[PPT] - Pairing-Based Cryptography & Generic Groups Lecture 22 1 PowerPoint Presentation

SLIDE 1

Pairing-Based Cryptography & Generic Groups

Lecture 22

1

SLIDE 2

Bilinear Pairing

2

SLIDE 3

Bilinear Pairing

Two (or three) groups with an efficient pairing operation, e: G x G → GT that is “bilinear”

2

SLIDE 4

Bilinear Pairing

Two (or three) groups with an efficient pairing operation, e: G x G → GT that is “bilinear” Typically, prime order (cyclic) groups

2

SLIDE 5

Bilinear Pairing

Two (or three) groups with an efficient pairing operation, e: G x G → GT that is “bilinear” Typically, prime order (cyclic) groups e(ga,gb) = e(g,g)ab

2

SLIDE 6

Bilinear Pairing

Two (or three) groups with an efficient pairing operation, e: G x G → GT that is “bilinear” Typically, prime order (cyclic) groups e(ga,gb) = e(g,g)ab Multiplication (once) in the exponent!

2

SLIDE 7

Bilinear Pairing

Two (or three) groups with an efficient pairing operation, e: G x G → GT that is “bilinear” Typically, prime order (cyclic) groups e(ga,gb) = e(g,g)ab Multiplication (once) in the exponent! e(gaga’,gb) = e(ga,gb) e(ga’,gb) ; e(ga,gbc) = e(gac,gb) ; ...

2

SLIDE 8

Bilinear Pairing

Two (or three) groups with an efficient pairing operation, e: G x G → GT that is “bilinear” Typically, prime order (cyclic) groups e(ga,gb) = e(g,g)ab Multiplication (once) in the exponent! e(gaga’,gb) = e(ga,gb) e(ga’,gb) ; e(ga,gbc) = e(gac,gb) ; ... Not degenerate: e(g,g,) ! 1

2

SLIDE 9

Bilinear Pairing

Two (or three) groups with an efficient pairing operation, e: G x G → GT that is “bilinear” Typically, prime order (cyclic) groups e(ga,gb) = e(g,g)ab Multiplication (once) in the exponent! e(gaga’,gb) = e(ga,gb) e(ga’,gb) ; e(ga,gbc) = e(gac,gb) ; ... Not degenerate: e(g,g,) ! 1 D-BDH Assumption: For random (a,b,c,z), the distributions of (ga,gb,gc,gabc) and (ga,gb,gc,gz) are indistinguishable

2

SLIDE 10

3-Party Key Exchange

3

SLIDE 11

3-Party Key Exchange

A single round 3-party key-exchange protocol secure against passive eavesdroppers (under D-BDH assumption)

3

SLIDE 12

3-Party Key Exchange

A single round 3-party key-exchange protocol secure against passive eavesdroppers (under D-BDH assumption) Generalizes Diffie-Hellman key-exchange

3

SLIDE 13

3-Party Key Exchange

A single round 3-party key-exchange protocol secure against passive eavesdroppers (under D-BDH assumption) Generalizes Diffie-Hellman key-exchange Let e: G x G → GT be bilinear and g a generator of G

3

SLIDE 14

3-Party Key Exchange

A single round 3-party key-exchange protocol secure against passive eavesdroppers (under D-BDH assumption) Generalizes Diffie-Hellman key-exchange Let e: G x G → GT be bilinear and g a generator of G Alice broadcasts ga, Bob broadcasts gb, and Carol broadcasts gc

3

SLIDE 15

3-Party Key Exchange

A single round 3-party key-exchange protocol secure against passive eavesdroppers (under D-BDH assumption) Generalizes Diffie-Hellman key-exchange Let e: G x G → GT be bilinear and g a generator of G Alice broadcasts ga, Bob broadcasts gb, and Carol broadcasts gc Each party computes e(g,g)abc

3

SLIDE 16

3-Party Key Exchange

A single round 3-party key-exchange protocol secure against passive eavesdroppers (under D-BDH assumption) Generalizes Diffie-Hellman key-exchange Let e: G x G → GT be bilinear and g a generator of G Alice broadcasts ga, Bob broadcasts gb, and Carol broadcasts gc Each party computes e(g,g)abc e.g. Alice computes e(g,g)abc = e(gb,gc)a

3

SLIDE 17

3-Party Key Exchange

A single round 3-party key-exchange protocol secure against passive eavesdroppers (under D-BDH assumption) Generalizes Diffie-Hellman key-exchange Let e: G x G → GT be bilinear and g a generator of G Alice broadcasts ga, Bob broadcasts gb, and Carol broadcasts gc Each party computes e(g,g)abc e.g. Alice computes e(g,g)abc = e(gb,gc)a By D-BDH the key e(g,g)abc = e(g,gabc) is pseudorandom given eavesdropper’ s view (ga,gb,gc)

3

SLIDE 18

NIZK Proofs

4

SLIDE 19

NIZK Proofs

Recall: ZK proofs to enforce honest behavior in a basic protocol (without compromising secrecy properties of the basic protocol)

4

SLIDE 20

NIZK Proofs

Recall: ZK proofs to enforce honest behavior in a basic protocol (without compromising secrecy properties of the basic protocol) Non-interactive ZK, using a common random/reference string (CRS)

4

SLIDE 21

NIZK Proofs

Recall: ZK proofs to enforce honest behavior in a basic protocol (without compromising secrecy properties of the basic protocol) Non-interactive ZK, using a common random/reference string (CRS) Can forge proofs or extract knowledge if a trapdoor for the CRS is available (used by the simulator)

4

SLIDE 22

NIZK Proofs

Recall: ZK proofs to enforce honest behavior in a basic protocol (without compromising secrecy properties of the basic protocol) Non-interactive ZK, using a common random/reference string (CRS) Can forge proofs or extract knowledge if a trapdoor for the CRS is available (used by the simulator) NIZK useful in (non-interactive) public-key schemes

4

SLIDE 23

NIZK Proofs

Recall: ZK proofs to enforce honest behavior in a basic protocol (without compromising secrecy properties of the basic protocol) Non-interactive ZK, using a common random/reference string (CRS) Can forge proofs or extract knowledge if a trapdoor for the CRS is available (used by the simulator) NIZK useful in (non-interactive) public-key schemes CRS can be part of the public key: when no security needed against the party generating CRS (e.g. signer of a message, receiver in an encryption scheme)

4

SLIDE 24

NIZK Proofs

Recall: ZK proofs to enforce honest behavior in a basic protocol (without compromising secrecy properties of the basic protocol) Non-interactive ZK, using a common random/reference string (CRS) Can forge proofs or extract knowledge if a trapdoor for the CRS is available (used by the simulator) NIZK useful in (non-interactive) public-key schemes CRS can be part of the public key: when no security needed against the party generating CRS (e.g. signer of a message, receiver in an encryption scheme) Often “witness-indistinguishability” (NIWI or NIWI PoK) sufficient: can’ t distinguish proofs using different witnesses

4

SLIDE 25

NIZK Proofs

Recall: ZK proofs to enforce honest behavior in a basic protocol (without compromising secrecy properties of the basic protocol) Non-interactive ZK, using a common random/reference string (CRS) Can forge proofs or extract knowledge if a trapdoor for the CRS is available (used by the simulator) NIZK useful in (non-interactive) public-key schemes CRS can be part of the public key: when no security needed against the party generating CRS (e.g. signer of a message, receiver in an encryption scheme) Often “witness-indistinguishability” (NIWI or NIWI PoK) sufficient: can’ t distinguish proofs using different witnesses Trivial if only one witness. Very useful when two kinds of witnesses

4

SLIDE 26

NIZK Proofs

5

SLIDE 27

NIZK Proofs

ZK/NIZK proof/proof of knowledge systems exist for all “NP statements” (i.e., “there exists/I know a witness for the relation... ” ) under standard general assumptions

5

SLIDE 28

NIZK Proofs

ZK/NIZK proof/proof of knowledge systems exist for all “NP statements” (i.e., “there exists/I know a witness for the relation... ” ) under standard general assumptions However, involves reduction to an NP-complete relation (e.g. graph 3-coloring) : considered impractical

5

SLIDE 29

NIZK Proofs

ZK/NIZK proof/proof of knowledge systems exist for all “NP statements” (i.e., “there exists/I know a witness for the relation... ” ) under standard general assumptions However, involves reduction to an NP-complete relation (e.g. graph 3-coloring) : considered impractical Special purpose proof for statements that arise in specific schemes, under specific assumptions

5

SLIDE 30

NIZK Proofs

ZK/NIZK proof/proof of knowledge systems exist for all “NP statements” (i.e., “there exists/I know a witness for the relation... ” ) under standard general assumptions However, involves reduction to an NP-complete relation (e.g. graph 3-coloring) : considered impractical Special purpose proof for statements that arise in specific schemes, under specific assumptions Much more efficient: no NP-completeness reductions; exploits similar assumptions as used in the basic scheme

5

SLIDE 31

A NIZK For Statements Involving Pairings

6

SLIDE 32

A NIZK For Statements Involving Pairings

Groth-Sahai proofs (2008)

6

SLIDE 33

A NIZK For Statements Involving Pairings

Groth-Sahai proofs (2008) Very useful in constructions using bilinear pairings

6

SLIDE 34

A NIZK For Statements Involving Pairings

Groth-Sahai proofs (2008) Very useful in constructions using bilinear pairings Can get “perfect” witness-indistinguishability or zero-knowledge

6

SLIDE 35

A NIZK For Statements Involving Pairings

Groth-Sahai proofs (2008) Very useful in constructions using bilinear pairings Can get “perfect” witness-indistinguishability or zero-knowledge Then, soundness will be under certain computational assumptions

6

SLIDE 36

A NIZK For Statements Involving Pairings

7

SLIDE 37

A NIZK For Statements Involving Pairings

an e.g. statement

7

SLIDE 38

A NIZK For Statements Involving Pairings

an e.g. statement I know X,Y,Z ∈ G and integers u,v,w s.t.

7

SLIDE 39

A NIZK For Statements Involving Pairings

an e.g. statement I know X,Y,Z ∈ G and integers u,v,w s.t. e(X,A) ... e(X,Y) = 1 (pairing product)

7

SLIDE 40

A NIZK For Statements Involving Pairings

an e.g. statement I know X,Y,Z ∈ G and integers u,v,w s.t. e(X,A) ... e(X,Y) = 1 (pairing product) Xau ... Zbv = B (product)

7

SLIDE 41

A NIZK For Statements Involving Pairings

an e.g. statement I know X,Y,Z ∈ G and integers u,v,w s.t. e(X,A) ... e(X,Y) = 1 (pairing product) Xau ... Zbv = B (product) a v + ... + b w = c

7

SLIDE 42

A NIZK For Statements Involving Pairings

an e.g. statement I know X,Y,Z ∈ G and integers u,v,w s.t. e(X,A) ... e(X,Y) = 1 (pairing product) Xau ... Zbv = B (product) a v + ... + b w = c (where A,B∈G, integers a,b,c are known to both)

7

SLIDE 43

A NIZK For Statements Involving Pairings

an e.g. statement I know X,Y,Z ∈ G and integers u,v,w s.t. e(X,A) ... e(X,Y) = 1 (pairing product) Xau ... Zbv = B (product) a v + ... + b w = c (where A,B∈G, integers a,b,c are known to both) Useful in proving statements like “these two commitments are to the same value”, or “I have a signature for a message with a certain property”, when appropriate commitment/signature scheme is used

7

SLIDE 44

Applications

8

SLIDE 45

Applications

Fancy signature schemes

8

SLIDE 46

Applications

Fancy signature schemes Short group/ring signatures

8

SLIDE 47

Applications

Fancy signature schemes Short group/ring signatures Short attribute-based signatures

8

SLIDE 48

Applications

Fancy signature schemes Short group/ring signatures Short attribute-based signatures Efficient non-interactive proof of correctness of shuffle

8

SLIDE 49

Applications

Fancy signature schemes Short group/ring signatures Short attribute-based signatures Efficient non-interactive proof of correctness of shuffle Non-interactive anonymous credentials

8

SLIDE 50

Applications

Fancy signature schemes Short group/ring signatures Short attribute-based signatures Efficient non-interactive proof of correctness of shuffle Non-interactive anonymous credentials ...

8

SLIDE 51

Some More Assumptions

9

SLIDE 52

Some More Assumptions

C-BDH Assumption: For random (a,b,c), given (ga,gb,gc) infeasible to compute gabc

9

SLIDE 53

Some More Assumptions

C-BDH Assumption: For random (a,b,c), given (ga,gb,gc) infeasible to compute gabc Strong DH Assumption: For random x, given (g,gx) infeasible to find (y,g1/x+y). (But can check: e(gxgy, g1/x+y) = e(g,g).)

9

SLIDE 54

Some More Assumptions

C-BDH Assumption: For random (a,b,c), given (ga,gb,gc) infeasible to compute gabc Strong DH Assumption: For random x, given (g,gx) infeasible to find (y,g1/x+y). (But can check: e(gxgy, g1/x+y) = e(g,g).) q-SDH: Given (g,gx,...,gx^q), infeasible to find (y,g1/x+y)

9

SLIDE 55

Some More Assumptions

C-BDH Assumption: For random (a,b,c), given (ga,gb,gc) infeasible to compute gabc Strong DH Assumption: For random x, given (g,gx) infeasible to find (y,g1/x+y). (But can check: e(gxgy, g1/x+y) = e(g,g).) q-SDH: Given (g,gx,...,gx^q), infeasible to find (y,g1/x+y) Decision-Linear Assumption: (g,ga,gb,gax,gby, gx+y) and (g,ga,gb,gax,gby, gz) are indistinguishable

9

SLIDE 56

Some More Assumptions

C-BDH Assumption: For random (a,b,c), given (ga,gb,gc) infeasible to compute gabc Strong DH Assumption: For random x, given (g,gx) infeasible to find (y,g1/x+y). (But can check: e(gxgy, g1/x+y) = e(g,g).) q-SDH: Given (g,gx,...,gx^q), infeasible to find (y,g1/x+y) Decision-Linear Assumption: (g,ga,gb,gax,gby, gx+y) and (g,ga,gb,gax,gby, gz) are indistinguishable Variants and other assumptions when e:G1xG2→GT, or when G has composite order

9

SLIDE 57

Some More Assumptions

C-BDH Assumption: For random (a,b,c), given (ga,gb,gc) infeasible to compute gabc Strong DH Assumption: For random x, given (g,gx) infeasible to find (y,g1/x+y). (But can check: e(gxgy, g1/x+y) = e(g,g).) q-SDH: Given (g,gx,...,gx^q), infeasible to find (y,g1/x+y) Decision-Linear Assumption: (g,ga,gb,gax,gby, gx+y) and (g,ga,gb,gax,gby, gz) are indistinguishable Variants and other assumptions when e:G1xG2→GT, or when G has composite order DDH in G1 and/or G2

9

SLIDE 58

Some More Assumptions

C-BDH Assumption: For random (a,b,c), given (ga,gb,gc) infeasible to compute gabc Strong DH Assumption: For random x, given (g,gx) infeasible to find (y,g1/x+y). (But can check: e(gxgy, g1/x+y) = e(g,g).) q-SDH: Given (g,gx,...,gx^q), infeasible to find (y,g1/x+y) Decision-Linear Assumption: (g,ga,gb,gax,gby, gx+y) and (g,ga,gb,gax,gby, gz) are indistinguishable Variants and other assumptions when e:G1xG2→GT, or when G has composite order DDH in G1 and/or G2 Pseudorandomness of random elements from a prime order subgroup.

9

SLIDE 59

Cheap Crypto

10

SLIDE 60

Cheap Crypto

A significant amount of effort/ expertise required to reduce the security to (standard) hardness assumptions

10

SLIDE 61

Cheap Crypto

A significant amount of effort/ expertise required to reduce the security to (standard) hardness assumptions Or even to new “simple” assumptions

10

SLIDE 62

Cheap Crypto

A significant amount of effort/ expertise required to reduce the security to (standard) hardness assumptions Or even to new “simple” assumptions New assumptions may not have been actively attacked

10

SLIDE 63

Cheap Crypto

A significant amount of effort/ expertise required to reduce the security to (standard) hardness assumptions Or even to new “simple” assumptions New assumptions may not have been actively attacked Sometimes the resulting schemes may be quite complicated and relatively inefficient

10

SLIDE 64

Cheap Crypto

A significant amount of effort/ expertise required to reduce the security to (standard) hardness assumptions Or even to new “simple” assumptions New assumptions may not have been actively attacked Sometimes the resulting schemes may be quite complicated and relatively inefficient Quicker/cheaper alternative: Use heuristic idealizations

10

SLIDE 65

Cheap Crypto

A significant amount of effort/ expertise required to reduce the security to (standard) hardness assumptions Or even to new “simple” assumptions New assumptions may not have been actively attacked Sometimes the resulting schemes may be quite complicated and relatively inefficient Quicker/cheaper alternative: Use heuristic idealizations Random Oracle Model

10

SLIDE 66

Cheap Crypto

A significant amount of effort/ expertise required to reduce the security to (standard) hardness assumptions Or even to new “simple” assumptions New assumptions may not have been actively attacked Sometimes the resulting schemes may be quite complicated and relatively inefficient Quicker/cheaper alternative: Use heuristic idealizations Random Oracle Model Generic Group Model

10

SLIDE 67

Cheap Crypto

A significant amount of effort/ expertise required to reduce the security to (standard) hardness assumptions Or even to new “simple” assumptions New assumptions may not have been actively attacked Sometimes the resulting schemes may be quite complicated and relatively inefficient Quicker/cheaper alternative: Use heuristic idealizations Random Oracle Model Generic Group Model Useful in at least “prototyping” new primitives (e.g. IBE)

10

SLIDE 68

Generic Group Model

11

SLIDE 69

Generic Group Model

A group is modeled as an oracle, which uses “handles” to represent group elements

11

SLIDE 70

Generic Group Model

A group is modeled as an oracle, which uses “handles” to represent group elements The oracle maintains an internal table mapping group elements to handles one-to-one. Handles are generated arbitrarily in response to queries (say, randomly, or i for the ith handle generated in the scheme)

11

SLIDE 71

Generic Group Model

A group is modeled as an oracle, which uses “handles” to represent group elements The oracle maintains an internal table mapping group elements to handles one-to-one. Handles are generated arbitrarily in response to queries (say, randomly, or i for the ith handle generated in the scheme) Provides the following operations:

11

SLIDE 72

Generic Group Model

A group is modeled as an oracle, which uses “handles” to represent group elements The oracle maintains an internal table mapping group elements to handles one-to-one. Handles are generated arbitrarily in response to queries (say, randomly, or i for the ith handle generated in the scheme) Provides the following operations: Sample: pick random x and return Handle(x)

11

SLIDE 73

Generic Group Model

A group is modeled as an oracle, which uses “handles” to represent group elements The oracle maintains an internal table mapping group elements to handles one-to-one. Handles are generated arbitrarily in response to queries (say, randomly, or i for the ith handle generated in the scheme) Provides the following operations: Sample: pick random x and return Handle(x) Multiply: On input two handles h1 and h2, return

Handle(Elem(h1).Elem(h2))

11

SLIDE 74

Generic Group Model

A group is modeled as an oracle, which uses “handles” to represent group elements The oracle maintains an internal table mapping group elements to handles one-to-one. Handles are generated arbitrarily in response to queries (say, randomly, or i for the ith handle generated in the scheme) Provides the following operations: Sample: pick random x and return Handle(x) Multiply: On input two handles h1 and h2, return

Handle(Elem(h1).Elem(h2)) Raise: On input a handle h and integer a (can be negative), return Handle(Elem(h)a)

11

SLIDE 75

Generic Group Model

A group is modeled as an oracle, which uses “handles” to represent group elements The oracle maintains an internal table mapping group elements to handles one-to-one. Handles are generated arbitrarily in response to queries (say, randomly, or i for the ith handle generated in the scheme) Provides the following operations: Sample: pick random x and return Handle(x) Multiply: On input two handles h1 and h2, return

Handle(Elem(h1).Elem(h2)) Raise: On input a handle h and integer a (can be negative), return Handle(Elem(h)a) In addition, if modeling a group with bilinear pairing, also provides the pairing operation and operations for the target group

11

SLIDE 76

Generic Group Model

12

SLIDE 77

Generic Group Model

Cryptographic scheme will be defined in the generic group model

12

SLIDE 78

Generic Group Model

Cryptographic scheme will be defined in the generic group model Typically an underlying group of exponentially large order

12

SLIDE 79

Generic Group Model

Cryptographic scheme will be defined in the generic group model Typically an underlying group of exponentially large order Adversary is allowed to know the underlying group structure, and may perform unlimited computations, but is allowed to query the oracle only a polynomial number of times over all

12

SLIDE 80

Generic Group Model

Cryptographic scheme will be defined in the generic group model Typically an underlying group of exponentially large order Adversary is allowed to know the underlying group structure, and may perform unlimited computations, but is allowed to query the oracle only a polynomial number of times over all Can write the discrete log of every handle as a linear polynomial (or a quadratic polynomial, if allowing pairing) in variables corresponding to the sampling operation. An “accidental collision” if two formally different polynomials have same value

12

SLIDE 81

Generic Group Model

Cryptographic scheme will be defined in the generic group model Typically an underlying group of exponentially large order Adversary is allowed to know the underlying group structure, and may perform unlimited computations, but is allowed to query the oracle only a polynomial number of times over all Can write the discrete log of every handle as a linear polynomial (or a quadratic polynomial, if allowing pairing) in variables corresponding to the sampling operation. An “accidental collision” if two formally different polynomials have same value Analysis will rely on the inability of the adversary to cause accidental collisions: by “Schwartz-Zippel Lemma” bounding the number of zeros of a low-degree multi-variate polynomial

12

SLIDE 82

Generic Group Model

Cryptographic scheme will be defined in the generic group model Typically an underlying group of exponentially large order Adversary is allowed to know the underlying group structure, and may perform unlimited computations, but is allowed to query the oracle only a polynomial number of times over all Can write the discrete log of every handle as a linear polynomial (or a quadratic polynomial, if allowing pairing) in variables corresponding to the sampling operation. An “accidental collision” if two formally different polynomials have same value Analysis will rely on the inability of the adversary to cause accidental collisions: by “Schwartz-Zippel Lemma” bounding the number of zeros of a low-degree multi-variate polynomial And an exhaustive analysis to show requisite security properties

12

SLIDE 83

Generic Group Model

13

SLIDE 84

Generic Group Model

What does security in GGM mean?

13

SLIDE 85

Generic Group Model

What does security in GGM mean? Secure against adversaries who do not “look inside” the group

13

SLIDE 86

Generic Group Model

What does security in GGM mean? Secure against adversaries who do not “look inside” the group Risk: There maybe a simple attack against our construction because of some specific (otherwise benign) structure in the group

13

SLIDE 87

Generic Group Model

What does security in GGM mean? Secure against adversaries who do not “look inside” the group Risk: There maybe a simple attack against our construction because of some specific (otherwise benign) structure in the group No “if this scheme is broken, so are many others” guarantee

13

SLIDE 88

Generic Group Model

What does security in GGM mean? Secure against adversaries who do not “look inside” the group Risk: There maybe a simple attack against our construction because of some specific (otherwise benign) structure in the group No “if this scheme is broken, so are many others” guarantee Better practice: when possible identify simple (new) assumptions sufficient for the security of the scheme. Then prove the assumption in the generic group model

13

SLIDE 89

“Knowledge” Assumptions

14

SLIDE 90

“Knowledge” Assumptions

KEA-1: Given (g,ga) for a random generator g and random a, if a PPT adversary extends it to a DDH tuple (g,ga,gb,gab) then it “must know” b

14

SLIDE 91