PUBLICKEY ENCRYPTION IN THE BOUNDEDRETRIEVAL MODEL Jol Alwen

PUBLIC-KEY ENCRYPTION IN THE BOUNDED-RETRIEVAL MODEL Joël Alwen, Yevgeniy Dodis, Moni Naor, Gil Segev, Shabsi Walfish, Daniel Wichs Eurocrypt 2010 Speaker: Daniel Wichs

Motivation Cryptographic security analyzed in formal “attack model”. Do our attack models capture reality? In reality, extra information about secret-keys can leak. � Side-channels attacks: timing, power, heat, EM radiation, acoustics. . . � Cold-boot attack [HSH+ 08] � Viruses Leakage-Resilient Crypto: � Add key-leakage to the attack model. � Build primitives that provably allow leakage of secret key.

Model of Leakage: Memory Attacks Adversary can learn any efficiently computable function f : {0, 1}* {0, 1}L of the secret key. L = [Akavia-Goldwasser-Vaikuntanathan 0 Leakage Bounded Retrieval. Model Relative-Leakage [Dzi 06, …, ADW 09]: [AGV 09, DKL 09, NS 09, …]. Maximize ratio ofto L allow to |sk|for more Grow secret-key (e. g. 90% of the Even key can leak). leakage. many Gigabytes. Efficiency does not degrade as |sk| grows. {Public key, ciphertext, computation time} f(sk) sk leak

Why design schemes for the BRM? Security against Viruses: � Upper bound how much attacker can download (e. g. 10 GB). Bandwidth � OK too low, cost too high, system security may detect. if secret key is large. Not OK if efficiency degrades. Security against side-channel attacks: � Leakage amount depends on the complexity of computation. � Leakage-resilient schemes might be less secure: + Leakage-resilience ) + Complexity ) + Leakage.

Prior Work on Leakage Resilience Memory Attacks Relative-Leakage: Symmetric and Public-Key Encryption and Authentication/Signatures. [AGV 09, DKL 09, ADW 09, KV 09, NS 09, …]. Bounded Retrieval Model: Symmetric and Public Key “Authenticated key Agreement. ” Requires interaction. [Dzi 06, CDD+07, ADW 09]. This work: Public-Key Encryption in the Bounded Retrieval Model. Restricted types of leakage functions. [CDH+00, DSS 01, KZ 03, ISW 03 , MR 04, DP 08, Pie 09, FKPR 10, GR 10, FRR+10, JV 10] Does not seem applicable to e. g. virus attacks.

Definition of PKE in BRM Adversar y pk f : {0, 1}* ! {0, 1}L Challenger (pk, sk) à Key. Gen(1, s. L ) f(sk) m 0 , m 1 c Output Pr[b’ = b] · ½ + negl(s) b’ bà {0, 1} cÃEncrypt(mb, pk) Key generation gets L as input. Adversary learns L bit leakage. Efficiency: pk size, ciphertext size, encryption/decryption times are all bounded by some fixed polynomials,

Outline of Talk A “high-level” template for constructing BRM schemes. “Identity Based Hash Proof System” (IB-HPS) Overview of IB-HPS constructions and parameters.

Template for BRM Schemes: 1. Leakage Amplification (via Parallel. Repetition) Start with: Scheme resilient to L’ bits of leakage. Construct: Scheme resilient to L >> L’ bits of leakage. Idea: Leakage Amplification via Parallel Repetition.

Template for BRM Schemes: 1. Parallel-Repetition Encryption Decryption c 1, c 2, …, cn ci = Enc(mi, pki) PK= pk 1 pk 2 pk 3 … pkn SK= sk 1 sk 2 sk 3 … skn To encrypt under PK. Secret-share message m into n shares m 1, …, mn. Encrypt each share mi separately under pki.

Template for BRM Schemes: 1. Security of Parallel-Repetition? Theorem (? ): n-wise parallel repetition amplifies leakage-resilience by a factor of n. Hope: Need to leak L’ bits on each of n keys to break the ‘repetition scheme’. �… but maybe not a different L’ bits on each key. So is theorem true? � Not in general. Recent counterexample by [Lewko. Waters 10]! � Yes in special cases (“hash proof systems”). Stay tuned.

Template for BRM Schemes: 1. Efficiency of Parallel-Repetition? Encryption Decryption c 1, c 2, …, cn ci = Enc(mi, pki) PK= pk 1 pk 2 pk 3 … pkn SK= sk 1 sk 2 sk 3 … skn Problem 1: Ciphertext-size, computation proportional to n. Problem 2: Public-key size proportional to n.

Template for BRM Schemes: 2. Small random subsets. Encryption Decryption (idx 1, c 1)…, (idxt, ct) ci = Enc(mi, pkidxi) PK= pk 1 pk 2 pk 3 … pkn SK= sk 1 sk 2 sk 3 … skn Encryptor chooses small random subset of t << n indices. Encrypts t shares under the corresponding t publickeys. Hope: to break scheme, need to have leaked L’ bits

Template for BRM Schemes: 3. Adding a Master Public Key. Encryption Decryption (idx 1, c 1)…, (idxt, ct) ci = Enc(mi, idxi) PK= MPK SK= sk 1 sk 2 sk 3 … Use Identity-Based Encryption (IBE) PK is master-public-key of IBE. SK consists of keys ski for identities i=1, …, n. skn

Template for BRM Schemes: 3. Adding a Master Public Key. Encryption Decryption (idx 1, c 1)…, (idxt, ct) ci = Enc(mi, idxi) PK= MPK SK= sk 1 sk 2 sk 3 … skn Scheme meets efficiency requirements of the BRM. Security? Does not amplify leakage-resilience in

Outline of Talk A “high-level” template for constructing BRM schemes. “Identity Based Hash Proof System” (IB-HPS) IB-HPS constructions and parameters.

Key Encapsulation Mechanism (KEM) A KEM can be used to encrypt a random message m. (pk, sk)ÃKey. Gen(1 s) (c, m)ÃEncap(pk) m à Dec(c, sk)

Hash Proof System (HPS): A Special KEM SKpk Dec(c, SKDec(c*, pk) SKpk) For each pk, many possible sk. Key. Gen outputs skÃSKpk. Correctness: if (c, m)ÃEncap(pk) then Dec(c, sk) = m for all sk. Bad Encapsulation: c* Ã Encap*(pk). Dec(c*, sk) is different for each sk.

HPS and Leakage Resilient KEM Theorem [Naor-Segev 09]: A HPS is a Leakage-Resilient KEM. L ¼ log(|SKpk |). Proof: Can’t distinguish Looks skÃSKpk ‘bad’ Show: ciphertext random Dec(c, sk) Dec (c*, sk) m still has entropy If leakage < log(|SK pk |) given view of adv still has uncertainty about sk. Use extractors.

Parallel-Repetition of HPS Theorem: Parallel repetition of a HPS amplifies leakage-resilience. Leakage of HPS is L ¼ log(|SKpk |) n-wise parallel repetition results in new HPS with SK’pk = SKpk x … x SKpk n times Can show that “random subset selection” also works.

Identity-Based Hash Proof System (IBHPS) Global ‘master’ parameters: (MPK, MSK). For each identity, the secret-key sk. ID comes from a large set. � Can efficiently sample from any SKID only if given MSK. Encapsulation targets a specific identity: � Good � Bad (c, m) Ã Encap(ID, MPK) c* Ã Encap*(ID, MPK). SKID 1 SKID 2 …

Applications of IB-HPS Directly gives leakage-resilient IBE in relative-leakage model. Can be used to instantiate our framework. Leakage-amplification works! ) Get PKE/IBE in the Bounded Retrieval Model.

Outline of Talk A “high-level” template for constructing BRM schemes. “Identity Based Hash Proof System” (IB-HPS) IB-HPS constructions and parameters.

Constructions Scheme Assumption Bilinear Groups ABDHE [Gen 06] Standard Model Relative Leakage 1/2 Quadratic Residuosity [BGH 07] QR RO Model 1/O(s) Lattices [GPV 08] LWE RO Model (1 -²)

Thank You! Questions?