying Coron’s technique to the mul:-user selng • To show that this loss is impossible to avoid: ✏ M ≥ ✏ R − 1 N • Applying [Coron 2002], we get 22
Applying Coron’s technique to the mul:-user selng • To show that this loss is impossible to avoid: ✏ M ≥ ✏ R − 1 N • Applying [Coron 2002], we get ◆ − 1 ✓ ✏ M ≥ ✏ R − 1 1 − N − 1 N · N 23
Applying Coron’s technique to the mul:-user selng • To show that this loss is impossible to avoid: ✏ M ≥ ✏ R − 1 N • Applying [Coron 2002], we get Equal to N ◆ − 1 ✓ ✏ M ≥ ✏ R − 1 1 − N − 1 N · N Trivial bound , because of the “annoying term” 24
Our approach Goal: Prove that 1/N-loss is impossible to avoid 1. Define a weaker security defini:on – Counterintui:ve: Should be more difficult to prove impossibility of :ght reduc:ons! 2. New meta-reduc:on technique – No “annoying term” – Weakness of security defini:ons enables simple and clean analysis 3. Generalize this technique to other primi:ves 25
Our approach Goal: Prove that 1/N-loss is impossible to avoid 1. Define a weaker security defini:on – Counterintui:ve: Should be more difficult to prove impossibility of :ght reduc:ons! 2. New meta-reduc:on technique – No “annoying term” – Weakness of security defini:ons enables simple and clean analysis 3. Generalize this technique to other primi:ves 26
Weak Mul:-User Security pk 1 , ..., pk N • A receives N public keys • Corrupt users j • Signature queries sk i for i≠j • A has to compute sk j sk j 27
Weak Mul:-User Security pk 1 , ..., pk N • A receives N public keys • Corrupt users j • Signature queries sk i for i≠j • A has to compute sk j sk j No :ght security proof for “weak” security � No :ght security proof for any “stronger” no:on 28
Weak Mul:-User Security pk 1 , ..., pk N • A receives N public keys • Corrupt users j • Signature queries sk i for i≠j • A has to compute sk j sk j No :ght security proof for “weak” security � No :ght security proof for any “stronger” no:on Makes sense for any public-key scheme! 29
Our approach Goal: Prove that 1/N-loss is impossible to avoid 1. Define a weaker security defini:on – Counterintui:ve: Should be more difficult to prove impossibility of :ght reduc:ons! 2. New meta-reduc:on technique – No “annoying term” – Weakness of security defini:ons enables simple and clean analysis 3. Generalize this technique to other primi:ves 30
Our result ◆ − 1 ✓ ✏ M ≥ ✏ R − 1 1 − N − 1 N · N • Restricted but reasonable class of reduc:ons: – Use adversary A as a black-box – Few advanced capabili:es (e.g. seq. rewinding) • Rela:vely simple analysis 31
Tightness Bound: Intui:on Reduc:on R pk 1 , ..., pk N Instance of P j sk i for i≠j sk j Solu:on 32
Tightness Bound: Intui:on Reduc:on R pk 1 , ..., pk N Instance of P j sk i for i≠j sk j Solu:on 1. Only one index j such that R can output sk i for all i≠j � R not :ght! 2. More than one j � P not “hard”! 33
Recommend
More recommend
