Robust Password- Protected Secret Sharing Michel Abdalla, Mario - PowerPoint PPT Presentation

Robust Password- Protected Secret Sharing Michel Abdalla, Mario Cornejo, Anca Ni ţ ulescu, David Pointcheval École Normale Supérieure, CNRS and INRIA, Paris, France R E S E A R C H U N I V E R S I T Y

PPSS: Motivation Cloud provider medical top secret taxes paychecks records documents

PPSS: Motivation Cloud provider medical top secret taxes paychecks records documents

PPSS: Motivation Cloud provider medical top secret taxes paychecks records documents Everyone might have access to the data

PPSS: Motivation Cloud provider medical top secret taxes paychecks records documents

PPSS: Motivation Cloud provider medical top secret taxes paychecks records documents Provider still has access to the data

PPSS: Motivation Cloud provider medical top secret taxes paychecks records documents

PPSS: Motivation Cloud provider medical top secret taxes paychecks records documents

PPSS: Motivation Cloud provider medical top secret taxes paychecks records documents • We can remember just low-entropy passwords (and not too many). • Humans cannot remember large secret keys. • Provider/authorities might perform an offline dictionary attack.

PPSS: Motivation Cloud provider medical top secret taxes paychecks records documents • USB Tokens might not be always available. • Tokens might fall into the wrong hands. • Large keys give better security.

PPSS: Password-Protected Secret Sharing Cloud provider taxes

PPSS: Password-Protected Secret Sharing Cloud provider • User creates a cryptographic key. taxes

PPSS: Password-Protected Secret Sharing Cloud provider • User creates a cryptographic key. • Encrypts her data using this key. taxes

PPSS: Password-Protected Secret Sharing Keys store Cloud provider … • User creates a cryptographic key. • Encrypts her data using this key. • Stores her secret key into servers n by using her password and some public information. taxes

PPSS: Password-Protected Secret Sharing Keys store Cloud provider … taxes • User creates a cryptographic key. • Encrypts her data using this key. • Stores her secret key into servers n by using her password and some public information. • Stores the data into the provider.

PPSS: Password-Protected Secret Sharing Keys store Cloud provider … • After interactions using her t + 1 password, the user can recover her secret key taxes

PPSS: Password-Protected Secret Sharing Keys store Cloud provider … • After interactions using her t + 1 password, the user can recover her secret key taxes

PPSS: Properties • A PPSS scheme defines two steps: Initialization : Secret & password are processed Reconstruction : The user can recover the secret by interacting with a subset of servers. t + 1 • Additional properties: Soundness : Even if the adversary cannot make the user recover a different secret. Robustness : The recovery is guaranteed if there are s non-corrupt servers. t + 1

PPSS: Instantiations of PPSS Scheme Messages Client inter-server Robust ZKP BJSL11 4 PKI PKI No Costly CLLN14 10 Std PKI No Costly JKK14 2 CRS None Yes Costly JKKX16 2 CRS None No No

PPSS: Instantiations of PPSS Scheme Messages Client inter-server Robust ZKP BJSL11 4 PKI PKI No Costly CLLN14 10 Std PKI No Costly JKK14 2 CRS None Yes Costly JKKX16 2 CRS None No No This work 2 CRS None Yes No

Robust Password-Protected Secret Sharing PPSS OPRF Robust Gap Secret Sharing Secret Sharing Scheme

Robust Password-Protected Secret Sharing PPSS OPRF Robust Gap Secret Sharing Secret Sharing Scheme

Robust Password-Protected Secret Sharing PPSS OPRF Robust Gap Secret Sharing Secret Sharing Scheme

Robust Password-Protected Secret Sharing PPSS OPRF Robust Gap Secret Sharing Secret Sharing Scheme

PPSS: Secret Sharing Scheme s 1 s 2 Secret s 3 … s n

PPSS: Secret Sharing Scheme s 1 s 2 Secret s 3 … s n

PPSS: Robust Gap Secret Sharing Scheme How do we implement robustness?

PPSS: Robust Gap Secret Sharing Scheme Assume a set of valid shares from a Threshold SSS s 1 s 2 s 3 … s n ( s 1 , . . . , s n )

PPSS: Robust Gap Secret Sharing Scheme Fingerprint function: Hash function s 1 σ 1 s 2 σ 2 s 3 σ 3 … s n σ n ( s 1 , . . . , s n ) ( σ 1 , . . . , σ n )

PPSS: Robust Gap Secret Sharing Scheme 2 2 k ( n − t r )+1 < N ≤ 2 2 k ( n − t r )+2 Generate a prime number N s 1 σ 1 s 2 σ 2 × S s 3 σ 3 … s n σ n S = Q n ( s 1 , . . . , s n ) ( σ 1 , . . . , σ n ) i =1 σ i mod N

PPSS: Robust Gap Secret Sharing Scheme 2 2 k ( n − t r )+1 < N ≤ 2 2 k ( n − t r )+2 Generate a prime number N s 1 σ 1 Output: s 2 σ 2 … s 1 s 2 s 3 { s k } n = s n × S s 3 σ 3 SSInfo = ( S , N ) { } S N … , s n σ n S = Q n ( s 1 , . . . , s n ) ( σ 1 , . . . , σ n ) i =1 σ i mod N

PPSS: Robust Gap Secret Sharing Scheme How can we decide which are the valid sets of shares to reconstruct?

PPSS: Robust Gap Secret Sharing Scheme Given SSInfo = ( S , N ) { } S N , s 1 s 2 s 3 … s n

PPSS: Robust Gap Secret Sharing Scheme Given SSInfo = ( S , N ) { } S N , s 1 τ 1 s 2 τ 2 s 3 τ 3 … s n τ n

PPSS: Robust Gap Secret Sharing Scheme Given SSInfo = ( S , N ) { } S N , s 1 τ 1 s 2 τ 2 × T s 3 τ 3 … s n τ n

PPSS: Robust Gap Secret Sharing Scheme Given SSInfo = ( S , N ) { } S N , T γ = S

PPSS: Robust Gap Secret Sharing Scheme Given SSInfo = ( S , N ) { } S N , T … τ 2 τ 3 τ n τ 1 γ = = S … σ 2 σ 3 σ n σ 1

PPSS: Robust Gap Secret Sharing Scheme Given SSInfo = ( S , N ) { } S N , T T 0 … τ 2 τ 3 τ n τ 1 γ = = = S 0 S … σ 2 σ 3 σ n σ 1

PPSS: Robust Gap Secret Sharing Scheme Given SSInfo = ( S , N ) { } S N , T T 0 … τ 2 τ 3 τ n τ 1 γ = = = S 0 S … σ 2 σ 3 σ n σ 1 | gcd( τ 1 , ) | ≈ 1 T 0

PPSS: Robust Gap Secret Sharing Scheme Given SSInfo = ( S , N ) { } S N , T T 0 … τ 2 τ 3 τ n τ 1 γ = = = S 0 S … σ 2 σ 3 σ n σ 1 Correct fingerprint! | gcd( τ 1 , ) | ≈ 1 T 0

PPSS: Robust Gap Secret Sharing Scheme Given SSInfo = ( S , N ) { } S N , T T 0 … τ 2 τ 3 τ n τ 1 γ = = = S 0 S … σ 2 σ 3 σ n σ 1 Correct fingerprint! | gcd( τ 1 , ) | ≈ 1 T 0 | gcd( ) | ≈ Incorrect fingerprint! T 0 k τ 2 ,

PPSS: Robust Gap Secret Sharing Scheme Given SSInfo = ( S , N ) { } S N , T T 0 … τ 2 τ 3 τ n τ 1 γ = = = S 0 S … σ 2 σ 3 σ n σ 1 Correct fingerprint! | gcd( τ 1 , ) | ≈ 1 T 0 | gcd( ) | ≈ Incorrect fingerprint! T 0 k τ 2 , Correct fingerprint! | gcd( ) | ≈ 1 T 0 τ 3 ,

PPSS: Oblivious PRF sk pw F F ( sk , pw ) • The output is indistinguishable from random • The server learns nothing

PPSS: Password-Protected Secret Sharing Initialization phase

PPSS: Initialization The user interacts with servers to obliviously evaluate the PRF n ( pk 1 , sk 1 ) ( pk 2 , sk 2 ) ( pk n , sk n ) …

PPSS: Initialization The user interacts with servers to obliviously evaluate the PRF n ( pk 1 , sk 1 ) ( pk 2 , sk 2 ) ( pk n , sk n ) … π 1 = F sk 1 ( pw ) pw

PPSS: Initialization The user interacts with servers to obliviously evaluate the PRF n ( pk 1 , sk 1 ) ( pk 2 , sk 2 ) ( pk n , sk n ) … π 1 = F sk 1 ( pw ) π 2 = F sk 2 ( pw ) pw

PPSS: Initialization The user interacts with servers to obliviously evaluate the PRF n ( pk 1 , sk 1 ) ( pk 2 , sk 2 ) ( pk n , sk n ) … π 1 = F sk 1 ( pw ) π 2 = F sk 2 ( pw ) π n = F sk n ( pw ) pw

PPSS: Initialization Each share is encrypted using the each PRF evaluation ( pk 1 , sk 1 ) ( pk 2 , sk 2 ) ( pk n , sk n ) … π 1 = F sk 1 ( pw ) π 2 = F sk 2 ( pw ) π n = F sk n ( pw ) R = K || r pw { π k } n { pk k } n

PPSS: Initialization Each share is encrypted using the each PRF evaluation ( pk 1 , sk 1 ) ( pk 2 , sk 2 ) ( pk n , sk n ) … π 1 = F sk 1 ( pw ) π 2 = F sk 2 ( pw ) π n = F sk n ( pw ) R = K || r ( s 1 , . . . , s n , SSInfo ) ← ShareGen ( R ) pw { π k } n { pk k } n

PPSS: Initialization Each share is encrypted using the each PRF evaluation ( pk 1 , sk 1 ) ( pk 2 , sk 2 ) ( pk n , sk n ) … π 1 = F sk 1 ( pw ) π 2 = F sk 2 ( pw ) π n = F sk n ( pw ) R = K || r ( s 1 , . . . , s n , SSInfo ) ← ShareGen ( R ) σ k = π k ⊕ s k pw { π k } n { pk k } n

PPSS: Initialization The user computes a commitment ( pk 1 , sk 1 ) ( pk 2 , sk 2 ) ( pk n , sk n ) … C = Commit ( pw, H ( { pk k } n , { σ k } n , SSInfo , K ); r ) pw { π k } n { pk k } n { σ k } n K r SSInfo

PPSS: Initialization The user uploads the encrypted data ( pk 1 , sk 1 ) ( pk 2 , sk 2 ) ( pk n , sk n ) … PInfo PInfo PInfo PInfo = ( { pk k } n , { σ k } n , SSInfo , C ) pw { π k } n { pk k } n { σ k } n K r SSInfo C

PPSS: Password-Protected Secret Sharing Reconstruction phase

PPSS: Reconstruction The user interacts with the server ( pk 1 , sk 1 ) ( pk 2 , sk 2 ) ( pk n , sk n ) … PInfo PInfo PInfo π 1 = F sk 1 ( pw ) PInfo pw