Robustly Reusable Fuzzy Extractor from Standard Assumptions Yunhua - - PowerPoint PPT Presentation

▶
robustly reusable fuzzy extractor from standard
SMART_READER_LITE
LIVE PREVIEW

Robustly Reusable Fuzzy Extractor from Standard Assumptions Yunhua - - PowerPoint PPT Presentation

Oct 21, 2022 259 likes •626 views

Robustly Reusable Fuzzy Extractor from Standard Assumptions Yunhua Wen and Shengli Liu Shanghai Jiao Tong University Problem Randomness is crucial in cryptography (e.g. sk). However, uniformly distributed and accurately reproducible

slide-1
SLIDE 1

Robustly Reusable Fuzzy Extractor from Standard Assumptions

Yunhua Wen and Shengli Liu Shanghai Jiao Tong University

slide-2
SLIDE 2

Problem

  • Randomness is crucial in cryptography (e.g. sk).
  • However, uniformly distributed and accurately reproducible string is rare in

practice.

  • There are many imperfect random sources, e.g.

Physically Unclonable Functions (PUFs) Biometric Information

slide-3
SLIDE 3

Problem

  • Randomness is crucial in cryptography (e.g. sk).
  • However, uniformly distributed and accurately reproducible string is rare in

practice.

  • There are many imperfect random sources, e.g.

Physically Unclonable Functions (PUFs) Biometric Information

Problem: How to use such imperfect random sources in cryptography?

slide-4
SLIDE 4

Fuzzy Extractor

  • Gen(w)
  • Input: a weak random secret w.
  • Output: the extracted key R and a public helper string P

.

  • Rep(w’, P)
  • Input: a noisy version w’ and the public helper string P

.

  • Output: the extracted key R’.

Gen

W R P

Rep

W’ R’ P

slide-5
SLIDE 5

Fuzzy Extractor

  • Gen(w)
  • Input: a weak random secret w.
  • Output: the extracted key R and a public helper string P

.

  • Rep(w’, P)
  • Input: a noisy version w’ and the public helper string P

.

  • Output: the extracted key R’.

Gen

W R P

Rep

W’ R’ P

Correctness: If w’ is close enough to w, R’=R. Security: R is pseudorandom given P .

slide-6
SLIDE 6

Applications

Gen

R P

Enc

m C

Rep

P R

Dec

C m

Users do not need to store the secret key R. Application in Encryption and Decryption:

slide-7
SLIDE 7

Robust Fuzzy Extractor

Gen

R P

Enc

m C

Rep

P’ R’

Dec

C m’

The user may get a wrong key R’ without notifications.

slide-8
SLIDE 8

Robust Fuzzy Extractor

Gen

R P

Enc

m C

Rep

P’

Security：If P is modified, then Rep will output .

Failure

slide-9
SLIDE 9

Reusable Fuzzy Extractor

  • Biometric is unique and cannot be changed or created.
  • The security of multi-extraction from the same noisy source is not

guaranteed by fuzzy extractor.

. . .

sk1

<latexit sha1_base64="JgBloVbAcfdqwB87xrJ6F5wSc=">ACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sKthVqKcl02obmxWRSLMWFP+BW/0z8A/0L74xTUIvohCRnzr3nzNx7/TQMuk4rwVrYXFpeaW4Wlpb39jcKm/vNLMkF4w3WBIm4sb3Mh4GMW/IQIb8JhXci/yQt/zRuYq3xlxkQRJfy0nKO5E3iIN+wDypqGzUdbvlilN19LngWtABWbVk/ILbtFDAoYcEThiSMIhPGT0tOHCQUpcB1PiBKFAxznuUSJtTlmcMjxiR/Qd0K5t2Jj2yjPTakanhPQKUto4IE1CeYKwOs3W8Vw7K/Y376n2VHeb0N83XhGxEkNi/9LNMv+rU7VI9HGqawioplQzqjpmXHLdFXVz+0tVkhxS4hTuUVwQZlo567OtNZmuXfXW0/E3nalYtWcmN8e7uiUN2P05znQPKq6TtW9Oq7Uzsyoi9jDPg5pnieo4QJ1NMh7iEc84dm6tBJrbN19ploFo9nFt2U9fAnXZCR</latexit><latexit sha1_base64="JgBloVbAcfdqwB87xrJ6F5wSc=">ACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sKthVqKcl02obmxWRSLMWFP+BW/0z8A/0L74xTUIvohCRnzr3nzNx7/TQMuk4rwVrYXFpeaW4Wlpb39jcKm/vNLMkF4w3WBIm4sb3Mh4GMW/IQIb8JhXci/yQt/zRuYq3xlxkQRJfy0nKO5E3iIN+wDypqGzUdbvlilN19LngWtABWbVk/ILbtFDAoYcEThiSMIhPGT0tOHCQUpcB1PiBKFAxznuUSJtTlmcMjxiR/Qd0K5t2Jj2yjPTakanhPQKUto4IE1CeYKwOs3W8Vw7K/Y376n2VHeb0N83XhGxEkNi/9LNMv+rU7VI9HGqawioplQzqjpmXHLdFXVz+0tVkhxS4hTuUVwQZlo567OtNZmuXfXW0/E3nalYtWcmN8e7uiUN2P05znQPKq6TtW9Oq7Uzsyoi9jDPg5pnieo4QJ1NMh7iEc84dm6tBJrbN19ploFo9nFt2U9fAnXZCR</latexit><latexit sha1_base64="JgBloVbAcfdqwB87xrJ6F5wSc=">ACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sKthVqKcl02obmxWRSLMWFP+BW/0z8A/0L74xTUIvohCRnzr3nzNx7/TQMuk4rwVrYXFpeaW4Wlpb39jcKm/vNLMkF4w3WBIm4sb3Mh4GMW/IQIb8JhXci/yQt/zRuYq3xlxkQRJfy0nKO5E3iIN+wDypqGzUdbvlilN19LngWtABWbVk/ILbtFDAoYcEThiSMIhPGT0tOHCQUpcB1PiBKFAxznuUSJtTlmcMjxiR/Qd0K5t2Jj2yjPTakanhPQKUto4IE1CeYKwOs3W8Vw7K/Y376n2VHeb0N83XhGxEkNi/9LNMv+rU7VI9HGqawioplQzqjpmXHLdFXVz+0tVkhxS4hTuUVwQZlo567OtNZmuXfXW0/E3nalYtWcmN8e7uiUN2P05znQPKq6TtW9Oq7Uzsyoi9jDPg5pnieo4QJ1NMh7iEc84dm6tBJrbN19ploFo9nFt2U9fAnXZCR</latexit><latexit sha1_base64="JgBloVbAcfdqwB87xrJ6F5wSc=">ACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sKthVqKcl02obmxWRSLMWFP+BW/0z8A/0L74xTUIvohCRnzr3nzNx7/TQMuk4rwVrYXFpeaW4Wlpb39jcKm/vNLMkF4w3WBIm4sb3Mh4GMW/IQIb8JhXci/yQt/zRuYq3xlxkQRJfy0nKO5E3iIN+wDypqGzUdbvlilN19LngWtABWbVk/ILbtFDAoYcEThiSMIhPGT0tOHCQUpcB1PiBKFAxznuUSJtTlmcMjxiR/Qd0K5t2Jj2yjPTakanhPQKUto4IE1CeYKwOs3W8Vw7K/Y376n2VHeb0N83XhGxEkNi/9LNMv+rU7VI9HGqawioplQzqjpmXHLdFXVz+0tVkhxS4hTuUVwQZlo567OtNZmuXfXW0/E3nalYtWcmN8e7uiUN2P05znQPKq6TtW9Oq7Uzsyoi9jDPg5pnieo4QJ1NMh7iEc84dm6tBJrbN19ploFo9nFt2U9fAnXZCR</latexit>

sk2

<latexit sha1_base64="6l+5XTJqwS4y0umxge8kwfB1dmU=">ACx3icjVHLSsNAFD2Nr1pfVZdugkVwVZIi6LoRncV7ANqKcl02oamTCZFEtx4Q+41T8T/0D/wjtjCmoRnZDkzLn3nJl7rx+HQaIc5zVnLS2vrK7l1wsbm1vbO8XdvUYiUsl4nYlQyJbvJTwMIl5XgQp5K5bcG/shb/qjCx1vTrhMAhHdqGnMO2NvEAX9gHlKU8moW+kWS07ZMcteBG4GSshWTRfcIseBhSjMERQREO4SGhpw0XDmLiOpgRJwkFJs5xjwJpU8rilOERO6LvgHbtjI1orz0To2Z0SkivJKWNI9IypOE9Wm2iafGWbO/ec+Mp7blP5+5jUmVmFI7F+6eZ/dboWhT7OTA0B1RQbRlfHMpfUdEXf3P5SlSKHmDiNexSXhJlRzvtsG01iate9Uz8zWRqVu9ZlpviXd+SBuz+HOciaFTKrlN2r09K1fNs1Hkc4BDHNM9TVHGJGurkPcQjnvBsXVnCmlh3n6lWLtPs49uyHj4AKb2Qkg=</latexit><latexit sha1_base64="6l+5XTJqwS4y0umxge8kwfB1dmU=">ACx3icjVHLSsNAFD2Nr1pfVZdugkVwVZIi6LoRncV7ANqKcl02oamTCZFEtx4Q+41T8T/0D/wjtjCmoRnZDkzLn3nJl7rx+HQaIc5zVnLS2vrK7l1wsbm1vbO8XdvUYiUsl4nYlQyJbvJTwMIl5XgQp5K5bcG/shb/qjCx1vTrhMAhHdqGnMO2NvEAX9gHlKU8moW+kWS07ZMcteBG4GSshWTRfcIseBhSjMERQREO4SGhpw0XDmLiOpgRJwkFJs5xjwJpU8rilOERO6LvgHbtjI1orz0To2Z0SkivJKWNI9IypOE9Wm2iafGWbO/ec+Mp7blP5+5jUmVmFI7F+6eZ/dboWhT7OTA0B1RQbRlfHMpfUdEXf3P5SlSKHmDiNexSXhJlRzvtsG01iate9Uz8zWRqVu9ZlpviXd+SBuz+HOciaFTKrlN2r09K1fNs1Hkc4BDHNM9TVHGJGurkPcQjnvBsXVnCmlh3n6lWLtPs49uyHj4AKb2Qkg=</latexit><latexit sha1_base64="6l+5XTJqwS4y0umxge8kwfB1dmU=">ACx3icjVHLSsNAFD2Nr1pfVZdugkVwVZIi6LoRncV7ANqKcl02oamTCZFEtx4Q+41T8T/0D/wjtjCmoRnZDkzLn3nJl7rx+HQaIc5zVnLS2vrK7l1wsbm1vbO8XdvUYiUsl4nYlQyJbvJTwMIl5XgQp5K5bcG/shb/qjCx1vTrhMAhHdqGnMO2NvEAX9gHlKU8moW+kWS07ZMcteBG4GSshWTRfcIseBhSjMERQREO4SGhpw0XDmLiOpgRJwkFJs5xjwJpU8rilOERO6LvgHbtjI1orz0To2Z0SkivJKWNI9IypOE9Wm2iafGWbO/ec+Mp7blP5+5jUmVmFI7F+6eZ/dboWhT7OTA0B1RQbRlfHMpfUdEXf3P5SlSKHmDiNexSXhJlRzvtsG01iate9Uz8zWRqVu9ZlpviXd+SBuz+HOciaFTKrlN2r09K1fNs1Hkc4BDHNM9TVHGJGurkPcQjnvBsXVnCmlh3n6lWLtPs49uyHj4AKb2Qkg=</latexit><latexit sha1_base64="6l+5XTJqwS4y0umxge8kwfB1dmU=">ACx3icjVHLSsNAFD2Nr1pfVZdugkVwVZIi6LoRncV7ANqKcl02oamTCZFEtx4Q+41T8T/0D/wjtjCmoRnZDkzLn3nJl7rx+HQaIc5zVnLS2vrK7l1wsbm1vbO8XdvUYiUsl4nYlQyJbvJTwMIl5XgQp5K5bcG/shb/qjCx1vTrhMAhHdqGnMO2NvEAX9gHlKU8moW+kWS07ZMcteBG4GSshWTRfcIseBhSjMERQREO4SGhpw0XDmLiOpgRJwkFJs5xjwJpU8rilOERO6LvgHbtjI1orz0To2Z0SkivJKWNI9IypOE9Wm2iafGWbO/ec+Mp7blP5+5jUmVmFI7F+6eZ/dboWhT7OTA0B1RQbRlfHMpfUdEXf3P5SlSKHmDiNexSXhJlRzvtsG01iate9Uz8zWRqVu9ZlpviXd+SBuz+HOciaFTKrlN2r09K1fNs1Hkc4BDHNM9TVHGJGurkPcQjnvBsXVnCmlh3n6lWLtPs49uyHj4AKb2Qkg=</latexit>
slide-10
SLIDE 10

Reusable Fuzzy Extractor

Perturbations

Gen Gen Gen

. . . . . .

Chosen by Adversary

slide-11
SLIDE 11

Reusable Fuzzy Extractor

Perturbations

Gen Gen Gen

. . . . . .

Chosen by Adversary Rj is pseudorandom even given (P1, R1, …,Pj, …,Pn, Rn)

slide-12
SLIDE 12

Related Works

FE schemes Robustness? Reusability?

[DRS04], [FMR13] [Boyen04], [ABCG16], [CFPRS16], [ACEK17], [WL18], [WLH18] [BDKOS05], [DKRS06], [KR08], [CDFPW08]

No fuzzy extractor considers robustness and reusability simultaneously.

slide-13
SLIDE 13

Our Contribution

  • We formally defined robustly reusable fuzzy extractor(rrFE).
  • We constructed the first rrFE based on standard assumptions.
slide-14
SLIDE 14

Robustly Reusable Fuzzy Extractor

Perturbations

Gen Gen Gen

. . . . . .

Rj is pseudorandom even given (P1, R1, …,Pj, …,Pn, Rn) Chosen by Adversary

slide-15
SLIDE 15

Robustly Reusable Fuzzy Extractor

Perturbations

Gen Gen Gen

. . . . . .

Rj is pseudorandom even given (P1, R1, …,Pj, …,Pn, Rn) Chosen by Adversary It is hard for adversary to forge Pj’, st., Rep does not

  • utput bot, even if it gets (P1,

R1, …,Pj, R j,…,Pn, Rn).

slide-16
SLIDE 16

Building Blocks

  • Homomorphic Secure Sketch (SS)
  • Homomorphic Extractor (Ext)
  • Symmetric Key Encapsulation Mechanism (SKEM)
  • Homomorphic Lossy Algebraic Filter (LAF) 

slide-17
SLIDE 17

Building Block-Secure Sketch

  • SS.Gen(w)
  • Input: a weak random secret w.
  • Output: a sketch s.
  • SS.Rec(w’, s)
  • Input: a noisy version w’ and the sketch s.
  • Output: w.

SS.Gen

W S

SS.Rec

W’ W S

  • Correctness: For w’ close to w, w can be recovered from s.
  • Privacy: s does not leak too much information of w.
slide-18
SLIDE 18

Building Block-Secure Sketch

  • SS.Gen(w)
  • Input: a weak random secret w.
  • Output: a sketch s.
  • SS.Rec(w’, s)
  • Input: a noisy version w’ and the sketch s.
  • Output: w.

SS.Gen

W S

SS.Rec

W’ W S

Homomorphic secure sketch: SS.Gen(w+w’) = SS.Gen(w) + SS.Gen(w’).

  • Correctness: For w’ close to w, w can be recovered from s.
  • Privacy: s does not leak too much information of w.
slide-19
SLIDE 19

Building Block—Extractor

Extractor Input: a weak secret w and a uniformly random seed i. Output: extracted key R = Ext(w; i).

Ext

W R i

Security: R is uniformly random, even conditioned on the seed i. (Ext(W; i), i) ≈ (Uniform, i).

slide-20
SLIDE 20

Building Block—Extractor

Extractor Input: a weak secret w and a uniformly random seed i. Output: extracted key R = Ext(w; i).

Ext

W R i

Homomorphic extractor: Ext(w+w’, i) =Ext(w; i) + Ext(w’; i). Security: R is uniformly random, even conditioned on the seed i. (Ext(W; i), i) ≈ (Uniform, i).

slide-21
SLIDE 21

Building Block—SKEM

Symmetric Key Encapsulation Mechanism is similar to traditional KEM.

  • SKEM.Enc(pp, sk) (c, k).
  • SKEM.Dec(c, sk)=k.

Key-shift

. . . . . .

ki is pseudorandom even given (c1, k1, …,cj, …,cn, kn)

sk

SKEM

sk1 skj skn

SKEM SKEM

(c1, k1) (cj, kj) (cn, kn)

Key-Shift Security

slide-22
SLIDE 22

Building Block—LAF

tag=(t, t’)

Lossy Algebraic Filter (LAF)

X Y Y X

F(tag,X) F(tag,X)

Injective Lossy

F-1(Y) F-1(Y)

slide-23
SLIDE 23

Building Block—LAF

tag=(t, t’)

Lossy Algebraic Filter (LAF)

X Y Y X

F(tag,X) F(tag,X)

Injective Lossy

F-1(Y) F-1(Y)

slide-24
SLIDE 24

Building Block—LAF

tag=(t, t’)

Lossy Algebraic Filter (LAF)

X Y Y X

F(tag,X) F(tag,X)

Injective Lossy

F-1(Y) F-1(Y)

  • Evasiveness: It is hard to find a non-injective tag without Ftd.
  • Lossiness: If the tag is lossy, the function value is only depend on .
slide-25
SLIDE 25

Building Block—LAF

Lossy Algebraic Filter (LAF)

Homomorphic LAF:

slide-26
SLIDE 26

Sketch-and-Extract Paradigm

SS.Gen

S

Ext

W R i

Information reconciliation Privacy amplification

P R

slide-27
SLIDE 27

Sketch-and-Extract Paradigm

SS.Gen

S

Ext

W R i

Information reconciliation Privacy amplification

The “sketch-and-extract” construction is a fuzzy extractor [DRS04].

P R

slide-28
SLIDE 28

Sketch-and-Extract Paradigm

SS.Gen

S

Ext

W R i

Information reconciliation Privacy amplification

The “sketch-and-extract” construction is a fuzzy extractor [DRS04]. Not reusable: Same w, same R. Not robust: No authentication

P R

slide-29
SLIDE 29

How to Achieve Reusability

SS.Gen

S

Ext

W R i

SKEM

K C

P

slide-30
SLIDE 30

How to Achieve Reusability

SS.Gen

S

Ext

W R i

SKEM

K C

P

Homomorphic properties:

The ks-security of SKEM guarantees the privacy of k.

slide-31
SLIDE 31

How to Achieve Robustness

SS.Gen

S

Ext

W sk i

SKEM

K C

P LAF

W

t y

R

For authentication

Seed i of Ext, Fpk of LAF and pp of SKEM are common reference string, which can be stored publicly, but can not be modified.

slide-32
SLIDE 32

Reusability & Robustness

All tags are changed into lossy tags.

slide-33
SLIDE 33

Reusability & Robustness

All tags are changed into lossy tags.

Enough entropy is left for Ext to extract a key and for LAF to authenticate.

slide-34
SLIDE 34

Instantiation

  • Homomorphic Ext and SS have information theoretical instantiations.
  • Homomorphic LAF can be constructed by the DLIN assumption.
  • Key-shift secure SKEM can be constructed by the DDH assumption.

Our rrFE is based on standard assumptions.

slide-35
SLIDE 35

Summary

  • Our contribution
  • We constructed the first robustly reusable fuzzy extractor from standard

assumption.

  • Open problem
  • Robustly reusable FE for arbitrary correlated inputs.
slide-36
SLIDE 36

Thank you !