Quantitative Information Leakage. Lecture 9

Transcription

1 Quantitative Information Leakage Lecture 9 1

2 The baic model: Sytem = Information-Theoretic channel Secret Information Obervable 1 o1... Sytem... m on Input Output 2

3 Toward a quantitative notion of leakage A general principle: Leakage = difference between the a priori vulnerability and the a poteriori vulnerability vulnerability = vulnerability of the ecret, a priori / a poteriori = before / after the obervation Intuitively the vulnerability depend on the ditribution: the more uncertainty there i about the exact value of the ecret, the le vulnerable the ecret i. Note that the obervation update the input probability: p( o) =p() p(o ) p(o) Baye theorem 3

4 Information theoretic approach Entropy H(X) of a random variable X Information theory: H(X) meaure the degree of uncertainty of the event Security: H(X) can be ued to meaure the vulnerability of the ecret Mutual information I(S;O) Information theory: I(S;O) meaure the correlation of S and O formally I(S;O) i defined a difference between: H(S), the entropy of S before knowing, and H(S O), the entropy of S after knowing O Security: I(S;O) can be ued to meaure the leakage: Leakage = I(S;O) = H(S) H(S O) H(S) depend only on the prior; H(S O) can be computed uing the prior and the channel matrix 4

5 Shannon entropy A priori H(S) = X p() log p() A poteriori H(S O) = X o p(o) X p( o) log p( o) Leakage = Mutual Information I(S; O) =H(S) H(S O) In general H(S) H(S O) the entropy may increae after one ingle obervation, but in the average it decreae or remain the ame H(S) = H(S O) if and only if S and O are independent Thi i the cae if and only if all row of the channel matrix are the ame Thi cae correpond to trong anonymity in the ene of Chaum Shannon capacity C = max I(S;O) over all prior (wort-cae leakage) 5

6 Entropy: Alternative notion A we argued before, there i no unique notion of vulnerability. It depend on: the model of attack, and how we meaure it ucce Conider again the general model of adverary propoed by [Köpf and Bain CCS 07] that we aw before: Aume an oracle that anwer ye/no to quetion of a certain form. The adverary i defined by the form of the quetion and the meaure of ucce. In general we conider the bet trategy for the adverary, with repect to a given meaure of ucce. 6

7 We aw that if Entropy: Alternative notion the quetion are of the form: i S P?, and the meaure of ucce i: the expected number of quetion needed to find the value of S in the adverary bet trategy then the natural meaure of protection i Shannon entropy However, thi model of attack doe not eem o natural in ecurity, and alternative have been conidered. In particular, the limited-try attack The adverary ha a limited number of attempt at it dipoal The meaure of ucce i the probability that he dicover the ecret during thee attempt (in hi bet trategy) Obviouly the bet trategy for the adverary i to try firt the value which have the highet probability 7

8 One try attack: Rényi min-entropy One-try attack The quetion are of the form: The meaure of ucce i: i S =? log(max p()) The meaure of ucce i Rényi min-entropy: H 1 (S) = log(max p()) Like in the cae of Shannon entropy, H 1 (S) i highet when the ditribution i uniform, and it i 0 when the ditribution i a delta of Dirac (no uncertainty). 8

9 Toward a notion of leakage baed on min-entropy Leakage = difference between the a priori vulnerability and the a poteriori vulnerability Leakage = H ( S ) H (S O ) How hould we define the conditional minentropy H (S O )? 9

10 Let u recall the conditional entropy in Shannon cae H(S) = X p() log p() Shannon entropy An obervable o determine a new ditribution on S: p( o) =p() p(o ) p(o) Baye theorem Define the entropy of the new ditribution on S, given that O = o, a: H(S O = o) = X p( o) log p( o) Define conditional entropy a the expected value of the updated entropie: H(S O) = X p(o) H(S O = o) o X = p(o) X p( o) log p( o) o 10

11 Let u try to do the ame for the min-entropy cae H 1 (S) = log(max p()) Rényi min-entropy Define the entropy of the new ditribution on S, given that O = o, a: H 1 (S O = o) = log(max p( o)) Define conditional entropy a the expected value of the updated entropie: H 1 (S O) = X p(o) H 1 (S O = o) o X = p(o) log(max ( o)) However thi approach doe not work: we would obtain negative leakage! o 11

12 Conditional min-entropy Probability of ucce of an attack on S, given that O = o: Pr ucc (S O = o) = max p( o) The expected value of the prob. of ucce (aka convere of the Baye rik): Pr ucc (S O) = X o p(o) Pr ucc (S O = o) = X o p(o) max p( o) = X o max (p(o ) p()) Now define H 1 (S O) = log Pr ucc (S O) [Smith 2009] 12

13 Leakage in the min-entropy approach A priori H 1 (S) = log max p() A poteriori H 1 (S O) = log X o max(p(o ) p()) Leakage = min-mutual Inf. I 1 (S; O) =H 1 (S) H 1 (S O) 13

14 Example: DC net. Ring of 2 node, b = 1, biaed coin n0 Input S: n0, n1 Output O: the declaration of n1 and n0: d1d0 {01,10} n1 Biaed c.: p(0) = ⅔ p(1) = ⅓ n0 n1 ⅔ ⅓ ⅓ ⅔ x = p(n0) 14

15 Propertie of the leakage in the min-entropy approach In general I (S;O) 0 I (S;O) = 0 if all row are the ame (but not vicevera) Define min-capacity: C = max I (S;O) over all prior. We have: 1. C = 0 if and only if all row are the ame 2. C i obtained on the uniform ditribution (but, in general, there can be other ditribution that give maximum leakage) 3. C = the log of the um of the max of each column 4. C = C in the determinitic cae 5. C C in general 15

16 Leakage in the min-entropy approach C i obtained on the uniform ditribution C = the um of the max of each column Proof (a) I 1 (S; O) = H 1 (S) H 1 (S O) = log max p() ( log( X o X max(p(o ) p()) = log apple log o X o max p() (max p(o )) (max max p() p()) max(p(o ) p()))) = log X o max p(o ) (b) Thi expreion i alo given by I (S;O) on the uniform input ditribution 16

17 More propertie of the leakage H(S) = H (S) = 0 iff S i a point probability ditribution (aka delta of Dirac), i.e., all the probability ma i in one ingle value The maximum value of H(S) and H (S) i log #S Shannon mutual information i ymmetric: I(S;O) = I(O;S) Namely: H(S) - H(S O) = H(O) - H(O S). Thi doe not hold for the min-entropy cae If the channel i determinitic, then I(S;O) = H(O) If the channel i determinitic, then C = C = log #O 17

18 Rényi min-entropy v. Shannon entropy S = {a, b} p(a) =x p(b) =1 x S = {a, b, c} p(a) = x p(b) = y p(c) = 1 (x + y) H (S) H(S) x y Rényi min entropy and conditional entropy are the log of piecewie linear function xx 18

19 Shannon capacity v. Rényi min-capacity binary channel a 1-a b 1-b Shannon capacity Rényi min-capacity In general, Rényi min capacity i an upper bound for Shannon capacity 19

20 Exercie 1. Prove that I (S;O) 0 2. Prove that if all row of the channel matrix are equal, then I (S;O) = 0 3. Prove that all row of the channel matrix are equal if and only if C = 0 4. Compute Shannon leakage and Rényi min-leakage for the paword checker (the verion where the adverary can oberve the execution time), auming a uniform ditribution on the paword 20