Cryptographic Reverse Firewall via Malleable Smooth Projective Hash - PowerPoint PPT Presentation

Cryptographic Reverse Firewall via Malleable Smooth Projective Hash Functions Rongmao Chen, Yi Mu, Guomin Yang , Willy Susilo, Fuchun Guo and Mingwu Zhang Asiacrypt 2016, Hanoi

Outline n Background n Cryptographic Reverse Firewall n Part I: Malleable Smooth Projective Hash Function n Part II: CRF Constructions Via Malleable SPHFs n Unkeyed Message Transmission Protocol n Oblivious Signature-Based Envelope Protocol n Oblivious Transfer Protocol n Conclusions and Future Work

Outline n Background n Cryptographic Reverse Firewall n Part I: Malleable Smooth Projective Hash Function n Part II: CRF Constructions Via Malleable SPHFs n Unkeyed Message Transmission Protocol n Oblivious Signature-Based Envelope Protocol n Oblivious Transfer Protocol n Conclusions and Future Work

Background q Edward Snowden Revelations q Massive surveillance by intelligence agencies q Undermining security mechanisms q subverting cryptographic protocols q deploying security weakness in implementations

Background q Edward Snowden Revelations q Massive surveillance by intelligence agencies q Undermining security mechanisms q subverting cryptographic protocols q deploying security weakness in implementations q Post-Snowden Cryptography q How to achieve meaningful security for cryptographic protocols in the presence of an adversary that may arbitrarily tamper with the victim’s machine?

IACR Statement On Mass Surveillance The membership of the IACR repudiates mass surveillance and the undermining of cryptographic solutions and standards ， Population-wide surveillance threatens democracy and human dignity. We call for expediting research and deployment of effective techniques to protect personal privacy against governmental and corporate overreach. -- Copenhagen, Eurocrypt 2014

Outline n Background n Cryptographic Reverse Firewall n Part I: Malleable Smooth Projective Hash Function n Part II: CRF Constructions Via Malleable SPHFs n Unkeyed Message Transmission Protocol n Oblivious Signature-Based Envelope Protocol n Oblivious Transfer Protocol n Conclusions and Future Work

Cryptographic Reverse Firewall [MS15] p A stateful algorithm 𝒳 p Input: current state 𝜐 and message 𝑛 p Output: updated state 𝜐̃ and message 𝑛 % p A “composed” party 𝒳 ∘ P 𝒳 is applied to the incoming and outgoing messages of p party P p the state of 𝒳 is initialized to the public parameters 𝒳 is called a reverse firewall for P p p “active router” between P ’s private network and the outside 𝑛 1 𝑛 1 * … … 𝑛 𝑜 * 𝑛 𝑜 P 𝒳

Cryptographic Reverse Firewall [MS15] p Stackable reverse firewalls p composition of multiple reverse firewalls 𝒳 ∘ 𝒳 ∘ ⋯ ∘ 𝒳 ∘ P p Transparent to legitimate traffic p does not break functionality ( Functionality-maintaining ) p 𝒳 shares no secret with P p we do not trust the firewall ( Security-preserving ) p No corrupted implementation of P can leak information through 𝒳 ( Exfiltration-resistant ) 𝑛 1 𝑛 1 * … … 𝑛 𝑜 * 𝑛 𝑜 P 𝒳

Property I: Functionality-Maintaining p Underlying protocol has some functionality 𝑛 1 … 𝑛 𝑜 y A y B p Protocol with 𝒳 has the same functionality 𝑛 1 𝑛 1 * … … 𝑛 𝑜 * 𝑛 𝑜 y A y B

Property II: Security-Preserving p Underlying protocol satisfies some security notions 𝑛 1 … 𝑛 𝑜 p Protocol with 𝒳 satisfies the same security notions 𝑛 1 𝑛 1 * … … 𝑛 𝑜 * 𝑛 𝑜

Property II: Security-Preserving p Corrupted implementation may break the security 𝑛 1 … 𝑛 𝑜 p Corrupted protocol with 𝒳 remains secure 𝑛 1 𝑛 1 * … … 𝑛 𝑜 * 𝑛 𝑜 Strong vs Weak Security-Preserving Eavesdropper vs Peer Party

Property III: Exfiltration-Resistant p Corrupted implementation of P cannot leak any information to an eavesdropping attacker 𝑛 1 𝑛 1 * … … 𝑛 𝑜 * 𝑛 𝑜 ≈ 𝑫 𝑛 1 𝑛 1 * … … 𝑛 𝑜 * 𝑛 𝑜 Strong vs Weak Exfiltration-Resistance Eavesdropper vs Peer Party

Research Goal The “holy grail” would be a full characterization of functionalities and security properties for which reverse firewall exists. -- By Mironov and Stephens-Davidowitz Eurocrypt 2015 This work: a general approach for designing CRFs for functionalities that are realizable by Smooth Projective Hash Functions

Outline n Background n Cryptographic Reverse Firewall n Part I: Malleable Smooth Projective Hash Function n Part II: CRF Constructions Via Malleable SPHFs n Unkeyed Message Transmission Protocol n Oblivious Signature-Based Envelope Protocol n Oblivious Transfer Protocol n Conclusions and Future Work

Smooth Projective Hash Function [CS02] SPHFSetup ( 1 𝑚 )=pp; HashKG (pp)=hk ; ProjKG (pp,hk)=hp Hash (pp,hk, C ) L ( C, w ) ProjHash (pp,hp, C , w ) … X Y C’ V’ Hash (pp,hk, C’ ) X/L … … p Correctness : Hash (pp,hk, C ) = ProjHash (pp,hp, C , w ); $ Y ; p Smoothness : V’ ≈ S R p Hard Subset Membership : L ≈ 𝐷 X/L

Our Extension: Malleable SPHF p Randomness Sampling p SampR (pp) ⟶ 𝑠 % SampW (pp) ⟶ w * p p Projection Key Updating 8 MaulK (pp,hp, 𝑠 % ) ⟶ hp p 8 MaulH (pp,hp, 𝑠 % , C ) ⟶ hv p p Element Re-randomization 8 ReranE (pp, C , 𝑥 * ) ⟶ 𝐷 p 8 ReranH (pp,hp, C , 𝑥 * ) ⟶ hv p

Our Extension: Malleable SPHF p Property I: Projection Key Malleability hp if exists hk w C Hash ProjHash = hv’ hv

Our Extension: Malleable SPHF p Property I: Projection Key Malleability hp hk C Hash hv

Our Extension: Malleable SPHF p Property I: Projection Key Malleability 8 ≈ 𝐷 hp 1 8 ① hp 0 8 hp hp MaulK 𝑠 % SampR hk C Hash hv 8 = h ② hv ∗ hv

Our Extension: Malleable SPHF p Property I: Projection Key Malleability 8 ≈ 𝐷 hp 1 8 ① hp 0 8 hp hp MaulK 𝑠 % SampR hk 8 C hk Hash Hash hv hv’ 8 = h ② hv ∗ hv

Our Extension: Malleable SPHF p Property I: Projection Key Malleability 8 ≈ 𝐷 hp 1 8 ① hp 0 8 hp hp MaulK 𝑠 % SampR hk 8 C hk Hash Hash MaulH 8 hv hv hv’ 8 = hv’ ② hv ∗ hv

Our Extension: Malleable SPHF p Property II: Element Re-randomizability C hk Hash hv

Our Extension: Malleable SPHF p Property II: Element Re-randomizability 8 ≈ 𝐷 𝐷 1 8 ① 𝐷 0 > C ReranE 𝐷 𝑥 % SampW hk Hash hv 8 = h ② hv ∗ ℎ𝑤

Our Extension: Malleable SPHF p Property II: Element Re-randomizability 8 ≈ 𝐷 𝐷 1 8 ① 𝐷 0 > C ReranE 𝐷 𝑥 % SampW hp hk hk Hash Hash hv hv’

Our Extension: Malleable SPHF p Property II: Element Re-randomizability 8 ≈ 𝐷 𝐷 1 8 ① 𝐷 0 > C ReranE 𝐷 𝑥 % SampW hp hk hk Hash Hash ReranH 8 hv hv hv’ 8 = hv’ ② hv ∗ hv

Our Extension: Malleable SPHF p Property II: Element Re-randomizability 8 ≈ 𝐷 𝐷 1 8 ① 𝐷 0 > C ReranE 𝐷 𝑥 % SampW > ∈ L iff ③ 𝐷 C ∈ L hp hk hk Hash Hash ReranH 8 hv hv hv’ 8 = hv’ ② hv ∗ hv

A Generic Construction of Malleable SPHF p Graded Rings [BCC+13] p common formalization of cyclic groups, bilinear groups, and multilinear groups p ∀ 𝑏, 𝑐 ∈ 𝕬 𝑞 , 𝑏⨁𝑐 = 𝑏 + 𝑐, 𝑏⨀𝑐 = 𝑏 L 𝑐 PQ ； ∀ 𝑑 ∈ 𝕬 𝑞 , p ∀ 𝑣 1 , 𝑤 1 ∈ 𝔿, 𝑣 1 ⨁𝑤 1 = 𝑣 1 L 𝑤 1 , 𝑣 1 ⊖ 𝑤 1 = 𝑣 1 L 𝑤 1 𝑑⨀𝑣 1 = 𝑣 1 𝑑 p ∀ 𝑣 1 , 𝑤 1 ∈ 𝔿, 𝑣 1 ⨀𝑤 1 = 𝑓 𝑣 1 , 𝑤 1 ∈ 𝔿 𝑈 (𝑓: 𝔿×𝔿 ⟶ 𝔿 𝑈 ) p Generic SPHF via Graded Rings [BCC+13] 𝛥: 𝒴 ⟼ 𝔿 [×\ , 𝛪: 𝒴 ⟼ 𝔿 Q×\ p Q×[ s. t. , 𝛪 𝐷 = 𝛍⨀𝛥 𝐷 p 𝐷 ∈ ℒ ⟺ ∃𝛍 ∈ 𝕬 𝑞 hk : = 𝜷 = (𝛽 1 , … , 𝛽 𝑜 ) Τ $ \ , hp ∶= 𝛿 𝐷 = 𝛥 𝐷 ⨀𝜷 ∈ 𝔿 𝑙 p ← 𝕬 𝑞 p Hash (pp,hk, C ) ∶= 𝛪 𝐷 ⨀𝜷 , ProjHash (pp,hp, C ,w) ∶= 𝛍⨀ 𝛿 𝐷 𝛪 𝐷 ⨀𝜷 = 𝛍⨀𝛥 𝐷 ⨀𝜷 = 𝛍⨀ 𝛿 𝐷

A Generic Construction of Malleable SPHF p Generic Malleable SPHF via Graded Rings 8 = 𝛿 𝐷 ⨁𝛥 𝐷 ⨀ 𝒔 p MaulK (pp,hp= 𝛿 𝐷 , 𝒔 * ) ： hp * 8 = 𝛪 𝐷 ⨀ 𝒔 p MaulH (pp,hp, 𝒔 * , C ) ： hv * 8⨀𝛥 𝐷 8 = 𝛪 𝐷 ⨁ 𝛍 p ReranK (pp, C , 𝑥 * ) ： 𝐷 8 = 𝛍 8 ⨀ 𝛿 𝐷 p ReranH (pp,hp, C , 𝑥 * ) ： hv Theorem The above construction is a malleable SPHF if the follows hold: 𝛪: 𝒴 ⟼ 𝔿 Q×\ is an identity function; • 𝛥: 𝒴 ⟼ 𝔿 [×\ is a constant function; • • The hard subset membership holds. p Instantiation from the k -linear assumption

Outline n Background n Cryptographic Reverse Firewall n Part I: Malleable Smooth Projective Hash Function n Part II: CRF Constructions Via Malleable SPHFs n Unkeyed Message Transmission Protocol n Oblivious Signature-Based Envelope Protocol n Oblivious Transfer Protocol n Conclusions and Future Work

Message Transmission Protocol with CRFs p Message Transmission Protocol Input: pp, M Input: pp $ ← HashKG (pp) hk hp ← ProjKG (pp,hk) op $ ← SampYes (pp) ( C , w ) V = ProjHash (pp,hp, C,w ) CT = V ⨁ M q, qr M’ = CT ⊝ Hash (pp,hk, C ) M’ = M Hash (pp,hk, C ) = ProjHash (pp,hp, C,w )