Cliptography: Clipping The Power Of Kleptographic Attacks Qiang - - PowerPoint PPT Presentation

▶
cliptography clipping the power of kleptographic attacks
SMART_READER_LITE
LIVE PREVIEW

Cliptography: Clipping The Power Of Kleptographic Attacks Qiang - - PowerPoint PPT Presentation

Sep 11, 2022 313 likes •1.42k views

Cliptography: Clipping The Power Of Kleptographic Attacks Qiang Tang New Jersey Institute of Technology Joint work with Alexander Russell(UConn), Moti Yung(Snapchat & Columbia), and Hong-Sheng Zhou(VCU) Modern Crypto Modern Crypto

slide-1
SLIDE 1

Cliptography: Clipping The Power Of Kleptographic Attacks

Qiang Tang New Jersey Institute of Technology

Joint work with Alexander Russell(UConn), Moti Yung(Snapchat & Columbia), and Hong-Sheng Zhou(VCU)

slide-2
SLIDE 2

Modern Crypto

slide-3
SLIDE 3
  • “Precise” models to capture attacks
  • “Rigorous” proofs to establish security

Modern Crypto

slide-4
SLIDE 4
  • “Precise” models to capture attacks
  • “Rigorous” proofs to establish security

Modern Crypto

Still long way to go

slide-5
SLIDE 5

The “Security Divide”

crypto

security

slide-6
SLIDE 6

An Implicit Assumption

slide-7
SLIDE 7

An Implicit Assumption

Tradition: after cryptographers design the crypto tools, someone will implement them correctly for use

slide-8
SLIDE 8

Implementations are Untrustworthy

slide-9
SLIDE 9

Implementations are Untrustworthy

slide-10
SLIDE 10

Implementations are Untrustworthy

slide-11
SLIDE 11

Implementations are Untrustworthy

slide-12
SLIDE 12
  • The science of stealing information securely and

subliminally from black-box cryptographic implementations

Kleptography

Young & Yung ’96, ’97

slide-13
SLIDE 13

RSA Key Generation

RSA KeyGen

slide-14
SLIDE 14

A Subverted Implementation

RSA KeyGen

slide-15
SLIDE 15

A Subverted Implementation

RSA KeyGenz (A “backdoor”)

slide-16
SLIDE 16

The Attack:

RSA KeyGenz (A “backdoor”)

slide-17
SLIDE 17

The Attack:

RSA KeyGen Having the backdoor z, adversary can learn p from pk

z

(A “backdoor”)

slide-18
SLIDE 18

The Attack:

RSA KeyGen Having the backdoor z, adversary can learn p from pk

z

(A “backdoor”) Without z, e looks randomly distributed as in the SPEC

slide-19
SLIDE 19

Two Decades Later

slide-20
SLIDE 20

Two Decades Later

slide-21
SLIDE 21

Two Decades Later

  • Theory can go to practice!
slide-22
SLIDE 22

Backdoored Dual EC

slide-23
SLIDE 23
  • Remarkably, an adversarially implemented

cryptographic algorithm may…

The Threat of Klepto Attacks

slide-24
SLIDE 24
  • Remarkably, an adversarially implemented

cryptographic algorithm may…

  • leak private information to the implementer

The Threat of Klepto Attacks

slide-25
SLIDE 25
  • Remarkably, an adversarially implemented

cryptographic algorithm may…

  • leak private information to the implementer
  • while adhering perfectly to the specification.

The Threat of Klepto Attacks

slide-26
SLIDE 26

Sudden Renewed Attention

Bellare-Paterson-Rogaway’14, Bellare-Hoang’15, Dodis-Ganesh-Golovnev-Juels-Ristenpart’15, Mironov-Stevens-Davidovitz’15, Degabriele-Farshim-Pottering’15, Ateniese-Magri-Venturi’15,Bellare-Jaeger-Kane’15, Rogaway’15 Russell-T

  • Yung-Zhou’15A, Russell-T
  • Yung-Zhou’15B,

Dodis-Mironov-Davidovitz’16,Bellare-Kane-Rogaway’16 Degabriele-Paterson-Schult-Woodage’16 Russell-T

  • Yung-Zhou‘16A,Russell-T
  • Yung-Zhou’16B

13

slide-27
SLIDE 27

Sudden Renewed Attention

Bellare-Paterson-Rogaway’14, Bellare-Hoang’15, Dodis-Ganesh-Golovnev-Juels-Ristenpart’15, Mironov-Stevens-Davidovitz’15, Degabriele-Farshim-Pottering’15, Ateniese-Magri-Venturi’15,Bellare-Jaeger-Kane’15, Rogaway’15 Russell-T

  • Yung-Zhou’15A, Russell-T
  • Yung-Zhou’15B,

Dodis-Mironov-Davidovitz’16,Bellare-Kane-Rogaway’16 Degabriele-Paterson-Schult-Woodage’16 Russell-T

  • Yung-Zhou‘16A,Russell-T
  • Yung-Zhou’16B

13

Mostly depressing results

slide-28
SLIDE 28

Subliminal Channel Attack

[BPR14]

A Secret s Subverted implementation of randomized algorithm can leak secrets exclusively to backdoor holder via public communication channel using steganography by doing rejection sampling

slide-29
SLIDE 29

Status-of-the-Art for Defending

slide-30
SLIDE 30
  • Give up on randomized algorithms

Status-of-the-Art for Defending

slide-31
SLIDE 31
  • Give up on randomized algorithms
  • assume key generation algorithm is

honest

Status-of-the-Art for Defending

slide-32
SLIDE 32
  • Give up on randomized algorithms
  • assume key generation algorithm is

honest

  • consider deterministic encryption

algorithm only

Status-of-the-Art for Defending

slide-33
SLIDE 33
  • Give up on randomized algorithms
  • assume key generation algorithm is

honest

  • consider deterministic encryption

algorithm only

  • Assumed correctness

Status-of-the-Art for Defending

slide-34
SLIDE 34
  • Give up on randomized algorithms
  • assume key generation algorithm is

honest

  • consider deterministic encryption

algorithm only

  • Assumed correctness
  • Assuming trusted randomness (for

re-randomizer)

Status-of-the-Art for Defending

slide-35
SLIDE 35
  • Give up on randomized algorithms
  • assume key generation algorithm is

honest

  • consider deterministic encryption

algorithm only

  • Assumed correctness
  • Assuming trusted randomness (for

re-randomizer)

Status-of-the-Art for Defending

slide-36
SLIDE 36

Current Status: Wide Open

slide-37
SLIDE 37
  • No wide agreement on models

Current Status: Wide Open

slide-38
SLIDE 38
  • No wide agreement on models
  • Very few defending mechanisms known: no idea

what to do with randomized algorithms

Current Status: Wide Open

slide-39
SLIDE 39
  • No wide agreement on models
  • Very few defending mechanisms known: no idea

what to do with randomized algorithms

  • Very few functionalities have been considered

Current Status: Wide Open

slide-40
SLIDE 40
  • No wide agreement on models
  • Very few defending mechanisms known: no idea

what to do with randomized algorithms

  • Very few functionalities have been considered

Current Status: Wide Open

Far from being understood

slide-41
SLIDE 41
  • Revisit cryptography, build cliptography—

clipping the power of kleptographic attacks

Long Term Goal

slide-42
SLIDE 42

Our Initial Results

18

slide-43
SLIDE 43
  • Modeling: a general definitional framework, a hierarchy of
  • definitions. all algorithms are subverted by the adversary;

Our Initial Results

18

slide-44
SLIDE 44
  • Modeling: a general definitional framework, a hierarchy of
  • definitions. all algorithms are subverted by the adversary;
  • Mitigating: properly control the public channel to salvage

primitives even if subliminal channel exists—immediately deployable with minimal change of the specification

Our Initial Results

18

slide-45
SLIDE 45
  • Subversion resistant (TD)OWP
  • Subversion resistant PRGs
  • Subversion resistant signature with an online watchdog

Our Defending Results

19

slide-46
SLIDE 46

Cliptographic Model

20

slide-47
SLIDE 47

Cliptographic Model

G

20

slide-48
SLIDE 48

Cliptographic Model

G

20

slide-49
SLIDE 49

Cliptographic Model

G

20

slide-50
SLIDE 50

Cliptographic Model

G

a4t*#f-1zd f%5u7(bg@

20

slide-51
SLIDE 51

Cliptographic Model

G

a4t*#f-1zd f%5u7(bg@

  • 20
slide-52
SLIDE 52

Cliptographic Model

G G

SPEC

a4t*#f-1zd f%5u7(bg@

  • 20
slide-53
SLIDE 53

Cliptographic Model

G G

SPEC

a4t*#f-1zd f%5u7(bg@

G

  • 20
slide-54
SLIDE 54

Cliptographic Model

G G

SPEC

a4t*#f-1zd f%5u7(bg@

G

  • 20
slide-55
SLIDE 55

Cliptographic Model

G G

SPEC

a4t*#f-1zd f%5u7(bg@

G

  • 20
slide-56
SLIDE 56

The Model(s)

Three participants:

slide-57
SLIDE 57

The Model(s)

Three participants:

  • The Adversary, who provides

implementations of cryptographic algorithms, and later attempts to “break” them;

slide-58
SLIDE 58

The Model(s)

Three participants:

  • The Adversary, who provides

implementations of cryptographic algorithms, and later attempts to “break” them;

  • The Challenger(User), who uses the

subverted implementations.

slide-59
SLIDE 59

The Model(s)

Three participants:

  • The Adversary, who provides

implementations of cryptographic algorithms, and later attempts to “break” them;

  • The Challenger(User), who uses the

subverted implementations.

  • The Watchdog, who tests the

implementations against their specification;

slide-60
SLIDE 60

The Model(s)

Three participants:

  • The Adversary, who provides

implementations of cryptographic algorithms, and later attempts to “break” them;

  • The Challenger(User), who uses the

subverted implementations.

  • The Watchdog, who tests the

implementations against their specification; The adversary is proud-but-malicious

slide-61
SLIDE 61

The Basic Notion of Security

A primitive is cliptographically secure/subversion resistant if there exists a watchdog so that, for any efficient adversary,:

slide-62
SLIDE 62

The Basic Notion of Security

A primitive is cliptographically secure/subversion resistant if there exists a watchdog so that, for any efficient adversary,:

  • Either the watchdog can distinguish

IMPL from SPEC, or

slide-63
SLIDE 63

The Basic Notion of Security

A primitive is cliptographically secure/subversion resistant if there exists a watchdog so that, for any efficient adversary,:

  • Either the watchdog can distinguish

IMPL from SPEC, or

  • The primitive is still secure according

to the “adapted’’ security game.

slide-64
SLIDE 64

The Basic Notion of Security

A primitive is cliptographically secure/subversion resistant if there exists a watchdog so that, for any efficient adversary,:

  • Either the watchdog can distinguish

IMPL from SPEC, or

  • The primitive is still secure according

to the “adapted’’ security game. Several variants depending on the watchdog power, form of the implementation, etc

slide-65
SLIDE 65

What Can the Watchdog Guarantee?

slide-66
SLIDE 66

What Can the Watchdog Guarantee?

  • W can guarantee that deterministic algorithms

with public input distribution are (almost) consistent with the specification.

  • W can guarantee the randomness generation

algorithms produce unpredictable outputs.

slide-67
SLIDE 67

Mitigating Subliminal Channel

Key Generation must be randomized

slide-68
SLIDE 68
  • A one-way permutation: A permutation that is
  • Easy to compute;
  • Hard to invert.
  • Fundamental tool for constructing PRGs,

symmetric encryption.

One-Way Permutation

slide-69
SLIDE 69

Subvertible OWPs:

Gen i, y = fi(x) Adversary can win this game…and…

slide-70
SLIDE 70

Subvertible OWPs

SPEC Gen Gen Two index distributions are indistinguishable

slide-71
SLIDE 71

Subvertible OWPs

SPEC Gen Gen Two index distributions are indistinguishable OK to ignore Eval as it is deterministic with a public input distribution

slide-72
SLIDE 72
  • SPEC: Outputs random i,k; here {gi} is a TDOWP

.

  • IMPL: (i,d) from a TDOWP

, and k=SEnc(z,d); here d is the trapdoor.

Random Padding is Dangerous

Index

slide-73
SLIDE 73

Mitigating Subliminal Channel

Key Generation must be randomized

slide-74
SLIDE 74

Conventional Wisdom

slide-75
SLIDE 75

Conventional Wisdom

Nothing up my sleeve numbers

slide-76
SLIDE 76

Conventional Wisdom

Nothing up my sleeve numbers

  • π = 3.1415926535897932384626432832795..…. some bits of it were

used as constants in some hash function (BLAKE), block cipher (Blowfish) and more

slide-77
SLIDE 77

Conventional Wisdom

Nothing up my sleeve numbers

  • π = 3.1415926535897932384626432832795..…. some bits of it were

used as constants in some hash function (BLAKE), block cipher (Blowfish) and more

  • e = 2.7182818284590452353602874713527……some bits of it were

used as constants in an AES candidate block cipher (RC5) and more

slide-78
SLIDE 78

Mitigating Subverted KG

Nothing up my sleeve parameters/keys

slide-79
SLIDE 79

Mitigating Subverted KG

Gen Hash Nothing up my sleeve parameters/keys

slide-80
SLIDE 80

Mitigating Subverted KG: Intuition

z

slide-81
SLIDE 81

Mitigating Subverted KG: Intuition

z Any backdoor can be used to invert a sparse subset of functions, otherwise SPEC is insecure

slide-82
SLIDE 82

Mitigating Subverted KG: Intuition

z z H Any backdoor can be used to invert a sparse subset of functions, otherwise SPEC is insecure

slide-83
SLIDE 83

Mitigating Subverted KG: Intuition

z z H Any backdoor can be used to invert a sparse subset of functions, otherwise SPEC is insecure “Dispersing” the index to a “safe” place

slide-84
SLIDE 84

Gen Hash Theorem: {gi} is a family of subversion resistant OWPs.

Mitigating Subverted KG

slide-85
SLIDE 85

Gen Hash Assuming the SPEC of h is RO, and index domain is “simple” Theorem: {gi} is a family of subversion resistant OWPs.

Mitigating Subverted KG

slide-86
SLIDE 86

Further Implications

slide-87
SLIDE 87
  • Similarly salvage Duel_EC PRNG: it was shown to be

impossible to sanitize the output.

Further Implications

slide-88
SLIDE 88
  • Similarly salvage Duel_EC PRNG: it was shown to be

impossible to sanitize the output.

  • Similarly salvage trapdoor OWP

, then further save the KG

  • f the full domain hash digital signature scheme

Further Implications

slide-89
SLIDE 89

Further Results

slide-90
SLIDE 90
  • Reduction of FDH does not go through, modification

needed

Further Results

slide-91
SLIDE 91
  • Reduction of FDH does not go through, modification

needed

  • Reduction from clipto-secure OWP to PRG preserves

Further Results

slide-92
SLIDE 92

Conventional FDH Proof

Embed the TDOWP challenge to one RO query answer:

A

Reduction

slide-93
SLIDE 93

Conventional FDH Proof

Embed the TDOWP challenge to one RO query answer:

A

i, y = fi(x) Reduction

slide-94
SLIDE 94

Conventional FDH Proof

Embed the TDOWP challenge to one RO query answer:

A

i, y = fi(x) Reduction

slide-95
SLIDE 95

Conventional FDH Proof

Embed the TDOWP challenge to one RO query answer:

A

i, y = fi(x) Reduction

slide-96
SLIDE 96

FDH in the Clipto Setting

A

i, y = fi(x) Reduction

slide-97
SLIDE 97

FDH in the Clipto Setting

A

i, y = fi(x) Reduction y now generated by Eval implementation

slide-98
SLIDE 98

FDH in the Clipto Setting

A

i, y = fi(x) Reduction y now generated by Eval implementation RO queries can be made during manufacturing

slide-99
SLIDE 99

FDH in the Clipto Setting

No way to embed TDOWP challenge

A

i, y = fi(x) Reduction y now generated by Eval implementation RO queries can be made during manufacturing

slide-100
SLIDE 100

Revised FDH

slide-101
SLIDE 101
  • Hash pk together with message

Revised FDH

slide-102
SLIDE 102
  • Hash pk together with message
  • RO queries have to be made after pk is generated

which is after implementation is provided

Revised FDH

slide-103
SLIDE 103

Summary

slide-104
SLIDE 104
  • It is possible to save randomized algorithm from

subversion with minimal trust via specification re-design

Summary

slide-105
SLIDE 105
  • It is possible to save randomized algorithm from

subversion with minimal trust via specification re-design

  • Landscape changes when adding one dimension, every

piece of result worth revisiting

Summary

slide-106
SLIDE 106
  • Destroy subliminal channel
  • Defend against hidden trigger attack
  • Mitigating in the standard model
  • Revisit cryptography, and build a robust cliptography theory
  • Connection between correctness under subversion to self-correcting

programs

  • Many more…

Open Problems

slide-107
SLIDE 107

Our Recent Progress: Destroying Subliminal Channel

42

General result of destroying subliminal channels and saving PKE to preserve IND-CPA security

slide-108
SLIDE 108

Our Recent Progress: Signature with Offline Watchdog

43

Self-correcting random oracle and defend against hidden trigger attack for signatures

slide-109
SLIDE 109

Alexander Russell, Qiang Tang, Moti Yung and Hong-Sheng Zhou http://eprint.iacr.org/2015/695

Cliptography: Clipping The Power Of Kleptographic Attacks