Efficient UC-Secure Authenticated Key-Exchange for Algebraic - - PowerPoint PPT Presentation

▶
efficient uc secure authenticated key exchange for
SMART_READER_LITE
LIVE PREVIEW

Efficient UC-Secure Authenticated Key-Exchange for Algebraic - - PowerPoint PPT Presentation

Jan 16, 2024 458 likes •916 views

Efficient UC-Secure Authenticated Key-Exchange for Algebraic Languages PKC 2013 , Fabrice Ben Hamouda Olivier Blazy Cline Chevalier David Pointcheval Damien Vergnaud Horst Grtz Institute for IT Security / Ruhr-University Bochum ENS /

slide-1
SLIDE 1

Efficient UC-Secure Authenticated Key-Exchange for Algebraic Languages

PKC 2013, Fabrice Ben Hamouda Olivier Blazy Céline Chevalier David Pointcheval Damien Vergnaud Horst Görtz Institute for IT Security / Ruhr-University Bochum ENS / CNRS / INRIA / Université Panthéon-Assas

slide-2
SLIDE 2

1 Introduction

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 2/26

slide-3
SLIDE 3

1 Introduction 2 Building Blocks

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 2/26

slide-4
SLIDE 4

1 Introduction 2 Building Blocks 3 Language Authenticated Key Exchange

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 2/26

slide-5
SLIDE 5

1 Introduction 2 Building Blocks 3 Language Authenticated Key Exchange 4 Conclusion

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 2/26

slide-6
SLIDE 6

Outline

1 Introduction 2 Building Blocks 3 Language Authenticated Key Exchange 4 Conclusion

slide-7
SLIDE 7

Authenticated Key Exchange

Alice Bob − − − − − − − − − − − − − − − → ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − → KAB Share a common session key iff everything goes well.

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 4/26

slide-8
SLIDE 8

Password Authenticated Key Exchange [BM92]

Alice Bob − − − − − − − − − − − − − − − → ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − → pwA pwB Share a common session key iff they possess the same password.

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 5/26

slide-9
SLIDE 9

Secret Handshakes [BDSS03]

Alice Bob − − − − − − − − − − − − − − − → ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − → σA σB Share a common session key iff their signatures fit.

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 6/26

slide-10
SLIDE 10

Credential Authenticated Key Exchange [CCGS10]

Alice Bob − − − − − − − − − − − − − − − → ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − → Cred(A) Cred(B) Share a common session key iff they possess the required credentials.

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 7/26

slide-11
SLIDE 11

Language Authenticated Key Exchange

Alice Bob − − − − − − − − − − − − − − − → ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − → wA wB Share a common session key iff their (words/languages) fit.

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 8/26

slide-12
SLIDE 12

Outline

1 Introduction 2 Building Blocks

Cramer Shoup Encryption Revisited Smooth Projective Hash Functions and their language Manageable Languages

3 Language Authenticated Key Exchange 4 Conclusion

slide-13
SLIDE 13

Cramer Shoup Encryption Definition [CS02]

§ Setup(1λ): Generates a multiplicative group (p, G, g1, g2). § EKeyGenE(param): dk = (µ1,2, ν1,2, η1,2) $

← Z6

p,

pk = (c = gµ1

1 gµ2 2 , d = gν1 1 gν2 2 , h = gη1 1 gη2 2 ). § Encrypt(pk, M; α): For M, and α $

← Zp, defines C = CS(M; α) as

  • u = (gα

1 , gα 2 ), e = Mhα, v = (cdξ)α

. ξ = Hash(u, e)

§ Decrypt(dk = (µ, ν, η), C = (u, e, v)):

If v = uµi+ξνi

i

, then M = e · u−ηi

i

. IND-CCA under DDH

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 10/26

slide-14
SLIDE 14

Double Cramer Shoup Encryption Definition

§ Setup(1λ): Generates a multiplicative group (p, G, g1, g2). § EKeyGenE(param): dk $

← Z6

p, pk. § Encrypt1(pk, M; α): C = CS(M; α). § Encrypt2(pk, N, ξ; α′): For N, and α $

← Zp, defines C′ = CS′(N, ξ; α) as

  • u′ = (gα′

1 , gα′ 2 ), e′ = Mhα′, v′ = (cdξ)α′

.

§ Decrypt(dk = (µ, ν, η), C = (u, e, v), C′):

If v = uµi+ξνi

i

, then M = e · u−ηi

i

. If v′ = u′

i µi+ξνi, then N = e′ · u′ i −ηi.

IND-PD-CCA under DDH (IND-CCA on CS, IND-CPA on CS’)

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 11/26

slide-15
SLIDE 15

Multi Double Cramer Shoup Encryption Definition

§ Setup(1λ): Generates a multiplicative group (p, G, g1, g2). § EKeyGenE(param): dk $

← Z6

p, pk. § Encrypt1(pk, M; α): C = CS(M; α), where ξ = Hash(u, e). § Encrypt2(pk, N, ξ; α′): C′ = CS′(N, ξ; α′). § Decrypt(dk = (µ, ν, η), C, C′):

If v = uiµi+ξνi, then M = e · ui−ηi. If v′ = u′

i µi+ξνi, then N = e′ · u′ i −ηi.

IND-PD-CCA under DDH.

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 12/26

slide-16
SLIDE 16

Smooth Projective Hash Functions Definition [CS02,GL03]

Let {H} be a family of functions:

§ X, domain of these functions § L, subset (a language) of this domain

such that, for any point x in L, H(x) can be computed by using

§ either a secret hashing key hk: H(x) = HashL(hk; x); § or a public projected key hp: H′(x) = ProjHashL(hp; x, w)

Public mapping hk → hp = ProjKGL(hk, x)

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 13/26

slide-17
SLIDE 17

Properties

For any x ∈ X, H(x) = HashL(hk; x) For any x ∈ L, H(x) = ProjHashL(hp; x, w) w witness that x ∈ L

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 14/26

slide-18
SLIDE 18

Properties

For any x ∈ X, H(x) = HashL(hk; x) For any x ∈ L, H(x) = ProjHashL(hp; x, w) w witness that x ∈ L

Smoothness

For any x ∈ L, H(x) and hp are independent

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 14/26

slide-19
SLIDE 19

Properties

For any x ∈ X, H(x) = HashL(hk; x) For any x ∈ L, H(x) = ProjHashL(hp; x, w) w witness that x ∈ L

Smoothness

For any x ∈ L, H(x) and hp are independent

Pseudo-Randomness

For any x ∈ L, H(x) is pseudo-random, without a witness w

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 14/26

slide-20
SLIDE 20

Properties

For any x ∈ X, H(x) = HashL(hk; x) For any x ∈ L, H(x) = ProjHashL(hp; x, w) w witness that x ∈ L

Smoothness

For any x ∈ L, H(x) and hp are independent

Pseudo-Randomness

For any x ∈ L, H(x) is pseudo-random, without a witness w The latter property requires L to be a hard-partitioned subset of X:

Hard-Partitioned Subset

L is a hard-partitioned subset of X if it is computationally hard to distinguish a random element in L from a random element in X \ L

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 14/26

slide-21
SLIDE 21

Straightforward Languages

§ Diffie Hellman / Linear Tuple

(g, h, G = ga, H = ha) Valid Diffie Hellman tuple? hp : gκhλ hpa = G κHλ Oblivious Transfer, Implicit Opening of a ciphertext

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 15/26

slide-22
SLIDE 22

Straightforward Languages

§ Diffie Hellman / Linear Tuple

(g, h, G = ga, H = ha) Valid Diffie Hellman tuple? hp : gκhλ hpa = G κHλ Oblivious Transfer, Implicit Opening of a ciphertext (U = ua, V = vb, W = ga+b) Valid Linear tuple? hp : uκgλ, vµgλ hpa

1hpb 2 = UκV µW λ

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 15/26

slide-23
SLIDE 23

Straightforward Languages

§ Diffie Hellman / Linear Tuple § Conjunction / Disjunction

L1 ∩ L2 Simultaneous verification hp : hp1, hp2 H′

1 · H′ 2 = H1 · H2

∧Ai

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 15/26

slide-24
SLIDE 24

Straightforward Languages

§ Diffie Hellman / Linear Tuple § Conjunction / Disjunction

L1 ∪ L2 One out of 2 conditions hp = hp1, hp2, hp∆ H′ = L1?hpw1

1

: hpw2

2 · hp∆ = X hk1 1

Is it a bit?

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 15/26

slide-25
SLIDE 25

Advanced Languages

§ (Linear) Cramer-Shoup Encryption

(u1 = gr

1, u2 = gr 2, e = hrM, v = (cdξ)r)

Verifiability of the CS hp : gκ

1 gµ 2 (cdξ)ηhλ

hpr = uκ

1uµ 2 vη(e/M)λ

Implicit Opening of a ciphertext, verifiability of a ciphertext, PAKE

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 16/26

slide-26
SLIDE 26

Advanced Languages

§ (Linear) Cramer-Shoup Encryption

(u1 = gr

1, u2 = gr 2, e = hrM, v = (cdξ)r)

Verifiability of the CS hp : gκ

1 gµ 2 (cdξ)ηhλ

hpr = uκ

1uµ 2 vη(e/M)λ

Implicit Opening of a ciphertext, verifiability of a ciphertext, PAKE (gr

1, gs 2, gr+s 3

, hr

1hs 2M, (c1dξ 1)r(c2dξ 2)s)

Verifiability of the LCS hp : gκ

1 gθ 3(c1dξ 1)ηhλ, gµ 2 gθ 3(c2dξ 2)ηhλ

hpr

1hps 2 = uκ 1uµ 2 uθ 3vη(e/M)λ

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 16/26

slide-27
SLIDE 27

Advanced Languages

§ (Linear) Cramer-Shoup Encryption § Commitment of a commitment

(U = ua, V = vs, G = hsga) ELin hp : uηgλ, vθhλ hpa

1hps 2 = UηV θG λ

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 16/26

slide-28
SLIDE 28

Advanced Languages

§ (Linear) Cramer-Shoup Encryption § Commitment of a commitment § Linear Pairing Equations

 

i∈Ak

e(Yi, Ak,i)   ·  

i∈Bk

Zi Zk,i   = Dk For each variables: hpi : uκigλ, vµigλ

  • i∈Ak e(hpwi

i , Ak,i)

  • ·
  • i∈Bk HP

Zk,iwi i

  • =
  • i∈Ak e(Hi, Ak,i)
  • ·
  • i∈Bk Hi Zk,i
  • /Dλ

k

Knowledge of a secret key, Knowledge of a (secret) signature on a (secret) message valid under a (secret) verification key, . . .

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 16/26

slide-29
SLIDE 29

Commitment à la Lindell [Lin11]

Alice Bob C, C′ = DCS(M, 1; α), π = Ped(C′, t, M) C, π − − − − − − − − − − − − − − − → ǫ $ ← Zn

p,

ǫ, hp ← − − − − − − − − − − − − − − − hpi = gµi

1 gνi 2 hλi(cdξ)θi

z = ǫα1 + α2 t, C′ − − − − − − − − − − − − − − − →

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 17/26

slide-30
SLIDE 30

Commitment à la Lindell [Lin11]

Alice Bob C, C′ = DCS(M, 1; α), π = Ped(C′, t, M) C, π − − − − − − − − − − − − − − − → ǫ $ ← Zn

p,

ǫ, hp ← − − − − − − − − − − − − − − − hpi = gµi

1 gνi 2 hλi(cdξ)θi

z = ǫα1 + α2 t, C′ − − − − − − − − − − − − − − − → hpz, M − − − − − − − − − − − − − − − → Hash(CǫC′, M, hk)

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 17/26

slide-31
SLIDE 31

§ Self-Randomizable Language

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 18/26

slide-32
SLIDE 32

§ Self-Randomizable Language § Double-Step PD-CCA Commitment

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 18/26

slide-33
SLIDE 33

§ Self-Randomizable Language § Double-Step PD-CCA Commitment § Implicit Decommitment

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 18/26

slide-34
SLIDE 34

Outline

1 Introduction 2 Building Blocks 3 Language Authenticated Key Exchange

General Instantiation Secret Handshakes Password Authenticated Key Exchange

4 Conclusion

slide-35
SLIDE 35

Language Authenticated Key Exchange

Alice Bob C(LB, L′

A, MB), π(C′)

− − − − − − − − − − − − − − − → C(L′

B, LA, MA), hpB, ǫ

← − − − − − − − − − − − − − − − hpA, C′(1, 1, 1) − − − − − − − − − − − − − − − → HB · H′

A

H′

B · HA

Same value iff languages are as expected, and users know witnesses.

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 20/26

slide-36
SLIDE 36

Secret Handshakes for the same secret signing authority

Alice Bob C(L(σ, vkA, idB), L(σ, vkA, idA), σ(A)), π(C′) − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − → C(L(σ, vkB, idB), L(σ, vkB, idA), σ(B)), hpB, ǫ ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − hpA, C′(1, 1, 1) − − − − − − − − − − − − − − − → HB · H′

A

H′

B · HA

Ciphertext of a Waters Signature valid under the committed vk: e(σ1, g) = e(h, vk) · e(id∗, σ2)

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 21/26

slide-37
SLIDE 37

Password Authenticated Key Exchange

Alice Bob C(pwB), π(C′) − − − − − − − − − − − − − − − → C(pwA), hpB, ǫ ← − − − − − − − − − − − − − − − hpA, C′(1) − − − − − − − − − − − − − − − → HB · H′

A

H′

B · HA

Share a common session key iff they possess the same password.

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 22/26

slide-38
SLIDE 38

Password Authenticated Key Exchange

Alice Bob urA, vrA, pwBhrA, (cdξA)rA − − − − − − − − − − − − − − − − − − → gtkHash(C′

A)

pwAhrB, grB ← − − − − − − − − − − − − − − − hpB : uλBvµBhηB(cdξA)θB, ǫ C′

A = (usA, vsA, hsA, (cdξA)sA)

− − − − − − − − − − − − − − − − − − − − − → t, hpA : gλAhηA ChkA

B,−pwA · hpsA+ǫrA B

hprB

A · C∗ A,−pwB hkB

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 23/26

slide-39
SLIDE 39

Outline

1 Introduction 2 Building Blocks 3 Language Authenticated Key Exchange 4 Conclusion

slide-40
SLIDE 40

Extensions and Open Questions

We presented a general Framework to instantiate several AKE protocols.

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 25/26

slide-41
SLIDE 41

Extensions and Open Questions

We presented a general Framework to instantiate several AKE protocols. This allows to produce efficient UC instantiations under classical assumptions (DDH,DLin,...)

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 25/26

slide-42
SLIDE 42

Extensions and Open Questions

We presented a general Framework to instantiate several AKE protocols. This allows to produce efficient UC instantiations under classical assumptions (DDH,DLin,...) Concrete examples for PAKE, v-PAKE, several Secret Handshakes, CAKE, . . .

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 25/26

slide-43
SLIDE 43

Extensions and Open Questions

We presented a general Framework to instantiate several AKE protocols. This allows to produce efficient UC instantiations under classical assumptions (DDH,DLin,...) Concrete examples for PAKE, v-PAKE, several Secret Handshakes, CAKE, . . . New manageable languages with SPHF implicit proofs of knowledge

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 25/26

slide-44
SLIDE 44

Extensions and Open Questions

We presented a general Framework to instantiate several AKE protocols. This allows to produce efficient UC instantiations under classical assumptions (DDH,DLin,...) Concrete examples for PAKE, v-PAKE, several Secret Handshakes, CAKE, . . . New manageable languages with SPHF implicit proofs of knowledge Several new tools: multi-commitment on CS, revisited commitment à la Lindell, . . .

LAKE | Horst Görtz Institute for IT-Security | PKC 2013 25/26

slide-45
SLIDE 45

Many thanks for your attention! Any questions? More details are available in the full version. . .

LAKE | Horst Görtz Institute for IT-Security | PKC 2013