Scalable RSA Modulus Generation with a Dishonest Majority Muthu - - PowerPoint PPT Presentation

▶
scalable rsa modulus generation with a dishonest
SMART_READER_LITE
LIVE PREVIEW

Scalable RSA Modulus Generation with a Dishonest Majority Muthu - - PowerPoint PPT Presentation

Jun 24, 2023 562 likes •1.12k views

Scalable RSA Modulus Generation with a Dishonest Majority Muthu Venkitasubramaniam Ligero Inc. & University of Rochester Megan Chen, Carmit Hazay, Yuval Ishai, Yuriy Kashnikov, Daniele Micciancio, Tarik Riviere, abhi shelat, Ruihan Wang

slide-1
SLIDE 1

Scalable RSA Modulus Generation with a Dishonest Majority

Muthu Venkitasubramaniam

Ligero Inc. & University of Rochester

Megan Chen, Carmit Hazay, Yuval Ishai, Yuriy Kashnikov, Daniele Micciancio, Tarik Riviere, abhi shelat, Ruihan Wang

slide-2
SLIDE 2

What is an RSA Modulus?

Biprime - product of exactly two primes

slide-3
SLIDE 3

Why? RSA History

  • 1977 - RSA Public-Key Encryption
  • 1999 - Paillier Public-Key Encryption
  • 2001 - CRS for UC setting
  • 2018 - Verifiable Delay Functions (VDF)

NIST Randomness Beacon

Source: https://csrc.nist.gov/projects/interoperable-randomness-beacons

slide-4
SLIDE 4
  • [Rivest-Shamir-Wagner96] introduced Inherently

Sequential functions (ISH)

  • 2018 - VDF constructions by Pietrzak,

Wesolowski

Verifiable Delay Functions

slide-5
SLIDE 5

Goal

Sample a biprime N where factorization “hidden”

USE MPC!

slide-6
SLIDE 6

Desiderata

  • Modulus size:

2048 bits

  • Threshold:

n-1 corruption

  • # Participants:

> 1000

  • Party Spec:

“Lightweight”

  • Bandwidth:

< 5 Mbps

  • Security:

60-bit statistical security 128-bit computational security

slide-7
SLIDE 7

Step 1: Design protocol for

PASSIVE corruptions

Step 2: Upgrade security to tolerate

ACTIVE corruptions

Protocol Blueprint

slide-8
SLIDE 8

Step 1: Scalable Passive Protocol

slide-9
SLIDE 9

Previous Works: Overview

Milestone Work Adversary Parties Corruption Threshold First Work [BF97] Passive n >= 3 t < n/2 [FMY98] Active n t < n/2 [PS98] Active 2 t = 1 Based on OT [Gil99] Passive 2 t = 1 [ACS02] Passive n t < n/2 [DM10] Active 3 t = 1 [HMRT12] Active n t < n [FLOP18] Active 2 t = 1 [CCD+20] Active n t < n

slide-10
SLIDE 10

Boneh-Franklin Framework

[BF97]

  • 1. Candidates &

Trial division

N

  • 2. Mult

0,1

  • 3. Biprimality

Testing

pi, qi

slide-11
SLIDE 11

Boneh-Franklin Framework

[BF97]

  • 1. Candidates &

Trial division

N

  • 2. Mult

0,1

  • 3. Biprimality

Testing

pi, qi

Parties choose pi, qi randomly

slide-12
SLIDE 12

Boneh-Franklin Framework

[BF97]

  • 1. Candidates &

Trial division

N

  • 2. Mult

0,1

  • 3. Biprimality

Testing

pi, qi

Parties choose pi, qi randomly

slide-13
SLIDE 13

Boneh-Franklin Framework

[BF97]

  • 1. Candidates &

Trial division

N

  • 2. Mult

0,1

  • 3. Biprimality

Testing

pi, qi

Is N the product

  • f two primes?

Parties choose pi, qi randomly

slide-14
SLIDE 14

[CCD+20] Passive Protocol

N

  • 2. Mult

0,1 pi, qi

Is N the product

  • f two primes?

Parties choose pi, qi randomly

  • 3. Biprimality

Testing

  • 1. Candidates &

Trial division

slide-15
SLIDE 15

[CCD+20] Passive Protocol

N

  • 2. Mult

0,1 pi, qi

Is N the product

  • f two primes?

Parties choose pi, qi randomly

  • 3. Biprimality

Testing

  • 1. PRESIEVED

CANDIDATES

slide-16
SLIDE 16

[CCD+20] Passive Protocol

  • 1. Pre-sieving

candidates

  • 2. Mult
  • 3. Biprimality

testing Secure Multiplication Secure Multiplication Secure Multiplication Jacobi test [BF97]

slide-17
SLIDE 17

a1,b1 ∈ 𝔾 c1 cn

MUL

Secure Multiplication

a𝑜, bn ∈ 𝔾 a2,b2 ∈ 𝔾

…

c2

slide-18
SLIDE 18

Implementing Secure Multiplication

  • Oblivious Linear Evaluation (OLE)

– Scales quadratic in # parties

  • Threshold Additively Homomorphic Encryption (TAHE)

[CDN01] – Scales linearly in # parties

  • Our Approach: TAHE with verifiable

coordinator

– per-party comm. scales logarithmically in # parties

slide-19
SLIDE 19

Parties’ secret shares Key Generation Encrypt pi

  • Coord. adds

Receive Enc(p) from Coord. Multiply by qi

  • Coord. adds

Receive Enc( pq ) from Coord. Decrypted product

Threshold AHE with a coordinator

Pi

pi, qi ski EncPK(pi) EncPK(p) qi ⋅ EncPK(p) EncPK(p ⋅ q)

C

∑EncPK(pi) ∑qi ⋅ EncPK(p) p ⋅ q

slide-20
SLIDE 20

Parties’ secret shares Key Generation Encrypt pi

  • Coord. adds

Receive Enc(p) from Coord. Multiply by qi

  • Coord. adds

Receive Enc( pq ) from Coord. Decrypted product

Threshold AHE with a coordinator

Pi

pi, qi ski EncPK(pi) EncPK(p) qi ⋅ EncPK(p) EncPK(p ⋅ q)

C

PK ∑EncPK(pi) ∑qi ⋅ EncPK(p) p ⋅ q

slide-21
SLIDE 21

Parties’ secret shares Key Generation Encrypt pi

  • Coord. adds

Receive Enc(p) from Coord. Multiply by qi

  • Coord. adds

Receive Enc( pq ) from Coord. Decrypted product

Threshold AHE with a coordinator

Pi

pi, qi ski EncPK(pi) EncPK(p) qi ⋅ EncPK(p) EncPK(p ⋅ q)

C

PK ∑EncPK(pi) ∑qi ⋅ EncPK(p) p ⋅ q

slide-22
SLIDE 22

Parties’ secret shares Key Generation Encrypt pi

  • Coord. adds

Receive Enc(p) from Coord. Multiply by qi

  • Coord. adds

Receive Enc( pq ) from Coord. Decrypted product

Threshold AHE with a coordinator

Pi

pi, qi ski EncPK(pi) EncPK(p) qi ⋅ EncPK(p) EncPK(p ⋅ q)

C

PK ∑EncPK(pi) ∑qi ⋅ EncPK(p) p ⋅ q

slide-23
SLIDE 23

Parties’ secret shares Key Generation Encrypt pi

  • Coord. adds

Receive Enc(p) from Coord. Multiply by qi

  • Coord. adds

Receive Enc( pq ) from Coord. Decrypted product

Threshold AHE with a coordinator

Pi

pi, qi ski EncPK(pi) EncPK(p) qi ⋅ EncPK(p) EncPK(p ⋅ q)

C

PK ∑EncPK(pi) ∑qi ⋅ EncPK(p) p ⋅ q

slide-24
SLIDE 24

Parties’ secret shares Key Generation Encrypt pi

  • Coord. adds

Receive Enc(p) from Coord. Multiply by qi

  • Coord. adds

Receive Enc( pq ) from Coord. Decrypted product

Threshold AHE with a coordinator

Pi

pi, qi ski EncPK(pi) EncPK(p) qi ⋅ EncPK(p) EncPK(p ⋅ q)

C

PK ∑EncPK(pi) ∑qi ⋅ EncPK(p) p ⋅ q

slide-25
SLIDE 25

Parties’ secret shares Key Generation Encrypt pi

  • Coord. adds

Receive Enc(p) from Coord. Multiply by qi

  • Coord. adds

Receive Enc( pq ) from Coord. Decrypted product

Threshold AHE with a coordinator

Pi

pi, qi ski EncPK(pi) EncPK(p) qi ⋅ EncPK(p) EncPK(p ⋅ q)

C

PK ∑EncPK(pi) ∑qi ⋅ EncPK(p) p ⋅ q

slide-26
SLIDE 26

Parties’ secret shares Key Generation Encrypt pi

  • Coord. adds

Receive Enc(p) from Coord. Multiply by qi

  • Coord. adds

Receive Enc( pq ) from Coord. Decrypted product

Threshold AHE with a coordinator

Pi

pi, qi ski EncPK(pi) EncPK(p) qi ⋅ EncPK(p) EncPK(p ⋅ q)

C

PK ∑EncPK(pi) ∑qi ⋅ EncPK(p) p ⋅ q

slide-27
SLIDE 27

Parties’ secret shares Key Generation Encrypt pi

  • Coord. adds

Receive Enc(p) from Coord. Multiply by qi

  • Coord. adds

Receive Enc( pq ) from Coord. Decrypted product

Threshold AHE with a coordinator

Pi

pi, qi ski EncPK(pi) EncPK(p) qi ⋅ EncPK(p) EncPK(p ⋅ q) p ⋅ q

C

PK ∑EncPK(pi) ∑qi ⋅ EncPK(p)

slide-28
SLIDE 28
  • 3. Biprimality

Testing

[BF97]’s Distributed Biprimality Test

  • 1. Candidates &

Trial division

  • 2. Mult

Test whether N is the product of two primes [BF97]

  • Jacobi Test (Dist “Miller-Rabin" test)
  • GCD Test
slide-29
SLIDE 29

[BF97]’s Distributed Biprimality Test

Test whether N is the product of two primes [BF97]

  • Jacobi Test (Dist “Miller-Rabin" test)
  • GCD Test
slide-30
SLIDE 30

[BF97]’s Distributed Biprimality Test

Test whether N is the product of two primes [BF97]

  • Jacobi Test (Dist “Miller-Rabin" test)
  • GCD Test
slide-31
SLIDE 31

[BF97]’s Distributed Biprimality Test

Test whether N is the product of two primes [BF97]

  • Jacobi Test (Dist “Miller-Rabin" test)
  • GCD Test
slide-32
SLIDE 32

Step 2: Compile to full security

slide-33
SLIDE 33

GMW Paradigm

P1 P2

x1,r1 x2,r2

. . .

m1 mk

slide-34
SLIDE 34

P1 P2

x1,r1 x2,r2

Commit Commit

m1 mk

ZK ZK

. . .

GMW Paradigm

slide-35
SLIDE 35

P1 P2

x1,r1 x2,r2

Commit Commit

m1 mk

ZK ZK

. . .

Our Approach

slide-36
SLIDE 36

P1 P2

x1,r1 x2,r2

Commit Commit

m1 mk

. . .

Our Approach

ZK

slide-37
SLIDE 37

Our Protocol

Key Setup Generate Candidates Compute Products Biprimality test

Generate threshold keys Sample pre-sieved primes Use TAHE to compute candidates Jacobi test

Certification

Zero-knowledge proof

Commitment

Commit to randomness

slide-38
SLIDE 38

Verifiable Coordinator

C

  • Coordinator performs
  • nly public operations
  • Sign every message
  • Post message on

bulletin board

slide-39
SLIDE 39

Modular Proof (UC-security)

Generate Beaver triples Passive Protocol (with triples) Certify triples

slide-40
SLIDE 40

Modular Proof (UC-security) ℱ𝑑𝑓𝑠𝑢−𝑢𝑠𝑗𝑞𝑚𝑓

Passive Protocol (with triples)

ℱ𝑑𝑓𝑠𝑢−𝑢𝑠𝑗𝑞𝑚𝑓

slide-41
SLIDE 41

Certified Beaver Triples Functionality

ℱ𝑑𝑓𝑠𝑢−𝑢𝑠𝑗𝑞𝑚𝑓

Relation 𝑆

Pi

Generate 𝑏𝑘

𝑗, 𝑐𝑘 𝑗, 𝑑𝑘 𝑗 𝑘

𝑦, 𝑥

𝑦, 𝑆 𝑦, 𝑥, 𝑏𝑘

𝑗,𝑐 𝑘 𝑗, 𝑑 𝑘 𝑗 𝑘

slide-42
SLIDE 42

Realizing Certified Beaver Triples Functionality

ℱ

𝑑𝑞 (commit)

Generate triples using TAHE

ℱ

𝑑𝑞 (prove)

Commit and Prove Semi-malicious security

slide-43
SLIDE 43

Which TAHE to choose?

Paillier?

  • Circular choice

El Gamal?

  • Inefficient decryption (discrete log)

LWE?

  • Does not support all AHE operations

Ring-LWE more efficient, flexible

  • Supports AHE, better parameters, packing
slide-44
SLIDE 44

ZK Constraints

  • Triples generation - Operations in Ring ℤ𝑅 where 𝑅

= 𝑞1 × 𝑞2 ×∙ ∙ ∙× 𝑞𝑜 and each 𝑞𝑗 is a 62-bit prime.

  • Triples consumption - Linear operations modulo τ

that is a product of (a different set of) primes

  • Jacobi test - Operations modulo ℤ𝑂

∗ where 𝑂 is the

2048-bit candidate modulus

slide-45
SLIDE 45

Needs:

  • Memory efficient (2GB RAM for prover)
  • Communication efficient (sublinear)
  • Transparent

Our Approa

  • ach

Ligero [AHIV17] + Sigma

[Sho00]

What ZK Protocol to Use?

slide-46
SLIDE 46

Ligero

  • Triples generation via Ring-LWE (Range Proofs)
  • Triples consumption (modular arithmetic)

Sigma

  • Jacobi test (knowledge of exponent)

The Proofs

slide-47
SLIDE 47

Our Protocol

  • Security w/ abort upto n-1

1 party ty corrupti tions

and the coordinato

tor by an active adversary

– Verifiable coordinator

  • Identifiable abort
  • Public-verifiability [BDO14,BDD20]
slide-48
SLIDE 48

Implementation

slide-49
SLIDE 49

Setup

  • Parties

– AWS t3.small (2 vcpu, 2GB RAM)

  • Coordinator

– AWS r5dn24x.large (96 vcpu, 768 GB RAM)

  • Ring LWE Parameter Selection

– FHE Standardization (based on best attacks)

  • PKI

– Sign every message

slide-50
SLIDE 50

Threshold AHE with Ring-LWE: Parameters

slide-51
SLIDE 51

Practical Considerations

  • Bandwidth filtering

– Run a throughput test and deny entry for parties with insufficient bandwidth

  • Restart with kickout

– If protocol aborts, identify and kickout failing party – What does n-1 security imply here?

  • Distributed verification
  • Benchmarking
slide-52
SLIDE 52

Performance Metrics

slide-53
SLIDE 53

Summary

  • First scalable MPC with dishonest majority
  • A practical implementation of the generic

GMW paradigm – 4-8x computation overhead – <2x communication overhead

– Bottl tleneck ck is coord rdinato tor r spec

  • Modular proof
slide-54
SLIDE 54

Thank You