Quantum-secure symmetric-key cryptography based on Hidden Shifts - - PowerPoint PPT Presentation

Quantum-secure symmetric-key cryptography based on Hidden Shifts

arXiv:1610.01187

Gorjan Alagic

QMATH, Department of Mathematical Sciences University of Copenhagen

Alexander Russell

Department of Computer Science & Engineering University of Connecticut

quantum computation + cryptography

Typical post-quantum crypto: Classical crypto in quantum world: Fully-quantum crypto:

classical quantum

adversary cryptosystem

classical quantum

adversary cryptosystem

quantum

adversary cryptosystem

Classical functions on a quantum computer Let 𝑔: 0,1 𝑜 → 0,1 𝑛 be some function. Quantum generalizes classical, so we can implement 𝑔 on our quantum computer. How? 1.

𝑦, 𝑧 ↦ (𝑦, 𝑧 ⊕ 𝑔 𝑦 )

[turn into reversible function] 2.

𝑦 𝑧 ↦ 𝑦 |𝑧 ⊕ 𝑔 𝑦 ⟩

[run circuit on your quantum computer] But wait… now we can plug in non-classical inputs:

෍

𝑦,𝑧

𝛽𝑦𝑧 𝑦 𝑧 ↦ ෍

𝑦,𝑧

𝛽𝑦𝑧 𝑦 |𝑧 ⊕ 𝑔 𝑦 ⟩

E.g., can prepare uniform superposition of values:

quantum access?

(𝑦, 𝑔 𝑦 ) for random 𝑦 ?? ෍

𝑦

𝑦 |𝑔 𝑦 ⟩

Recall CPA:

• classically:

implements the map: 𝑦 ↦ 𝑭𝒐𝒅𝑙 𝑦 ;

• what happens if 𝐵 can run this map quantumly?
• then 𝐵 gets quantum oracle: 𝑦 𝑧 ↦ 𝑦 |𝑧 ⊕ 𝑭𝒐𝒅𝑙 𝑦 ⟩
• … and can run it on non-classical inputs!

Some protocol involving an encryption scheme 𝑭𝒐𝒅, 𝑬𝒇𝒅 …

quantum access?

𝐵

𝑭𝒐𝒅𝑙 𝑭𝒐𝒅𝑙 ?? ෍

𝑦

𝑦 |𝑭𝒐𝒅𝑙 𝑦 ⟩

In some settings, “quantum oracles” make perfect sense:

• public-key encryption: 𝑞𝑙 ↦ encrypt circuit
• hash functions: algorithm
• exposing code: obfuscated circuit

In other settings, this might depend on the model, or the physics:

• private-key encryption (can device act coherently? “frozen smart card” [GHS16])
• authentication and signatures (can user be fooled into signing superposition?)

In any case: the model is of theoretical interest! reversible circuit

quantum access: is it realistic?

Yes: pseudorandomness still exists! [GGM84] construction yields PRFs {𝑔

𝑙} which are “quantum oracle” – secure [Zha12].

Maybe everything is ok, even in this model?

is *anything* secure in this model?

Authentication [BZ13]:

• Uniformly random key 𝑙 for 𝑔

𝑙 ;

• 𝐍𝐁𝐃𝑙 𝑛 = 𝑔

𝑙 𝑛 .

Encryption [BZ13]:

• Uniformly random 𝑙 for 𝑔

𝑙 ;

• 𝐅𝐨𝐝𝑙 𝑛 = 𝑠, 𝑔

𝑙 𝑠 ⊕ 𝑛 .

“Simplest block cipher” [EM97, DKS11]:

• 1. Fix public, random permutation 𝑄: 0,1 𝑜 → 0,1 𝑜;
• 2. Uniformly random key: 𝑙 ∈𝑆 0,1 𝑜;
• 3. Encrypt: 𝐹𝑙 𝑦 = 𝑄 𝑦 ⊕ 𝑙 ⊕ 𝑙 .

Security:

• 𝐹𝑙 is strongly pseudorandom (even if adversary has 𝑄, 𝑄−1, 𝐹𝑙, 𝐹𝑙

−1.)

• ⇒ can’t decrypt;
• ⇒ can’t forge input/output pairs, etc.

𝑄

𝑙 𝑙

𝑦 𝐹𝑙(𝑦)

quantum oracle attacks: an example

simple predecessor to Shor Given:

• racle access to 𝑔;
• Promise ∃𝒍 s.t. 𝑔 𝑦 = 𝑔(𝑧) iff 𝑧 = 𝑦 ⊕ 𝒍;

Output:

• 𝒍

“Simplest block cipher” [EM97, DKS11]: 𝐹𝑙 𝑦 = 𝑄 𝑦 ⊕ 𝑙 ⊕ 𝑙 . Quantum attack [KM12]:

• 1. Form oracle 𝑔 𝑦 = 𝑄 𝑦 ⊕ 𝐹𝑙 𝑦 ;
• 2. Apply Simon’s algorithm on 𝑔 and output result.

Why does it work? 𝑔 𝑦 = 𝑄 𝑦 ⊕ 𝑄 𝑦 ⊕ 𝑙 ⊕ 𝑙 = 𝑔(𝑦 ⊕ 𝑙) This is Simon’s promise ⇒ attack will output 𝑙! Devastating: complete key recovery with only 𝒫(𝑜) queries, space and time! Simple variants also break: 3-round Feistel [KM10], Encrypted-CBC-MAC, LRW tweakable ciphers, many CAESAR candidates, … [KLLN16, SS16].

quantum oracle attacks: an example

𝑄

𝑙 𝑙

𝑦 𝐹𝑙(𝑦)

Hidden Shift Problem (HS). Fix a finite group 𝐻. Given oracles for injective 𝑔, 𝑕: 𝐻 → 𝑇 and a promise that ∃ 𝑡 ∈ 𝐻 such that 𝑔 𝑦 = 𝑕(𝑦 ⋅ 𝑡) for all 𝑦 ∈ 𝐻, output 𝑡. The Simon attack breaks: Even-Mansour, 3-round Feistel, Encrypted-CBC-MAC, LRW tweakable ciphers, many CAESAR candidates, …

• if viewed in a certain way, all the attacks…
• first build a pair of shifted functions: 𝑔 𝑦 = 𝑕(𝑦 ⊕ 𝑙)…
• … and then apply Simon’s algorithm to 𝑔 𝑦 ⊕ 𝑕(𝑦).

𝒈 𝒉

what is really at the core: hidden shift

well-known to quantum algorithms community!

Classically: requires exponentially-many queries [in 𝑜 = log( 𝐻 ) ]. Quantumly: efficiently solvable for 𝐻 = ℤ2

𝑜 (Simon).

For most other groups, appears to be hard. Cyclic groups: (e.g., ℤ2𝑜)

• best quantum algorithm takes 2𝒫

𝑜 time [Kup03].

• nly idea we have (“coset sampling”) : if it works, then UniqueSVP ∈ BQP [Reg02].

Symmetric groups: (i.e., 𝑇𝑜)

• no subexp algorithms known;
• coset sampling unlikely to give even subexp algorithms [MR05, MRS07].

hidden shift problem

Hidden Shift Problem (HS). Fix a finite group 𝐻. Given oracles for injective 𝑔, 𝑕: 𝐻 → 𝑇 and a promise that ∃ 𝑡 ∈ 𝐻 such that 𝑔 𝑦 = 𝑕(𝑦 ⋅ 𝑡) for all 𝑦 ∈ 𝐻, output 𝑡.

The Simon attack breaks: Even-Mansour, 3-round Feistel, Encrypted-CBC-MAC, LRW tweakable ciphers, many CAESAR candidates, … Generic fix:

• select an exponentially-large group (family) 𝐻 (e.g., cyclic ℤ2n, dihedral 𝐸𝑛, symmetric 𝑇𝑜, Lie-type 𝑇𝑀2(𝔾𝑟), … )
• replace input/output spaces with 𝐻 (or a power of 𝐻).
• replace bitwise XOR operation with group operation on 𝐻.

Sanity check [AH17]:

• this does not affect classical security…
• … or classical-access security against quantum adversaries.

hidden shift crypto

The Simon attack breaks: Even-Mansour, 3-round Feistel, Encrypted-CBC-MAC, LRW tweakable ciphers, many CAESAR candidates, … Generic fix:

• select an exponentially-large group (family) 𝐻 (e.g., cyclic ℤ2n, dihedral 𝐸𝑛, symmetric 𝑇𝑜, Lie-type 𝑇𝑀2(𝔾𝑟), …
• replace input/output spaces with 𝐻 (or a power of 𝐻).
• replace bitwise XOR operation with group operation on 𝐻.

Example 1: Even-Mansour.

• 1. Fix public, random permutation 𝑄: 𝐻 → 𝐻;
• 2. Select key: 𝑙 ∈𝑆 𝐻;
• 3. Encrypt: 𝐹𝑙 𝑦 = 𝑄 𝑦 ⋅ 𝑙 ⋅ 𝑙 .

𝑄

𝑙 𝑙

𝑦 𝐹𝑙(𝑦)

⋅ ⋅ hidden shift crypto ⋅

: 𝐻 × 𝐻 → 𝐻

The Simon attack breaks: Even-Mansour, 3-round Feistel, Encrypted-CBC-MAC, LRW tweakable ciphers, many CAESAR candidates, … Generic fix:

• select an exponentially-large group (family) 𝐻 (e.g., cyclic ℤ2n, dihedral 𝐸𝑛, symmetric 𝑇𝑜, Lie-type 𝑇𝑀2(𝔾𝑟), …
• replace input/output spaces with 𝐻 (or a power of 𝐻).
• replace bitwise XOR operation with group operation on 𝐻.

Example 2: Feistel network.

• 1. Choose pseudorandom function 𝑆: 0,1 𝑜 × 𝐻 → 𝐻;
• 2. Choose keys 𝑙𝑘 ∈𝑆 0,1 𝑜, set 𝑆𝑘 ≔ 𝑆𝑙𝑘;
• 3. Build pseudorandom permutation on 𝐻 × 𝐻:

R1 R2 R3

+ + + ⋅ ⋅ ⋅ hidden shift crypto ⋅

: 𝐻 × 𝐻 → 𝐻

The Simon attack breaks: Even-Mansour, 3-round Feistel, Encrypted-CBC-MAC, LRW tweakable ciphers, many CAESAR candidates, … Generic fix:

• select an exponentially-large group (family) 𝐻 (e.g., cyclic ℤ2n, dihedral 𝐸𝑛, symmetric 𝑇𝑜, Lie-type 𝑇𝑀2(𝔾𝑟), …
• replace input/output spaces with 𝐻 (or a power of 𝐻).
• replace bitwise XOR operation with group operation on 𝐻.

Example 3: Encrypted-CBC-MAC.

• 1. Fix keyed, pseudorandom permutation 𝐹: 0,1 𝑜 × 𝐻 → 𝐻;
• 2. Select key pair: 𝑙, 𝑙1 ∈𝑆 0,1 𝑜;
• 3. Decompose message 𝑛 ∈ 𝐻𝑚 into blocks 𝑛𝑘 ∈ 𝐻.

Ek Ek

…

Ek Ek’

+ + ⋅ ⋅ ⋅

1

hidden shift crypto ⋅

: 𝐻 × 𝐻 → 𝐻

Is this “generic fix” a good idea?

• 1. The Hidden Shift Problem (HS) seems to be a good crypto primitive.

Theorem 1. The Hidden Shift Problem is random self-reducible.

main results

Is this “generic fix” a good idea?

• 1. The Hidden Shift Problem (HS) seems to be a good crypto primitive.
• randomized version “RHS” where 𝑔 is random and 𝑕 is a shift;
• QPT = quantum polynomial-time algorithm.

Proof idea: Use the “1/poly-fraction” QPT to explore the entire space of instances, by:

• 1. randomizing shifts by pre-composing 𝑔 (but not 𝑕) with a random shift;
• 2. randomize outputs by post-composing both 𝑔 and 𝑕 with a qPRF;
• 3. repeat with fresh randomness, and a fresh qPRF key poly-many times;
• 4. test any outputs of the QPT by random sampling and checking.

Theorem 1. RHS is random self-reducible. That is, if there exists a QPT which solves RHS for a 1/poly-fraction of inputs, then there exists a QPT which solves RHS and HS for all but a negligible fraction of inputs.

main results

Is this “generic fix” a good idea?

• 1. The Hidden Shift Problem (HS) seems to be a good crypto primitive.

Theorem 2. The decision and search version of HS are equivalent.

main results

Is this “generic fix” a good idea?

• 1. The Hidden Shift Problem (HS) seems to be a good crypto primitive.

Decision version (DRHS). Decide: (i.) 𝑔 is random, 𝑕 is a shift, or (ii.) 𝑔, 𝑕 are random. Proof idea: RHS ⇒ DRHS is obvious (note: can amplify here.) DRHS ⇒ RHS. Descend subgroup tower 𝐻𝑛 ≥ 𝐻𝑛−1 ≥ ⋯ ≥ 𝐻1 recursively.

• 1. for each transversal element 𝛽, call DRHS on 𝑔 and 𝑕 ∘ 𝑀𝛽 restricted to 𝐻𝑛−1;
• 2. exactly one value of 𝛽 (say, 𝛾𝑛) will result in “shift;”
• 3. recursively call algorithm on next level down with restrictions of 𝑔 and 𝑕 ∘ 𝑀𝛾𝑛;
• 4. output product 𝛾𝑛𝛾𝑛−1 ⋯ 𝛾1.

Theorem 2. Suppose 𝐻 has an efficient subgroup series (e.g., ℤ2𝑜 or 𝑇𝑜.) Then there exists a QPT* for DRHS if and only if there exists a QPT* for RHS.

* - with at most 1/poly completeness and soundness error

main results

Is this “generic fix” a good idea?

• 2. It frustrates all known Simon attacks.

By our theorems + previous results, this would yield:

• (worst-case) quantum algorithm for Hidden Shift;
• (worst-case) quantum algorithm for Hidden Subgroup Problem;
• (over ℤ𝑒) possible poly-time quantum attacks on lattice crypto [Regev02];
• (over 𝑇𝑜) simple poly-time quantum algorithms for Graph Isomorphism;
• (over 𝑇𝑜) efficient attacks on “known-code” version of McEliece [DMR10].

The Simon attack on the Hidden Shift variants of all aforementioned schemes requires a subroutine for efficiently solving the RHS problem over the relevant group family.

main results

Is this “generic fix” a good idea?

• 3. In some cases, we can prove security reductions.

Theorem 3 [AR16]. Under the HS assumption, the Hidden Shift Even-Mansour cipher is pseudorandom. HS assumption: there does not exist a polynomial-time quantum algorithm for the Hidden Shift problem which succeeds on all instances. Theorem 4 [AR16]. Under the HS assumption, the Hidden Shift Encrypted-CBC-MAC is collision-free.

main results

In the “quantum oracle” security model…

• previous results: many standard schemes (Even-Mansour, Feistel, CBC-MAC, etc.) are broken;
• we identified an easy generic patch: replace bitwise XOR with modular addition;
• quantum-resistance of resulting schemes is connected to Hidden Shift and Hidden Subgroup Problem;
• … in some cases via rigorous security reductions;
• this crypto view on HS and HSP led to some new results on their algorithmic hardness!

What’s next?

• what else is broken in this model?
• can HS or HSP serve as a basis for other quantum-secure crypto?
• gain confidence in our security notions for encryption, authentication, signatures, etc.

Thanks!

conclusions