Limitations of the Meta-Reduction Technique Nils Fleischhacker - - PowerPoint PPT Presentation

▶
limitations of the meta reduction technique
SMART_READER_LITE
LIVE PREVIEW

Limitations of the Meta-Reduction Technique Nils Fleischhacker - - PowerPoint PPT Presentation

Mar 22, 2023 393 likes •795 views

Preliminaries Meta-Reductions Limitations Conclusion Limitations of the Meta-Reduction Technique Nils Fleischhacker Technische Universit at Darmstadt September 2, 2012 Nils Fleischhacker Technische Universit at Darmstadt Limitations

slide-1
SLIDE 1

Preliminaries Meta-Reductions Limitations Conclusion

Limitations of the Meta-Reduction Technique

Nils Fleischhacker

Technische Universit¨ at Darmstadt

September 2, 2012

Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 1

slide-2
SLIDE 2

Preliminaries Meta-Reductions Limitations Conclusion

Signatures

... with Reasonable Randomization

S = (Kgen, Sign, Vrfy)

κ Kgen sk pk Sign Vrfy σ m b Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 2

slide-3
SLIDE 3

Preliminaries Meta-Reductions Limitations Conclusion

Signatures

... with Reasonable Randomization

S = (Kgen, Sign, Vrfy)

κ Kgen sk pk Sign Vrfy σ m ω b

H∞ (Sign(pk, m)) ∈ ω(log(κ))

Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 2

slide-4
SLIDE 4

Preliminaries Meta-Reductions Limitations Conclusion

Problems Π = (IGen, Thresh, Vrfy)

κ IGen z A Vrfy x b Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 3

slide-5
SLIDE 5

Preliminaries Meta-Reductions Limitations Conclusion

Problems Π = (IGen, Thresh, Vrfy, O)

κ IGen z A Vrfy x b O st Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 3

slide-6
SLIDE 6

Preliminaries Meta-Reductions Limitations Conclusion

Problems Π = (IGen, Thresh, Vrfy, O)

κ IGen z A Vrfy x b O st

ExpΠ

A(κ) :

    z ← IGen(κ) x ← AO(z) b ← Vrfy(z, x)

  • utput b

   

Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 3

slide-7
SLIDE 7

Preliminaries Meta-Reductions Limitations Conclusion

Problems Π = (IGen, Thresh, Vrfy, O)

κ IGen z A Vrfy x b O st

ExpΠ

A(κ) :

    z ← IGen(κ) x ← AO(z) b ← Vrfy(z, x)

  • utput b

    AdvA

Π(κ) =

Pr

  • ExpΠ

A(κ)

?

= 1

  • − Pr
  • ExpΠ

Thresh(κ)

?

= 1

  • Nils Fleischhacker

Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 3

slide-8
SLIDE 8

Preliminaries Meta-Reductions Limitations Conclusion

Reductions and Meta-Reductions

A EUF-CMA Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 4

slide-9
SLIDE 9

Preliminaries Meta-Reductions Limitations Conclusion

Reductions and Meta-Reductions

R A EUF-CMA Π Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 4

slide-10
SLIDE 10

Preliminaries Meta-Reductions Limitations Conclusion

Reductions and Meta-Reductions

R M A EUF-CMA Π Π’ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 4

slide-11
SLIDE 11

Preliminaries Meta-Reductions Limitations Conclusion

The “Standard” Technique

M R Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

slide-12
SLIDE 12

Preliminaries Meta-Reductions Limitations Conclusion

The “Standard” Technique

M R z Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

slide-13
SLIDE 13

Preliminaries Meta-Reductions Limitations Conclusion

The “Standard” Technique

M m, m′

$

← {0, 1}∗ R z pk Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

slide-14
SLIDE 14

Preliminaries Meta-Reductions Limitations Conclusion

The “Standard” Technique

M m, m′

$

← {0, 1}∗ R z pk m Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

slide-15
SLIDE 15

Preliminaries Meta-Reductions Limitations Conclusion

The “Standard” Technique

M m, m′

$

← {0, 1}∗ R z pk m m, σ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

slide-16
SLIDE 16

Preliminaries Meta-Reductions Limitations Conclusion

The “Standard” Technique

M m, m′

$

← {0, 1}∗ R z pk m, σ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

slide-17
SLIDE 17

Preliminaries Meta-Reductions Limitations Conclusion

The “Standard” Technique

M m, m′

$

← {0, 1}∗ R z pk m, σ m′ σ′ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

slide-18
SLIDE 18

Preliminaries Meta-Reductions Limitations Conclusion

The “Standard” Technique

M m, m′

$

← {0, 1}∗ R z pk m, σ m′ σ′ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

slide-19
SLIDE 19

Preliminaries Meta-Reductions Limitations Conclusion

The “Standard” Technique

M m, m′

$

← {0, 1}∗ R z pk m, σ m′ σ′ x Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 5

slide-20
SLIDE 20

Preliminaries Meta-Reductions Limitations Conclusion

The “Standard” Technique So, what’s the problem?

Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 6

slide-21
SLIDE 21

Preliminaries Meta-Reductions Limitations Conclusion

Well, as it turns out...

i := 0 (sk, pk) ← Kgen(1κ) ω ← O(m, i) σ ← Sign(sk, m; ω) i := i + 1 if     Vrfy(pk, m∗, σ∗) ? = 0 ∨ ∃i ∈ {0, . . . , p} :

  • ω∗ ← O(m∗, i)

∧ σ∗ ? = Sign(sk, m∗; ω∗)

  abort Find x ∈ Sol such that Vrfy(z, x) ? = 1. R x z pk m σ m∗, σ∗ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 7

slide-22
SLIDE 22

Preliminaries Meta-Reductions Limitations Conclusion

Well, as it turns out...

i := 0 (sk, pk) ← Kgen(1κ) ω ← O(m, i) σ ← Sign(sk, m; ω) i := i + 1 if     Vrfy(pk, m∗, σ∗) ? = 0 ∨ ∃i ∈ {0, . . . , p} :

  • ω∗ ← O(m∗, i)

∧ σ∗ ? = Sign(sk, m∗; ω∗)

  abort Find x ∈ Sol such that Vrfy(z, x) ? = 1.

Choose random function and output public key.

R x z pk m σ m∗, σ∗ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 7

slide-23
SLIDE 23

Preliminaries Meta-Reductions Limitations Conclusion

Well, as it turns out...

i := 0 (sk, pk) ← Kgen(1κ) ω ← O(m, i) σ ← Sign(sk, m; ω) i := i + 1 if     Vrfy(pk, m∗, σ∗) ? = 0 ∨ ∃i ∈ {0, . . . , p} :

  • ω∗ ← O(m∗, i)

∧ σ∗ ? = Sign(sk, m∗; ω∗)

  abort Find x ∈ Sol such that Vrfy(z, x) ? = 1.

Choose random function and output public key. Sign using randomness computed as ω ← O(m, i).

R x z pk m σ m∗, σ∗ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 7

slide-24
SLIDE 24

Preliminaries Meta-Reductions Limitations Conclusion

Well, as it turns out...

i := 0 (sk, pk) ← Kgen(1κ) ω ← O(m, i) σ ← Sign(sk, m; ω) i := i + 1 if     Vrfy(pk, m∗, σ∗) ? = 0 ∨ ∃i ∈ {0, . . . , p} :

  • ω∗ ← O(m∗, i)

∧ σ∗ ? = Sign(sk, m∗; ω∗)

  abort Find x ∈ Sol such that Vrfy(z, x) ? = 1.

Choose random function and output public key. Sign using randomness computed as ω ← O(m, i). Check whether forgery would have been computed by R itself.

R x z pk m σ m∗, σ∗ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 7

slide-25
SLIDE 25

Preliminaries Meta-Reductions Limitations Conclusion

Well, as it turns out...

i := 0 (sk, pk) ← Kgen(1κ) ω ← O(m, i) σ ← Sign(sk, m; ω) i := i + 1 if     Vrfy(pk, m∗, σ∗) ? = 0 ∨ ∃i ∈ {0, . . . , p} :

  • ω∗ ← O(m∗, i)

∧ σ∗ ? = Sign(sk, m∗; ω∗)

  abort Find x ∈ Sol such that Vrfy(z, x) ? = 1.

Choose random function and output public key. Sign using randomness computed as ω ← O(m, i). Check whether forgery would have been computed by R itself. Brute force solution.

R x z pk m σ m∗, σ∗ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 7

slide-26
SLIDE 26

Preliminaries Meta-Reductions Limitations Conclusion

Meta-Meta-Reduction

R M A EUF-CMA Π Π’ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 8

slide-27
SLIDE 27

Preliminaries Meta-Reductions Limitations Conclusion

Meta-Meta-Reduction

N R M A EUF-CMA Π Π’ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 8

slide-28
SLIDE 28

Preliminaries Meta-Reductions Limitations Conclusion

Meta-Meta-Reduction

N R M A EUF-CMA Π Π’ Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 8

slide-29
SLIDE 29

Preliminaries Meta-Reductions Limitations Conclusion

What does it mean?

N M Sign(sk, ·) pk Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 9

slide-30
SLIDE 30

Preliminaries Meta-Reductions Limitations Conclusion

What does it mean?

N z ← Π′.IGen(κ) M Sign(sk, ·) z pk Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 9

slide-31
SLIDE 31

Preliminaries Meta-Reductions Limitations Conclusion

What does it mean?

N z ← Π′.IGen(κ) R M Sign(sk, ·) z pk Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 9

slide-32
SLIDE 32

Preliminaries Meta-Reductions Limitations Conclusion

What does it mean?

N z ← Π′.IGen(κ) R M Sign(sk, ·) z pk pk Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 9

slide-33
SLIDE 33

Preliminaries Meta-Reductions Limitations Conclusion

What does it mean?

N z ← Π′.IGen(κ) R M Sign(sk, ·) z pk m pk Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 9

slide-34
SLIDE 34

Preliminaries Meta-Reductions Limitations Conclusion

What does it mean?

N z ← Π′.IGen(κ) R M Sign(sk, ·) z pk m σ pk Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 9

slide-35
SLIDE 35

Preliminaries Meta-Reductions Limitations Conclusion

What does it mean?

N z ← Π′.IGen(κ) R M Sign(sk, ·) z pk m σ m∗, σ∗ pk Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 9

slide-36
SLIDE 36

Preliminaries Meta-Reductions Limitations Conclusion

What does it mean?

N z ← Π′.IGen(κ) R M Sign(sk, ·) z pk m σ m∗, σ∗ pk N M Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 9

slide-37
SLIDE 37

Preliminaries Meta-Reductions Limitations Conclusion

So, what? This is no impossibility result. We are trying to show that EUF-CMA security cannot be proven. Of course an sEUF-CMA adversary might exist. There is no contradiction whatsoever.

Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 10

slide-38
SLIDE 38

Preliminaries Meta-Reductions Limitations Conclusion

So, what? However, why are we trying to find a meta-reduction? Because we are unable find an adversary.

Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 11

slide-39
SLIDE 39

Preliminaries Meta-Reductions Limitations Conclusion

Conclusion For reasonably randomized signature schemes (without obvious rerandomization) and non-interactive problems the meta-reduction technique is not as useful as one might hope.

Nils Fleischhacker Technische Universit¨ at Darmstadt Limitations of the Meta-Reduction Technique 12