On the Complexity of Simulating Auxiliary Input Yi-Hsiu Chen 1 - PowerPoint PPT Presentation

On the Complexity of Simulating Auxiliary Input Yi-Hsiu Chen 1 Kai-Min Chung 2 Jyun-Jie Liao 2 1 Harvard University, Cambridge, USA 2 Academia Sinica, Taipei, Taiwan 1 / 18

Simulating Auxiliary Input [JP14] Consider random variables ( X , Z ) ∈ { 0 , 1 } n × { 0 , 1 } ℓ . Z - short leakage of X Z = g ( X ) for (probabilstic) function g , but g might not be efficient 2 / 18

Simulating Auxiliary Input [JP14] Consider random variables ( X , Z ) ∈ { 0 , 1 } n × { 0 , 1 } ℓ . Z - short leakage of X Z = g ( X ) for (probabilstic) function g , but g might not be efficient Problem ∃ ? efficiently computable simulator h : { 0 , 1 } n → { 0 , 1 } ℓ such that ( X , h ( X )) and ( X , Z ) are indistinguishable? 2 / 18

Simulating Auxiliary Input [JP14] Consider random variables ( X , Z ) ∈ { 0 , 1 } n × { 0 , 1 } ℓ . Z - short leakage of X Z = g ( X ) for (probabilstic) function g , but g might not be efficient Problem ∃ ? efficiently computable simulator h : { 0 , 1 } n → { 0 , 1 } ℓ such that ( X , h ( X )) and ( X , Z ) are indistinguishable? What is the best we can hope for? 2 / 18

Simulating Auxiliary Input [JP14] Consider random variables ( X , Z ) ∈ { 0 , 1 } n × { 0 , 1 } ℓ . Z - short leakage of X Z = g ( X ) for (probabilstic) function g , but g might not be efficient Problem ∃ ? efficiently computable simulator h : { 0 , 1 } n → { 0 , 1 } ℓ such that ( X , h ( X )) and ( X , Z ) are indistinguishable? What is the best we can hope for? ( X , h ( X )) and ( X , Z ) are statistically close 2 / 18

Simulating Auxiliary Input [JP14] Consider random variables ( X , Z ) ∈ { 0 , 1 } n × { 0 , 1 } ℓ . Z - short leakage of X Z = g ( X ) for (probabilstic) function g , but g might not be efficient Problem ∃ ? efficiently computable simulator h : { 0 , 1 } n → { 0 , 1 } ℓ such that ( X , h ( X )) and ( X , Z ) are indistinguishable? What is the best we can hope for? ( X , h ( X )) and ( X , Z ) are statistically close 2 / 18

Simulating Auxiliary Input [JP14] Consider random variables ( X , Z ) ∈ { 0 , 1 } n × { 0 , 1 } ℓ . Z - short leakage of X Z = g ( X ) for (probabilstic) function g , but g might not be efficient Problem ∃ ? efficiently computable simulator h : { 0 , 1 } n → { 0 , 1 } ℓ such that ( X , h ( X )) and ( X , Z ) are indistinguishable? What is the best we can hope for? ( X , h ( X )) and ( X , Z ) are statistically close n c -size simulator against poly(n) distinguishers 2 / 18

Simulating Auxiliary Input [JP14] Consider random variables ( X , Z ) ∈ { 0 , 1 } n × { 0 , 1 } ℓ . Z - short leakage of X Z = g ( X ) for (probabilstic) function g , but g might not be efficient Problem ∃ ? efficiently computable simulator h : { 0 , 1 } n → { 0 , 1 } ℓ such that ( X , h ( X )) and ( X , Z ) are indistinguishable? What is the best we can hope for? ( X , h ( X )) and ( X , Z ) are statistically close n c -size simulator against poly(n) distinguishers ([TTV09]) 2 / 18

Simulating Auxiliary Input [JP14] Consider random variables ( X , Z ) ∈ { 0 , 1 } n × { 0 , 1 } ℓ . Z - short leakage of X Z = g ( X ) for (probabilstic) function g , but g might not be efficient Problem ∃ ? efficiently computable simulator h : { 0 , 1 } n → { 0 , 1 } ℓ such that ( X , h ( X )) and ( X , Z ) are indistinguishable? What is the best we can hope for? ( X , h ( X )) and ( X , Z ) are statistically close n c -size simulator against poly(n) distinguishers ([TTV09]) Ω( s ) simulator which fools every distinguisher of size s 2 / 18

Leakage Simulation Lemma Theorem [JP14] For any random variables ( X , Z ) ∈ { 0 , 1 } n × { 0 , 1 } ℓ , ǫ > 0 and s ∈ N , there exists a (probabilistic) simulator h with complexity s h ( ǫ, s , ℓ ) := s · poly( ǫ − 1 , 2 ℓ ) which is ǫ -indistinguishable by every distinguisher f of size s , i.e. | Pr[ f ( X , Z ) = 1] − Pr[ f ( X , h ( X )) = 1] | < ǫ 3 / 18

Leakage Simulation Lemma Theorem [JP14] For any random variables ( X , Z ) ∈ { 0 , 1 } n × { 0 , 1 } ℓ , ǫ > 0 and s ∈ N , there exists a (probabilistic) simulator h with complexity s h ( ǫ, s , ℓ ) := s · poly( ǫ − 1 , 2 ℓ )=? which is ǫ -indistinguishable by every distinguisher f of size s , i.e. | Pr[ f ( X , Z ) = 1] − Pr[ f ( X , h ( X )) = 1] | < ǫ 3 / 18

Applications Complexity Regularity Lemma [TTV09] Hardcore Lemma [Imp95] Dense Model Theorem [GT04, TZ06, RTTV08] Weak Szemer´ edi Regularity Lemma [FK99] Cryptography Leakage Resilient Cryptography Black-box Separation for SNARGs [GW11] Chain Rule for HILL-Entropy [GW11, Rey11] Zero-Knowledge [CLP15] 4 / 18

Main Results s h =? 5 / 18

Main Results s h =? Upper Bound: O (2 4 ℓ ǫ − 4 · s ) JP14 O ( ℓ · 2 ℓ ǫ − 2 · s + 2 ℓ ǫ − 4 ) VZ13 O (2 5 ℓ ǫ − 2 · s ) Sk´ o16 O ( ℓ · 2 ℓ ǫ − 2 · s ) This work 5 / 18

Main Results s h =? Upper Bound: O (2 4 ℓ ǫ − 4 · s ) JP14 O ( ℓ · 2 ℓ ǫ − 2 · s + 2 ℓ ǫ − 4 ) VZ13 O (2 5 ℓ ǫ − 2 · s ) Sk´ o16 O ( ℓ · 2 ℓ ǫ − 2 · s ) This work Lower Bound: Ω(2 ℓ ǫ − 2 ) queries to distinguishers Black-box simulation Query on the same input 5 / 18

Applications: Leakage-Resilient Stream Cipher [DP08] Stream cipher: ( S i , X i ) := SC ( S i − 1 ) S q − 1 S 0 S 1 S 2 S i X 1 X 2 X i X q − 1 X q Λ 1 Λ 2 Λ i Λ q − 1 6 / 18

Applications: Leakage-Resilient Stream Cipher [DP08] Stream cipher: ( S i , X i ) := SC ( S i − 1 ) S q − 1 S 0 S 1 S 2 S i X 1 X 2 X i X q − 1 X q Λ 1 Λ 2 Λ i Λ q − 1 6 / 18

Applications: Leakage-Resilient Stream Cipher [DP08] Stream cipher: ( S i , X i ) := SC ( S i − 1 ) ( ǫ, s , ℓ, q ) leakage-resilient stream cipher: X q is ( ǫ, s ) pseudorandom given ( X 1 , . . . , X q − 1 , Λ 1 , . . . , Λ q − 1 ) S q − 1 S 0 S 1 S 2 S i X 1 X 2 X i X q − 1 X q Λ 1 Λ 2 Λ i Λ q − 1 6 / 18

Applications: Leakage-Resilient Stream Cipher [DP08] Stream cipher: ( S i , X i ) := SC ( S i − 1 ) ( ǫ, s , ℓ, q ) leakage-resilient stream cipher: X q is ( ǫ, s ) pseudorandom given ( X 1 , . . . , X q − 1 , Λ 1 , . . . , Λ q − 1 ) “Only computation leaks”: Λ i = f i ( S i − 1 ) f i can be adaptively chosen, but | Λ i | ≤ ℓ ≪ | S 0 | S q − 1 S 0 S 1 S 2 S i X 1 X 2 X i X q − 1 X q Λ 1 Λ 2 Λ i Λ q − 1 6 / 18

Applications: Leakage-Resilient Stream Cipher Leakage Resilient Stream Cipher [Pie09, JP14] Given ( ǫ F , s F ) wPRF F , the following stream cipher is ( ǫ, s ) secure in q rounds even when given ℓ bits of leakage per round. � ǫ = 4 q ǫ F 2 ℓ s = max { s : s h ( ǫ ′ , s , ℓ ) < s F } , where ǫ ′ = � ǫ F 2 ℓ Figure: leakage resilient stream cipher [Pie09] 7 / 18

Applications: Leakage-Resilient Stream Cipher Leakage Resilient Stream Cipher [Pie09, JP14] Given ( ǫ F , s F ) wPRF F , the following stream cipher is ( ǫ, s ) secure in q rounds even when given ℓ bits of leakage per round. � ǫ F 2 ℓ ǫ = 4 q s = max { s : s h ( ǫ ′ , s , ℓ ) < s F } , where ǫ ′ = � ǫ F 2 ℓ Consider the setting in [Sk´ o16]: Security of F : s F /ǫ F = 2 256 Target stream cipher: q = 16 , ℓ = 3 , ǫ = 2 − 40 JP14 VZ13 Sk´ o16 this work 2 66 2 76 s 0 0 7 / 18

Applications: Leakage-Resilient Stream Cipher Leakage Resilient Stream Cipher [Pie09, JP14] Given ( ǫ F , s F ) wPRF F , the following stream cipher is ( ǫ, s ) secure in q rounds even when given ℓ bits of leakage per round. � ǫ F 2 ℓ ǫ = 4 q s = max { s : s h ( ǫ ′ , s , ℓ ) < s F } , where ǫ ′ = � ǫ F 2 ℓ Consider the setting in [Sk´ o16]: Security of F : s F /ǫ F = 2 256 Target stream cipher: q = 16 , ℓ = 8 , ǫ = 2 − 40 JP14 VZ13 Sk´ o16 this work 2 36 2 65 s 0 0 7 / 18

Boosting h T =update( h T − 1 , f T ) h i =update( h i − 1 , f i ) h 1 =update( h 0 , f 1 ) h T h 0 h 1 h i Distinguisher Simulator success f i f 1 Pr[ f 1 ( X , h 0 ( X )) = 1] − Pr[ f 1 ( X , Z ) = 1] > ǫ Pr[ f i ( X , h 1 ( X )) = 1] − Pr[ f i ( X , Z ) = 1] > ǫ Output h T 8 / 18

Boosting h T =update( h T − 1 , f T ) h i =update( h i − 1 , f i ) h 1 =update( h 0 , f 1 ) h T h 0 h 1 h i Distinguisher Simulator success f i f 1 Pr[ f 1 ( X , h 0 ( X )) = 1] − Pr[ f 1 ( X , Z ) = 1] > ǫ Pr[ f i ( X , h 1 ( X )) = 1] − Pr[ f i ( X , Z ) = 1] > ǫ Output h T 8 / 18

Boosting h T =update( h T − 1 , f T ) h i =update( h i − 1 , f i ) h 1 =update( h 0 , f 1 ) h T h 0 h 1 h i Distinguisher Simulator success f i f 1 Pr[ f 1 ( X , h 0 ( X )) = 1] − Pr[ f 1 ( X , Z ) = 1] > ǫ Pr[ f i ( X , h 1 ( X )) = 1] − Pr[ f i ( X , Z ) = 1] > ǫ Output h T 8 / 18

Boosting h T =update( h T − 1 , f T ) h i =update( h i − 1 , f i ) h 1 =update( h 0 , f 1 ) h T h 0 h 1 h i Distinguisher Simulator success f i f 1 Pr[ f 1 ( X , h 0 ( X )) = 1] − Pr[ f 1 ( X , Z ) = 1] > ǫ Pr[ f i ( X , h 1 ( X )) = 1] − Pr[ f i ( X , Z ) = 1] > ǫ Output h T 8 / 18

Boosting h T =update( h T − 1 , f T ) h i =update( h i − 1 , f i ) h 1 =update( h 0 , f 1 ) h T h 0 h 1 h i Distinguisher Simulator success f i f 1 Pr[ f 1 ( X , h 0 ( X )) = 1] − Pr[ f 1 ( X , Z ) = 1] > ǫ Pr[ f i ( X , h 1 ( X )) = 1] − Pr[ f i ( X , Z ) = 1] > ǫ Output h T 8 / 18