Efficient UC-Secure Authenticated Key-Exchange for Algebraic - PowerPoint PPT Presentation

Efficient UC-Secure Authenticated Key-Exchange for Algebraic Languages PKC 2013 , Fabrice Ben Hamouda Olivier Blazy Céline Chevalier David Pointcheval Damien Vergnaud Horst Görtz Institute for IT Security / Ruhr-University Bochum ENS / CNRS / INRIA / Université Panthéon-Assas

1 Introduction LAKE | Horst Görtz Institute for IT-Security | PKC 2013 2/26

1 Introduction 2 Building Blocks LAKE | Horst Görtz Institute for IT-Security | PKC 2013 2/26

1 Introduction 2 Building Blocks 3 Language Authenticated Key Exchange LAKE | Horst Görtz Institute for IT-Security | PKC 2013 2/26

1 Introduction 2 Building Blocks 3 Language Authenticated Key Exchange 4 Conclusion LAKE | Horst Görtz Institute for IT-Security | PKC 2013 2/26

Outline 1 Introduction 2 Building Blocks 3 Language Authenticated Key Exchange 4 Conclusion

Authenticated Key Exchange Alice Bob − − − − − − − − − − − − − − − → ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − → K AB Share a common session key iff everything goes well. LAKE | Horst Görtz Institute for IT-Security | PKC 2013 4/26

Password Authenticated Key Exchange [BM92] Alice Bob − − − − − − − − − − − − − − − → ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − → pw A pw B Share a common session key iff they possess the same password. LAKE | Horst Görtz Institute for IT-Security | PKC 2013 5/26

Secret Handshakes [BDSS03] Alice Bob − − − − − − − − − − − − − − − → ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − → σ A σ B Share a common session key iff their signatures fit. LAKE | Horst Görtz Institute for IT-Security | PKC 2013 6/26

Credential Authenticated Key Exchange [CCGS10] Alice Bob − − − − − − − − − − − − − − − → ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − → Cred ( A ) Cred ( B ) Share a common session key iff they possess the required credentials. LAKE | Horst Görtz Institute for IT-Security | PKC 2013 7/26

Language Authenticated Key Exchange Alice Bob − − − − − − − − − − − − − − − → ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − → w A w B Share a common session key iff their (words/languages) fit. LAKE | Horst Görtz Institute for IT-Security | PKC 2013 8/26

Outline 1 Introduction 2 Building Blocks Cramer Shoup Encryption Revisited Smooth Projective Hash Functions and their language Manageable Languages 3 Language Authenticated Key Exchange 4 Conclusion

Cramer Shoup Encryption Definition [CS02] § Setup ( 1 λ ) : Generates a multiplicative group ( p , G , g 1 , g 2 ) . $ ← Z 6 § EKeyGen E ( param ) : dk = ( µ 1 , 2 , ν 1 , 2 , η 1 , 2 ) p , pk = ( c = g µ 1 1 g µ 2 2 , h = g η 1 1 g η 2 2 , d = g ν 1 1 g ν 2 2 ) . $ § Encrypt ( pk , M ; α ) : For M , and α ← Z p , defines C = CS ( M ; α ) as � u = ( g α 1 , g α 2 ) , e = Mh α , v = ( cd ξ ) α � . ξ = Hash ( u , e ) § Decrypt ( dk = ( µ, ν, η ) , C = ( u , e , v )) : If v = � u µ i + ξν i , then M = e · � u − η i . i i IND-CCA under DDH LAKE | Horst Görtz Institute for IT-Security | PKC 2013 10/26

Double Cramer Shoup Encryption Definition § Setup ( 1 λ ) : Generates a multiplicative group ( p , G , g 1 , g 2 ) . § EKeyGen E ( param ) : dk $ ← Z 6 p , pk. § Encrypt 1 ( pk , M ; α ) : C = CS ( M ; α ) . ← Z p , defines C ′ = CS ′ ( N , ξ ; α ) $ § Encrypt 2 ( pk , N , ξ ; α ′ ) : For N , and α as u ′ = ( g α ′ 2 ) , e ′ = Mh α ′ , v ′ = ( cd ξ ) α ′ � 1 , g α ′ � . § Decrypt ( dk = ( µ, ν, η ) , C = ( u , e , v ) , C ′ ) : If v = � u µ i + ξν i , then M = e · � u − η i . i i If v ′ = � u ′ µ i + ξν i , then N = e ′ · � u ′ − η i . i i IND-PD-CCA under DDH (IND-CCA on CS, IND-CPA on CS’) LAKE | Horst Görtz Institute for IT-Security | PKC 2013 11/26

Multi Double Cramer Shoup Encryption Definition § Setup ( 1 λ ) : Generates a multiplicative group ( p , G , g 1 , g 2 ) . § EKeyGen E ( param ) : dk $ ← Z 6 p , pk. § Encrypt 1 ( pk , M ; α ) : C = CS ( M ; α ) , where ξ = Hash ( u , e ) . § Encrypt 2 ( pk , N , ξ ; α ′ ) : C ′ = CS ′ ( N , ξ ; α ′ ) . § Decrypt ( dk = ( µ, ν, η ) , C , C ′ ) : If v = � u i µ i + ξν i , then M = e · � u i − η i . If v ′ = � u ′ µ i + ξν i , then N = e ′ · � u ′ − η i . i i IND-PD-CCA under DDH. LAKE | Horst Görtz Institute for IT-Security | PKC 2013 12/26

Smooth Projective Hash Functions Definition [CS02,GL03] Let { H } be a family of functions: § X , domain of these functions § L , subset (a language) of this domain such that, for any point x in L , H ( x ) can be computed by using § either a secret hashing key hk: H ( x ) = Hash L ( hk ; x ) ; § or a public projected key hp: H ′ ( x ) = ProjHash L ( hp ; x , w ) Public mapping hk �→ hp = ProjKG L ( hk , x ) LAKE | Horst Görtz Institute for IT-Security | PKC 2013 13/26

Properties For any x ∈ X , H ( x ) = Hash L ( hk ; x ) For any x ∈ L , H ( x ) = ProjHash L ( hp ; x , w ) w witness that x ∈ L LAKE | Horst Görtz Institute for IT-Security | PKC 2013 14/26

Properties For any x ∈ X , H ( x ) = Hash L ( hk ; x ) For any x ∈ L , H ( x ) = ProjHash L ( hp ; x , w ) w witness that x ∈ L Smoothness For any x �∈ L , H ( x ) and hp are independent LAKE | Horst Görtz Institute for IT-Security | PKC 2013 14/26

Properties For any x ∈ X , H ( x ) = Hash L ( hk ; x ) For any x ∈ L , H ( x ) = ProjHash L ( hp ; x , w ) w witness that x ∈ L Smoothness For any x �∈ L , H ( x ) and hp are independent Pseudo-Randomness For any x ∈ L , H ( x ) is pseudo-random, without a witness w LAKE | Horst Görtz Institute for IT-Security | PKC 2013 14/26

Properties For any x ∈ X , H ( x ) = Hash L ( hk ; x ) For any x ∈ L , H ( x ) = ProjHash L ( hp ; x , w ) w witness that x ∈ L Smoothness For any x �∈ L , H ( x ) and hp are independent Pseudo-Randomness For any x ∈ L , H ( x ) is pseudo-random, without a witness w The latter property requires L to be a hard-partitioned subset of X : Hard-Partitioned Subset L is a hard-partitioned subset of X if it is computationally hard to distinguish a random element in L from a random element in X \ L LAKE | Horst Görtz Institute for IT-Security | PKC 2013 14/26

Straightforward Languages § Diffie Hellman / Linear Tuple ( g , h , G = g a , H = h a ) Valid Diffie Hellman tuple? hp a = G κ H λ hp : g κ h λ Oblivious Transfer, Implicit Opening of a ciphertext LAKE | Horst Görtz Institute for IT-Security | PKC 2013 15/26

Straightforward Languages § Diffie Hellman / Linear Tuple ( g , h , G = g a , H = h a ) Valid Diffie Hellman tuple? hp a = G κ H λ hp : g κ h λ Oblivious Transfer, Implicit Opening of a ciphertext ( U = u a , V = v b , W = g a + b ) Valid Linear tuple? hp : u κ g λ , v µ g λ hp a 1 hp b 2 = U κ V µ W λ LAKE | Horst Görtz Institute for IT-Security | PKC 2013 15/26

Straightforward Languages § Diffie Hellman / Linear Tuple § Conjunction / Disjunction L 1 ∩ L 2 Simultaneous verification H ′ 1 · H ′ hp : hp 1 , hp 2 2 = H 1 · H 2 ∧ A i LAKE | Horst Görtz Institute for IT-Security | PKC 2013 15/26

Straightforward Languages § Diffie Hellman / Linear Tuple § Conjunction / Disjunction L 1 ∪ L 2 One out of 2 conditions H ′ = L 1 ? hp w 1 : hp w 2 2 · hp ∆ = X hk 1 hp = hp 1 , hp 2 , hp ∆ 1 1 Is it a bit? LAKE | Horst Görtz Institute for IT-Security | PKC 2013 15/26

Advanced Languages § (Linear) Cramer-Shoup Encryption ( u 1 = g r 1 , u 2 = g r 2 , e = h r M , v = ( cd ξ ) r ) Verifiability of the CS hp r = u κ 1 g µ 1 u µ hp : g κ 2 ( cd ξ ) η h λ 2 v η ( e / M ) λ Implicit Opening of a ciphertext, verifiability of a ciphertext, PAKE LAKE | Horst Görtz Institute for IT-Security | PKC 2013 16/26

Advanced Languages § (Linear) Cramer-Shoup Encryption ( u 1 = g r 1 , u 2 = g r 2 , e = h r M , v = ( cd ξ ) r ) Verifiability of the CS hp r = u κ 1 g µ 1 u µ hp : g κ 2 ( cd ξ ) η h λ 2 v η ( e / M ) λ Implicit Opening of a ciphertext, verifiability of a ciphertext, PAKE 2 , g r + s 2 M , ( c 1 d ξ 1 ) r ( c 2 d ξ ( g r 1 , g s , h r 1 h s 2 ) s ) Verifiability of the LCS 3 3 ( c 1 d ξ 1 ) η h λ , g µ 3 ( c 2 d ξ 1 u µ hp : g κ 1 g θ 2 g θ 2 ) η h λ hp r 1 hp s 2 = u κ 2 u θ 3 v η ( e / M ) λ LAKE | Horst Görtz Institute for IT-Security | PKC 2013 16/26

Advanced Languages § (Linear) Cramer-Shoup Encryption § Commitment of a commitment ( U = u a , V = v s , G = h s g a ) ELin hp : u η g λ , v θ h λ hp a 1 hp s 2 = U η V θ G λ LAKE | Horst Görtz Institute for IT-Security | PKC 2013 16/26