From theoretical crypto to practice: gloups an abominable gap - - PowerPoint PPT Presentation

▶
from theoretical crypto to practice gloups an abominable
SMART_READER_LITE
LIVE PREVIEW

From theoretical crypto to practice: gloups an abominable gap - - PowerPoint PPT Presentation

Aug 29, 2022 386 likes •924 views

From theoretical crypto to practice: gloups an abominable gap Cryptie, Oblazy Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 1 / 35 Encryption and Signature: Just a 2 min reminder 1 Libraries 2 Funny Cryptography 3 Cryptie, O. Blazy (Xlim)

slide-1
SLIDE 1

From theoretical crypto to practice: gloups an abominable gap

Cryptie, Oblazy

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 1 / 35

slide-2
SLIDE 2

1

Encryption and Signature: Just a 2 min reminder

2

Libraries

3

Funny Cryptography

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 2 / 35

slide-3
SLIDE 3

1

Encryption and Signature: Just a 2 min reminder

2

Libraries

3

Funny Cryptography

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 2 / 35

slide-4
SLIDE 4

1

Encryption and Signature: Just a 2 min reminder

2

Libraries

3

Funny Cryptography

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 2 / 35

slide-5
SLIDE 5

1

Encryption and Signature: Just a 2 min reminder

2

Libraries

3

Funny Cryptography

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 3 / 35

slide-6
SLIDE 6

Definition (Encryption Scheme)

E = (Setup, EKeyGen, Encrypt, Decrypt): Setup(1K): param; EKeyGen(param): public encryption key pk, private decryption key dk; Encrypt(pk, m; r): ciphertext c on m ∈ M and pk; Decrypt(dk, c): decrypts c under dk.

Decrypt pk, r dk C m Encrypt

Indistinguishability: Given M0, M1, it should be hard to guess which one is encrypted in C.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 4 / 35

slide-7
SLIDE 7

Definition

An assymetric encryption scheme allows Cryptie, using the public key of Bob, to encrypt a message to Bob in such a way that only Bob, with his secret key, can read it.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 5 / 35

slide-8
SLIDE 8

sk; s σ(m) m Sign

Definition (Signature Scheme)

S = (Setup, SKeyGen, Sign, Verif): Setup(1K): param; SKeyGen(param): public verification key vk, private signing key sk; Sign(sk, m; s): signature σ on m, under sk; Verif(vk, m, σ): checks whether σ is valid on m. Unforgeability: Given q pairs (mi, σi), it should be hard to output a valid σ on a fresh m.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 6 / 35

slide-9
SLIDE 9

Definition

A signature scheme allows Cryptie, using her secret key, to sign a document in such a way that anybody knowing her public key, for example Bob, can be sure that she signs exactly this document.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 7 / 35

slide-10
SLIDE 10

Definition

A signature scheme allows Cryptie, using her secret key, to sign a document in such a way that anybody knowing her public key, for example Bob, can be sure that she signs exactly this document.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 7 / 35

slide-11
SLIDE 11

1

Encryption and Signature: Just a 2 min reminder

2

Libraries

3

Funny Cryptography

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 8 / 35

slide-12
SLIDE 12

Libre Crypto libraries? we have a lot of them

NaCL Public domain Botan (simplified) BSD Boncycastle MIT License Cryptlib Sleepycat License Crypto++ Boost Software License 1.0 (Public domain for files) Libgcrypt LGPLv2.1+ Libtomcrypt Public License and WTFPL Nettle GPLv2+ and LGPLv3+ OpenSSL and LibreSSL OpenSSL License, original SSLeay Licence etc ... ⇒ You can even discover some new Free Software license ! ⇒ Mostly vanilla crypto... ⇒ Community knows the good parameter, the good curve but...

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 9 / 35

slide-13
SLIDE 13

Academical crypto in real world

When academics says "this is broken", it is patched (nearly in a timely manner).

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 10 / 35

slide-14
SLIDE 14

Academical crypto in real world

When academics says "this is broken", it is patched (nearly in a timely manner).

Example

First theoretical academic attack on SHA-1 in 2005 First academic attack that may(?) be used 2010-2015ish. Start of the end of SHA-1 2013-2015. Summer 2016: Practical attacks.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 10 / 35

slide-15
SLIDE 15

Academical crypto in real world 2

What about funny crypto? 20+ years later the lucky ones are just starting to be used (in weird Blockchains).

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 11 / 35

slide-16
SLIDE 16

What kind of strange properties can we have?

Weird signatures Strange encryption Crazy stuff ⇒ Let’s talk about funny crypto

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 12 / 35

slide-17
SLIDE 17

1

Encryption and Signature: Just a 2 min reminder

2

Libraries

3

Funny Cryptography

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 13 / 35

slide-18
SLIDE 18

Weird signatures

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 14 / 35

slide-19
SLIDE 19

Sanitizable Signatures [KR00]

Definition

A sanitizable signature allows Alice to signs a text in such a way that she can give Cryptie the right to modify some parts of it while keeping a correct signature of her on this modified message.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 15 / 35

slide-20
SLIDE 20

Group Signatures [CvH91]

Definition

A group signature allows Bob to signs as a member of a group in such a way that only a special (optional) entity, an "Opener", would be able to know that HE was the signer of the given message.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 16 / 35

slide-21
SLIDE 21

Group Signatures [CvH91]

Definition

A group signature allows Bob to signs as a member of a group in such a way that only a special (optional) entity, an "Opener", would be able to know that HE was the signer of the given message.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 16 / 35

slide-22
SLIDE 22

Group Signatures [CvH91]

Definition

A group signature allows Bob to signs as a member of a group in such a way that only a special (optional) entity, an "Opener", would be able to know that HE was the signer of the given message.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 16 / 35

slide-23
SLIDE 23

Group Signatures [CvH91]

Definition

A group signature allows Bob to signs as a member of a group in such a way that only a special (optional) entity, an "Opener", would be able to know that HE was the signer of the given message.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 16 / 35

slide-24
SLIDE 24

Group Ring Signatures [RST01]

Definition

A group ring signature allows Bob to signs as a member of a group, that he built alone, in such a way that only a special (optional) entity, an "Opener", no one would be able to know that HE was the signer of the given message.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 17 / 35

slide-25
SLIDE 25

Group Ring Signatures [RST01]

Definition

A group ring signature allows Bob to signs as a member of a group, that he built alone, in such a way that only a special (optional) entity, an "Opener", no one would be able to know that HE was the signer of the given message.

The only technology using it is some Blockchain implementation...

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 17 / 35

slide-26
SLIDE 26

Blind Signatures [Chaum83]

Definition

A blind signature allows Alice to signs a letter "through" its envelope. If later, she sees two documents she signs, she won’t be able to know which text she signs when.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 18 / 35

slide-27
SLIDE 27

Blind Signatures [Chaum83]

Definition

A blind signature allows Alice to signs a letter "through" its envelope. If later, she sees two documents she signs, she won’t be able to know which text she signs when.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 18 / 35

slide-28
SLIDE 28

Strange encryption

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 19 / 35

slide-29
SLIDE 29

Homomorphic Encryption [RSA77]

Definition

In an Homomorphic Encryption, a user encrypts a message M, using a public encryption

  • key. The resulting ciphertext can then be decrypted using a secret decryption key.

Ciphertexts can be combined, so that the decryption leads to the combination of the plaintext

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 20 / 35

slide-30
SLIDE 30

Homomorphic Encryption [RSA77]

Definition

In an Homomorphic Encryption, a user encrypts a message M, using a public encryption

  • key. The resulting ciphertext can then be decrypted using a secret decryption key.

Ciphertexts can be combined, so that the decryption leads to the combination of the plaintext

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 20 / 35

slide-31
SLIDE 31

Homomorphic Encryption [RSA77]

Definition

In an Homomorphic Encryption, a user encrypts a message M, using a public encryption

  • key. The resulting ciphertext can then be decrypted using a secret decryption key.

Ciphertexts can be combined, so that the decryption leads to the combination of the plaintext

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 20 / 35

slide-32
SLIDE 32

Homomorphic Encryption [RSA77]

Definition

In an Homomorphic Encryption, a user encrypts a message M, using a public encryption

  • key. The resulting ciphertext can then be decrypted using a secret decryption key.

Ciphertexts can be combined, so that the decryption leads to the combination of the plaintext

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 20 / 35

slide-33
SLIDE 33

Threshold Encryption [DDFY94]

Definition

In a Threshold Encryption, a user encrypts a message M, using a public encryption key. The resulting ciphertext can then be decrypted using at least k secret decryption keys.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 21 / 35

slide-34
SLIDE 34

Threshold Encryption [DDFY94]

Definition

In a Threshold Encryption, a user encrypts a message M, using a public encryption key. The resulting ciphertext can then be decrypted using at least k secret decryption keys.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 21 / 35

slide-35
SLIDE 35

Threshold Encryption [DDFY94]

Definition

In a Threshold Encryption, a user encrypts a message M, using a public encryption key. The resulting ciphertext can then be decrypted using at least k secret decryption keys.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 21 / 35

slide-36
SLIDE 36

Threshold Encryption [DDFY94]

Definition

In a Threshold Encryption, a user encrypts a message M, using a public encryption key. The resulting ciphertext can then be decrypted using at least k secret decryption keys.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 21 / 35

slide-37
SLIDE 37

Broadcast Encryption [FN94]

Definition

In a Broadcast Encryption, a user encrypts a message M for a subset of users. The resulting ciphertext can then be decrypted using one of k secret decryption key.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 22 / 35

slide-38
SLIDE 38

Identity-based Encryption [Sha01]

Definition

In an Identity-based Encryption, a user encrypts a message M, using a public encryption key user identity. The resulting ciphertext can then be decrypted using a secret decryption key.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 23 / 35

slide-39
SLIDE 39

Attribute-base Encryption [SW04]

Definition

In an Attribute-based Encryption, a user encrypts a message M, using a public encryption key corresponding to some policy. The resulting ciphertext can then be decrypted using a secret decryption key credential fitting the policy.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 24 / 35

slide-40
SLIDE 40

Witness Encryption [GGSW13]

Definition

In a Witness Encryption, a user encrypts a message M, using a public encryption key. The resulting ciphertext can then be decrypted using a secret decryption key witness of some property.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 25 / 35

slide-41
SLIDE 41

Crazy stuff

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 26 / 35

slide-42
SLIDE 42

Zero-Knowledge Proof [GMR85]

Alice Bob Interactive method for Alice to prove to Bob that she knows something S without revealing anything other than this fact.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 27 / 35

slide-43
SLIDE 43

Smooth Projective Hash Functions [CS02]

Definition

Functions that can be evaluated in two different ways, either with a secret hashing key hk or with a public projected key hp and a secret witness Word x Language L K = HashL(hk; x) K = ProjHashL(hp; x, w)

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 28 / 35

slide-44
SLIDE 44

SPHF

Any encryption of a solution of a NP problem : encryption of a password encryption of a credential solution of an equation etc.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 29 / 35

slide-45
SLIDE 45

Conditional Action

Alice Bob C(input) ← − − − − − − − − − − − − − − −

  • utput ⊕ SPHF

− − − − − − − − − − − − − − − → An honest user learns the output. The server learns nothing.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 30 / 35

slide-46
SLIDE 46

Oblivious Signature-based envelope [LDB05]

OSBE Alice the whistle-blower Trustful journalists C(cred) ← − − − − − − − − − − − − − − − M ⊕ SPHF − − − − − − − − − − − − − − − → An honest user learns the output iff he possesses the signature. The server learns nothing.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 31 / 35

slide-47
SLIDE 47

Oblivious Transfer [Rab81]

OT Database User C(line) ← − − − − − − − − − − − − − − − DB[line] ⊕ SPHF − − − − − − − − − − − − − − − → The User learns the value of line but nothing else. The Database learns nothing.

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 32 / 35

slide-48
SLIDE 48

Authenticated Key Exchange [BM92]

Alice Bob C(pwA) ← − − − − − − − − − − − − − − − C(pwB) − − − − − − − − − − − − − − − → SPHFA ⊕ SPHFB SPHFB ⊕ SPHFA The Users have the same shared key at the end, if they have the same password Otherwise they learn nothing Can be done with other things than password

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 33 / 35

slide-49
SLIDE 49

Authenticated Key Exchange [BM92]

Alice Bob C(pwA) ← − − − − − − − − − − − − − − − C(pwB) − − − − − − − − − − − − − − − → SPHFA ⊕ SPHFB SPHFB ⊕ SPHFA The Users have the same shared key at the end, if they have the same password Otherwise they learn nothing Can be done with other things than password

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 33 / 35

slide-50
SLIDE 50

Thank you

If you are interested in any of these, contact us. Cryptie: me@cryptie.eu or cryptie@fsfe.org O.Blazy: olivier.blazy@unilim.fr

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 34 / 35

slide-51
SLIDE 51

Thank you

If you are interested in any of these, contact us. Cryptie: me@cryptie.eu or cryptie@fsfe.org O.Blazy: olivier.blazy@unilim.fr PS: Looking for a PhD student

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 34 / 35

slide-52
SLIDE 52

Sources

Thanks to : wordclouds.com for (in a home made license, +/- CC-BY...) janjf93 for (in CC0) sixsixfive for (in CC0) Phantom Open Emoji maintainers and contributors for (in CC-BY 3.0) the Cnil for

  • etc. (in CC-BY 3.0)

Cryptie, O. Blazy (Xlim) RMLL CC-BY-SA 4.0 35 / 35