More Efficient (Almost) Tightly Secure Structure-Preserving - PowerPoint PPT Presentation

More Efficient (Almost) Tightly Secure Structure-Preserving Signatures Romain Gay 1 Dennis Hofheinz 2 Lisa Kohl 2 Jiaxin Pan 2 1 ENS Paris, France 2 Karlsruhe Institute of Technology, Germany R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 1 / 33

This talk A structure-preserving signature scheme with Tighter security (Significantly) shorter signatures: 25 → 14 elements The core technique can be presented in a simple, algebraic and modular way. R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 2 / 33

Signature $ ( pk,sk ) ← Gen ( par ) $ ← Sign ( sk, m ) σ 0 / 1 ← Ver ( pk, m ,σ ) R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 3 / 33

Structure-Preserving Signatures (SPS) [AFGHO10] Pairing groups G 1 , G 2 , G T cyclic groups of prime order q : e ∶ G 1 × G 2 → G T (Type III) ( pk,sk ) ← Gen ( par ) : pk ∈ G s ( s ∈ { 1 , 2 ,T } ) $ ← Sign ( sk, m ) : m ∈ G s and σ ∈ G s $ σ 0 / 1 ← Ver ( pk, m ,σ ) : Only pairing product equations are allowed. R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 3 / 33

Applications of SPS Composition with: Groth-Sahai NIZK proofs, ElGamal Encryption, ... Efficient modular design for: Group signatures, blind signatures, anonymous credentials, ... R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 4 / 33

Applications of SPS Composition with: Groth-Sahai NIZK proofs, ElGamal Encryption, ... Efficient modular design for: Group signatures, blind signatures, anonymous credentials, ... Goal Construct simple and efficient SPS under standard assumptions. R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 4 / 33

Applications of SPS Composition with: Groth-Sahai NIZK proofs, ElGamal Encryption, ... Efficient modular design for: Group signatures, blind signatures, anonymous credentials, ... Goal Construct simple and efficient SPS under standard assumptions. Standard assumptions (e.g. DDH/SXDH, DLIN, k -LIN): non-interactive and static assumptions R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 4 / 33

Important measures of efficiency for SPS Size of public keys, ∣ pk ∣ Size of signatures, ∣ σ ∣ Number of pairing product equations, # PPEs Tightness of security reductions R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 5 / 33

Important measures of efficiency for SPS Size of public keys, ∣ pk ∣ Size of signatures, ∣ σ ∣ Number of pairing product equations, # PPEs Tightness of security reductions Affects the key length recommendation R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 5 / 33

Tight security [BBM00,Coron00] Adversary Reduction Adversary Reduction Adversary Reduction with success ratio with success ratio ρ ′ ∶ = ε ′ ρ ∶ = ε t ′ = ρ / L t R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 6 / 33

Tight security [BBM00,Coron00] Adversary Reduction Adversary Reduction Adversary Reduction with success ratio with success ratio ρ ′ ∶ = ε ′ ρ ∶ = ε t ′ = ρ / L t This work: t ′ = O ( t ) R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 6 / 33

Tight security [BBM00,Coron00] Adversary Reduction Adversary Reduction Adversary Reduction with success ratio with success ratio ρ ′ ∶ = ε ′ ρ ∶ = ε t ′ = ρ / L t This work: t ′ = O ( t ) Tight security: L = “small” (e.g. L = O ( λ ) , or O ( log Q ) , or O ( 1 ) ) Non-tight security: L = Ω ( Q ) λ : security parameter Q ∶ = poly ( λ ) < 2 λ ⇒ log Q < λ R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 6 / 33

Example: Why tightness? Adversary Reduction Adversary Reduction Adversary Reduction with success ratio with success ratio ρ ′ ∶ = ε ′ ρ ∶ = ε t ′ = ρ / L < 2 − 110 t < 2 − 80 Tight security: L = 1 Non-tight security: for example, L = # signing queries = 2 30 R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 7 / 33

State-of-the-Art: Tightness and Efficiency Schemes Security loss Signature size O ( 1 ) O ( λ ) text [HJ12] O ( λ ) Tight text [AHNOP17] 25 O ( Q log Q ) [JR17] 6 O ( Q 2 ) [KPW15] 7 O ( Q ) [LPY15] 11 Non-tight O ( Q ) [ACDKNO12] 11 ⋮ ⋮ ⋮ R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 8 / 33

State-of-the-Art: Tightness, and Efficiency Schemes Security loss Signature size O ( 1 ) O ( λ ) text [HJ12] O ( λ ) Tight text [AHNOP17] 25 O ( λ ) text [JOR18] 17 O ( log Q ) This work 14 O ( Q log Q ) [JR17] 6 O ( Q 2 ) [KPW15] 7 O ( Q ) Non-tight [LPY15] 11 O ( Q ) [ACDKNO12] 11 ⋮ ⋮ ⋮ R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 9 / 33

This Work Algebraic MAC � → SPS The core component: an efficient tightly secure message authentication code (MAC) R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 10 / 33

This Work Algebraic MAC � → SPS The core component: an efficient tightly secure message authentication code (MAC) The resulting SPS has better performance: shorter signatures shorter public keys less pairing product equations tighter security R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 10 / 33

Our Technique One-time MAC (private-key, information-theoretically secure, SP) Motivated by the adaptive partioning technique ([Hof17], [GHK17]) Many-time MAC (SP) private-key ↦ public-key via pairings SPS R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 11 / 33

Our Technique One-time MAC (private-key, information-theoretically secure, SP) This talk Many-time MAC (SP) private-key ↦ public-key via pairings (Similar to [BKP14,KPW15]) SPS R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 12 / 33

Signature vs. MAC Signature MAC ▷ ( pk , sk ) ← Gen MAC ( par ) ▷ ( pk,sk ) ← Gen ( par ) $ $ ▷ τ ← Tag ( sk, m ) ▷ σ ← Sign ( sk, m ) $ $ ▷ 0 / 1 ← Ver ( pk , sk, m ,τ ) ▷ 0 / 1 ← Ver ( pk, m ,σ ) R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 13 / 33

Security of Signature Challenger Adversary ( pk,sk ) $ pk ← Gen m i ← Sign ( sk, m i ) $ Q queries σ i σ i ( m ∗ ,σ ∗ ) Adversary wins: Ver ( pk, m ∗ ,σ ∗ ) = 1 ∧ m ∗ ∉ { m 1 ,..., m Q } R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 14 / 33

Security of MAC Challenger Adversary ( pk , sk ) $ pk ← Gen MAC m i ← Tag ( sk, m i ) $ Q queries τ i τ i ( m ∗ ,τ ∗ ) Adversary wins: Ver ( sk, m ∗ ,τ ∗ ) = 1 ∧ m ∗ ∉ { m 1 ,..., m Q } R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 15 / 33

For our MAC Challenger Adversary ( pk , sk ) $ pk ← Gen MAC m i ← Tag ( sk, m i ) $ Q queries τ i $ ( m ∗ ,τ ∗ ) Adversary wins: Ver ( sk, m ∗ ,τ ∗ ) = 1 ∧ m ∗ ∉ { m 1 ,..., m Q } R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 15 / 33

Implicit Notation Let a ∈ Z p , [ a ] s ∶ = a P s ∈ G s R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 16 / 33

Implicit Notation Let a ∈ Z p , [ a ] s ∶ = a P s ∈ G s ⎛ ⎞ a 11 ... a 1 m ⎜ ⋱ ⎟ ∈ Z n × m Let A = , p ⎝ ⎠ a n 1 ... a nm a 11 P s a 1 m P s ⎛ ⎞ ... [ A ] s ∶ = ⎜ ⋱ ⎟ ∈ G n × m , s ⎝ ⎠ a n 1 P s a nm P s ... where s ∈ { 1 , 2 ,T } . R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 16 / 33

One-time MAC ▸ Gen MAC ∶ sk ∶ = x 0 $ ← Z 1 + n x 0 p ▸ Tag ( sk, [ m ] 1 ) ∶ τ ∶ = 1 ∣ m [( 1 , m ⊺ ) x 0 ] 1 �ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ�ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ� x 0 2-wise independent hash ▸ Ver ( sk, [ m ] 1 ,σ ) ∶ τ ? = [( 1 , m )] 1 x 0 R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 17 / 33

One-time ↝ Many-time MAC ▸ Gen MAC ∶ sk ∶ = ( x 0 p ) $ $ ← Z 1 + n x 0 ← Z 2 k , x p ▸ Tag ( sk, [ m ] 1 ) ∶ 1 ∣ τ ∶ = m [( 1 , m ⊺ ) x 0 ] 1 + Random �ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ�ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ� x 0 2-wise independent hash ▸ Ver ( sk, [ m ] 1 ,σ ) ∶ τ ? = [( 1 , m )] 1 x 0 R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 18 / 33

The Core Idea (Simplified Version) r A 0 t = t ⊺ x u = where A 0 ∈ Z 2 k × k . p R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 19 / 33

The Core Idea (Simplified Version) r A 0 t = ([ t 0 ] , [ u 0 ]) ,..., ([ t Q − 1 ] , [ u Q − 1 ]) ≈ c t ⊺ x u = ([ t 0 ] , [ $ 0 ]) ,..., ([ t Q − 1 ] , [ $ Q − 1 ]) . where A 0 ∈ Z 2 k × k . p R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 19 / 33

The Core Idea (Simplified Version) Real: {([ t i ] , [ t ⊺ i x ])} 1 ≤ i ≤ Q r A 0 t = ≈ c t ⊺ Rand: {([ t i ] , [ t ⊺ i x i ])} 1 ≤ i ≤ Q x u = $ ← Z 2 k where x i p . where A 0 ∈ Z 2 k × k . p R. Gay, D. Hofheinz, L. Kohl, J. Pan More Efficient Tightly Secure SPS 20 / 33