General Impossibility of Group Homomorphic Encryption in the Quantum World

Transcription

1 General Impossibility of Group Homomorphic Encryption in the Quantum World Frederik Armknecht Tommaso Gagliardoni Stefan Katzenbeisser Andreas Peter PKC 2014, March 28th Buenos Aires, Argentina 1

2 An example Consider the basic, unpadded RSA: let N = pq for large primes p and q, consider group (Z n, ) public exponent e s.t. gcd(e, φ(n)) = 1 secret exponent d = e 1 mod φ(n) Enc(m) = m e mod N for plaintext m Dec(c) = c d mod N for ciphertext c. 2

3 An example Consider the basic, unpadded RSA: let N = pq for large primes p and q, consider group (Z n, ) public exponent e s.t. gcd(e, φ(n)) = 1 secret exponent d = e 1 Enc(m) = m e mod φ(n) mod N for plaintext m Dec(c) = c d mod N for ciphertext c. Now consider two plaintexts m 1, m 2, and consider the product of their encryptions: c 1 = Enc(m 1 ), c 2 = Enc(m 2 ) Dec(c 1 c 2 ) = Dec(m e 1 me 2 ) = Dec((m 1 m 2 ) e ) = (m 1 m 2 ) ed mod N = m 1 m 2. 2

4 An example Consider the basic, unpadded RSA: let N = pq for large primes p and q, consider group (Z n, ) public exponent e s.t. gcd(e, φ(n)) = 1 secret exponent d = e 1 Enc(m) = m e mod φ(n) mod N for plaintext m Dec(c) = c d mod N for ciphertext c. Now consider two plaintexts m 1, m 2, and consider the product of their encryptions: c 1 = Enc(m 1 ), c 2 = Enc(m 2 ) Dec(c 1 c 2 ) = Dec(m e 1 me 2 ) = Dec((m 1 m 2 ) e ) = (m 1 m 2 ) ed mod N = m 1 m 2. In this case, decryption is a group homomorphism. 2

5 Group Homomorphic Encryption (GHE) A public-key encryption scheme E = (KeyGen, Enc, Dec) is called group homomorphic if, for any (pk, sk) Keygen(λ): 3

6 Group Homomorphic Encryption (GHE) A public-key encryption scheme E = (KeyGen, Enc, Dec) is called group homomorphic if, for any (pk, sk) Keygen(λ): the plaintext space P is a group in respect to 3

7 Group Homomorphic Encryption (GHE) A public-key encryption scheme E = (KeyGen, Enc, Dec) is called group homomorphic if, for any (pk, sk) Keygen(λ): the plaintext space P is a group in respect to the set of encryptions C := { Enc pk (m; r) m P, r Rnd } is a group in respect to 3

8 Group Homomorphic Encryption (GHE) A public-key encryption scheme E = (KeyGen, Enc, Dec) is called group homomorphic if, for any (pk, sk) Keygen(λ): the plaintext space P is a group in respect to the set of encryptions C := { Enc pk (m; r) m P, r Rnd } is a group in respect to the decryption is a group homomorphism: Dec sk (c 1 c 2 ) = Dec sk (c 1 ) Dec sk (c 2 ), for every c 1, c 2 C. 3

9 Group Homomorphic Encryption (GHE) A public-key encryption scheme E = (KeyGen, Enc, Dec) is called group homomorphic if, for any (pk, sk) Keygen(λ): the plaintext space P is a group in respect to the set of encryptions C := { Enc pk (m; r) m P, r Rnd } is a group in respect to the decryption is a group homomorphism: Dec sk (c 1 c 2 ) = Dec sk (c 1 ) Dec sk (c 2 ), for every c 1, c 2 C. (from now on we will only consider Abelian groups) 3

10 Fully Homomorphic Encryption (FHE) In Fully Homomorphic Encryption we have the following properties: plaintext and ciphertext spaces are rings, not just groups (so there are two operations) the set of encryptions C is usually just a set, not necessarily a group the decryption is guaranteed to run correctly only after less than p(λ) evaluations for some polynomial p. (even if p can be adjusted dynamically through bootstrapping, in GHE the decryption is guaranteed even after unbounded many evaluations) 4

11 The dierences 5

12 The dierences 5

13 The dierences 5

14 The dierences 5

15 The dierences GHE is not `FHE with just one operation': it is something dierent. 5

16 Examples of GHE schemes RSA ElGamal Goldwasser-Micali Pailler... 6

17 Examples of GHE schemes RSA ElGamal Goldwasser-Micali Pailler... Shor's algorithm Factorization of integers in quantum PPT. 6

18 Examples of GHE schemes RSA ElGamal Goldwasser-Micali Pailler... broken Shor's algorithm Factorization of integers in quantum PPT. 6

19 Examples of GHE schemes RSA ElGamal Goldwasser-Micali Pailler... broken Shor's algorithm Factorization of integers in quantum PPT. Watrous' and other variants Discrete logarithm and many related computational problems in quantum PPT. 6

20 Examples of GHE schemes RSA ElGamal Goldwasser-Micali Pailler... broken broken broken broken Shor's algorithm Factorization of integers in quantum PPT. Watrous' and other variants Discrete logarithm and many related computational problems in quantum PPT. 6

21 Examples of GHE schemes RSA ElGamal Goldwasser-Micali Pailler... broken broken broken broken Shor's algorithm Factorization of integers in quantum PPT. Watrous' and other variants Discrete logarithm and many related computational problems in quantum PPT. Question Is GHE possible at all in the quantum world? 6

22 Our result Theorem Let E be any IND-CPA secure GHE scheme. Then there exists a PPT quantum algorithm which breaks the security of E with non-negligible probability. 7

23 IND-CPA Security 8

24 IND-CPA Security 8

25 Subgroup Membership Problem (SMP) Consider a group G and a non-trivial subgroup H < G. 9

26 Subgroup Membership Problem (SMP) Consider a group G and a non-trivial subgroup H < G. Given an element x G drawn from some distribution: Problem: decide whether x H or x G \ H. 9

27 Subgroup Membership Problem (SMP) Consider a group G and a non-trivial subgroup H < G. Given an element x G drawn from some distribution: Problem: decide whether x H or x G \ H. Remark In a GHE scheme, the set of encryptions of the neutral element 1 G, { Enc pk (1 G ; r) r Rnd } is a subgroup of the ciphertext group. 9

28 Subgroup Membership Problem (SMP) Consider a group G and a non-trivial subgroup H < G. Given an element x G drawn from some distribution: Problem: decide whether x H or x G \ H. Remark In a GHE scheme, the set of encryptions of the neutral element 1 G, { Enc pk (1 G ; r) r Rnd } is a subgroup of the ciphertext group. Theorem For GHE schemes, IND-CPA security implies hardness of SMP respect to the subgroup of encryptions of 1 G. notice: vice versa does not hold. 9

29 An attack based on Order Finding Order Finding Problem (OFP): given a non-trivial subgroup H < G, nd the order (cardinality) of H. 10

30 An attack based on Order Finding Order Finding Problem (OFP): given a non-trivial subgroup H < G, nd the order (cardinality) of H. There is a simple way of reducing SMP to OFP. Given G, H, x G : 1 compute order of H 2 compute order of H, x (subgroup generated by H and x) 3 x H i the two orders are the same. 10

31 An attack based on Order Finding Order Finding Problem (OFP): given a non-trivial subgroup H < G, nd the order (cardinality) of H. There is a simple way of reducing SMP to OFP. Given G, H, x G : 1 compute order of H 2 compute order of H, x (subgroup generated by H and x) 3 x H i the two orders are the same. Watrous' order-nding quantum algorithm Given generators g 1,..., g k of subgroup H < G, there exists a PPT quantum algorithm which outputs o(h). 10

32 An attack based on Order Finding Order Finding Problem (OFP): given a non-trivial subgroup H < G, nd the order (cardinality) of H. There is a simple way of reducing SMP to OFP. Given G, H, x G : 1 compute order of H 2 compute order of H, x (subgroup generated by H and x) 3 x H i the two orders are the same. Watrous' order-nding quantum algorithm Given generators g 1,..., g k of subgroup H < G, there exists a PPT quantum algorithm which outputs o(h). Done! 10

33 End of this talk Thanks for your attention! 11

34 Not so fast... 12

35 Not so fast... What do we mean by a description of a group H? 12

36 Not so fast... What do we mean by a description of a group H? a black-box sampling algorithm to sample elements in H 12

37 Not so fast... What do we mean by a description of a group H? a black-box sampling algorithm to sample elements in H an explicit description of the neutral element 12

38 Not so fast... What do we mean by a description of a group H? a black-box sampling algorithm to sample elements in H an explicit description of the neutral element black-box access to the group operation 12

39 Not so fast... What do we mean by a description of a group H? a black-box sampling algorithm to sample elements in H an explicit description of the neutral element black-box access to the group operation black-box access to the inversion of group elements 12

40 Not so fast... What do we mean by a description of a group H? a black-box sampling algorithm to sample elements in H an explicit description of the neutral element black-box access to the group operation black-box access to the inversion of group elements Notice: in GHE, we do not necessary have a set of generators. 12

41 The problem 13

42 The problem Recall: we want to solve the SMP in G in respect to the subgroup of the encryption of 1 G ; this would break IND-CPA security. 13

43 The problem Recall: we want to solve the SMP in G in respect to the subgroup of the encryption of 1 G ; this would break IND-CPA security. Idea: use the sampling algorithm by requesting encryptions of the neutral element, and hope to nd a set of generators after not too many samples. 13

44 The uniform case If the Enc algorithm samples form H according to the uniform distribution, where ord(h) 2 k, then: Theorem [Pak,Bratus,'99] Sampling k + 4 elements yields a generating set for H with probability

45 The uniform case If the Enc algorithm samples form H according to the uniform distribution, where ord(h) 2 k, then: Theorem [Pak,Bratus,'99] Sampling k + 4 elements yields a generating set for H with probability 3 4. But in general we can have arbitrary distributions! 14

46 Arbitrary distribution Much more dicult. 15

47 Arbitrary distribution Much more dicult. Idea: we restrict to a large enough subgroup. 15

48 Arbitrary distribution Much more dicult. Idea: we restrict to a large enough subgroup. Details are tricky 15

49 Arbitrary distribution Much more dicult. Idea: we restrict to a large enough subgroup. Details are tricky Theorem If H < G is a sampleable subgroup according to arbitrary distribution D, with ord(h) 2 k, then: sampling 7k (2 + log(k) ) + 1 elements yields a generating set for H with probability 3 4, regardless of D. 15

50 The attack 1 generate a large enough number of encryptions of the neutral element 1 G, obtaining c 1,..., c n 16

51 The attack 1 generate a large enough number of encryptions of the neutral element 1 G, obtaining c 1,..., c n 2 run Watrous' algorithm on {c 1,..., c n }, obtaining order o 1 16

52 The attack 1 generate a large enough number of encryptions of the neutral element 1 G, obtaining c 1,..., c n 2 run Watrous' algorithm on {c 1,..., c n }, obtaining order o 1 3 play the IND-CPA game by choosing m 0 = 1 G and m 1 1 G ; receive challenge ciphertext c 16

53 The attack 1 generate a large enough number of encryptions of the neutral element 1 G, obtaining c 1,..., c n 2 run Watrous' algorithm on {c 1,..., c n }, obtaining order o 1 3 play the IND-CPA game by choosing m 0 = 1 G and m 1 1 G ; receive challenge ciphertext c 4 run Watrous' algorithm on {c 1,..., c n, c}, obtaining order o 2 16

54 The attack 1 generate a large enough number of encryptions of the neutral element 1 G, obtaining c 1,..., c n 2 run Watrous' algorithm on {c 1,..., c n }, obtaining order o 1 3 play the IND-CPA game by choosing m 0 = 1 G and m 1 1 G ; receive challenge ciphertext c 4 run Watrous' algorithm on {c 1,..., c n, c}, obtaining order o 2 5 if o 1 = o 2 then output 0, else output 1 16

55 The attack 1 generate a large enough number of encryptions of the neutral element 1 G, obtaining c 1,..., c n 2 run Watrous' algorithm on {c 1,..., c n }, obtaining order o 1 3 play the IND-CPA game by choosing m 0 = 1 G and m 1 1 G ; receive challenge ciphertext c 4 run Watrous' algorithm on {c 1,..., c n, c}, obtaining order o 2 5 if o 1 = o 2 then output 0, else output 1 Theorem No GHE scheme can be IND-CPA secure against quantum adversaries. 16

56 In the FHE case... Our attack strictly relies on the group structure. 17

57 In the FHE case... Our attack strictly relies on the group structure. Sucient condition: there exist two plaintexts, m 0 m 1, and a subgroup H such that: 17

58 In the FHE case... Our attack strictly relies on the group structure. Sucient condition: there exist two plaintexts, m 0 m 1, and a subgroup H such that: we have a PPT algorithm which outputs a small set of generators for H 17

59 In the FHE case... Our attack strictly relies on the group structure. Sucient condition: there exist two plaintexts, m 0 m 1, and a subgroup H such that: we have a PPT algorithm which outputs a small set of generators for H the probability that Enc(m 0 ) lies in H is high 17

60 In the FHE case... Our attack strictly relies on the group structure. Sucient condition: there exist two plaintexts, m 0 m 1, and a subgroup H such that: we have a PPT algorithm which outputs a small set of generators for H the probability that Enc(m 0 ) lies in H is high the probability that Enc(m 1 ) lies in G \ H is high 17

61 In the FHE case... Our attack strictly relies on the group structure. Sucient condition: there exist two plaintexts, m 0 m 1, and a subgroup H such that: we have a PPT algorithm which outputs a small set of generators for H the probability that Enc(m 0 ) lies in H is high the probability that Enc(m 1 ) lies in G \ H is high 17

62 End of this talk (for good...) Thanks for your attention! 18