A Classification of Computational Assumptions in the Algebraic Group - PowerPoint PPT Presentation

A Classification of Computational Assumptions in the Algebraic Group Model Balthazar Bauer, Georg Fuchsbauer, Julian Loss August 11, 2020 1

1. The Algebraic Group Model (FKL 2018) 2. Classification 3. Separation 2

1. The Algebraic Group Model (FKL 2018) 2. Classification 3. Separation 3

From GGM to AGM ◮ Let G be a cyclic group of prime order p . 4

From GGM to AGM ◮ Let G be a cyclic group of prime order p . Standard Model ( � , ♥ ) b ( Z 1 , Z 2 , Z 3 ) � + ♥ C ( ♠ , ( a 1 , a 2 , a 3 )) such that ♠ = a 1 � + a 2 ♥ + a 3 ⋆ 4

From GGM to AGM ◮ Let G be a cyclic group of prime order p . Standard Model ( � , ♥ ) b ( Z 1 , Z 2 , Z 3 ) � + ♥ C ( ♠ , ( a 1 , a 2 , a 3 )) Y such that ♠ = a 1 � + a 2 ♥ + a 3 ⋆ 4

From GGM to AGM ◮ Let G be a cyclic group of prime order p . Generic Group Model ( � , ♥ , ⋆ ) C ♠ = a 1 � + a 2 ♥ + a 3 ⋆ ( ♠ , ( a 1 , a 2 , a 3 )) ♠ such that ♠ = a 1 � + a 2 ♥ + a 3 ⋆ 5

From GGM to AGM ◮ Let G be a cyclic group of prime order p . Generic Group Model ( � , ♥ ) ( � , ♥ , ⋆ ) C ♠ = a 1 � + a 2 ♥ + a 3 ⋆ ( ♠ , ( a 1 , a 2 , a 3 )) ♠ such that ♠ = a 1 � + a 2 ♥ + a 3 ⋆ 5

From GGM to AGM ◮ Let G be a cyclic group of prime order p . Generic Group Model ( � , ♥ ) ( � , ♥ , ⋆ ) ♣ = � + ♥ C ♠ = a 1 � + a 2 ♥ + a 3 ⋆ ( ♠ , ( a 1 , a 2 , a 3 )) ♠ such that ♠ = a 1 � + a 2 ♥ + a 3 ⋆ 5

From GGM to AGM ◮ Let G be a cyclic group of prime order p . Generic Group Model ( � , ♥ ) ( � , ♥ , ⋆ ) ♣ = � + ♥ C ♠ = a 1 � + a 2 ♥ + a 3 ⋆ ♠ = a 1 � + a 2 ♥ + a 3 ⋆ ( ♠ , ( a 1 , a 2 , a 3 )) ♠ such that ♠ = a 1 � + a 2 ♥ + a 3 ⋆ 5

From GGM to AGM ◮ Let G be a cyclic group of prime order p . Generic Group Model (modified) ( � , ♥ ) ( � , ♥ , ⋆ ) ♣ = � + ♥ C ♠ = a 1 � + a 2 ♥ + a 3 ⋆ ( ♠ , ( a 1 , a 2 , a 3 )) such that ♠ = a 1 � + a 2 ♥ + a 3 ⋆ 6

From GGM to AGM ◮ Let G be a cyclic group of prime order p . Algebraic Group Model ( � , ♥ ) b ( Z 1 , Z 2 , Z 3 ) � + ♥ C Y = a 1 Z 1 + a 2 Z 2 + a 3 Z 3 ( Y , ( a 1 , a 2 , a 3 )) such that Y = a 1 Z 1 + a 2 Z 2 + a 3 Z 3 7

Standard vs Algebraic ◮ No reduction from DLog to CDH in the standard model. 8

Standard vs Algebraic ◮ No reduction from DLog to CDH in the standard model. ◮ Let A be an algebraic algorithm which solves CDH. 8

Standard vs Algebraic ◮ No reduction from DLog to CDH in the standard model. ◮ Let A be an algebraic algorithm which solves CDH. ◮ B ( G , X ) : 8

Standard vs Algebraic ◮ No reduction from DLog to CDH in the standard model. ◮ Let A be an algebraic algorithm which solves CDH. ◮ B ( G , X ) : $ ◮ v ← − Z ∗ p 8

Standard vs Algebraic ◮ No reduction from DLog to CDH in the standard model. ◮ Let A be an algebraic algorithm which solves CDH. ◮ B ( G , X ) : $ ◮ v ← − Z ∗ p ◮ ( Y , ℓ 1 , ℓ 2 , ℓ 3 ) ← A ( G , X , X + v G ) 8

Standard vs Algebraic ◮ No reduction from DLog to CDH in the standard model. ◮ Let A be an algebraic algorithm which solves CDH. ◮ B ( G , X ) : $ ◮ v ← − Z ∗ p ◮ ( Y , ℓ 1 , ℓ 2 , ℓ 3 ) ← A ( G , X , X + v G ) ( ℓ 1 G + ℓ 2 X + ℓ 3 ( X + v G ) = Y ) 8

Standard vs Algebraic ◮ No reduction from DLog to CDH in the standard model. ◮ Let A be an algebraic algorithm which solves CDH. ◮ B ( G , X ) : $ ◮ v ← − Z ∗ p ◮ ( Y , ℓ 1 , ℓ 2 , ℓ 3 ) ← A ( G , X , X + v G ) ( ℓ 1 G + ℓ 2 X + ℓ 3 ( X + v G ) = Y ) ◮ { x ∗ 1 , x ∗ 2 } ← Solve ( ℓ 1 + ℓ 2 X + ℓ 3 ( X + v )) ≡ X ( X + v ) (mod p ) 8

Standard vs Algebraic ◮ No reduction from DLog to CDH in the standard model. ◮ Let A be an algebraic algorithm which solves CDH. ◮ B ( G , X ) : $ ◮ v ← − Z ∗ p ◮ ( Y , ℓ 1 , ℓ 2 , ℓ 3 ) ← A ( G , X , X + v G ) ( ℓ 1 G + ℓ 2 X + ℓ 3 ( X + v G ) = Y ) ◮ { x ∗ 1 , x ∗ 2 } ← Solve ( ℓ 1 + ℓ 2 X + ℓ 3 ( X + v )) ≡ X ( X + v ) (mod p ) ◮ Output x ∗ i such that X = x ∗ i G 8

Standard vs Algebraic ◮ No reduction from DLog to CDH in the standard model. ◮ Let A be an algebraic algorithm which solves CDH. ◮ B ( G , X ) : $ ◮ v ← − Z ∗ p ◮ ( Y , ℓ 1 , ℓ 2 , ℓ 3 ) ← A ( G , X , X + v G ) ( ℓ 1 G + ℓ 2 X + ℓ 3 ( X + v G ) = Y ) ◮ { x ∗ 1 , x ∗ 2 } ← Solve ( ℓ 1 + ℓ 2 X + ℓ 3 ( X + v )) ≡ X ( X + v ) (mod p ) ◮ Output x ∗ i such that X = x ∗ i G ◮ Conclusion: AGM enables new security reductions 8

q -Diffie-Hellman Exponent ◮ Let G be a cyclic group of prime order p . 9

q -Diffie-Hellman Exponent ◮ Let G be a cyclic group of prime order p .   G x G     x 2 G $   → x q + 1 G ← − Z p ; → x   ·     ·   x q G 9

q -Diffie-Hellman Exponent ◮ Let G be a cyclic group of prime order p .   G x G     x 2 G $   → x q + 1 G ← − Z p ; → x   ·     ·   x q G Can we reduce DLog to q -DHE? 9

q -Strong Diffie-Hellman (Boneh Boyen 2004 ) ◮ Let ( G 1 , G 2 , e ) be a bilinear cyclic group of prime order p . 10

q -Strong Diffie-Hellman (Boneh Boyen 2004 ) ◮ Let ( G 1 , G 2 , e ) be a bilinear cyclic group of prime order p .   G 1 G 2     x G 2   � � $ 1   ← − Z p ; → → c , x 2 G 2 ( x + c ) G 1 x     ·     ·   x q G 2 10

q -Strong Diffie-Hellman (Boneh Boyen 2004 ) ◮ Let ( G 1 , G 2 , e ) be a bilinear cyclic group of prime order p .   G 1 G 2     x G 2   � � $ 1   ← − Z p ; → → c , x 2 G 2 ( x + c ) G 1 x     ·     ·   x q G 2 Can we reduce DLog to q -SDH? 10

DLog CDH DHI one-more DLog q ′ -DLog q -SDH SRDH Gap-DH q ′′ -DHE LRSW 11

DLog CDH DHI one-more DLog q ′ -DLog q -SDH SRDH Gap-DH q ′′ -DHE LRSW 12

DLog ? CDH DHI ? one-more DLog q ′ -DLog ? ? q -SDH SRDH Gap-DH q ′′ -DHE LRSW 13

1. The Algebraic Group Model (FKL 2018) 2. Classification 3. Separation 14

( � R , P ) -uber assumption (Boneh Boyen Goh 2005 ) ◮ General idea: Describe many assumptions 15

( � R , P ) -uber assumption (Boneh Boyen Goh 2005 ) ◮ General idea: Describe many assumptions ◮ � R ∈ Z p [ X 1 , . . . , X m ] n , P ∈ Z p [ X 1 , . . . , X m ] 15

( � R , P ) -uber assumption (Boneh Boyen Goh 2005 ) ◮ General idea: Describe many assumptions ◮ � R ∈ Z p [ X 1 , . . . , X m ] n , P ∈ Z p [ X 1 , . . . , X m ] R 1 = R 1 ( �  x ) G  R 2 = R 2 ( � x ) G   $   � → P ( � ← − Z m p ; · → x ) G x     ·   R n = R n ( � x ) G R ) : P = � a i R i Easy if P ∈ Span ( � x ) = � a i R i ( � P ( � x ) ; x ) G = � a i R i P ( � ; Hard in the GGM if P �∈ Span ( � R ) (non-triviality condition) 15

( � R , P ) -uber assumption (Boneh Boyen Goh 2005 ) ◮ General idea: Describe many assumptions (like CDH) ◮ � R ∈ Z p [ X 1 , . . . , X m ] n , P ∈ Z p [ X 1 , . . . , X m ]  R 1 = R 1 ( �  x ) G ( = 1 G ) $  → R 2 = R 2 ( � → P ( � ( x , y ) ← − Z 2 p ; x ) G ( = x G ) x ) G ( = xy G )  R 3 = R 3 ( � x ) G ( = y G ) Easy if P ∈ Span ( � R ) : R ) : P = � a i R i Easy if P ∈ Span ( � x ) = � a i R i ( � P ( � x ) ; x ) G = � a i R i P ( � ; Hard in the GGM if P �∈ Span ( � R ) (non-triviality condition) 16

( � R , P ) -uber assumption (Boneh Boyen Goh 2005 ) ◮ General idea: Describe many assumptions (like q -DHE) ◮ � R ∈ Z p [ X 1 , . . . , X m ] n , P ∈ Z p [ X 1 , . . . , X m ] R 1 = R 1 ( �  x ) G ( = 1 G )  R 2 = R 2 ( � x ) G ( = x G )     R 3 = R 3 ( � x ) G ( = x 2 G ) $   x ) G ( = x q + 1 G ) → P ( � ← − Z p ; → x   ·     ·   R n = R n ( � x ) G ( = x q G ) R ) : P = � a i R i Easy if P ∈ Span ( � x ) = � a i R i ( � P ( � x ) ; x ) G = � a i R i P ( � ; 17

( � R , P ) -uber assumption (Boneh Boyen Goh 2005 ) ◮ General idea: Describe many assumptions ◮ � R ∈ Z p [ X 1 , . . . , X m ] n , P ∈ Z p [ X 1 , . . . , X m ] R 1 = R 1 ( �  x ) G  R 2 = R 2 ( � x ) G   $   � → P ( � ← − Z m p ; · → x ) G x     ·   R n = R n ( � x ) G ◮ Easy if P ∈ Span ( � R ) : 18

( � R , P ) -uber assumption (Boneh Boyen Goh 2005 ) ◮ General idea: Describe many assumptions ◮ � R ∈ Z p [ X 1 , . . . , X m ] n , P ∈ Z p [ X 1 , . . . , X m ] R 1 = R 1 ( �  x ) G  R 2 = R 2 ( � x ) G   $   � → P ( � ← − Z m p ; · → x ) G x     ·   R n = R n ( � x ) G R ) : P = � a i R i ◮ Easy if P ∈ Span ( � 18