Forward-secrecy on POP Arthur Villard School of Computer and - - PowerPoint PPT Presentation

▶
forward secrecy on pop
SMART_READER_LITE
LIVE PREVIEW

Forward-secrecy on POP Arthur Villard School of Computer and - - PowerPoint PPT Presentation

Nov 14, 2022 171 likes •488 views

Forward-secrecy on POP Arthur Villard School of Computer and Communication Sciences Decentralized and Distributed Systems lab Master Thesis September 2017 Responsible Supervisor Prof. Bryan Ford Prof. Ewa Syta Linus Gasser EPFL / DEDIS

slide-1
SLIDE 1

Forward-secrecy on POP

School of Computer and Communication Sciences Decentralized and Distributed Systems lab Master Thesis – September 2017

Responsible

  • Prof. Bryan Ford

EPFL / DEDIS Supervisor Linus Gasser EPFL / DEDIS

Arthur Villard

  • Prof. Ewa Syta

Trinity College

slide-2
SLIDE 2

12/02/2018 Arthur Villard - Master Thesis 2 DEDIS

Context

  • Online collaborative service (e.g. Wikipedia)
  • Authenticate users anonymously against a list
  • Link authentication attempts
  • Other example: e-voting
slide-3
SLIDE 3

12/02/2018 Arthur Villard - Master Thesis 3 DEDIS

Overview

  • Introduction
  • PoP and DAGA interaction
  • Implementing DAGA
  • Improving DAGA
  • Conclusion & Future work
slide-4
SLIDE 4

12/02/2018 Arthur Villard - Master Thesis 4 DEDIS

Overview

  • Introduction
  • PoP and DAGA interaction
  • Implementing DAGA
  • Improving DAGA
  • Conclusion & Future work
slide-5
SLIDE 5

12/02/2018 Arthur Villard - Master Thesis 5 DEDIS

Frameworks

  • PoP: Proof of Personhood – DEDIS

➔ Creation of the user list ➔ Authentication protocol ➔ Anonymity within the group ➔ No forward-secrecy

  • DAGA: Deniable Anonymous Group Authentication – Ewa Syta

➔ Authentication protocol ➔ Forward-secrecy

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-6
SLIDE 6

12/02/2018 Arthur Villard - Master Thesis 6 DEDIS

Goals

  • Using DAGA as PoP’s authentication protocol
  • Implementing DAGA in Go
  • Improving DAGA

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-7
SLIDE 7

12/02/2018 Arthur Villard - Master Thesis 7 DEDIS

Key concepts

  • Anonymity

➔ No information about the user is known

  • Accountability

➔ The sender can be held responsible for his action

  • Linkability

➔ Two messages come from the same user

  • Forward-secrecy

➔ Breaking a session does not break the previous ones

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-8
SLIDE 8

12/02/2018 Arthur Villard - Master Thesis 8 DEDIS

Overview

  • Introduction
  • PoP and DAGA interaction
  • Implementing DAGA
  • Improving DAGA
  • Conclusion & Future work
slide-9
SLIDE 9

12/02/2018 Arthur Villard - Master Thesis 9 DEDIS

Integration

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-10
SLIDE 10

12/02/2018 Arthur Villard - Master Thesis 10 DEDIS

PoP: How it works

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-11
SLIDE 11

12/02/2018 Arthur Villard - Master Thesis 11 DEDIS

PoP: Weaknesses

  • No forward-secrecy

➔ Tag derived from private key ➔ Leakage allows to identify the user in previous sessions

  • Cross-service de-anonymisation

➔ Tags independent from the service ➔ Users can be tracked between different services

 Loss of anonymity

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-12
SLIDE 12

12/02/2018 Arthur Villard - Master Thesis 12 DEDIS

DAGA: How it works

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

DAGA servers Compute initial tag R e q u e s t c h a l l e n g e Distributed randomness C h a l l e n g e R e q u e s t L i n k a g e t a g + P r

  • f

s Proof generation Request generation User Context

slide-13
SLIDE 13

12/02/2018 Arthur Villard - Master Thesis 13 DEDIS

DAGA solutions

  • Forward-secrecy

➔ Tags derived from context elements only ➔ Private key used in client proof ➔ Proof does not leak information

  • Cross-service de-anonymisation

➔ Different services  Different contexts

 Different tags for the same user

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-14
SLIDE 14

12/02/2018 Arthur Villard - Master Thesis 14 DEDIS

Conclusion

  • DAGA can solve PoP weaknesses
  • DAGA and PoP can be interfaced
  • E-voting

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-15
SLIDE 15

12/02/2018 Arthur Villard - Master Thesis 15 DEDIS

Overview

  • Introduction
  • PoP and DAGA interaction
  • Implementing DAGA
  • Improving DAGA
  • Conclusion & Future work
slide-16
SLIDE 16

12/02/2018 Arthur Villard - Master Thesis 16 DEDIS

Implementation

  • Go
  • RSA  Elliptic Curves
  • Distributed randomness

T 0

i=hi (∏

k=1 m

sk)

T 0

i=(∏ k =1 m

sk)∗H i

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-17
SLIDE 17

12/02/2018 Arthur Villard - Master Thesis 17 DEDIS

Code results

  • Library: Complete implementation
  • Test coverage 88%
  • Example scenario
  • Benchmark package

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-18
SLIDE 18

12/02/2018 Arthur Villard - Master Thesis 18 DEDIS

Benchmarks: Communication

Setup:

  • Windows 10
  • x86-64
  • 1 thread

@4,5GHz Setup:

  • Ubuntu 12.04
  • x86-64
  • 1 thread
  • No improvement
  • No explanation yet

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-19
SLIDE 19

12/02/2018 Arthur Villard - Master Thesis 19 DEDIS

Benchmarks: Time

Setup:

  • Windows 10
  • x86-64
  • 1 thread

@4,5GHz Setup:

  • Ubuntu 12.04
  • x86-64
  • 1 thread
  • Moore’s law 2012  2018: ~ /8 from hardware
  • Elliptic Curves

32768 members / 32 servers

15 000 s 1 000 s /15 Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-20
SLIDE 20

12/02/2018 Arthur Villard - Master Thesis 20 DEDIS

Conclusion

  • Complete implementation
  • Time improvement
  • Next step: Integrate it with PoP

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-21
SLIDE 21

12/02/2018 Arthur Villard - Master Thesis 21 DEDIS

Overview

  • Introduction
  • PoP and DAGA interaction
  • Implementing DAGA
  • Improving DAGA
  • Conclusion & Future work
slide-22
SLIDE 22

12/02/2018 Arthur Villard - Master Thesis 22 DEDIS

Proof problem

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

DAGA servers Compute initial tag R e q u e s t c h a l l e n g e Distributed randomness C h a l l e n g e R e q u e s t L i n k a g e t a g + P r

  • f

s Proof generation Request generation User Context

slide-23
SLIDE 23

12/02/2018 Arthur Villard - Master Thesis 23 DEDIS

Proof problem

  • Anonymity through a client OR proof:

➔ I know (private key 1 OR private key 2 OR … )

  • Growth

, n = #members

➔ 32768 members / 32 servers

  • Proof ~6,3 MB, total cost ~200 MB  ~20% of total

O(6∗n)

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-24
SLIDE 24

12/02/2018 Arthur Villard - Master Thesis 24 DEDIS

Improving the proof

  • Work with Kasra Edalatnejadkhamene, PhD student
  • Survey of the field
  • Split the proof

➔ Proof of membership: Accumulator ➔ Proof of knowledge: Signature of knowledge

  • No concrete scheme

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-25
SLIDE 25

12/02/2018 Arthur Villard - Master Thesis 25 DEDIS

Overview

  • Introduction
  • PoP and DAGA interaction
  • Implementing DAGA
  • Improving DAGA
  • Conclusion & Future work
slide-26
SLIDE 26

12/02/2018 Arthur Villard - Master Thesis 26 DEDIS

Conclusion & Future work

  • DAGA and PoP can work together
  • Complete Go implementation of DAGA
  • Improvement guidelines for the proof
  • Next steps

➔ Integrate DAGA and PoP ➔ Optimize network consumption ➔ Continue the work on the proof ➔ Improve implementation resistance

(secure memory management, constant-time, … )

Introduction | PoP and DAGA interaction | Implementing DAGA | Improving DAGA | Conclusion

slide-27
SLIDE 27

12/02/2018 Arthur Villard - Master Thesis 27 DEDIS

Distributed randomness

slide-28
SLIDE 28

12/02/2018 Arthur Villard - Master Thesis 28 DEDIS

Context

  • User public keys (#members)
  • Server public keys (#servers)
  • Server random commitments (#servers)
  • Client random generators (#members)
slide-29
SLIDE 29

12/02/2018 Arthur Villard - Master Thesis 29 DEDIS

Accumulator

  • Accumulators from Bilinear Pairings and Applications
  • L. Nguyen, 2005
  • Adjustments:

➔ Trusted setup ➔ Bounded ➔ Efficiency based on trusted authority

slide-30
SLIDE 30

12/02/2018 Arthur Villard - Master Thesis 30 DEDIS

Ring signature

  • How to Leak a Secret, R. Rivest, A. Shamir and Y.

Tauman