Property Preserving Symmetric Encryption

Transcription

1 Property Preserving Symmetric Encryption Omkant Pandey Microsoft, Redmond Yannis Rouselakis University of Texas at Austin

2 Traditional Cryptography Alice Bob Eve

3 New Goal: Computations on Encrypted Data Indexing Range queries Data clustering Keyword search General computations

4 Order Preserving Encryption [BCLO09, BC011] Alice

5 Order Preserving Encryption [BCLO09, BC011] Exponential size ciphertext space Or High min entropy plaintext distributions Are there properties / schemes with no such restrictions?

6 Property Preserving Encryption ApropertyP is a function of arity k P (m 1,m 2,...,m k )=0 or 1 A Property Preserving Encryption (PPE) scheme contains Setup (pp, sk) Encrypt(sk, m) ct Decrypt(sk, ct) m Test(pp, ct 1,ct 2,...,c k ) {0, 1} Test should satisfy: Test(pp, ct 1,ct 2,...,ct k )=P (m 1,m 2,...,m k ) publicly computable symmetric key encryption.

7 Left or Right Security [BDJR97] PublicParameters (m L 1,m R 1 ) ct 1 (m L 2,m R 2 ) Adversary ct 2 (m L Q,mR Q ) ct Q Challenger b $ {L, R} ct i = Enc(sk, m b i ) Restriction: Forall(i 1,i 2,...,i k ) [Q] k : P (m L i 1,m L i 2,...,m L i k )=P (m R i 1,m R i 2,...,m R i k )

8 Find Then Guess Security [BDJR97] PublicParameters m L 1 = m R 1 = m 1 m 1 ct 1 Adversary (m L,m R ) ct m Q m L Q = mr Q = m Q ct Q Challenger b $ {L, R} ct i = Enc(sk, m i ) ct = Enc(sk, m b ) Restriction: Forall(i 1,i 2,...,i k ) ([Q] { }) k : P (m L i 1,m L i 2,...,m L i k )=P (m R i 1,m R i 2,...,m R i k )

9 Definitional Relationships Standard Symmetric Key Cryptography [BDJR97]: Hybrid Argument LoR (Symmetric) Property Preserving Encryption: Not Possible FtG Left Sequence not reachable from Right Sequence Same equality pattern Different reachability class Depends on the property at hand

10 Definitional Relationships Theorem (informal): Left or Right security strictly stronger than Find then Guess FtG Theorem (informal): There exists a hierarchy of Find then Guess LoR FtG FtG 2 FtG 3 LoR

11 Proving the Separation We will assume that there exists an FtG secure scheme FtG LoR Π =(Setup, Encrypt, Decrypt, Test) We will construct a new scheme Π =(Setup, Encrypt, Decrypt, Test ) Such that: Π is FtG secure, but not LoR secure.

12 Proving the Separation Quadratic Residues Consider M = Z p = {1, 2,...,p 1}, where p prime. We have that: FtG LoR QR = {x Z p y Z p : x = y 2 } QN R = Z p\qr For z = xy, wherex, y, z Z p, z is in QR if and only if Both x and y are in QR OR Both x and y are in QN R

13 Proving the Separation Consider the binary property: FtG LoR P (x, y) = ½ 1 if x y QR 0 if x y QN R Suppose Π =(Setup, Encrypt, Decrypt, Test)isFtGsecureonpropertyP: Test(Encrypt(x), Encrypt(y)) = P (x, y)

14 Proving the Separation Create a new scheme Π =(Setup, Encrypt, Decrypt, Test ) where: Setup : Calls Setup (pp, sk) Samples t from {0, 1} Outputs pp = pp and sk =(sk, t) One time pad FtG LoR Encrypt (sk,m): Calls Encrypt(sk, m) ct Samples b from {0, 1} If b =0outputs ct =(ct, b, t) If b =1outputs ct =(ct, b, t J (m)) J (m) = ½ 0 if m QR 1 if m QN R

15 Proving the Separation: Π is FtG secure m i Case 1: J (m L )=J (m R ) m i m i m L m R QR QR QN R QN R It is true: P (m i,m L )=P (m i,m R ) Case 2: J (m L ) 6= J (m R ) QR QN R QN R QR

16 Proving the Separation: Π is FtG secure Case 1: J (m L )=J (m R ) Encrypt (sk,m): Encrypt(sk, m) ct b $ {0, 1} If b =0thenct =(ct, b, t) else ct =(ct, b, t J (m)) Simulator knows t and simulates the game perferctly by answering all single queries and the challenge query. Case 2: J (m L ) 6= J (m R ) Simulator responds to the one query with (ct, b 1,b 2 ) where b 1,b 2 uniformly random bits.

17 Proving the Separation: Π is not LoR secure Attack: QR QN R QR QN R QR QN R QR QN R QR QN R Encrypt (sk,m): Encrypt(sk, m) ct b $ {0, 1} If b =0thenct =(ct, b, t) else ct =(ct, b, t J (m)) Valid: P (m L i,ml j )=P (mr i,mr j )=1foralli, j Successful: W.h.p. the attacker learns t and can deduce J (m)

18 Proving the Hierarchy FtG n FtG n+1 Assuming there exists an FtG n secure scheme Π, weconstructaschemeπ that is FtG n secure, but not FtG n+1 secure.

19 Proving the Hierarchy: Main Ideas Case 1: m i Case 2: QN R QR QR QR QN R QR m i QR QN R QN R QN R m i m i QN R QN R Use an n time pad to encode information about sign. In case 1 simulate perfectly knowing the pad. In case 2 output suitable random integers. Correct simulation until n challenge queries. Break with constant probability at n+1 challenge queries.

20 Constructions Unary Properties: Trivial generic construction Binary Properties using Predicate Encryption [KSW08]: Requires very strong security No candidate construction known for non trivial properties Ternary properties and above: Open Problem

21 Pairings in Composite Order Groups Let G be a group of composite order N = p q with a bilinear mapping: e : G G G T and e(g a,g b )=e(g, g) ab Independence Property: Let g 0,g 1 be generators of the subgroups of order p, q, respectively. Then: e(g a 0 g b 1,g c 0 g d 1)=e(g 0,g 0 ) ac e(g 1,g 1 ) bd In particular: e(g a 0,g b 1)=1

22 Orthogonality Property: Orthogonality of n-dimensional vectors in Z p. ~a =(a 1,a 2,...,a n ) ~ b =(b1,b 2,...,b n ) ~a ~b = a 1 b 1 + a 2 b a n b n P (~a, ~ b)= ½ 0 if ~a ~ b =0 (modp) 1 otherwise

23 Explicit Construction: Setup and Encrypt Secret key: g 0,g 1 and v, t 1,t 2,...,t n Z p such that: v 2 = t t t 2 n Encryption of ~a =(a 1,a 2,...,a n ): Pick r, s Z p and output g rv 1, (g sa 1 0 g rt 1 1,gsa 2 0 g rt 2 1,...,gsa n 0 g rt n 1 )

24 Explicit Construction: Test Enc(~a) : Enc( ~ b): g1 rv, g sa 1 0 g rt 1 1, g sa 2 0 g rt 2 1,..., g sa n 0 g rt n 1 g r0 v 1,g s0 b 1 0 g r0 t 1 1,g s0 b 2 0 g r0 t 2 1,...,g s0 b n 0 g r0 t n 1 First pairing: e(g 1,g 1 ) rr0 v 2 Product of n pairings: e(g 0,g 0 ) ss0 a 1 b 1 e(g 1,g 1 ) rr0 t e(g 0,g 0 ) ss0 a n b n e(g 1,g 1 ) rr0 t 2 n = e(g 0,g 0 ) ss0 (~a ~b) e(g 1,g 1 ) rr0 (t t2 n )

25 New Directions New interesting properties: Ternary properties and above. Arithmetic progressions. Geometric shapes Straight Lines. General properties. Using lattices, since pairings seem suitable only for binary properties. Privatizing popular algorithms: Clustering Data classification Generalizing the properties to functions Powerful public computa ons on encrypted data.

26 Thank you