Updatable Encryption with Post-Compromise Security Anja Lehmann - PowerPoint PPT Presentation

Updatable Encryption with Post-Compromise Security Anja Lehmann & Björn Tackmann IBM Research – Zurich

Motivation | Outsourced Storage ▪ Data owner stores encrypted data at (untrusted) data host symmetric encryption ▪ Proactive security by periodically changing the secret key – Key rotation reduces risk & impact of key or data exposure ▪ Key rotation often mandated in high-security environments and by PCI DSS 2

Motivation | Key Rotation ▪ How to update exiting ciphertexts to the new key? ▪ Standard symmetric encryption → download all ciphertext & re-encrypt from scratch ▪ Inefficient: down&upload of all ciphertexts, symmetric key often protected by hardware 3

Motivation | Updatable Encryption ▪ Proposed by Boneh et al. [BLMR13]: ciphertexts can be updated w/o secret key Key update generates key & update token Update token allows to „blindly“ transforms ciphertexts ▪ Update operation of ciphertexts is shifted to (untrusted) data host w/o harming security 4

Updatable Encryption | State-of-the-Art Ciphertext-Dependent Ciphertext-Independent UE. setup 𝜇 → 𝑙 0 UE. setup 𝜇 → 𝑙 0 UE. enc 𝑙 𝑓 , 𝑛 → 𝐷 𝑓 UE. enc 𝑙 𝑓 , 𝑛 → 𝐷 𝑓 UE. dec 𝑙 𝑓 , 𝐷 𝑓 → 𝑛 UE. dec 𝑙 𝑓 , 𝐷 𝑓 → 𝑛 UE. next 𝑙 𝑓 → (𝑙 𝑓+1 , Δ 𝑓+1 ) UE. next 𝑙 𝑓 → 𝑙 𝑓+1 UE. upd Δ 𝑓+1, 𝐷 𝑓 → 𝐷 𝑓+1 UE. token 𝑙 𝑓 , 𝑙 𝑓+1 , 𝐷 𝑓 → Δ 𝐷,𝑓+1 UE. upd Δ 𝐷,𝑓+1, 𝐷 𝑓 → 𝐷 𝑓+1 ▪ BLMR13: high level idea & scheme, ▪ BLMR15: partial definitions & new scheme no security definitions ▪ EPRS17: comprehensive treatment, ▪ EPRS17: partial definition & scheme improved definitions & schemes 5

Updatable Encryption | State-of-the-Art Ciphertext-Dependent Ciphertext-Independent UE. setup 𝜇 → 𝑙 0 UE. setup 𝜇 → 𝑙 0 UE. enc 𝑙 𝑓 , 𝑛 → 𝐷 𝑓 UE. enc 𝑙 𝑓 , 𝑛 → 𝐷 𝑓 UE. dec 𝑙 𝑓 , 𝐷 𝑓 → 𝑛 UE. dec 𝑙 𝑓 , 𝐷 𝑓 → 𝑛 UE. next 𝑙 𝑓 → (𝑙 𝑓+1 , Δ 𝑓+1 ) UE. next 𝑙 𝑓 → 𝑙 𝑓+1 UE. upd Δ 𝑓+1, 𝐷 𝑓 → 𝐷 𝑓+1 UE. token 𝑙 𝑓 , 𝑙 𝑓+1 , 𝐷 𝑓 → Δ 𝐷,𝑓+1 UE. upd Δ 𝐷,𝑓+1, 𝐷 𝑓 → 𝐷 𝑓+1 ▪ BLMR13: high level idea & scheme, ▪ BLMR15: partial definitions & new scheme no security definitions ▪ EPRS17: comprehensive treatment, ▪ EPRS17: partial definition & scheme improved definitions & schemes ▪ This work: formal definitions & secure schemes for ciphertext-independent setting 6

Updatable Encryption | Sequential Setting … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 … 𝐷 0 𝐷 1 𝐷 2 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ This work: strictly sequential setting ▪ Previous works: adaptions of proxy re-encryption definition – Allows re-encryptions across arbitrary epochs (back & forward) – No notion of time → hard to grasp when key corruptions are allowed 7

Updatable Encryption | Security … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 … 𝐷 0 𝐷 1 𝐷 2 𝐷 3 𝐷 4 𝐷 5 𝐷 6 Post-Compromise Security Forward Security = IND-ENC + Corrupt Challenge 𝑙𝑓𝑧/𝑢𝑝𝑙𝑓𝑜(𝑓) 𝑛 0 , 𝑛 1 Return key 𝑙 𝑓 b ← {0,1} or token Δ 𝑓 𝐹𝑜𝑑 𝑙 𝑓 ∗ , 𝑛 𝑐 𝑙 𝑓 / Δ 𝑓 ෪ 𝐷 𝑓 ∗ 𝑐 ? 8

Updatable Encryption | IND-ENC & Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 9

Updatable Encryption | IND-ENC & Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 10

Updatable Encryption | IND-ENC & Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 11

Updatable Encryption | IND-ENC & Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 12

Updatable Encryption | IND-ENC & Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 13

Updatable Encryption | IND-ENC & Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 14

Updatable Encryption | IND-ENC & Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates ▪ Real: bi bidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 Δ e+1 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ ෪ ෫ 𝐷 𝑓 𝐷 𝑓+1 𝑐 ? 15

Updatable Encryption | IND-ENC & Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ ෪ ෪ ෪ … 𝐷 0 𝐷 1 𝐷 2 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates ▪ Real: bi bidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 Δ e+1 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ ෪ ෫ 𝐷 𝑓 𝐷 𝑓+1 𝑐 ? 16

Updatable Encryption | IND-ENC & Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ ෪ ෪ ෪ … 𝐷 0 𝐷 1 𝐷 2 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates ▪ Real: bi bidirectional ciphertext & ke key-up updates Corrupt 𝑙 𝑓 / Δ 𝑓 Δ e+1 𝑙 𝑓 𝑙 𝑓+1 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ ෪ ෫ 𝐷 𝑓 𝐷 𝑓+1 Δ e+1 𝑐 ? 17

Updatable Encryption | IND-ENC & Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ ෪ ෪ ෪ … 𝐷 0 𝐷 1 𝐷 2 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates ▪ Real: bi bidirectional ciphertext & ke key-up updates Corrupt 𝑙 𝑓 / Δ 𝑓 Δ e+1 𝑙 𝑓 𝑙 𝑓+1 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ ෪ ෫ 𝐷 𝑓 𝐷 𝑓+1 Δ e+1 𝑐 ? 18

Updatable Encryption | IND-ENC Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 ▪ IND-ENC definitio ion Challenge ෪ 𝐷 𝑓 ∗ – Adaptive and retroactive key & token corruptions 𝑐 ? – Formalizes indirect knowledge of keys & challenge cipherexts – Covers CPA, post-compromise and forward security for fresh encryptio ions ns ▪ IND-ENC is not sufficient: No guarantees about updated ciphertexts! – UE. upd Δ 𝑓+1, 𝐷 𝑓 → 𝐷 𝑓+1 could contain 𝐷 𝑓 , i.e., history of all old ciphertexts ( 𝐷′ 3 = 𝐷 3 , (𝐷 2 , (𝐷 1 , (𝐷 0 ))) ) compromise of a single old key breaks security of updated ciphertexts 19