Tightly-Secure Signatures from Chameleon Hash Functions NIST, - - PowerPoint PPT Presentation

▶
tightly secure signatures from chameleon hash functions
SMART_READER_LITE
LIVE PREVIEW

Tightly-Secure Signatures from Chameleon Hash Functions NIST, - - PowerPoint PPT Presentation

May 06, 2023 277 likes •735 views

Tightly-Secure Signatures from Chameleon Hash Functions NIST, Maryland , PKC 2015 Olivier Blazy 1 , Saqib A. Kakvi 2 , Eike Kiltz 2 , Jiaxin Pan 2 1 University of Limoges, France 2 Ruhr University Bochum, Germany Keywords 1. Signatures 2. Tight

slide-1
SLIDE 1

Tightly-Secure Signatures from Chameleon Hash Functions

NIST, Maryland, PKC 2015 Olivier Blazy1, Saqib A. Kakvi2, Eike Kiltz2, Jiaxin Pan2

1University of Limoges, France 2Ruhr University Bochum, Germany

slide-2
SLIDE 2

Keywords

  • 1. Signatures
  • 2. Tight Security
  • 3. Chameleon Hash

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 2/30

slide-3
SLIDE 3

Signature

⊲ (pk, sk) ←$ Gen ⊲ σ ←$ Sign(sk, M) ⊲ 0/1 ← Ver(pk, M, σ) Correctness: ∀(pk, sk) ←$ Gen, Ver(pk, M, Sign(sk, M)) = 1

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 3/30

slide-4
SLIDE 4

UF-CMA Security

Challenger (pk, sk) ←$ Gen pk Mi σi ←$ Sign(sk, Mi) σi (M, σ) Adversary wins: Ver(pk, M, σ) = 1 ∧M / ∈ {M1, . . . , MQ} Adversary Q is the number of signing queries.

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 4/30

slide-5
SLIDE 5

Provable Security

DLOG

g, A ←$ G

a ∈ Zp A = ga Reduction Adversary

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 5/30

slide-6
SLIDE 6

Provable Security

DLOG

g, A ←$ G

a ∈ Zp A = ga Reduction Adversary “DLOG problem is hard ⇒ scheme is secure”

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 5/30

slide-7
SLIDE 7

◮ Let k be the security parameter, Adv[Sig] < f(k) · Adv[DLOG]

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 6/30

slide-8
SLIDE 8

Tight Security

Adv[Sig] < f(k) · Adv[DLOG] ◮ “Tight” if

f(k) = O(1)

◮ “Loose” if

f(k) = O(Q)

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 7/30

slide-9
SLIDE 9

Why “tight”?

◮ In practice:

  • We want efficient schemes!
  • Smaller security parameters!

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 8/30

slide-10
SLIDE 10

For example

◮ We want 80-bit security and Q = 240

Tight scheme

⊲ Adv[Sig] < Adv[DLOG] < 2−80 = ⇒ We need DLOG problem with 80-bit security = ⇒ |p| = 160 (by the best DLOG attack)

Loose Scheme

⊲ Adv[Sig] < 240 · Adv[DLOG] < 2−80 = ⇒ Adv[DLOG] < 2−120 = ⇒ We need DLOG problem with 120-bit security = ⇒ |p| = 240 (by the best DLOG attack)

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 9/30

slide-11
SLIDE 11

Signatures in the Standard Model

◮ Loose Reduction

  • e.g. Waters ’05

◮ Non-standard/“Q-Type” Assumptions

  • e.g. Boneh-Boyen ’04

◮ Exceptions: . . .

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 10/30

slide-12
SLIDE 12

Tight Signatures from Standard Assumptions

◮ CRYPTO ’96 Cramer-Damgård: RSA ◮ PKC ’05 Catalano-Gennaro: Factoring ◮ CRYPTO ’12 Hofheinz-Jager: DLIN

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 11/30

slide-13
SLIDE 13

Tight Signatures from Standard Assumptions

◮ CRYPTO ’96 Cramer-Damgård: RSA ◮ PKC ’05 Catalano-Gennaro: Factoring ◮ CRYPTO ’12 Hofheinz-Jager: DLIN

Question

Generic constructions for tight signatures?

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 11/30

slide-14
SLIDE 14

Our Contribution

Transformation DLOG SIS CDH DLIN RSA . . . TSIG[DLOG] TSIG[SIS] TSIG[CDH] TSIG[DLIN] TSIG[RSA] TSIG[. . .]

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 12/30

slide-15
SLIDE 15

Our Contribution

DLOG SIS FAC . . . Chameleon Hash Two-Tier Signature Tight Signature

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 13/30

slide-16
SLIDE 16

Our Contribution

DLOG SIS FAC . . . Chameleon Hash Two-Tier Signature Tight Signature [BS07]

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 13/30

slide-17
SLIDE 17

Two-Tier Signature

◮ Proposed by Bellare and Shoup at PKC ’07

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 14/30

slide-18
SLIDE 18

Two-Tier Signature

Signature ◮ (pk, sk) ←$ Gen ◮ σ ←$ Sign(sk, M) ◮ 0/1 ← Ver(pk, M, σ) Two-Tier Signature ◮ (ppk, psk) ←$ PrimaryGen ◮ (spk, ssk) ←$ SecondaryGen ◮ σ ←$ TTSign(sk, ssk, M) ◮ 0/1 ← TTVer(pk, spk, M, σ)

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 15/30

slide-19
SLIDE 19

Security of two-tier signature

Challenger (ppk, psk) ←$ PrimaryGen pk Mi (spki, sski) ←$ SecondaryGen σi ←$ TTSign(sk, sski, Mi) (σi, spki) (M, σ, spk) Adversary wins: TTVer(ppk, spk, M, σ) = 1 ∧ M / ∈ {M1, . . . , MQ} ∧ spk = spki for some i Adversary

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 16/30

slide-20
SLIDE 20

Two-Tier Signature → Standard Signature

. . . . . . . . . . . . . . . . . . . . . . . .

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 17/30

slide-21
SLIDE 21

Two-Tier Signature → Standard Signature

spki ←$ SecondaryGen . . . . . . . . . . . . . . . . . . . . . . . .

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 17/30

slide-22
SLIDE 22

Two-Tier Signature → Standard Signature

spki ←$ SecondaryGen . . . . . . . . . . . . M . . . . . . . . . . . .

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 17/30

slide-23
SLIDE 23

Gen of Tree Signature

◮ (ppk, psk) ←$ PrimaryGen

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 18/30

slide-24
SLIDE 24

Gen of Tree Signature

◮ (ppk, psk) ←$ PrimaryGen ◮ (spkroot, sskroot) ←$ SecondaryGen

. . . . . . . . . . . .

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 18/30

slide-25
SLIDE 25

Gen of Tree Signature

◮ (ppk, psk) ←$ PrimaryGen ◮ (spkroot, sskroot) ←$ SecondaryGen ◮ PK = (ppk, spkroot), sk = (psk, sskroot)

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 18/30

slide-26
SLIDE 26

Sign(sk,M)

◮ Step 1: Nodes Generation ◮ Step 2: Path Authentication

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 19/30

slide-27
SLIDE 27

Step 1: Node Generation

. . . . . . . . . . . . M . . . . . . . . . . . .

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 20/30

slide-28
SLIDE 28

Step 1: Node Generation

. . . . . . . . . . . . M . . . . . . . . . . . .

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 20/30

slide-29
SLIDE 29

Step 1: Node Generation

. . . . . . . . . . . . M . . . . . . . . . . . .

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 20/30

slide-30
SLIDE 30

Step 1: Node Generation

. . . . . . . . . . . . M . . . . . . . . . . . .

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 20/30

slide-31
SLIDE 31

Step 1: Node Generation

. . . . . . . . . . . . M . . . . . . . . . . . .

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 20/30

slide-32
SLIDE 32

Step 2: Path Authentication

. . . . . . . . . . . . M . . . . . . . . . . . .

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 21/30

slide-33
SLIDE 33

Step 2: Path Authentication

◮ σ = TTSign(psk, sskparent, (LChild||RChild))

Parent LChild RChild

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 22/30

slide-34
SLIDE 34

Step 2: Path Authentication

Use Two-Tier Sig to authenticate the path

. . . . . . . . . . . . M . . . . . . . . . . . .

σ0

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 23/30

slide-35
SLIDE 35

Step 2: Path Authentication

Use Two-Tier Sig to authenticate the path

. . . . . . . . . . . . M . . . . . . . . . . . .

σ0 σ1

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 23/30

slide-36
SLIDE 36

Step 2: Path Authentication

Use Two-Tier Sig to authenticate the path

. . . . . . . . . . . . M . . . . . . . . . . . .

σ0 σ1 σL

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 23/30

slide-37
SLIDE 37

Signatures

◮ Define signature := (path,σ1, . . . , σL) ◮ Verify:

  • Check if (σ1, . . . , σL) are valid two-tier signatures on path

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 24/30

slide-38
SLIDE 38

Security Theorem 1

Our construction is tightly secure, if the underlying two-tier signature is tightly-secure. Particularly, ◮ Adv[TreeSig] = Adv[Two-TierSig]

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 25/30

slide-39
SLIDE 39

Proof Idea

◮ Simulate the signature without sk:

  • Use two-tier signing oracle

◮ Tightly extract the two-tier forgery:

  • Observation:

◮ Forgery path differs from signing paths

  • “Splitting” node: the valid two-tier forgery

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 26/30

slide-40
SLIDE 40

“Splitting” Node

. . . . . . . . . . . . . . . . . . . . . . . . . . . M∗

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 27/30

slide-41
SLIDE 41

“Splitting” Node

. . . . . . . . . . . . . . . . . . . . . . . . . . . M∗

σ∗

1

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 27/30

slide-42
SLIDE 42

Differences to Merkle trees

◮ Our tree node only contains “half” of the PK

  • Merkle: the whole PK

◮ We have a tight reduction

  • Merkle: loose reduction, guessing

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 28/30

slide-43
SLIDE 43

Summary Our Contributions

◮ Generic framework, new constructions ◮ Extensions: flat-tree signatures, ssNIZK, multi-challenge PKE ◮ Shortcoming: linear signature size

Open Problems

◮ Reducing signature size

  • For DLIN, it is already solved by [CW13], [BKP14];
  • Tight and constant size signatures based on DLOG, RSA, SIS?

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 29/30

slide-44
SLIDE 44

Many thanks for your attention! QUESTIONS?

Tight Sign from CHF|Horst Görtz Institute for IT-Security|NIST, Maryland|PKC 2015 30/30