Robust Password- Protected Secret Sharing Michel Abdalla, Mario - - PowerPoint PPT Presentation

▶
robust password protected secret sharing
SMART_READER_LITE
LIVE PREVIEW

Robust Password- Protected Secret Sharing Michel Abdalla, Mario - - PowerPoint PPT Presentation

Sep 16, 2022 161 likes •924 views

Robust Password- Protected Secret Sharing Michel Abdalla, Mario Cornejo, Anca Ni ulescu, David Pointcheval cole Normale Suprieure, CNRS and INRIA, Paris, France R E S E A R C H U N I V E R S I T Y PPSS: Motivation Cloud provider

slide-1
SLIDE 1

Robust Password- Protected Secret Sharing

Michel Abdalla, Mario Cornejo, Anca Niţulescu, David Pointcheval

École Normale Supérieure, CNRS and INRIA, Paris, France

R E S E A R C H U N I V E R S I T Y

slide-2
SLIDE 2

PPSS: Motivation

Cloud provider

taxes medical records paychecks top secret documents

slide-3
SLIDE 3

Cloud provider

taxes medical records paychecks top secret documents

PPSS: Motivation

slide-4
SLIDE 4

Cloud provider

taxes medical records paychecks top secret documents

Everyone might have access to the data

PPSS: Motivation

slide-5
SLIDE 5

Cloud provider

taxes medical records paychecks top secret documents

PPSS: Motivation

slide-6
SLIDE 6

Cloud provider

taxes medical records paychecks top secret documents

Provider still has access to the data

PPSS: Motivation

slide-7
SLIDE 7

Cloud provider

taxes medical records paychecks top secret documents

PPSS: Motivation

slide-8
SLIDE 8

Cloud provider

taxes medical records paychecks top secret documents

PPSS: Motivation

slide-9
SLIDE 9

Cloud provider

taxes medical records paychecks top secret documents

  • We can remember just low-entropy passwords

(and not too many).

  • Humans cannot remember large secret keys.
  • Provider/authorities might perform an offline

dictionary attack.

PPSS: Motivation

slide-10
SLIDE 10

Cloud provider

taxes medical records paychecks top secret documents

  • USB Tokens might not be always available.
  • Tokens might fall into the wrong hands.
  • Large keys give better security.

PPSS: Motivation

slide-11
SLIDE 11

PPSS: Password-Protected Secret Sharing

Cloud provider

taxes

slide-12
SLIDE 12

PPSS: Password-Protected Secret Sharing

Cloud provider

taxes

  • User creates a cryptographic key.
slide-13
SLIDE 13

PPSS: Password-Protected Secret Sharing

Cloud provider

  • User creates a cryptographic key.

taxes

  • Encrypts her data using this key.
slide-14
SLIDE 14

PPSS: Password-Protected Secret Sharing

Cloud provider

…

Keys store

  • User creates a cryptographic key.
  • Encrypts her data using this key.
  • Stores her secret key into servers

by using her password and some public information.

n

taxes

slide-15
SLIDE 15

Cloud provider

PPSS: Password-Protected Secret Sharing

  • User creates a cryptographic key.

taxes

  • Encrypts her data using this key.
  • Stores her secret key into servers

by using her password and some public information.

n

…

Keys store

  • Stores the data into the provider.
slide-16
SLIDE 16

Cloud provider

PPSS: Password-Protected Secret Sharing

…

Keys store

  • After interactions using her

password, the user can recover her secret key

t + 1

taxes

slide-17
SLIDE 17

Cloud provider

PPSS: Password-Protected Secret Sharing

…

Keys store

  • After interactions using her

password, the user can recover her secret key

t + 1

taxes

slide-18
SLIDE 18

Reconstruction: The user can recover the secret by interacting with a subset of servers.

  • A PPSS scheme defines two steps:

PPSS: Properties

  • Additional properties:

Initialization: Secret & password are processed t + 1

Robustness: The recovery is guaranteed if there are s non-corrupt servers.

t + 1

Soundness: Even if the adversary cannot make the user recover a different secret.

slide-19
SLIDE 19

PPSS: Instantiations of PPSS

Scheme Messages Client inter-server Robust ZKP BJSL11 4 PKI PKI No Costly CLLN14 10 Std PKI No Costly JKK14 2 CRS None Yes Costly JKKX16 2 CRS None No No

slide-20
SLIDE 20

PPSS: Instantiations of PPSS

Scheme Messages Client inter-server Robust ZKP BJSL11 4 PKI PKI No Costly CLLN14 10 Std PKI No Costly JKK14 2 CRS None Yes Costly JKKX16 2 CRS None No No This work 2 CRS None Yes No

slide-21
SLIDE 21

Robust Password-Protected Secret Sharing

Robust Gap Secret Sharing OPRF PPSS Secret Sharing Scheme

slide-22
SLIDE 22

Robust Password-Protected Secret Sharing

Robust Gap Secret Sharing OPRF PPSS Secret Sharing Scheme

slide-23
SLIDE 23

Robust Password-Protected Secret Sharing

Robust Gap Secret Sharing OPRF PPSS Secret Sharing Scheme

slide-24
SLIDE 24

Robust Password-Protected Secret Sharing

Robust Gap Secret Sharing OPRF PPSS Secret Sharing Scheme

slide-25
SLIDE 25

PPSS: Secret Sharing Scheme

Secret

s1 s2 s3

…

sn

slide-26
SLIDE 26

PPSS: Secret Sharing Scheme

s1 s2 s3

…

sn

Secret

slide-27
SLIDE 27

How do we implement robustness?

PPSS: Robust Gap Secret Sharing Scheme

slide-28
SLIDE 28

PPSS: Robust Gap Secret Sharing Scheme

Assume a set of valid shares from a Threshold SSS s1 s2 s3 … sn (s1, . . . , sn)

slide-29
SLIDE 29

PPSS: Robust Gap Secret Sharing Scheme

s1 s2 s3 σ1 … sn σ2 σ3 σn Fingerprint function: Hash function (s1, . . . , sn) (σ1, . . . , σn)

slide-30
SLIDE 30

PPSS: Robust Gap Secret Sharing Scheme

s1 s2 s3 σ1 … sn σ2 σ3 σn Generate a prime number N

22k(n−tr)+1 < N ≤ 22k(n−tr)+2

S = Qn

i=1 σi mod N

×

S (s1, . . . , sn) (σ1, . . . , σn)

slide-31
SLIDE 31

PPSS: Robust Gap Secret Sharing Scheme

s1 s2 s3 σ1 … sn σ2 σ3 σn Generate a prime number N

22k(n−tr)+1 < N ≤ 22k(n−tr)+2

S = Qn

i=1 σi mod N

×

S (s1, . . . , sn) (σ1, . . . , σn) Output: SSInfo = (S, N) {sk}n = s1 s2 s3 sn … S N , { }

slide-32
SLIDE 32

How can we decide which are the valid sets of shares to reconstruct?

PPSS: Robust Gap Secret Sharing Scheme

slide-33
SLIDE 33

PPSS: Robust Gap Secret Sharing Scheme

s1 s2 s3 … sn Given SSInfo = (S, N) S N , { }

slide-34
SLIDE 34

PPSS: Robust Gap Secret Sharing Scheme

s1 s2 s3 … sn Given SSInfo = (S, N) S N , { } τ1 τ2 τ3 τn

slide-35
SLIDE 35

PPSS: Robust Gap Secret Sharing Scheme

s1 s2 s3 … sn Given SSInfo = (S, N) S N , { }

×

T τ1 τ2 τ3 τn

slide-36
SLIDE 36

PPSS: Robust Gap Secret Sharing Scheme

Given T SSInfo = (S, N) S N , { } S γ =

slide-37
SLIDE 37

PPSS: Robust Gap Secret Sharing Scheme

Given T SSInfo = (S, N) S N , { } S γ = = … σ1 σ2 σ3 σn … τ1 τ2 τ3 τn

slide-38
SLIDE 38

PPSS: Robust Gap Secret Sharing Scheme

Given T SSInfo = (S, N) S N , { } S γ = = … σ1 σ2 σ3 σn … τ1 τ2 τ3 τn T 0 S0 =

slide-39
SLIDE 39

PPSS: Robust Gap Secret Sharing Scheme

Given T SSInfo = (S, N) S N , { } S γ = = … σ1 σ2 σ3 σn … τ1 τ2 τ3 τn T 0 S0 = | gcd( τ1 , T 0 )| ≈ 1

slide-40
SLIDE 40

PPSS: Robust Gap Secret Sharing Scheme

Given T SSInfo = (S, N) S N , { } S γ = = … σ1 σ2 σ3 σn … τ1 τ2 τ3 τn T 0 S0 = | gcd( τ1 , T 0 )| ≈ 1 Correct fingerprint!

slide-41
SLIDE 41

PPSS: Robust Gap Secret Sharing Scheme

Given T SSInfo = (S, N) S N , { } S γ = = … σ1 σ2 σ3 σn … τ1 τ2 τ3 τn T 0 S0 = | gcd( τ1 , T 0 )| ≈ 1 | gcd( , T 0 )| ≈ τ2 k Correct fingerprint! Incorrect fingerprint!

slide-42
SLIDE 42

PPSS: Robust Gap Secret Sharing Scheme

Given T SSInfo = (S, N) S N , { } S γ = = … σ1 σ2 σ3 σn … τ1 τ2 τ3 τn T 0 S0 = | gcd( τ1 , T 0 )| ≈ 1 | gcd( , T 0 )| ≈ τ2 k Correct fingerprint! Incorrect fingerprint! | gcd( T 0 )| ≈ 1 Correct fingerprint! τ3 ,

slide-43
SLIDE 43

PPSS: Oblivious PRF pw

sk

  • The output is indistinguishable from random
  • The server learns nothing

F

F(sk, pw)

slide-44
SLIDE 44

PPSS: Password-Protected Secret Sharing

Initialization phase

slide-45
SLIDE 45

PPSS: Initialization

The user interacts with servers to obliviously evaluate the PRF

n …

(pk1, sk1) (pk2, sk2) (pkn, skn)

slide-46
SLIDE 46

PPSS: Initialization

pw

…

(pk1, sk1) (pk2, sk2) (pkn, skn) π1 = Fsk1(pw) The user interacts with servers to obliviously evaluate the PRF

n

slide-47
SLIDE 47

PPSS: Initialization

pw

…

(pk1, sk1) (pk2, sk2) (pkn, skn) π1 = Fsk1(pw) π2 = Fsk2(pw) The user interacts with servers to obliviously evaluate the PRF

n

slide-48
SLIDE 48

PPSS: Initialization

pw

…

(pk1, sk1) (pk2, sk2) (pkn, skn)

πn = Fskn(pw)

π1 = Fsk1(pw) π2 = Fsk2(pw) The user interacts with servers to obliviously evaluate the PRF

n

slide-49
SLIDE 49

PPSS: Initialization

pw {πk}n

R = K||r

Each share is encrypted using the each PRF evaluation

…

(pk1, sk1) (pk2, sk2) (pkn, skn)

πn = Fskn(pw)

π1 = Fsk1(pw) π2 = Fsk2(pw)

{pkk}n

slide-50
SLIDE 50

PPSS: Initialization

pw {πk}n

R = K||r

Each share is encrypted using the each PRF evaluation

(s1, . . . , sn, SSInfo) ← ShareGen(R) …

(pk1, sk1) (pk2, sk2) (pkn, skn)

πn = Fskn(pw)

π1 = Fsk1(pw) π2 = Fsk2(pw)

{pkk}n

slide-51
SLIDE 51

PPSS: Initialization

pw {πk}n

R = K||r

Each share is encrypted using the each PRF evaluation

(s1, . . . , sn, SSInfo) ← ShareGen(R) σk = πk ⊕ sk …

(pk1, sk1) (pk2, sk2) (pkn, skn)

πn = Fskn(pw)

π1 = Fsk1(pw) π2 = Fsk2(pw)

{pkk}n

slide-52
SLIDE 52

PPSS: Initialization

pw {πk}n

The user computes a commitment

K r SSInfo …

(pk1, sk1) (pk2, sk2) (pkn, skn)

{pkk}n {σk}n C = Commit(pw, H({pkk}n, {σk}n, SSInfo, K); r)

slide-53
SLIDE 53

PPSS: Initialization

pw {πk}n

The user uploads the encrypted data

C PInfo PInfo PInfo …

(pk1, sk1) (pk2, sk2) (pkn, skn)

K r SSInfo {pkk}n {σk}n PInfo = ({pkk}n, {σk}n, SSInfo, C)

slide-54
SLIDE 54

PPSS: Password-Protected Secret Sharing

Reconstruction phase

slide-55
SLIDE 55

PPSS: Reconstruction

The user interacts with the server

π1 = Fsk1(pw)

pw

PInfo …

(pk1, sk1) (pk2, sk2)

(pkn, skn)

PInfo PInfo PInfo

slide-56
SLIDE 56

PPSS: Reconstruction

…

(pk1, sk1) (pk2, sk2)

(pkn, skn)

The user interacts with the server PInfo PInfo PInfo

π1 = Fsk1(pw)

pw

PInfo

π2 = Fsk2(pw)

slide-57
SLIDE 57

PPSS: Reconstruction

…

(pk1, sk1) (pk2, sk2)

(pkn, skn)

The user interacts with the server PInfo PInfo PInfo

π1 = Fsk1(pw)

pw

PInfo

π2 = Fsk2(pw)

πn = Fskn(pw)

slide-58
SLIDE 58

PPSS: Reconstruction

…

(pk1, sk1) (pk2, sk2)

(pkn, skn)

The user interacts with the server PInfo PInfo PInfo

π1 = Fsk1(pw)

pw

π2 = Fsk2(pw)

πn = Fskn(pw)

σ1 ⊕ π1 = s1

slide-59
SLIDE 59

PPSS: Reconstruction

…

(pk1, sk1) (pk2, sk2)

(pkn, skn)

The user interacts with the server PInfo PInfo PInfo

π1 = Fsk1(pw)

pw

π2 = Fsk2(pw)

πn = Fskn(pw)

σ1 ⊕ π1 = s1 σ2 ⊕ π2 = s2

slide-60
SLIDE 60

PPSS: Reconstruction

…

(pk1, sk1) (pk2, sk2)

(pkn, skn)

The user interacts with the server PInfo PInfo PInfo

π1 = Fsk1(pw)

pw

π2 = Fsk2(pw)

πn = Fskn(pw)

σ1 ⊕ π1 = s1 σ2 ⊕ π2 = s2 σ3 ⊕ π3 = s3

slide-61
SLIDE 61

PPSS: Reconstruction

…

(pk1, sk1) (pk2, sk2)

(pkn, skn)

The user interacts with the server PInfo PInfo PInfo

π1 = Fsk1(pw)

pw

π2 = Fsk2(pw)

πn = Fskn(pw)

σ1 ⊕ π1 = s1 σ2 ⊕ π2 = s2 σ3 ⊕ π3 = s3 σn ⊕ πn = sn

slide-62
SLIDE 62

PPSS: Reconstruction

…

(pk1, sk1) (pk2, sk2)

(pkn, skn)

The user interacts with the server PInfo PInfo PInfo

π1 = Fsk1(pw)

pw

π2 = Fsk2(pw)

πn = Fskn(pw)

σ1 ⊕ π1 = s1 σ2 ⊕ π2 = s2 σ3 ⊕ π3 = s3 σn ⊕ πn = sn Reconstruct( )

?

= R = K||r

slide-63
SLIDE 63

PPSS: Reconstruction

…

(pk1, sk1) (pk2, sk2)

(pkn, skn)

The user interacts with the server PInfo PInfo PInfo

π1 = Fsk1(pw)

pw

π2 = Fsk2(pw)

πn = Fskn(pw)

Commit(pw, H({pkk}n, {σk}n, SSInfo, K); r)

?

= C

slide-64
SLIDE 64

PPSS: Proof [Sketch]

Adversary’s probability is bounded by: We build simulators for each PRFs

slide-65
SLIDE 65

PPSS: Proof [Sketch]

Adversary’s probability is bounded by: We build simulators for each PRFs Probability of guessing pw Pr[PWinC] =

qu #Dict

slide-66
SLIDE 66

PPSS: Proof [Sketch]

Adversary’s probability is bounded by: We build simulators for each PRFs Probability of breaking the OPRF Pr[PWinF] = ε

slide-67
SLIDE 67

PPSS: Comparison

  • By using our robust threshold secret sharing we

avoid the verifiability requirements for the OPRF.

  • We reduce the communication to the half, because of

the simplification of the OPRF.

  • Our communication and computation complexities are

asymptotically equivalent to [JKK14], in real life they are twice better.

slide-68
SLIDE 68

Robust Password- Protected Secret Sharing

Michel Abdalla, Mario Cornejo, Anca Niţulescu, David Pointcheval

École Normale Supérieure, CNRS and INRIA, Paris, France

R E S E A R C H U N I V E R S I T Y

slide-69
SLIDE 69

PPSS: Experimental Results

Given T SSInfo = (S, N) S N , { } S γ = = … σ1 σ2 σ3 σn … τ1 τ2 τ3 τn T 0 S0 =

slide-70
SLIDE 70

PPSS: Experimental Results

Given T SSInfo = (S, N) S N , { } S γ = = … σ3 σn … τ1 τ2 τ3 τn = | gcd( τ1 , )| ≈ 1 Correct fingerprint! = 1 T 00 S00 T 00 σ2 σ1

slide-71
SLIDE 71

T 00 S00

PPSS: Experimental Results

Given T SSInfo = (S, N) S N , { } S γ = = … σ2 σ3 σn … τ1 τ2 τ3 τn = | gcd( τ1 , )| ≈ 1 Correct fingerprint! = 1 | gcd( τ1 , )| ≈ 1 Correct fingerprint! = 2 | gcd( τ1 , )| ≈ 1 Correct fingerprint! = 3 T 00 T 00 T 00 σ1

slide-72
SLIDE 72

PPSS: Experimental Results

| gcd( , )| ≈ 1 Incorrect fingerprint! | gcd( , )| ≈ 1 Incorrect fingerprint! , | gcd( )| ≈ 1 Incorrect fingerprint! T 00 T 00 T 00 τ2 τ2 τ2 = k = k − 1 = k − 2

slide-73
SLIDE 73

PPSS: CDH-based PRF (One-More Gap DH)

pw

A B α ← Z∗ A ← H1(pw)α C ← B1/α = H1(pw)sk pk = gsk B ← Ask sk Fsk(pw) = H2(pw, pk, C)

slide-74
SLIDE 74

PPSS: DDH-based PRF

x = (x1, x2, . . . , x`) ∈ {0, 1}` pk, {ci = Encpk(ai)} sk ∈ Zs α ← Gs C ← Encpk(α × a0 Q aixi) C Proof(α, xi) G D ← Decsk(C) G ← gD R ← G1/α