Verifiable Security of Boneh-Franklin Identity-Based Encryption - - PowerPoint PPT Presentation

▶
verifiable security of boneh franklin identity based
SMART_READER_LITE
LIVE PREVIEW

Verifiable Security of Boneh-Franklin Identity-Based Encryption - - PowerPoint PPT Presentation

Oct 19, 2022 47 likes •460 views

Verifiable Security of Boneh-Franklin Identity-Based Encryption Federico Olmedo Gilles Barthe Santiago Zanella Bguelin IMDEA Software Institute, Madrid, Spain 5 th International Conference on Provable Security 2011.10.17 Verifiable Security

slide-1
SLIDE 1

Verifiable Security of Boneh-Franklin Identity-Based Encryption Federico Olmedo Gilles Barthe Santiago Zanella Béguelin

IMDEA Software Institute, Madrid, Spain

5th International Conference on Provable Security 2011.10.17

1 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-2
SLIDE 2

Identity-Based Encryption (IBE)

Problem of standard PKE: key management is involved and troublesome

2 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-3
SLIDE 3

Identity-Based Encryption (IBE)

Problem of standard PKE: key management is involved and troublesome Proposed solution by Shamir: to use recipient’s ID as public key

2 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-4
SLIDE 4

Identity-Based Encryption (IBE)

Problem of standard PKE: key management is involved and troublesome Proposed solution by Shamir: to use recipient’s ID as public key Alice Bob

slide-5
SLIDE 5

Identity-Based Encryption (IBE)

Problem of standard PKE: key management is involved and troublesome Proposed solution by Shamir: to use recipient’s ID as public key Alice Bob 1

Encrypt with public key

bob@comp.com

slide-6
SLIDE 6

Identity-Based Encryption (IBE)

Problem of standard PKE: key management is involved and troublesome Proposed solution by Shamir: to use recipient’s ID as public key Alice Bob 1

Encrypt with public key

bob@comp.com PKG 2

Bob authenticates

slide-7
SLIDE 7

Identity-Based Encryption (IBE)

Problem of standard PKE: key management is involved and troublesome Proposed solution by Shamir: to use recipient’s ID as public key Alice Bob 1

Encrypt with public key

bob@comp.com PKG 2

Bob authenticates

3 “bob@comp.com”’s

private key

2 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-8
SLIDE 8

Should we rely on IBE schemes?

1984 Shamir 2001 Boneh & Franklin 2002 2003 2004 2005 Gentry & Silverberg, Horwitz & Lynn, Al-Riyami & Peterson, Yao et al, Cheng & Comely Galindo

1984: Conception of identity-based cryptography 2001: First practical provably-secure IBE scheme. 2002-2005: Used as building block for many other protocols 2005: Security proof is flawed (but can be patched)

3 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-9
SLIDE 9

Improving the security argument

Verifiable security paradigm Use formal methods to build certified security proofs of cryp- tographic systems

Gives strong evidence of correctness of security arguments Enables automation in proofs Demonstrated applicability and effectiveness

4 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-10
SLIDE 10

Outline

1 The provably-secure BasicIdent scheme 2 CertiCrypt framework 3 Machine-checked proof of BasicIdent security 4 Summary and perspectives 5 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-11
SLIDE 11

An IBE Scheme

An identity-based encryption scheme is specified by four polynomial algorithms: Extract Setup Encrypt Decrypt

slide-12
SLIDE 12

An IBE Scheme

An identity-based encryption scheme is specified by four polynomial algorithms: Extract Setup Encrypt Decrypt

  • sec. param
slide-13
SLIDE 13

An IBE Scheme

An identity-based encryption scheme is specified by four polynomial algorithms: Extract Setup Encrypt Decrypt

  • sec. param

public params public params public params public params

slide-14
SLIDE 14

An IBE Scheme

An identity-based encryption scheme is specified by four polynomial algorithms: Extract Setup Encrypt Decrypt

  • sec. param

public params public params public params public params master key

slide-15
SLIDE 15

An IBE Scheme

An identity-based encryption scheme is specified by four polynomial algorithms: Extract Setup Encrypt Decrypt

  • sec. param

public params public params public params public params master key ID plaintext ciphertext ciphertext secret key plaintext

slide-16
SLIDE 16

An IBE Scheme

An identity-based encryption scheme is specified by four polynomial algorithms: Extract Setup Encrypt Decrypt

  • sec. param

public params public params public params public params master key ID plaintext ciphertext ciphertext secret key plaintext master key ID secret key

6 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-17
SLIDE 17

Boneh-Franklin’s recipe

1 Extend the notions of IND-CPA and IND-CCA to IBE schemes 2 Build an IND-CPA-secure IBE scheme BasicIdent 3 Apply a variant of Fujisaki-Okamoto transformation to turn BasicIdent

into an IND-CCA-secure IBE scheme

7 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-18
SLIDE 18

The BasicIdent scheme (definition)

Consider G1 and G2, two cyclic groups of prime order q, ˆ e : G1 × G1 → G2, an efficiently computable bilinear map ˆ e(aP, bQ) = ˆ e(P, Q)ab P = G1 = ⇒ ˆ e(P, P) = G2 Two hash functions H1 : {0, 1}⋆ → G+

1

H2 : G2 → {0, 1}n The BasicIdent IBE-scheme is defined as Setup(k) : P

$

← G+

1 ; mk

$

← Z+

q ; Ppub ← mk·P; return ((P, Ppub), mk)

Extract(mk, ID) : QID ← H1(ID); return mk·QID Encrypt(ID, m) : QID ← H1(ID); c

$

← Z+

q ; m′ ← H2(e(QID, Ppub)c);

return (c·P, m ⊕ m′) Decrypt(sk, (u, v)) : return v ⊕ H2(ˆ e(sk, u))

8 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-19
SLIDE 19

The BasicIdent scheme (security proof)

Proof by reduction (in the random oracle model)

Define security goal (and adversarial model) Consider a computational assumption Reduce the security of the scheme to the intractability assumption. Problem instance Solution A B Pr

  • A breaks

the scheme

  • ≤ F
  • Pr
  • B solves the

hard problem

  • 9 / 21

Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-20
SLIDE 20

The BasicIdent scheme (security proof)

Proof by reduction (in the random oracle model)

Define security goal (and adversarial model) ➥ Indistinguishability under Chosen Plaintext Attack Strengthened notion of PKE IND-CPA for IBE Consider a computational assumption Reduce the security of the scheme to the intractability assumption. Problem instance Solution A B Pr

  • A breaks

the scheme

  • ≤ F
  • Pr
  • B solves the

hard problem

  • 9 / 21

Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-21
SLIDE 21

The BasicIdent scheme (security proof)

Proof by reduction (in the random oracle model)

Define security goal (and adversarial model) ➥ Indistinguishability under Chosen Plaintext Attack Strengthened notion of PKE IND-CPA for IBE Consider a computational assumption ➥ Bilinear Diffie-Hellman assumption It is hard to compute ˆ e(P, P)abc given a random tuple (P, a · P, b · P, c · P). Reduce the security of the scheme to the intractability assumption. Problem instance Solution A B Pr

  • A breaks

the scheme

  • ≤ F
  • Pr
  • B solves the

hard problem

  • 9 / 21

Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-22
SLIDE 22

The BasicIdent scheme (security proof)

Proof by reduction (in the random oracle model)

Define security goal (and adversarial model) ➥ Indistinguishability under Chosen Plaintext Attack Strengthened notion of PKE IND-CPA for IBE Consider a computational assumption ➥ Bilinear Diffie-Hellman assumption It is hard to compute ˆ e(P, P)abc given a random tuple (P, a · P, b · P, c · P). Reduce the security of the scheme to the intractability assumption. Problem instance Solution A B Pr

  • A breaks

the scheme

  • ≤ F
  • Pr
  • B solves the

hard problem

  • ➥

AdvA

IND-ID-CPA ≤ AdvB BDH exp(1) qH2 (1+qEX ) 2

9 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-23
SLIDE 23

Tidying the proof up

The game-playing technique Security Goal

Game G0 . . . . . . ← A( ) . . . Game G1 . . . . . . . . .

. . . Reduction

Game Gn . . . . . . ← B( ) . . .

PrG0 [S0] ≤ f1

  • PrG1 [S1]
  • ≤ . . . ≤ fn
  • PrGn [Sn]
  • 10 / 21

Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-24
SLIDE 24

CertiCrypt: machine-checked crypto proofs

Certified framework for building and verifying crypto proofs in the Coq proof assistant Combination of programming language techniques and cryptographic-specific tools Game-based methodology, natural to cryptographers Several case studies:

Encryption schemes: ElGamal, Hashed ElGamal, OAEP Signature schemes: FDH, BLS Zero-Knowledge protocols: Schnorr, Okamoto, Diffie-Hellman, Fiat-Shamir

11 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-25
SLIDE 25

Inside CertiCrypt (language syntax)

Language-based proofs Formalize security definitions, assumptions and games using a probabilistic programming language. pWhile: a probabilistic programming language C ::= skip nop | C; C sequence | V ← E assignment | V

$

← D random sampling | if E then C else C conditional | while E do C while loop | V ← P(E, . . . , E) procedure call x

$

← d: sample the value of x according to distribution d The language of expressions (E) and distribution expressions (D) admits user-defined extensions

12 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-26
SLIDE 26

Inside CertiCrypt (standard tools)

Observational equivalence

| = c1 ≃I

O c2

Example | = x

$

← {0, 1}k; y ← x ⊕ z ≃{z}

{x,y,z} y

$

← {0, 1}k; x ← y ⊕ z Useful to relate probabilities fv(A) ⊆ O | = c1 ≃I

O c2

m1 =I m2 Pr [c1, m1 : A] = Pr [c2, m2 : A]

13 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-27
SLIDE 27

Inside CertiCrypt (crypto-specific tool)

Fundamental lemma of game-playing

Game G1 . . . bad ← true; c1 . . . Game G2 . . . bad ← true; c2 . . . Two identical up to bad games

Lemma If G1 and G2 are identical up to bad, then |Pr [G1, m : A] − Pr [G2, m : A]| ≤ max{Pr [G1, m : bad] , Pr [G2, m : bad]}

14 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-28
SLIDE 28

Our proof in CertiCrypt

We extended CertiCrypt with: Types and operators for the groups G1, G2 An operator for a bilinear map ˆ e : G1 × G1 → G2 Simplification rules for computing normal forms of applications of the bilinear map ˆ e An instruction for sampling from Bernoulli distributions

15 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-29
SLIDE 29

Our proof in CertiCrypt

Formalizing the security goal: Game GIND-ID-CPA : (params, mk) ← Setup(k); (m0, m1, IDA) ← A1(params); b

$

← {0, 1}; c ← Encrypt(IDA, mb); bA ← A2(c) The adversary is modeled by two procedures (of unknown code) A1 and A2 that communicate through shared variables A1 and A2 have oracle access to the extraction algorithm and to both random oracles Neither A1 nor A2 is allowed to query the challenge IDA to the extraction

  • racle.

AdvA

IND-ID-CPA

def

=

  • PrGIND-ID-CPA [b = bA] − 1

2

  • 16 / 21

Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-30
SLIDE 30

Our proof in CertiCrypt

Formalizing the assumptions The Bilinear Diffie-Hellman assumption Game GB

BDH :

P

$

← G+

1 ; a, b, c

$

← Z+

q ;

z ← B(P, a·P, b·P, c·P) AdvB

BDH

def

= PrGB

BDH

  • z = ˆ

e(P, P)abc ∀B • PPT(B) = ⇒ negl(AdvB

BDH)

The random oracle model Oracle H1(ID) : if ID / ∈ dom(L1) then R

$

← G+

1 ;

L1(ID) ← R return L1(ID) Oracle H2(r) : if r / ∈ dom(L2) then m

$

← {0, 1}n; L2(r) ← m return L2(r)

17 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-31
SLIDE 31

Our proof in CertiCrypt

Building the reduction. . . Game GIND-ID-CPA : (parm, mk) ← Setup(k); (m0, m1, IDA) ← A1(parm); b

$

← {0, 1}; c ← Encrypt(IDA, mb); bA ← A2(c) Game GB

BDH :

P

$

← G+

1 ; a, b, c

$

← Z+

q ;

z ← B(P, a·P, b·P, c·P) . . . AdvA

IND-ID-CPA

≤ . . . ≤ AdvB

BDH exp(1) qH2 (1+qEX ) 2

Seven intermediate games Lazy sampling, fundamental lemma, Coron’s technique Same bound as Boneh & Franklin proof

18 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-32
SLIDE 32

Our proof in CertiCrypt

Our reduction is direct in contrast to Boneh-Franklin proof that goes through an intermediate IND-CPA-secure (non-IBE) encryption scheme Used a simpler argument instead of an inductive argument in Boneh-Franklin’s proof that we could not reproduce 5000 lines of Coq script Built in 3 man-months (but automatically verifiable in 10 minutes)

19 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-33
SLIDE 33

Summary and Perspectives

Contributions

Presented a machine-checked reduction of the security of the BasicIdent IBE scheme to the Bilinear Diffie-Hellman assumption Demonstrated that CertiCrypt can be extended to deal with complex security proofs of cryptographic schemes

Perspectives

Formalize Fujisaki-Okamoto meta-result. Eliminate RO assumption on G1: formalize Brier et al work about indifferentiability of hash functions into elliptic curves.

20 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-34
SLIDE 34

Final remarks

Questions? Get CertiCrypt (and EasyCrypt) from: http://certicrypt.gforge.inria.fr

21 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-35
SLIDE 35

Inside CertiCrypt (language semantics)

Programs map an initial memory to a distribution of final memories: c ∈ C : M → D(M) We use Paulin’s measure monad to represent distributions: D(A)

def

= (A → [0, 1]) → [0, 1] For instance x

$

← {true, false} m = λf · 1 2f (m[x/true]) + 1 2f (m[x/false])

  • To compute probabilities, just measure the characteristic function of the event:

Pr [c, m : A]

def

= c m 1A

22 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-36
SLIDE 36

What does it take to trust a proof in CertiCrypt

You need to

trust the type checker of Coq trust the definition of the language semantics make sure the security statement and the computational assumption (a few lines in Coq) are what you expect it to be

You don’t need to

understand or even read the proof trust proof tactics, program transformations trust program logics, wp-calculus be an expert in Coq

23 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-37
SLIDE 37

Our proof in CertiCrypt I

Game CPA : L1, L2, L3 ← nil; P

$

← G+

1 ; a

$

← Z+

q ;

Ppub ← aP; (m0, m1, IDA) ← A1(P, Ppub); d

$

← {0, 1}; y ← E(IDA, md); dA ← A2(y) Oracle EX(ID) : if ID / ∈ L3 then L3 ← ID :: L3 Q ← H1(ID); return aQ Oracle H1(ID) : if ID / ∈ dom(L1) then R

$

← G+

1 ;

L1(id) ← R return L1(ID) Oracle H2(r) : if r / ∈ dom(L2) then m

$

← {0, 1}n; L2(r) ← m return L2(r) Game BDH : P

$

← G+

1 ; a, b, c

$

← Z+

q ;

z ← B(P, aP, bP, cP) B(P0, P1, P2, P3) : L1, L2, L3, V , T ← nil; while |T| < qH1 do t

$

← true ⊕p false; T ← t :: T P ← P0; Ppub ← P1; P′ ← P2; (m0, m1, IDA) ← A1(P, Ppub); QA ← H1(IDA); v′ ← V (IDA)−1; R

$

← {0, 1}n; y ← (v′P3, R); dA ← A2(y); i

$

← [1.. |L2|]; return fst(L2[i]) Oracle EX(ID) : if ID / ∈ L3 then L3 ← ID :: L3 Q ← H1(ID); return aQ Oracle H1(ID) : if ID / ∈ dom(L1) then v

$

← Z+

q ;

V (ID) ← v; if T[|L1|] then L1(ID) ← vP′ else L1(ID) ← vP return L1(ID) Oracle H2(r) : if r / ∈ dom(L2) then m

$

← {0, 1}n; L2(r) ← m return L2(r)

24 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-38
SLIDE 38

Semantic security of an IBE scheme

C H A L L E N G E R A T T A C K E R (m0, m1) b

$

← {0, 1} Encrypt(md, ID) b′ ∈ {0, 1}

An IBE scheme is IND-ID-CPA-secure iff ∀A • PPT(A) = ⇒

  • Pr
  • b = b′

− 1 2

  • is negligible

25 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-39
SLIDE 39

Semantic security of an IBE scheme

C H A L L E N G E R A T T A C K E R (m0, m1), IDA b

$

← {0, 1} Encrypt(md, IDA) b′ ∈ {0, 1}

An IBE scheme is IND-ID-CPA-secure iff ∀A • PPT(A) = ⇒

  • Pr
  • b = b′

− 1 2

  • is negligible
slide-40
SLIDE 40

Semantic security of an IBE scheme

C H A L L E N G E R A T T A C K E R (m0, m1), IDA b

$

← {0, 1} Encrypt(md, IDA) b′ ∈ {0, 1} Setup public params

An IBE scheme is IND-ID-CPA-secure iff ∀A • PPT(A) = ⇒

  • Pr
  • b = b′

− 1 2

  • is negligible

26 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption

slide-41
SLIDE 41

Semantic security of an IBE scheme

C H A L L E N G E R A T T A C K E R (m0, m1), IDA b

$

← {0, 1} Encrypt(md, IDA) b′ ∈ {0, 1} Setup public params ID1, ID2, . . . , IDn Extract sk1, sk2, . . . , skn IDn+1, IDn+2, . . . , IDn+r skn+1, skn+2, . . . , skn+r

An IBE scheme is IND-ID-CPA-secure iff ∀A • PPT(A) ∧ Pr m

i=1 idi = idA

  • = 1 =

⇒

  • Pr
  • b = b′

− 1 2

  • is negligible

27 / 21 Verifiable Security of Boneh-Franklin,Identity-Based Encryption