Short Digital Signatures and ID- KEMs via Truncation Collision - - PowerPoint PPT Presentation

Short Digital Signatures and ID- KEMs via Truncation Collision Resistance

Tibor Jager Paderborn University

1

Rafael Kurek Paderborn University

Contributions

• New security notion for standard Hash Functions
• Truncation-Collision Resistance
• New Digital Signature scheme and ID-KEM
• From selective to full security in Standard Model
• Solving open problem: single element in prime
• rder group

2

Random Oracle Model [BR93]

3

“Cryptographic Hash Function modelled as truly random function”

• (Simple) proofs ✅
• Strong security properties ✅
• Short, full secure signatures [BLS01, BB04]
• Short, full secure ID-KEMs [BF01, BB04]

Random Oracle Model [BR93]

4

“Cryptographic Hash Function modelled as truly random function”

• (Simple) proofs ✅
• Strong security properties ✅
• Short, full secure signatures [BLS01, BB04]
• Short, full secure ID-KEMs [BF01, BB04]
• Unclear security guarantees for implementations [CGH02] ❌
• Unclear which security property required ❌

Random Oracle Model [BR93]

5

“Cryptographic Hash Function modelled as truly random function”

• (Simple) proofs ✅
• Strong security properties ✅
• Short, full secure signatures [BLS01, BB04]
• Short, full secure ID-KEMs [BF01, BB04]
• Unclear security guarantees for implementations [CGH02] ❌
• Unclear which security property required ❌

f

Looking for reasonable complexity assumption on standard Cryptographic Hash Functions to avoid ROM

6

Problem of turning selective into adaptive security

Selective Adversary Adaptive Adversary pk

7

M*

Problem of turning selective into adaptive security

M* ← 0,1 %

Selective Adversary Adaptive Adversary pk

8

M* pk

Problem of turning selective into adaptive security

M* ← 0,1 %

Selective Adversary Adaptive Adversary pk

9

M* pk 𝑛'

Problem of turning selective into adaptive security

M* ← 0,1 %

𝜏 '

Selective Adversary Adaptive Adversary pk (m*, 𝜏*)

10

M* pk 𝑛' 𝜏*

Problem of turning selective into adaptive security

M* ← 0,1 %

𝜏 '

Selective Adversary Adaptive Adversary pk (m*, 𝜏*)

11

M* pk 𝑛' 𝜏*

Problem of turning selective into adaptive security

M* ← 0,1 %

𝜏 '

M* = m* M* ≠ 𝑛' ∀ 𝑗

Selective Adversary Adaptive Adversary pk (m*, 𝜏*)

12

M* pk 𝑛' 𝜏*

Problem of turning selective into adaptive security

M* ← 0,1 % ROM: 𝜁/01023'40≈ 𝑞𝑝𝑚𝑧(𝑙)=> ? 𝜁@A@B3'40

𝜏 '

Standard: 𝜁C01023'40≈ 2=% ? 𝜁@A@B3'40

Collision Resistance

13

Collision Resistance

14

A Hash function H is Collision Resistant if

Pr[ A finds collision ] < negl(k)

for all ppt adversaries A.

Truncation Collision Resistance

15

Truncation Collision Resistance

16

A Hash function H is Truncation-Collision Resistant if

Pr[ A finds collision for prefix of length i ] <

3(3=>) EFGH

for all probabilistic t-time adversaries A.

Truncation Collision Resistance

17

A Hash function H is Truncation-Collision Resistant if

Pr[ A finds collision for prefix of length i ] <

3(3=>) EFGH

for all probabilistic t-time adversaries A.

(Related to birthday bound)

Main property

18

H(x)= 1010011000111000111101110011001101100010

Main property

19

H(x)= 1010011000111000111101110011001101100010

Easier to guess

Main property

20

H(x)= 1010011000111000111101110011001101100010

Easier to guess More collision resistant

Main property

21

H(x)= 1010011000111000111101110011001101100010

Easier to guess More collision resistant

For every adversary A there exists a prefix length j s.t.

Collision Resistant Easy to guess Length j

Generic construction

from selective to adaptive secure signatures without ROM

22

Generic construction

from selective to adaptive secure signatures without ROM

23

H( ? ) 𝐼>(m) 𝐼E(m) 𝐼EJKL M(m) m 𝐼EN(m)

𝐼' Prefix of length i H Tru-CR

Generic construction

from selective to adaptive secure signatures without ROM

24

H( ? ) 𝐼>(m) 𝐼E(m) 𝐼EJKL M(m) Sig(𝑡𝑙>, ? )

𝜏 = (𝜏 >,..,𝜏 PQR %)

m 𝐼EN(m) Sig(𝑡𝑙S, ? ) Sig(𝑡𝑙E, ? ) Sig(𝑡𝑙PQR %, ? )

𝐼' Prefix of length i H Tru-CR Sig selective secure

25

Proof sketch

Selective Adversary Adaptive Adversary

26

Proof sketch

Breaking weak scheme with message length j

Selective Adversary Adaptive Adversary pk*

27

pk=(𝑞𝑙S,..., pk*,…)

Proof sketch

M* ← 0,1 T M* (𝑞𝑙', 𝑡𝑙') ← 𝐿𝑓𝑧𝐻𝑓𝑜

Selective Adversary Adaptive Adversary pk*

28

pk=(𝑞𝑙S,..., pk*,…) m 𝜏 = (𝜏 S, … , 𝜏

T, . . . )

Proof sketch

M* ← 0,1 T 𝜏 ' = Sig(𝑡𝑙' , 𝐼EF(m)) 𝐼

T(m)

𝜏 T

M* (𝑞𝑙', 𝑡𝑙') ← 𝐿𝑓𝑧𝐻𝑓𝑜

Selective Adversary Adaptive Adversary pk* m*, 𝜏* = (𝜏S

∗, … , 𝜏 T ∗, …)

29

pk=(𝑞𝑙S,..., pk*,…) m 𝜏 = (𝜏 S, … , 𝜏

T, . . . )

𝜏

T ∗

Proof sketch

M* ← 0,1 T 𝜏 ' = Sig(𝑡𝑙' , 𝐼EF(m)) 𝐼

T(m)

𝜏 T

M* (𝑞𝑙', 𝑡𝑙') ← 𝐿𝑓𝑧𝐻𝑓𝑜

Selective Adversary Adaptive Adversary pk* m*, 𝜏* = (𝜏S

∗, … , 𝜏 T ∗, …)

30

pk=(𝑞𝑙S,..., pk*,…) m 𝜏 = (𝜏 S, … , 𝜏

T, . . . )

𝜏

T ∗

Proof sketch

M* ← 0,1 T 𝜏 ' = Sig(𝑡𝑙' , 𝐼EF(m)) 𝐼

T(m)

𝜏 T

M*

f

Truncation-CR: Guess of 𝐼

T(m*)? ✅

No collision? ✅

(𝑞𝑙', 𝑡𝑙') ← 𝐿𝑓𝑧𝐻𝑓𝑜

In this talk

• Turning weak secure Digital Signature scheme into full secure

without ROM In the paper

• From “selective and non-adaptive” to full adaptive security
• Same approach for ID-KEM
• Single element constructions due to aggregation of Boneh

and Boyen signature scheme (ID-KEM resp.):

31

σ = ⇣ g

1 x0+H1(m)

⌘Qlog k

i=1 1 xi+H2i (m)

Truncation-CR assumption

• Truncated versions of SHA-256 and SHA-512 have been standardized

by NIST (224 or 384 bits)

• SHA-3 standard defines extendable-output-functions (XOFs), where
• utput length can be adapted to any desired length
• Standard way to choose hash function with “k-bit security”: 2k-bit
• utput length.
• essentially assuming: no significantly better collision attack than generic

birthday algorithm exists

32

Truncation-CR generalizes to all prefixes

Contributions

• Construction of Tru-CR Hash Function (sketch in full version)
• Further useful applications

33

Future work

• New security notion for standard Hash Functions
• Truncation-Collision Resistance
• New Digital Signature scheme and ID-KEM
• From selective to full security in Standard Model
• Solving open problem: single element in prime order group

34

Thank you for your attention!

eprint.iacr.org/2017/061

35

Related work

• Oracle Hashing [Canetti, CRYPTO 1997]
• Programmable HF [Hofheinz and Kiltz, CRYPTO 2008]
• UCE [Bellare et al., CRYPTO 2013]
• ICE [Farshim and Mittelbach, FSE 2016]
• ELF [Zhandry, CRYPTO 2016]

36