On Tight Security Proofs for Schnorr Signatures Nils Fleischhacker 1 - PowerPoint PPT Presentation

On Tight Security Proofs for Schnorr Signatures Nils Fleischhacker 1 Tibor Jager 2 oder 1 Dominique Schr¨ 1 Saarland University 2 Horst G¨ ortz Institute for IT Security, Ruhr-University Bochum December 9, 2014

(Informal) main Result The security of Schnorr signatures cannot be tightly reduced to any natural assumption using a generic reduction. The result holds unconditionally.

Schnorr Signatures [Sch90,Schn91] G = � g � , H Sign ( x, m ) Kgen (1 κ ) Vrfy ( X, m, σ ) $ r ← Z q parse σ as ( R, y ) $ R := g r x ← Z q X := g x c := H ( R, m ) c := H ( R, m ) = X c · R ? return g y return ( x, X ) y := r + x · c return σ = ( R, y ) ◮ Provably secure under DLOG assumption in the ROM [PS96, PS00]. ◮ Previous impossibility results for tight proofs for DLOG and algebraic reductions [PV05,GBL08,Seu12].

Schnorr Signatures [Sch90,Schn91] G = � g � , H Sign ( x, m ) Kgen (1 κ ) Vrfy ( X, m, σ ) $ r ← Z q parse σ as ( R, y ) $ R := g r x ← Z q X := g x c := H ( R, m ) c := H ( R, m ) = X c · R ? return g y return ( x, X ) y := r + x · c return σ = ( R, y ) ◮ Provably secure under DLOG assumption in the ROM [PS96, PS00]. ◮ Previous impossibility results for tight proofs for DLOG and algebraic reductions [PV05,GBL08,Seu12].

Schnorr Signatures [Sch90,Schn91] G = � g � , H Sign ( x, m ) Kgen (1 κ ) Vrfy ( X, m, σ ) $ r ← Z q parse σ as ( R, y ) $ R := g r x ← Z q X := g x c := H ( R, m ) c := H ( R, m ) = X c · R ? return g y return ( x, X ) y := r + x · c return σ = ( R, y ) ◮ Provably secure under DLOG assumption in the ROM [PS96, PS00]. Not tight! ◮ Previous impossibility results for tight proofs for DLOG and algebraic reductions [PV05,GBL08,Seu12].

Why do we care about tightness? g x R pk, m UUNF − NM Π σ x ′

Why do we care about tightness? g x R pk, m UUNF − NM Π Weaker Definition of Security = Stronger Negative Result σ x ′

Why do we care about tightness? g x R pk, m UUNF − NM Π σ x ′ t

Why do we care about tightness? g x R pk, m UUNF − NM Π σ x ′ f ( t ) = t t

Why do we care about tightness? g x R pk, m UUNF − NM Π σ x ′ f ( t ) = 2 t t

Why do we care about tightness? g x R pk, m q R ′ , m ′ UUNF − NM Π H ( R ′ , m ′ ) σ x ′ f ( t, q ) = q · t t

Meta-Reductions [BV98] Π R UUNF − NM A

Meta-Reductions [BV98] M Π Π ’ R UUNF − NM A

Previous Work on Lower Bounds PV05 1 Bound q 1 / 2 algebraic Reduction (OM)DL Assumption OMDL

Previous Work on Lower Bounds PV05 GBL08 1 1 Bound q 1 / 2 q 2 / 3 algebraic algebraic Reduction (OM)DL (OM)DL Assumption OMDL OMDL

Previous Work on Lower Bounds PV05 GBL08 Seurin12 1 1 O ( 1 Bound q ) q 1 / 2 q 2 / 3 algebraic algebraic algebraic Reduction (OM)DL (OM)DL (OM)DL Assumption OMDL OMDL OMDL

Previous Work on Lower Bounds PV05 GBL08 Seurin12 Our Work 1 1 O ( 1 O ( 1 Bound q ) q ) q 1 / 2 q 2 / 3 algebraic algebraic algebraic generic Reduction representation (OM)DL (OM)DL (OM)DL invariant Assumption OMDL OMDL OMDL none

Algebraic vs. Generic Reductions An algebraic reduction only A generic reduction works regardless of the representation computes group elements using group operations. of the group. φ : G → { 0 , 1 } 2 n � G , g � g x 1 , g x 2 ( x 1 , x 2 ) , g y φ ( g x 1 ) , φ ( g x 2 ) φ ( g a ) , φ ( g b ) , ◦ R O R Ext φ ( g a ◦ g b ) g y y φ ( g y )

So... GGM? No! φ ( A ) , φ ( B ) ( φ ( i ) , φ ( j ) , ◦ ) O φ ( i ◦ j ) R φ ( C ) , φ ( D )

So... GGM? No! φ ( A ) , φ ( B ) ( φ ( i ) , φ ( j ) , ◦ ) O φ ( i ◦ j ) R A φ ( C ) , φ ( D )

So... GGM? No! A, B φ ( A ) , φ ( B ) ( φ ( i ) , φ ( j ) , ◦ ) O φ ( i ◦ j ) R φ ( X ) , m, ω X, m, ω A ( φ ( R ) , y ) ( R, y ) φ ( C ) , φ ( D ) C, D

So... GGM? No! A, B φ ( A ) , φ ( B ) ( φ ( i ) , φ ( j ) , ◦ ) O φ ( i ◦ j ) R φ ( X ) , m, ω X, m, ω A ( φ ( R ) , y ) ( R, y ) φ ( C ) , φ ( D ) C, D

Ok, so how does it work? Vanilla Reductions proc A ( X, m, ω ) ( R 1 , . . . , R q ) ← G q for all i ∈ [ q ] c i = H ( R i , m ) α ← [ q ] y := log g X c α R α return ( R α , y ) .

Ok, so how does it work? Vanilla Reductions Vanilla Reduction: ◮ Runs A once ◮ Does not rewind Result: ◮ Rules out all generic vanilla reductions ◮ Even tight reductions

Ok, so how does it work? Vanilla Reductions proc A ( X, m, ω ) ( R 1 , . . . , R q ) ← G q for all i ∈ [ q ] c i = H ( R i , m ) α ← [ q ] y := log g X c α R α return ( R α , y ) .

Ok, so how does it work? Vanilla Reductions C 1 , . . . , C u , C ′ L G L E φ ( C 1 ) , . . . , φ ( C u ) , C ′ M C 1 E 1 . . . . . . C u E u O R 1 E u +1 R . . . . . . R q E u + q A

Ok, so how does it work? Vanilla Reductions C 1 , . . . , C u , C ′ L G L E φ ( C 1 ) , . . . , φ ( C u ) , C ′ M C 1 E 1 . . . . . . ( E i , E j , × ) C u E u O R 1 E u +1 E u + q +1 R . . . . . . R q E u + q A E u + q +1 A

Ok, so how does it work? Vanilla Reductions C 1 , . . . , C u , C ′ L G L E φ ( C 1 ) , . . . , φ ( C u ) , C ′ M C 1 E 1 . . . . . . ( E i , E j , × ) C u E u O R 1 E u +1 E u + q +1 R . . . . . . R q E u + q φ ( X ) , m A E u + q +1 A ( φ ( R ) , y )

Ok, so how does it work? Vanilla Reductions C 1 , . . . , C u , C ′ L G L E L V φ ( C 1 ) , . . . , φ ( C u ) , C ′ M C 1 E 1 (1 , 0 , ... ) . . . . . . . . . ( E i , E j , × ) C u E u ( ..., 0 , 1 , 0 , ... ) O R 1 E u +1 ( ..., 0 , 1 , 0 , ... ) E u + q +1 R . . . . . . . . . R q E u + q ( ..., 0 , 1) φ ( X ) , m A E u + q +1 V i + V j A ( φ ( R ) , y )

Ok, so how does it work? Vanilla Reductions proc A ( φ ( X ) , m, ω ) : for all i ∈ [ q ] L G L E L V . . . c i = R . H ( φ ( R i ) , m ) . . . . . . α ← [ q ] R α E u + α V u + α . . . y := log g X c α R α . . . . . . G u + q +1 E u + q +1 V u + q +1

Ok, so how does it work? Vanilla Reductions proc A ( φ ( X ) , m, ω ) : for all i ∈ [ q ] L G L E L V . . . c i = R . H ( φ ( R i ) , m ) . . . . . . α ← [ q ] R α E u + α V u + α . . . R ∗ α := g y X − c α . . . y ← Z p ; . . . G u + q +1 E u + q +1 V u + q +1

Ok, so how does it work? Vanilla Reductions proc A ( φ ( X ) , m, ω ) : for all i ∈ [ q ] L G L E L V . . . c i = R . H ( φ ( R i ) , m ) . . . . . . α ← [ q ] R ∗ E u + α V u + α α . . . R ∗ α := g y X − c α . . . y ← Z p ; . . . G u + q +1 E u + q +1 V u + q +1

Ok, so how does it work? Vanilla Reductions proc A ( φ ( X ) , m, ω ) : for all i ∈ [ q ] L G L E L V . . . c i = R . H ( φ ( R i ) , m ) . . . . . . α ← [ q ] R ∗ E u + α V u + α α . . . R ∗ α := g y X − c α . . . y ← Z p ; . . . G u + q +1 E u + q +1 V u + q +1 for j = 1 , . . . , |L G | do u + q V j � G i := i · G j j =1 return ( y, φ ( R ∗ α ))

Will this not trip up the Reduction? R is only able to notice the reprogramming if there exist i, j such that G i = G j before the reprogramming and G i � = G j after reprogramming, or the other way round. This happens with probability at most 2( u + q + t R ) 2 ≤ negl p

Summary & Conclusion The security of Schnorr signatures cannot be reduced to any representation invariant assumption tighter than O (1 /q ) using a generic fully blackbox reduction.

Thank You! Nils Fleischhacker fleischhacker@cs.uni-saarland.de