Detection of Algebraic Manipulation with Applications to Robust

Detection of Algebraic Manipulation with Applications to Robust Secret Sharing and Fuzzy Extractors Ronald Cramer, Yevgeniy Dodis, Serge Fehr, Carles Padro, Daniel Wichs

Abstract Storage Device §(G) Properties of §(G): 1. §(G) provides privacy. 2. §(G) allows algebraic manipulation. g 2 G + Storage §(G) What’s g? ¢ 2 G

Abstract Storage Device §(G) Q: Why study devices with these properties? A: They appear implicitly in crypto applications: – – Secret Sharing Fuzzy Extractors Problem: Because of algebraic manipulation, the above primitives are vulnerable to certain active adversarial attacks. Task: A general method that helps us add “robustness” to secret sharing and fuzzy extractors.

Application: Secret Sharing S 1 S 6 S 5 S 2 g 2 Gblue wire!” s = “Cut the S 4 Qualified sets: can recover g. Unqualified sets: learn nothing about g. S 3

Application: Secret Sharing S 1 S 6 Unqualified Set S S’ 22 S 5 S 33 S’ S 44 S’ What’s g?

Application: Secret Sharing g’= Rec(S ’ , S 3 red ’ , Swire!” s’ = “Cut 1, S 2 the 4’, S 5, S 6) Robust Secret Sharing: An adversary who corrupts an unqualified set of players cannot cause the recovery of s’ s.

Linear Secret Sharing Assume Secret Sharing is Linear (i. e. [Sha 79, KW 93, …]) g’ =Rec(S 1, S’ 2, S’ 3, S’ 4, S 5, S 6 ) = Rec(S 1, S 2 , S 3 , S 4, S 5, S 6) + Rec(0, ¢ 2, ¢ 3, ¢ 4, 0, 0) =g+¢ So is limited to algebraic manipulation!

Linear Secret Sharing Need: A way to store data on §(G) so S 6 that algebraic manipulation can be detected. S 1 S 2 S 5 §(G) S 4 • Privacy of SS ) Privacy of §(G). • Linearity of SS ) Algebraic Manipulation. S 3

Algebraic Manipulation Detection (AMD) Codes An AMD Code consists of – A probabilistic encoding function E: S ! G – A decoding function D: G ! S [ {? } For any s, D(E(s)) = s For any s 2 S , ¢ 2 G Pr[D(E(s) + ¢) {s, ? }]· ² Robust Secret Sharing: Share E(s).

Robust Linear Secret Sharing Recall: g’ =Rec(S 1, S’ 2, S’ 3, S’ 4, S 5, S 6) = g + ¢ =E(s)+¢ D(g’) = D(E(s) + ¢) 2 {s, ? }

Construction of AMD Code Systematic AMD code: E(s) = (s, k, h(s, k)) where k is random. G = S £ G 1 £ G 2 Construction: d i h(s, k) = kd+2 + § s k i i=0 Intuition: ¢ 3 = h(s+¢ 1, k+¢ 2) – h(s, k) is a non-zero polynomial in k. – hence hard to guess for a random k.

Parameters and Optimality To get robustness security ² = 2 - ·, encoding of s adds overhead 2· + O(log(|s|)) bits. Almost matches lower bound of 2· bits. Previous constructions of Robust SS implicitly defined AMD codes with overhead linear in |s|. [CPS 02, OK 96, PSV 99] To share a 1 MB message with robustness ² = 2 -128 – – Previous construction had an overhead of 2 MB. We get an overhead of less than 300 bits.

Application #2 Fuzzy Extractors

Robust Fuzzy Extractors Secret w: “secret_Password” w Gen P R Secret w’: w ¼ w’ “Secret~password” P* Fuzzyextractor: Extractor: Robust fuzzy R looks I will detect P uniformly * P. random even after I see P. w’ Rep R R* ?

Robust Fuzzy Extractors Secret w’ Secret w (Bob in the future) w Gen P R P* w’ Does not allow interaction! Rep R/?

The Price of Robustness Non-robust fuzzy extractors with “good” parameters were constructed for several natural metrics. [DORS 04] Until now, to get robustness, you had to choose: – Interaction + computational assumptions + CRS [BDKOS 05] – Random Oracle model [BDKOS 05] – Entropy rate of w more than ½ + extract short keys [DKRS 06] Would like to get a non-interactive protocol that works for all entropy rates and does not require random oracles. I. T. robustness requires that the entropy rate of w is more than ½, even in the non-fuzzy case w=w’. – The price of robustness, w. o. RO/CRS/assumptions, is HIGH! [DS 02] This talk: Robustness is essentially FREE in the CRS model!

Randomness Extractors Secret: w Ext R Public Seed: i Can extract almost all entropy in w. The extracted string is random, even given The public seed (i, R) ¼ (i, U)

Non-fuzzy Key Exchange Not robust! Choose i i R=Ext(w, i)

Non-fuzzy Key Exchange CRS: Extractor seed i Robust! R=Ext(w, i) Trivial! No communication necessary! But does not generalize to fuzzy case…

Correcting Errors using a Secure Sketch w SS S w’ S Rec w SS(w) is very short and does not leak out much info about w.

Fuzzy Extractor Cannot put in CRS since S is user-specific. w Gen() : w i Ext w SS P = (i, S) w’ Rep(w’, P) : w’ Rec w i Ext R R Let’s try to only put i in S the CRS and S “authenticate” S. w

Robust Fuzzy Extractor? CRS: Extractor seed i w w’ P = (S, ¾) Rep(w’, P): Gen(): w i Ext w SS k S MAC R, Use k as a key R extracted k Split to a MAC to S ¾ randomness “authenticate” Into 2 parts. S w’ Rec w w i Ext R R k k S ¾ Ver “yes”, ”no” S

Robust Fuzzy Extractor? CRS: Extractor seed i w w’ P * = (S*, ¾*) Rep(w’, P): Gen(): w i Ext R, k w SS S k S MAC ¾ w’ S* w i k S* ¾* Rec w Ext R k Ver “yes”, ”no”

Robust Fuzzy Extractor? CRS: Extractor seed i w w’ P * = (S*, ¾*) Rep(w’, P): Gen(): w i w k S Ext R, k w’ SS S MAC ¾ Rec w* w* i Ext R k k S* ¾* Ver “yes”, ”no” S*

Robust Fuzzy Might not be Extractor? secure! CRS: Extractor seed i w But let’s see - how insecure is it? w’ Assume that the secure sketch P * = (S*, and extractor are¾*)linear. . . Rep(w’, P): Gen(): w i w k S Ext R, k w’ SS S w* i MAC ¾ S* k* S* ¾* Rec w* Ext R k* Ver “yes”, ”no”

Robust Fuzzy Extractor? CRS: Extractor seed i w w’ P * = (S*, ¾*) Rep(w’, P): Gen(): w i Ext R, k w SS S k S MAC ¾ w’ S+¢S w* i k* S* ¾* Rec w* Ext R k* Ver “yes”, ”no”

Robust Fuzzy Extractor? CRS: Extractor seed i w w’ P * = (S*, ¾*) Rep(w’, P): Gen(): w i w k S w’ Ext R, k S+¢S SS S w+¢w MAC ¾ i k* S* ¾* Rec w+¢w Ext R k* Ver “yes”, ”no”

Robust Fuzzy Extractor? CRS: Extractor seed i w w’ P * = (S*, ¾*) Rep(w’, P): Gen(): w i w k S w’ Ext R, k S+¢S SS S w+¢w MAC ¾ i k+¢k S* ¾* Rec Ext Ver w+¢w R k+¢k “yes”, ”no”

Robust Fuzzy Extractor? CRS: Extractor seed i • Can think of MAC key k as stored w w’ on a device §(G). = (S, ¾) • Can’t encode k P using an AMD code. Gen(): • Need a new MAC primitive. Rep(w’, P): w i Ext R w SS S k MAC S ¾ w’ k §(G) S* Rec w* w* i Ext R Ver “yes”, ”no” S* ¾*

MAC with Key Manipulation Security (KMS-MAC) A (one-time) MAC that is secure even if the key used for verification is stored on §(G). Given ¾ = MACk(s) can’t come up with ¢ and ¾’ = MACk+¢(s’). Systematic AMD code ) KMS-MAC: – E(s) = (s, k, h(s, k)) – MAC (k 1, k 2) (s) = h(s, k 1)+k 2

Use a KMS-MAC! Robust Fuzzy Extractor? CRS: Extractor seed i w w’ P * = (S*, ¾*) Rep(w’, P): Gen(): w i Ext R w SS S k MAC S ¾ w’ k §(G) S* Rec w* w* i Ext R Ver “yes”, ”no” S* ¾*

Parameters Because our KMS-MAC has short keys, we loose very little randomness to achieve robustness! In the CRS model, robustness comes essentially for FREE. – At least for “linear” fuzzy extractors

Review Devices §(G) appear naturally in crypto applications. – Linear Secret Sharing. – Fuzzy Extractors in CRS model. Use AMD codes or KMS-MACs to get robustness.

THANK YOU! Questions?