Identity-Based Cryptosystems and Quadratic Residuosity Marc Joye - - PowerPoint PPT Presentation

▶
identity based cryptosystems and quadratic residuosity
SMART_READER_LITE
LIVE PREVIEW

Identity-Based Cryptosystems and Quadratic Residuosity Marc Joye - - PowerPoint PPT Presentation

Apr 04, 2023 256 likes •659 views

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion Identity-Based Cryptosystems and Quadratic Residuosity Marc Joye Proxy: Fabrice Benhamouda PKC 2016 Tapei, Taiwan 1 / 20 Identity-Based Encryption

slide-1
SLIDE 1

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Identity-Based Cryptosystems and Quadratic Residuosity

Marc Joye Proxy: Fabrice Benhamouda PKC 2016 · Tapei, Taiwan

1 / 20

slide-2
SLIDE 2

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Identity-Based Encryption

Definition An identity-based encryption scheme is a set of 4 algorithms

1 Setup

Input: security parameter κ Output: master public/secret key mpk/msk

2 / 20

slide-3
SLIDE 3

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Identity-Based Encryption

Definition An identity-based encryption scheme is a set of 4 algorithms

1 Setup

Input: security parameter κ Output: master public/secret key mpk/msk

2 Encryption

Input: master public key mpk, identity id, message m Output: C = E (mpk, id, m)

2 / 20

slide-4
SLIDE 4

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Identity-Based Encryption

Definition An identity-based encryption scheme is a set of 4 algorithms

1 Setup

Input: security parameter κ Output: master public/secret key mpk/msk

2 Encryption

Input: master public key mpk, identity id, message m Output: C = E (mpk, id, m)

3 Key derivation

Input: identity id, master secret key msk Output: user’s private key usk

2 / 20

slide-5
SLIDE 5

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Identity-Based Encryption

Definition An identity-based encryption scheme is a set of 4 algorithms

1 Setup

Input: security parameter κ Output: master public/secret key mpk/msk

2 Encryption

Input: master public key mpk, identity id, message m Output: C = E (mpk, id, m)

3 Key derivation

Input: identity id, master secret key msk Output: user’s private key usk

4 Decryption

Input: decryption key usk, ciphertext C Output: m = D(usk, C)

2 / 20

slide-6
SLIDE 6

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

This Talk

Study of Cocks IBE scheme

Clifford Cocks (mathematician, GCHQ)

Our Main Contribution Discovery of the algebraic structure underlying Cocks encryption better understanding of its properties and its security new applications

3 / 20

slide-7
SLIDE 7

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Outline

1

Cocks IBE Scheme

2

Algebraic Structure

3

Applications

4

Conclusion

4 / 20

slide-8
SLIDE 8

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Preliminaries

If p prime number, a ∈ Fp, Legendre symbol: a p

  • =

     if a ≡ 0 mod p 1 if a is a square (a = b2 mod p) −1 else

5 / 20

slide-9
SLIDE 9

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Preliminaries

If p prime number, a ∈ Fp, Legendre symbol: a p

  • =

     if a ≡ 0 mod p 1 if a is a square (a = b2 mod p) −1 else If N = pq RSA modulus, a ∈ ZN, Jacobi symbol: a N

  • =

a p

  • ·

a q

  • (efficiently computable)

5 / 20

slide-10
SLIDE 10

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Preliminaries

If p prime number, a ∈ Fp, Legendre symbol: a p

  • =

     if a ≡ 0 mod p 1 if a is a square (a = b2 mod p) −1 else If N = pq RSA modulus, a ∈ ZN, Jacobi symbol: a N

  • =

a p

  • ·

a q

  • (efficiently computable)

a is a square mod N ⇐ ⇒ a p

  • =

a q

  • = 1

5 / 20

slide-11
SLIDE 11

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Preliminaries

If p prime number, a ∈ Fp, Legendre symbol: a p

  • =

     if a ≡ 0 mod p 1 if a is a square (a = b2 mod p) −1 else If N = pq RSA modulus, a ∈ ZN, Jacobi symbol: a N

  • =

a p

  • ·

a q

  • (efficiently computable)

a is a square mod N ⇐ ⇒ a p

  • =

a q

  • = 1 =

⇒ a N

  • = 1

5 / 20

slide-12
SLIDE 12

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Cocks Cryptosystem

First pairing-free IBE scheme (2001)

works in standard RSA groups semantically secure under QR assumption (in the ROM)

Quadratic Residuosity Assumption Let N = pq be an RSA-type modulus. The distributions of JN =

  • a ∈ Z×

N |

a

N

  • = 1
  • and QRN =
  • a ∈ Z×

N |

a

p

  • =

a

q

  • = 1
  • are indistinguishable

6 / 20

slide-13
SLIDE 13

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Cocks Cryptosystem (cont’d)

Setup mpk = {N, u, H}, msk = {p, q} where: N = pq an RSA modulus u ∈ JN \ QRN H: {0, 1}∗ → JN hash function (RO) Key derivation compute Did = H(id) and returns usk = δid =

  • (Did)1/2

if Did ∈ QRN (uDid)1/2 if Did ∈ JN \ QRN

Remark: Original cryptosystem defined with p, q ≡ 3 (mod 4) and u = −1

7 / 20

slide-14
SLIDE 14

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Cocks Cryptosystem (cont’d)

Setup mpk = {N, u, H}, msk = {p, q} where: N = pq an RSA modulus u ∈ JN \ QRN H: {0, 1}∗ → JN hash function (RO) Key derivation compute Did = H(id) and returns usk = δid =

  • (Did)1/2

if Did ∈ QRN (uDid)1/2 if Did ∈ JN \ QRN

Remark: Original cryptosystem defined with p, q ≡ 3 (mod 4) and u = −1

7 / 20

slide-15
SLIDE 15

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Cocks Cryptosystem (cont’d)

mpk Alice Bob message m ∈ {−1, 1} δid = H(id)1/2 mod N t ∈R ZN s.t. t N

  • = m

c = t + H(id) t mod N

C=(c )

− − − − − − − → γ = c m = γ + 2δid N

  • 7 / 20
slide-16
SLIDE 16

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Cocks Cryptosystem (cont’d)

mpk Alice Bob message m ∈ {−1, 1} δid = H(id)1/2 mod N t, ¯ t ∈R ZN s.t.

  • r δid = (uH(id))1/2 mod N

t N

  • =

¯ t N

  • = m

c = t + H(id) t mod N ¯ c = ¯ t + uH(id) ¯ t mod N

C=(c,¯ c)

− − − − − − − → γ = c or ¯ c m = γ + 2δid N

  • 7 / 20
slide-17
SLIDE 17

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Outline

1

Cocks IBE Scheme

2

Algebraic Structure

3

Applications

4

Conclusion

8 / 20

slide-18
SLIDE 18

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Pell Curve

Consider the Pell curve given by the Pell equation x2 − ∆y2 = 1

  • ver Fp, where ∆ = δ2 ∈ F×

p

9 / 20

slide-19
SLIDE 19

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Pell Curve

Consider the Pell curve given by the Pell equation x2 − ∆y2 = 1

  • ver Fp, where ∆ = δ2 ∈ F×

p

Set of points (x, y) on the Pell curve

forms a group C (Fp)

  • rder p − 1

neutral element: O = (0, 1)

9 / 20

slide-20
SLIDE 20

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Pell Curve

Consider the Pell curve given by the Pell equation x2 − ∆y2 = 1

  • ver Fp, where ∆ = δ2 ∈ F×

p

Set of points (x, y) on the Pell curve

forms a group C (Fp) ∼ = F×

p

  • rder p − 1

neutral element: O = (0, 1)

9 / 20

slide-21
SLIDE 21

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Group Law

Geometric interpretation

10 / 20

slide-22
SLIDE 22

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Group Law

Geometric interpretation

10 / 20

slide-23
SLIDE 23

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Group Law

Geometric interpretation

10 / 20

slide-24
SLIDE 24

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Group Law

Geometric interpretation Algebraically: (x1, y1) ⊕ (x2, y2) = (x1x2 + ∆y1y2, x1y2 + x2y1)

10 / 20

slide-25
SLIDE 25

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Compact Representation

Slope

line through P P P and O: y = s(x − 1) for efficiency, let t := ∆s =

∆y x−1

ψ : Fp ∪ {∞} → C (Fp),

  • t → P

P P =

  • t2+∆

t2−∆, 2t t2−∆

  • ∞ → O

Remark: ψ not defined at ±δ when ∆ ∈ QRp

11 / 20

slide-26
SLIDE 26

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

The Group ZN,∆

We recall that ∆ = δ2 ∈ QRp Define the group (Fp,∆, ⊛) with neutral element ∞, where Fp,∆ = (Fp \ {±δ}) ∪ {∞} = {ψ−1(P P P) | P P P ∈ C (Fp)} = {t ∈ Fp | t2 = ∆} ∪ {∞} under the law ⊛: t1 ⊛ t2 = t1t2 + ∆ t1 + t2

12 / 20

slide-27
SLIDE 27

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

The Group ZN,∆

We recall that ∆ = δ2 ∈ QRp Define the group (Fp,∆, ⊛) with neutral element ∞, where Fp,∆ = (Fp \ {±δ}) ∪ {∞} = {ψ−1(P P P) | P P P ∈ C (Fp)} = {t ∈ Fp | t2 = ∆} ∪ {∞} ∼ = F×

p

under the law ⊛: t1 ⊛ t2 = t1t2 + ∆ t1 + t2

12 / 20

slide-28
SLIDE 28

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

The Group ZN,∆

We recall that ∆ = δ2 ∈ QRp Define the group (Fp,∆, ⊛) with neutral element ∞, where Fp,∆ = (Fp \ {±δ}) ∪ {∞} = {ψ−1(P P P) | P P P ∈ C (Fp)} = {t ∈ Fp | t2 = ∆} ∪ {∞} ∼ = F×

p

under the law ⊛: t1 ⊛ t2 = t1t2 + ∆ t1 + t2 By Chinese remaindering, for N = pq, consider ZN,∆ := Fp,∆ × Fq,∆ ∼ = Z×

N

12 / 20

slide-29
SLIDE 29

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

The Subgroup of Squares in ZN,∆

Main Observation (Up to a factor of 2) Cocks ciphertexts are squares in ZN,∆, where ∆ = H(id) ∈ QRN [or ∆ = uH(id) ∈ QRN] t1 ⊛ t2 = t1t2 + ∆ t1 + t2 = ⇒ t ⊛ t = t2 + H(id) 2t = 1 2 ·

  • t + H(id)

t

  • = c

2 and likewise, ¯ t ⊛ ¯ t =

¯ t2+uH(id) 2¯ t

= 1

2 ·

  • ¯

t + uH(id)

¯ t

  • = ¯

c 2

13 / 20

slide-30
SLIDE 30

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Outline

1

Cocks IBE Scheme

2

Algebraic Structure

3

Applications

4

Conclusion

14 / 20

slide-31
SLIDE 31

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Re-Randomizing Cocks Ciphertexts

For simplicity, we suppose H(id) ∈ QRN = ⇒ ∆ = H(id) Let message m = (−1)b ∈ {±1} Corresponding ciphertext is c = t + ∆

t with

t

N

  • = m

Choosing a random t′ and computing c′ = t′ + ∆

t′ , we have

c∗ 2 := c 2 ⊛ c′ 2 ≡ c 2 ⇐ ⇒ c + c′ N

  • = 1

= ⇒ t′ should be chosen s.t.

  • c+c′

N

  • = 1 to get a ciphertext c∗

equivalent to c

15 / 20

slide-32
SLIDE 32

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Computing over Cocks Ciphertexts

For simplicity, we suppose H(id) ∈ QRN = ⇒ ∆ = H(id) Let messages m1 = (−1)b1 and m2 = (−1)b2 ∈ {±1} Define message m3 := m1 · m2 = (−1)b1⊕b2 Corresponding ciphertexts are denoted c1, c2, and c3 Then c′

3

2 := c1 2 ⊛ c2 2 ≡ c3 2 ⇐ ⇒ c1 + c2 N

  • = 1

If necessary, re-randomize e.g. c1 until above condition is met

16 / 20

slide-33
SLIDE 33

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Computing over Cocks Ciphertexts

Cocks cryptosystem is homomorphic

w.r.t. multiplication for messages in {±1} w.r.t. ⊕ for messages in {0, 1}

16 / 20

slide-34
SLIDE 34

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Making Cocks Ciphertexts Anonymous

Galbraith: Cocks ciphertext are not anonymous With our notation Proposition Let w ∈ ZN,∆. If w2 − ∆ N

  • = −1

then w is not a square in ZN,∆ = ⇒ If a ciphertext c satisfies (c/2)2−H(id)

N

  • = −1 then it is not

for user with identity id

17 / 20

slide-35
SLIDE 35

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Making Cocks Ciphertexts Anonymous

⊛-multiply with probability 1/2 the value of c

2 with

an element d

2 satisfying

(d/2)2−∆

N

  • = −1

At decryption time, legitimate recipient can ⊛-divide by d

2 in

case ciphertext were ⊛-multiplied by d

2

Application: Public-key encryption with keyword search (PEKS)

17 / 20

slide-36
SLIDE 36

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Outline

1

Cocks IBE Scheme

2

Algebraic Structure

3

Applications

4

Conclusion

18 / 20

slide-37
SLIDE 37

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Summary

Description of algebraic structure underlying Cocks encryption Better understanding of Cocks cryptosystem Applications:

homomorphic computations anonymous encryption

(More results in the paper) Cocks cryptosystem is homomorphic

19 / 20

slide-38
SLIDE 38

Identity-Based Encryption Cocks IBE Scheme Algebraic Structure Applications Conclusion

Comments/Questions?

http://joye.site88.net/

20 / 20