CRYPTOSYSTEMS IN A QUANTUM WORLD Mark Zhandry Stanford University - - PowerPoint PPT Presentation

▶
cryptosystems in a
SMART_READER_LITE
LIVE PREVIEW

CRYPTOSYSTEMS IN A QUANTUM WORLD Mark Zhandry Stanford University - - PowerPoint PPT Presentation

Jan 27, 2024 382 likes •1.05k views

CLASSICAL CRYPTOSYSTEMS IN A QUANTUM WORLD Mark Zhandry Stanford University * Joint work with Dan Boneh But First: My Current Work Indistinguishability Obfuscation (and variants) Multiparty NIKE without trusted setup and with small

slide-1
SLIDE 1

CLASSICAL CRYPTOSYSTEMS IN A QUANTUM WORLD

Mark Zhandry – Stanford University * Joint work with Dan Boneh

slide-2
SLIDE 2

But First: My Current Work

Indistinguishability Obfuscation (and variants)

  • Multiparty NIKE without trusted setup and with small parameters
  • Broadcast encryption with short ciphertexts and secret/public keys
  • Traitor tracing with short ciphertexts and secret/public keys
  • More to come

Talk at NYU 2:30pm Tomorrow (11/20). Ask me for details Multilinear Maps

  • Can above primitives be built directly from multilinear maps?
slide-3
SLIDE 3

Back to Quantum

slide-4
SLIDE 4

Classical Crypto

Ex: CCA encryption

pk sk c = E(pk,m)

Computational power and interactions are classical

slide-5
SLIDE 5

Quantum Computing Attack

Adversary has quantum computer:

pk = (N,e) sk = (N,d) c = E(pk,m)

N  p,q (Shor’s alg) d = e-1 mod ϕ(N) m = D(sk,c) Interactions remain classical

Aka: Post-quantum crypto

slide-6
SLIDE 6

Defending against Quantum Computing Attacks

Need crypto based on hard problems for quantum computers

  • Ex: lattice problems

Classical security proofs (reductions) often carry through

  • Many reductions treat adversary as black box
  • Classical interactions  simulate adversary using

classical techniques

  • Ex: OWF  PRF, IBE  CCA encryption, etc.
  • Exception: rewinding
slide-7
SLIDE 7

This Talk: Quantum Channel Attacks

All parties have quantum computers

pk sk c = E(pk,m)

Computational power and interactions are quantum

slide-8
SLIDE 8

Quantum Background

x =

Measurement:

x x

(Output x with probability |αx|2) Can perform any classical op:

F

x y =

slide-9
SLIDE 9

Motivation

Objection: Can always measure incoming query

pk sk c = E(pk,m)

Attack reduced to classical channel attack

slide-10
SLIDE 10

Motivation

Objection: Can always measure incoming query Answer: Implementing measurement securely is non-trivial

  • Measurement is physical – must trust hardware
  • What if adversary has access to device?
  • Only way to be certain: entangle fully with query
  • Requires quantum storage ≥ total data measured.

Conservative approach to crypto: Use schemes secure against quantum channel attacks

slide-11
SLIDE 11

Proving Quantum Security

Main difficulty: simulation

  • Adversary may query on superposition of all inputs
  • Exact simulation:
  • need an answer at every point
  • Distribution of all answers must be same as real setting

Possible solutions:

  • Find reduction that answers every point correctly
  • Distribution of answers indistinguishable from real setting
  • Answer incorrectly on some inputs*
slide-12
SLIDE 12

What’s to come

  • Encryption
  • Pseudorandom functions
  • Message authentication codes
  • Signatures (if time)
slide-13
SLIDE 13

Encryption

slide-14
SLIDE 14

Quantum CCA Attack

(sk,pk)  G() b  {0,1} pk

D

m’ c’

sk

>

mb

E

pk

>

Dc

m’ c’

sk

>

Dc(sk,c’)= D(sk,c’) if c’≠c ⊥ if c’=c

b’

Challenge CCA Queries CCA Queries

slide-15
SLIDE 15

Proving security against quantum CCA

Goal: find reduction that can decrypt all queries except challenge Example: ABB’10 selective IBE

+ selective IBE  CCA

Reduction can decrypt every ciphertext but challenge

  • Needs all decryption keys but challenge

Reduction can compute all decryption keys except challenge

slide-16
SLIDE 16

Pseudorandom Functions

slide-17
SLIDE 17

Pseudorandom Functions

Recall classical def: b  {0,1} b=0: k  K F(・)=F(k,・) b=1: FFuncs(X,Y)

F

x y

b’

slide-18
SLIDE 18

Quantum Security for PRFs

b  {0,1} b=0: k  K F(・)=F(k,・) b=1: FFuncs(X,Y)

F

b’

x y

slide-19
SLIDE 19

The GGM Construction

slide-20
SLIDE 20

Pseudorandom Generators

s y

G

G0(s) G1(s) S Y

≈

slide-21
SLIDE 21

The GGM Construction

x0 ⟶ k

G

x1 ⟶

G G

x2 ⟶

G G G G

Fk(000) Fk(001) Fk(010) Fk(011) Fk(100) Fk(101) Fk(110) Fk(111)

S

slide-22
SLIDE 22

Quantum Security Proof?

Follow classical steps: Step 1: Hybridize over levels of tree

slide-23
SLIDE 23

Hybridize Over Levels

Hybrid 0

slide-24
SLIDE 24

Hybridize Over Levels

Hybrid 1

slide-25
SLIDE 25

Hybridize Over Levels

Hybrid 2

slide-26
SLIDE 26

Hybridize Over Levels

Hybrid 3

slide-27
SLIDE 27

Hybridize Over Levels

Hybrid n

slide-28
SLIDE 28

Hybridize Over Levels

PRF distinguisher will distinguish two adjacent hybrids

Y Y Y Y Y Y Y Y Y Y Y Y

slide-29
SLIDE 29

Hybridize Over Levels

PRF distinguisher will distinguish two adjacent hybrids

Y Y Y Y Y Y Y Y S S S S S S S S

slide-30
SLIDE 30

Quantum Security Proof?

Follow classical steps: Step 1: Hybridize over levels of tree Step 2: Simulate hybrids using PRG/Random samples

✓

slide-31
SLIDE 31

Simulating Hybrids

Y Y Y Y Y Y Y Y S S S S S S S S S S S Y Y Y

slide-32
SLIDE 32

How It Was Done Classically

Adversary only queries polynomial number of points

Only need to fill active nodes Active node: value used to answer query

slide-33
SLIDE 33

Quantum Simulation?

Adversary can query on all exponentially-many inputs

slide-34
SLIDE 34

Quantum Simulation?

Adversary can query on all exponentially-many inputs

Cannot simulate exactly with polynomial samples!

All nodes are active!

slide-35
SLIDE 35

A Distribution to Simulate

H:

For all x∈X: yx  D H(x) = yx

Any distribution D on values induces a distribution on functions

Dx

D D D D D D D D D D D D D D D D

slide-36
SLIDE 36

Simulating Hybrids

Y Y Y Y Y Y Y Y S S S S S S S S

GX UX

Goal: simulate DX using poly samples of D

slide-37
SLIDE 37

Attempt 1: Systematic

D D D D

y1 y2 y3 y4 y1 y2 y3 y4 y1 y2 y3 y4 y1 y2 y3 y4 y1 y2 y3 y4 H(x) = yx mod r H is periodic  period learnable by quantum algorithms

slide-38
SLIDE 38

Attempt 2: Random

D D D D

y1 y2 y3 y4 y4 y3 y1 y3 y2 y4 y4 y4 y1 y2 y2 y2 y2 y3 y3 y2 R  Funcs([r],X) H(x) = yR(x) Called small range distributions, SRr

X(D)

slide-39
SLIDE 39

Small Range Distributions

Theorem: SRr

X(D) is indistinguishable from DX by any q-

query quantum algorithm, except with probability O(q3/r) Notes:

  • Highly non-trivial
  • Distinguishing prob not negligible, but good enough
  • We get to choose r
  • Random function R not efficiently constructible
  • [Zha’12a] Can simulate R using k-wise independence
slide-40
SLIDE 40

Quantum GGM Proof

PRF distinguisher will distinguish two adjacent hybrids

S S S S S S S S Y Y Y Y Y Y Y Y Y Y Y Y S S S S

≈ ≈

(SR distributions) (SR distributions)

slide-41
SLIDE 41

Quantum Security Proof?

Follow classical steps: Step 1: Hybridize over levels of tree Step 2: Simulate hybrids approximately using PRG/Random samples Step 3: Hybrid over samples

✓ ✓ ✓

slide-42
SLIDE 42

Quantum GGM Proof

PRF distinguisher will distinguish two adjacent hybrids

S S S S S S S S Y Y Y Y Y Y Y Y Y Y Y Y S S S S

≈ ≈ ≈

(SR distributions) (SR distributions) (PRG security)

slide-43
SLIDE 43

Message Authentication Codes (MACs)

slide-44
SLIDE 44

Message Authentication Codes (MACs)

Recall classical def: K  {0,1}λ

S

k

>

mi σi m,σ

Requirements: V(k,m,σ) accepts, m ≠ mi for any i m

1

m

2

…

slide-45
SLIDE 45

Quantum Security?

S

k

>

m

1

m

2

…

m,σ

Requirements: V(k,m,σ) accepts, m ≠ mi for any i

mi σi

?

Cannot copy quantum info!

  • Must define success without

reference to queries K  {0,1}λ

slide-46
SLIDE 46

Quantum Security

S

k

>

(m0*,σ0*),..., (mq*,σq*) mi σi

K  {0,1}λ q queries Adversary must produce q+1 (distinct) forgeries after making q queries

slide-47
SLIDE 47

PRF as a MAC

Try classical construction:

S

k

F

>

x σ=F(x)

S

k

F

>

x σ

=

accept/reject

slide-48
SLIDE 48

Security of PRF as a MAC

F

k

>

(m0*,σ0*),..., (mq*,σq*) mi σi

K  {0,1}λ q queries Adversary must produce q+1 (distinct) input/output pairs of F after making q queries

slide-49
SLIDE 49

Security of PRF as a MAC

Replace F with a random function

F

(m0*,σ0*),..., (mq*,σq*) mi σi

F  Funcs(M,T) q queries Adversary must produce q+1 (distinct) input/output pairs of random function after making q queries Oracle Interrogation:

slide-50
SLIDE 50

Quantum Oracle Interrogation

Classically: hard Adv[q+1 points]: 1/|T| Quantum: not so fast

[vD’98]: random function F: X  {0,1} q quantum queries ⇒ 1.9q points w.h.p. Also true for small range size: ex: random function F: X  {0,1}2 q quantum queries ⇒ 1.3q points w.h.p.

Question: What about large range size?

(1/2n for n-bit tags)

slide-51
SLIDE 51

Quantum Oracle Interrogation

Our result: Highly nontrivial

  • Invented new quantum impossibility tool: The Rank Method

Takeaway: Quantum Oracle Interrogation easier, but still hard

Theorem: Random function F: X  T Adv[q queries ⇒ q+1 points] ≤ (q+1)/|T|

(only lose factor of q+1 relative to classical case)

slide-52
SLIDE 52

Back to MAC Security

Classical CMA: secure PRF ⇒ secure MAC (Adv: 1/|T|) Quantum CMA: quantum-secure PRF ⇒ quantum-secure MAC (Adv: (q+1)/|T|) Both cases: MAC size super-logarithmic ⇒ MAC is secure

slide-53
SLIDE 53

Signatures

slide-54
SLIDE 54

Signatures

Naturally extend MAC definition

S

sk

>

(m0*,σ0*),..., (mq*,σq*) mi σi

(sk,pk)  G() q queries pk

slide-55
SLIDE 55

Proof Difficulties

Aborts are problematic

  • Can’t both abort and continue

Adversary can tell if signatures are invalid

  • Need to sign all messages correctly

Previous quantum proof techniques leave query intact

  • Known limitations in quantum setting:
  • MPC [ DFNS’11 ]
  • Fiat-Shamir in QROM [ DFG’13 ]
  • Cannot prove security for unique signatures (Ex: Lamport)
slide-56
SLIDE 56

Building Quantum-Secure Signatures

First attempt: do classical constructions work? Examples:

  • From lattices [ CHKP’10, ABB’10 ]
  • Using random oracles [ BR’93, GPV’08 ]
  • From generic assumptions [ Rom’90 ]

Short answer: sometimes yes, with small modifications

slide-57
SLIDE 57

Hash and Sign

Many classical signature schemes hash before signing: Classical Advantages:

  • Only sign small hash  more efficient
  • Weak security requirements for S’ if H modeled as random oracle

Our Goal:

  • Prove quantum security of S assuming only classical security of S’

S H S’

m h σ sk

V

slide-58
SLIDE 58

First Step: Simulate using only classical queries to S’ Problem: exponentially many h  must query S’ too many times

Quantum Security of Hash and Sign

H

sk m h σ

Success prob: ε

S’

V

(m0, σ0), ..., (mq, σq)

slide-59
SLIDE 59

Now S’ only queried on r inputs  Can simulate Next Step: Use one of the σi as a forgery for S’ Problem: # of sigs ( q+1 ) << # of S’ queries ( r )

Step 1: Use S.R. Distribution for H

sk m h σ

P Q

i

Success prob: ε/2

S’

V

(m0, σ0), ..., (mq, σq)

S.R. function on r samples Codomain [r]

slide-60
SLIDE 60

Intermediate Measurement

New quantum simulation technique:

x y in

  • ut

Success prob: σ

x y in

  • ut

Theorem: Success prob: ≥σ/t

x

t possible outcomes

slide-61
SLIDE 61

Only q queries to S’  One of the σi must be forgery for S’ Success probability non-negligible for constant q

Step 2: Measure Output of P

S’

sk m

P Q

i

Success prob: ε/2rq

i h σ

V

(m0, σ0), ..., (mq, σq)

slide-62
SLIDE 62

Many-time Secure Scheme

To sign each message, draw

  • A random salt
  • A pairwise indep function R

S R

sk

H

m salt σ, salt h r

S’

V $

Theorem: If S’ is classical many-time secure, then S is quantum many-time secure

slide-63
SLIDE 63

Other Signature Constructions

  • Uses entirely different techniques

Non-Random Oracle Schemes:

  • Follow-up work: signatures from one-way functions

Theorem: Collision resistance ⇒ quantum-secure signatures Theorem: (Slight variant of) GPV is quantum-secure Theorem: Generic conversion using Chameleon hash

slide-64
SLIDE 64

Result Summary

Quantum CCA Encryption

  • One specific example

Quantum PRFs

  • From generators [GGM’84], synthesizers [NR’95], or LWE

[BPR’11] Quantum MACs

  • PRF as a MAC
  • Modification of Carter-Wegmen [WC’81]

Quantum CMA-secure Signatures

  • Two generic conversions
  • From collision resistance
slide-65
SLIDE 65

Open Problems

Prove quantum security for more existing schemes

  • CBC-MAC, NMAC, etc.
  • Hash and Sign without salting
  • …

Improve tightness of reductions

  • Most of our security reductions are very loose