1 / 13

Advances in Leakage Resilience: Public-Key Encryption in the Bounded-Retrieval Model

This research explores the concept of Leakage Resilience within the Bounded-Retrieval Model (BRM) in cryptographic systems, particularly focusing on Public-Key Encryption (PKE). The aim is to develop PKE schemes that maintain security even when an adversary gains access to partial information about secret keys. We introduce novel techniques to ensure that public keys and ciphertext sizes remain manageable despite high leakage thresholds, and analyze the security implications against both viruses and side-channel attacks.

trilby
Download Presentation

Advances in Leakage Resilience: Public-Key Encryption in the Bounded-Retrieval Model

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Earlier Today: Yevgeniy covered ID schemes, Signatures, Interactive Encryption/Authentication/AKA Public-Key Encryption in the Bounded-Retrieval Model Joël Alwen, YevgeniyDodis, MoniNaor, Gil Segev, ShabsiWalfish, Daniel Wichs

  2. Leakage Resilience and the BRM • Leakage Resilience: Cryptographic schemes that remain secure even if adversary learns partial information about sk. • Goal: High relative leakage. • Bounded Retrieval Model: Absolute size of leakage can be arbitrarily large (bits, Mb, Gb…). • Accommodate any leakage threshold by increasing key size flexibly. • No other loss of efficiency! [AGV09, NS09,…] sk f(sk) leak [Dzi06, CLW06,…] 90% of |sk|

  3. Why have schemes in the BRM? • Security against viruses: • Virus downloads arbitrary information from local storage and sends it to a remote attacker. • In practice, virus cannot download too much (< 10 GB). • Bandwidth too low, Cost too high, System security may detect. • Security against side-channel attacks: • Adversary gets some “physical output” of computation. • May be unreasonable to learn “too much” info, even after many physical readings. • How much is “too much” depends on physical implementation (few Kb - few Mb).

  4. Prior Work • Leakage Resilience (No BRM): • Symmetric-Key Authenticated Encryption [DKL09] • Public-KeyEncryption [AGV09, NS09, KV09] • Signatures [ADW09, Katz09] • Bounded Retrieval Model: • Secret Sharing [DP07] • Symmetric-Key Identification and Authenticated Key Agreement [Dzi06,CDD+07] • Public-Key ID schemes, Signatures, Authenticated Key Agreement [ADW09] • Now: Public-KeyEncryption in the BRM.

  5. Public-Key Encryption in the BRM • Goal: PKE parameterized by security parameter s (e.g. 256 bits) and leakage bound L (e.g. 256 bits - 10GB). • Secret Key size is flexible: |sk| = (1 + ε)L. • Public Keys and Ciphertexts are short, only depend on s. • Decryption is local. Number of bits accessed is proportional to s. • Naïve Attempt : “Take any leakage-resilient PKE tolerating l(|sk|) leakage. Increase security parameter s until l(|sk|) > L.” • Problem: Public-key/Ciphertext size depends on L. May be huge. • Problem: Decryption is not local. • Problem: Computation over groups with 10 GB description length. • Positive: Very Secure!

  6. PKE in the BRM via Composition of PKE • Attempt #1: “Compose n copies of Leakage-Resilient PKE” • Generate n pairs (pk1,sk1),…, (pkn, skn). Set PK = (pk1,…, pkn), SK = (sk1,…, skn). • To encrypt m: • Compute shares (s1,…, sn) such that m = s1 + …+ sn. • Set c1=Enc(pk1, s1),…, cn=Enc(pkn, sn). • Ciphertext is C = (c1 ,…, cn). • Hope: Composed scheme amplifies leakage from lto L = n lbitswithout unnecessary increase in security parameter. • Intuition: To break the composed scheme, must leak l bits about each of (sk1,…, skn). • Unfortunately ciphertext size, public key size and locality are still large. PK SK pk1 sk1 pk2 sk2 … … Can intuition be formalized? Stay tuned… pkn skn

  7. PKE in the BRM via Composition of IBE • Attempt #2: Use Leakage-Resilient IBE to Reduce Public-Key Size. • Generate a master-key pair (MPK, MSK) for an IBE. • Use MSK to generate keys sk1,…, sknfor identities 1,…,n. • Set PK = MPK, SK = (sk1,…, skn). Delete MSK. • To encrypt m: • Compute shares (s1,…, st) such that m = s1 + …+ st. • Choose t random identities IDi∊ [n]. • Set c1=Enc(ID1, s1),…, cn=Enc(IDt, st). • Ciphertext is C = (ID1 ,…, IDt , c1 ,…, ct). • Good news: Ciphertext, Public-Key, Locality is proportional to security parameter. • Need leakage resilient IBE. (Of Independent Interest) • Is the composition secure? SK MPK sk1 ID=1 ID=2 sk2 … Random Subset of [n] skn ID=n

  8. Does Composition Amplify Leakage Resilience? • Composition of Leakage-Resilient PKE (Attempt 1): • Intuition does not formalize into a reduction. • Problem: cannot simulate L bits leakage on SK = (sk1,…, skn) by leaking only l < L bits of ski. • Do not know of an counterexample (even artificial). • but black-box reductions won’t work… • Composition using Leakage-Resilient IBE (Attempt 2): • Have an (artificial) counterexample. Idea: secret keys of identities 1,…,n contain secret-sharing of master secret key. • Good news: composition amplifies leakage resilience for PKE/IBE of special form. • Based on hash-proof-systems [CS02, NS09].

  9. Leakage Resilience from Hash-Proof Systems • Earlier today: construction of Leakage-Resilient PKE from Hash-Proof Systems [NS09]. • R= {(pk,sk) pairs}. Many valid sk for each pk. • Three algorithms (Encap, BadEncap, Decap) • Good encapsulation: (e, k) = Encap(pk). • Bad encapsulation: e = BadEncap(pk). • Decapsulation: k = Decap(e, sk). • Can’t distinguish if e is good or bad (even given sk). • For fixed pk, bad e: Decap(e,sk) is statistically uniform. • Encryption/Decryption: use k as a one-time-pad. • Encrypt(m, pk) = (e, k+m) where (e,k) = Encap(pk).

  10. Composition of Hash Proof Systems • Let PK = (pk1,…, pkn), SK = (sk1,…, skn). • Encrypt(m,pk) = (E, K+m) where • E = (e1,…, en, r) for (ei , ki ) = Encap(pki) • K = Extract(k1,…, kn; r)

  11. Theorem: Composition of Hash-Proof Systems Amplifies Leakage • Show that: E = [e1,…, en, r], Leak(SK), K = Extract(k1,…, kn; r) Where (ei,ki ) = Encap(pki) E = [e1,…, en, r], Leak(SK), K = Extract(k1,…, kn; r) Where ei = Encap(pki), ki = Decap(ei, ski) E = [e1,…, en, r], Leak(SK), K = Extract(k1,…, kn; r) Where ei = BadEncap(pki), ki = Decap(ei, ski) E = [(e1,…, en), r], Leak(SK), Uniform INDISTINGUISHABLE |Uniform| = n|ki | - |Leak(SK)| - O(S)

  12. How to get PKE in BRM? • Recap: “Attempt 1” scheme can be fixed using Hash-Proof Systems. • Long ciphertexts, public-keys, and no locality. • How to fix “Attempt 2” scheme based on IBE? • Need “Identity Based Hash-Proof System” (IB-HPS). • Formalized this new notion. • Result 1: IB-HPS gives us Leakage-Resilient IBE. • Result 2: IB-HPS gives us efficient PKE in BRM. • Resulting IBE is used to instantiate “Attempt 2” scheme. • Constructions?

  13. Constructing IB-HPS • Construction based on the [Gentry06] IBE . • Based on “q-ABDHA” (pairing stuff....) • Allows leakage of (½ - ε ) of secret key. • Construction based on [GPV08] IBE. • Based on “LWE” (lattice stuff + RO) • Proven as leakage-resilient IBE by [AGV09]. • Allows leakage of (1 - ε ) of secret key.

More Related