Dj Q: Using Dual Systems to Revisit q-Type Assumptions Melissa Chase - - PowerPoint PPT Presentation

▶
d j q using dual systems to revisit q type assumptions
SMART_READER_LITE
LIVE PREVIEW

Dj Q: Using Dual Systems to Revisit q-Type Assumptions Melissa Chase - - PowerPoint PPT Presentation

Jan 13, 2024 21 likes •1.46k views

Dj Q: Using Dual Systems to Revisit q-Type Assumptions Melissa Chase (MSR Redmond) Sarah Meiklejohn (UC San Diego University College London) 1 Pairing-based cryptography: a brief history Historically, pairings have provided great

slide-1
SLIDE 1

Déjà Q: Using Dual Systems to Revisit q-Type Assumptions

Melissa Chase (MSR Redmond) Sarah Meiklejohn (UC San Diego → University College London)

1

slide-2
SLIDE 2

Pairing-based cryptography: a brief history

2

Historically, pairings have provided great functionality

slide-3
SLIDE 3

Pairing-based cryptography: a brief history

2

Historically, pairings have provided great functionality

  • First IBE instantiation [BF01]
slide-4
SLIDE 4

Pairing-based cryptography: a brief history

2

Historically, pairings have provided great functionality

  • First IBE instantiation [BF01]
  • Many other breakthroughs have followed [BBS04,GS08,KSW08,LW11,...]
slide-5
SLIDE 5

Pairing-based cryptography: a brief history

2

Historically, pairings have provided great functionality

  • First IBE instantiation [BF01]
  • Many other breakthroughs have followed [BBS04,GS08,KSW08,LW11,...]

With great functionality, comes great (ir)responsibility!

slide-6
SLIDE 6

Pairing-based cryptography: a brief history

2

Historically, pairings have provided great functionality

  • First IBE instantiation [BF01]
  • Many other breakthroughs have followed [BBS04,GS08,KSW08,LW11,...]

With great functionality, comes great (ir)responsibility!

  • First assumption: BDH (given (ga,gb,gc), compute e(g,g)abc)
slide-7
SLIDE 7

Pairing-based cryptography: a brief history

2

Historically, pairings have provided great functionality

  • First IBE instantiation [BF01]
  • Many other breakthroughs have followed [BBS04,GS08,KSW08,LW11,...]

With great functionality, comes great (ir)responsibility!

  • First assumption: BDH (given (ga,gb,gc), compute e(g,g)abc)
  • Later assumptions: Subgroup Hiding [BGN05], Decision Linear, SXDH
slide-8
SLIDE 8

Pairing-based cryptography: a brief history

2

Historically, pairings have provided great functionality

  • First IBE instantiation [BF01]
  • Many other breakthroughs have followed [BBS04,GS08,KSW08,LW11,...]

With great functionality, comes great (ir)responsibility!

  • First assumption: BDH (given (ga,gb,gc), compute e(g,g)abc)
  • Later assumptions: Subgroup Hiding [BGN05], Decision Linear, SXDH
  • Even later assumptions: q-SDH, q-ADHSDH, q-EDBDH, q-SDH-III, q-SFP

, “source group q-parallel BDHE,” etc.

slide-9
SLIDE 9

Why are q-type assumptions worrisome?

3

slide-10
SLIDE 10

Why are q-type assumptions worrisome?

3

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan

IBE universe

slide-11
SLIDE 11

Why are q-type assumptions worrisome?

3

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan

IBE universe

slide-12
SLIDE 12

Why are q-type assumptions worrisome?

3

BDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan

IBE universe

slide-13
SLIDE 13

Why are q-type assumptions worrisome?

3

BDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

IBE universe

slide-14
SLIDE 14

Why are q-type assumptions worrisome?

3

BDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

IBE universe

slide-15
SLIDE 15

Why are q-type assumptions worrisome?

3

BDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

IBE universe q-SDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan

(g,gx,…,gxq)

slide-16
SLIDE 16

Why are q-type assumptions worrisome?

3

BDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

IBE universe q-SDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

(g,gx,…,gxq)

slide-17
SLIDE 17

Why are q-type assumptions worrisome?

3

BDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

IBE universe q-SDH ⇒ /

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

(g,gx,…,gxq)

slide-18
SLIDE 18

Why are q-type assumptions worrisome?

3

BDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

IBE universe q-SDH ⇒ / q+5-SDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

(g,gx,…,gxq) (g,gx,…,gxq,…,gxq+5)

slide-19
SLIDE 19

Why are q-type assumptions worrisome?

3

BDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

IBE universe q-SDH ⇒ / q+5-SDH ⇒

>

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

(g,gx,…,gxq) (g,gx,…,gxq,…,gxq+5)

slide-20
SLIDE 20

Why are q-type assumptions worrisome?

3

BDH ⇒

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

IBE universe q-SDH ⇒ / q+5-SDH ⇒

>

t/√q steps [Cheon06] t/√q+5 steps

Alice Bob Charles Dora Ernie Fred George Hannah Isabelle Julian Kate Louise Melissa Nicholas Otis Phil Quentin Rachel Sarah Tristan Ursula Vanessa William Xavier Yevgeniy

slide-21
SLIDE 21

Moving away from q-type assumptions

4

Dual systems [W09,…] have proved effective at removing q-type assumptions

slide-22
SLIDE 22

Moving away from q-type assumptions

4

Dual systems [W09,…] have proved effective at removing q-type assumptions

  • Properties of bilinear groups: subgroup hiding and parameter hiding
slide-23
SLIDE 23

Moving away from q-type assumptions

4

Dual systems [W09,…] have proved effective at removing q-type assumptions

  • Properties of bilinear groups: subgroup hiding and parameter hiding
  • Abstract dual systems into three steps
slide-24
SLIDE 24

Moving away from q-type assumptions

4

Dual systems [W09,…] have proved effective at removing q-type assumptions

  • Properties of bilinear groups: subgroup hiding and parameter hiding
  • Abstract dual systems into three steps

Apply dual systems directly to variants of the uber-assumption [BBG05,B08]

slide-25
SLIDE 25

Moving away from q-type assumptions

4

Dual systems [W09,…] have proved effective at removing q-type assumptions

  • Properties of bilinear groups: subgroup hiding and parameter hiding
  • Abstract dual systems into three steps

Apply dual systems directly to variants of the uber-assumption [BBG05,B08]

  • Reduce* to an assumption that holds by a statistical argument

*currently only in composite-order groups

slide-26
SLIDE 26

Moving away from q-type assumptions

4

Dual systems [W09,…] have proved effective at removing q-type assumptions

  • Properties of bilinear groups: subgroup hiding and parameter hiding
  • Abstract dual systems into three steps

Apply dual systems directly to variants of the uber-assumption [BBG05,B08]

  • Reduce* to an assumption that holds by a statistical argument
  • Adapt dual systems to work for deterministic primitives

*currently only in composite-order groups

slide-27
SLIDE 27

Moving away from q-type assumptions

4

Dual systems [W09,…] have proved effective at removing q-type assumptions

  • Properties of bilinear groups: subgroup hiding and parameter hiding
  • Abstract dual systems into three steps

Apply dual systems directly to variants of the uber-assumption [BBG05,B08]

  • Reduce* to an assumption that holds by a statistical argument
  • Adapt dual systems to work for deterministic primitives

Extension to Dodis-Yampolskiy PRF [DY05] *currently only in composite-order groups

slide-28
SLIDE 28

Outline

5

slide-29
SLIDE 29

Outline

5

Bilinear groups

slide-30
SLIDE 30

Outline

5

Bilinear groups q-Type assumptions

slide-31
SLIDE 31

Outline

5

Bilinear groups q-Type assumptions Extensions

slide-32
SLIDE 32

Outline

5

Bilinear groups q-Type assumptions Extensions Conclusions

slide-33
SLIDE 33

Outline

5

Bilinear groups q-Type assumptions Extensions Conclusions Bilinear groups

Subgroup hiding Parameter hiding Dual systems

slide-34
SLIDE 34

Standard bilinear group: (N, G, H, GT, e, g, h)

Properties of (bilinear) groups

6

slide-35
SLIDE 35

Standard bilinear group: (N, G, H, GT, e, g, h)

Properties of (bilinear) groups

6

Group order; prime or composite

slide-36
SLIDE 36

Standard bilinear group: (N, G, H, GT, e, g, h)

Properties of (bilinear) groups

6

Group order; prime or composite

}

|G| = |H| = κN; |GT| = λN

slide-37
SLIDE 37

Standard bilinear group: (N, G, H, GT, e, g, h)

Properties of (bilinear) groups

6

Group order; prime or composite

}

|G| = |H| = κN; |GT| = λN e: G × H → GT bilinearity: e(ga,hb) = e(g,h)ab ∀a,b∈Z/NZ non-degeneracy: e(x,y) = 1 ∀y∈H ⇒ x = 1

slide-38
SLIDE 38

Standard bilinear group: (N, G, H, GT, e, g, h)

Properties of (bilinear) groups

6

Group order; prime or composite

}

|G| = |H| = κN; |GT| = λN e: G × H → GT bilinearity: e(ga,hb) = e(g,h)ab ∀a,b∈Z/NZ non-degeneracy: e(x,y) = 1 ∀y∈H ⇒ x = 1

}

G = <g>; H = <h>

slide-39
SLIDE 39

Standard bilinear group: (N, G, H, GT, e, g, h)

Properties of (bilinear) groups

6

Group order; prime or composite

}

|G| = |H| = κN; |GT| = λN e: G × H → GT bilinearity: e(ga,hb) = e(g,h)ab ∀a,b∈Z/NZ non-degeneracy: e(x,y) = 1 ∀y∈H ⇒ x = 1

}

G = <g>; H = <h>

slide-40
SLIDE 40

Standard bilinear group: (N, G, H, GT, e, g, h)

Properties of (bilinear) groups

6

Group order; prime or composite

}

|G| = |H| = κN; |GT| = λN e: G × H → GT bilinearity: e(ga,hb) = e(g,h)ab ∀a,b∈Z/NZ non-degeneracy: e(x,y) = 1 ∀y∈H ⇒ x = 1

}

G = <g>; H = <h>

subgroup hiding

slide-41
SLIDE 41

Standard bilinear group: (N, G, H, GT, e, g, h)

Properties of (bilinear) groups

6

Group order; prime or composite

}

|G| = |H| = κN; |GT| = λN e: G × H → GT bilinearity: e(ga,hb) = e(g,h)ab ∀a,b∈Z/NZ non-degeneracy: e(x,y) = 1 ∀y∈H ⇒ x = 1

}

G = <g>; H = <h>

subgroup hiding parameter hiding

slide-42
SLIDE 42

Composite-order bilinear group: (N, G, GT, e, g) where N = pq

Subgroup hiding

7

subgroup hiding parameter hiding

slide-43
SLIDE 43

Composite-order bilinear group: (N, G, GT, e, g) where N = pq

Subgroup hiding

7

subgroup hiding parameter hiding

Gp Gq

slide-44
SLIDE 44

Composite-order bilinear group: (N, G, GT, e, g) where N = pq Subgroup hiding [BGN05]:

Subgroup hiding

7

subgroup hiding parameter hiding

Gp Gq

slide-45
SLIDE 45

Composite-order bilinear group: (N, G, GT, e, g) where N = pq Subgroup hiding [BGN05]:

Subgroup hiding

7

subgroup hiding parameter hiding

Gp Gq ≈

slide-46
SLIDE 46

Composite-order bilinear group: (N, G, GT, e, g) where N = pq Subgroup hiding [BGN05]:

Subgroup hiding

7

subgroup hiding parameter hiding

Gp Gq ≈

random element of Gp × Gq

slide-47
SLIDE 47

Composite-order bilinear group: (N, G, GT, e, g) where N = pq Subgroup hiding [BGN05]:

Subgroup hiding

7

subgroup hiding parameter hiding

Gp Gq ≈

(indistinguishable from) random element of Gp × Gq

slide-48
SLIDE 48

Composite-order bilinear group: (N, G, GT, e, g) where N = pq Subgroup hiding [BGN05]:

Subgroup hiding

7

subgroup hiding parameter hiding

Gp Gq ≈

(indistinguishable from) random element of Gp random element of Gp × Gq

slide-49
SLIDE 49

Parameter hiding [L12]

Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements

subgroup hiding parameter hiding

8

slide-50
SLIDE 50

Parameter hiding [L12]

Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements

subgroup hiding parameter hiding

8

slide-51
SLIDE 51

Parameter hiding [L12]

Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements

subgroup hiding parameter hiding

g2f(x1,...,xc)

8

g1f(x1,...,xc)

slide-52
SLIDE 52

Parameter hiding [L12]

Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements

subgroup hiding parameter hiding

g2f(x1,...,xc)

8

≈

g1f(x1,...,xc)

slide-53
SLIDE 53

Parameter hiding [L12]

Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements

subgroup hiding parameter hiding

g2f(x1,...,xc)

8

≈

g1f(x1,...,xc) g1f(x1,...,xc)g2f(x1′,...,xc′)

slide-54
SLIDE 54

Parameter hiding [L12]

Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements

subgroup hiding parameter hiding

g2f(x1,...,xc)

8

is independent from ≈

g1f(x1,...,xc) g1f(x1,...,xc)g2f(x1′,...,xc′)

slide-55
SLIDE 55

Parameter hiding [L12]

Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements

subgroup hiding parameter hiding

g2f(x1,...,xc)

8

is independent from xi mod p reveals nothing about xi mod q (CRT) ≈

g1f(x1,...,xc) g1f(x1,...,xc)g2f(x1′,...,xc′)

slide-56
SLIDE 56

Typical dual-system proof for IBE [W09,LW10,...]

9

slide-57
SLIDE 57

Typical dual-system proof for IBE [W09,LW10,...]

9

Challenge ciphertext

slide-58
SLIDE 58

Typical dual-system proof for IBE [W09,LW10,...]

9

ID queries Challenge ciphertext

slide-59
SLIDE 59

Typical dual-system proof for IBE [W09,LW10,...]

normal: normal:

9

ID queries Challenge ciphertext

slide-60
SLIDE 60

Typical dual-system proof for IBE [W09,LW10,...]

normal: (subgroup hiding) normal:

9

ID queries Challenge ciphertext

slide-61
SLIDE 61

Typical dual-system proof for IBE [W09,LW10,...]

normal: (subgroup hiding) (parameter hiding) normal:

9

ID queries Challenge ciphertext

slide-62
SLIDE 62

Typical dual-system proof for IBE [W09,LW10,...]

normal: semi-functional (SF): (subgroup hiding) (parameter hiding) normal:

9

ID queries Challenge ciphertext

slide-63
SLIDE 63

Typical dual-system proof for IBE [W09,LW10,...]

normal: semi-functional (SF): (subgroup hiding) (parameter hiding) (subgroup hiding) normal:

9

ID queries Challenge ciphertext

slide-64
SLIDE 64

Typical dual-system proof for IBE [W09,LW10,...]

normal: semi-functional (SF): (subgroup hiding) (parameter hiding) (subgroup hiding) (parameter hiding) normal:

9

ID queries Challenge ciphertext

slide-65
SLIDE 65

Typical dual-system proof for IBE [W09,LW10,...]

normal: semi-functional (SF): (subgroup hiding) (parameter hiding) (subgroup hiding) (parameter hiding) normal: semi-functional (SF):

9

ID queries Challenge ciphertext

slide-66
SLIDE 66

Typical dual-system proof for IBE [W09,LW10,...]

normal: semi-functional (SF): (subgroup hiding) (parameter hiding) (subgroup hiding) (parameter hiding) normal: semi-functional (SF):

9

SF keys don’t decrypt SF ciphertexts!

ID queries Challenge ciphertext

slide-67
SLIDE 67

Dual systems in three easy steps

10

slide-68
SLIDE 68

Dual systems in three easy steps

10

  • 1. start with base scheme
slide-69
SLIDE 69

Dual systems in three easy steps

normal:

10

  • 1. start with base scheme
slide-70
SLIDE 70

Dual systems in three easy steps

normal:

10

  • 1. start with base scheme
  • 2. transition to SF version
slide-71
SLIDE 71

Dual systems in three easy steps

normal: semi-functional (SF): (subgroup hiding) (parameter hiding)

10

  • 1. start with base scheme
  • 2. transition to SF version
slide-72
SLIDE 72

Dual systems in three easy steps

normal: semi-functional (SF): (subgroup hiding) (parameter hiding)

10

  • 1. start with base scheme
  • 2. transition to SF version

(subgroup hiding)

slide-73
SLIDE 73

Dual systems in three easy steps

normal: semi-functional (SF): (subgroup hiding) (parameter hiding)

10

  • 1. start with base scheme
  • 2. transition to SF version

(subgroup hiding) (subgroup hiding)

slide-74
SLIDE 74

Dual systems in three easy steps

normal: semi-functional (SF): (subgroup hiding) (parameter hiding)

10

  • 1. start with base scheme
  • 2. transition to SF version

(subgroup hiding) (subgroup hiding)

slide-75
SLIDE 75

Dual systems in three easy steps

normal: semi-functional (SF): (subgroup hiding) (parameter hiding)

10

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

(subgroup hiding) (subgroup hiding)

slide-76
SLIDE 76

Outline

11

Cryptographic background Pseudorandom functions Extensions Conclusions Bilinear groups q-Type assumptions

The uber-assumption Relating uber-assumptions A bijection trick

slide-77
SLIDE 77

The “uber-assumption” [BBG05,B08]

Uber-assumption is parameterized by (c,R,S,T,f)

12

slide-78
SLIDE 78

The “uber-assumption” [BBG05,B08]

Uber-assumption is parameterized by (c,R,S,T,f)

  • c = number of variables: x1,...,xc ← R

12

slide-79
SLIDE 79

The “uber-assumption” [BBG05,B08]

Uber-assumption is parameterized by (c,R,S,T,f)

  • c = number of variables: x1,...,xc ← R
  • R = <1,ρ1,...,ρr>: A is given g, {gρi(x1,...,xc)}

12

slide-80
SLIDE 80

The “uber-assumption” [BBG05,B08]

Uber-assumption is parameterized by (c,R,S,T,f)

  • c = number of variables: x1,...,xc ← R
  • R = <1,ρ1,...,ρr>: A is given g, {gρi(x1,...,xc)}
  • S = <1,σ1,...,σs>: A is given h, {hσi(x1,...,xc)}

12

slide-81
SLIDE 81

The “uber-assumption” [BBG05,B08]

Uber-assumption is parameterized by (c,R,S,T,f)

  • c = number of variables: x1,...,xc ← R
  • R = <1,ρ1,...,ρr>: A is given g, {gρi(x1,...,xc)}
  • S = <1,σ1,...,σs>: A is given h, {hσi(x1,...,xc)}
  • T = <1,τ1,...,τt>: A is given e(g,h), {e(g,h)τi(x1,...,xc)}

12

slide-82
SLIDE 82

The “uber-assumption” [BBG05,B08]

Uber-assumption is parameterized by (c,R,S,T,f)

  • c = number of variables: x1,...,xc ← R
  • R = <1,ρ1,...,ρr>: A is given g, {gρi(x1,...,xc)}
  • S = <1,σ1,...,σs>: A is given h, {hσi(x1,...,xc)}
  • T = <1,τ1,...,τt>: A is given e(g,h), {e(g,h)τi(x1,...,xc)}
  • f(x1,...,xc): A needs to compute e(g,h)f(x1,...,xc) (or distinguish it from random)

12

slide-83
SLIDE 83

The “uber-assumption” [BBG05,B08]

Uber-assumption is parameterized by (c,R,S,T,f)

  • c = number of variables: x1,...,xc ← R
  • R = <1,ρ1,...,ρr>: A is given g, {gρi(x1,...,xc)}
  • S = <1,σ1,...,σs>: A is given h, {hσi(x1,...,xc)}
  • T = <1,τ1,...,τt>: A is given e(g,h), {e(g,h)τi(x1,...,xc)}
  • f(x1,...,xc): A needs to compute e(g,h)f(x1,...,xc) (or distinguish it from random)

uber(c,R,S,T,f) assumption: given (R,S,T) values, hard to compute/distinguish f

12

slide-84
SLIDE 84

Example uber-assumption: exponent q-SDH

exponent q-SDH [ZS-NS04]: given (g,gx,…,gxq), distinguish gxq+1 from random

13

slide-85
SLIDE 85

Example uber-assumption: exponent q-SDH

exponent q-SDH [ZS-NS04]: given (g,gx,…,gxq), distinguish gxq+1 from random

  • c = number of variables: c = 1

13

slide-86
SLIDE 86

Example uber-assumption: exponent q-SDH

exponent q-SDH [ZS-NS04]: given (g,gx,…,gxq), distinguish gxq+1 from random

  • c = number of variables: c = 1
  • R = <1,ρ1,…,ρr>: ρi(x) = xi (∀i 0≤i≤q)

13

slide-87
SLIDE 87

Example uber-assumption: exponent q-SDH

exponent q-SDH [ZS-NS04]: given (g,gx,…,gxq), distinguish gxq+1 from random

  • c = number of variables: c = 1
  • R = <1,ρ1,…,ρr>: ρi(x) = xi (∀i 0≤i≤q)
  • S = <1>
  • T = <1>

13

slide-88
SLIDE 88

Example uber-assumption: exponent q-SDH

exponent q-SDH [ZS-NS04]: given (g,gx,…,gxq), distinguish gxq+1 from random

  • c = number of variables: c = 1
  • R = <1,ρ1,…,ρr>: ρi(x) = xi (∀i 0≤i≤q)
  • S = <1>
  • T = <1>
  • f(x1,…,xc): f(x) = xq+1

13

slide-89
SLIDE 89

Example uber-assumption: exponent q-SDH

exponent q-SDH [ZS-NS04]: given (g,gx,…,gxq), distinguish gxq+1 from random

  • c = number of variables: c = 1
  • R = <1,ρ1,…,ρr>: ρi(x) = xi (∀i 0≤i≤q)
  • S = <1>
  • T = <1>
  • f(x1,…,xc): f(x) = xq+1

exponent q-SDH is uber(1,<1,{xi}>,<1>,<1>,xq+1)

13

slide-90
SLIDE 90

Applying dual systems to exponent q-SDH

14

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)

slide-91
SLIDE 91

Applying dual systems to exponent q-SDH

g1r1x1,…,g1r1x1q

14

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)

slide-92
SLIDE 92

Applying dual systems to exponent q-SDH

g1r1x1,…,g1r1x1q

14

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)

slide-93
SLIDE 93

Applying dual systems to exponent q-SDH

subgroup hiding

g1r1x1,…,g1r1x1q g1r1x1i ⋅ g2r1′x1i

vs.

14

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)

slide-94
SLIDE 94

Applying dual systems to exponent q-SDH

subgroup hiding

g1r1x1,…,g1r1x1q g1r1x1i ⋅ g2r1′x1i

parameter hiding

g1r1x1i ⋅ g2r1′x2i

vs.

14

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)

slide-95
SLIDE 95

Applying dual systems to exponent q-SDH

subgroup hiding

g1r1x1,…,g1r1x1q g1r1x1i ⋅ g2r1′x1i

parameter hiding

g1r1x1i ⋅ g2r1′x2i g1r1x1i + r2x2i ⋅ g2r1′x2i

subgroup hiding vs. vs.

14

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)

slide-96
SLIDE 96

Applying dual systems to exponent q-SDH

subgroup hiding

g1r1x1,…,g1r1x1q g1r1x1i ⋅ g2r1′x1i

parameter hiding

g1r1x1i ⋅ g2r1′x2i g1r1x1i + r2x2i ⋅ g2r1′x2i

subgroup hiding subgroup hiding

g1r1x1+r2x2,…,g1r1x1q+r2x2q

vs. vs. vs.

14

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)

slide-97
SLIDE 97

Applying dual systems to exponent q-SDH

subgroup hiding

g1r1x1,…,g1r1x1q

parameter hiding subgroup hiding subgroup hiding

g1r1x1+r2x2,…,g1r1x1q+r2x2q

14

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)

slide-98
SLIDE 98

Applying dual systems to exponent q-SDH

subgroup hiding

g1r1x1,…,g1r1x1q

parameter hiding subgroup hiding subgroup hiding

g1r1x1+r2x2,…,g1r1x1q+r2x2q g1∑rkxk,…,g1∑rkxkq

14

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)

slide-99
SLIDE 99

Applying dual systems to exponent q-SDH

subgroup hiding

g1r1x1,…,g1r1x1q

parameter hiding subgroup hiding subgroup hiding

g1r1x1+r2x2,…,g1r1x1q+r2x2q g1∑rkxk,…,g1∑rkxkq

14

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)

slide-100
SLIDE 100

Applying dual systems to exponent q-SDH

15

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden
slide-101
SLIDE 101

uber(c,R,<1,{xi}>,<1>,xq+1) → uber(lc,<1,{ ∑rkxki}>,<1>,<1>,∑rkxkq+1)

Applying dual systems to exponent q-SDH

15

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden
slide-102
SLIDE 102

uber(c,R,<1,{xi}>,<1>,xq+1) → uber(lc,<1,{ ∑rkxki}>,<1>,<1>,∑rkxkq+1)

Applying dual systems to exponent q-SDH

15

r r ... r 1 x . x x 1 x . x x . . . . . . 1 x . x x

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden
slide-103
SLIDE 103

uber(c,R,<1,{xi}>,<1>,xq+1) → uber(lc,<1,{ ∑rkxki}>,<1>,<1>,∑rkxkq+1)

Applying dual systems to exponent q-SDH

15

=

r r ... r 1 x . x x 1 x . x x . . . . . . 1 x . x x y y . . y

So A is really given

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden
slide-104
SLIDE 104

Applying dual systems to exponent q-SDH

16

=

r r ... r 1 x . x x 1 x . x x . . . . . . 1 x . x x y y . . y

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden
slide-105
SLIDE 105

Applying dual systems to exponent q-SDH

16

=

Vandermonde matrix, so if l=q+2 this is invertible

r r ... r 1 x . x x 1 x . x x . . . . . . 1 x . x x y y . . y

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden
slide-106
SLIDE 106

Applying dual systems to exponent q-SDH

16

=

Vandermonde matrix, so if l=q+2 this is invertible

Consider set S of l-sized sets; then r,y∈S Matrix multiplication is map M: S → S permutation

r r ... r 1 x . x x 1 x . x x . . . . . . 1 x . x x y y . . y

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden
slide-107
SLIDE 107

Applying dual systems to exponent q-SDH

16

=

Vandermonde matrix, so if l=q+2 this is invertible This is chosen uniformly at random from S

Consider set S of l-sized sets; then r,y∈S Matrix multiplication is map M: S → S permutation

r r ... r 1 x . x x 1 x . x x . . . . . . 1 x . x x y y . . y

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden
slide-108
SLIDE 108

Applying dual systems to exponent q-SDH

16

=

Vandermonde matrix, so if l=q+2 this is invertible This is chosen uniformly at random from S

Consider set S of l-sized sets; then r,y∈S Matrix multiplication is map M: S → S permutation

This is distributed uniformly random as well!

r r ... r 1 x . x x 1 x . x x . . . . . . 1 x . x x y y . . y

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden
slide-109
SLIDE 109

More generally, this is true if

! ! !

has linearly independent columns (or rows)

Applying dual systems to the uber-assumption

17

1 ρ . ρ f(x 1 ρ . ρ f(x . . . . . . . . 1 ρ . ρ f(x

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden
slide-110
SLIDE 110

More generally, this is true if

! ! !

has linearly independent columns (or rows)

Applying dual systems to the uber-assumption

17

1 ρ . ρ f(x 1 ρ . ρ f(x . . . . . . . . 1 ρ . ρ f(x

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

Decisional uber(c,R,S,T,f) holds if:

  • 1. subgroup hiding and parameter hiding hold
  • 2. S = T = <1>
  • 3. f is not a linear combination of ρi
slide-111
SLIDE 111

More generally, this is true if

! ! !

has linearly independent columns (or rows)

Applying dual systems to the uber-assumption

17

1 ρ . ρ f(x 1 ρ . ρ f(x . . . . . . . . 1 ρ . ρ f(x

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

Decisional uber(c,R,S,T,f) holds if:

  • 1. subgroup hiding and parameter hiding hold
  • 2. S = T = <1>
  • 3. f is not a linear combination of ρi
  • nly computational requirement
slide-112
SLIDE 112

More generally, this is true if

! ! !

has linearly independent columns (or rows)

Applying dual systems to the uber-assumption

17

1 ρ . ρ f(x 1 ρ . ρ f(x . . . . . . . . 1 ρ . ρ f(x

  • 1. start with base scheme
  • 2. transition to SF version
  • 3. argue information is hidden

Decisional uber(c,R,S,T,f) holds if:

  • 1. subgroup hiding and parameter hiding hold
  • 2. S = T = <1>
  • 3. f is not a linear combination of ρi
  • nly computational requirement

limitation

slide-113
SLIDE 113

Outline

18

Cryptographic background q-Type assumptions Data Conclusions Bilinear groups Extensions

Broader classes of assumptions Dodis-Yampolskiy PRF

slide-114
SLIDE 114

Strengthening our results

sh ph sh sh

19

slide-115
SLIDE 115

Strengthening our results

sh ph sh sh

Remember that we needed two types of subgroup hiding … …even when given a generator for

19

slide-116
SLIDE 116

Strengthening our results

sh ph sh sh

Remember that we needed two types of subgroup hiding … …even when given a generator for

vs.

19

slide-117
SLIDE 117

Strengthening our results

sh ph sh sh

Remember that we needed two types of subgroup hiding … …even when given a generator for

vs. vs.

19

slide-118
SLIDE 118

Strengthening our results

sh ph sh sh

Remember that we needed two types of subgroup hiding … …even when given a generator for This restricts us to “one-sided” assumptions

vs. vs.

19

  • 2. S = T = <1>
slide-119
SLIDE 119

Strengthening our results

sh ph sh sh

Remember that we needed two types of subgroup hiding … …even when given a generator for This restricts us to “one-sided” assumptions

vs. vs.

19

(g,gx,…,gxq) → gxq+1 or random

[eq-SDH]

  • 2. S = T = <1>
slide-120
SLIDE 120

Strengthening our results

sh ph sh sh

Remember that we needed two types of subgroup hiding … …even when given a generator for This restricts us to “one-sided” assumptions

vs. vs.

19

(g,gx,…,gxq) → gxq+1 or random (g,gx,…,gxq,hx) → compute (c,g1/x+c)

[eq-SDH] [q-SDH]

  • 2. S = T = <1>
slide-121
SLIDE 121

Strengthening our results

sh ph sh sh

vs. vs.

20

sh ph

Remember that we needed two types of subgroup hiding…

slide-122
SLIDE 122

Strengthening our results

sh ph sh sh

To address this, switch back to regular dual systems

vs. vs.

20

sh ph

Remember that we needed two types of subgroup hiding…

slide-123
SLIDE 123

Strengthening our results

sh ph sh sh

To address this, switch back to regular dual systems

vs. vs.

20

sh ph

Remember that we needed two types of subgroup hiding…

slide-124
SLIDE 124

Strengthening our results

sh ph sh sh

To address this, switch back to regular dual systems

vs. vs.

20

sh ph

Remember that we needed two types of subgroup hiding…

slide-125
SLIDE 125

Strengthening our results

sh ph sh sh

To address this, switch back to regular dual systems

vs. vs.

20

sh ph

Remember that we needed two types of subgroup hiding…

Computational uber(c,R,S,T,f) holds if:

  • 1. subgroup hiding and parameter hiding hold
  • 2. f is not a linear combination of ρi

limitation

slide-126
SLIDE 126

Strengthening our results

sh ph sh sh

To address this, switch back to regular dual systems This implies (for example) that q-SDH [BB04] follows from subgroup hiding.... …and so does everything based on q-SDH (like Boneh-Boyen signatures)*

vs. vs.

20

sh ph

Remember that we needed two types of subgroup hiding… *when instantiated in asymmetric composite-order groups [BRS11]

slide-127
SLIDE 127

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)

slide-128
SLIDE 128

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)

Theorem [DY05]: Advvrf ≤ a(λ)·Adva(λ)-DBDHI

slide-129
SLIDE 129

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)

Theorem [DY05]: Advvrf ≤ a(λ)·Adva(λ)-DBDHI

verifiable random function

slide-130
SLIDE 130

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)

Theorem [DY05]: Advvrf ≤ a(λ)·Adva(λ)-DBDHI

require u=e(g,h) verifiable random function

slide-131
SLIDE 131

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)

Theorem [DY05]: Advvrf ≤ a(λ)·Adva(λ)-DBDHI

require u=e(g,h) verifiable random function q-type assumption

slide-132
SLIDE 132

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)

Theorem [DY05]: Advvrf ≤ a(λ)·Adva(λ)-DBDHI

require u=e(g,h) looseness: need |a(λ)| ≤ poly(λ) verifiable random function q-type assumption

slide-133
SLIDE 133

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)

Theorem [DY05]: Advvrf ≤ a(λ)·Adva(λ)-DBDHI Theorem: Advprf ≤ q·Advsgh

require u=e(g,h) looseness: need |a(λ)| ≤ poly(λ) verifiable random function q-type assumption

slide-134
SLIDE 134

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)

Theorem [DY05]: Advvrf ≤ a(λ)·Adva(λ)-DBDHI Theorem: Advprf ≤ q·Advsgh

require u=e(g,h) looseness: need |a(λ)| ≤ poly(λ) verifiable random function q-type assumption pseudorandom function

slide-135
SLIDE 135

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)

Theorem [DY05]: Advvrf ≤ a(λ)·Adva(λ)-DBDHI Theorem: Advprf ≤ q·Advsgh

require u=e(g,h) looseness: need |a(λ)| ≤ poly(λ) verifiable random function q-type assumption require composite order pseudorandom function

slide-136
SLIDE 136

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)

Theorem [DY05]: Advvrf ≤ a(λ)·Adva(λ)-DBDHI Theorem: Advprf ≤ q·Advsgh

require u=e(g,h) looseness: need |a(λ)| ≤ poly(λ) verifiable random function q-type assumption require composite order pseudorandom function static assumption

slide-137
SLIDE 137

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)

Theorem [DY05]: Advvrf ≤ a(λ)·Adva(λ)-DBDHI Theorem: Advprf ≤ q·Advsgh

require u=e(g,h) looseness: need |a(λ)| ≤ poly(λ) verifiable random function q-type assumption require composite order a(λ) of arbitrary size pseudorandom function static assumption

slide-138
SLIDE 138

Outline

22

Cryptographic background q-Type assumptions Extensions Conclusions Bilinear groups Conclusions

slide-139
SLIDE 139

Conclusions and open problems

23

slide-140
SLIDE 140

We applied the dual-system technique directly to a broad class of assumptions

Conclusions and open problems

23

slide-141
SLIDE 141

We applied the dual-system technique directly to a broad class of assumptions Limitation: Restricted to (asymmetric) composite-order (bilinear) groups

Conclusions and open problems

23

slide-142
SLIDE 142

We applied the dual-system technique directly to a broad class of assumptions Limitation: Restricted to (asymmetric) composite-order (bilinear) groups Limitation: Can’t get rid of every q-type assumption

Conclusions and open problems

23

slide-143
SLIDE 143

We applied the dual-system technique directly to a broad class of assumptions Limitation: Restricted to (asymmetric) composite-order (bilinear) groups Limitation: Can’t get rid of every q-type assumption Full version!: cs.ucsd.edu/~smeiklejohn/files/eurocrypt14a.pdf

Conclusions and open problems

23

slide-144
SLIDE 144

We applied the dual-system technique directly to a broad class of assumptions Limitation: Restricted to (asymmetric) composite-order (bilinear) groups Limitation: Can’t get rid of every q-type assumption Full version!: cs.ucsd.edu/~smeiklejohn/files/eurocrypt14a.pdf

Conclusions and open problems

23

Thanks! Any questions?