Multi-Instance Security and its Application to Password- Based - PowerPoint PPT Presentation

PKCS#5 – Password-based cryptography standard Salting as suggested in PKCS#5 prevents attack KDF1: … 𝐿 𝑞𝑥||𝒕𝒃𝒎𝒖 H H H PB-Encrypt ( 𝑞𝑥, 𝑁 ) Randomly chosen per KDF 𝒕𝒃𝒎𝒖  {0,1} 𝑡 evaluation 𝐿  H c ( 𝑞𝑥||𝒕𝒃𝒎𝒖 ) 𝐷  ENC ( 𝐿, 𝑁 ) Return 𝐷||𝒕𝒃𝒎𝒖 Allows decryption Question: Does salting provably ensure multi- instance security amplification?

Iteration and salting in the real world No salting! No iteration!

Our results

Our results Question: Does salting provably ensure multi-instance security amplification?

Our results Question: Does salting provably ensure multi-instance security amplification? Answer: We do not really know!

Our results Question: Does salting provably ensure multi-instance security amplification? Answer: We do not really know! 1) No formal proof!

Our results Question: Does salting provably ensure multi-instance security amplification? Answer: We do not really know! 1) No formal proof! 2) No formal model!

Our results Question: Does salting provably ensure multi-instance security amplification? Answer: We do not really know! 1) No formal proof! 2) No formal model! Our contributions: 1) General definitional framework for multi-instance security of arbitrary cryptographic primitives. 2) Case study: Security analysis of PKCS#5 within our framework.

Outline 1. Multi-instance security 2. Security of PKCS#5 – A case study

Outline 1. Multi-instance security 2. Security of PKCS#5 – A case study

Single-instance security – PB-Encryption LOR-Security 𝑐 ← 0,1 𝑞𝑥 ← 𝑄𝑋𝐸

Single-instance security – PB-Encryption LOR-Security 𝒏 𝟏 , 𝒏 𝟐 |𝒏 𝟏 | = |𝒏 𝟐 | 𝑐 ← 0,1 𝑞𝑥 ← 𝑄𝑋𝐸 𝐅𝐎𝐃(𝒒𝒙, 𝒏 𝒄 )

Single-instance security – PB-Encryption LOR-Security 𝒏 𝟏 , 𝒏 𝟐 |𝒏 𝟏 | = |𝒏 𝟐 | 𝑐 ← 0,1 𝑞𝑥 ← 𝑄𝑋𝐸 𝐅𝐎𝐃(𝒒𝒙, 𝒏 𝒄 ) 𝒄′

Single-instance security – PB-Encryption LOR-Security 𝒏 𝟏 , 𝒏 𝟐 |𝒏 𝟏 | = |𝒏 𝟐 | 𝑐 ← 0,1 𝑞𝑥 ← 𝑄𝑋𝐸 𝐅𝐎𝐃(𝒒𝒙, 𝒏 𝒄 ) 𝐁𝐞𝐰 lor 𝐵 = 2 × [Pr 𝒄 = 𝒄 ′ − 1 2 ] 𝒄′

Single-instance security – PB-Encryption LOR-Security 𝒏 𝟏 , 𝒏 𝟐 |𝒏 𝟏 | = |𝒏 𝟐 | 𝑐 ← 0,1 𝑞𝑥 ← 𝑄𝑋𝐸 𝐅𝐎𝐃(𝒒𝒙, 𝒏 𝒄 ) 𝐁𝐞𝐰 lor 𝐵 = 2 × [Pr 𝒄 = 𝒄 ′ − 1 2 ] 𝒄′

Single-instance security – PB-Encryption LOR-Security 𝒏 𝟏 , 𝒏 𝟐 |𝒏 𝟏 | = |𝒏 𝟐 | 𝑐 ← 0,1 𝑞𝑥 ← 𝑄𝑋𝐸 𝐅𝐎𝐃(𝒒𝒙, 𝒏 𝒄 ) 𝐁𝐞𝐰 lor 𝐵 = 2 × [Pr 𝒄 = 𝒄 ′ − 1 2 ] 𝒄′ PWR-Security 𝑞𝑥 ← 𝑄𝑋𝐸

Single-instance security – PB-Encryption LOR-Security 𝒏 𝟏 , 𝒏 𝟐 |𝒏 𝟏 | = |𝒏 𝟐 | 𝑐 ← 0,1 𝑞𝑥 ← 𝑄𝑋𝐸 𝐅𝐎𝐃(𝒒𝒙, 𝒏 𝒄 ) 𝐁𝐞𝐰 lor 𝐵 = 2 × [Pr 𝒄 = 𝒄 ′ − 1 2 ] 𝒄′ PWR-Security 𝒏 𝑞𝑥 ← 𝑄𝑋𝐸 𝐅𝐎𝐃(𝒒𝒙, 𝒏)

Single-instance security – PB-Encryption LOR-Security 𝒏 𝟏 , 𝒏 𝟐 |𝒏 𝟏 | = |𝒏 𝟐 | 𝑐 ← 0,1 𝑞𝑥 ← 𝑄𝑋𝐸 𝐅𝐎𝐃(𝒒𝒙, 𝒏 𝒄 ) 𝐁𝐞𝐰 lor 𝐵 = 2 × [Pr 𝒄 = 𝒄 ′ − 1 2 ] 𝒄′ PWR-Security 𝒏 𝑞𝑥 ← 𝑄𝑋𝐸 𝐅𝐎𝐃(𝒒𝒙, 𝒏) 𝒒𝒙′

Single-instance security – PB-Encryption LOR-Security 𝒏 𝟏 , 𝒏 𝟐 |𝒏 𝟏 | = |𝒏 𝟐 | 𝑐 ← 0,1 𝑞𝑥 ← 𝑄𝑋𝐸 𝐅𝐎𝐃(𝒒𝒙, 𝒏 𝒄 ) 𝐁𝐞𝐰 lor 𝐵 = 2 × [Pr 𝒄 = 𝒄 ′ − 1 2 ] 𝒄′ PWR-Security 𝒏 𝑞𝑥 ← 𝑄𝑋𝐸 𝐅𝐎𝐃(𝒒𝒙, 𝒏) 𝐁𝐞𝐰 pwr 𝐵 = Pr[𝒒𝒙′ = 𝒒𝒙] 𝒒𝒙′

The multi-instance (mi) security vista Our goal: Define security metric for scheme S wrt property P to measure success of an adversary that:  instances of the scheme concurrently .  Corrupts up to 𝑢 < 𝑛 instances of the scheme (e.g., learns passwords).  Wins if it breaks P for all uncorrupted instances.

The multi-instance (mi) security vista Our goal: Define security metric for scheme S wrt property P to measure success of an adversary that:  Attacks 𝑛 instances of the scheme concurrently .  Corrupts up to 𝑢 < 𝑛 instances of the scheme (e.g., learns passwords).  Wins if it breaks P for all uncorrupted instances.

The multi-instance (mi) security vista < 𝑛𝑛 instances of the scheme (e.g., learns passwords). Our goal: Define security metric for scheme S wrt property P to measure success of an adversary that:  Attacks 𝑛 instances of the scheme concurrently .  Corrupts up to 𝑢 < 𝑛 instances of the scheme (e.g., learns passwords).  Wins if it breaks P for all uncorrupted instances.

The multi-instance (mi) security vista < 𝑛𝑛 instances of the scheme (e.g., learns passwords). Our goal: Define security metric for scheme S wrt property P to measure success of an adversary that:  Attacks 𝑛 instances of the scheme concurrently .  Wins if it breaks P for all uncorrupted instances.  Wins if it breaks P for all uncorrupted instances.

PWR security

PWR security 𝑞𝑥 1 ← 𝑄𝑋𝐸 𝑞𝑥 2 ← 𝑄𝑋𝐸 𝑞𝑥 3 ← 𝑄𝑋𝐸

PWR security 𝑞𝑥 1 ← 𝑄𝑋𝐸 𝑞𝑥 2 ← 𝑄𝑋𝐸 𝑞𝑥 3 ← 𝑄𝑋𝐸

PWR security 𝑞𝑥 1 ← 𝑄𝑋𝐸 𝑞𝑥 2 ← 𝑄𝑋𝐸 𝑞𝑥 3 ← 𝑄𝑋𝐸

PWR security 𝑞𝑥 1 ← 𝑄𝑋𝐸 𝑞𝑥 2 ← 𝑄𝑋𝐸 𝑞𝑥 3 ← 𝑄𝑋𝐸

PWR security ′ , 𝒒𝒙 𝟑 ′ , 𝒒𝒙 𝟒 ′ ) (𝒒𝒙 𝟐 𝑞𝑥 1 ← 𝑄𝑋𝐸 𝑞𝑥 2 ← 𝑄𝑋𝐸 𝑞𝑥 3 ← 𝑄𝑋𝐸

PWR security ′ , 𝒒𝒙 𝟑 ′ , 𝒒𝒙 𝟒 ′ ) (𝒒𝒙 𝟐 𝑞𝑥 1 ← 𝑄𝑋𝐸 𝑞𝑥 2 ← 𝑄𝑋𝐸 𝑞𝑥 3 ← 𝑄𝑋𝐸 𝐁𝐞𝐰 𝐧−𝐪𝐱𝐬 𝐵 = Pr[𝒒𝒙 1 ′ = 𝒒𝒙 𝟐 , … , 𝒒𝒙 𝑛 ′ = 𝒒𝒙 𝒏 ]

LOR security 𝑐 1 ← 0,1 𝑞𝑥 1 ← 𝑄𝑋𝐸 𝑐 2 ← 0,1 𝑞𝑥 2 ← 𝑄𝑋𝐸 𝑐 3 ← 0,1 𝑞𝑥 3 ← 𝑄𝑋𝐸

LOR security 𝑐 1 ← 0,1 𝑞𝑥 1 ← 𝑄𝑋𝐸 𝑐 2 ← 0,1 𝑞𝑥 2 ← 𝑄𝑋𝐸 𝑐 3 ← 0,1 𝑞𝑥 3 ← 𝑄𝑋𝐸

LOR security 𝑐 1 ← 0,1 𝑞𝑥 1 ← 𝑄𝑋𝐸 𝑐 2 ← 0,1 𝑞𝑥 2 ← 𝑄𝑋𝐸 𝑐 3 ← 0,1 𝑞𝑥 3 ← 𝑄𝑋𝐸

LOR security 𝑐 1 ← 0,1 𝑞𝑥 1 ← 𝑄𝑋𝐸 𝑐 2 ← 0,1 𝑞𝑥 2 ← 𝑄𝑋𝐸 𝑐 3 ← 0,1 𝑞𝑥 3 ← 𝑄𝑋𝐸 𝐁𝐞𝐰 𝐧−𝐦𝐩𝐬 𝐵 = ?

Defining mi security for encryption Attempt #1: AND-advantage

Defining mi security for encryption Attempt #1: AND-advantage ′ , … , 𝒄 𝒏 ′ Output: 𝒄 𝟐 LORA-security: Advantage: 𝐁𝐞𝐰 𝐧−𝐦𝐩𝐬𝐛 𝐵 = 𝐐𝐬[ 𝒄 𝟐 , … , 𝒄 𝒏 = 𝒄 𝟐 ′ , … , 𝒄 𝒏 ′ ]

Defining mi security for encryption Attempt #1: AND-advantage ′ , … , 𝒄 𝒏 ′ Output: 𝒄 𝟐 LORA-security: Advantage: 𝐁𝐞𝐰 𝐧−𝐦𝐩𝐬𝐛 𝐵 = 𝐐𝐬[ 𝒄 𝟐 , … , 𝒄 𝒏 = 𝒄 𝟐 ′ , … , 𝒄 𝒏 ′ ] Problem: Does not measure hardness of winning all uncorrupted instances.

Defining mi security for encryption Attempt #1: AND-advantage ′ , … , 𝒄 𝒏 ′ Output: 𝒄 𝟐 LORA-security: Advantage: 𝐁𝐞𝐰 𝐧−𝐦𝐩𝐬𝐛 𝐵 = 𝐐𝐬[ 𝒄 𝟐 , … , 𝒄 𝒏 = 𝒄 𝟐 ′ , … , 𝒄 𝒏 ′ ] Problem: Does not measure hardness of winning all uncorrupted instances. Reason: If ∃ adversary with ′ ] > 3/4 𝐐𝐬[𝒄 𝟐 = 𝒄 𝟐 Then ∃ adversary guessing second bit at random, with ′ , 𝒄 𝟑 ′ × 1 2 𝐐𝐬 𝒄 𝟐 , 𝒄 𝟑 = 𝒄 𝟐 > 3 4 = 3/8

Defining mi security for encryption Attempt #1: AND-advantage ′ , … , 𝒄 𝒏 ′ Output: 𝒄 𝟐 LORA-security: Advantage: 𝐁𝐞𝐰 𝐧−𝐦𝐩𝐬𝐛 𝐵 = 𝐐𝐬[ 𝒄 𝟐 , … , 𝒄 𝒏 = 𝒄 𝟐 ′ , … , 𝒄 𝒏 ′ ] Problem: Does not measure hardness of winning all uncorrupted instances. Reason: If ∃ adversary with ′ ] > 3/4 𝐐𝐬[𝒄 𝟐 = 𝒄 𝟐 Then ∃ adversary guessing second bit at random, with ′ , 𝒄 𝟑 ′ × 1 2 𝐐𝐬 𝒄 𝟐 , 𝒄 𝟑 = 𝒄 𝟐 > 3 4 = 3/8

Defining mi security for encryption Attempt #2: XOR-advantage

Defining mi security for encryption Attempt #2: XOR-advantage Output: 𝒄′ LORX-security: Advantage: 𝐁𝐞𝐰 𝐧−𝐦𝐩𝐬𝒚 𝐵 = 2 × 𝐐𝐬 𝒄 ′ = 𝒄 𝟐 ⊕ ⋯ ⊕ 𝒄 𝒏 − 1/2

Defining mi security for encryption Attempt #2: XOR-advantage Output: 𝒄′ LORX-security: Advantage: 𝐁𝐞𝐰 𝐧−𝐦𝐩𝐬𝒚 𝐵 = 2 × 𝐐𝐬 𝒄 ′ = 𝒄 𝟐 ⊕ ⋯ ⊕ 𝒄 𝒏 − 1/2 Reason: If ∃ adversary with 𝐐𝐬 𝒄 ′ = 𝒄 𝟐 > 1 + 𝜁 2 Then: Adversary guessing second bit has no advantage 𝐐𝐬 𝒄 ′ = 𝒄 𝟐 ⊕ 𝒄 𝟑 = 1 2

Mi security notions – Relations m-LORA m-LORX m-PWR

Mi security notions – Relations (1) m-LORA m-LORX m-PWR

Mi security notions – Relations (1) m-LORA m-LORX m-PWR

Mi security notions – Relations (1) m-LORA m-LORX m-PWR 1) Holds in most cases – proof relies on probabilistic lemma from [U09].

Mi security notions – Relations (1) m-LORA m-LORX (2) m-PWR 1) Holds in most cases – proof relies on probabilistic lemma from [U09].

Mi security notions – Relations (1) m-LORA m-LORX (2) m-PWR 1) Holds in most cases – proof relies on probabilistic lemma from [U09]. 2) Very loose asymptotic implication – based on Goldreich- Levin Theorem [GL89]

Relations – LOR vs ROR LOR-Security 𝒏 𝟏 , 𝒏 𝟐 𝑐 ← 0,1 𝑞𝑥 ← 𝑄𝑋𝐸 ENC (𝒒𝒙, 𝒏 𝒄 ) 𝒄′ ROR-Security 𝒏 𝟏 𝑐 ← 0,1 𝑛 1 ← 𝑁 𝑞𝑥 ← 𝑄𝑋𝐸 ENC (𝒒𝒙, 𝒏 𝒄 ) 𝒄′

Relations – LOR vs ROR

Relations – LOR vs ROR Classical textbook theorem. 𝐁𝐞𝐰ror 𝒖 ≤ 𝐁𝐞𝐰lor 𝒖 ≤ 𝟑 × 𝐁𝐞𝐰ror 𝒖

Relations – LOR vs ROR Hybrid argument Classical textbook theorem. 𝐁𝐞𝐰ror 𝒖 ≤ 𝐁𝐞𝐰lor 𝒖 ≤ 𝟑 × 𝐁𝐞𝐰ror 𝒖

Relations – LOR vs ROR Hybrid argument Classical textbook theorem. 𝐁𝐞𝐰ror 𝒖 ≤ 𝐁𝐞𝐰lor 𝒖 ≤ 𝟑 × 𝐁𝐞𝐰ror 𝒖 ≤ + L R L $ $ R

Relations – LOR vs ROR Hybrid argument Classical textbook theorem. 𝐁𝐞𝐰ror 𝒖 ≤ 𝐁𝐞𝐰lor 𝒖 ≤ 𝟑 × 𝐁𝐞𝐰ror 𝒖 ≤ + L R L $ $ R Mi setting with m instances: 𝐁𝐞𝐰m−rorx 𝒖 ≤ 𝐁𝐞𝐰m−lorx 𝒖 ≤ 𝟑 𝒏 × 𝐁𝐞𝐰m−rorx 𝒖

Relations – LOR vs ROR Hybrid argument Classical textbook theorem. 𝐁𝐞𝐰ror 𝒖 ≤ 𝐁𝐞𝐰lor 𝒖 ≤ 𝟑 × 𝐁𝐞𝐰ror 𝒖 ≤ + L R L $ $ R Mi setting with m instances: 𝐁𝐞𝐰m−rorx 𝒖 ≤ 𝐁𝐞𝐰m−lorx 𝒖 ≤ 𝟑 𝒏 × 𝐁𝐞𝐰m−rorx 𝒖 $ R R $ $ L L R L $ + + ≤ + $ L R $ R L R L $ $

Relations – LOR vs ROR Hybrid argument Classical textbook theorem. 𝐁𝐞𝐰ror 𝒖 ≤ 𝐁𝐞𝐰lor 𝒖 ≤ 𝟑 × 𝐁𝐞𝐰ror 𝒖 ≤ + L R L $ $ R Tight! Mi setting with m instances: 𝐁𝐞𝐰m−rorx 𝒖 ≤ 𝐁𝐞𝐰m−lorx 𝒖 ≤ 𝟑 𝒏 × 𝐁𝐞𝐰m−rorx 𝒖 $ R R $ $ L L R L $ + + ≤ + $ L R $ R L R L $ $

Outline 1. Multi-instance security 2. Security of PKCS#5 – A case study

Outline 1. Multi-instance security 2. Security of PKCS#5 – A case study