Challenges in Leakage-Resilient Symmetric Cryptography Krzysztof - - PowerPoint PPT Presentation

▶
challenges in leakage resilient symmetric cryptography
SMART_READER_LITE
LIVE PREVIEW

Challenges in Leakage-Resilient Symmetric Cryptography Krzysztof - - PowerPoint PPT Presentation

Apr 13, 2023 34 likes •995 views

Challenges in Leakage-Resilient Symmetric Cryptography Krzysztof Pietrzak ECRYPT II Workshop on Physical Attacks, Graz, November 28, 2012 Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography Krzysztof Pietrzak Challenges

slide-1
SLIDE 1

Challenges in Leakage-Resilient Symmetric Cryptography

Krzysztof Pietrzak ECRYPT II Workshop on Physical Attacks, Graz, November 28, 2012

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-2
SLIDE 2

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-3
SLIDE 3

Provable Security

1

Define “Breaking the Cryptosystem”.

2

Construct Cryptosystem.

3

Prove Cryptosystem Secure.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-4
SLIDE 4

Provable Security

1

Define “Breaking the Cryptosystem”. Example: Digital Signatures key

2

Construct Cryptosystem.

3

Prove Cryptosystem Secure.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-5
SLIDE 5

Provable Security

1

Define “Breaking the Cryptosystem”. Example: Digital Signatures key

2

Construct Cryptosystem.

3

Prove Cryptosystem Secure.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-6
SLIDE 6

Provable Security

1

Define “Breaking the Cryptosystem”. Example: Digital Signatures key

2

Construct Cryptosystem.

3

Prove Cryptosystem Secure.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-7
SLIDE 7

Provable Security

1

Define “Breaking the Cryptosystem”. Example: Digital Signatures key

2

Construct Cryptosystem.

3

Prove Cryptosystem Secure.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-8
SLIDE 8

Provable Security

1

Define “Breaking the Cryptosystem”. Example: Digital Signatures key

2

Construct Cryptosystem.

3

Prove Cryptosystem Secure.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-9
SLIDE 9

Provable Security

1

Define “Breaking the Cryptosystem”. Example: Digital Signatures key

2

Construct Cryptosystem.

3

Prove Cryptosystem Secure.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-10
SLIDE 10

Provable Security

1

Define “Breaking the Cryptosystem”. Example: Digital Signatures

? ?

key breaks scheme if ?

? is a valid signature for a new message.

2

Construct Cryptosystem.

3

Prove Cryptosystem Secure.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-11
SLIDE 11

Provable Security

1

Define “Breaking the Cryptosystem”. Example: Digital Signatures

? ?

key breaks scheme if ?

? is a valid signature for a new message.

2

Construct Cryptosystem.

3

Prove Cryptosystem Secure. Theorem No efficient adversary who breaks the scheme exists

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-12
SLIDE 12

Provable Security

1

Define “Breaking the Cryptosystem”. Example: Digital Signatures

? ?

key breaks scheme if ?

? is a valid signature for a new message.

2

Construct Cryptosystem.

3

Prove Cryptosystem Secure. Theorem No efficient adversary who breaks the scheme exists if (factoring, SVP,. . . ) is hard.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-13
SLIDE 13

Provably secure cryptosystems get broken in practice.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-14
SLIDE 14

Provably secure cryptosystems get broken in practice. Problem: adversaries outside the anticipated model.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-15
SLIDE 15

Provably secure cryptosystems get broken in practice. Problem: adversaries outside the anticipated model.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-16
SLIDE 16

Black-Box Security Models vs. Reality

key

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-17
SLIDE 17

Black-Box Security Models vs. Reality

key

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-18
SLIDE 18

Black-Box Security Models vs. Reality

key

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-19
SLIDE 19

Black-Box Security Models vs. Reality

key E.g. can measure time to compute .

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-20
SLIDE 20

Black-Box Security Models vs. Reality

key E.g. can measure time to compute . breaks RSA on smart cards [Kocher’95]

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-21
SLIDE 21

Black-Box Security Models vs. Reality

key E.g. can measure time to compute . breaks RSA on smart cards [Kocher’95] Side-Channel Attack: Cryptanalytic attack exploring information leaked from a physical implementation of a cryptosystem.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-22
SLIDE 22

power analysis probing attacks cold-boot attacks cache attacks radiation, sound, heat,. . .

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-23
SLIDE 23

power analysis [Eisenbarth et al. CRYPTO’08] break wireless car keys probing attacks cold-boot attacks [Halderman et al. USENIX’08] break disc-encryption schemes cache attacks [Ristenpart et al. CCS’09] break cloud computing radiation, sound, heat,. . .

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-24
SLIDE 24

The Rise of Side-Channel Attacks

Became major threat in the last few decades.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-25
SLIDE 25

The Rise of Side-Channel Attacks

Became major threat in the last few decades.

Ubiquitous computing: Light-weight crypto-devices are susceptible to side-channel attacks.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-26
SLIDE 26

The Rise of Side-Channel Attacks

Became major threat in the last few decades.

Ubiquitous computing: Light-weight crypto-devices are susceptible to side-channel attacks. Provable security: Side-channels became the weakest link.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-27
SLIDE 27

Side-channels are a physical phenomenon, how could theoretical cryptography be of help?

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-28
SLIDE 28

Side-channels are a physical phenomenon, how could theoretical cryptography be of help? Reductions in the context of side-channel attacks [MicRey’04] Construct schemes that remain provably secure in the presence of leakage.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-29
SLIDE 29

Leakage models: one-time vs. continuous

key

  • ne-time

f key continuous

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-30
SLIDE 30

Leakage models: one-time vs. continuous

key

  • ne-time

f (key) key continuous

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-31
SLIDE 31

Leakage models: one-time vs. continuous

key

  • ne-time

key continuous

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-32
SLIDE 32

Leakage models: one-time vs. continuous

key

  • ne-time

key continuous

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-33
SLIDE 33

Leakage models: one-time vs. continuous

key

  • ne-time

key continuous f 1,

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-34
SLIDE 34

Leakage models: one-time vs. continuous

key

  • ne-time

key continuous f 1(key, coins),

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-35
SLIDE 35

Leakage models: one-time vs. continuous

key

  • ne-time

key continuous f 2,

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-36
SLIDE 36

Leakage models: one-time vs. continuous

key

  • ne-time

key continuous f 2(key, coins),

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-37
SLIDE 37

Leakage models: one-time vs. continuous

key

  • ne-time

key continuous f 2(key, coins), Most side-channels like timing,power,. . . are continuous. Notable exception cold-boot. Security against continuous leakage is much harder to

  • achieve. E.g. requires key-refreshing.

Intermediate “Floppy model”.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-38
SLIDE 38

Leakage models: dedicated vs. general

dedicated leakage functions f models a particular side-channel timing: Make running time independent of input. probing: Private Circuits ([Ishai,Sahai,Wagner Crypto’03])

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-39
SLIDE 39

Leakage models: dedicated vs. general

dedicated leakage functions f models a particular side-channel timing: Make running time independent of input. probing: Private Circuits ([Ishai,Sahai,Wagner Crypto’03]) general leakage functions bounded: f (key) has length ℓ ≪ |key| bits. entropic: Entropy of key decreases by at most ℓ given f (key). auxiliary input: Computationally hard to compute key given f (key).

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-40
SLIDE 40

One-Time Bounded/Entropic leakage

key ∈ {0, 1}n. Adv choses f and gets f (key).

1

Bounded leakage: f must satisfy |f (key)| = ℓ ≪ n.

2

Entropic leakage: f must satisfy H∞(key|f (key)) ≥ n − ℓ. Maurer’s bounded storage model, privacy amplification,. . . Intrusion resilience [Dzi’06,CDDLLW’07,. . . ] (symmetric) Memory attacks [AGV’09,NaoSeg’09,. . . ] (public-key)

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-41
SLIDE 41

Continuous Bounded/Entropic leakage

key i state after i’th invocation of the scheme. key +

i ⊆ key i touched in i’th invocation.

Before i’th invocation, Adv chooses f (.) with range {0, 1}ℓ and gets f (key +

i ) (Leakage-Resilient Cryptography [DziPie08],. . . )

f (key i) (Continuous Memory Attacks [DHLW12],. . . )

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-42
SLIDE 42

Public-key

Signatures: [AWD09, KV09, FKPR10, DHLW10, BKKV10, BSW11,. . . ] Public key encryption: [AGV09, NS09, DHLW10, BKKV10, BSW11,. . . ] Identity based encryption: [DHLW10, CDRW10, LRW11,. . . ] Multiparty Computation: [FRRTV10, GR10, JV10,. . . ] Zero Knowledge: [GJS11,. . . ]

Secret-key Stream-Ciphers: [DP08, Pie09, YSPY10,YS12,. . . ] Pseudorandom Functions/Permutations: [DP10, FPS11,MSJ12,. . . ] Compilers

[ISW03,FRRTV10,GolRot12,. . . ]

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-43
SLIDE 43

Public-key

Signatures: [AWD09, KV09, FKPR10, DHLW10, BKKV10, BSW11,. . . ] Public key encryption: [AGV09, NS09, DHLW10, BKKV10, BSW11,. . . ] Identity based encryption: [DHLW10, CDRW10, LRW11,. . . ] Multiparty Computation: [FRRTV10, GR10, JV10,. . . ] Zero Knowledge: [GJS11,. . . ]

Secret-key Stream-Ciphers: [DP08, Pie09, YSPY10,YS12,. . . ] Pseudorandom Functions/Permutations: [DP10, FPS11,MSJ12,. . . ] Compilers

[ISW03,FRRTV10,GolRot12,. . . ]

3 Principles Share Secret: Blinding Evolve Secret: Stream-Ciphers Hide Secret: For every pk many sk (HPS,Σ-Protocols)

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-44
SLIDE 44

Leakage-Resilient Stream-Ciphers

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-45
SLIDE 45

weak PRFs

Definition Weak PRF F : {0, 1}k × {0, 1}n → {0, 1}m is a (s, ǫ, q) secure weak PRF if no adversary of size s can distinguish the following distributions advantage ǫ (X1, Y1), . . . , (Xq, Yq) (X1, Z1), . . . , (Xq, Zq) where Xi, Zi are uniform and Yi = F(K, Xi) for a random K.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-46
SLIDE 46

weak PRFs

Definition Weak PRF F : {0, 1}k × {0, 1}n → {0, 1}m is a (s, ǫ, q) secure weak PRF if no adversary of size s can distinguish the following distributions advantage ǫ (X1, Y1), . . . , (Xq, Yq) (X1, Z1), . . . , (Xq, Zq) where Xi, Zi are uniform and Yi = F(K, Xi) for a random K. Definition Min-Entropy X has min entropy m if Pr[X = x] ≤ 2−m for all x. If K ∈ {0, 1}k is uniform and |f (K)| = λ, then K has k − λ bits min-entropy given f (K).

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-47
SLIDE 47

Stream-Cipher

Definition (Stream-Cipher) A function SC : {0, 1}κ → {0, 1}n × {0, 1}κ is a stream-cipher if for random K0 the output Y1, Y2, . . . (where (Ki, Yi) = SC(Ki−1)) is pseudorandom

K0 SC K1 SC K2 SC K3 SC K4 Y1 Y2 Y3 Y4

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-48
SLIDE 48

Stream-Cipher

Definition (Stream-Cipher) A function SC : {0, 1}κ → {0, 1}n × {0, 1}κ is a stream-cipher if for random K0 the output Y1, Y2, . . . (where (Ki, Yi) = SC(Ki−1)) is pseudorandom

K0 F K1 F K2 F K3 F K4 Y1 Y2 Y3 Y4

Can use any pseudorandom generator F

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-49
SLIDE 49

Stream-Cipher

Definition (Stream-Cipher) A function SC : {0, 1}κ → {0, 1}n × {0, 1}κ is a stream-cipher if for random K0 the output Y1, Y2, . . . (where (Ki, Yi) = SC(Ki−1)) is pseudorandom

K0 F K1 F K2 F K3 F K4 Λ1 Y1 Λ2 Y2 Λ3 Y3 Λ4 Y4

Can use any pseudorandom generator F

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-50
SLIDE 50

Stream-Cipher

Definition (Stream-Cipher) A function SC : {0, 1}κ → {0, 1}n × {0, 1}κ is a stream-cipher if for random K0 the output Y1, Y2, . . . (where (Ki, Yi) = SC(Ki−1)) is pseudorandom

K0 F K1 F K2 F K3 F K4 Λ1 Y1 Λ2 Y2 Λ3 Y3 Λ4 Y4

Can use any pseudorandom generator F But not leakage resilient even for λ = 1: For t = |K| + 1, define Λi = f (Ki−1)

def

= i’th bit of Kt. After t rounds leaked entire Kt.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-51
SLIDE 51

A Leakage Resilient Stream-Cipher from any wPRF

K0 F F Y0 K1 F F Y1 Y2 Y3 Y4 K2 K3 K4

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-52
SLIDE 52

A Leakage Resilient Stream-Cipher from any wPRF

Λ1 = f (K0, Y0) K0 F F Y0 K1 F F Y1 Y2 Y3 Y4 K2 K3 K4

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-53
SLIDE 53

A Leakage Resilient Stream-Cipher from any wPRF

Λ1 = f (K0, Y0) K0 F F Y0 K1 F F Λ2 = f (K1, Y1) Y1 Y2 Y3 Y4 K2 K3 K4

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-54
SLIDE 54

A Leakage Resilient Stream-Cipher from any wPRF

Λ1 = f (K0, Y0) Λ3 = f (K2, Y2) K0 F F Y0 K1 F F Λ2 = f (K1, Y1) Y1 Y2 Y3 Y4 K2 K3 K4

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-55
SLIDE 55

A Leakage Resilient Stream-Cipher from any wPRF

Λ1 = f (K0, Y0) Λ3 = f (K2, Y2) K0 F F Y0 K1 F F Λ2 = f (K1, Y1) Λ4 = f (K3, Y3) Y1 Y2 Y3 Y4 K2 K3 K4

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-56
SLIDE 56

A Leakage Resilient Stream-Cipher from any wPRF

Λ1 = f (K0, Y0) Λ3 = f (K2, Y2) K0 F F Y0 K1 F F Λ2 = f (K1, Y1) Λ4 = f (K3, Y3) Y1 Y2 Y3 Y4 K2 K3 K4

Theorem ([P’09]) If F is a wPRF then the above is a leakage-resilient stream-cipher: Given Y0, . . . , Yi and Λ1, . . . , Λi the Yi+1, Yi+2, . . . is pseudorandom.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-57
SLIDE 57

A Leakage Resilient Stream-Cipher from any wPRF

Λ1 = f (K0, Y0) Λ3 = f (K2, Y2) K0 F F Y0 K1 F F Λ2 = f (K1, Y1) Λ4 = f (K3, Y3) Y1 Y2 Y3 Y4 K2 K3 K4

Theorem ([P’09]) If F is a wPRF then the above is a leakage-resilient stream-cipher: Given Y0, . . . , Yi and Λ1, . . . , Λi the Yi+1, Yi+2, . . . is pseudorandom. Leakage function f (Ki, Yi) → Λi can’t compute Ki+2, Ki+3, . . ..

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-58
SLIDE 58

Quantitative bound in [P’09] is nowhere practical. (s, ǫ) secure wPRF gave (s′, ǫ′) secure stream cipher where ǫ′ ≈ ǫ1/12 s′ ≈ s · ǫ2 As log(s/ǫ) ≤ key length, require wPRF with key length ≫ 1000 to get meaningful bounds.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-59
SLIDE 59

Quantitative bound in [P’09] is nowhere practical. (s, ǫ) secure wPRF gave (s′, ǫ′) secure stream cipher where ǫ′ ≈ ǫ1/12 s′ ≈ s · ǫ2 As log(s/ǫ) ≤ key length, require wPRF with key length ≫ 1000 to get meaningful bounds. With two recent results we can give a meaningful bound for keys of length 256. Overcoming weak expectations. [DodisYu 2012] How to fake auxiliary input. [JetchevP 2012]

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-60
SLIDE 60

Overcoming Weak Expectations

Theorem [DodisYu 2012] (improving [P’09]) If F is a (ǫ, 2s, 2q) secure wPRF, then it is a ( √ 2λǫ, s, q) secure wPRF if the key K ∈ {0, 1}k comes from any distribution with k − λ bits of min-entropy.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-61
SLIDE 61

Overcoming Weak Expectations

Theorem [DodisYu 2012] (improving [P’09]) If F is a (ǫ, 2s, 2q) secure wPRF, then it is a ( √ 2λǫ, s, q) secure wPRF if the key K ∈ {0, 1}k comes from any distribution with k − λ bits of min-entropy. Every weak PRF is one-time bounded leakage-resilient! Every also holds for entropic leakage (if leakage function is efficient).

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-62
SLIDE 62

How to fake auxiliary input

Theorem [JetchevP 2012] Consider any joint distribution (X, A) ∈ X × {0, 1}λ.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-63
SLIDE 63

How to fake auxiliary input

Theorem [JetchevP 2012] Consider any joint distribution (X, A) ∈ X × {0, 1}λ. Let D be a class distinguishers, say circuits of size s = 280

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-64
SLIDE 64

How to fake auxiliary input

Theorem [JetchevP 2012] Consider any joint distribution (X, A) ∈ X × {0, 1}λ. Let D be a class distinguishers, say circuits of size s = 280 There exists an efficient simulator h : X → {0, 1}λ that

Fools every D in D ∀D ∈ D : |Pr[D(X, A) = 1] − Pr[D(X, h(X)) = 1]| ≤ ǫ h is of size s · 23λ/ǫ2.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-65
SLIDE 65

K0 F F Y0 K1 F F Y1 Y2 Y3 Y4 K2 K3 K4

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-66
SLIDE 66

Λ1 = f (K0, Y0) K0 F F Y0 K1 F F Y1 Y2 Y3 Y4 K2 K3 K4

Replace Λ1 with “fake” h(K2, Y1).

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-67
SLIDE 67

h(K2, Y1) K0 F F Y0 K1 F F Y1 Y2 Y3 Y4 K2 K3 K4

Replace Λ1 with “fake” h(K2, Y1). Replace (Y1, K2) with uniformly random ( ˜ Y1, ˜ K2)

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-68
SLIDE 68

h( ˜ K2, ˜ Y1) K0 F F Y0 K1 F F ˜ Y1 Y2 Y3 Y4 ˜ K2 K3 K4

Replace Λ1 with “fake” h(K2, Y1). Replace (Y1, K2) with uniformly random ( ˜ Y1, ˜ K2) . . .

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-69
SLIDE 69

h( ˜ K2, ˜ Y1) K0 F F Y0 K1 F F Λ2 = f (K1, ˜ Y1) ˜ Y1 Y2 Y3 Y4 ˜ K2 K3 K4

Replace Λ1 with “fake” h(K2, Y1). Replace (Y1, K2) with uniformly random ( ˜ Y1, ˜ K2) . . .

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-70
SLIDE 70

h( ˜ K2, ˜ Y1) K0 F F Y0 K1 F F h(K3, Y2) ˜ Y1 Y2 Y3 Y4 ˜ K2 K3 K4

Replace Λ1 with “fake” h(K2, Y1). Replace (Y1, K2) with uniformly random ( ˜ Y1, ˜ K2) . . .

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-71
SLIDE 71

h( ˜ K2, ˜ Y1) K0 F F Y0 K1 F F h( ˜ K3, ˜ Y2) ˜ Y1 ˜ Y2 Y3 Y4 ˜ K2 ˜ K3 K4

Replace Λ1 with “fake” h(K2, Y1). Replace (Y1, K2) with uniformly random ( ˜ Y1, ˜ K2) . . .

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-72
SLIDE 72

h( ˜ K2, ˜ Y1) Λ3 = f (K2, Y2) K0 F F Y0 K1 F F h( ˜ K3, ˜ Y2) ˜ Y1 ˜ Y2 Y3 Y4 ˜ K2 ˜ K3 K4

Replace Λ1 with “fake” h(K2, Y1). Replace (Y1, K2) with uniformly random ( ˜ Y1, ˜ K2) . . .

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-73
SLIDE 73

h( ˜ K2, ˜ Y1) h(K4, Y3) K0 F F Y0 K1 F F h( ˜ K3, ˜ Y2) ˜ Y1 ˜ Y2 Y3 Y4 ˜ K2 ˜ K3 K4

Replace Λ1 with “fake” h(K2, Y1). Replace (Y1, K2) with uniformly random ( ˜ Y1, ˜ K2) . . .

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-74
SLIDE 74

h( ˜ K2, ˜ Y1) h( ˜ K4, ˜ Y3) K0 F F Y0 K1 F F h( ˜ K3, ˜ Y2) ˜ Y1 ˜ Y2 ˜ Y3 Y4 ˜ K2 ˜ K3 ˜ K4

Replace Λ1 with “fake” h(K2, Y1). Replace (Y1, K2) with uniformly random ( ˜ Y1, ˜ K2) . . .

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-75
SLIDE 75

λ : # of bits leaked per round. q : # of blocks output. Lemma ([JetPie’12]) If F is a (ǫF, sF, 2)-secure weak PRF the this is a (ǫ′, s′, q, λ)-secure leakage resilient stream cipher where ǫ′ = 4q

  • ǫF2λ

s′ = Θ(1) · sFǫ′2 23λ q = 220 , λ = 10 , ǫF = 2−100 , sF = 2154 (sF/ǫF = 2256) ǫ′ = 2−23 s′ = 278

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-76
SLIDE 76

Leakage-Resilient PRFs

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-77
SLIDE 77

GGM

Kǫ K0 K1 K10 K11 K100 K101 K1001 K1011 prg prg prg prg

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-78
SLIDE 78

GGM + LR-SC

Kǫ K0 K1 K10 K11 K100 K101 K1001 K1011 prg prg prg prg K0 F F X0 K1 F F X1 X2 X3 X4 K2 K3 K4

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-79
SLIDE 79

GGM + LR-SC ⇒ LR-PRF

Kǫ K0 K1 K10 K11 K100 K101 K1001 K1011 prg prg prg prg K0 F F X0 K1 F F X1 X2 X3 X4 K2 K3 K4

K0 K1 Zε Kε wprf Z0 Z1 wprf K00 K01 K10 K11 Z10 Z11 K100 K101 K110 K111 wprf Z100 Z101 wprf K1000 K1001 K1010 K1011 Z1010 Z1011 wprf Y1011 Λε Λ1 Λ10 Λ101 Λ1011

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-80
SLIDE 80

LR-PRF

K0 K1 Zε Kε wprf Z0 Z1 wprf K00 K01 K10 K11 Z10 Z11 K100 K101 K110 K111 wprf Z100 Z101 wprf K1000 K1001 K1010 K1011 Z1010 Z1011 wprf Y1011 Λε Λ1 Λ10 Λ101 Λ1011

1

Granular Leakage.

2

Non-adaptive leakage.

3

  • 1. & 2. allow static key!

4

Inefficient construction.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-81
SLIDE 81

Leakage-Resilient PRPs

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-82
SLIDE 82

Indistinguishability & Indifferentiabiliyt

LX RX

F1 ⊕ F2 ⊕ F3 ⊕

LY RY

Theorem ([LubyRackoff’88]) 3-round Feistel instantiated with PRFs is a PRP.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-83
SLIDE 83

Indistinguishability & Indifferentiabiliyt

LX RX

F1 ⊕ Z F2 ⊕ F3 ⊕

LY RY

Theorem ([LubyRackoff’88]) 3-round Feistel instantiated with PRFs is a PRP.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-84
SLIDE 84

Indistinguishability & Indifferentiabiliyt

LX RX

F1 ⊕ Z F2 ⊕ F3 ⊕

LY RY

Theorem ([LubyRackoff’88]) 3-round Feistel instantiated with PRFs is a PRP. Theorem ([HolensteinKuenzlerTessaro’11]) 18-round Feistel instantiated with URFs is indifferentiable from a URP.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-85
SLIDE 85

Indistinguishability & Indifferentiabiliyt

LX RX

F1 ⊕ Z F2 ⊕ F3 ⊕

LY RY

Theorem ([LubyRackoff’88]) 3-round Feistel instantiated with PRFs is a PRP. Theorem ([HolensteinKuenzlerTessaro’11]) 18-round Feistel instantiated with URFs is indifferentiable from a URP. Theorem ([DodisP’10])

r-round Feistel instantiated with leakage-resilient PRFs is a secure leakage-resilient super PRP for q-query distinguishers satisfying q ≤ 1.38r/2−1.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-86
SLIDE 86

Side-Channel Attacks on Feistel

LX RX

Z1 F1 ⊕ Z2 F2 ⊕ Z3 F3 ⊕

LY RY

Ψr : r-round Feistel instantiated with uniformly random functions {0, 1}n → {0, 1}n. Theorem ([DodisP’10]) Can invert Ψr on any value Y making 4nr forward queries. If given |Z1|1, . . . , |Zn|1 with every query.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-87
SLIDE 87

Side-Channel Attacks on Feistel

LX RX

Z1 F1 ⊕ Z2 F2 ⊕ Z3 F3 ⊕

LY RY

Ψr : r-round Feistel instantiated with uniformly random functions {0, 1}n → {0, 1}n. Theorem ([DodisP’10]) Can invert Ψr on any value Y making 4nr forward queries. If given |Z1|1, . . . , |Zn|1 with every query. Works for other leakages (than Hamming weight) of the Zi’s.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-88
SLIDE 88

getting LR PRFs is hard what to do?

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-89
SLIDE 89

Use algebraic PRFs, e.g. f (x) = g a0

  • xi =1 ai

[NaorReingold’97]. Can use blinding to protect.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-90
SLIDE 90

Use algebraic PRFs, e.g. f (x) = g a0

  • xi =1 ai

[NaorReingold’97]. Can use blinding to protect. Avoid PRFs! Use algebraic MACs [DodKilPieWic’12] like LaPiN

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-91
SLIDE 91

A Proposal: LaPiN [HeyKilLyuPaaP FSE’12]

Ring 1 R = F2[X]/(f )

Prover Verifier

c

← −

Random challenge c ∈ {0, 1}80 Chose r, e ∈ R z = r · (k · π(c) + ˆ k) + e ∈ R

r,z

− − →

ˆ e = z − r · (k · π(c) + ˆ k) Accept if ˆ e is a small element in ring R.

Key are two ring elements k, ˆ k (621 bits each) Share k = k0 · k1, ˆ k = ˆ k0 · ˆ k1 Run protocol using (ki, ˆ ki) for i ∈ {0, 1}, combine at the end. Occasionally refresh k0 ← k0 · z , k1 ← k1 · z−1.

1 f (X) = (X 127 +X 8 +X 7 +X 3 +1)(X 126 +X 9 +X 6 +X 5 +1)(X 125 +

X 9 + X 7 + X 4 + 1)(X 122 + X 7 + X 4 + X 3 + 1)(X 121 + X 8 + X 5 + X 1 + 1)

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-92
SLIDE 92

Auxiliary Input Security?

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-93
SLIDE 93

Auxiliary Input vs Bounded Leakage: A Conjecture

Adversary gets Bounded Leakage: f (key) , |f (key)| ≤ ℓ. Auxiliary Input: f (key), key is hard to compute given f (key).

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-94
SLIDE 94

Auxiliary Input vs Bounded Leakage: A Conjecture

Adversary gets Bounded Leakage: f (key) , |f (key)| ≤ ℓ. Auxiliary Input: f (key), key is hard to compute given f (key). Is Aux. Input really stronger than bounded leakage in practice? Does there exist a natural scheme that is secure against bounded leakage, but not auxiliary input (which does not trivially contradict the bounded leakage bound)?

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-95
SLIDE 95

Auxiliary Input vs Bounded Leakage: A Conjecture

Adversary gets Bounded Leakage: f (key) , |f (key)| ≤ ℓ. Auxiliary Input: f (key), key is hard to compute given f (key). Is Aux. Input really stronger than bounded leakage in practice? Does there exist a natural scheme that is secure against bounded leakage, but not auxiliary input (which does not trivially contradict the bounded leakage bound)? RO analogy Does there exist a natural scheme that is secure in the random

  • racle model, but not if the RO is replaced with, say SHA3.

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography

slide-96
SLIDE 96

Questions?

Krzysztof Pietrzak Challenges in Leakage-ResilientSymmetric Cryptography