f − 1 Preimage Sampling ◮ Sample D L , u given any ‘short enough’ basis S : max � ˜ s i � ≤ std dev ⋆ Output distribution leaks no information about S ! ◮ Randomized “nearest-plane” algorithm [Babai’86,Klein’00,GPV’08] s 2 u s 1 10 / 23
f − 1 Preimage Sampling ◮ Sample D L , u given any ‘short enough’ basis S : max � ˜ s i � ≤ std dev ⋆ Output distribution leaks no information about S ! ◮ Randomized “nearest-plane” algorithm [Babai’86,Klein’00,GPV’08] s 2 u s 1 ◮ Proof idea: D L , u ( plane ) depends only on dist ( u , plane ) 10 / 23
f − 1 Preimage Sampling ◮ Sample D L , u given any ‘short enough’ basis S : max � ˜ s i � ≤ std dev ⋆ Output distribution leaks no information about S ! ◮ Randomized “nearest-plane” algorithm [Babai’86,Klein’00,GPV’08] s 2 u s 1 ◮ Proof idea: D L , u ( plane ) depends only on dist ( u , plane ) ◮ [P’10] : Efficient & parallel algorithm for std dev ≥ s 1 ( S ) ≈ max � ˜ s i � 10 / 23
A Secure Instantiation [Ajtai96,. . . ] ◮ Let n = sec param, q = poly ( n ) − → additive group Z n q 11 / 23
A Secure Instantiation [Ajtai96,. . . ] ◮ Let n = sec param, q = poly ( n ) − → additive group Z n q q , consider integer solutions z ∈ Z m of: ◮ Given a 1 , . . . , a m ∈ Z n | | | | mod q f A ( z ) := Az = · · · = a 1 a 2 a m z 0 | | | | � �� � m ≫ n 11 / 23
A Secure Instantiation [Ajtai96,. . . ] ◮ Let n = sec param, q = poly ( n ) − → additive group Z n q q , consider integer solutions z ∈ Z m of: ◮ Given a 1 , . . . , a m ∈ Z n | | | | mod q f A ( z ) := Az = · · · = a 1 a 2 a m z 0 | | | | � �� � m ≫ n Easy to find a ‘long’ solution: e.g., z = ( q , 0 , . . . , 0 ) — but very hard to find a ‘short’ one! 11 / 23
A Secure Instantiation [Ajtai96,. . . ] ◮ Let n = sec param, q = poly ( n ) − → additive group Z n q q , consider integer solutions z ∈ Z m of: ◮ Given a 1 , . . . , a m ∈ Z n | | | | mod q f A ( z ) := Az = · · · = a 1 a 2 a m z 0 | | | | � �� � m ≫ n Easy to find a ‘long’ solution: e.g., z = ( q , 0 , . . . , 0 ) — but very hard to find a ‘short’ one! Theorem: Worst-Case/Average-Case [Ajtai’96,. . . ,MR’04,GPV’08] For uniform A and q ≥ β √ n , finding solution z � = 0 where � z � ≤ β ⇓ Solving β √ n -approx GapSVP & more, on any n -dim lattice! 11 / 23
A Secure Instantiation [Ajtai96,. . . ] ◮ Let n = sec param, q = poly ( n ) − → additive group Z n q q , consider integer solutions z ∈ Z m of: ◮ Given a 1 , . . . , a m ∈ Z n | | | | mod q f A ( z ) := Az = · · · = a 1 a 2 a m z 0 | | | | � �� � m ≫ n Putting it all together: ( 0 , q ) 1 Solutions z form a ‘hard’ lattice L ⊆ Z m ( q , 0 ) O 11 / 23
A Secure Instantiation [Ajtai96,. . . ] ◮ Let n = sec param, q = poly ( n ) − → additive group Z n q q , consider integer solutions z ∈ Z m of: ◮ Given a 1 , . . . , a m ∈ Z n | | | | mod q f A ( z ) := Az = · · · = a 1 a 2 a m z 0 | | | | � �� � m ≫ n Putting it all together: ( 0 , q ) 1 Solutions z form a ‘hard’ lattice L ⊆ Z m [Ajtai’99,AlwenP’09] : can generate uniform A 2 s 2 together with a short basis S (i.e., AS = 0 ). ( q , 0 ) O s 1 11 / 23
A Secure Instantiation [Ajtai96,. . . ] ◮ Let n = sec param, q = poly ( n ) − → additive group Z n q q , consider integer solutions z ∈ Z m of: ◮ Given a 1 , . . . , a m ∈ Z n | | | | mod q f A ( z ) := Az = · · · = a 1 a 2 a m z 0 | | | | � �� � m ≫ n Putting it all together: ( 0 , q ) 1 Solutions z form a ‘hard’ lattice L ⊆ Z m [Ajtai’99,AlwenP’09] : can generate uniform A 2 together with a short basis S (i.e., AS = 0 ). x 3 Gaussian x ↔ syndrome u = Ax = f A ( x ) ( q , 0 ) O 11 / 23
A Secure Instantiation [Ajtai96,. . . ] ◮ Let n = sec param, q = poly ( n ) − → additive group Z n q q , consider integer solutions z ∈ Z m of: ◮ Given a 1 , . . . , a m ∈ Z n | | | | mod q f A ( z ) := Az = · · · = a 1 a 2 a m z 0 | | | | � �� � m ≫ n Putting it all together: ( 0 , q ) 1 Solutions z form a ‘hard’ lattice L ⊆ Z m [Ajtai’99,AlwenP’09] : can generate uniform A 2 together with a short basis S (i.e., AS = 0 ). x 3 Gaussian x ↔ syndrome u = Ax = f A ( x ) ( q , 0 ) O ⋆ Given u , hard to find short x ∈ f − 1 A ( u ) . ⋆ But given basis S , can sample f − 1 A ( u ) ! 11 / 23
Part 2: Identity-Based Encryption 12 / 23
Identity-Based Encryption ◮ Proposed by [Shamir’84] : 13 / 23
Identity-Based Encryption ◮ Proposed by [Shamir’84] : ⋆ ‘Master’ keys mpk (public) and msk (held by trusted authority) 13 / 23
Identity-Based Encryption ◮ Proposed by [Shamir’84] : ⋆ ‘Master’ keys mpk (public) and msk (held by trusted authority) ⋆ Given mpk , can encrypt to ID “Alice” or “Bob” or . . . 13 / 23
Identity-Based Encryption ◮ Proposed by [Shamir’84] : ⋆ ‘Master’ keys mpk (public) and msk (held by trusted authority) ⋆ Given mpk , can encrypt to ID “Alice” or “Bob” or . . . ⋆ Using msk , authority can calculate sk Alice or sk Bob or . . . 13 / 23
Identity-Based Encryption ◮ Proposed by [Shamir’84] : ⋆ ‘Master’ keys mpk (public) and msk (held by trusted authority) ⋆ Given mpk , can encrypt to ID “Alice” or “Bob” or . . . ⋆ Using msk , authority can calculate sk Alice or sk Bob or . . . ⋆ Messages to Carol remain secret, even given sk Alice , sk Bob , . . . 13 / 23
Identity-Based Encryption ◮ Proposed by [Shamir’84] : ⋆ ‘Master’ keys mpk (public) and msk (held by trusted authority) ⋆ Given mpk , can encrypt to ID “Alice” or “Bob” or . . . ⋆ Using msk , authority can calculate sk Alice or sk Bob or . . . ⋆ Messages to Carol remain secret, even given sk Alice , sk Bob , . . . (Fast-forward 17 years. . . ) 13 / 23
Identity-Based Encryption ◮ Proposed by [Shamir’84] : ⋆ ‘Master’ keys mpk (public) and msk (held by trusted authority) ⋆ Given mpk , can encrypt to ID “Alice” or “Bob” or . . . ⋆ Using msk , authority can calculate sk Alice or sk Bob or . . . ⋆ Messages to Carol remain secret, even given sk Alice , sk Bob , . . . (Fast-forward 17 years. . . ) ◮ [BonehFranklin’01,. . . ] : construction using bilinear pairings 13 / 23
Identity-Based Encryption ◮ Proposed by [Shamir’84] : ⋆ ‘Master’ keys mpk (public) and msk (held by trusted authority) ⋆ Given mpk , can encrypt to ID “Alice” or “Bob” or . . . ⋆ Using msk , authority can calculate sk Alice or sk Bob or . . . ⋆ Messages to Carol remain secret, even given sk Alice , sk Bob , . . . (Fast-forward 17 years. . . ) ◮ [BonehFranklin’01,. . . ] : construction using bilinear pairings ◮ [Cocks’01,BGH’07] : quadratic residuosity (mod N = pq ) 13 / 23
Identity-Based Encryption ◮ Proposed by [Shamir’84] : ⋆ ‘Master’ keys mpk (public) and msk (held by trusted authority) ⋆ Given mpk , can encrypt to ID “Alice” or “Bob” or . . . ⋆ Using msk , authority can calculate sk Alice or sk Bob or . . . ⋆ Messages to Carol remain secret, even given sk Alice , sk Bob , . . . (Fast-forward 17 years. . . ) ◮ [BonehFranklin’01,. . . ] : construction using bilinear pairings ◮ [Cocks’01,BGH’07] : quadratic residuosity (mod N = pq ) ◮ [GPV’08] : lattices! 13 / 23
‘Learning With Errors’ (LWE) Problem [Regev’05] ◮ Secret s ∈ Z n q , uniform a i ∈ Z n (here q is prime) q 14 / 23
‘Learning With Errors’ (LWE) Problem [Regev’05] ◮ Secret s ∈ Z n q , uniform a i ∈ Z n (here q is prime) q ◮ Goal: distinguish ( a i , b i = � a i , s � + e i ) from uniform ( a i , b i ) b 1 = � a 1 , s � + e 1 a 1 , a 2 , b 2 = � a 2 , s � + e 2 . . . √ n ≤ error ≪ q 14 / 23
‘Learning With Errors’ (LWE) Problem [Regev’05] ◮ Secret s ∈ Z n q , uniform a i ∈ Z n (here q is prime) q ◮ Goal: distinguish ( A , b = A t s + e ) from uniform ( A , b ) . . . . . . A t = A t s + e m , b . . . . . . √ n ≤ error ≪ q 14 / 23
‘Learning With Errors’ (LWE) Problem [Regev’05] ◮ Secret s ∈ Z n q , uniform a i ∈ Z n (here q is prime) q ◮ Goal: distinguish ( A , b = A t s + e ) from uniform ( A , b ) . . . . . . A t = A t s + e m , b . . . . . . √ n ≤ error ≪ q ◮ Recall: as hard as worst-case lattice problems [Regev’05,P’09] 14 / 23
‘Learning With Errors’ (LWE) Problem [Regev’05] ◮ Secret s ∈ Z n q , uniform a i ∈ Z n (here q is prime) q ◮ Goal: distinguish ( A , b = A t s + e ) from uniform ( A , b ) . . . . . . A t = A t s + e m , b . . . . . . √ n ≤ error ≪ q ◮ Recall: as hard as worst-case lattice problems [Regev’05,P’09] ◮ Observe: given short nonzero z ∈ Z m such that Az = 0 mod q , � z , b � = � Az , s � + � z , e � ≈ 0 mod q � z , b � = uniform mod q 14 / 23
‘Learning With Errors’ (LWE) Problem [Regev’05] ◮ Secret s ∈ Z n q , uniform a i ∈ Z n (here q is prime) q ◮ Goal: distinguish ( A , b = A t s + e ) from uniform ( A , b ) . . . . . . A t = A t s + e m , b . . . . . . √ n ≤ error ≪ q ◮ Recall: as hard as worst-case lattice problems [Regev’05,P’09] ◮ Observe: given short nonzero z ∈ Z m such that Az = 0 mod q , � z , b � = � Az , s � + � z , e � ≈ 0 mod q � z , b � = uniform mod q = ⇒ z is a ‘weak’ trapdoor, for distinguishing LWE from uniform 14 / 23
Warm-Up: Public-Key Encryption A x ← Gauss s , e 15 / 23
Warm-Up: Public-Key Encryption A x ← Gauss s , e u = Ax = f A ( x ) (public key) 15 / 23
Warm-Up: Public-Key Encryption A x ← Gauss s , e u = Ax = f A ( x ) (public key) b = A t s + e (ciphertext ‘preamble’) 15 / 23
Warm-Up: Public-Key Encryption A x ← Gauss s , e u = Ax = f A ( x ) (public key) b = A t s + e (ciphertext ‘preamble’) b ′ = � u , s � + e ′ (‘pad’) 15 / 23
Warm-Up: Public-Key Encryption A x ← Gauss s , e u = Ax = f A ( x ) (public key) b = A t s + e (ciphertext ‘preamble’) b ′ + bit · ⌊ q 2 ⌋ b ′ = � u , s � + e ′ (‘payload’) (‘pad’) 15 / 23
Warm-Up: Public-Key Encryption A x ← Gauss s , e u = Ax = f A ( x ) (public key) b = A t s + e (ciphertext ‘preamble’) b ′ + bit · ⌊ q 2 ⌋ b ′ = � u , s � + e ′ � x , b � ≈ � u , s � (‘payload’) (‘pad’) 15 / 23
Warm-Up: Public-Key Encryption A x ← Gauss s , e u = Ax = f A ( x ) (public key) b = A t s + e (ciphertext ‘preamble’) b ′ + bit · ⌊ q 2 ⌋ b ′ = � u , s � + e ′ � x , b � ≈ � u , s � (‘payload’) (‘pad’) ? ( A , u , b , b ′ ) 15 / 23
Warm-Up: Public-Key Encryption A x ← Gauss s , e u = Ax = f A ( x ) (public key) b = A t s + e (ciphertext ‘preamble’) b ′ + bit · ⌊ q 2 ⌋ b ′ = � u , s � + e ′ � x , b � ≈ � u , s � (‘payload’) (‘pad’) ? ( A , u , b , b ′ ) 15 / 23
ID-Based Encryption x ← f − 1 A ( u ) mpk = A s , e u = H ( “Alice” ) (‘identity’ key) b = A t s + e (ciphertext randomness) b ′ + bit · ⌊ q 2 ⌋ b ′ = � u , s � + e ′ � x , b � ≈ � u , s � (‘payload’) (‘pad’) 16 / 23
Part 3: Bonsai Trees: Removing the Random Oracle and More Advanced Applications 17 / 23
CONTROLLED or NATURAL ? 18 / 23
CONTROLLED or NATURAL ? ◮ Bonsai: collection of techniques for selective control of tree growth, for the creation of natural aesthetic forms 18 / 23
Bonsai Trees in Cryptography f ε f 0 f 1 f 00 f 01 f 10 f 11 1 Hierarchy of TDFs (Functions specified by public key, random oracle, interaction, . . . ) 19 / 23
Bonsai Trees in Cryptography f ε f 0 f 1 f 00 f 01 f 10 f 11 1 Hierarchy of TDFs (Functions specified by public key, random oracle, interaction, . . . ) 2 Techniques for selective ‘control’ of growth & delegation of control 19 / 23
Bonsai Trees in Cryptography f ε f 0 f 1 f 00 f 01 f 10 f 11 1 Hierarchy of TDFs (Functions specified by public key, random oracle, interaction, . . . ) 2 Techniques for selective ‘control’ of growth & delegation of control 3 Applications: ‘hash-and-sign,’ (hierarchical) IBE — all without random oracles! 19 / 23
Bonsai Trees: Abstract Properties f ε f 0 f 1 f 00 f 01 f 10 f 11 20 / 23
Bonsai Trees: Abstract Properties f ε f 0 f 1 f 00 f 01 f 10 f 11 1 Controlling f v (knowing trapdoor) = ⇒ controlling f vz , for all z . 20 / 23
Bonsai Trees: Abstract Properties f ε f 0 f 1 f 00 f 01 f 10 f 11 1 Controlling f v (knowing trapdoor) = ⇒ controlling f vz , for all z . 2 Can grow a controlled branch off of any uncontrolled node. 20 / 23
Bonsai Trees: Abstract Properties f ε f 0 f 1 f 00 f 01 f 10 f 11 1 Controlling f v (knowing trapdoor) = ⇒ controlling f vz , for all z . 2 Can grow a controlled branch off of any uncontrolled node. (Allows simulation to embed its challenge into the tree, while still being able to answer queries.) 20 / 23
Bonsai Trees: Abstract Properties f ε f 0 f 1 f 00 f 01 f 10 f 11 1 Controlling f v (knowing trapdoor) = ⇒ controlling f vz , for all z . 2 Can grow a controlled branch off of any uncontrolled node. (Allows simulation to embed its challenge into the tree, while still being able to answer queries.) 3 Can delegate control of any subtree, w/o endangering ancestors. 20 / 23
Bonsai Trees: Realization Property 1: Control f v ⇒ Control f vz Short basis S 1 for A 1 ⇒ short basis S for A = [ A 1 | A 2 ] , for any A 2 . 21 / 23
Bonsai Trees: Realization Property 1: Control f v ⇒ Control f vz Short basis S 1 for A 1 ⇒ short basis S for A = [ A 1 | A 2 ] , for any A 2 . ◮ Using S 1 , compute a short integer soln X to A 1 X = − A 2 mod q . Then: � S 1 � X A · S = [ A 1 | A 2 ] · = 0 mod q . 0 I � �� � S 21 / 23
Bonsai Trees: Realization Property 1: Control f v ⇒ Control f vz Short basis S 1 for A 1 ⇒ short basis S for A = [ A 1 | A 2 ] , for any A 2 . ◮ Using S 1 , compute a short integer soln X to A 1 X = − A 2 mod q . Then: � S 1 � X A · S = [ A 1 | A 2 ] · = 0 mod q . 0 I � �� � S � ˜ (In fact, X need not be short — we have ˜ , so � ˜ S � = � ˜ S 1 0 � S = S 1 � .) 0 I 21 / 23
Bonsai Trees: Realization Property 1: Control f v ⇒ Control f vz Short basis S 1 for A 1 ⇒ short basis S for A = [ A 1 | A 2 ] , for any A 2 . ◮ Using S 1 , compute a short integer soln X to A 1 X = − A 2 mod q . Then: � S 1 � X A · S = [ A 1 | A 2 ] · = 0 mod q . 0 I � �� � S � ˜ (In fact, X need not be short — we have ˜ , so � ˜ S � = � ˜ S 1 0 � S = S 1 � .) 0 I Property 2: Grow a Controlled Branch Given (uncontrolled) A 1 , create controlled extension A = [ A 1 | A 2 ] . 21 / 23
Bonsai Trees: Realization Property 1: Control f v ⇒ Control f vz Short basis S 1 for A 1 ⇒ short basis S for A = [ A 1 | A 2 ] , for any A 2 . ◮ Using S 1 , compute a short integer soln X to A 1 X = − A 2 mod q . Then: � S 1 � X A · S = [ A 1 | A 2 ] · = 0 mod q . 0 I � �� � S � ˜ (In fact, X need not be short — we have ˜ , so � ˜ S � = � ˜ S 1 0 � S = S 1 � .) 0 I Property 2: Grow a Controlled Branch Given (uncontrolled) A 1 , create controlled extension A = [ A 1 | A 2 ] . ◮ Just generate A 2 with short basis S 2 . Then use above technique to control A ! 21 / 23
Bonsai Trees: Realization Property 1: Control f v ⇒ Control f vz Short basis S 1 for A 1 ⇒ short basis S for A = [ A 1 | A 2 ] , for any A 2 . ◮ Using S 1 , compute a short integer soln X to A 1 X = − A 2 mod q . Then: � S 1 � X A · S = [ A 1 | A 2 ] · = 0 mod q . 0 I � �� � S � ˜ (In fact, X need not be short — we have ˜ , so � ˜ S � = � ˜ S 1 0 � S = S 1 � .) 0 I Property 3: Securely Delegate Control ? ◮ Basis S contains S 1 , so unsafe to reveal! 21 / 23
Bonsai Trees: Realization Property 1: Control f v ⇒ Control f vz Short basis S 1 for A 1 ⇒ short basis S for A = [ A 1 | A 2 ] , for any A 2 . ◮ Using S 1 , compute a short integer soln X to A 1 X = − A 2 mod q . Then: � S 1 � X A · S = [ A 1 | A 2 ] · = 0 mod q . 0 I � �� � S � ˜ (In fact, X need not be short — we have ˜ , so � ˜ S � = � ˜ S 1 0 � S = S 1 � .) 0 I Property 3: Securely Delegate Control ? ◮ Basis S contains S 1 , so unsafe to reveal! Solution: Use S to sample new Gaussian basis. 21 / 23
Recommend
More recommend
