[PPT] - Dj Q All Over Again: Tighter and Broader Reductions of q -Type PowerPoint Presentation

SLIDE 1

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Déjà Q All Over Again: Tighter and Broader Reductions of q-Type Assumptions

Melissa Chase - MSR Redmond Mary Maller - University College London Sarah Meiklejohn - University College London

1/31

SLIDE 2

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions 2/31

SLIDE 3

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Subgroup Hiding ⇒ certain q-Type Assumptions

3/31

SLIDE 4

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Example: Broadcast Encryption

Methods of delivering encrypted content over a broadcast channel where only qualified users can decrypt the content.

Example

Boneh Gentry and Waters’ broadcast encryption scheme [BGW-Crypto05].

◮ Pairing based solution ◮ Short ciphertexts and private keys ◮ Collusion resistant

4/31

SLIDE 5

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

The q-BDHE Assumption

The BGW broadcast encryption scheme bases its security

n the q-BDHE assumption [BGW-Crypto05].

Given g,gc,gα,...,gαq,gαq+2,...,gα2q it is hard to distinguish e(g,gc)q+1 from random.

5/31

SLIDE 6

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

The q-BDHE Assumption

The BGW broadcast encryption scheme bases its security

n the q-BDHE assumption [BGW-Crypto05].

Given g,gc,gα,...,gαq,?,gαq+2,...,gα2q it is hard to distinguish e(g,gc)q+1 from random.

5/31

SLIDE 7

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Déjà Q: Using Dual Systems to Revisit q-Type Assumptions [CM-Eurocrypt14]

Subgroup Hiding Specific classes of q-type & ⇒ assumptions in asymmetric Parameter Hiding bilinear groups of order N = p1p2 1. Pr[break q-type assumption] ≤ O(q) Pr[break subgroup hiding]

1Asymmetric composite order bilinear groups do exist - see

[BRS-JNT11].

6/31

SLIDE 8

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

[CM-Eurocrypt14]: Contributions

Decides Computes Source Group given info in one group given info in both groups Target Group given info in one group given info in both groups q-BDHE

7/31

SLIDE 9

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Our Contributions: Broader

Decides Computes Source Group given info in one group given info in both groups Target Group given info in one group given info in both groups q-BDHE

8/31

SLIDE 10

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Our Contributions: Tighter

Subgroup Hiding Specific classes of q-type & ⇒ assumptions in asymmetric Parameter Hiding bilinear groups of order N = p1p2p3 . Pr[break q-type assumption] ≤ O(logq) Pr[break subgroup hiding]

9/31

SLIDE 11

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Outline of Presentation

10/31

SLIDE 12

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Bilinear Groups

Standard Bilinear Groups: G = (N,G,H,GT,e,g,h).

◮ N = group order; prime or composite ◮ |G| = |H| = kN, |GT| = λN ◮ G =< g >, H =< h > ◮ e : G × H → GT

Properties

Bilinearity: e(ga,hb) = e(g,h)ab Non-degeneracy: e(x,y) = 1∀y ∈ H ⇒ x = 1.

11/31

SLIDE 13

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Subgroup Hiding [BGN - TCC05]

12/31

SLIDE 14

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Subgroup Hiding [BGN - TCC05]

12/31

SLIDE 15

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Subgroup Hiding [BGN - TCC05]

12/31

SLIDE 16

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Parameter Hiding [Lewko-Eurocrypt12]

13/31

SLIDE 17

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Parameter Hiding [Lewko-Eurocrypt12]

13/31

SLIDE 18

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Parameter Hiding [Lewko-Eurocrypt12]

13/31

SLIDE 19

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Parameter Hiding [Lewko-Eurocrypt12]

13/31

SLIDE 20

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Outline of Presentation

14/31

SLIDE 21

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Reductions we can Cover

15/31

SLIDE 22

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Aim of Reduction

Model q-type assumption as a game. Transition to statistically impossible game. [CM-Eurocrypt14]

16/31

SLIDE 23

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Aim of Reduction

Model q-type assumption as a game. Transition to statistically impossible game. [CM-Eurocrypt14]

16/31

SLIDE 24

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Aim of Reduction

Model q-type assumption as a game. Transition to statistically impossible game. [CM-Eurocrypt14]

16/31

SLIDE 25

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Aim of Reduction

Model q-type assumption as a game. Transition to statistically impossible game. [CM-Eurocrypt14]

16/31

SLIDE 26

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Aim of Reduction

Model q-type assumption as a game. Transition to statistically impossible game. [CM-Eurocrypt14]

16/31

SLIDE 27

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Aim of Reduction

Model q-type assumption as a game. Transition to statistically impossible game. [CM-Eurocrypt14]

16/31

SLIDE 28

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Déjà Q: Reduction Techniques

17/31

SLIDE 29

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Déjà Q: Reduction Techniques

17/31

SLIDE 30

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Déjà Q: Reduction Techniques

17/31

SLIDE 31

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Déjà Q: Reduction Techniques

17/31

SLIDE 32

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Déjà Q: Reduction Techniques

17/31

SLIDE 33

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Our Tight Reduction Techniques

Double the randomness.

18/31

SLIDE 34

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Our Tight Reduction Techniques

Double the randomness.

18/31

SLIDE 35

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Our Tight Reduction Techniques

Double the randomness.

18/31

SLIDE 36

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Our Tight Reduction Techniques

Double the randomness.

18/31

SLIDE 37

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Our Tight Reduction Techniques

Double the randomness.

18/31

SLIDE 38

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Our Tight Reduction Techniques

Double the randomness.

18/31

SLIDE 39

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Result

Given gρ1(x),...,gρq(x),hσ1(x),...,hσq(x) ˆ h Then Adv[Deciding e(g, ˆ h)f(x) from random] ≤ (3 + log(q + 2))Pr[Breaks Subgroup Hiding]

19/31

SLIDE 40

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Result

Subgroup Hiding Specific classes of q-type & ⇒ assumptions in asymmetric Parameter Hiding bilinear groups of order N = p1p2p3 . Pr[break q-type assumption] ≤ O(logq) Pr[break subgroup hiding]

20/31

SLIDE 41

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Outline of Presentation

21/31

SLIDE 42

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Example: Broadcast Encryption

Methods of delivering encrypted content over a broadcast channel where only qualified users can decrypt the content.

Example

Boneh Gentry and Waters’ broadcast encryption scheme [BGW-Crypto05].

◮ Pairing based solution ◮ Short ciphertexts and private keys ◮ Collusion resistant

22/31

SLIDE 43

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Broadcast Encryption

The asymmetric q-BDHE assumption: given ˆ h,gα,hα,...,gαq,hαq,gαq+2,hαq+2,...,gα2q,hα2q it is hard to distinguish e(g, ˆ h)q+1 from random is tightly implied by subgroup hiding and parameter hiding. The BGW broadcast encryption scheme is implied by the symmetric q-BDHE assumption.

23/31

SLIDE 44

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Symmetric Reductions

◮ The previous asymmetric reduction fails in the

symmetric case.

◮ Adversary given components that would allow it to

trivially break subgroup hiding in the symmetric case (e(G1,H2) = 1).

◮ Show how to push through the same reduction in the

symmetric case by adding randomness from a fourth subgroup. Symmetric schemes can also be translated into asymmetric groups.

24/31

SLIDE 45

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

The Asymmetric BGW Variant

Techniques from [AGOT-Crypto14].

g gi p0[0] gc C0 vi di p1[0] p2[0] Ci p0[1] p2[1] p1[1]

= G = G&H = H

25/31

SLIDE 46

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Identity Based KEM [ACF-Eurocrypt09]

g Bi g1 gc C gij p1[0] hi skID p0[0] p4[0] p2[0] p3[0] p4[1] p0[1] p1[1] p2[1] p3[1]

26/31

SLIDE 47

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

ABE Scheme [Waters08]

The less efficient construction.

g ga gi hi msk L C' gc p0[1] p1[0] K Ci Kx p5[0] p5[1] p0[0] p1[1] p2[1] p3[1] p4[1] p2[0] p4[0] p3[0]

27/31

SLIDE 48

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

HIBE Scheme [BBG-Eurocrypt05]

g yi g3 hi g1 B gc g2 a1 C a0 bi p0[0] p2[0] p1[1] msk p0[1] p1[0] p2[1]

28/31

SLIDE 49

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Outline of Presentation

29/31

SLIDE 50

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Open Problems

◮ How secure are q-type assumptions in prime order

groups?

◮ How secure are q-power knowledge of exponent

assumptions (non-falsifiable assumptions)?

◮ How secure are q-type when the adversary has inputs

from both source groups and the challenge component is also in the source group?

30/31

SLIDE 51

Asiacrypt 2016, Hanoi Bilinear Groups and Assumptions Reductions Symmetric Schemes Conclusions

Thank-you for Listening.

31/31