Efficient KDM-CCA Secure Public-Key Encryption for Polynomial - PowerPoint PPT Presentation

Efficient KDM-CCA Secure Public-Key Encryption for Polynomial Functions Shuai Han, Shengli Liu, and Lin Lyu 1. Shanghai Jiao Tong University 2. State Key Laboratory of Cryptology 3. Westone Cryptologic Research Center Asiacrypt 2016, Hanoi, Vietnam

Key-Dependent Message • KDM security: allow adversary to access encryptions of messages, which are closely dependent on the secret keys. Enc ( pk , f ( sk ))

Key-Dependent Message • KDM security: allow adversary to access encryptions of messages, which are closely dependent on the secret keys. Enc ( pk , f ( sk )) • Applications: – Hard disk encryption – Anonymous credential system

Key-Dependent Message • KDM security: allow adversary to access encryptions of messages, which are closely dependent on the secret keys. Enc ( pk , f ( sk )) • Applications: – Hard disk encryption – Anonymous credential system • Traditional security notion does not imply KDM security. [ABBC’10, CGH’12, MO’14, BHW’15, KRW’15, KW’16, AP’16] · · ·

Public-Key Encryption PKE = ( Setup , Gen , Enc , Dec ) : ( pk , sk ) ← $ Gen ( prm ) Alice Bob

Public-Key Encryption PKE = ( Setup , Gen , Enc , Dec ) : ( pk , sk ) ← $ Gen ( prm ) pke.ct pke.ct ← $ Enc ( pk , m ) Alice Bob

Public-Key Encryption PKE = ( Setup , Gen , Enc , Dec ) : ( pk , sk ) ← $ Gen ( prm ) pke.ct pke.ct ← $ Enc ( pk , m ) m ← Dec ( sk , pke.ct ) Alice Bob

KDM Security ( pk 1 , sk 1 ) ← $ Gen ( prm ) ( pk i , sk i ) ← $ Gen ( prm ) ( pk n , sk n ) ← $ Gen ( prm ) … … User 1 User i User n pk 1 , · · · , pk n

KDM Security ( pk 1 , sk 1 ) ← $ Gen ( prm ) ( pk i , sk i ) ← $ Gen ( prm ) ( pk n , sk n ) ← $ Gen ( prm ) … … User 1 User i User n f pk 1 , · · · , pk n

KDM Security ( pk 1 , sk 1 ) ← $ Gen ( prm ) ( pk i , sk i ) ← $ Gen ( prm ) ( pk n , sk n ) ← $ Gen ( prm ) … … User 1 User i User n pke.ct ∗ ← $ Enc ( pk i , f ( sk 1 , · · · , sk n )) or pke.ct ∗ ← $ Enc ( pk i , 0 ) f pk 1 , · · · , pk n

KDM Security ( pk 1 , sk 1 ) ← $ Gen ( prm ) ( pk i , sk i ) ← $ Gen ( prm ) ( pk n , sk n ) ← $ Gen ( prm ) … … User 1 User i User n pke.ct ∗ ← $ Enc ( pk i , f ( sk 1 , · · · , sk n )) or pke.ct ∗ ← $ Enc ( pk i , 0 ) f pke.ct ∗ pk 1 , · · · , pk n

KDM Security ( pk 1 , sk 1 ) ← $ Gen ( prm ) ( pk i , sk i ) ← $ Gen ( prm ) ( pk n , sk n ) ← $ Gen ( prm ) … … User 1 User i User n pke.ct ∗ ← $ Enc ( pk i , f ( sk 1 , · · · , sk n )) pke.ct or pke.ct ∗ ← $ Enc ( pk i , 0 ) f pke.ct ∗ pk 1 , · · · , pk n

KDM Security ( pk 1 , sk 1 ) ← $ Gen ( prm ) ( pk i , sk i ) ← $ Gen ( prm ) ( pk n , sk n ) ← $ Gen ( prm ) … … User 1 User i User n pke.ct ∗ ← $ Enc ( pk i , f ( sk 1 , · · · , sk n )) m ← Dec ( sk i , pke.ct ) pke.ct or pke.ct ∗ ← $ Enc ( pk i , 0 ) f pke.ct ∗ pk 1 , · · · , pk n

KDM Security ( pk 1 , sk 1 ) ← $ Gen ( prm ) ( pk i , sk i ) ← $ Gen ( prm ) ( pk n , sk n ) ← $ Gen ( prm ) … … User 1 User i User n pke.ct ∗ ← $ Enc ( pk i , f ( sk 1 , · · · , sk n )) m ← Dec ( sk i , pke.ct ) pke.ct or pke.ct ∗ ← $ Enc ( pk i , 0 ) f pke.ct ∗ m pk 1 , · · · , pk n

Function Set of KDM Security KDM security is related to a set of functions F from SK × · · · × SK to M . – F circ : the set of selection functions. f : ( sk 1 , · · · , sk n ) �− → sk i – F aff : the set of affine functions. n f : ( sk 1 , · · · , sk n ) �−→ � a i · sk i + b i = 1 – F d poly : the set of polynomial functions of bounded degree d . a ( c 1 , ··· , c n ) · sk c 1 1 · · · sk c n f : ( sk 1 , · · · , sk n ) �−→ � n 0 ≤ c 1 + ··· + c n ≤ d

Function Set of KDM Security KDM security is related to a set of functions F from SK × · · · × SK to M . – F circ : the set of selection functions. f : ( sk 1 , · · · , sk n ) �−→ sk i – F aff : the set of affine functions. n f : ( sk 1 , · · · , sk n ) �−→ � a i · sk i + b i = 1 – F d poly : the set of polynomial functions of bounded degree d . a ( c 1 , ··· , c n ) · sk c 1 1 · · · sk c n f : ( sk 1 , · · · , sk n ) �−→ � n 0 ≤ c 1 + ··· + c n ≤ d The larger F is, the stronger the security is.

Related Works: KDM-CPA secure PKE KDM-CPA PKE Scheme KDM-CCA? | Ciphertext | Assumption Function Set [BHHO’08], [BG’10] F aff − O ( ℓ ) | G | DDH/QR/DCR [ACPS’09] F aff − O ( 1 ) | G | LWE F d O ( ℓ d + 1 ) | G | [BGK’11] DDH/LWE − poly F d [MTY’11] O ( d ) | G | DCR − poly – ℓ : security parameter. – d : bounded degree of polynomial functions.

Related Works: KDM-CCA secure PKE KDM-CCA PKE Scheme KDM-CCA? | Ciphertext | Assumption Function Set √ [BHHO’08] + [CCS’09] F aff O ( ℓ ) | G | DDH √ [Hofheinz’13] O ( 1 ) | G | DDH & DCR F circ � [LLJ’15] ? O ( 1 ) | G | DDH & DCR F aff – ℓ : security parameter. – d : bounded degree of polynomial functions.

Our Contribution KDM-CCA PKE Scheme KDM-CCA? | Ciphertext | Assumption Function Set √ Our first scheme F aff O ( 1 ) | G | DDH & DCR √ F d O ( d 9 ) | G | Our second scheme DDH & DCR poly • We give the first efficient KDM [ F aff ] -CCA secure PKE with compact ciphertexts. – Compact: the ciphertexts consist only a constant number of group elements. – Efficient: our scheme is free of NIZK and free of pairing.

Our Contribution KDM-CCA PKE Scheme KDM-CCA? | Ciphertext | Assumption Function Set √ Our first scheme F aff O ( 1 ) | G | DDH & DCR √ F d O ( d 9 ) | G | Our second scheme DDH & DCR poly • We give the first efficient KDM [ F aff ] -CCA secure PKE with compact ciphertexts. – Compact: the ciphertexts consist only a constant number of group elements. – Efficient: our scheme is free of NIZK and free of pairing. • We extend our technique, and construct the first efficient KDM [ F d poly ] -CCA secure PKE with almost compact ciphertexts.

Synopsis 1. The LLJ Scheme [Lu, Li and Jia, 2015] 2. Introducing: Authenticated Encryption with Auxiliary-Input 3. KDM-CCA secure PKE for Affine Functions 4. KDM-CCA secure PKE for Polynomial Functions

The LLJ Scheme from Related-Key Attack secure “ AE ” The LLJ Scheme AE � ? INT- F aff -RKA DDH KDM[ F aff ]-CCA • One essential building block called “Authenticated Encryption” (AE) is employed. • The “INT- F aff -RKA” (ciphertext-integrity against related-key attacks) security proof of the LLJ’s AE does not go through to the DDH assumption.

INT- F aff -RKA security of LLJ’s AE DDH Problem Solver DDH tuple or Random tuple No trapdoor Adversary against INT- F aff -RKA of Decision bit: 0/1 AE Decision forgery procedure • LLJ’s AE: (ElGamal)-type. ( g r , g kr ) . • The DDH adversary does not have any trapdoor to convert the forgery from the adversary of AE to a decision bit in an efficient way.

Synopsis 1. The LLJ Scheme [Lu, Li and Jia, 2015] 2. Introducing: Authenticated Encryption with Auxiliary-Input 3. KDM-CCA secure PKE for Affine Functions 4. KDM-CCA secure PKE for Polynomial Functions

A Plausible Solution • Our new AIAE: (Kurosawa-Desmedt [KD’04])-type. � � 2 , g r ( k 1 + k 3 t ) , g r ( k 2 + k 4 t ) g r 1 , g r . 1 2

A Plausible Solution • Our new AIAE: (Kurosawa-Desmedt [KD’04])-type. � � 2 , g r ( k 1 + k 3 t ) , g r ( k 2 + k 4 t ) g r 1 , g r . 1 2 New Problem! The secret key of our AIAE consists of several elements k = ( k 1 , k 2 , k 3 , k 4 ) . The affine function of k is too complicated to prove the INT- F aff -RKA security. 4 4 4 4 f : ( k 1 , k 2 , k 3 , k 4 ) �−→ ( � a i , 1 · k i + b 1 , � a i , 2 · k i + b 2 , � a i , 3 · k i + b 3 , � a i , 4 · k i + b 4 ) i = 1 i = 1 i = 1 i = 1

Our Solution: Authenticated Encryption with Auxiliary-Input AIAE = ( AIAE . Setup , AIAE . Enc , AIAE . Dec ) : k k Alice Bob • We introduce “Authenticated Encryption with Auxiliary-Input” (AIAE).

Our Solution: Authenticated Encryption with Auxiliary-Input AIAE = ( AIAE . Setup , AIAE . Enc , AIAE . Dec ) : k k Alice Bob • We introduce “Authenticated Encryption with Auxiliary-Input” (AIAE). – AIAE must have auxiliary input “aux”.

Our Solution: Authenticated Encryption with Auxiliary-Input AIAE = ( AIAE . Setup , AIAE . Enc , AIAE . Dec ) : k k aiae.ct , aux aiae.ct ← $ AIAE.Enc ( k , m , aux ) Alice Bob • We introduce “Authenticated Encryption with Auxiliary-Input” (AIAE). – AIAE must have auxiliary input “aux”.

Our Solution: Authenticated Encryption with Auxiliary-Input AIAE = ( AIAE . Setup , AIAE . Enc , AIAE . Dec ) : k k aiae.ct , aux aiae.ct ← $ AIAE.Enc ( k , m , aux ) m ← AIAE.Dec ( k , aiae.ct , aux ) Alice Bob • We introduce “Authenticated Encryption with Auxiliary-Input” (AIAE). – AIAE must have auxiliary input “aux”.

Our Solution: Authenticated Encryption with Auxiliary-Input AIAE = ( AIAE . Setup , AIAE . Enc , AIAE . Dec ) : k k aiae.ct , aux aiae.ct ← $ AIAE.Enc ( k , m , aux ) m ← AIAE.Dec ( k , aiae.ct , aux ) Alice Bob • We introduce “Authenticated Encryption with Auxiliary-Input” (AIAE). – AIAE must have auxiliary input “aux”. – Weak INT- F -RKA security: an additional “special rule” for the forgery.

Weak INT- F -RKA security for AIAE k User f , m , aux