Public-seed Pseudorandom Permutations Pratik Soni Stefano Tessaro - - PowerPoint PPT Presentation

β–Ά
public seed pseudorandom permutations
SMART_READER_LITE
LIVE PREVIEW

Public-seed Pseudorandom Permutations Pratik Soni Stefano Tessaro - - PowerPoint PPT Presentation

Jul 31, 2023 250 likes β€’2.04k views

Public-seed Pseudorandom Permutations Pratik Soni Stefano Tessaro UC Santa Barbara UC Santa Barbara EUROCRYPT 2017 Cryptographic schemes often built from generic building blocks Cryptographic schemes often built from generic building

slide-1
SLIDE 1

Public-seed Pseudorandom Permutations

Pratik Soni Stefano Tessaro

UC Santa Barbara UC Santa Barbara

EUROCRYPT 2017

slide-2
SLIDE 2

Cryptographic schemes often built from generic building blocks

slide-3
SLIDE 3

Cryptographic schemes often built from generic building blocks

Typically: Block ciphers, hash/compression functions!

𝐼 𝐿 βŠ• π‘—π‘žπ‘π‘’ || 𝑁 𝐿 βŠ• π‘π‘žπ‘π‘’ 𝐼

hash function (e.g., SHA-3)

𝐹𝐿 𝑁1 π½π‘Š 𝑁2 𝐹𝐿 𝑁ℓ

block cipher (e.g., AES)

slide-4
SLIDE 4

Cryptographic schemes often built from generic building blocks

Typically: Block ciphers, hash/compression functions!

Is there a universal and simple building block for efficient symmetric cryptography?

𝐼 𝐿 βŠ• π‘—π‘žπ‘π‘’ || 𝑁 𝐿 βŠ• π‘π‘žπ‘π‘’ 𝐼

hash function (e.g., SHA-3)

𝐹𝐿 𝑁1 π½π‘Š 𝑁2 𝐹𝐿 𝑁ℓ

block cipher (e.g., AES)

slide-5
SLIDE 5

Recent trend: Start from seedless permutation

slide-6
SLIDE 6

Recent trend: Start from seedless permutation

slide-7
SLIDE 7

Recent trend: Start from seedless permutation

Sponge paradigm

slide-8
SLIDE 8

Recent trend: Start from seedless permutation

Sponge paradigm

slide-9
SLIDE 9

Recent trend: Start from seedless permutation

…

Sponge paradigm

slide-10
SLIDE 10

Here: 𝜌 is an efficiently computable and invertible

  • ne-to-one function

Recent trend: Start from seedless permutation

…

Sponge paradigm

slide-11
SLIDE 11

Permutations

β€œβ€¦ it would be nice, now, if permutations can be called the Swiss Army Knife [of cryptography]” β€” Joan Daemen, Passwords^12

Hashing Garbling PRNGs Authenticated Encryption MACs KDFs

slide-12
SLIDE 12

Typical instantiations

slide-13
SLIDE 13

Typical instantiations

Ad-hoc construction e.g., in KECCAK, NORX, … Designed to withstand cryptanalysis

slide-14
SLIDE 14

Typical instantiations

Fixed-key block ciphers Ad-hoc construction e.g., in KECCAK, NORX, … Designed to withstand cryptanalysis e.g., 𝜌 ∢ 𝑦 β†’ AES(0128, 𝑦)

𝐡𝐹𝑇 0128

slide-15
SLIDE 15

Typical instantiations

Fixed-key block ciphers Ad-hoc construction e.g., in KECCAK, NORX, … Designed to withstand cryptanalysis e.g., 𝜌 ∢ 𝑦 β†’ AES(0128, 𝑦) Faster, no re-keying costs!

𝐡𝐹𝑇 0128

Faster Hash functions [RS08], fast garbling [BHKR13]

slide-16
SLIDE 16

Permutations assumptions

Permutations are great in practice, but what about theory?

slide-17
SLIDE 17

Permutations assumptions

Goal: Standard-model reduction: β€œIf 𝜌 satisfies π‘Œ then 𝐷[𝜌] satisfies 𝑍.” Permutations are great in practice, but what about theory?

𝑇0

𝜌 𝜌 𝜌

slide-18
SLIDE 18

Permutations assumptions

Goal: Standard-model reduction: β€œIf 𝜌 satisfies π‘Œ then 𝐷[𝜌] satisfies 𝑍.”

e.g., 𝐷 = KECCAK;

𝑍 = Anything non-trivial π‘Œ = ? ? ? Permutations are great in practice, but what about theory?

𝑇0

𝜌 𝜌 𝜌

slide-19
SLIDE 19

Permutations assumptions

Goal: Standard-model reduction: β€œIf 𝜌 satisfies π‘Œ then 𝐷[𝜌] satisfies 𝑍.”

e.g., 𝐷 = KECCAK;

𝑍 = Anything non-trivial π‘Œ = ? ? ? Common approach: Use random permutation (RP) model 𝜌 is random + adversary given oracle access to 𝜌 and πœŒβˆ’1 Permutations are great in practice, but what about theory? Observation: No standard-model proofs known for permutation- based constructions!

𝑇0

𝜌 𝜌 𝜌

slide-20
SLIDE 20

But: random permutations do not exist [CGH98]

slide-21
SLIDE 21

But: random permutations do not exist [CGH98]

RP model proofs only yield security for generic attacks

slide-22
SLIDE 22

But: random permutations do not exist [CGH98]

RP model proofs only yield security for generic attacks Quite different state of affairs than for hash functions: Hash functions ideal model random oracle

slide-23
SLIDE 23

But: random permutations do not exist [CGH98]

RP model proofs only yield security for generic attacks Quite different state of affairs than for hash functions: Hash functions ideal model standard model random oracle

CRHF, OWFs, UOWHFs, CI, UCEs…

slide-24
SLIDE 24

But: random permutations do not exist [CGH98]

RP model proofs only yield security for generic attacks Quite different state of affairs than for hash functions: Hash functions Permutations ideal model standard model random oracle RP

CRHF, OWFs, UOWHFs, CI, UCEs… ????

slide-25
SLIDE 25

But: random permutations do not exist [CGH98]

RP model proofs only yield security for generic attacks Quite different state of affairs than for hash functions: Hash functions Permutations ideal model standard model random oracle RP

CRHF, OWFs, UOWHFs, CI, UCEs… ????

What cryptographic hardness can we expect from a permutation?

No one-wayness, no compression, no pseudorandomness …

slide-26
SLIDE 26

This work, in a nutshell

First plausible and useful standard-model security assumption for permutations.

slide-27
SLIDE 27

This work, in a nutshell

First plausible and useful standard-model security assumption for permutations.

β€œPublic-seed Pseudorandom Permutations” (psPRPs)

slide-28
SLIDE 28

This work, in a nutshell

First plausible and useful standard-model security assumption for permutations.

β€œPublic-seed Pseudorandom Permutations” (psPRPs)

We address two main questions:

slide-29
SLIDE 29

This work, in a nutshell

First plausible and useful standard-model security assumption for permutations.

β€œPublic-seed Pseudorandom Permutations” (psPRPs)

We address two main questions:

Can we get psPRPs at all?

slide-30
SLIDE 30

This work, in a nutshell

First plausible and useful standard-model security assumption for permutations.

β€œPublic-seed Pseudorandom Permutations” (psPRPs)

We address two main questions:

Can we get psPRPs at all? Are psPRPs useful?

slide-31
SLIDE 31

This work, in a nutshell

inspired by the UCE framework [BHK13] First plausible and useful standard-model security assumption for permutations.

β€œPublic-seed Pseudorandom Permutations” (psPRPs)

We address two main questions:

Can we get psPRPs at all? Are psPRPs useful?

slide-32
SLIDE 32

This work, in a nutshell

inspired by the UCE framework [BHK13] First plausible and useful standard-model security assumption for permutations.

β€œPublic-seed Pseudorandom Permutations” (psPRPs)

We address two main questions:

Can we get psPRPs at all? Are psPRPs useful?

Yes! Yes!

slide-33
SLIDE 33

psPRPs have many applications

slide-34
SLIDE 34

psPRPs have many applications

Deterministic & Hedged PKE Immunizing backdoored PRGs CCA-secure Enc. (CCA) … Hardcore functions (HC) KDM-secure symmetric key Enc. (KDM) Point function Obfuscation (PFOB) Efficient garbling from fixed-key block-ciphers Message-locked Encryption (MLE)

𝒒𝒕𝑸𝑺𝑸

slide-35
SLIDE 35

psPRPs have many applications

Deterministic & Hedged PKE Immunizing backdoored PRGs CCA-secure Enc. (CCA) … Hardcore functions (HC) KDM-secure symmetric key Enc. (KDM) Point function Obfuscation (PFOB) Efficient garbling from fixed-key block-ciphers Message-locked Encryption (MLE)

𝒒𝒕𝑸𝑺𝑸 𝑽𝑫𝑭

slide-36
SLIDE 36

psPRPs have many applications

Deterministic & Hedged PKE Immunizing backdoored PRGs CCA-secure Enc. (CCA) … Hardcore functions (HC) KDM-secure symmetric key Enc. (KDM) Point function Obfuscation (PFOB) Efficient garbling from fixed-key block-ciphers Message-locked Encryption (MLE)

𝒒𝒕𝑸𝑺𝑸 𝑽𝑫𝑭

Sponges

slide-37
SLIDE 37

psPRPs have many applications

Deterministic & Hedged PKE Immunizing backdoored PRGs CCA-secure Enc. (CCA) … Hardcore functions (HC) KDM-secure symmetric key Enc. (KDM) Point function Obfuscation (PFOB) Message-locked Encryption (MLE)

𝒒𝒕𝑸𝑺𝑸 𝑽𝑫𝑭

Efficient garbling from fixed-key block-ciphers Sponges

slide-38
SLIDE 38

psPRPs have many applications

Deterministic & Hedged PKE Immunizing backdoored PRGs CCA-secure Enc. (CCA) … Hardcore functions (HC) KDM-secure symmetric key Enc. (KDM) Point function Obfuscation (PFOB) Message-locked Encryption (MLE)

𝒒𝒕𝑸𝑺𝑸 𝑽𝑫𝑭

Efficient garbling from fixed-key block-ciphers Sponges Feistel

slide-39
SLIDE 39

Roadmap

1.Definitions 2.Constructions & Applications 3.Conclusions

slide-40
SLIDE 40

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

𝜌 ∢ 0,1 π‘œ β†’ 0,1 π‘œ

We consider seeded permutations

slide-41
SLIDE 41

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

π»π‘“π‘œ 𝑦 πœŒπ‘‘ 𝑦 𝜌 ∢ 0,1 π‘œ β†’ 0,1 π‘œ

πœŒπ‘‘

1πœ‡ 𝑑

Seed generation

𝑧 πœŒπ‘‘

βˆ’1 𝑧

πœŒπ‘‘

βˆ’1

Forward evaluation Backward evaluation

Efficient (poly-time) algorithms

(2) βˆ€π‘¦ ∢ πœŒπ‘‘

βˆ’1 πœŒπ‘‘ 𝑦

= 𝑦 (1) πœŒπ‘‘ ∢ 0,1 π‘œ β†’ 0,1 π‘œ

We consider seeded permutations

slide-42
SLIDE 42

Traditional security notion if seed is secret: Pseudorandom Permutation

slide-43
SLIDE 43

𝐸 𝑑 ← Gen(1πœ‡) 𝜌s / πœŒπ‘‘

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1

β‰ˆ

Traditional security notion if seed is secret: Pseudorandom Permutation

0/1

slide-44
SLIDE 44

𝐸 𝑑 ← Gen(1πœ‡) 𝜌s / πœŒπ‘‘

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1

β‰ˆ

Traditional security notion if seed is secret: Pseudorandom Permutation

0/1

slide-45
SLIDE 45

𝐸 𝑑 ← Gen(1πœ‡) 𝜌s / πœŒπ‘‘

βˆ’1 5

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1

β‰ˆ

Stage 1:

  • Oracle access
  • Secret seed

Stage 2:

  • Learns seed
  • No oracle access

Traditional security notion if seed is secret: Pseudorandom Permutation

0/1

slide-46
SLIDE 46

𝐸 𝑑 ← Gen(1πœ‡) 𝜌s / πœŒπ‘‘

βˆ’1 5

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1

β‰ˆ

Stage 1:

  • Oracle access
  • Secret seed

Stage 2:

  • Learns seed
  • No oracle access

Traditional security notion if seed is secret: Pseudorandom Permutation Limited information flow

0/1

slide-47
SLIDE 47

UCE security

𝐼 = (π»π‘“π‘œ, β„Ž)

Bellare Hoang Keelveedhi

slide-48
SLIDE 48

𝑔 ← Funcs(𝑛, π‘œ) 𝑔 𝑑 ← Gen(1πœ‡) β„Žπ‘‘

UCE security

𝑇 source

𝐼 = (π»π‘“π‘œ, β„Ž)

Bellare Hoang Keelveedhi

slide-49
SLIDE 49

𝑔 ← Funcs(𝑛, π‘œ) 𝑔 𝑑 ← Gen(1πœ‡) β„Žπ‘‘

UCE security

𝑇 source

𝐼 = (π»π‘“π‘œ, β„Ž)

Bellare Hoang Keelveedhi

slide-50
SLIDE 50

𝑔 ← Funcs(𝑛, π‘œ) 𝑔 𝑑 ← Gen(1πœ‡) β„Žπ‘‘

UCE security

𝑇 source 𝑀

𝐼 = (π»π‘“π‘œ, β„Ž)

distinguisher 𝐸

Bellare Hoang Keelveedhi

slide-51
SLIDE 51

𝑔 ← Funcs(𝑛, π‘œ) 𝑔 𝑑 ← Gen(1πœ‡) β„Žπ‘‘

UCE security

𝑇 source 𝑀

𝐼 = (π»π‘“π‘œ, β„Ž)

distinguisher 𝐸

Bellare Hoang Keelveedhi

𝒕 𝑑 ← Gen(1πœ‡)

slide-52
SLIDE 52

𝑔 ← Funcs(𝑛, π‘œ) 𝑔 𝑑 ← Gen(1πœ‡) β„Žπ‘‘

UCE security

𝑇 source 𝑀

𝐼 = (π»π‘“π‘œ, β„Ž)

distinguisher 𝐸

Bellare Hoang Keelveedhi

0/1 𝒕

slide-53
SLIDE 53

𝑔 ← Funcs(𝑛, π‘œ) 𝑔 𝑑 ← Gen(1πœ‡) β„Žπ‘‘

UCE security

𝑇 source 𝑀

𝐼 = (π»π‘“π‘œ, β„Ž)

distinguisher 𝐸

Bellare Hoang Keelveedhi

0/1 𝒕

β‰ˆ

slide-54
SLIDE 54

𝑇 𝐸 𝑑 ← Gen(1πœ‡)

psPRP security

𝝆𝒕/𝝆𝒕

βˆ’πŸ

𝝇 ← 𝐐𝐟𝐬𝐧𝐭(𝒐)

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

𝝇/π‡βˆ’πŸ

slide-55
SLIDE 55

𝑇 𝐸 Makes forward and backward queries! 𝑑 ← Gen(1πœ‡)

psPRP security

𝝆𝒕/𝝆𝒕

βˆ’πŸ

𝝇 ← 𝐐𝐟𝐬𝐧𝐭(𝒐)

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

𝝇/π‡βˆ’πŸ

slide-56
SLIDE 56

𝑇 𝑀 𝐸 𝒕 Makes forward and backward queries! 𝑑 ← Gen(1πœ‡)

psPRP security

𝝆𝒕/𝝆𝒕

βˆ’πŸ

𝝇 ← 𝐐𝐟𝐬𝐧𝐭(𝒐)

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

𝝇/π‡βˆ’πŸ

slide-57
SLIDE 57

𝑇 𝑀 𝐸 0/1 𝒕 Makes forward and backward queries! 𝑑 ← Gen(1πœ‡)

psPRP security

𝝆𝒕/𝝆𝒕

βˆ’πŸ

𝝇 ← 𝐐𝐟𝐬𝐧𝐭(𝒐)

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

𝝇/π‡βˆ’πŸ

slide-58
SLIDE 58

𝑄 is π‘žπ‘‘π‘„π‘†π‘„-secure if βˆ€ PPT 𝑇, 𝐸 , left and right are indistinguishable.

𝑇 𝑀 𝐸 0/1 𝒕 Makes forward and backward queries! 𝑑 ← Gen(1πœ‡)

psPRP security

𝝆𝒕/𝝆𝒕

βˆ’πŸ

𝝇 ← 𝐐𝐟𝐬𝐧𝐭(𝒐)

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

𝝇/π‡βˆ’πŸ

slide-59
SLIDE 59

𝑄 is π‘žπ‘‘π‘„π‘†π‘„-secure if βˆ€ PPT 𝑇, 𝐸 , left and right are indistinguishable.

𝑇 𝑀 𝐸 0/1 𝒕 Makes forward and backward queries! 𝑑 ← Gen(1πœ‡)

psPRP security

𝝆𝒕/𝝆𝒕

βˆ’πŸ

𝝇 ← 𝐐𝐟𝐬𝐧𝐭(𝒐)

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

𝝇/π‡βˆ’πŸ

slide-60
SLIDE 60

𝑄 is π‘žπ‘‘π‘„π‘†π‘„-secure if βˆ€ PPT 𝑇, 𝐸 , …

slide-61
SLIDE 61

𝑑 ← Gen(1πœ‡) πœŒπ‘‘/πœŒπ‘‘

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1 𝑇

𝑄 is π‘žπ‘‘π‘„π‘†π‘„-secure if βˆ€ PPT 𝑇, 𝐸 , …

slide-62
SLIDE 62

(+, 0π‘œ) (+, 0π‘œ)

𝑑 ← Gen(1πœ‡) πœŒπ‘‘/πœŒπ‘‘

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1 𝑇

𝑄 is π‘žπ‘‘π‘„π‘†π‘„-secure if βˆ€ PPT 𝑇, 𝐸 , …

slide-63
SLIDE 63

(+, 0π‘œ) (+, 0π‘œ)

𝑑 ← Gen(1πœ‡) πœŒπ‘‘/πœŒπ‘‘

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1 𝑇

𝑄 is π‘žπ‘‘π‘„π‘†π‘„-secure if βˆ€ PPT 𝑇, 𝐸 , …

𝑧 𝑧

slide-64
SLIDE 64

(+, 0π‘œ) (+, 0π‘œ)

𝑑 ← Gen(1πœ‡) πœŒπ‘‘/πœŒπ‘‘

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1 𝑇 𝑀 = 𝑧 𝐸 𝒕

𝑄 is π‘žπ‘‘π‘„π‘†π‘„-secure if βˆ€ PPT 𝑇, 𝐸 , …

𝑧 𝑧

slide-65
SLIDE 65

(+, 0π‘œ) (+, 0π‘œ)

𝑑 ← Gen(1πœ‡) πœŒπ‘‘/πœŒπ‘‘

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1 𝑇 𝑀 = 𝑧 𝐸 𝒕

𝑄 is π‘žπ‘‘π‘„π‘†π‘„-secure if βˆ€ PPT 𝑇, 𝐸 , …

𝑧

Outputs 1 iff 𝑧 = πœŒπ‘‘ 0π‘œ

𝑧

slide-66
SLIDE 66

(+, 0π‘œ) (+, 0π‘œ)

𝑑 ← Gen(1πœ‡) πœŒπ‘‘/πœŒπ‘‘

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1 𝑇 𝑀 = 𝑧 𝐸 𝒕

𝑄 is π‘žπ‘‘π‘„π‘†π‘„-secure if βˆ€ PPT 𝑇, 𝐸 , …

𝑧

Outputs 1 iff 𝑧 = πœŒπ‘‘ 0π‘œ

1

with prob. 1

𝑧

slide-67
SLIDE 67

(+, 0π‘œ) (+, 0π‘œ)

𝑑 ← Gen(1πœ‡) πœŒπ‘‘/πœŒπ‘‘

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1 𝑇 𝑀 = 𝑧 𝐸 𝒕

𝑄 is π‘žπ‘‘π‘„π‘†π‘„-secure if βˆ€ PPT 𝑇, 𝐸 , …

𝑧

Outputs 1 iff 𝑧 = πœŒπ‘‘ 0π‘œ

1 1

with prob. 1 with prob. 1/2π‘œ

𝑧

slide-68
SLIDE 68

(+, 0π‘œ) (+, 0π‘œ)

𝑑 ← Gen(1πœ‡) πœŒπ‘‘/πœŒπ‘‘

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1 𝑇 𝑀 = 𝑧 𝐸 𝒕

𝑄 is π‘žπ‘‘π‘„π‘†π‘„-secure if βˆ€ PPT 𝑇, 𝐸 , …

𝑧

Outputs 1 iff 𝑧 = πœŒπ‘‘ 0π‘œ

1 1

with prob. 1 with prob. 1/2π‘œ

𝑧

π‘žπ‘‘π‘„π‘†π‘„-security is impossible against all sources!

β‰ˆ

slide-69
SLIDE 69

Sources need to be restricted

all sources

𝑄 = (Gen, 𝜌, πœŒβˆ’1)

slide-70
SLIDE 70

Sources need to be restricted

all sources

𝒯

𝑄 = (Gen, 𝜌, πœŒβˆ’1)

slide-71
SLIDE 71

Sources need to be restricted

𝑄 is π‘žπ‘‘π‘„π‘†π‘„[𝒯]-secure if βˆ€ 𝑇 ∈ 𝒯 and βˆ€ PPT 𝐸, left and right are indistinguishable.

all sources

𝒯

𝑄 = (Gen, 𝜌, πœŒβˆ’1)

𝑇

𝑀

𝐸

0/1 𝒕 𝑑 ← Gen(1πœ‡) πœŒπ‘‘/πœŒπ‘‘

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍/πœβˆ’1

slide-72
SLIDE 72

all sources

This talk – unpredictable and reset-secure sources

slide-73
SLIDE 73

all sources

π’―π‘‘π‘£π‘ž

unpredictable

This talk – unpredictable and reset-secure sources

slide-74
SLIDE 74

all sources

𝒯𝑑𝑠𝑑 π’―π‘‘π‘£π‘ž

unpredictable reset-secure

This talk – unpredictable and reset-secure sources

slide-75
SLIDE 75

all sources

𝒯𝑑𝑠𝑑 π’―π‘‘π‘£π‘ž

unpredictable reset-secure

This talk – unpredictable and reset-secure sources

Both restrictions model that 𝐸 cannot predict the queries made by the sources!

slide-76
SLIDE 76

all sources

𝒯𝑑𝑠𝑑 π’―π‘‘π‘£π‘ž

unpredictable reset-secure

This talk – unpredictable and reset-secure sources

Both restrictions model that 𝐸 cannot predict the queries made by the sources!

π’―π‘‘π‘£π‘ž βŠ† 𝒯𝑑𝑠𝑑

slide-77
SLIDE 77

all sources

𝒯𝑑𝑠𝑑 π’―π‘‘π‘£π‘ž

unpredictable reset-secure

This talk – unpredictable and reset-secure sources

Both restrictions model that 𝐸 cannot predict the queries made by the sources!

π’―π‘‘π‘£π‘ž βŠ† 𝒯𝑑𝑠𝑑

π‘žπ‘‘π‘„π‘†π‘„ 𝒯𝑑𝑠𝑑 is a stronger assumption than π‘žπ‘‘π‘„π‘†π‘„ π’―π‘‘π‘£π‘ž

⟹

slide-78
SLIDE 78

Source restrictions – unpredictability

𝑇 𝜍/πœβˆ’1 𝐡

𝜍 ← Perms(π‘œ)

slide-79
SLIDE 79

Source restrictions – unpredictability

𝑇 𝜍/πœβˆ’1 (𝜏, 𝑦𝑗) 𝐡

𝜍 ← Perms(π‘œ)

𝜏 ∈ {+, βˆ’}

slide-80
SLIDE 80

Source restrictions – unpredictability

𝑇 𝜍/πœβˆ’1 (𝜏, 𝑦𝑗) 𝐡 𝑅 ← 𝑅 βˆͺ { 𝜏, 𝑦𝑗 , (𝜏 , 𝑧𝑗)}

𝜍 ← Perms(π‘œ)

𝜏 ∈ {+, βˆ’}

slide-81
SLIDE 81

Source restrictions – unpredictability

𝑇 𝜍/πœβˆ’1 (𝜏, 𝑦𝑗) 𝑧𝑗 𝐡 𝑅 ← 𝑅 βˆͺ { 𝜏, 𝑦𝑗 , (𝜏 , 𝑧𝑗)}

𝜍 ← Perms(π‘œ)

𝜏 ∈ {+, βˆ’}

slide-82
SLIDE 82

Source restrictions – unpredictability

𝑇 𝜍/πœβˆ’1 (𝜏, 𝑦𝑗) 𝑧𝑗 𝐡 𝑀 𝑅 ← 𝑅 βˆͺ { 𝜏, 𝑦𝑗 , (𝜏 , 𝑧𝑗)}

𝜍 ← Perms(π‘œ)

𝜏 ∈ {+, βˆ’}

slide-83
SLIDE 83

Source restrictions – unpredictability

𝑇 𝜍/πœβˆ’1 (𝜏, 𝑦𝑗) 𝑧𝑗 𝐡 𝑀 𝑅′ 𝑅 ← 𝑅 βˆͺ { 𝜏, 𝑦𝑗 , (𝜏 , 𝑧𝑗)} Pr [ 𝑅′ ∩ 𝑅 β‰  𝜚] = negl(πœ‡)

𝜍 ← Perms(π‘œ)

𝜏 ∈ {+, βˆ’} It should be hard for 𝐡 to predict any of 𝑇’s queries or its inverse

slide-84
SLIDE 84

Source restrictions – unpredictability

𝑇 𝜍/πœβˆ’1 (𝜏, 𝑦𝑗) 𝑧𝑗 𝐡 𝑀 𝑅′ 𝑅 ← 𝑅 βˆͺ { 𝜏, 𝑦𝑗 , (𝜏 , 𝑧𝑗)} Pr [ 𝑅′ ∩ 𝑅 β‰  𝜚] = negl(πœ‡)

βŠ† π’―π‘‘π‘£π‘ž: 𝐡 is computationally unbounded π’―π‘‘π‘£π‘ž: 𝐡 is PPT

𝜍 ← Perms(π‘œ)

𝜏 ∈ {+, βˆ’} It should be hard for 𝐡 to predict any of 𝑇’s queries or its inverse

slide-85
SLIDE 85

Source restrictions – unpredictability

𝑇 𝜍/πœβˆ’1 (𝜏, 𝑦𝑗) 𝑧𝑗 𝐡 𝑀 𝑅′ 𝑅 ← 𝑅 βˆͺ { 𝜏, 𝑦𝑗 , (𝜏 , 𝑧𝑗)} Pr [ 𝑅′ ∩ 𝑅 β‰  𝜚] = negl(πœ‡)

βŠ† π’―π‘‘π‘£π‘ž: 𝐡 is computationally unbounded π’―π‘‘π‘£π‘ž: 𝐡 is PPT π‘žπ‘‘π‘„π‘†π‘„[π’―π‘‘π‘£π‘ž] impossible if iO exists [BFM14]

𝜍 ← Perms(π‘œ)

𝜏 ∈ {+, βˆ’} It should be hard for 𝐡 to predict any of 𝑇’s queries or its inverse

slide-86
SLIDE 86

Source restrictions – reset-security

slide-87
SLIDE 87

Source restrictions – reset-security

𝑇 𝜍/πœβˆ’1 𝑆

𝜍 ← Perms(π‘œ)

slide-88
SLIDE 88

Source restrictions – reset-security

𝑇 𝜍/πœβˆ’1 𝑆

𝜍 ← Perms(π‘œ)

slide-89
SLIDE 89

Source restrictions – reset-security

𝑇 𝜍/πœβˆ’1 𝑆

𝑀

𝜍/πœβˆ’1

𝜍 ← Perms(π‘œ)

slide-90
SLIDE 90

Source restrictions – reset-security

𝑇 𝜍/πœβˆ’1 𝑆

𝑀

𝜍/πœβˆ’1

0/1 𝜍 ← Perms(π‘œ)

slide-91
SLIDE 91

Source restrictions – reset-security

𝑇 𝜍/πœβˆ’1 𝑆

𝑀

𝜍/πœβˆ’1

0/1

𝑇 𝜍/πœβˆ’1 𝑆

𝑀 0/1

𝜍1/𝜍1

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍 ← Perms(π‘œ) 𝜍1 ← Perms(π‘œ)

slide-92
SLIDE 92

β‰ˆ

Source restrictions – reset-security

𝑇 𝜍/πœβˆ’1 𝑆

𝑀

𝜍/πœβˆ’1

0/1

𝑇 𝜍/πœβˆ’1 𝑆

𝑀 0/1

𝜍1/𝜍1

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍 ← Perms(π‘œ) 𝜍1 ← Perms(π‘œ)

slide-93
SLIDE 93

β‰ˆ

Source restrictions – reset-security

βŠ† 𝒯𝑑𝑠𝑑: 𝑆 is computationally unbounded 𝒯𝑑𝑠𝑑: 𝑆 is PPT

𝑇 𝜍/πœβˆ’1 𝑆

𝑀

𝜍/πœβˆ’1

0/1

𝑇 𝜍/πœβˆ’1 𝑆

𝑀 0/1

𝜍1/𝜍1

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍 ← Perms(π‘œ) 𝜍1 ← Perms(π‘œ)

slide-94
SLIDE 94

β‰ˆ

Source restrictions – reset-security

βŠ† 𝒯𝑑𝑠𝑑: 𝑆 is computationally unbounded 𝒯𝑑𝑠𝑑: 𝑆 is PPT

𝑇 𝜍/πœβˆ’1 𝑆

𝑀

𝜍/πœβˆ’1

0/1

𝑇 𝜍/πœβˆ’1 𝑆

𝑀 0/1

𝜍1/𝜍1

βˆ’1

𝜍 ← Perms(π‘œ) 𝜍 ← Perms(π‘œ) 𝜍1 ← Perms(π‘œ)

π’―π‘‘π‘£π‘ž βŠ† 𝒯𝑑𝑠𝑑

slide-95
SLIDE 95

π‘žπ‘‘π‘„π‘†π‘„[𝒯𝑑𝑠𝑑] π‘žπ‘‘π‘„π‘†π‘„[π’―π‘‘π‘£π‘ž]

Recap

slide-96
SLIDE 96

π‘žπ‘‘π‘„π‘†π‘„[𝒯𝑑𝑠𝑑] π‘žπ‘‘π‘„π‘†π‘„[π’―π‘‘π‘£π‘ž]

Recap

slide-97
SLIDE 97

Recap

slide-98
SLIDE 98

Recap

Central assumption in UCE theory

slide-99
SLIDE 99

Recap

Central assumption in UCE theory

slide-100
SLIDE 100

Roadmap

1.Definitions 2.Constructions & Applications 3.Conclusions

slide-101
SLIDE 101

Next

Can we get psPRPs at all? Are psPRPs useful?

slide-102
SLIDE 102

Next

Can we get psPRPs at all? Are psPRPs useful?

Constructions from UCEs Heuristic Instantiations

slide-103
SLIDE 103

Next

Can we get psPRPs at all? Are psPRPs useful?

Constructions from UCEs Heuristic Instantiations Constructions of UCEs Direct applications

Garbling from fixed-key block ciphers

slide-104
SLIDE 104

Next

Can we get psPRPs at all? Are psPRPs useful?

Constructions from UCEs Heuristic Instantiations Constructions of UCEs Direct applications

Garbling from fixed-key block ciphers

slide-105
SLIDE 105

Next

Can we get psPRPs at all? Are psPRPs useful?

Constructions from UCEs Heuristic Instantiations Constructions of UCEs Direct applications

Garbling from fixed-key block ciphers

slide-106
SLIDE 106

Next

Can we get psPRPs at all? Are psPRPs useful?

Constructions from UCEs Heuristic Instantiations Constructions of UCEs Direct applications

Garbling from fixed-key block ciphers Common denominator: A new, restricted notion of indifferentiability!

slide-107
SLIDE 107

Next

Can we get psPRPs at all? Are psPRPs useful?

Constructions from UCEs Heuristic Instantiations Constructions of UCEs Direct applications

Garbling from fixed-key block ciphers Common denominator: A new, restricted notion of indifferentiability! CP-sequential indifferentiability

slide-108
SLIDE 108

𝐷 𝑆𝑄

𝜍/πœβˆ’1

𝑆𝑃

𝑔 𝜍 ← Perms(π‘œ) 𝑔 ← Funcs(βˆ—, π‘œ)

Indifferentiability[MRH04]

slide-109
SLIDE 109

𝐡 𝐡 𝐷 𝑆𝑄

𝜍/πœβˆ’1

𝑆𝑃

𝑔 𝜍 ← Perms(π‘œ) 𝑔 ← Funcs(βˆ—, π‘œ)

Indifferentiability[MRH04]

slide-110
SLIDE 110

𝐡 𝐡 𝐷

?

𝑆𝑄

𝜍/πœβˆ’1

𝑆𝑃

𝑔 𝜍 ← Perms(π‘œ) 𝑔 ← Funcs(βˆ—, π‘œ)

Indifferentiability[MRH04]

slide-111
SLIDE 111

𝐡 𝐡 𝐷 𝑇𝑗𝑛 𝑆𝑄

𝜍/πœβˆ’1

𝑆𝑃

𝑔 𝜍 ← Perms(π‘œ) 𝑔 ← Funcs(βˆ—, π‘œ)

Indifferentiability[MRH04]

slide-112
SLIDE 112

𝐡 𝐡

β‰ˆ

𝐷 0/1 𝑇𝑗𝑛 0/1 𝑆𝑄

𝜍/πœβˆ’1

𝑆𝑃

𝑔 𝜍 ← Perms(π‘œ) 𝑔 ← Funcs(βˆ—, π‘œ)

Indifferentiability[MRH04]

slide-113
SLIDE 113

β‰ˆ

𝐡1 𝐷 𝐡2 𝑑𝑒 0/1 𝐡1 𝐡2 𝑑𝑒 𝑇𝑗𝑛 0/1

CP-sequential indifferentiability

𝑆𝑄

𝜍/πœβˆ’1

𝑆𝑃

𝑔 𝜍 ← Perms(π‘œ) 𝑔 ← Funcs(βˆ—, π‘œ)

slide-114
SLIDE 114

β‰ˆ

𝐡1 𝐷 𝐡2 𝑑𝑒 0/1 𝐡1 𝐡2 𝑑𝑒 𝑇𝑗𝑛 0/1

CP-sequential indifferentiability

𝐷 𝑆𝑄 βˆΌπ‘‘π‘žπ‘— 𝑆𝑃 ⇔ βˆƒ PPT 𝑇𝑗𝑛 βˆ€ PPT (𝐡1, 𝐡2): left and right are indistinguishable. 𝑆𝑄

𝜍/πœβˆ’1

𝑆𝑃

𝑔 𝜍 ← Perms(π‘œ) 𝑔 ← Funcs(βˆ—, π‘œ)

slide-115
SLIDE 115

β‰ˆ

Remarks:

𝐡1 𝐷 𝐡2 𝑑𝑒 0/1 𝐡1 𝐡2 𝑑𝑒 𝑇𝑗𝑛 0/1

CP-sequential indifferentiability

𝐷 𝑆𝑄 βˆΌπ‘‘π‘žπ‘— 𝑆𝑃 ⇔ βˆƒ PPT 𝑇𝑗𝑛 βˆ€ PPT (𝐡1, 𝐡2): left and right are indistinguishable. 𝑆𝑄

𝜍/πœβˆ’1

𝑆𝑃

𝑔 𝜍 ← Perms(π‘œ) 𝑔 ← Funcs(βˆ—, π‘œ)

slide-116
SLIDE 116

β‰ˆ

  • 1. Full indifferentiability ⟹ CP-seq indiff.
  • 2. Reverse ordering: seq. indifferentiability [MPS12]

Remarks:

𝐡1 𝐷 𝐡2 𝑑𝑒 0/1 𝐡1 𝐡2 𝑑𝑒 𝑇𝑗𝑛 0/1

CP-sequential indifferentiability

𝐷 𝑆𝑄 βˆΌπ‘‘π‘žπ‘— 𝑆𝑃 ⇔ βˆƒ PPT 𝑇𝑗𝑛 βˆ€ PPT (𝐡1, 𝐡2): left and right are indistinguishable. 𝑆𝑄

𝜍/πœβˆ’1

𝑆𝑃

𝑔 𝜍 ← Perms(π‘œ) 𝑔 ← Funcs(βˆ—, π‘œ)

slide-117
SLIDE 117

From psPRPs to UCEs

Theorem:

slide-118
SLIDE 118

From psPRPs to UCEs

𝐷 𝑆𝑄 ∼cpi 𝑆𝑃

𝐷

Theorem:

𝑆𝑄

𝜍/πœβˆ’1

slide-119
SLIDE 119

From psPRPs to UCEs

𝐷 𝑆𝑄 ∼cpi 𝑆𝑃 + 𝑄 π‘žπ‘‘π‘„π‘†π‘„[𝒯𝑑𝑠𝑑]-secure

𝐷

Theorem:

𝑆𝑄

𝜍/πœβˆ’1

slide-120
SLIDE 120

From psPRPs to UCEs

𝐷 𝑆𝑄 ∼cpi 𝑆𝑃 ⟹ + 𝑄 π‘žπ‘‘π‘„π‘†π‘„[𝒯𝑑𝑠𝑑]-secure 𝐷[𝑄]

𝐷

Theorem:

𝑆𝑄

𝜍/πœβˆ’1 πœŒπ‘‘/πœŒπ‘‘

βˆ’1

slide-121
SLIDE 121

From psPRPs to UCEs

𝐷 𝑆𝑄 ∼cpi 𝑆𝑃 ⟹ + 𝑄 π‘žπ‘‘π‘„π‘†π‘„[𝒯𝑑𝑠𝑑]-secure 𝑉𝐷𝐹[𝒯𝑑𝑠𝑑]-secure. 𝐷[𝑄]

𝐷

Theorem:

𝑆𝑄

𝜍/πœβˆ’1 πœŒπ‘‘/πœŒπ‘‘

βˆ’1

slide-122
SLIDE 122

From psPRPs to UCEs

𝐷 𝑆𝑄 ∼cpi 𝑆𝑃 ⟹ + 𝑄 π‘žπ‘‘π‘„π‘†π‘„[𝒯𝑑𝑠𝑑]-secure 𝑉𝐷𝐹[𝒯𝑑𝑠𝑑]-secure. 𝐷[𝑄]

Similar result proved in [BHK14], but:

  • Need full indifferentiability
  • Only stated for UCE domain extension

𝐷

Theorem:

𝑆𝑄

𝜍/πœβˆ’1 πœŒπ‘‘/πœŒπ‘‘

βˆ’1

slide-123
SLIDE 123

From psPRPs to UCEs

𝐷 𝑆𝑄 ∼cpi 𝑆𝑃 ⟹ + 𝑄 π‘žπ‘‘π‘„π‘†π‘„[𝒯𝑑𝑠𝑑]-secure 𝑉𝐷𝐹[𝒯𝑑𝑠𝑑]-secure. 𝐷[𝑄]

Similar result proved in [BHK14], but:

  • Need full indifferentiability
  • Only stated for UCE domain extension

𝐷

Theorem:

𝑆𝑄

𝜍/πœβˆ’1

Corollary: Every perm-based indiff. hash-function transforms a psPRP into a UCE!

πœŒπ‘‘/πœŒπ‘‘

βˆ’1

slide-124
SLIDE 124

From psPRPs to UCEs – Sponges

𝑧 ∈ {0,1}𝑠 𝑁 ∈ {0,1}βˆ—

𝑇0

𝑠 n βˆ’ 𝑠 𝜍 𝑠 𝜍 𝜍 𝑁1 𝑁2 π‘π‘š

slide-125
SLIDE 125

From psPRPs to UCEs – Sponges

𝑧 ∈ {0,1}𝑠

Theorem [BDVP08]: Sponge[𝑆𝑄] ∼cpi 𝑆𝑃.

𝑁 ∈ {0,1}βˆ—

𝑇0

𝑠 n βˆ’ 𝑠 𝜍 𝑠 𝜍 𝜍 𝑁1 𝑁2 π‘π‘š

slide-126
SLIDE 126

From psPRPs to UCEs – Sponges

𝑧 ∈ {0,1}𝑠

Theorem [BDVP08]: Sponge[𝑆𝑄] ∼cpi 𝑆𝑃.

𝑁 ∈ {0,1}βˆ—

𝑇0

𝑠 n βˆ’ 𝑠 𝜍 𝑠 𝜍 𝜍 𝑁1 𝑁2 π‘π‘š

πœŒπ‘‘ πœŒπ‘‘ πœŒπ‘‘

slide-127
SLIDE 127

From psPRPs to UCEs – Sponges

𝑧 ∈ {0,1}𝑠

Corollary: 𝑄 π‘žπ‘‘π‘„π‘†π‘„ 𝒯𝑑𝑠𝑑 -secure ⟹ Sponge[𝑄] 𝑉𝐷𝐹 𝒯𝑑𝑠𝑑 -secure. Theorem [BDVP08]: Sponge[𝑆𝑄] ∼cpi 𝑆𝑃.

𝑁 ∈ {0,1}βˆ—

𝑇0

𝑠 n βˆ’ 𝑠 𝜍 𝑠 𝜍 𝜍 𝑁1 𝑁2 π‘π‘š

πœŒπ‘‘ πœŒπ‘‘ πœŒπ‘‘

slide-128
SLIDE 128

From psPRPs to UCEs – Sponges

𝑧 ∈ {0,1}𝑠

Corollary: 𝑄 π‘žπ‘‘π‘„π‘†π‘„ 𝒯𝑑𝑠𝑑 -secure ⟹ Sponge[𝑄] 𝑉𝐷𝐹 𝒯𝑑𝑠𝑑 -secure. Theorem [BDVP08]: Sponge[𝑆𝑄] ∼cpi 𝑆𝑃.

𝑁 ∈ {0,1}βˆ—

𝑇0

𝑠 n βˆ’ 𝑠 𝜍 𝑠 𝜍 𝜍 𝑁1 𝑁2 π‘π‘š

πœŒπ‘‘ πœŒπ‘‘ πœŒπ‘‘

Validates the Sponge paradigm for UCE applications!

slide-129
SLIDE 129

CP-sequentially indiff. constructions that are not fully indiff.?

slide-130
SLIDE 130

From psPRPs to UCEs – Chop

CP-sequentially indiff. constructions that are not fully indiff.?

slide-131
SLIDE 131

From psPRPs to UCEs – Chop

𝜍

CP-sequentially indiff. constructions that are not fully indiff.?

slide-132
SLIDE 132

From psPRPs to UCEs – Chop

𝑦 ∈ {0,1}π‘œ

𝜍

CP-sequentially indiff. constructions that are not fully indiff.?

slide-133
SLIDE 133

From psPRPs to UCEs – Chop

𝑦 ∈ {0,1}π‘œ

𝜍

π‘œ π‘œ

CP-sequentially indiff. constructions that are not fully indiff.?

slide-134
SLIDE 134

From psPRPs to UCEs – Chop

𝑦 ∈ {0,1}π‘œ truncates π‘œ-bits to 𝑠-bits

𝜍

π‘œ π‘œ 𝑠

CP-sequentially indiff. constructions that are not fully indiff.?

slide-135
SLIDE 135

From psPRPs to UCEs – Chop

𝑦 ∈ {0,1}π‘œ 𝑧 ∈ {0,1}𝑠 truncates π‘œ-bits to 𝑠-bits

𝜍

π‘œ π‘œ 𝑠

CP-sequentially indiff. constructions that are not fully indiff.?

slide-136
SLIDE 136

From psPRPs to UCEs – Chop

Theorem: Chop[𝑆𝑄] ∼cpi 𝑆𝐺 when π‘œ βˆ’ 𝑠 ∈ πœ•(log πœ‡).

𝑦 ∈ {0,1}π‘œ 𝑧 ∈ {0,1}𝑠 truncates π‘œ-bits to 𝑠-bits

𝜍

π‘œ π‘œ 𝑠

CP-sequentially indiff. constructions that are not fully indiff.?

slide-137
SLIDE 137

From psPRPs to UCEs – Chop

Theorem: Chop[𝑆𝑄] ∼cpi 𝑆𝐺 when π‘œ βˆ’ 𝑠 ∈ πœ•(log πœ‡).

Chop 𝑆𝑄 is not indifferentiable

𝑦 ∈ {0,1}π‘œ 𝑧 ∈ {0,1}𝑠 truncates π‘œ-bits to 𝑠-bits

𝜍

π‘œ π‘œ 𝑠

CP-sequentially indiff. constructions that are not fully indiff.?

slide-138
SLIDE 138

From psPRPs to UCEs – Chop

Theorem: Chop[𝑆𝑄] ∼cpi 𝑆𝐺 when π‘œ βˆ’ 𝑠 ∈ πœ•(log πœ‡).

Chop 𝑆𝑄 is not indifferentiable

𝑦 ∈ {0,1}π‘œ 𝑧 ∈ {0,1}𝑠 truncates π‘œ-bits to 𝑠-bits

𝜍 πœŒπ‘‘

π‘œ π‘œ 𝑠

CP-sequentially indiff. constructions that are not fully indiff.?

slide-139
SLIDE 139

From psPRPs to UCEs – Chop

Theorem: Chop[𝑆𝑄] ∼cpi 𝑆𝐺 when π‘œ βˆ’ 𝑠 ∈ πœ•(log πœ‡). Corollary: 𝑄 π‘žπ‘‘π‘„π‘†π‘„ 𝒯𝑑𝑠𝑑 -secure ⟹ Chop[𝑄] 𝑉𝐷𝐹[𝒯𝑑𝑠𝑑]- secure.

Chop 𝑆𝑄 is not indifferentiable

𝑦 ∈ {0,1}π‘œ 𝑧 ∈ {0,1}𝑠 truncates π‘œ-bits to 𝑠-bits

𝜍 πœŒπ‘‘

π‘œ π‘œ 𝑠

CP-sequentially indiff. constructions that are not fully indiff.?

slide-140
SLIDE 140

From psPRPs to UCEs – Chop

Theorem: Chop[𝑆𝑄] ∼cpi 𝑆𝐺 when π‘œ βˆ’ 𝑠 ∈ πœ•(log πœ‡). Corollary: 𝑄 π‘žπ‘‘π‘„π‘†π‘„ 𝒯𝑑𝑠𝑑 -secure ⟹ Chop[𝑄] 𝑉𝐷𝐹[𝒯𝑑𝑠𝑑]- secure.

Chop 𝑆𝑄 is not indifferentiable

𝑉𝐷𝐹 π’―π‘‘π‘£π‘ž π‘žπ‘‘π‘„π‘†π‘„ π’―π‘‘π‘£π‘ž

𝑦 ∈ {0,1}π‘œ 𝑧 ∈ {0,1}𝑠 truncates π‘œ-bits to 𝑠-bits

𝜍 πœŒπ‘‘

π‘œ π‘œ 𝑠

CP-sequentially indiff. constructions that are not fully indiff.?

slide-141
SLIDE 141

From psPRPs to UCEs – Chop

Theorem: Chop[𝑆𝑄] ∼cpi 𝑆𝐺 when π‘œ βˆ’ 𝑠 ∈ πœ•(log πœ‡). Corollary: 𝑄 π‘žπ‘‘π‘„π‘†π‘„ 𝒯𝑑𝑠𝑑 -secure ⟹ Chop[𝑄] 𝑉𝐷𝐹[𝒯𝑑𝑠𝑑]- secure.

Chop 𝑆𝑄 is not indifferentiable

𝑉𝐷𝐹 π’―π‘‘π‘£π‘ž π‘žπ‘‘π‘„π‘†π‘„ π’―π‘‘π‘£π‘ž

𝑦 ∈ {0,1}π‘œ 𝑧 ∈ {0,1}𝑠 truncates π‘œ-bits to 𝑠-bits

𝜍 πœŒπ‘‘

π‘œ π‘œ 𝑠

From Chop 𝑄 to VIL UCE: Domain extension techniques [BHK14] CP-sequentially indiff. constructions that are not fully indiff.?

slide-142
SLIDE 142

psPRPs from UCEs

Theorem:

slide-143
SLIDE 143

psPRPs from UCEs

β‰ˆ

𝐡1 𝐷 𝐡2 𝑑𝑒 𝑐′ 𝐡1 𝐡2 𝑑𝑒 𝑇𝑗𝑛 𝑐′ 𝑆𝑃 𝑆𝑄

𝐷 𝑆𝑃 ∼cpi 𝑆𝑄 Theorem:

slide-144
SLIDE 144

psPRPs from UCEs

β‰ˆ

𝐡1 𝐷 𝐡2 𝑑𝑒 𝑐′ 𝐡1 𝐡2 𝑑𝑒 𝑇𝑗𝑛 𝑐′ 𝑆𝑃 𝑆𝑄

𝐷 𝑆𝑃 ∼cpi 𝑆𝑄

⟹ +

𝐼 𝑉𝐷𝐹[𝒯𝑑𝑠𝑑]-secure 𝐷 𝐼 π‘žπ‘‘π‘„π‘†π‘„[𝒯𝑑𝑠𝑑]-secure. Theorem:

slide-145
SLIDE 145

psPRPs from UCEs

β‰ˆ

𝐡1 𝐷 𝐡2 𝑑𝑒 𝑐′ 𝐡1 𝐡2 𝑑𝑒 𝑇𝑗𝑛 𝑐′ 𝑆𝑃 𝑆𝑄

Corollary: Every hash-function-based indiff. permutation transforms a UCE into a psPRP. 𝐷 𝑆𝑃 ∼cpi 𝑆𝑄

⟹ +

𝐼 𝑉𝐷𝐹[𝒯𝑑𝑠𝑑]-secure 𝐷 𝐼 π‘žπ‘‘π‘„π‘†π‘„[𝒯𝑑𝑠𝑑]-secure. Theorem:

slide-146
SLIDE 146

From UCEs to psPRPs – Feistel

π‘œ π‘œ 𝑔

1

𝑔

2

𝑔

3

𝑔

4

𝑔

5

π‘Œ1 π‘Œ2 π‘Œ3 π‘Œ4 π‘Œ5 π‘Œ6 π‘Œ0 π‘Œ5

𝑍 ∈ {0,1}2π‘œ

πœ”5[π’ˆ]

π‘Œ ∈ {0,1}2π‘œ

π‘œ π‘œ π‘œ π‘œ

slide-147
SLIDE 147

From UCEs to psPRPs – Feistel

impossible [CPS08] [HKT11] [DS16] [DSKT16] #rounds for indifferentiability

???

π‘œ π‘œ 𝑔

1

𝑔

2

𝑔

3

𝑔

4

𝑔

5

π‘Œ1 π‘Œ2 π‘Œ3 π‘Œ4 π‘Œ5 π‘Œ6 π‘Œ0 π‘Œ5

𝑍 ∈ {0,1}2π‘œ

πœ”5[π’ˆ]

π‘Œ ∈ {0,1}2π‘œ

π‘œ π‘œ π‘œ π‘œ

slide-148
SLIDE 148

From UCEs to psPRPs – Feistel

impossible [CPS08] [HKT11] [DS16] [DSKT16] #rounds for indifferentiability

???

π‘œ π‘œ 𝑔

1

𝑔

2

𝑔

3

𝑔

4

𝑔

5

π‘Œ1 π‘Œ2 π‘Œ3 π‘Œ4 π‘Œ5 π‘Œ6 π‘Œ0 π‘Œ5

𝑍 ∈ {0,1}2π‘œ

πœ”5[π’ˆ]

π‘Œ ∈ {0,1}2π‘œ

π‘œ π‘œ π‘œ π‘œ

psPRPs exist in the standard model if UCEs exist!!!

slide-149
SLIDE 149

Can we reduce the round-complexity of Feistel for UCE to psPRP transformation?

slide-150
SLIDE 150

[HKT11] [DS16] [DSKT16] #rounds for CP-sequential indifferentiability

Can we reduce the round-complexity of Feistel for UCE to psPRP transformation?

slide-151
SLIDE 151

Theorem: 5-round Feistel (πœ”5[π’ˆ]) ∼cpi 𝑆𝑄.

[HKT11] [DS16] [DSKT16] #rounds for CP-sequential indifferentiability This work!!!

Can we reduce the round-complexity of Feistel for UCE to psPRP transformation?

slide-152
SLIDE 152

Corollary: 𝑰 𝑉𝐷𝐹 𝒯𝑑𝑠𝑑 -secure ⟹ πœ”5[𝑰] π‘žπ‘‘π‘„π‘†π‘„[𝒯𝑑𝑠𝑑]- secure. Theorem: 5-round Feistel (πœ”5[π’ˆ]) ∼cpi 𝑆𝑄.

[HKT11] [DS16] [DSKT16] #rounds for CP-sequential indifferentiability This work!!!

Can we reduce the round-complexity of Feistel for UCE to psPRP transformation?

slide-153
SLIDE 153

5-round proof is technically involved

slide-154
SLIDE 154

5-round proof is technically involved

Our 5-round Sim:

  • Relies on chain completion

techniques

  • Heavily exploits query ordering
  • Very different chain-completion

strategy from previous works, no recursion needed

𝑔

1

𝑔

2

𝑔

3

𝑔

4

𝑔

5

π‘Œ1 π‘Œ2 π‘Œ3 π‘Œ4 π‘Œ5 π‘Œ6 π‘Œ0 π‘Œ5 Set uniform Set uniform forceVal forceVal detect detect

slide-155
SLIDE 155

5-round proof is technically involved

Our 5-round Sim:

impossible [LR88] [HKT11] [DS16] [DSKT16] #rounds of Feistel for psPRP-security This work!!!

Open: Do 4-rounds suffice?

  • Relies on chain completion

techniques

  • Heavily exploits query ordering
  • Very different chain-completion

strategy from previous works, no recursion needed

𝑔

1

𝑔

2

𝑔

3

𝑔

4

𝑔

5

π‘Œ1 π‘Œ2 π‘Œ3 π‘Œ4 π‘Œ5 π‘Œ6 π‘Œ0 π‘Œ5 Set uniform Set uniform forceVal forceVal detect detect

???

slide-156
SLIDE 156

Heuristic Instantiations

slide-157
SLIDE 157

Heuristic Instantiations

𝐹 𝑑 ← {0,1}𝑙

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

From Block-ciphers e.g. AES

π»π‘“π‘œ: 𝜌:

slide-158
SLIDE 158

Heuristic Instantiations

𝐹 𝑑 ← {0,1}𝑙

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

psPRP 𝒯𝑑𝑠𝑑 -secure From Block-ciphers e.g. AES Ideal-Cipher model

π»π‘“π‘œ: 𝜌:

slide-159
SLIDE 159

Heuristic Instantiations

𝐹 𝑑 ← {0,1}𝑙

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

psPRP 𝒯𝑑𝑠𝑑 -secure 𝜌 𝑑 ← {0,1}𝑙 From Permutations e.g. the Keccak permutation From Block-ciphers e.g. AES

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

Ideal-Cipher model

π»π‘“π‘œ: 𝜌: 𝜌: π»π‘“π‘œ:

slide-160
SLIDE 160

Heuristic Instantiations

𝐹 𝑑 ← {0,1}𝑙

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

psPRP 𝒯𝑑𝑠𝑑 -secure psPRP π’―π‘‘π‘£π‘ž -secure 𝜌 𝑑 ← {0,1}𝑙 From Permutations e.g. the Keccak permutation From Block-ciphers e.g. AES

𝑄 = (π»π‘“π‘œ, 𝜌, πœŒβˆ’1)

Ideal-Cipher model RP model

π»π‘“π‘œ: 𝜌: 𝜌: π»π‘“π‘œ:

slide-161
SLIDE 161

Fast Garbling from psPRPs

Garbled And

𝐹 0π‘œ, 𝐿10 βŠ• 𝐿10 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿01 βŠ• 𝐿01 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿11 βŠ• 𝐿11 βŠ• 𝑦𝑕

1

𝐹 0π‘œ, 𝐿00 βŠ• 𝐿00 βŠ• 𝑦𝑕 𝑦𝑏

0, 𝑦𝑏 1

𝑦𝑕

0, 𝑦𝑕 1

And

𝑦𝑐

0, 𝑦𝑐 1

slide-162
SLIDE 162

Fast Garbling from psPRPs

Fast garbling from [BHKR13]

Garbled And

𝐹 0π‘œ, 𝐿10 βŠ• 𝐿10 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿01 βŠ• 𝐿01 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿11 βŠ• 𝐿11 βŠ• 𝑦𝑕

1

𝐹 0π‘œ, 𝐿00 βŠ• 𝐿00 βŠ• 𝑦𝑕 𝑦𝑏

0, 𝑦𝑏 1

𝑦𝑕

0, 𝑦𝑕 1

And

𝑦𝑐

0, 𝑦𝑐 1

slide-163
SLIDE 163

Fast Garbling from psPRPs

Fast garbling from [BHKR13]

  • Only calls fixed-key block cipher

𝑦 β†’ 𝐹(0𝑙, 𝑦)

  • Very fast – no key-schedule

Garbled And

𝐹 0π‘œ, 𝐿10 βŠ• 𝐿10 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿01 βŠ• 𝐿01 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿11 βŠ• 𝐿11 βŠ• 𝑦𝑕

1

𝐹 0π‘œ, 𝐿00 βŠ• 𝐿00 βŠ• 𝑦𝑕 𝑦𝑏

0, 𝑦𝑏 1

𝑦𝑕

0, 𝑦𝑕 1

And

𝑦𝑐

0, 𝑦𝑐 1

slide-164
SLIDE 164

Fast Garbling from psPRPs

Fast garbling from [BHKR13]

  • Only calls fixed-key block cipher

𝑦 β†’ 𝐹(0𝑙, 𝑦)

  • Proof in RP model
  • Very fast – no key-schedule

Garbled And

𝐹 0π‘œ, 𝐿10 βŠ• 𝐿10 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿01 βŠ• 𝐿01 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿11 βŠ• 𝐿11 βŠ• 𝑦𝑕

1

𝐹 0π‘œ, 𝐿00 βŠ• 𝐿00 βŠ• 𝑦𝑕 𝑦𝑏

0, 𝑦𝑏 1

𝑦𝑕

0, 𝑦𝑕 1

And

𝑦𝑐

0, 𝑦𝑐 1

slide-165
SLIDE 165

Fast Garbling from psPRPs

This work: Replace 𝐹 0𝑙, 𝑦 by πœŒπ‘‘ for a random seed generated upon garbling.

Fast garbling from [BHKR13]

  • Only calls fixed-key block cipher

𝑦 β†’ 𝐹(0𝑙, 𝑦)

  • Proof in RP model
  • Very fast – no key-schedule

Garbled And

𝐹 0π‘œ, 𝐿10 βŠ• 𝐿10 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿01 βŠ• 𝐿01 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿11 βŠ• 𝐿11 βŠ• 𝑦𝑕

1

𝐹 0π‘œ, 𝐿00 βŠ• 𝐿00 βŠ• 𝑦𝑕 𝑦𝑏

0, 𝑦𝑏 1

𝑦𝑕

0, 𝑦𝑕 1

And

𝑦𝑐

0, 𝑦𝑐 1

slide-166
SLIDE 166

Fast Garbling from psPRPs

This work: Replace 𝐹 0𝑙, 𝑦 by πœŒπ‘‘ for a random seed generated upon garbling.

Fast garbling from [BHKR13]

  • Only calls fixed-key block cipher

𝑦 β†’ 𝐹(0𝑙, 𝑦)

  • Proof in RP model
  • Very fast – no key-schedule

Theorem: Secure garbling when πœŒπ’• is π‘žπ‘‘π‘„π‘†π‘„[π’―π‘‘π‘£π‘ž].

Garbled And

𝐹 0π‘œ, 𝐿10 βŠ• 𝐿10 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿01 βŠ• 𝐿01 βŠ• 𝑦𝑕 𝐹 0π‘œ, 𝐿11 βŠ• 𝐿11 βŠ• 𝑦𝑕

1

𝐹 0π‘œ, 𝐿00 βŠ• 𝐿00 βŠ• 𝑦𝑕 𝑦𝑏

0, 𝑦𝑏 1

𝑦𝑕

0, 𝑦𝑕 1

And

𝑦𝑐

0, 𝑦𝑐 1

slide-167
SLIDE 167

Roadmap

1.Definitions 2.Constructions & Applications 3.Conclusions

slide-168
SLIDE 168

Conclusion

psPRPs

slide-169
SLIDE 169

Conclusion

First standard model assumptions on permutations

psPRPs

slide-170
SLIDE 170

Constructions

Conclusion

First standard model assumptions on permutations

psPRPs

slide-171
SLIDE 171

Constructions

Conclusion

First standard model assumptions on permutations Applications

psPRPs

slide-172
SLIDE 172

Many open questions…

slide-173
SLIDE 173

Many open questions…

  • More applications: psPRP-based PRNGs,

authenticated encryption?

  • More efficient constructions: Round

complexity of Feistel for psPRPs?

psPRPs:

slide-174
SLIDE 174

Many open questions…

  • More applications: psPRP-based PRNGs,

authenticated encryption?

  • More efficient constructions: Round

complexity of Feistel for psPRPs?

psPRPs: Public-seed Pseudorandomness - general paradigm:

slide-175
SLIDE 175

Many open questions…

  • More applications: psPRP-based PRNGs,

authenticated encryption?

  • More efficient constructions: Round

complexity of Feistel for psPRPs?

  • Applications of public-seed Ideal Ciphers?

psPRPs: Public-seed Pseudorandomness - general paradigm:

slide-176
SLIDE 176

Many open questions…

  • Simpler assumptions on permutations?
  • More applications: psPRP-based PRNGs,

authenticated encryption?

  • More efficient constructions: Round

complexity of Feistel for psPRPs?

  • Applications of public-seed Ideal Ciphers?

psPRPs: Public-seed Pseudorandomness - general paradigm: Beyond psPRPs:

slide-177
SLIDE 177

Many open questions…

  • Simpler assumptions on permutations?
  • More applications: psPRP-based PRNGs,

authenticated encryption?

  • More efficient constructions: Round

complexity of Feistel for psPRPs?

  • Applications of public-seed Ideal Ciphers?

psPRPs: Public-seed Pseudorandomness - general paradigm: Beyond psPRPs:

Is SHA-3 a CRHF under any non-trivial assumption?

slide-178
SLIDE 178

Many open questions…

  • Simpler assumptions on permutations?
  • More applications: psPRP-based PRNGs,

authenticated encryption?

  • More efficient constructions: Round

complexity of Feistel for psPRPs?

  • Applications of public-seed Ideal Ciphers?

psPRPs: Public-seed Pseudorandomness - general paradigm: Beyond psPRPs:

Is SHA-3 a CRHF under any non-trivial assumption?

Thank you!