[PPT] - The Discrete Logarithm Problem with Preprocessing Henry PowerPoint Presentation

SLIDE 1

The Discrete Logarithm Problem with Preprocessing

Henry Corrigan-Gibbs and Dmitry Kogan Stanford University

Eurocrypt – 1 May 2018 Tel Aviv, Israel

SLIDE 2

38

SLIDE 3

Signatures

(DSA and Schnorr)

39

SLIDE 4

Signatures

(DSA and Schnorr)

DH key exchange

40

SLIDE 5

Signatures

(DSA and Schnorr)

DH key exchange DDH

41

SLIDE 6

Signatures

(DSA and Schnorr)

DH key exchange DDH Pairings

42

SLIDE 7

The discrete-log problem

Group: ! = #

f prime order $

Instance: #% ∈ ! Solution: ' ∈ ℤ) Adversary *

43

SLIDE 8

The discrete-log problem

Group: ! = #

f prime order $

Instance: #% ∈ ! Solution: ' ∈ ℤ) Adversary * Why do we believe this problem is hard?

44

SLIDE 9

Generic lower bounds give us confidence

Th

Theorem. [Shoup’97] Every ge

generic discrete-log algorithm that

operates in a group of prime order ! and
succeeds with probability at least ½

must run in time Ω(!%/').

45

SLIDE 10

Generic lower bounds give us confidence

Th

Theorem. [Shoup’97] Every ge

generic discrete-log algorithm that

operates in a group of prime order ! and
succeeds with probability at least ½

must run in time Ω(!%/').

Generic attack in 256-bit group takes ≈ 2%'+ time.

46

SLIDE 11

Generic lower bounds give us confidence

Th

Theorem. [Shoup’97] Every ge

generic discrete-log algorithm that

operates in a group of prime order ! and
succeeds with probability at least ½

must run in time Ω(!%/').

Generic attack in 256-bit group takes ≈ 2%'+ time.

47

Best attacks on standard EC groups are generic

SLIDE 12

Generic algorithms can only make “black-box” use of the group operation

Ge Generic-gr group up model del:

Group is defined by an injective “l

“lab abeling” function

!: ℤ$ → 0,1 ∗

Algorithm has access to a gr

group up-op

peration
n or
racle:

*+ ! , , ! - ↦ ! , + -

Generic dlog algorithm takes as input ! 1 , ! 0 , representing (2, 23), make queries to *+, outputs 0.

[Measure running time by query complexity]

48 [Nechaev’94], [Shoup’97], [Maurer’05]

SLIDE 13

Generic algorithms can only make “black-box” use of the group operation

Ge Generic-gr group up model del:

Group is defined by an injective “l

“lab abeling” function

!: ℤ$ → 0,1 ∗

Algorithm has access to a gr

group up-op

peration
n or
racle:

*+ ! , , ! - ↦ ! , + -

Generic dlog algorithm takes as input ! 1 , ! 0 , representing (2, 23), make queries to *+, outputs 0.

[Measure running time by query complexity]

49 [Nechaev’94], [Shoup’97], [Maurer’05]

Very useful way to understand hardness

[BB04,B05,M05,D06, B08,Y15,…]

SLIDE 14

Existing generic lower bounds do do not account fo for preprocessing

Premise of generic-group model: the adversary kno

knows s no nothi hing ng about the structure of the group ! in advance

In reality: the adversary knows a lot about !!

Ø ! is one of a small number of groups: NIST P-256, Curve25519, …

A realistic adversary can perform !-specific preprocessing!
Existing generic-group lower bounds say nothing about

preprocessing attacks! [H80, Yao90, FN91, …]

50

SLIDE 15

Existing generic lower bounds do do not account fo for preprocessing

Premise of generic-group model: the adversary kno

knows s no nothi hing ng about the structure of the group ! in advance

In reality: the adversary knows a lot about !!

Ø ! is one of a small number of groups: NIST P-256, Curve25519, …

A realistic adversary can perform !-specific preprocessing!
Existing generic-group lower bounds say nothing about

preprocessing attacks! [H80, Yao90, FN91, …]

51

SLIDE 16

Existing generic lower bounds do do not account fo for preprocessing

Premise of generic-group model: the adversary kno

knows s no nothi hing ng about the structure of the group ! in advance

In reality: the adversary knows a lot about !!

Ø ! is one of a small number of groups: NIST P-256, Curve25519, …

A realistic adversary can perform !-specific preprocessing!
Existing generic-group lower bounds say nothing about

preprocessing attacks! [H80, Yao90, FN91, …]

52

SLIDE 17

Existing generic lower bounds do do not account fo for preprocessing

Premise of generic-group model: the adversary kno

knows s no nothi hing ng about the structure of the group ! in advance

In reality: the adversary knows a lot about !!

Ø ! is one of a small number of groups: NIST P-256, Curve25519, …

A realistic adversary can perform !-specific preprocessing!
Existing generic-group lower bounds say nothing about

preprocessing attacks! [H80, Yao90, FN91, …]

53

SLIDE 18

!" !# Preprocessing phase

Group: $ = & Advice: '($ Solution: ) ∈ ℤ, Instance: &- ∈ $

Online phase

Initiated by Hellman (1980) in context of OWFs

54

SLIDE 19

!" !# Preprocessing phase

Group: $ = & Advice: '($ Solution: ) ∈ ℤ, Instance: &- ∈ $

Online phase

Initiated by Hellman (1980) in context of OWFs

Both algorithms are generic! Both algorithms are generic!

55

SLIDE 20

!" !# Preprocessing phase

Group: $ = & Advice: '($ Solution: ) ∈ ℤ, Instance: &- ∈ $

Online phase

56

Initiated by Hellman (1980) in context of OWFs

SLIDE 21

!" !# Preprocessing phase

Group: $ = & Advice: '($ Solution: ) ∈ ℤ, Instance: &- ∈ $

Online phase

Preprocessing time .

57

Initiated by Hellman (1980) in context of OWFs

SLIDE 22

!" !# Preprocessing phase

Group: $ = & Advice: '($ Solution: ) ∈ ℤ, Instance: &- ∈ $

Online phase

Advice size . Preprocessing time /

58

Initiated by Hellman (1980) in context of OWFs

SLIDE 23

!" !# Preprocessing phase

Group: $ = & Advice: '($ Solution: ) ∈ ℤ, Instance: &- ∈ $

Online phase

Advice size . Online time / Preprocessing time 0

59

Initiated by Hellman (1980) in context of OWFs

SLIDE 24

!" !# Preprocessing phase

Group: $ = & Advice: '($ Solution: ) ∈ ℤ, Instance: &- ∈ $

Online phase

Advice size . Online time / Preprocessing time 0 Success prob. 1

60

Initiated by Hellman (1980) in context of OWFs

SLIDE 25

Rest of this talk

Background: Preprocessing attacks are relevant

Preexisting ! = # = $

%('(/*) generic attack on discrete log

Our results: Preprocessing lower-bounds and attacks

The $

%('(/*) generic dlog attack is optimal

Any such attack must use lots of preprocessing: Ω('-/*)
New $

%('(/.) preprocessing attack on DDH-like problem

Open questions

61

SLIDE 26

Rest of this talk

Background: Preprocessing attacks are relevant

Preexisting ! = # = $

%('(/*) generic attack on discrete log

Our results: Preprocessing lower-bounds and attacks

The $

%('(/*) generic dlog attack is optimal

Any such attack must use lots of preprocessing: Ω('-/*)
New $

%('(/.) preprocessing attack on DDH-like problem

Open questions

62

SLIDE 27

Th

Theorem. [Mihalcik 2010] [Lee, Cheon, Hong 2011] [Bernstein and Lange 2013]

There is a generic dlog algorithm with preprocessing that:

uses ! bits of group-specific advice,
uses " online time, and
succeeds with probability #,

such that: !"$ = & '(#))

63

A preexisting result…

…. building on prior work on multiple-discrete-log algorithms [ESST99,KS01,HMCD04,BL12]

SLIDE 28

Th

Theorem. [Mihalcik 2010] [Lee, Cheon, Hong 2011] [Bernstein and Lange 2013]

There is a generic dlog algorithm with preprocessing that:

uses ! bits of group-specific advice,
uses " online time, and
succeeds with probability #,

such that: !"$ = & '(#))

Will sketch the algorithm for ! = " = )+/-, constant #.

64

A preexisting result…

…. building on prior work on multiple-discrete-log algorithms [ESST99,KS01,HMCD04,BL12]

SLIDE 29

Th

Theorem. [Mihalcik 2010] [Lee, Cheon, Hong 2011] [Bernstein and Lange 2013]

There is a generic dlog algorithm with preprocessing that:

uses ! bits of group-specific advice,
uses " online time, and
succeeds with probability #,

such that: !"$ = & '(#))

65

A preexisting result…

…. building on prior work on multiple-discrete-log algorithms [ESST99,KS01,HMCD04,BL12]

SLIDE 30

SLIDE 37

Preliminaries

Define a pseudo-random walk on !:

"# ↦ "#%&

where ' = Hash "# is a random function

"# "#%&) "#%∑+ &+ "#%&)%&,

…

= -.

73

/

If you know the dlog of the endpoint of a walk, you know the dlog of the starting point!

[M10, LCH11, BL13]

SLIDE 38

Preliminaries

Define a pseudo-random walk on !:

"# ↦ "#%&

where ' = Hash "# is a random function

"# "#%&) "#%∑+ &+ "#%&)%&,

…

79

/

…

If you know the dlog of the endpoint of a walk, you know the dlog of the starting point!

[M10, LCH11, BL13]

SLIDE 44

Advice string

!"/$ chains Length: !"/$

…

Preprocessing phase

Build !"/$ chains of

length !"/$

Store dlogs of chain

endpoints Online phase

Walk %(!"/$) steps
When you hit a

stored point, output the discrete log

…

80

[M10, LCH11, BL13]

SLIDE 45

Advice string

!"/$ chains Length: !"/$

…

Preprocessing phase

Build !"/$ chains of

length !"/$

Store dlogs of chain

endpoints Online phase

Walk %(!"/$) steps
When you hit a

stored point, output the discrete log

Advice: ( %(!"/$) bits

…

81

[M10, LCH11, BL13]

SLIDE 46

Advice string

!"/$ chains Length: !"/$

…

Preprocessing phase

Build !"/$ chains of

length !"/$

Store dlogs of chain

endpoints Online phase

Walk %(!"/$) steps
When you hit a

stored point, output the discrete log

Advice: ( %(!"/$) bits

…

82

[M10, LCH11, BL13]

SLIDE 47

Advice string

!"/$ chains Length: !"/$

…

Preprocessing phase

Build !"/$ chains of

length !"/$

Store dlogs of chain

endpoints Online phase

Walk %(!"/$) steps
When you hit a

stored point, output the discrete log

Advice: ( %(!"/$) bits

…

)*

83

[M10, LCH11, BL13]

SLIDE 48

Advice string

!"/$ chains Length: !"/$

…

Preprocessing phase

Build !"/$ chains of

length !"/$

Store dlogs of chain

endpoints Online phase

Walk %(!"/$) steps
When you hit a

stored point, output the discrete log

Advice: ( %(!"/$) bits

…

)*

84

[M10, LCH11, BL13]

SLIDE 49

Advice string

!"/$ chains Length: !"/$

…

Preprocessing phase

Build !"/$ chains of

length !"/$

Store dlogs of chain

endpoints Online phase

Walk %(!"/$) steps
When you hit a

stored point, output the discrete log

Advice: ( %(!"/$) bits

…

)*

85

[M10, LCH11, BL13]

SLIDE 50

Advice string

!"/$ chains Length: !"/$

…

Preprocessing phase

Build !"/$ chains of

length !"/$

Store dlogs of chain

endpoints Online phase

Walk %(!"/$) steps
When you hit a

stored point, output the discrete log

Advice: ( %(!"/$) bits

…

)*

86

[M10, LCH11, BL13]

SLIDE 51

Advice string

!"/$ chains Length: !"/$

…

Preprocessing phase

Build !"/$ chains of

length !"/$

Store dlogs of chain

endpoints Online phase

Walk %(!"/$) steps
When you hit a

stored point, output the discrete log

Advice: ( %(!"/$) bits Time: ( %(!"/$) steps

…

)*

87

[M10, LCH11, BL13]

SLIDE 52

Advice string

!"/$ chains Length: !"/$

…

Preprocessing phase

Build !"/$ chains of

length !"/$

Store dlogs of chain

endpoints Online phase

Walk %(!"/$) steps
When you hit a

stored point, output the discrete log

Advice: ( %(!"/$) bits Time: ( %(!"/$) steps

…

)*

88

Preprocessing time: + Ω(!-/$)

[M10, LCH11, BL13]

SLIDE 53

Generic discrete log à Without preprocessing: Ω "#/%

&'&( ti time

à With preprocessing: ) *("#/,)

&(. ti time

Related preprocessing attacks break:

Multiple discrete log problem

[This paper]

One-round Even-Mansour cipher

[FJM14]

Merkle-Damgård hash with random IV

[CDGS17]

“

25 256-bi bit ECDL

89

SLIDE 54

Generic discrete log à Without preprocessing: Ω "#/%

&'&( ti time

à With preprocessing: ) *("#/,)

&(. ti time

Related preprocessing attacks break:

Multiple discrete log problem

[This paper]

One-round Even-Mansour cipher

[FJM14]

Merkle-Damgård hash with random IV

[CDGS17] 25 256-bi bit ECDL

90

SLIDE 55

Generic discrete log à Without preprocessing: Ω "#/%

&'&( ti time

à With preprocessing: ) *("#/,)

&(. ti time

Related preprocessing attacks break:

Multiple discrete log problem

[This paper]

One-round Even-Mansour cipher

[FJM14]

Merkle-Damgård hash with random IV

[CDGS17] Is this dlog attack the best possible?! 25 256-bi bit ECDL

91

SLIDE 56

Generic discrete log à Without preprocessing: Ω "#/%

&'&( ti time

à With preprocessing: ) *("#/,)

&(. ti time

Related preprocessing attacks break:

Multiple discrete log problem

[This paper]

One-round Even-Mansour cipher

[FJM14]

Merkle-Damgård hash with random IV

[CDGS17] 25 256-bi bit ECDL

92

SLIDE 57

Signatures

(DSA and Schnorr)

DH key exchange DDH Pairings

93

SLIDE 58

Signatures

(DSA and Schnorr)

DH key exchange DDH Pairings

Could there exist a generic dlog preprocessing attack with ! = # = $%/%'?

94

SLIDE 59

Signatures

(DSA and Schnorr)

DH key exchange DDH Pairings

Could there exist a generic dlog preprocessing attack with ! = # = $%/%'?

Preprocessing attacks might make us worry about 256-bit EC groups95

SLIDE 60

96

SLIDE 61

This talk

Background: Preprocessing attacks are relevant

Preexisting ! = # = $

%('(/*) generic attack on discrete log

Our results: Preprocessing lower-bounds and attacks

The $

%('(/*) generic dlog attack is optimal

Any such attack must use lots of preprocessing: Ω('-/*)
New $

%('(/.) preprocessing attack on DDH-like problem

Open questions

97

SLIDE 62

Th

Theorem. [Our paper]

Every generic dlog algorithm with preprocessing that:

uses ! bits of group-specific advice,
uses " online time, and
succeeds with probability #,

must satisfy: !"$ = & Ω(#))

98

SLIDE 63

Th

Theorem. [Our paper]

Every generic dlog algorithm with preprocessing that:

uses ! bits of group-specific advice,
uses " online time, and
succeeds with probability #,

must satisfy: !"$ = & Ω(#))

This bound is tight for the full range of parameters (up to log factors)

99

SLIDE 64

Th

Theorem. [Our paper]

Every generic dlog algorithm with preprocessing that:

uses ! bits of group-specific advice,
uses " online time, and
succeeds with probability #,

must satisfy: !"$ = & Ω(#))

100

SLIDE 65

Th

Theorem. [Our paper]

Every generic dlog algorithm with preprocessing that:

uses ! bits of group-specific advice,
uses " online time, and
succeeds with probability #,

must satisfy: !"$ = & Ω(#))

101

Shoup’s proof technique (1997) relies on + having no information about the group , when it starts running à Need different proof technique

SLIDE 66

Th

Theorem. [Our paper]

Every generic dlog algorithm with preprocessing that:

uses ! bits of group-specific advice,
uses " online time, and
succeeds with probability #,

must satisfy: !"$ = & Ω(#))

102

SLIDE 67

Th

Theorem. [Our paper]

Furthermore, the preprocessing time ! must satisfy !" + "$ = Ω(()) Th

Theorem. [Our paper]

Every generic dlog algorithm with preprocessing that:

uses + bits of group-specific advice,
uses " online time, and
succeeds with probability (,

must satisfy: +"$ = , Ω(())

103

SLIDE 68

Th

Theorem. [Our paper]

Furthermore, the preprocessing time ! must satisfy !" + "$ = Ω(()) Th

Theorem. [Our paper]

Every generic dlog algorithm with preprocessing that:

uses + bits of group-specific advice,
uses " online time, and
succeeds with probability (,

must satisfy: +"$ = , Ω(())

104

Online time )-// implies Ω()$//) preprocessing

SLIDE 69

Th

Theorem. [Our paper]

Furthermore, the preprocessing time ! must satisfy !" + "$ = Ω(()) Th

Theorem. [Our paper]

Every generic dlog algorithm with preprocessing that:

uses + bits of group-specific advice,
uses " online time, and
succeeds with probability (,

must satisfy: +"$ = , Ω(())

105

SLIDE 70

Reminder: Generic-group model

A group is defined by an injective “l

“lab abeling” function

!: ℤ$ → 0,1 ∗

Algorithm has access to a gr

group up-op

peration
n or
racle:

*+ ! , , ! - ↦ ! , + -

E.g., A dlog algorithm takes as input ! 1 , ! 0 , representing (2, 23), make queries to *+, outputs 0.

106

SLIDE 71

We prove the lower bound using an incompressibility argument

Use ! to compress the mapping ": ℤ% → 0,1 ∗ that defines the group

Adv ! uses advice + and online time , such that +,- = /(1)

⇒ Encoder compresses well

Random string is incompressible

⇒ Lower bound on + and ,

Encoder Decoder

Enc(") ! !

Compressed representation

[Yao90, GT00, DTT10, DHT12, DGK17…]

107

(Random)

4 "(4) 1 101 2 110 3 001 … 4 "(4) 1 101 2 110 3 001 … Similar technique used in [DHT12]

SLIDE 72

We prove the lower bound using an incompressibility argument

Use ! to compress the mapping ": ℤ% → 0,1 ∗ that defines the group

Adv ! uses advice + and online time , such that +,- = /(1)

⇒ Encoder compresses well

Random string is incompressible

⇒ Lower bound on + and ,

Encoder Decoder

Enc(") ! !

Compressed representation

[Yao90, GT00, DTT10, DHT12, DGK17…]

108

(Random)

4 "(4) 1 101 2 110 3 001 … 4 "(4) 1 101 2 110 3 001 … Similar technique used in [DHT12]

SLIDE 73

We prove the lower bound using an incompressibility argument

Use ! to compress the mapping ": ℤ% → 0,1 ∗ that defines the group

Adv ! uses advice + and online time , such that +,- = /(1)

⇒ Encoder compresses well

Random string is incompressible

⇒ Lower bound on + and ,

Encoder Decoder

Enc(") ! !

Compressed representation

[Yao90, GT00, DTT10, DHT12, DGK17…]

109

(Random)

4 "(4) 1 101 2 110 3 001 … 4 "(4) 1 101 2 110 3 001 … Similar technique used in [DHT12]

SLIDE 74

We prove the lower bound using an incompressibility argument

Use ! to compress the mapping ": ℤ% → 0,1 ∗ that defines the group

Adv ! uses advice + and online time , such that +,- = /(1)

⇒ Encoder compresses well

Random string is incompressible

⇒ Lower bound on + and ,

Encoder Decoder

Enc(") ! !

Compressed representation

[Yao90, GT00, DTT10, DHT12, DGK17…]

110

(Random)

4 "(4) 1 101 2 110 3 001 … 4 "(4) 1 101 2 110 3 001 …

Wlog, assume ! is deterministic

Similar technique used in [DHT12]

SLIDE 75

We prove the lower bound using an incompressibility argument

Use ! to compress the mapping ": ℤ% → 0,1 ∗ that defines the group

Adv ! uses advice + and online time , such that +,- = /(1)

⇒ Encoder compresses well

Random string is incompressible

⇒ Lower bound on + and ,

Encoder Decoder

Enc(") ! !

Compressed representation

[Yao90, GT00, DTT10, DHT12, DGK17…]

111

(Random)

4 "(4) 1 101 2 110 3 001 … 4 "(4) 1 101 2 110 3 001 … Similar technique used in [DHT12]

SLIDE 76

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

& %(&) 1 101 2 110 3 001 4 000 5 1111 …

112

[Yao90, GT00, DHT12]

SLIDE 77

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

Compressed representation of %

& %(&) 1 101 2 110 3 001 4 000 5 1111 …

113

[Yao90, GT00, DHT12]

SLIDE 78

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

& %(&) 1 101 2 110 3 001 4 000 5 1111 …

114

[Yao90, GT00, DHT12]

SLIDE 79

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

& %(&) 1 101 2 110 3 001 4 000 5 1111 …

115

[Yao90, GT00, DHT12]

SLIDE 80

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

' %(') 1 101 2 110 3 001 4 000 5 1111 …

116

[Yao90, GT00, DHT12]

SLIDE 81

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

!$(000)

* %(*) 1 101 2 110 3 001 4 000 5 1111 …

117

[Yao90, GT00, DHT12]

SLIDE 82

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

!$(000)

* %(*) 1 101 2 110 3 001 4 000 5 1111 … First bitstring in image of %, representing some +,

118

[Yao90, GT00, DHT12]

SLIDE 83

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

!$(000)

* %(*) 1 101 2 110 3 001 4 000 5 1111 …

119

[Yao90, GT00, DHT12]

SLIDE 84

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

!$(000)

* %(*) 1 101 2 110 3 001 4 000 5 1111 …

120

[Yao90, GT00, DHT12]

SLIDE 85

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

!$(000)

Responses to !$’s queries on “000”

* %(*) 1 101 2 110 3 001 4 000 5 1111 …

121

[Yao90, GT00, DHT12]

SLIDE 86

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

!$(000)

Responses to !$’s queries on “000”

!$(001)

+ %(+) 1 101 2 110 3 001 4 000 5 1111 …

122

[Yao90, GT00, DHT12]

SLIDE 87

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

!$(000)

Responses to !$’s queries on “000”

!$(001)

+ %(+) 1 101 2 110 3 001 4 000 5 1111 …

123

[Yao90, GT00, DHT12]

SLIDE 88

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

!$(000)

Responses to !$’s queries on “000”

!$(001)

Responses to !$’s queries on “001”

+ %(+) 1 101 2 110 3 001 4 000 5 1111 …

124

[Yao90, GT00, DHT12]

SLIDE 89

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

!$(000)

Responses to !$’s queries on “000”

!$(001)

Responses to !$’s queries on “001”

… …

+ %(+) 1 101 2 110 3 001 4 000 5 1111 …

125

[Yao90, GT00, DHT12]

SLIDE 90

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

!$(000)

Responses to !$’s queries on “000”

!$(001)

Responses to !$’s queries on “001”

… …

Run !$ on + instances, for some parameter +

, %(,) 1 101 2 110 3 001 4 000 5 1111 …

126

[Yao90, GT00, DHT12]

SLIDE 91

Pr Proof

of idea:

a: Use preprocessing dlog adversary !", !$ to build a compressed representation of the mapping %. Encoder

!"

Compressed representation of %

st&

!$(000)

Responses to !$’s queries on “000”

!$(001)

Responses to !$’s queries on “001”

Rest of %

… …

Run !$ on + instances, for some parameter +

, %(,) 1 101 2 110 3 001 4 000 5 1111 …

127

[Yao90, GT00, DHT12]

SLIDE 92

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

128

[Yao90, GT00, DHT12]

SLIDE 93

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

129

[Yao90, GT00, DHT12]

SLIDE 94

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

130

[Yao90, GT00, DHT12]

SLIDE 95

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

" 2 = ?

131

[Yao90, GT00, DHT12]

SLIDE 96

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

" 2 = ? “110”

132

[Yao90, GT00, DHT12]

SLIDE 97

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

" 2 = ? “110”

133

[Yao90, GT00, DHT12]

SLIDE 98

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

134

[Yao90, GT00, DHT12]

SLIDE 99

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

" 5 = ?

135

[Yao90, GT00, DHT12]

SLIDE 100

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

" 5 = ? “111”

136

[Yao90, GT00, DHT12]

SLIDE 101

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

" 5 = ? “111”

137

[Yao90, GT00, DHT12]

SLIDE 102

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

" 5 = ? “111”

138

[Yao90, GT00, DHT12]

SLIDE 103

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

139

[Yao90, GT00, DHT12]

SLIDE 104

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

%((001)

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

140

[Yao90, GT00, DHT12]

SLIDE 105

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

%((001)

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

141

[Yao90, GT00, DHT12]

SLIDE 106

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

%((001)

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

" 1 = ?

142

[Yao90, GT00, DHT12]

SLIDE 107

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

%((001)

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

“101” " 1 = ?

143

[Yao90, GT00, DHT12]

SLIDE 108

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

%((001)

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

“101” " 1 = ?

144

[Yao90, GT00, DHT12]

SLIDE 109

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

%((001)

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

“101” " 1 = ?

145

[Yao90, GT00, DHT12]

SLIDE 110

! "(!) 1 101 2 110 3 001 4 000 5 1111 …

Pr Proof

of idea:

a: Use preprocessing dlog adversary %&, %( to build a compressed representation of the mapping ".

Compressed representation of "

st) Decoder

%((000)

110 111 … 101 …

Rest of "

…

%((001)

…

Run %( on - instances
Whenever %( outputs a

dlog, we get one value "(!) “for free”

“101” " 1 = ?

146

[Yao90, GT00, DHT12]

SLIDE 111

Easy case: The response to all of !"’s queries are distinct

!" outputs a discrete log “for free” ⇒

Compress by ≈ log ( bits

Harder case: The response to query ) is the same as the response to query )′ < ).

A naïve encoding “pays twice” for the same value ,(.) ⇒ No savings L
Instead, encoder writes a pointer to query )′

If the encoder runs !" on 0 instances, requires log 01 + log 1 bits.

147

Index of query ) Pointer to query )′

Cl Claim: m: Each invocation of !" allows the encoder to compress , by at least one bit.

[DHT12] treats a more difficult version of “hard case”

SLIDE 112

Easy case: The response to all of !"’s queries are distinct

!" outputs a discrete log “for free” ⇒

Compress by ≈ log ( bits

Harder case: The response to query ) is the same as the response to query )′ < ).

A naïve encoding “pays twice” for the same value ,(.) ⇒ No savings L
Instead, encoder writes a pointer to query )′

If the encoder runs !" on 0 instances, requires log 01 + log 1 bits.

148

Index of query ) Pointer to query )′

Cl Claim: m: Each invocation of !" allows the encoder to compress , by at least one bit.

[DHT12] treats a more difficult version of “hard case”

SLIDE 113

Easy case: The response to all of !"’s queries are distinct

!" outputs a discrete log “for free” ⇒

Compress by ≈ log ( bits

Harder case: The response to query ) is the same as the response to query )′ < ).

A naïve encoding “pays twice” for the same value ,(.) ⇒ No savings L
Instead, encoder writes a pointer to query )′

If the encoder runs !" on 0 instances, requires log 01 + log 1 bits.

149

Index of query ) Pointer to query )′

Cl Claim: m: Each invocation of !" allows the encoder to compress , by at least one bit.

[DHT12] treats a more difficult version of “hard case”

SLIDE 114

Easy case: The response to all of !"’s queries are distinct

!" outputs a discrete log “for free” ⇒

Compress by ≈ log ( bits

Harder case: The response to query ) is the same as the response to query )′ < ).

A naïve encoding “pays twice” for the same value ,(.) ⇒ No savings L
Instead, encoder writes a pointer to query )′

If the encoder runs !" on 0 instances, requires log 01 + log 1 bits.

150

Index of query ) Pointer to query )′

Cl Claim: m: Each invocation of !" allows the encoder to compress , by at least one bit.

[DHT12] treats a more difficult version of “hard case”

SLIDE 115

Easy case: The response to all of !"’s queries are distinct

!" outputs a discrete log “for free” ⇒

Compress by ≈ log ( bits

Harder case: The response to query ) is the same as the response to query )′ < ).

A naïve encoding “pays twice” for the same value ,(.) ⇒ No savings L
Instead, encoder writes a pointer to query )′

If the encoder runs !" on 0 instances, requires log 01 + log 1 bits.

151

Index of query ) Pointer to query )′

Cl Claim: m: Each invocation of !" allows the encoder to compress , by at least one bit.

[DHT12] treats a more difficult version of “hard case”

SLIDE 116

Easy case: The response to all of !"’s queries are distinct

!" outputs a discrete log “for free” ⇒

Compress by ≈ log ( bits

Harder case: The response to query ) is the same as the response to query )′ < ).

A naïve encoding “pays twice” for the same value ,(.) ⇒ No savings L
Instead, encoder writes a pointer to query )′

If the encoder runs !" on 0 instances, requires log 01 + log 1 bits.

152

Index of query ) Pointer to query )′

Each execution of 34 saves at least 1 bit, when: 567 89: < 567;, or 8 < ;/9:

Cl Claim: m: Each invocation of !" allows the encoder to compress , by at least one bit.

[DHT12] treats a more difficult version of “hard case”

SLIDE 117

Completing the proof

We run the adversary !" on # = %/'( instances
Each execution compresses by ≥ 1 bit
BUT, we have to include the )-bit advice string in the encoding

= ) − +

,- ≥ 0

⇒ )'( = Ω % ∎

153

Encoding

verhead

SLIDE 118

Extra complications

Algorithms that succeed on an !-fraction of group elements

Use the random self-reducibility of dlog Hardcode a good set of random coins for "# into En Enc $

Decisional type problems (DDH, etc.)

"# only outputs 1 bit—prior argument fails because encoding the runtime in log ( bits is too expensive Run "# on batches of inputs [See paper for details]

154

SLIDE 119

DDH problem: Distinguish !, !#, !$, !#$ from !, !#, !$, !% Up Upper bou

und

Lo Lower b bound Ti Time & Discrete log: '&( = * + ,- '&( = . Ω ,-

0/2

CDH: '&( = * + ,- '&( = . Ω ,-

0/2

DDH: '&( = * + ,- '&( = . Ω ,(- ≤ -0/2 ≥ -0/3 sqDDH: '&( = * + ,(- '&( = . Ω ,(-

0/3

What about Decision Diffie-Hellman (DDH)?

155

For , = -40/2 ' = -0/2

SLIDE 120

DDH problem: Distinguish !, !#, !$, !#$ from !, !#, !$, !% Up Upper bou

und

Lo Lower b bound Ti Time & Discrete log: '&( = * + ,- '&( = . Ω ,-

0/2

CDH: '&( = * + ,- '&( = . Ω ,-

0/2

DDH: '&( = * + ,- '&( = . Ω ,(- ≤ -0/2 ≥ -0/3 sqDDH: '&( = * + ,(- '&( = . Ω ,(-

0/3

What about Decision Diffie-Hellman (DDH)?

156

For , = -40/2 ' = -0/2

SLIDE 121

DDH problem: Distinguish !, !#, !$, !#$ from !, !#, !$, !% Up Upper bou

und

Lo Lower b bound Ti Time & Discrete log: '&( = * + ,- '&( = . Ω ,-

0/2

CDH: '&( = * + ,- '&( = . Ω ,-

0/2

DDH: '&( = * + ,- '&( = . Ω ,(- ≤ -0/2 ≥ -0/3 sqDDH: '&( = * + ,(- '&( = . Ω ,(-

0/3

What about Decision Diffie-Hellman (DDH)?

157

For , = -40/2 ' = -0/2

SLIDE 122

DDH problem: Distinguish !, !#, !$, !#$ from !, !#, !$, !% Up Upper bou

und

Lo Lower b bound Ti Time & Discrete log: '&( = * + ,- '&( = . Ω ,-

0/2

CDH: '&( = * + ,- '&( = . Ω ,-

0/2

DDH: '&( = * + ,- '&( = . Ω ,(- ≤ -0/2 ≥ -0/3 sqDDH: '&( = * + ,(- '&( = . Ω ,(-

0/3

What about Decision Diffie-Hellman (DDH)?

158

Better attack?

For , = -40/2 ' = -0/2

SLIDE 123

DDH problem: Distinguish !, !#, !$, !#$ from !, !#, !$, !% Up Upper bou

und

Lo Lower b bound Ti Time & Discrete log: '&( = * + ,- '&( = . Ω ,-

0/2

CDH: '&( = * + ,- '&( = . Ω ,-

0/2

DDH: '&( = * + ,- '&( = . Ω ,(- ≤ -0/2 ≥ -0/3 sqDDH: '&( = * + ,(- '&( = . Ω ,(-

0/3

What about Decision Diffie-Hellman (DDH)?

159

For , = -40/2 ' = -0/2

SLIDE 124

DDH problem: Distinguish !, !#, !$, !#$ from !, !#, !$, !% Up Upper bou

und

Lo Lower b bound Ti Time & Discrete log: '&( = * + ,- '&( = . Ω ,-

0/2

CDH: '&( = * + ,- '&( = . Ω ,-

0/2

DDH: '&( = * + ,- '&( = . Ω ,(- ≤ -0/2 ≥ -0/3 sqDDH: '&( = * + ,(- '&( = . Ω ,(-

0/3

What about Decision Diffie-Hellman (DDH)?

160

For , = -40/2 ' = -0/2

SLIDE 125

DDH problem: Distinguish !, !#, !$, !#$ from !, !#, !$, !% Up Upper bou

und

Lo Lower b bound Ti Time & Discrete log: '&( = * + ,- '&( = . Ω ,-

0/2

CDH: '&( = * + ,- '&( = . Ω ,-

0/2

DDH: '&( = * + ,- '&( = . Ω ,(- ≤ -0/2 ≥ -0/3 sqDDH: '&( = * + ,(- '&( = . Ω ,(-

0/3

What about Decision Diffie-Hellman (DDH)?

161

Our new results Our new results

For , = -40/2 ' = -0/2

SLIDE 126

De

Definition. The sqDDH problem is to distinguish

!, !#, ! #$ from !, !#, !%

for &, ' ←) ℤ+.

Why it’s interesting:

For generic online-only algs,

it’s as hard as discrete log

For generic preprocesssing algs,

we show that it’s “much easier” à A DDH-like problem that is easier than dlog

162

SLIDE 127

De

Definition. The sqDDH problem is to distinguish

!, !#, ! #$ from !, !#, !%

for &, ' ←) ℤ+.

Why it’s interesting:

For generic online-only algs,

it’s as hard as discrete log

For generic preprocesssing algs,

we show that it’s “much easier” à A DDH-like problem that is easier than dlog

163

SLIDE 128

De

Definition. The sqDDH problem is to distinguish

!, !#, ! #$ from !, !#, !%

for &, ' ←) ℤ+.

Why it’s interesting:

For generic online-only algs,

it’s as hard as discrete log

For generic preprocesssing algs,

we show that it’s “much easier” à A DDH-like problem that is easier than dlog

164

SLIDE 129

De

Definition. The sqDDH problem is to distinguish

!, !#, ! #$ from !, !#, !%

for &, ' ←) ℤ+.

Why it’s interesting:

For generic online-only algs,

it’s as hard as discrete log

For generic preprocesssing algs,

we show that it’s “much easier” à A DDH-like problem that is easier than dlog

165

SLIDE 130

This talk

Background: Preprocessing attacks are relevant

Preexisting ! = # = $

%('(/*) generic attack on discrete log

Our results: Preprocessing lower-bounds and attacks

The $

%('(/*) generic dlog attack is optimal

Any such attack must use lots of preprocessing: Ω('-/*)
New $

%('(/.) preprocessing attack on DDH-like problem

Open questions

166

SLIDE 131

Open questions and recent progress

Tightness of DDH upper/lower bounds?
Is it as hard as dlog or as easy as sqDDH?
Non-generic preprocessing attacks on ECDL?
As we have for ℤ"

∗

Coretti, Dodis, and Guo (2018)

Elegant proofs of generic-group lower bounds using “presampling”

(à la Unruh, 2007)

Prove hardness of “one-more” dlog, KEA assumptions, …

167

SLIDE 132

This talk

Background: Preprocessing attacks are relevant

Preexisting ! = # = $

%('(/*) generic attack on discrete log

Our results: Preprocessing lower-bounds and attacks

The $

%('(/*) generic dlog attack is optimal

Any such attack must use lots of preprocessing: Ω('-/*)
New $

%('(/.) preprocessing attack on DDH-like problem

Open questions

168

SLIDE 133

This talk

Background: Preprocessing attacks are relevant

Preexisting ! = # = $

%('(/*) generic attack on discrete log

Our results: Preprocessing lower-bounds and attacks

The $

%('(/*) generic dlog attack is optimal

Any such attack must use lots of preprocessing: Ω('-/*)
New $

%('(/.) preprocessing attack on DDH-like problem

Open questions

169

Henry – henrycg@cs.stanford.edu Dima – dkogan@cs.stanford.edu https://eprint.iacr.org/2017/1113

SLIDE 134