Updatable Encryption & Key Rotation Anja Lehmann IBM Research - - PowerPoint PPT Presentation
Updatable Encryption & Key Rotation Anja Lehmann IBM Research Zurich (R)CCA Secure Updatable Encryption with Integrity Protection. EUROCRYPT 2019 M Klooss, A Lehmann, A Rupp Updatable Encryption with Post-Compromise Security. EUROCRYPT
(R)CCA Secure Updatable Encryption with Integrity Protection. EUROCRYPT 2019 M Klooss, A Lehmann, A Rupp Updatable Encryption with Post-Compromise Security. EUROCRYPT 2018 A Lehmann, B Tackmann
▪ Data owner stores encrypted data at (untrusted) data host ▪ Proactive security by periodically changing the secret key – Key rotation reduces risk & impact of key or data exposure ▪ Key rotation often mandated in high-security environments and by PCI DSS symmetric encryption
2
▪ How to update exiting ciphertexts to the new key? ▪ Standard symmetric encryption → download all ciphertext & re-encrypt from scratch ▪ Inefficient: down&upload of all ciphertexts, symmetric key often protected by hardware
3
▪ Proposed by Boneh et al. [BLMR13]: ciphertexts can be updated w/o secret key Key update generates key & update token Update token allows to „blindly“ transforms ciphertexts ▪ Update operation of ciphertexts is shifted to (untrusted) data host w/o harming security
4
▪ BLMR13: high level idea & scheme,
no security definitions
▪ EPRS17: partial definition & scheme
▪ BLMR15: partial definitions & new scheme ▪ EPRS17: comprehensive treatment,
improved definitions & schemes Ciphertext-Independent Ciphertext-Dependent
▪ Our works: formal definitions & secure
5
▪ BLMR13: high level idea & scheme,
no security definitions
▪ EPRS17: partial definition & scheme
▪ BLMR15: partial definitions & new scheme ▪ EPRS17: comprehensive treatment,
improved definitions & schemes Ciphertext-Independent Ciphertext-Dependent
▪ Our works: formal definitions & secure
6
▪ Our work: strictly sequential setting ▪ Previous works: adaptions of proxy re-encryption definition – Allows re-encryptions across arbitrary epochs (back & forward) – No notion of time → hard to grasp when key corruptions are allowed
7
Challenge
8
▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni
9
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge
▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni
10
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge
▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni
11
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge
▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni
12
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge
▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni
13
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge
▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni
14
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge
▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni
▪ Real: bi
bidirectional ciphertext-updates
15
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge
▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni
▪ Real: bi
bidirectional ciphertext-updates
16
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge
▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni
▪ Real: bi
bidirectional ciphertext & key-up update dates
17
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge
▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni
▪ Real: bi
bidirectional ciphertext & key-up update dates
18
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge ▪ IND-ENC
ENC definiti tion
– Adaptive and retroactive key & token corruptions – Formalizes inferable information of keys & challenge
– Covers CPA, post-compromise and forward security
for fresh h encrypt ptions
ted ciphertexts ts
▪ Wrong claim in EC’18 paper:
19
𝑛 Encrypt 𝐷𝑓 Next 𝐷𝑓′ ReEnc* 𝐷𝑓
with e′< e
IND-ENC is not sufficient. No guarantees about updated ciphertexts!
* “honest” ciphertexts only
20
Attributes
▪ No security after full breach – inference attacks through linkability
Treatment Ongoing Pregnant No
Attributes
Treatment HXFDPF Pregnant IEKLBR
21
▪ IND-UPD
PD definiti tion n = Update Indisti sting ngui uisha shabi bili lity ty
– Unlinkability of updated ciphertexts – no leakage
through correlation attacks
Challenge
𝐷0, 𝐷1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge 𝑛 Encrypt 𝐷𝑓 Next 𝐷𝑓′ ReEnc* 𝐷𝑓
with e′< e
* “honest” ciphertexts only
IND-ENC = Secure Updatable Encryption IND-ENC + IND-UPD = Strongly Secure Updatable Encryption
But much more expensive (for large ciphertexts)
𝑝, 𝐹𝑜𝑑(𝑙𝑗,𝑛))
𝑝, 𝑙𝑓+1 𝑝
DDH DDH Key-homomorphic PRF: 𝑄𝑆𝐺 𝑙1, 𝑂 ⊗ 𝑄𝑆𝐺 𝑙2, 𝑂 = 𝑄𝑆𝐺 𝑙1 ⊕ 𝑙2, 𝑂 Also crucial building block in ReCrypt [EPRS17] = ciphertext-dependent UE Known instantiations either DL or lattice-based Re-Randomizable Ciphertext-Independent Symmetric ElGamal
22
23
24
IND-ENC IND-UPD Encrypt 2 exp 2 exp 2 exp Token 2 exp 1 exp 2n exp ReEnc 2n exp 2.5n exp 2n exp Ciphertext-Dependen ent
25
Ciphertext-Indepen enden dent
IND-ENC CPA CPA CPA IND-UPD CPA CPA Integrity CTXT Encrypt 2 exp 2 exp 2 exp Token 2 exp 1 exp 2n exp ReEnc 2n exp 2.5n exp 2n exp Ciphertext-Dependen ent
26
Ciphertext-Indepen enden dent
IND-ENC CPA CPA CCA CPA IND-UPD CPA CCA CPA Integrity CTXT CTXT
partially Encrypt 2 exp 2 exp 2 exp Token 2 exp 1 exp 2n exp ReEnc 2n exp 2.5n exp 2n exp Ciphertext-Dependen ent
27
Ciphertext-Indepen enden dent
𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge
IND-ENC ENC-CCA
▪ Decryptions of challenge ciphertext must be prevented – e.g., RISE has re-randomizable ciphertexts ▪ Same trick as in ReEnc? → makes Dec oracle obsolete ▪ Use idea of EPRS17: – Deterministic re-encryption UE. upd Δ𝑓+1, 𝐷𝑓 → 𝐷𝑓+1 – Unique challenge ciphertext ෪
𝐷𝑓 in each epoch
– Dec takes all ciphertexts except ෪
𝐷𝑓
28
𝑛 Encrypt 𝐷𝑓 Next 𝐷𝑓′ ReEnc* 𝐷𝑓
with e′< e
* “honest” ciphertexts only
𝑛 Decrypt 𝐷𝑓
INT-CTXT
▪ Adversary must produce valid & non-trivial ciphertext
𝐷𝑓
∗ s.t. UE. dec 𝐷𝑓 ∗, 𝑙𝑓 ≠ ⊥
▪ 𝐷𝑓
∗ must not be response from Enc/ReEnc or trivial re-encryption
Corrupt
29
Encrypt Next ReEnc* Decrypt
∗
INT-CTXT
▪ Adversary must produce valid & non-trivial ciphertext
𝐷𝑓
∗ s.t. UE. dec 𝐷𝑓 ∗, 𝑙𝑓 ≠ ⊥
▪ 𝐷𝑓
∗ must not be response from Enc/ReEnc or trivial re-encryption
Corrupt
30
Encrypt Next ReEnc* Decrypt
∗
INT-CTXT
▪ Adversary must produce valid & non-trivial ciphertext
𝐷𝑓
∗ s.t. UE. dec 𝐷𝑓 ∗, 𝑙𝑓 ≠ ⊥
▪ 𝐷𝑓
∗ must not be response from Enc/ReEnc or trivial re-encryption
Corrupt
31
Encrypt Next ReEnc* Decrypt
∗
INT-CTXT
▪ Adversary must produce valid & non-trivial ciphertext
𝐷𝑓
∗ s.t. UE. dec 𝐷𝑓 ∗, 𝑙𝑓 ≠ ⊥
▪ 𝐷𝑓
∗ must not be response from Enc/ReEnc or trivial re-encryption
Corrupt
32
Encrypt Next ReEnc* Decrypt
∗
INT-CTXT
▪ Adversary must produce valid & non-trivial ciphertext
𝐷𝑓
∗ s.t. UE. dec 𝐷𝑓 ∗, 𝑙𝑓 ≠ ⊥
▪ 𝐷𝑓
∗ must not be response from Enc/ReEnc or trivial re-encryption
Corrupt
33
Encrypt Next ReEnc* Decrypt
∗
INT-CTXT
▪ Adversary must produce valid & non-trivial ciphertext
𝐷𝑓
∗ s.t. UE. dec 𝐷𝑓 ∗, 𝑙𝑓 ≠ ⊥
▪ 𝐷𝑓
∗ must not be response from Enc/ReEnc or trivial re-encryption
Corrupt
34
Encrypt Next ReEnc* Decrypt
∗
INT-CTXT
▪ Adversary must produce valid & non-trivial ciphertext
𝐷𝑓
∗ s.t. UE. dec 𝐷𝑓 ∗, 𝑙𝑓 ≠ ⊥
▪ 𝐷𝑓
∗ must not be response from Enc/ReEnc or trivial re-encryption
Corrupt
35
Encrypt Next ReEnc* Decrypt
∗
▪ (Somewhat) generic transformation of CPA-secure encryption and PRF ▪ SE needs some special properties: tidy, randomness recoverable, … – 𝐹𝑜𝑑 𝑙𝑇𝐹, 𝑛; 𝑠
→ 𝐷
– 𝐸𝑓𝑑 𝑙𝑇𝐹, 𝐷
▪ Encrypt 𝑛 : 𝐹𝑜𝑑 𝑙𝑇𝐹, 𝑛; 𝑠 → 𝐷 𝑏𝑜𝑒 𝑄𝑆𝐺 𝑙𝑄𝑆𝐺, 𝑛, 𝑠
▪ Decrypt (𝐷, 𝑢): 𝐸𝑓𝑑 𝑙𝑇𝐹, 𝐷 → (𝑛′, 𝑠′) 𝑏𝑜𝑒 𝑄𝑆𝐺 𝑙𝑄𝑆𝐺, 𝑛′, 𝑠′
→ 𝑢′. 𝑆𝑓𝑢𝑣𝑠𝑜 𝑛′ 𝑗𝑔 𝑢 = 𝑢′
▪ Update: update 𝐷, 𝑢 using key-rotatable building blocks
36
▪ Updatable PRF – based on DDH-PRF by NPR99 ▪ Group (𝐻, , 𝑟) in which DDH assumption holds, hash function 𝐼: 0,1 ∗ → 𝐻 – KeyGen: 𝑙 ∈ 𝑎𝑟
∗
– Eval: 𝑢 = 𝐼 𝑛 𝑙 – TokenGen for old key 𝑙 new key 𝑙′:
𝛦 = 𝑙′ / 𝑙
– Update: 𝑢′ = 𝑢Δ = 𝐼 𝑛 𝑙′
37
▪ Updatable (CPA) Encryption Scheme – ELGamal based ▪ Group (𝐻, , 𝑟) in which DDH assumption holds – KeyGen: 𝑦1, 𝑦2 ∈ 𝑎𝑟
∗ . 𝑙𝑇𝐹 = (𝑦1, 𝑦2)
– Encrypt: 𝑠 ∈ 𝐻.
𝐷1 = 𝑠𝑦1 and 𝐷2 = 𝑠𝑦2 ⋅ 𝑛
– Decrypt: 𝑠 = 𝐷1
−𝑦1
– TokenGen for old key 𝑦1, 𝑦2 , new key 𝑦′1, 𝑦′2 : Δ1 =
𝑦1
′
𝑦1 𝑏𝑜𝑒 Δ2 = 𝑦2
′−𝑦2
𝑦1
– Update: 𝐷′1 = 𝐷1
Δ1 = 𝑠𝑦′1 and 𝐷′2 = 𝐷1 Δ2 ⋅ 𝐷2 = 𝑠𝑦′2 ⋅ 𝑛
38
IND-ENC CPA CPA CCA CPA IND-UPD CPA CCA CPA Integrity CTXT CTXT
partially Encrypt 2 exp 2 exp 3 exp 2 exp Token 2 exp 1 exp 3 exp 2n exp ReEnc 2n exp 2.5n exp 3n exp 2n exp
Ciphertext-Dependen ent
39
Ciphertext-Indepen enden dent ▪ Encrypt 𝑛 : 𝐹𝑜𝑑 𝑙𝑇𝐹, 𝑛; 𝑠
▪ Decrypt (𝐷, 𝑢): 𝐸𝑓𝑑 𝑙𝑇𝐹, 𝐷
→ (𝑛′, 𝑠′) 𝑏𝑜𝑒 𝑄𝑆𝐺 𝑙𝑄𝑆𝐺, 𝑛′, 𝑠′ → 𝑢′. 𝑆𝑓𝑢𝑣𝑠𝑜 𝑛′ 𝑗𝑔 𝑢 = 𝑢′
▪ TokenGen: get SE. TokGen 𝑙𝑇𝐹, 𝑙𝑇𝐹
′
→ ΔSE and PRF. TokGen 𝑙𝑄𝑆𝐺, 𝑙𝑄𝑆𝐺
′
→ Δ𝑄𝑆𝐺
▪ Update: update 𝐷, 𝑢 using SE. Upd Δ𝑇𝐹, 𝐷 → 𝐷′ and PRF. Upd Δ𝑄𝑆𝐺, 𝑢 → 𝑢′
IND-ENC CPA CPA CCA CPA IND-UPD CPA CCA CPA Integrity CTXT CTXT
partially Encrypt 2 exp 2 exp 3 exp 2 exp Token 2 exp 1 exp 3 exp 2n exp ReEnc 2n exp 2.5n exp 3n exp 2n exp Ciphertext-Dependen ent
40
Ciphertext-Indepen enden dent
IND-ENC CPA CPA CCA CPA IND-UPD CPA CCA CPA Integrity CTXT CTXT
partially Encrypt 2 exp 2 exp 3 exp 2 exp Token 2 exp 1 exp 3 exp 2n exp ReEnc 2n exp 2.5n exp 3n exp 2n exp Ciphertext-Dependen ent
41
Ciphertext-Indepen enden dent 𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge 𝑛 Encrypt 𝐷𝑓 Next 𝐷𝑓′ ReEnc* 𝐷𝑓
with e′< e
* “honest” ciphertexts only
𝑛 Decrypt 𝐷𝑓
IND-ENC CPA CPA CCA CPA IND-UPD CPA CCA CPA Integrity CTXT CTXT
partially Encrypt 2 exp 2 exp 3 exp 2 exp Token 2 exp 1 exp 3 exp 2n exp ReEnc 2n exp 2.5n exp 3n exp 2n exp Ciphertext-Dependen ent
42
Ciphertext-Indepen enden dent 𝑛0, 𝑛1 𝑐 ? 𝑙𝑓 / Δ𝑓 Corrupt ෪ 𝐷𝑓∗ Challenge 𝑛 Encrypt 𝐷𝑓 Next 𝐷𝑓′ ReEnc* 𝐷𝑓
with e′< e
* “honest” ciphertexts only
𝑛 Decrypt 𝐷𝑓 ▪ ReEnc marks epochs as challenge-equal when 𝐷 is challenge ciphertext ▪ RISE and Enc&MAC can “blind” query to ReEnc oracle – Submit invalid ciphertext → unblind later
IND-ENC CPA CPA CCA RCCA CPA IND-UPD CPA CCA RCCA CPA Integrity CTXT PTXT CTXT
partially Encrypt 2 exp 2 exp 3 exp 2 exp Token 2 exp 1 exp 3 exp 2n exp ReEnc 2n exp 2.5n exp 3n exp 2n exp Ciphertext-Dependen ent
43
Ciphertext-Indepen enden dent
44
▪ Make ciphertext validity publicly verifiable → Naor-Yung transform (CPA → CCA) – 𝐹𝑜𝑑 𝑙1, 𝑛
→ 𝐷1 𝑏𝑜𝑒 𝐹𝑜𝑑 𝑙2, 𝑛 → 𝐷2
– 𝑂𝐽𝑎𝐿 𝐷1 = 𝐹𝑜𝑑 𝑙1, 𝑛
∧ 𝐹𝑜𝑑 𝑙2, 𝑛 → 𝜌
– 𝐷𝑗𝑞ℎ𝑓𝑠𝑢𝑓𝑦𝑢: 𝐷1, 𝐷2, 𝜌 ▪ Use CPA-secure Updatable Encryption: RISE ▪ Use Malleable NIZK: Groth-Sahai (GS) proofs ▪ Both building blocks create re-randomizable 𝐷 / 𝜌 ▪ Achieve RCCA & PTXT instead
→ CCA and CTXT is impossible ReEnc is not deterministic anymore
IND-ENC CPA CPA CCA RCCA CPA IND-UPD CPA CCA RCCA CPA Integrity CTXT PTXT CTXT
partially Encrypt 2 exp 2 exp 3 exp 2 exp Token 2 exp 1 exp 3 exp 2n exp ReEnc 2n exp 2.5n exp 3n exp 2n exp Ciphertext-Dependen ent
45
dete terministi tic c ReEnc nc dete terministi tic ReEnc
Ciphertext-Indepen enden dent
▪ Key rotation mandatory in many high-security environments ▪ Updatable Encryptions allow convenients updates of ciphertexts in untrusted domain – Ciphertext-dependent vs. Ciphertext-independent updates ▪ Lots of open problems: – CCA/CTXT with Arbitrary ReEnc Security ....w/o deterministic ReEnc – All schemes are bi-directional → are there uni-directional ones? – IND-UPD Definition implies PKE → weaker notions?
46
anj@zurich.ibm.com