Updatable Encryption & Key Rotation Anja Lehmann IBM Research – Zurich (R)CCA Secure Updatable Encryption with Integrity Protection. EUROCRYPT 2019 M Klooss, A Lehmann, A Rupp Updatable Encryption with Post-Compromise Security. EUROCRYPT 2018 A Lehmann, B Tackmann
Motivation | Outsourced Storage ▪ Data owner stores encrypted data at (untrusted) data host symmetric encryption ▪ Proactive security by periodically changing the secret key – Key rotation reduces risk & impact of key or data exposure ▪ Key rotation often mandated in high-security environments and by PCI DSS 2
Motivation | Key Rotation ▪ How to update exiting ciphertexts to the new key? ▪ Standard symmetric encryption → download all ciphertext & re-encrypt from scratch ▪ Inefficient: down&upload of all ciphertexts, symmetric key often protected by hardware 3
Motivation | Updatable Encryption ▪ Proposed by Boneh et al. [BLMR13]: ciphertexts can be updated w/o secret key Key update generates key & update token Update token allows to „blindly“ transforms ciphertexts ▪ Update operation of ciphertexts is shifted to (untrusted) data host w/o harming security 4
Updatable Encryption | State-of-the-Art Ciphertext-Dependent Ciphertext-Independent UE. setup 𝜇 → 𝑙 0 UE. setup 𝜇 → 𝑙 0 UE. enc 𝑙 𝑓 , 𝑛 → 𝐷 𝑓 UE. enc 𝑙 𝑓 , 𝑛 → 𝐷 𝑓 UE. dec 𝑙 𝑓 , 𝐷 𝑓 → 𝑛 UE. dec 𝑙 𝑓 , 𝐷 𝑓 → 𝑛 UE. next 𝑙 𝑓 → (𝑙 𝑓+1 , Δ 𝑓+1 ) UE. next 𝑙 𝑓 → 𝑙 𝑓+1 UE. upd Δ 𝑓+1, 𝐷 𝑓 → 𝐷 𝑓+1 UE. token 𝑙 𝑓 , 𝑙 𝑓+1 , 𝐷 𝑓 → Δ 𝐷,𝑓+1 UE. upd Δ 𝐷,𝑓+1, 𝐷 𝑓 → 𝐷 𝑓+1 ▪ BLMR13: high level idea & scheme, ▪ BLMR15: partial definitions & new scheme no security definitions ▪ EPRS17: comprehensive treatment, ▪ EPRS17: partial definition & scheme improved definitions & schemes ▪ Our works: formal definitions & secure schemes for ciphertext-independent setting 5
Updatable Encryption | State-of-the-Art Ciphertext-Dependent Ciphertext-Independent UE. setup 𝜇 → 𝑙 0 UE. setup 𝜇 → 𝑙 0 UE. enc 𝑙 𝑓 , 𝑛 → 𝐷 𝑓 UE. enc 𝑙 𝑓 , 𝑛 → 𝐷 𝑓 UE. dec 𝑙 𝑓 , 𝐷 𝑓 → 𝑛 UE. dec 𝑙 𝑓 , 𝐷 𝑓 → 𝑛 UE. next 𝑙 𝑓 → (𝑙 𝑓+1 , Δ 𝑓+1 ) UE. next 𝑙 𝑓 → 𝑙 𝑓+1 UE. upd Δ 𝑓+1, 𝐷 𝑓 → 𝐷 𝑓+1 UE. token 𝑙 𝑓 , 𝑙 𝑓+1 , 𝐷 𝑓 → Δ 𝐷,𝑓+1 UE. upd Δ 𝐷,𝑓+1, 𝐷 𝑓 → 𝐷 𝑓+1 ▪ BLMR13: high level idea & scheme, ▪ BLMR15: partial definitions & new scheme no security definitions ▪ EPRS17: comprehensive treatment, ▪ EPRS17: partial definition & scheme improved definitions & schemes ▪ Our works: formal definitions & secure schemes for ciphertext-independent setting 6
Updatable Encryption | Sequential Setting … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 … 𝐷 0 𝐷 1 𝐷 2 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Our work: strictly sequential setting ▪ Previous works: adaptions of proxy re-encryption definition – Allows re-encryptions across arbitrary epochs (back & forward) – No notion of time → hard to grasp when key corruptions are allowed 7
Updatable Encryption | Security … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 … 𝐷 0 𝐷 1 𝐷 2 𝐷 3 𝐷 4 𝐷 5 𝐷 6 Post-Compromise Security Forward Security = IND-ENC + Corrupt Challenge 𝑙𝑓𝑧/𝑢𝑝𝑙𝑓𝑜(𝑓) 𝑛 0 , 𝑛 1 Return key 𝑙 𝑓 b ← {0,1} or token Δ 𝑓 𝐹𝑜𝑑 𝑙 𝑓 ∗ , 𝑛 𝑐 𝑙 𝑓 / Δ 𝑓 ෪ 𝐷 𝑓 ∗ 𝑐 ? 8
Updatable Encryption | Capturing Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 9
Updatable Encryption | Capturing Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 10
Updatable Encryption | Capturing Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 11
Updatable Encryption | Capturing Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 12
Updatable Encryption | Capturing Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 13
Updatable Encryption | Capturing Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ 𝑐 ? 14
Updatable Encryption | Capturing Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ … 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates ▪ Real: bi bidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 Δ e+1 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ ෪ ෫ 𝐷 𝑓 𝐷 𝑓+1 𝑐 ? 15
Updatable Encryption | Capturing Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ ෪ ෪ ෪ … 𝐷 0 𝐷 1 𝐷 2 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates ▪ Real: bi bidirectional ciphertext-updates Corrupt 𝑙 𝑓 / Δ 𝑓 Δ e+1 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ ෪ ෫ 𝐷 𝑓 𝐷 𝑓+1 𝑐 ? 16
Updatable Encryption | Capturing Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ ෪ ෪ ෪ … 𝐷 0 𝐷 1 𝐷 2 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates ▪ Real: bi bidirectional ciphertext & key-up update dates Corrupt 𝑙 𝑓 / Δ 𝑓 Δ e+1 𝑙 𝑓 𝑙 𝑓+1 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ ෪ ෫ 𝐷 𝑓 𝐷 𝑓+1 Δ e+1 𝑐 ? 17
Updatable Encryption | Capturing Trivial Wins … 0 1 2 3 4 5 6 … 𝑙 0 𝑙 1 𝑙 2 𝑙 3 𝑙 4 𝑙 5 𝑙 6 … Δ 1 Δ 2 Δ 3 Δ 4 Δ 5 Δ 6 Δ 7 ෪ ෪ ෪ ෪ ෪ ෪ ෪ … 𝐷 0 𝐷 1 𝐷 2 𝐷 3 𝐷 4 𝐷 5 𝐷 6 ▪ Trivial win: secret key corruption in a challenge-equal epoch ▪ Capturing inferable information: ▪ Ideal: uni unidirectional ciphertext-updates ▪ Real: bi bidirectional ciphertext & key-up update dates Corrupt 𝑙 𝑓 / Δ 𝑓 Δ e+1 𝑙 𝑓 𝑙 𝑓+1 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ ෪ ෫ 𝐷 𝑓 𝐷 𝑓+1 Δ e+1 𝑐 ? 18
Updatable Encryption | IND-ENC 𝑛 Encrypt 𝐷 𝑓 ▪ IND-ENC ENC definiti tion 𝐷 𝑓′ with e ′ < e ReEnc* – Adaptive and retroactive key & token corruptions 𝐷 𝑓 – Formalizes inferable information of keys & challenge * “honest” ciphertexts only ciphertexts → exclude trivial wins Next – Covers CPA, post-compromise and forward security for fresh h encrypt ptions ons & update ted ciphertexts ts Corrupt 𝑙 𝑓 / Δ 𝑓 ▪ Wrong claim in EC’18 paper: 𝑛 0 , 𝑛 1 Challenge ෪ 𝐷 𝑓 ∗ IND-ENC is not sufficient. 𝑐 ? No guarantees about updated ciphertexts! 19
Recommend
More recommend
