HIBE with Tight Multi-challenge Security Roman Langrehr ETH Zurich (Switzerland), Part of the work done at KIT (Karlsruhe, Germany) Jiaxin Pan NTNU (Trondheim, Norway) Roman Langrehr, Jiaxin Pan 2020-06-01 1
Outline (H)IBE Tight multi-challenge security Related works The difficulty Our solution Future work Roman Langrehr, Jiaxin Pan 2020-06-01 2
Identity-based encryption mpk Alice Bob • Alice needs to obtain only the usk Bob master public key • Encryption with identities (e.g. e-mail address) Trusted Third Party Roman Langrehr, Jiaxin Pan 2020-06-01 3
Hierarchical Identity-based encryption k Bob Alice Bob s u mpk • Hierarchy of key generators usk Trusted Third Party Roman Langrehr, Jiaxin Pan 2020-06-01 4
Key delegation Identities have the form (id 1 , . . . , id p ). ε (0 . . . 0) · · · (1 . . . 1) (0 . . . 0 , 0 . . . 0) · · · (0 . . . 0 , 1 . . . 1) (1 . . . 1 , 0 . . . 0) · · · (1 . . . 1 , 1 . . . 1) . . . . . . . . . . . . • Each user can generate keys for its children Roman Langrehr, Jiaxin Pan 2020-06-01 5
Security game (IND-HID-CPA) Challenger Adversary mpk id $ b ← { 0 , 1 } • The adversary must not ask usk[id] user secret keys for prefixes of id ⋆ , m 0 , m 1 challenge identities (id ⋆ ). $ C ⋆ ← Enc(mpk , id ⋆ , m b ) b ′ b ? = b ′ Roman Langrehr, Jiaxin Pan 2020-06-01 6
Security game (IND-HID-CPA) Challenger Adversary mpk id $ b ← { 0 , 1 } • The adversary must not ask usk[id] user secret keys for prefixes of id ⋆ , m 0 , m 1 challenge identities (id ⋆ ). • IND-HID-CCA is easy once $ C ⋆ ← Enc(mpk , id ⋆ , m b ) you have IND-HID-CPA. b ′ b ? = b ′ Roman Langrehr, Jiaxin Pan 2020-06-01 6
Tight security Scheme Assumption Reduction (e.g. HIBE) (e.g. Diffie-Hellman) Roman Langrehr, Jiaxin Pan 2020-06-01 7
Tight security Scheme Assumption Reduction (e.g. HIBE) (e.g. Diffie-Hellman) Can be broken with Can be broken with probability ε using resources ρ . probability ε/ℓ using resources ρ . Roman Langrehr, Jiaxin Pan 2020-06-01 7
Tight security Scheme Assumption Reduction (e.g. HIBE) (e.g. Diffie-Hellman) Can be broken with Can be broken with probability ε using resources ρ . probability ε/ℓ using resources ρ . Larger security loss requires larger security parameter. Security loss ℓ can depend on: • scheme parameters (e.g. maximum hierarchy depth L ) • λ : the security parameter • the attacker’s resources (e.g. # user secret key queries Q k or # challenge ciphertext queries Q c ) Roman Langrehr, Jiaxin Pan 2020-06-01 7
Tight security Scheme Assumption Reduction (e.g. HIBE) (e.g. Diffie-Hellman) Can be broken with Can be broken with probability ε using resources ρ . probability ε/ℓ using resources ρ . Larger security loss requires larger security parameter. Tight security: Security loss ℓ can depend on: • scheme parameters (e.g. maximum hierarchy depth L ) allowed • λ : the security parameter � • the attacker’s resources (e.g. # user secret key queries Q k not allowed or # challenge ciphertext queries Q c ) Roman Langrehr, Jiaxin Pan 2020-06-01 7
Multi-challenge security Challenger Adversary mpk id $ ← { 0 , 1 } b usk[id] id ⋆ , m 0 , m 1 $ C ⋆ ← Enc(mpk , id ⋆ , m b ) b ′ b ? = b ′ Roman Langrehr, Jiaxin Pan 2020-06-01 8
Multi-challenge security Challenger Adversary mpk id $ ← { 0 , 1 } b usk[id] Single-challenge security id ⋆ , m 0 , m 1 Multi-challenge security $ C ⋆ ← Enc(mpk , id ⋆ , m b ) b ′ b ? = b ′ Roman Langrehr, Jiaxin Pan 2020-06-01 8
Multi-challenge security Challenger Adversary mpk id $ ← { 0 , 1 } b usk[id] Single-challenge security id ⋆ , m 0 , m 1 generic: O ( Q c ) loss Multi-challenge security $ C ⋆ ← Enc(mpk , id ⋆ , m b ) b ′ b ? = b ′ Roman Langrehr, Jiaxin Pan 2020-06-01 8
Multi-challenge security Challenger Adversary mpk id $ ← { 0 , 1 } b usk[id] Single-challenge security id ⋆ , m 0 , m 1 generic: O ( Q c ) loss Multi-challenge security $ C ⋆ ← Enc(mpk , id ⋆ , m b ) b ′ b ? = b ′ Tight multi-instance security: Easy to achieve by rerandomizing the master public key. Roman Langrehr, Jiaxin Pan 2020-06-01 8
History: HIBE HIBEs in prime-order pairing groups: [Wat09], [CW13], [BKP14] O ( Q k ) (single-challenge) [Lew12], [GCTC16] O ( Q k L ) (single-challenge) O ( nL 2 ) resp. O ( nL ) (single-challenge) [LP19] O ( nL 2 ) (multi-challenge) This work • Q k : # user secret key queries • L : maximum hierarchy depth • n : Bit-length of the identities Roman Langrehr, Jiaxin Pan 2020-06-01 9
History: Tight IBE Tight IBEs in prime-order pairing groups: [CW13], [BKP14] O ( n ) (single-challenge) [AHY15], [GCD + 16], [GDCC16], [HJP18] O ( n ) (multi-challenge) • n : Bit-length of the identities Roman Langrehr, Jiaxin Pan 2020-06-01 10
History: Tight IBE Tight IBEs in prime-order pairing groups: [CW13], [BKP14] O ( n ) (single-challenge) [AHY15], [GCD + 16], [GDCC16], [HJP18] O ( n ) (multi-challenge) • n : Bit-length of the identities ? Tight single-challenge HIBE + Tight multi-challenge IBE → Tight multi-challenge HIBE Roman Langrehr, Jiaxin Pan 2020-06-01 10
IND-HID-CPA security for (H)IBE The challenge: • The reduction must answer user secret key queries for id 1 , . . . , id Q k . • The reduction must take advantage of the adversaries decryption capabilities for id ⋆ 1 , . . . , id ⋆ Q c . • The adversary adaptively chooses id 1 , . . . , id Q k and id ⋆ 1 , . . . , id ⋆ Q c . Roman Langrehr, Jiaxin Pan 2020-06-01 11
Partitioning • Different parts use ”slightly different“ secret key. • A usk key from one part is not helpful for decrypting a ciphertext from a different part. Roman Langrehr, Jiaxin Pan 2020-06-01 12
Partitioning • Different parts use ”slightly different“ secret key. • A usk key from one part is not helpful for decrypting a ciphertext from a different part. Initial Intermediate Final One partition Separated from Queried user secret key Challenge ciphertext Roman Langrehr, Jiaxin Pan 2020-06-01 12
Query-by-query Partitioning • Typically used by non-tight (H)IBE schemes • O ( Q k ) security loss Roman Langrehr, Jiaxin Pan 2020-06-01 13
Query-by-query Partitioning • Typically used by non-tight (H)IBE schemes • O ( Q k ) security loss Roman Langrehr, Jiaxin Pan 2020-06-01 13
Query-by-query Partitioning • Typically used by non-tight (H)IBE schemes • O ( Q k ) security loss Roman Langrehr, Jiaxin Pan 2020-06-01 13
Query-by-query Partitioning • Typically used by non-tight (H)IBE schemes • O ( Q k ) security loss Roman Langrehr, Jiaxin Pan 2020-06-01 13
Query-by-query Partitioning • Typically used by non-tight (H)IBE schemes • O ( Q k ) security loss Roman Langrehr, Jiaxin Pan 2020-06-01 13
Query-by-query Partitioning • Typically used by non-tight (H)IBE schemes • O ( Q k ) security loss Roman Langrehr, Jiaxin Pan 2020-06-01 13
Query-by-query Partitioning • Typically used by non-tight (H)IBE schemes • O ( Q k ) security loss Roman Langrehr, Jiaxin Pan 2020-06-01 13
Query-by-query Partitioning • Typically used by non-tight (H)IBE schemes • O ( Q k ) security loss Roman Langrehr, Jiaxin Pan 2020-06-01 13
Bit-by-bit Partitioning • Typically used by tight (H)IBE schemes. • One part per identity • O ( n ) security loss Roman Langrehr, Jiaxin Pan 2020-06-01 14
Bit-by-bit Partitioning • Typically used by tight (H)IBE schemes. • One part per identity • O ( n ) security loss id 1 = 0 id 1 = 1 Roman Langrehr, Jiaxin Pan 2020-06-01 14
Bit-by-bit Partitioning • Typically used by tight (H)IBE schemes. • One part per identity • O ( n ) security loss id 2 = 0 id 2 = 1 Roman Langrehr, Jiaxin Pan 2020-06-01 14
Bit-by-bit Partitioning • Typically used by tight (H)IBE schemes. • One part per identity • O ( n ) security loss Roman Langrehr, Jiaxin Pan 2020-06-01 14
Bit-by-bit Partitioning • Typically used by tight (H)IBE schemes. • One part per identity • O ( n ) security loss Roman Langrehr, Jiaxin Pan 2020-06-01 14
Partitioning techniques 1. Embedding a challenge of the underlying assumption. . . – . . .in a part of the msk that appears only in user secret keys with id i = b . – . . .“reacts” with the randomness of the usk resp. ciphertext. Roman Langrehr, Jiaxin Pan 2020-06-01 15
Partitioning techniques 1. Embedding a challenge of the underlying assumption. . . – . . .in a part of the msk that appears only in user secret keys with id i = b . – . . .“reacts” with the randomness of the usk resp. ciphertext. 2. Choose randomness of a subspace [GHKW16] – hides part of the msk from usk queries. Roman Langrehr, Jiaxin Pan 2020-06-01 15
Usage in the single-challenge setting Tight IBE: Scheme Challenge queries usk queries [CW13],[BKP14] (information-theoretic) Embedding a challenge Roman Langrehr, Jiaxin Pan 2020-06-01 16
Usage in the single-challenge setting Tight IBE: Scheme Challenge queries usk queries [CW13],[BKP14] (information-theoretic) Embedding a challenge Tight HIBE: Scheme Challenge queries usk queries [LP19] (information-theoretic) Subspace Roman Langrehr, Jiaxin Pan 2020-06-01 16
Recommend
More recommend
