Overcoming Impossibility Results in Composable Security using Interval-Wise Guarantees Daniel Jost Ueli Maurer ETH Zurich Crypto 2020, August 17-21, 2020
Motivation: how to best define security? Aug 17, 2020 2 Daniel Jost
Defining Security Game-based security: • Simple and minimal • no direct link to real-world executions • many games • no composition Aug 17, 2020 3 Daniel Jost
Defining Security Game-based security: Composable security: • Guarantees linked to real-world application • Simple and minimal • Modularization • Composition • • More complicated proofs no direct link to real-world executions • Less efficient schemes • many games • Impossibility results • no composition Aug 17, 2020 4 Daniel Jost
Defining Security Game-based security: Composable security: • Guarantees linked to real-world application • Simple and minimal • Modularization • Composition • • More complicated proofs no direct link to real-world executions • Less efficient schemes • many games • Impossibility results • no composition Simulator-commitment problem Aug 17, 2020 5 Daniel Jost
The Commitment Problem • Example : − encrypting a message to protect confidentiality − where adversaries that can (adaptively) learn parties ’ state (including keys) Key π A π B sim Aug 17, 2020 6 Daniel Jost
The Commitment Problem • Example : − encrypting a message to protect confidentiality − where adversaries that can (adaptively) learn parties ’ state (including keys) (Leakable) key Secure channel Key π A π B sim Authenticated channel Aug 17, 2020 7 Daniel Jost
The Commitment Problem • Example : − encrypting a message to protect confidentiality − where adversaries that can (adaptively) learn parties ’ state (including keys) ? Key ≈ π A π B sim Aug 17, 2020 8 Daniel Jost
The Commitment Problem • Example : − encrypting a message to protect confidentiality − where adversaries that can (adaptively) learn parties ’ state (including keys) 1 Key m m π A π B sim Aug 17, 2020 9 Daniel Jost
The Commitment Problem • Example : − encrypting a message to protect confidentiality − where adversaries that can (adaptively) learn parties ’ state (including keys) 1 Key m m π A π B |m| sim c c 2 without m → committed Aug 17, 2020 10 Daniel Jost
The Commitment Problem • Example : − encrypting a message to protect confidentiality − where adversaries that can (adaptively) learn parties ’ state (including keys) 1 Key m m π A π B |m| m sim c k c 2 3 Aug 17, 2020 11 Daniel Jost
The Commitment Problem • Example : − encrypting a message to protect confidentiality − where adversaries that can (adaptively) learn parties ’ state (including keys) 1 Key m m π A π B |m| m sim c k c Cannot come 2 3 up with k that explains c Aug 17, 2020 12 Daniel Jost
The Commitment Problem Observation: • Example : • Leaking only the messages length (and the simulator creating a fake ciphertext) is − encrypting a message to protect confidentiality used to formalize that the message remains confidential until the key leaks − where adversaries that can (adaptively) learn parties ’ state (including keys) • But it causes problems to simulate after that event… 1 Key m m π A π B |m| m sim c k c Cannot come 2 3 up with k that explains c Aug 17, 2020 13 Daniel Jost
The Commitment Problem • Existing solutions : − Allowing for superpolynomial simulators → Still needs stronger schemes / additional setup − Non-information oracles: embedding game-based notions → Lack of clear composition rules Aug 17, 2020 14 Daniel Jost
Contributions Idea of this paper: Can we make to separate statements? • One up to the moment the key leaks (for confidentiality) • One after the key leaked (about the remaining guarantees) Goal: Non-goals: • Express security guarantees of • Requireing less efficient schemes / «regular» schemes composably additional setup • Fall back to game-based security Open question: How would such a notion fit within a composable framework? Aug 17, 2020 15 Daniel Jost
Specifications: a fresh take on composable security Aug 17, 2020 16 Daniel Jost
Rethinking Composable Security: Specifications a resource Aug 17, 2020 17 Daniel Jost
Rethinking Composable Security: Specifications Subset of resources with the desired properties → specification Set of all resources Aug 17, 2020 18 Daniel Jost
Rethinking Composable Security: Specifications ▪ General statement: specification abstraction ▪ Abstract assumed specification by constructed one ▪ Easier to understand Aug 17, 2020 19 Daniel Jost
Rethinking Composable Security: Specifications ▪ General statement: specification abstraction ▪ Abstract assumed specification by constructed one ▪ Easier to understand Aug 17, 2020 20 Daniel Jost
Rethinking Composable Security: Specifications ▪ General statement: specification abstraction ▪ Abstract assumed specification by constructed one ▪ Easier to understand Aug 17, 2020 21 Daniel Jost
Rethinking Composable Security: Specifications ▪ General statement: specification abstraction ▪ Abstract assumed specification by constructed one ▪ Easier to understand Introduced in Mau- Ren’16 Aug 17, 2020 22 Daniel Jost
Rethinking Composable Security: Specifications ▪ General statement: specification abstraction ▪ Abstract assumed specification by constructed one ▪ Easier to understand ▪ While traditional composable framework have a single type of statement, specifications give us flexibility : ▪ Basic properties and compositional guarantees fixed ▪ But not the types of specifications! Aug 17, 2020 23 Daniel Jost
Rethinking Composable Security: Specifications ▪ Advantages: ▪ Absolute statement: no «forgotten» attacks ▪ Composition: transitivity of subset relation ▪ Intersection Aug 17, 2020 24 Daniel Jost
Rethinking Composable Security: Specifications ▪ Advantages: ▪ Absolute statement: no «forgotten» attacks ▪ Composition: transitivity of subset relation ▪ Intersection ∧ Aug 17, 2020 25 Daniel Jost
Rethinking Composable Security: Specifications ▪ Advantages: ▪ Absolute statement: no «forgotten» attacks ▪ Composition: transitivity of subset relation ▪ Intersection Guarantee 2 Guarantee 1 (e.g confidentiality) (e.g authenticity) Aug 17, 2020 26 Daniel Jost
Simulation-based Security ▪ The standard «simulation-based» notion can be expressed as a special case of specification abstraction: Key ≈ π A π B sim Aug 17, 2020 27 Daniel Jost
Simulation-based Security ▪ The standard «simulation-based» notion can be expressed as a special case of specification abstraction: Key ≈ π A π B sim Aug 17, 2020 28 Daniel Jost
Simulation-based Security ▪ The standard «simulation-based» notion can be expressed as a special case of specification abstraction: Key ≈ π A π B Easy to see what Eve can do sim Aug 17, 2020 29 Daniel Jost
Simulation-based Security ▪ The standard «simulation-based» notion can be expressed as a special case of specification abstraction: Key ≈ π A π B sim Aug 17, 2020 30 Daniel Jost
Simulation-based Security ▪ The standard «simulation-based» notion can be expressed as a special case of specification abstraction: Key ≈ π A π B sim ⊆ Aug 17, 2020 31 Daniel Jost
Simulation-based Security ▪ The standard «simulation-based» notion can be expressed as a special case of specification abstraction: Key ≈ ε -relaxation: π A π B the set of all resources that are computationally indistinguishable to one of the original (green) specification. sim ⊆ Aug 17, 2020 32 Daniel Jost
Simulation-based Security ▪ The ε -relaxation has two important properties: 1. Commutes with protocol application 𝜌 ℛ 𝜗 ⊆ 𝜌ℛ 𝜗 2. Monotonicity: ℛ ⊆ 𝒯 ⟹ ℛ 𝜗 ⊆ 𝑇 𝜗 Aug 17, 2020 33 Daniel Jost
Simulation-based Security ▪ The ε -relaxation has two important properties: 1. Commutes with protocol application 𝜌 ℛ 𝜗 ⊆ 𝜌ℛ 𝜗 • The «standard» composition rule can be recovered as a syntactic derivation rule • In particular simulator and ε -relaxation can be ignored in further construction step 2. Monotonicity: ➔ Having structured specifications is crucial for true modularity! ℛ ⊆ 𝒯 ⟹ ℛ 𝜗 ⊆ 𝑇 𝜗 Aug 17, 2020 34 Daniel Jost
Interval-wise Relaxations Aug 17, 2020 35 Daniel Jost
Interval-wise Guarantees We use this specification based view this to overcome commitment problem! • Recall: cannot simulate across exposure of key Key m 1 π A π B • Solution: we formalize the guarantees before and after 3 2 c k the key exposure as separate specifications: m 1. Confidentiality until the key is exposed |m| m 2. Remaining guarantees afterwards sim c Aug 17, 2020 36 Daniel Jost
Recommend
More recommend
