Group Key Exchange and Provable Security joint work with E. Bresson - - PDF document

▶
group key exchange and provable security
SMART_READER_LITE
LIVE PREVIEW

Group Key Exchange and Provable Security joint work with E. Bresson - - PDF document

Oct 29, 2022 150 likes •366 views

Group Key Exchange and Provable Security joint work with E. Bresson and O. Chevassut David Pointcheval Dpartement dInformatique ENS - CNRS David.Pointcheval@ens.fr http://www.di.ens.fr/~pointche Overview Overview Provable

slide-1
SLIDE 1

David Pointcheval Département d’Informatique ENS - CNRS

David.Pointcheval@ens.fr http://www.di.ens.fr/~pointche

Group Key Exchange and Provable Security

joint work with E. Bresson and O. Chevassut

Group Key Exchange and Provable Security - 2 David Pointcheval ENS-CNRS

Overview Overview

◆ Provable Security ◆ Key Agreement

and Mutual Authentication

  • Definitions
  • Security Model
  • Example

◆ Group Key Agreement

  • Security Model
  • Example (security result)

◆ Conclusion

slide-2
SLIDE 2

Group Key Exchange and Provable Security - 3 David Pointcheval ENS-CNRS

Overview Overview

◆ Provable Security ◆ Key Agreement

and Mutual Authentication

◆ Group Key Agreement ◆ Conclusion

Group Key Exchange and Provable Security - 4 David Pointcheval ENS-CNRS

Provably Secure Scheme Provably Secure Scheme

To prove the security of a cryptographic scheme, one has to make precise

◆ the algorithmic assumptions ◆ the security notions to be guaranteed ◆ a reduction:

an adversary can help to break the assumption

slide-3
SLIDE 3

Group Key Exchange and Provable Security - 5 David Pointcheval ENS-CNRS

Proof by Reduction Proof by Reduction

Reduction of a problem to an attack Atk: Let be an adversary that breaks the scheme

  • Instance
  • f

intractable ⇒ scheme unbreakable Solution

  • f

then can be used to solve

Group Key Exchange and Provable Security - 6 David Pointcheval ENS-CNRS

Practical Security Practical Security

◆ Complexity theory: T polynomial ◆ Exact Security: T explicit ◆ Practical Security: T small (linear)

Eg : t’ = 4t intractable within less than 280 operations ⇒ scheme unbreakable within less than 278 operations

Adversary within t Algorithm against within t’ = T (t)

slide-4
SLIDE 4

Group Key Exchange and Provable Security - 7 David Pointcheval ENS-CNRS

Security Notions Security Notions

According to the needs, one defines

◆ the goals of an adversary ◆ the means of an adversary,

i.e. the available information

Group Key Exchange and Provable Security - 8 David Pointcheval ENS-CNRS

Overview Overview

◆ Provable Security ◆ Key Agreement

and Mutual Authentication

  • Definitions
  • Security Model
  • Example

◆ Group Key Agreement ◆ Conclusion

slide-5
SLIDE 5

Group Key Exchange and Provable Security - 9 David Pointcheval ENS-CNRS

Overview Overview

◆ Provable Security ◆ Key Agreement

and Mutual Authentication

  • Definitions
  • Security Model
  • Example

◆ Group Key Agreement ◆ Conclusion

Group Key Exchange and Provable Security - 10 David Pointcheval ENS-CNRS

Authenticated Key Exchange Authenticated Key Exchange

◆ ◆ Implicit authentication

Implicit authentication

  • only the intended partners can compute the

session key

◆ ◆ Semantic security

Semantic security

  • the session key is indistinguishable from a

random string

  • modeled via a Test-query
slide-6
SLIDE 6

Group Key Exchange and Provable Security - 11 David Pointcheval ENS-CNRS

Security Definitions (AKE) Security Definitions (AKE)

PROTOCOL

« Test » a key sk Flip a coin b sk if b=0, random if b=1 Outputs b’ (guess for b) Public data

. . . . . .

Group Key Exchange and Provable Security - 12 David Pointcheval ENS-CNRS

Further Properties Further Properties

◆ Mutual authentication

they are both sure to share the secret with the people they think they do

◆ Forward secrecy

even if a long-term secret data is corrupted, previous shared secrets are still semantically secure

slide-7
SLIDE 7

Group Key Exchange and Provable Security - 13 David Pointcheval ENS-CNRS

Overview Overview

◆ Provable Security ◆ Key Agreement

and Mutual Authentication

  • Definitions
  • Security Model
  • Example

◆ Group Key Agreement ◆ Conclusion

Group Key Exchange and Provable Security - 14 David Pointcheval ENS-CNRS

Formal Model Formal Model

can ask

  • send-queries
  • reveal-queries
  • execute-queries
  • test-query
  • corrupt-queries
  • history

B1 Bi Bb A1 Ai Aa 0/1

Bellare-Rogaway model revisited by Shoup

slide-8
SLIDE 8

Group Key Exchange and Provable Security - 15 David Pointcheval ENS-CNRS

Semantic Security Semantic Security

◆ A misuse of the secret data is modeled

by the reveal-query, which is answered by this secret data

◆ For the semantic security, the adversary

asks one test-query which is answered, according to a bit b, by

  • b=0: the actual secret data
  • b=1: a random string

⇒ the adversary has to guess this bit b

Group Key Exchange and Provable Security - 16 David Pointcheval ENS-CNRS

Passive/Active Passive/Active Adversaries Adversaries

◆ Passive adversary: history built using

the execute-queries → transcripts

◆ Active adversary: entire control of the

network with send-queries:

  • to send message to Alice or Bob

(in place of Bob or Alice respectively)

  • to intercept, forward and/or modify messages
slide-9
SLIDE 9

Group Key Exchange and Provable Security - 17 David Pointcheval ENS-CNRS

Forward Secrecy Forward Secrecy

Forward secrecy means that the adversary cannot distinguish a session key established before any corruption of the long-term private keys:

◆ the corrupt-query is answered

by the long-term private key

  • f the corrupted party

◆ then the test-query must be asked

  • n a session key established

before any corrupt-query

Group Key Exchange and Provable Security - 18 David Pointcheval ENS-CNRS

Overview Overview

◆ Provable Security ◆ Key Agreement

and Mutual Authentication

  • Definitions
  • Security Model
  • Example

◆ Group Key Agreement ◆ Conclusion

slide-10
SLIDE 10

Group Key Exchange and Provable Security - 19 David Pointcheval ENS-CNRS

Diffie Diffie-

  • Hellman

Hellman Key Exchange Key Exchange

The most classical key exchange scheme has been proposed by Diffie-Hellman: = <g>, cyclic group of prime order q

◆ Alice chooses a random x∈q,

computes and sends X=gx

◆ Bob chooses a random y∈q,

computes and sends Y=gy

◆ They each can compute the session key

K = Yx = Xy

Group Key Exchange and Provable Security - 20 David Pointcheval ENS-CNRS

Properties Properties

◆ If flows are authenticated,

it is well-known to provide the semantic security of the session key under the Decisional Diffie-Hellman Problem

◆ If one derives the session key

as k = H(K), where H is assumed to behave like a random oracle, semantic security is relative to the Computational Diffie-Hellman Problem

slide-11
SLIDE 11

Group Key Exchange and Provable Security - 21 David Pointcheval ENS-CNRS

Further Features Further Features

◆ But there is no explicit authentication

(Replay attacks)

◆ Adding key confirmation rounds:

mutual authentication [BPR00]

x∈q, X=gx y∈q, Y=gy K=Xy k1=H(K||1) Alice (Sa, Pa) Bob (Sb, Pb) Bob, X, (Sa,X) Alice, Y, (Sb,X,Y), k1 k=H(K||0) k1 correct? k2=H(K||2) k2 k2 correct?

Group Key Exchange and Provable Security - 22 David Pointcheval ENS-CNRS

Overview Overview

◆ Provable Security ◆ Key Agreement

and Mutual Authentication

◆ Group Key Agreement

  • Security Model
  • Example (security result)

◆ Conclusion

slide-12
SLIDE 12

Group Key Exchange and Provable Security - 23 David Pointcheval ENS-CNRS

Overview Overview

◆ Provable Security ◆ Key Agreement

and Mutual Authentication

◆ Group Key Agreement

  • Security Model
  • Example (security result)

◆ Conclusion

Group Key Exchange and Provable Security - 24 David Pointcheval ENS-CNRS

Model of Communication Model of Communication

◆ ◆ A set of

A set of n n players players, , modeled modeled by oracle by oracles s

◆ ◆ A multicast group consisting of a set of players

A multicast group consisting of a set of players

pkA, skA pkB, skB pkD, skD pkC, skC

Multicast group with sk

slide-13
SLIDE 13

Group Key Exchange and Provable Security - 25 David Pointcheval ENS-CNRS

Modeling the Adversary Modeling the Adversary

  • send: send messages to instances
  • execute: obtain honest executions of the protocol
  • reveal: obtain an instance’s session key
  • corrupt: obtain the value of the password

corrupt send execute reveal

pkA, skA pkB, skB pkD, skD pkC, skC

Group Key Exchange and Provable Security - 26 David Pointcheval ENS-CNRS

Freshness Freshness

sk is fresh if it is known by the players but not the adversary

reveal

(sk)

corrupt

(LL)

  • after a reveal-query,

sk is known

  • after a corrupt-query,

any future key is known

slide-14
SLIDE 14

Group Key Exchange and Provable Security - 27 David Pointcheval ENS-CNRS

Overview Overview

◆ Provable Security ◆ Key Agreement

and Mutual Authentication

◆ Group Key Agreement

  • Security Model
  • Example (security result)

◆ Conclusion

Group Key Exchange and Provable Security - 28 David Pointcheval ENS-CNRS

A Group Key Exchange A Group Key Exchange

◆ ◆ Generalization

Generalization of

  • f the

the 2- 2-party party DH, DH, t the session key is he session key is sk=H(gx1x2…xn)

◆ ◆ Ring-based algorithm

Ring-based algorithm

  • up-flow: the contributions of each instance

are gathered

  • down-flow: the last instance broadcasts

the result

  • end: instances compute the session key

from the broadcast

slide-15
SLIDE 15

Group Key Exchange and Provable Security - 29 David Pointcheval ENS-CNRS

The Algorithm The Algorithm

[g , gx1] [gx2, gx1, gx1x2 ] [gx2x3 , sk=H(gx1x2x3)

x1 x2 x3

  • Up-flow: Ui raises received values to the power xi
  • Down-flow: Un broadcasts (except gx1x2…xn)

Everything is authenticated (Signature/MAC)

gx1x3 ]

Group Key Exchange and Provable Security - 30 David Pointcheval ENS-CNRS

Group CDH Group CDH

◆ ◆ The

The CDH CDH generalized generalized to to the multi the multi-

  • party

party case case

  • given the values g∏xi for some choice
  • f proper subset of {1, …, n}
  • one has to compute the value gx1..xn

◆ ◆ Example

Example ( (n= n=3 3 and and I= I={1 {1, ,2 2, ,3}) 3})

  • given the set of the blue values
  • compute the red value

◆ ◆ The

The GCDH GCDH ⇔ ⇔ DDH DDH and and CDH CDH

[SAC ‘02] g, gx1 gx1, gx2 , gx1x2 gx1x3, gx2x3 , gx1x2x3

slide-16
SLIDE 16

Group Key Exchange and Provable Security - 31 David Pointcheval ENS-CNRS

Security Result Security Result

◆ ◆ Theorem

Theorem (in (in the random the random oracle model)

  • racle model)

Advake(T,n,qs,qe) ≤ 2qs

n qh · Succgcdh(n,T)

+ 2n · Succsign(qs,T)

◆ Proof:

  • Game 0 : the adversary plays against

the oracles in order to defeat the AKE-security ε = (Adv()+1)/2 = Pr[b’ = b] = Pr[S0]

Group Key Exchange and Provable Security - 32 David Pointcheval ENS-CNRS

Security Result Security Result (2) (2)

Game 1:

  • Exclude games wherein a signature/MAC

forgery is performed: | Pr[S1] - Pr[S0] | < n ·Succsign(qs,T)

slide-17
SLIDE 17

Group Key Exchange and Provable Security - 33 David Pointcheval ENS-CNRS

Security Result Security Result (3) (3)

Game 2:

  • guess n indices between 1 and qs

(this defines a pool of n instances, involved in the n queries)

  • cancel executions of the game such that this

pool of instances does not correspond to the Test-query (in other cases, output a random b’) Remarks:

  • The probability of a correct guess is exactly 1/qsn
  • Such a correct guess is independent with S1

Group Key Exchange and Provable Security - 34 David Pointcheval ENS-CNRS

Security Result Security Result (4) (4)

Pr[S2] = Pr[S1 ∧ guess] + Pr[S1 ∧ ¬guess] = Pr[S1 | guess] Pr[guess] + Pr[S1 | ¬guess] Pr[¬guess] = Pr[S1 ] / qsn + 1/2 (1 - 1 / qsn ) = 1/2 + (Pr[S1 ] - 1/2) / qsn Pr[S0] ≤ Pr[S1] + n ·Succsign(qs,T) 2 ·Pr[S0] - 1 ≤ 2 · Pr[S1] -1 + 2n ·Succsign(qs,T)

≤ qsn (2 · Pr[S2] -1) + 2n ·Succsign(qs,T)

slide-18
SLIDE 18

Group Key Exchange and Provable Security - 35 David Pointcheval ENS-CNRS

Security Result Security Result (5) (5)

Game 3:

  • Replace sk for this pool, by a random value

Remark:

  • A problem may happen if asks for H(gx1x2…xn),

which should be equal to sk: Event AskH3 | Pr[S3] - Pr[S2] | ≤ Pr[AskH3]

  • Since sk is random

(independent to the view of the adversary) Pr[S3] = 1/2 Adv() ≤ 2qsn · Pr[AskH3] + 2n ·Succsign(qs,T)

Group Key Exchange and Provable Security - 36 David Pointcheval ENS-CNRS

Security Result Security Result (6) (6)

Game 4:

  • Inject the GCDH instance for simulating the

selected oracle instances Pr[AskH4] = Pr[AskH3]

Remark: event AskH4 means that

  • H(gx1x2…xn), has been asked
  • gx1x2…xn is in the list of the queries asked to H
  • With a random guess, one gets it:

Pr[AskH4] ≤ qh · Succgcdh(n,T)

slide-19
SLIDE 19

Group Key Exchange and Provable Security - 37 David Pointcheval ENS-CNRS

Overview Overview

◆ Provable Security ◆ Key Agreement

and Mutual Authentication

◆ Group Key Agreement ◆ Conclusion

Group Key Exchange and Provable Security - 38 David Pointcheval ENS-CNRS

Improvements Improvements

◆ ◆ Security result

Security result: : exponential exponential in in n n [ACM CCS ’01]

  • No

No guess guess of

  • f the

the tested tested pool pool

  • Use of

Use of the random the random self- self-reducibility reducibility

  • f
  • f the

the CDH CDH and and GCDH GCDH problems problems ⇒ ⇒ reduction linear reduction linear in in n n

  • Standard Model [

Standard Model [Eurocrypt Eurocrypt ‘02] ‘02]

◆ Dynamic groups [Asiacrypt ‘01]

  • If one party leaves or joins the group,

the protocol does not need to be restarted from scratch

slide-20
SLIDE 20

Group Key Exchange and Provable Security - 39 David Pointcheval ENS-CNRS

Improvements Improvements: : Result Result

◆ ◆ Group of

Group of n n people people

◆ ◆ Tested

Tested group of size group of size s s

◆ ◆ Number

Number of

  • f dynamic

dynamic modifications modifications ( (setup setup, , join join, , remove remove): ): Q Q

◆ ◆ Time:

Time: T T Advake(A) ≤ 2 Q · Cn

s · qh · Succgcdh(s,T)

+ 2n ·Succsign(qs,T)

Group Key Exchange and Provable Security - 40 David Pointcheval ENS-CNRS

Mutual Authentication Mutual Authentication

◆ ◆ Authentication

Authentication of

  • f the

the parties: parties:

  • Public Key Infrastructures (signatures)

Public Key Infrastructures (signatures)

  • Secret

Secret keys keys - MAC [

  • MAC [Eurocrypt

Eurocrypt ‘02] ‘02]

  • Passwords

Passwords [Asiacrypt ‘02] In the latter case, a new kind of attack has to be considered: dictionary attacks

slide-21
SLIDE 21

Group Key Exchange and Provable Security - 41 David Pointcheval ENS-CNRS

Conclusion Conclusion

◆ Formal model for (Group) AKE ◆ Provably secure schemes

but still not « practical security »

◆ Various authentication modes