Public-Key Encryption in the Bounded-Retrieval Model

1. Earlier Today: Yevgeniy covered ID schemes, Signatures, Interactive Encryption/Authentication/AKA Public-Key Encryption in the Bounded-Retrieval Model Joël Alwen, YevgeniyDodis, MoniNaor, Gil Segev, ShabsiWalfish, Daniel Wichs

2. Leakage Resilience and the BRM • Leakage Resilience: Cryptographic schemes that remain secure even if adversary learns partial information about sk. • Goal: High relative leakage. • Bounded Retrieval Model: Absolute size of leakage can be arbitrarily large (bits, Mb, Gb…). • Accommodate any leakage threshold by increasing key size flexibly. • No other loss of efficiency! [AGV09, NS09,…] sk f(sk) leak [Dzi06, CLW06,…] 90% of |sk|

3. Why have schemes in the BRM? • Security against viruses: • Virus downloads arbitrary information from local storage and sends it to a remote attacker. • In practice, virus cannot download too much (< 10 GB). • Bandwidth too low, Cost too high, System security may detect. • Security against side-channel attacks: • Adversary gets some “physical output” of computation. • May be unreasonable to learn “too much” info, even after many physical readings. • How much is “too much” depends on physical implementation (few Kb - few Mb).

4. Prior Work • Leakage Resilience (No BRM): • Symmetric-Key Authenticated Encryption [DKL09] • Public-KeyEncryption [AGV09, NS09, KV09] • Signatures [ADW09, Katz09] • Bounded Retrieval Model: • Secret Sharing [DP07] • Symmetric-Key Identification and Authenticated Key Agreement [Dzi06,CDD+07] • Public-Key ID schemes, Signatures, Authenticated Key Agreement [ADW09] • Now: Public-KeyEncryption in the BRM.

5. Public-Key Encryption in the BRM • Goal: PKE parameterized by security parameter s (e.g. 256 bits) and leakage bound L (e.g. 256 bits - 10GB). • Secret Key size is flexible: |sk| = (1 + ε)L. • Public Keys and Ciphertexts are short, only depend on s. • Decryption is local. Number of bits accessed is proportional to s. • Naïve Attempt : “Take any leakage-resilient PKE tolerating l(|sk|) leakage. Increase security parameter s until l(|sk|) > L.” • Problem: Public-key/Ciphertext size depends on L. May be huge. • Problem: Decryption is not local. • Problem: Computation over groups with 10 GB description length. • Positive: Very Secure!

6. PKE in the BRM via Composition of PKE • Attempt #1: “Compose n copies of Leakage-Resilient PKE” • Generate n pairs (pk1,sk1),…, (pkn, skn). Set PK = (pk1,…, pkn), SK = (sk1,…, skn). • To encrypt m: • Compute shares (s1,…, sn) such that m = s1 + …+ sn. • Set c1=Enc(pk1, s1),…, cn=Enc(pkn, sn). • Ciphertext is C = (c1 ,…, cn). • Hope: Composed scheme amplifies leakage from lto L = n lbitswithout unnecessary increase in security parameter. • Intuition: To break the composed scheme, must leak l bits about each of (sk1,…, skn). • Unfortunately ciphertext size, public key size and locality are still large. PK SK pk1 sk1 pk2 sk2 … … Can intuition be formalized? Stay tuned… pkn skn

7. PKE in the BRM via Composition of IBE • Attempt #2: Use Leakage-Resilient IBE to Reduce Public-Key Size. • Generate a master-key pair (MPK, MSK) for an IBE. • Use MSK to generate keys sk1,…, sknfor identities 1,…,n. • Set PK = MPK, SK = (sk1,…, skn). Delete MSK. • To encrypt m: • Compute shares (s1,…, st) such that m = s1 + …+ st. • Choose t random identities IDi∊ [n]. • Set c1=Enc(ID1, s1),…, cn=Enc(IDt, st). • Ciphertext is C = (ID1 ,…, IDt , c1 ,…, ct). • Good news: Ciphertext, Public-Key, Locality is proportional to security parameter. • Need leakage resilient IBE. (Of Independent Interest) • Is the composition secure? SK MPK sk1 ID=1 ID=2 sk2 … Random Subset of [n] skn ID=n

8. Does Composition Amplify Leakage Resilience? • Composition of Leakage-Resilient PKE (Attempt 1): • Intuition does not formalize into a reduction. • Problem: cannot simulate L bits leakage on SK = (sk1,…, skn) by leaking only l < L bits of ski. • Do not know of an counterexample (even artificial). • but black-box reductions won’t work… • Composition using Leakage-Resilient IBE (Attempt 2): • Have an (artificial) counterexample. Idea: secret keys of identities 1,…,n contain secret-sharing of master secret key. • Good news: composition amplifies leakage resilience for PKE/IBE of special form. • Based on hash-proof-systems [CS02, NS09].

9. Leakage Resilience from Hash-Proof Systems • Earlier today: construction of Leakage-Resilient PKE from Hash-Proof Systems [NS09]. • R= {(pk,sk) pairs}. Many valid sk for each pk. • Three algorithms (Encap, BadEncap, Decap) • Good encapsulation: (e, k) = Encap(pk). • Bad encapsulation: e = BadEncap(pk). • Decapsulation: k = Decap(e, sk). • Can’t distinguish if e is good or bad (even given sk). • For fixed pk, bad e: Decap(e,sk) is statistically uniform. • Encryption/Decryption: use k as a one-time-pad. • Encrypt(m, pk) = (e, k+m) where (e,k) = Encap(pk).

10. Composition of Hash Proof Systems • Let PK = (pk1,…, pkn), SK = (sk1,…, skn). • Encrypt(m,pk) = (E, K+m) where • E = (e1,…, en, r) for (ei , ki ) = Encap(pki) • K = Extract(k1,…, kn; r)

11. Theorem: Composition of Hash-Proof Systems Amplifies Leakage • Show that: E = [e1,…, en, r], Leak(SK), K = Extract(k1,…, kn; r) Where (ei,ki ) = Encap(pki) E = [e1,…, en, r], Leak(SK), K = Extract(k1,…, kn; r) Where ei = Encap(pki), ki = Decap(ei, ski) E = [e1,…, en, r], Leak(SK), K = Extract(k1,…, kn; r) Where ei = BadEncap(pki), ki = Decap(ei, ski) E = [(e1,…, en), r], Leak(SK), Uniform INDISTINGUISHABLE |Uniform| = n|ki | - |Leak(SK)| - O(S)

12. How to get PKE in BRM? • Recap: “Attempt 1” scheme can be fixed using Hash-Proof Systems. • Long ciphertexts, public-keys, and no locality. • How to fix “Attempt 2” scheme based on IBE? • Need “Identity Based Hash-Proof System” (IB-HPS). • Formalized this new notion. • Result 1: IB-HPS gives us Leakage-Resilient IBE. • Result 2: IB-HPS gives us efficient PKE in BRM. • Resulting IBE is used to instantiate “Attempt 2” scheme. • Constructions?

13. Constructing IB-HPS • Construction based on the [Gentry06] IBE . • Based on “q-ABDHA” (pairing stuff....) • Allows leakage of (½ - ε ) of secret key. • Construction based on [GPV08] IBE. • Based on “LWE” (lattice stuff + RO) • Proven as leakage-resilient IBE by [AGV09]. • Allows leakage of (1 - ε ) of secret key.