How to Eat Your Entropy and Have It Too (Recovering from - - PowerPoint PPT Presentation

▶
how to eat your entropy and have it too recovering from
SMART_READER_LITE
LIVE PREVIEW

How to Eat Your Entropy and Have It Too (Recovering from - - PowerPoint PPT Presentation

Nov 03, 2022 315 likes •1.2k views

How to Eat Your Entropy and Have It Too (Recovering from compromise) Yevgeniy Dodis Adi Shamir Noah Stephens-Davidowitz Daniel Wichs Our Goal Our Goal Our Goal Our Goal How Does TCC Build a PRG? How Does TCC Build a PRG? PRG S 0 S 1 R

slide-1
SLIDE 1

How to Eat Your Entropy and Have It Too (Recovering from compromise)

Yevgeniy Dodis Adi Shamir Noah Stephens-Davidowitz Daniel Wichs

slide-2
SLIDE 2

Our Goal

slide-3
SLIDE 3

Our Goal

slide-4
SLIDE 4

Our Goal

slide-5
SLIDE 5

Our Goal

slide-6
SLIDE 6

How Does TCC Build a PRG?

slide-7
SLIDE 7

How Does TCC Build a PRG?

S0 R0 PRG S1

slide-8
SLIDE 8

How Does TCC Build a PRG?

S0 R0 PRG S1 R1 PRG S2

slide-9
SLIDE 9

How Does TCC Build a PRG?

S0 R0 PRG S1 R1 PRG S2 R2 PRG S3

slide-10
SLIDE 10

How Does TCC Build a PRG?

S0 R0 PRG S1 R1 PRG S2 R2 PRG S3 Perfect randomness…

slide-11
SLIDE 11

Developers Build “RNGs with Input”

slide-12
SLIDE 12

Developers Build “RNGs with Input”

S next S’,R

slide-13
SLIDE 13

Developers Build “RNGs with Input”

S next S’,R S,I refresh S’

slide-14
SLIDE 14

Developers Build “RNGs with Input”

S next S’,R S,I refresh S’ Entropy?

slide-15
SLIDE 15

Developers Build “RNGs with Input”

S next S’,R S,I refresh S’ Entropy? Accumulated entropy

slide-16
SLIDE 16

Developers Build “RNGs with Input”

S next S’,R S,I refresh S’ Entropy? Accumulated entropy H(S’) ≈ H(S) + H(I)

slide-17
SLIDE 17

(Limited) Formal Analysis

[BH05] [DPRVW13]

slide-18
SLIDE 18

(Limited) Formal Analysis

[BH05] [DPRVW13]

First formal model (In 2005!)

slide-19
SLIDE 19

(Limited) Formal Analysis

[BH05] [DPRVW13]

First formal model (In 2005!) Recover only after full-entropy input

slide-20
SLIDE 20

(Limited) Formal Analysis

[BH05] [DPRVW13]

First formal model (In 2005!) Gathers entropy as it comes Recover only after full-entropy input

slide-21
SLIDE 21

(Limited) Formal Analysis

[BH05] [DPRVW13]

First formal model (In 2005!) Gathers entropy as it comes Recover only after full-entropy input But….

slide-22
SLIDE 22

Premature Next

RNG with input

slide-23
SLIDE 23

Premature Next

RNG with input

slide-24
SLIDE 24

Premature Next

I

RNG with input

slide-25
SLIDE 25

Premature Next

I

RNG with input

slide-26
SLIDE 26

Premature Next

I

RNG with input

I

slide-27
SLIDE 27

Premature Next

I

RNG with input

I

slide-28
SLIDE 28

Premature Next

I

RNG with input

I I …

slide-29
SLIDE 29

Premature Next

I

RNG with input

I I …

slide-30
SLIDE 30

Premature Next

I

RNG with input

I I … R

slide-31
SLIDE 31

Premature Next

I

RNG with input

I I … R

slide-32
SLIDE 32

Premature Next

RNG with input

slide-33
SLIDE 33

Premature Next

RNG with input

slide-34
SLIDE 34

Premature Next

RNG with input

I

slide-35
SLIDE 35

Premature Next

RNG with input

I R

slide-36
SLIDE 36

Premature Next

RNG with input

I R S

slide-37
SLIDE 37

Premature Next

RNG with input

I R S

slide-38
SLIDE 38

How do we deal with this?

slide-39
SLIDE 39

Option 1: Don’t Let The Adversary Look

RNG with input

slide-40
SLIDE 40

Option 1: Don’t Let The Adversary Look

I

RNG with input

slide-41
SLIDE 41

Option 1: Don’t Let The Adversary Look

I

RNG with input

slide-42
SLIDE 42

Option 1: Don’t Let The Adversary Look

I

RNG with input

I

slide-43
SLIDE 43

Option 1: Don’t Let The Adversary Look

I

RNG with input

I

slide-44
SLIDE 44

Option 1: Don’t Let The Adversary Look

I

RNG with input

I I …

slide-45
SLIDE 45

Option 1: Don’t Let The Adversary Look

I

RNG with input

I I …

slide-46
SLIDE 46

Option 1: Don’t Let The Adversary Look

I

RNG with input

I I … R

slide-47
SLIDE 47

Option 1: Don’t Let The Adversary Look

I

RNG with input

I I … R

slide-48
SLIDE 48

Option 2: Estimate Entropy

RNG with input

slide-49
SLIDE 49

Option 2: Estimate Entropy

RNG with input

slide-50
SLIDE 50

Option 2: Estimate Entropy

RNG with input

I

slide-51
SLIDE 51

Option 2: Estimate Entropy

RNG with input

I I

slide-52
SLIDE 52

Option 2: Estimate Entropy

RNG with input

I I

slide-53
SLIDE 53

Option 2: Estimate Entropy

RNG with input

? I I

slide-54
SLIDE 54

Option 2: Estimate Entropy

RNG with input

? I I ?

slide-55
SLIDE 55

Option 2: Estimate Entropy

RNG with input

? I I ? I …

slide-56
SLIDE 56

Option 2: Estimate Entropy

RNG with input

? I I ?

RNG with input

I …

slide-57
SLIDE 57

Option 2: Estimate Entropy

RNG with input

? I I ?

RNG with input

R I …

slide-58
SLIDE 58

Option 2: Estimate Entropy

RNG with input

? I I ?

RNG with input

R I …

slide-59
SLIDE 59

Option 2: Estimate Entropy

RNG with input

? I I ?

RNG with input

R

But we can’t estimate entropy….

I …

slide-60
SLIDE 60

Option 3: Prove Impossibility

slide-61
SLIDE 61

Option 3: Prove Impossibility

But it’s possible….

slide-62
SLIDE 62

Option 4: Eat Your Entropy and Have It Too

slide-63
SLIDE 63

…

Option 4: Eat Your Entropy and Have It Too

slide-64
SLIDE 64

…

Option 4: Eat Your Entropy and Have It Too

slide-65
SLIDE 65

…

Option 4: Eat Your Entropy and Have It Too

slide-66
SLIDE 66

…

Unknown amount

Option 4: Eat Your Entropy and Have It Too

slide-67
SLIDE 67

…

Option 4: Eat Your Entropy and Have It Too

slide-68
SLIDE 68

…

Option 4: Eat Your Entropy and Have It Too

slide-69
SLIDE 69

…

Option 4: Eat Your Entropy and Have It Too

slide-70
SLIDE 70

…

Option 4: Eat Your Entropy and Have It Too

slide-71
SLIDE 71

…

Option 4: Eat Your Entropy and Have It Too

slide-72
SLIDE 72

…

Option 4: Eat Your Entropy and Have It Too

slide-73
SLIDE 73

…

Option 4: Eat Your Entropy and Have It Too

slide-74
SLIDE 74

…

Option 4: Eat Your Entropy and Have It Too

slide-75
SLIDE 75

… Adi Shamir

Option 4: Eat Your Entropy and Have It Too

slide-76
SLIDE 76

Idea Used in Practice (but not theory…)

[KSF99]’s Yarrow [FS03]’s Fortuna

slide-77
SLIDE 77

Idea Used in Practice (but not theory…)

[KSF99]’s Yarrow [FS03]’s Fortuna

Only two pools

slide-78
SLIDE 78

Idea Used in Practice (but not theory…)

[KSF99]’s Yarrow [FS03]’s Fortuna

Many pools with clever scheduling Only two pools

slide-79
SLIDE 79

Idea Used in Practice (but not theory…)

[KSF99]’s Yarrow [FS03]’s Fortuna

Many pools with clever scheduling Only two pools

slide-80
SLIDE 80

Idea Used in Practice (but not theory…)

[KSF99]’s Yarrow [FS03]’s Fortuna

Many pools with clever scheduling Only two pools

slide-81
SLIDE 81

Our Work

slide-82
SLIDE 82

Our Work

  • Formal model (very strong security notion)
slide-83
SLIDE 83

Our Work

  • Formal model (very strong security notion)
  • Provably secure construction in this model
  • Inspired by Fortuna
  • Proof in standard model (from OWF)
slide-84
SLIDE 84

Our Work

  • Formal model (very strong security notion)
  • Provably secure construction in this model
  • Inspired by Fortuna
  • Proof in standard model (from OWF)
  • Attacks on prior constructions
slide-85
SLIDE 85

Our Work

  • Formal model (very strong security notion)
  • Provably secure construction in this model
  • Inspired by Fortuna
  • Proof in standard model (from OWF)
  • Attacks on prior constructions
  • Formal analysis of and improvement of

Fortuna

  • Secure in limited setting
  • Doubled entropy effjciency
slide-86
SLIDE 86

Thanks!