Leakage-Resilient Chosen-Ciphertext Secure Public-Key Encryption - - PowerPoint PPT Presentation

▶
leakage resilient chosen ciphertext secure public key
SMART_READER_LITE
LIVE PREVIEW

Leakage-Resilient Chosen-Ciphertext Secure Public-Key Encryption - - PowerPoint PPT Presentation

Sep 21, 2023 106 likes •581 views

Leakage-Resilient Chosen-Ciphertext Secure Public-Key Encryption from Hash Proof System and One-Time Lossy Filter Baodong Qin and Shengli Liu Shanghai Jiao Tong University ASIACRYPT 2013 Dec 5, Bangalore, India B. Qin and S. Liu LR-CCA Secure

slide-1
SLIDE 1
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Leakage-Resilient Chosen-Ciphertext Secure Public-Key Encryption from Hash Proof System and One-Time Lossy Filter

Baodong Qin and Shengli Liu ASIACRYPT 2013 Dec 5, Bangalore, India

Shanghai Jiao Tong University

slide-2
SLIDE 2
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • Physical implementation leaks

information

  • e.g.: secret key/ randomness
  • Ideal setting
  • Private internal secret state

Why We Consider Secrets Leak?

THEORY REAL LIFE

secret state secret state

slide-3
SLIDE 3
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • Physical implementation leaks

information

  • e.g.: secret key/ randomness
  • Ideal setting
  • Private internal secret state

Why We Consider Secrets Leak?

THEORY REAL LIFE

secret state secret state

Side channel attacks time sound electromagnetic radiation

slide-4
SLIDE 4
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • Physical implementation leaks

information

  • e.g.: secret key/ randomness
  • Ideal setting
  • Private internal secret state

Why We Consider Secrets Leak?

THEORY REAL LIFE

secret state secret state

Side channel attacks time sound electromagnetic radiation

Only computation leaks information [Micali and Reyzin 04]

slide-5
SLIDE 5
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Bounded Leakage Model

Inspired by “cold-boot” attack/memory attack

[Halderman et al.08]

Not only computation leaks information

Model: leakage oracle

  • Leakage rate:

secret key: SK

slide-6
SLIDE 6
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Public-Key Encryption

Adversary y Decryption queries Leakage queries

Semantic security against key leakage and CCA [NS09]

slide-7
SLIDE 7
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Public-Key Encryption

Adversary y Decryption queries Leakage queries

Semantic security against key leakage and CCA [NS09]

The adversary succeeds if b=b’ Advantage: Pr[b=b’]-1/2

slide-8
SLIDE 8
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Previous Works

High leakage-rate (e.g. 1-o(1), using NIZK) but

either no efficient instantiations [NS09] or

  • ver a pairing-friendly group (efficient, but the

ciphertext size is a little bit large) [Dodis et al.10, Galindo et al.12]

slide-9
SLIDE 9
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Previous Works

High leakage-rate (e.g. 1-o(1), using NIZK) but

either no efficient instantiations [NS09] or

  • ver a pairing-friendly group (efficient, but the

ciphertext size is a little bit large) [Dodis et al.10, Galindo et al.12]

Low leakage rate (e.g. 1/4-o(1)), but

very practical construction via hash proof system [NS09,Li et al.12, Liu et al.13] has short ciphertext size (for reasonable leakage rate) Instantiations under DDH, DCR etc. (without pairing)

slide-10
SLIDE 10
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Question

From [Dodis et al. Asiacrypt 2010] …, it seems that the hash proof system approach to building CCA encryption is inherently limited to leakage-rates below 1/2: this is because the secret-key consists of two components (one for verifying that the ciphertext is well-formed and one for decrypting it) and the proofs break down if either of the components is individually leaked in its entirety. However, no HPS-based PKEs are known achieving leakage- rate 1/2-o(1), especially under DDH or DCR assumptions. Question: can we find a new way to construct LR-CCA secure PKEs which are as practical as HPS with reasonable high leakage-rates, like 1/2-o(1)?

slide-11
SLIDE 11
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Hash Proof System[CS02]

Family of projective hash functions Subset membership problem: (valid/invalid)

slide-12
SLIDE 12
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Hash Proof System[CS02]

Family of projective hash functions Subset membership problem: (valid/invalid)

SK space PK space

slide-13
SLIDE 13
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Hash Proof System[CS02]

Public evaluation Private evaluation

Family of projective hash functions Subset membership problem: (valid/invalid)

SK space PK space

slide-14
SLIDE 14
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Hash Proof System[CS02]

Public evaluation Private evaluation

Family of projective hash functions Subset membership problem: (valid/invalid)

SK space PK space

  • universal/universal2
  • smooth

High entropy

slide-15
SLIDE 15
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

HPS-based Approach

additional input Prove Mask message (language)

slide-16
SLIDE 16
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

HPS-based Approach

additional input Prove Mask message (language)

slide-17
SLIDE 17
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

HPS-based Approach

additional input Prove Mask message (language)

  • Leakage amount is at most:
  • In fact smaller than
slide-18
SLIDE 18
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

HPS-based Approach

additional input Prove Mask message (language)

  • Leakage amount is at most:
  • In fact smaller than

Leakage-rate:

slide-19
SLIDE 19
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

HPS-based Approach

additional input Prove Mask message (language)

  • Leakage amount is at most:
  • In fact smaller than

Leakage-rate: Best result: 1/4 –o(1) under DDH assumption

slide-20
SLIDE 20
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Our Approach

additional input Prove Mask message (language)

slide-21
SLIDE 21
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Our Approach

additional input Prove Mask message (language)

slide-22
SLIDE 22
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Our Approach

additional input Prove Mask message (language)

slide-23
SLIDE 23
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Our Approach

additional input Prove Mask message (language)

slide-24
SLIDE 24
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Our Approach

additional input Prove Mask message (language)

slide-25
SLIDE 25
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Our Approach

additional input Prove Mask message (language) Leakage-rate: Our result: 1/2 –o(1) under DDH /DCR

slide-26
SLIDE 26
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Our Approach

additional input Prove Mask message (language) Leakage-rate: Our result: 1/2 –o(1) under DDH /DCR One-Time Lossy Filter

slide-27
SLIDE 27
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

slide-28
SLIDE 28
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

slide-29
SLIDE 29
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

One-Time Lossy Filter

Similar to (chameleon) all-but-one lossy trapdoor

functions [PW08,LDL11]

not require efficient inversion.

Simplified version of lossy algebraic filter (for

CIRC-CCA security) [Hof13]

not require any algebraic property, but require that lossy function reveals constant information of its input even for larger domain (by adapting some public parameters).

Tag space:

auxiliary input part core tag part lossy tags injective tags

slide-30
SLIDE 30
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

lossiness/ indistinguishability/evasiveness

Properties

Injective Domain Lossy possible values Domain

slide-31
SLIDE 31
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Lossy tag is generated via a trapdoor Ftd.

For any auxiliary input ta, it is easy to compute a core tag tc, such that (ta,tc) is a lossy tag via the trapdoor. Without the trapdoor, it is hard to generate a new non-injective tag even seen one lossy tag.

Properties

slide-32
SLIDE 32
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

slide-33
SLIDE 33
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

One entropy source used in two purposes.

Mask the plaintext (applying an extractor) Verify the well-formedness of the ciphertext (applying a special injective function: one-time lossy filter)

Construction Idea

k-entropy source k-entropy Injective map

slide-34
SLIDE 34
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

The PKE Scheme

Ciphertext: Encryption Decryption

slide-35
SLIDE 35
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

The PKE Scheme

Ciphertext: Encryption Decryption

slide-36
SLIDE 36
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Proof Idea: challenge ciphertext

Public evaluation Private evaluation High entropy

slide-37
SLIDE 37
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Proof Idea: challenge ciphertext

Public evaluation Private evaluation Lossy Injective reveal bits info. High entropy

slide-38
SLIDE 38
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Proof Idea: challenge ciphertext

Public evaluation Private evaluation Shorter random bits to hide plaintext Reveal limited amount of information about K* High entropy

slide-39
SLIDE 39
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Proof Idea: challenge ciphertext

Public evaluation Private evaluation Shorter random bits to hide plaintext Reveal limited amount of information about K* constant remainder entropy (to leak) well-formedness check High entropy

slide-40
SLIDE 40
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Proof Idea: decryption query

Public evaluation Shorter random bits to hide plaintext Must know all entropy of K Injective High entropy

slide-41
SLIDE 41
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Proof Idea: decryption query

Public evaluation Shorter random bits to hide plaintext Must know all entropy of K Injective High entropy

slide-42
SLIDE 42
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Proof Summary

valid invalid injective

  • lossy
  • HPS

OT-LF Decryption queries

valid invalid injective

  • lossy
  • HPS

OT-LF Encryption query

slide-43
SLIDE 43
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

slide-44
SLIDE 44
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

n-fold parallelization of [CS02] construction. OT-LF, similar to DDH-based lossy trapdoor

function: Domain: , image values:

Instantiation: <q, G, g>

Chameleon hash

slide-45
SLIDE 45
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Efficiency Comparison

Advantages:

Achieve 1/2-o(1) under DDH/DCR shorter ciphertext overhead (when leakage rate better than HPS-based construction [28,25]

Disadvantages: below 1/2.

slide-46
SLIDE 46
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF

Conclusion and Further Work

A new primitive: one-time lossy filter A generic construction of LR-CCA-secure PKE Efficient instantiations under DDH and DCR

assumptions (with better leakage-rate 1/2-o(1)) Further work:

Improve the leakage-rate to [1/2, 1) without loss

the practicality.

Leakage-flexible CCA-secure PKE without pairing.

slide-47
SLIDE 47
  • B. Qin and S. Liu

LR-CCA Secure PKE from HPS and OT-LF