Foundations. P =! NP oneway function signature schemes Trapdoor oneway function PKC, IBS IBE

Transcription

1

2 Foundations P =! NP oneway function signature schemes Trapdoor oneway function PKC, IBS IBE NP problems: IF, DL, Knapsack Hardness of these problems implies the security of cryptosytems? 2

3 Relations of Problems 3

4 Hard Problems Relations between Hard Problems DL Problem: find x in Z from (g, g x ) DH Problem: find g ab from (g, g a, g b ) DDH Problem: determine whether g c =g ab from (g,g a,g b,g c ) Usage DL: mathematical base problem DH: a security of protocols relies on this (for one instance) DDH: more rigorous security is based on this (for class of instances) DLP > DHP > DDHP Are they equivalent? 4

5 RSA Cases.. Integer factorization problem Find a factorization (p,q) given a composite n=pq RSA problem Let n=pq e is odd Given m, find m 1/e mod n It is believed that RSA is not equivalent to IFP Ref: Boneh and Venkatesan, Breaking RSA may not be equivalent to factoring in Eurocrypt 98 Abstract: We provide evidence that breaking low-exponent RSA cannot be equivalent to factoring integers. We show that an algebraic reduction from factoring to breaking lowexponent RSA can be converted into an efficient factoring algorithm. Thus, in effect an oracle for breaking RSA does not help in factoring integers. Our result suggests an explanation for the lack of progress in proving that breaking RSA is equivalent to factoring. We emphasize that our results do not expose any weakness in the RSA system. 5

6 DL = DH? Consider a DLP on a group of order p [Maurer, C94] DLP is equivalent to DHP if one can find an elliptic curve over F p whose number of points are smooth. For example, if p+1 is smooth, DLP is equiv. to DDH on a group of order p Extend to hyperelliptic curves The complexity O(log^3 p) group operations O(log^3 p) calls of the DH oracle 6

7 Problem Conversion Proof of Sketch (DL=DH) Given g, h=g m in G of prime order p, find m Assume we have a DH oracle with g ab =DH g (g a,g b ) Let P=(u,v) be a generator of E(F p ). Q=(m,n) in E(F q ) Find s with Q=sP using pseudo operations We know g u, g v,g m,g n. Can solve ECDLP if #E(F q ) is smooth. (e.g. Pohlig-Hellman) The algorithm (e.g. elliptic curve addition) consists of several additions and multiplications g ab =DH(g a,g b ) and g a+b =g a g b We can compute s from g m rather than the real m Compute m from Q=sP We know P and s. Compute Q and m=x[q] 7

8 Weil Pairing φ(p,q): E[n] E[n] GF(q r ) * where e(p,q) = f P (A Q )/f Q (A P ) with (f P )=A p and A P ~ (P)-(O) Properties e(p,p)=1 for all P in E[n] [Bilinear] e(p 1 +P 2,Q)=e(P 1,Q)e(P 2,Q) and e(p,q 1 +Q 2 )=e(p,q 1 )e(p,q 2 ) [Alternating] e(p,q)=e(q,p) [Non-Degenerate] e(p,q)=1 for all Q in E[n] implies P=O [n-th root] e(p,q) n =1 Modified Weil Pairing Let E[n]=Z/n Z/n = <R 1 > <R 2 > and ϕ : <R 1 > <R 2 > with ϕ(r 1 )=R 2 Define a modified Weil paring e (P,Q)=e(P, ϕ(q)) Then e (P,P)!=1. Use e instead of e (why? See TPKA) Usually, ϕ sends a point in E(F q ) to a point in E(F q^2 ) or its twist. 8

9 DDH DDH = Poly? Given (P,aP,bP,cP), if e(p,cp)=p(ap,bp), then c =ab mod p e is efficiently computable when r is small. Exponent r r =< 6 if E is supersingular Expected value r for random E is Find the smallest r s.t. n=#e(f q ) q r -1 q r =1 mod n r is the multiplicative order of q in Z/nZ r ~ phi(n) No known algorithm for DDH on F q of prime order 9

10 Granularity DH G =DHg? DH g : DH problem with a fixed generator g DH G : DH g for all g in G We have DL G =DL g DH G =DH g DH g (h x,h y )=DH g (g ax,g ay )=g a^2xy g a^{-1} =g a^{p-2} can be computed by repeated DH and Mul. DH g (g a^2xy,g a^{-1} )=h xy DDH G!= DDH g Square Exponent (SE) and Inversion Exponent (IE) 10

11 With Bilinear Maps 11

12 New Assumptions related to bilinear maps Let e: G G H for two groups of prime order. e(g,g)=h New Assumptions BDL Problem: find t in Z s.t. e(g a,g b )=e(g,g) t from (g,g a,g b ) BDH Problem: find e(g,g) abc from (g, g a, g b,g c ) DBDH Problem: determine whether e(g,g) abc =h d from (g,g a,g b,g c,h d ) (That is, abc=d mod p) 12

13 Relations of DH problems with a Bilinear Map DL h DL g BDL g DH h DH g BDH g DDH h DDH g and DBDH g DDH g DBDH g Q: BDH = DH? 13

14 If e is weak-invertible,.. A bilinear map e: G G H is said to be weak-invertible if there is an efficiently computable inverse image (g 1,g 2 ) for any h H. That is, e(g 1,g 2 )=h DL g DL h BDH g = DL g DH h DH g DH h 14

15 If e is strong invertible,.. A bilinear map e: G G H is said to be strong-invertible if there is an element g in G s.t. an inverse image g is efficiently computable inverse image for any h H. That is, e(g,g)=h Assume e: G G H and f: H G are efficiently computable. We can solve the DH G problem by O(log p) evaluation of e Assume we have a self-bilinear map e: G G H Q: e is invertible? 15

16 Strong Diffie-Hellman 16

17 RSA N=pq for two primes p and q e>3 is relatively prime to φ(n) Given m Z N, find m 1/e Z N Classical Problems DLP: Given g and g a in G, find a CDHP: Given (g,g a,g b ), compute g ab DDHP: Given (g,g a,g b,g c ), decide if g c =g ab Relax the assumption 17

18 How to relax the problems? To design a new system with additional properties To prove the security without random oracles How to get a good grade in an exam? Flexible grading More Hints before the test 18

19 Relax the Problems: Flexible Grading Flexible RSA Problem (BP97,CS99,GHR99) Given a composite n and a message m in Z/n Find (e,m^{1/e}) for some e>2 LRSW Problem (LRSW99) Given g,g x,g y Gandm Z, output (a,a y,a x+mxy ) for some a G 19

20 l -Weak DHP Relax the Problems: More Hints (1/2) Given g, g a,, g a^l, compute g^{1/a} Traitor Tracing [Mitsunari-Sakai-Kasahara 02] l -Strong DHP: Given g, g a,, g a^l, compute g a^{l+1} Short Signatures without Random Oracles[BB04s] Short Group Signatures[BBS04] 20

21 Relax the Problems: More Hints (2/2) e: GxG G : a bilinear map l-bilinear DH Inversion Problem Given g, g a,, g a^l, compute e(g,g) 1/a Identity-based Encryptions[BB04e] Verifiable Random Functions[DY05] l-bilinear DH Exponent Problem Given h,g,,g a^{l-1},g a^{l +1},,g a^{2l}, compute e(g,h) a^l HIBE with constant size Ciphertext[BBG05] Public Key Broadcast Encryption[BGW05] More 21

22 The same security? Time-Memory-Data Trade-off [HS05] More data reduce the online and offline computation time Strong Diffie-Hellman We know l additional information: g x^2, g x^3,, g x^l 22

23 Main Results Given g, g a, a can be computed in O(log p (p/d) 1/2 ) group operations using O((p/d) 1/2 ) memory if either P - : p-1 has a positive divisor d < p 1/2 and g a^d are provided or P + : p+1 has a positive divisor d < p 1/3 and g a^2,,g a^d are provided The new algorithm reduces the complexity by O( d/log p) 23

24 Orders of Elliptic Curves NIST Curves B-163: p 1 = (a 132 bit prime) K-163: p 1 = (a 16 bit prime) (an 18 bit prime) (a 112 bit prime) P-192: p 1 = (an 83 bit prime) (a 92 bit prime) EC with embedding degree 6 E+(F 3^97 ): p 1 = E+(F 3^121 ): p 1 = (a 123 bit prime 24

25 Applications Schemes based on q-strong DH and its variants CCA or CMA against schemes based on DH assumptions Boldyreva s Blind Signature (sk,pk)=(x,xp), Sign(M)=xM Query to a Signing Oracle to get xp, x 2 P, x 3 P, Original ElGamal Encryption Scheme Query to a Decryption Oracle 25

26 An Example BGW Broadcast Encryption for n users is based on (2n)-BDHE assumptions E + (F 3^97 ) has a subgroup G of 151 bit prime order Attack Pollard rho: O(2 76 ) elliptic curve operations Proposed attack: O(2 59 ) Exponentiations for n=2 32 O(2 42 ) Exponentiations for n=2 64 as in file sharing Need 220 bit prime for 2 80 security with 2 64 users 26

27 Embedding to (Hyper-) Elliptic Curves? Find an embedding of Z/p to an elliptic curve over Z/p Let E: y^2=x^3+ax+b for A,B Z/p Given a Z/p, find b Z/p s.t. (a,b) E(Z/p) b=(a^3+aa+b) 1/2 : expressed by high powers of a g^b is not easy to compute using g a,, g a^d Can we implement BSGS w/o computing b? 27

28 Strong Prime? Find a prime p Neither p-1 nor p+1 has a divisor d s.t. log 2 p<d< p How to construct? Use CRT for p=1 mod p 1 and p=-1 mod p 2 Usually p becomes as large as p 1 p 2 Flexible RSA or LRSW? 28

29 Composite Order Bilinear Map 29

30 Composite Order Bilinear Maps Decision 3-party Diffie-Hellman Assumption Given a group G p of prime order p and random elements g p Subgroup Decision Problem G: a group of order n=pq Given a generator g q G q and g G Determine if a random element T of G is of order p Bilinear Subgroup Decision Problem (Traitor Tracing, Alg. Homo) G: a group of order n=pq, E: G x G G T Given g p G p of order p, g q G q of order q Determine if a random element T in G T is of order p 30

31 A Sequence of Bilinear Maps 31

32 Multilinear Map Definition Let G and H be two groups of prime order p A map e n : G n H is n-multilinear if e is linear on each variable. Applications Non-interactive n-party key agreement scheme Broadcast encryption scheme Unique signature scheme 32

33 Assumption A family of bilinear maps G n : a cyclic group of order p e n : G n G n G n+1 : bilinear map Multilinear map: f n : G 1n G n f 2 =e 2 f n (x 1,,x n )=e n-1 ( f n-1 (x 1,,x n-1 ), f n-1 (x n,g,..,g)) 33

34 Non-interactive Multiparty Key Agreement System Parameter G: a cyclic group of prime order p g G: a generator e n : G n H: n-multilinear map Key Setup Secret Key for user i =a i Z/p Public Key for user i =g ai Key Agreement Shared key of n+1 users = e n (g a1,g a2,..,g a_n ) a_{n+1}= e n (g,g,..,g) a1a2 a_{n+1} Applications: Video Conferencing, Secure group communications, Broadcast encryption, Secure storage network 34

35 System Parameter Forward-Secure Diffie-Hellman G n : cyclic group of composite order N g n G n : a generator e n : G n G n G n+1 : bilinear map Initial Key Setup sk 1 =a Z/n, pk 1 =g 1 a Key Evolution sk n+1 = sk n2 = a 2^n mod N pk n+1 =e n+1 (pk n,pk n )= g n+1^{a 2^n } mod N Key Agreement Shared key = {Alice s pk n }^{Bob s sk n } Applications: Forward secure encryption/signature, shredding 35