Hash-based Signatures

Transcription

1 Hash-based Signatures Andreas Hülsing Summer School on Post-Quantum Cryptography June 2017, TU Eindhoven

2 Post-Quantum Signatures Lattice, MQ, Coding Signature and/or key sizes Runtimes Secure parameters PAGE y x x x x x x y x x x x x x y

3 Hash-based Signature Schemes [Mer89] Post quantum Only secure hash function Security well understood Fast PAGE 3

4 RSA DSA EC-DSA... Intractability Assumption Cryptographic hash function RSA, DH, SVP, MQ, Digital signature scheme PAGE 4

5 Hash function families

6 (Hash) function families H n h k : {0,1} m n {0,1} n m(n) n efficient {0,1} n h k m n {0,1}

7 One-wayness H n h k : {0,1} m n {0,1} n y c, k h $ k H n x $ {0,1} h k x y c m n Success if h k x = y c x

8 Collision resistance H n h k : {0,1} m n {0,1} n k h k $ H n Success if h k x 1 = h k x 2 and x 1 x 2 (x 1, x 2 )

9 Second-preimage resistance H n h k : {0,1} m n {0,1} n x c, k h $ k H n x $ m n c {0,1} Success if h k x c = h k x and x c x x

10 Undetectability H n h k : {0,1} m n {0,1} n h k $ H n b $ {0,1} If b = 1 else x $ m n {0,1} y c h k (x) y c $ {0,1} n y c, k b*

11 Pseudorandomness H n h k : {0,1} m n {0,1} n 1 n b x y = g(x) g If b = 1 g $ H n else g $ U m n,n b*

12 Generic security Black Box security (best we can do without looking at internals) For hash functions: Security of random function family (Often) expressed in #queries (query complexity) Hash functions not meeting generic security considered insecure

13 Generic Security - OWF Classically: No query: Output random guess Succ OW A = 1 2 n One query: Guess, check, output new guess Succ OW A = 2 2 n q-queries: Guess, check, repeat q-times, output new guess Succ OW A = q+1 2 n Query bound: Θ(2 n )

14 Generic Security - OWF Quantum: More complex Reduction from quantum search for random H Know lower & upper bounds for quantum search! Query bound: Θ(2 n/2 ) Upper bound uses variant of Grover (Disclaimer: Currently only proof for 2 m 2 n )

15 Generic Security OW SPR CR UD* PRF* Classical Θ(2 n ) Θ(2 n ) Θ(2 n/2 ) Θ(2 n ) Θ(2 n ) Quantum Θ(2 n/2 ) Θ(2 n/2 ) Θ(2 n/3 ) Θ(2 n/2 ) Θ(2 n/2 ) * conjectured, no proof

16 Assumption / Attacks Hash-function properties stronger / easier to break Collision-Resistance 2 nd -Preimage- Resistance weaker / harder to break One-way Pseudorandom PAGE 16

17 Attacks on Hash Functions MD5 Collisions (theo.) MD5 Collisions (practical!) SHA1 Collisions (practical!) SHA1 Collisions (theo.) MD5 & SHA-1 No (Second-) Preimage Attacks! PAGE 17

18 Basic Construction PAGE 18

19 Lamport-Diffie OTS [Lam79] Message M = b1,,bm, OWF H * = n bit SK PK sk 1,0 sk 1,1 sk m,0 sk m,1 H H H H H H pk 1,0 pk 1,1 pk m,0 pk m,1 b1 Mux b2 Mux bm Mux Sig sk 1,b1 sk m,bm PAGE 19

20 EU-CMA for OTS pk, 1 n sk M (σ, M) SIGN (σ, M ) Success if M M and Verify pk, σ, M = Accept

21 Security Theorem: If H is one-way then LD-OTS is one-time eu-cmasecure.

22 Reduction Input: y c, k Set H h k Replace random pk i,b sk 1,0 sk 1,1 sk m,0 sk m,1 H H H H H H pk 1,0 pk 1,1 y c pk m,0 pk m,1

23 Reduction Input: y c, k Set H h k Adv. Message: M = b1,,bm If bi = b return fail else return Sign(M) Replace random pk i,b? sk 1,0 sk 1,1 sk m,0 sk m,1 H H H H H pk 1,0 pk 1,1 y c pk m,0 pk m,1 b1 Mux b2 Mux bm Mux sk 1,b1 sk m,bm

24 Reduction Input: y c, k Set H h k Choose random pk i,b Forgery: M* = b1*,,bm*, σ = σ 1,, σ m If bi b return fail Else return σ i? σ i sk 1,0 sk 1,1 σ i sk m,0 sk m,1 H H H H H pk 1,0 pk 1,1 y c pk m,0 pk m,1

25 Reduction - Analysis Abort in two cases: 1. bi = b probability ½ : b is a random bit 2. bi* b probability 1-1/m: At least one bit has to flip as M* M Reduction succeeds with A s success probability times 1/2m.

26 Merkle s Hash-based Signatures PK H SIG = (i=2,,,,, ) H OTS H H H H H H H H H H H H H OTS OTS OTS OTS OTS OTS OTS OTS SK PAGE 26

27 Security Theorem: MSS is eu-cma-secure if OTS is a one-time eu-cma secure signature scheme and H is a random element from a family of collision resistant hash functions.

28 Reduction Input: k, pk OTS 1. Choose random 0 i < 2 h 2. Generate key pair using pk OTS as ith OTS public key and H h k 3. Answer all signature queries using sk or sign oracle (for index i) 4. Extract OTS-forgery or collision from forgery

29 Reduction (Step 4, Extraction) Forgery: (i, σ OTS 1. If pk OTS, pk OTS, AUTH) equals OTS pk we used for i OTS, we got an OTS forgery. Can only be used if i = i. 2. Else adversary used different OTS pk. Hence, different leaves. Still same root! Pigeon-hole principle: Collision on path to root.

30 Winternitz-OTS

31 Recap LD-OTS [Lam79] Message M = b1,,bm, OWF H * = n bit SK sk 1,0 sk 1,1 sk m,0 sk m,1 H H H H H H PK pk 1,0 pk 1,1 pk m,0 pk m,1 b1 Mux b2 Mux bn Mux Sig sk 1,b1 sk m,bm

32 LD-OTS in MSS SIG = (i=2,,,,, ) Verification: 1. Verify 2. Verify authenticity of We can do better!

33 Trivial Optimization Message M = b1,,bm, OWF H * = n bit SK sk 1,0 sk 1,1 sk m,0 sk m,1 H H H H H H PK pk 1,0 pk 1,1 pk m,0 pk m,1 b1 Mux Mux b1 bm Mux Mux bm Sig sig 1,0 sig 1,1 sig m,0 sig m,1

34 Optimized LD-OTS in MSS Verification: X SIG = (i=2,,,,, ) 1. Compute from 2. Verify authenticity of Steps together verify

35 Let s sort this Message M = b 1,,b m, OWF H SK: sk 1,,sk m,sk m+1,,sk 2m PK: H(sk 1 ),,H(sk m ),H(sk m+1 ),,H(sk 2m ) Encode M: M = M M = b 1,,b m, b 1,, b m (instead of b 1, b 1,,b m, b m ) Sig: sig i = sk i, if b i = 1 H(sk i ), otherwise Checksum with bad performance!

36 Optimized LD-OTS Message M = b 1,,b m, OWF H SK: sk 1,,sk m,sk m+1,,sk m+1+log m PK: H(sk 1 ),,H(sk m ),H(sk m+1 ),,H(sk m+1+log m ) Encode M: M = b 1,,b m, 1 m b i Sig: sig i = sk i, if b i = 1 H(sk i ), otherwise IF one b i is flipped from 1 to 0, another b j will flip from 0 to 1

37 Function chains Function family: H n h k : {0,1} n {0,1} n h k $ H n Parameter w Chain: c i ( x) i 1 h k ( c ( x)) hk hk hk ( x) i times c 0 (x) = x c 1 (x) = h k (x) c w 1 (x)

38 WOTS Winternitz parameter w, security parameter n, message length m, function family H n c 0 (sk 1 ) = sk 1 Key Generation: Compute l, sample h k pk 1 = c w-1 (sk 1 ) c 1 (sk 1 ) c 1 (sk l ) pk l = c w-1 (sk l ) c 0 (sk l ) = sk l

39 WOTS Signature generation M b 1 b 2 b 3 b 4 b m b m +1 b m +2 b l c 0 (sk 1 ) = sk 1 pk 1 = c w-1 (sk 1 ) C σ 1 =c b 1(sk 1 ) Signature: σ = (σ 1,, σ l ) pk l = c w-1 (sk l ) c 0 (sk l ) = sk l σ l =c b l (sk l )

40 WOTS Signature Verification Verifier knows: M, w b 1 b 2 b 3 b 4 b m b m +1 b l 1+2 b l σ 1 Signature: σ = (σ 1,, σ l ) c 1 (σ 1 ) c 2 (σ 1 ) c 3 (σ 1 ) σ l pk 1 =? c w 1 b 1 (σ 1 ) pk l =? c w 1 b l (σ l )

41 WOTS Function Chains For x 0,1 n define c 0 x = x and WOTS: c i x = h k (c i 1 x ) WOTS $ : c i x = h c i 1 x (r) WOTS + : c i x = h k (c i 1 x r i )

42 WOTS Security Theorem (informally): W-OTS is strongly unforgeable under chosen message attacks if H n is a collision resistant family of undetectable one-way functions. W-OTS $ is existentially unforgeable under chosen message attacks if H n is a pseudorandom function family. W-OTS + is strongly unforgeable under chosen message attacks if H n is a 2 nd -preimage resistant family of undetectable one-way functions.

43 XMSS

44 XMSS Tree: Uses bitmasks Leafs: Use binary tree with bitmasks OTS: WOTS + Mesage digest: Randomized hashing Collision-resilient -> signature size halved H b i H

45 Multi-Tree XMSS Uses multiple layers of trees -> Key generation (= Building first tree on each layer) Θ(2 h ) Θ(d*2 h/d ) -> Allows to reduce worst-case signing times Θ(h/2) Θ(h/2d)

46 Authentication path computation

47 TreeHash (Mer89)

48 TreeHash TreeHash(v,i): Computes node on level v with leftmost descendant L i Public Key Generation: Run TreeHash(h,0) v = h = 3 = v = 2 v = 1 h v = 0 L 0 L 1 L 2 L 3... L 7

49 TreeHash TreeHash(v,i) 1: Init Stack, N1, N2 2: For j = i to i+2 v -1 do 3: N1 = LeafCalc(j) 4: While N1.level() == Stack.top().level() do 5: N2 = Stack.pop() 6: N1 = ComputeParent( N2, N1 ) 7: Stack.push(N1) 8: Return Stack.pop()

50 TreeHash TreeHash(v,i) L i L i+1... L i+2 v-1

51 Efficiency? Key generation: Every node has to be computed once. cost = 2 h leaves + 2 h -1 nodes => optimal Signature: One node on each level 0 <= v < h. cost 2 h -1 leaves + 2 h -1-h nodes. Many nodes are computed many times! (e.g. those on level v=h-1 are computed 2 h-1 times) -> Not optimal if state allowed

52 The BDS Algorithm [BDS08]

53 Motivation (for all Tree Traversal Algorithms) No Storage: Signature: Compute one node on each level 0 <= v < h. Costs: 2 h -1 leaf + 2 h -1-h node computations. Example: XMSS with SHA2-256 and h = 20 -> approx. 15min Store whole tree: 2 h n bits. Example: h=20, n=256; storage: 2 28 bits = 32MB Idea: Look for time-memory trade-off!

54 Use a State

55 Authentication Paths

56 Observation 1 Same node in authentication path is recomputed many times! Node on level v is recomputed for 2 v successive paths. Idea: Keep authentication path in state. -> Only have to update new nodes. Result Storage: h nodes Time: ~ h leaf + h node computations (average) But: Worst case still 2 h -1 leaf + 2 h -1-h node computations! -> Keep in mind. To be solved.

57 Observation 2 When new left node in authentication path is needed, its children have been part of previous authentication paths.

58 Computing Left Nodes v = 2 v 1 A ( i 1) A( i 1 2 ) i

59 Result Storing h 2 nodes all left nodes can be computed with one node computation / node

60 Observation 3 Right child nodes on high levels are most costly. Computing node on level v requires 2 v leaf and 2 v -1 node computations. Idea: Store right nodes on top k levels during key generation. Result Storage: 2 k -2 n bit nodes Time: ~ h-k leaf + h-k node computations (average) Still: Worst case 2 h-k -1 leaf + 2 h-k -1-(h-k) node computations!

61 Distribute Computation

62 Intuition Observation: For every second signature only one leaf computation Average runtime: ~ h-k leaf + h-k node computations Idea: Distribute computation to achieve average runtime in worst case. Focus on distributing computation of leaves

63 TreeHash with Updates TreeHash.init(v,i) 1: Init Stack, N1, N2, j=i, j_max = i+2 v -1 2: Exit TreeHash.update() 1: If j <= j_max 2: N1 = LeafCalc(j) 3: While N1.level() == Stack.top().level() do 5: N2 = Stack.pop() 6: N1 = ComputeParent( N2, N1 ) 7: Stack.push(N1) 8: Set j = j+1 9: Exit One leaf per update

64 Distribute Computation Concept Run one TreeHash instance per level 0 <= v < h-k Start computation of next right node on level v when current node becomes part of authentication path. Use scheduling strategy to guarantee that nodes are finished in time. Distribute (h-k)/2 updates per signature among all running TreeHash instances

65 Distribute Computation Worst Case Runtime Before: 2 h-k -1 leaf and 2 h-k -1-(h-k) node computations. With distributed computation: (h-k)/2 + 1 leaf and 3(h-k-1)/2 + 1 node computations. Add. Storage Single stack of size h-k nodes for all TreeHash instances. + One node per TreeHash instance. = 2(h-k) nodes

66 BDS Performance Storage: h 3h 3k k n bit nodes Runtime: (h k)/2+1 leaf and 3(h k 1)/2+1 node computations.

67 XMSS in practice

68 XMSS Internet-Draft (draft-irtf-cfrg-xmss-hash-based-signatures) Protecting against multi-target attacks / tight security n-bit hash => n bit security Small public key (2n bit) At the cost of ROM for proving PK compression secure Function families based on SHA2 Equal to XMSS-T [HRS16] up-to message digest

69 XMSS / XMSS-T Implementation C Implementation, using OpenSSL [HRS16] Sign (ms) Signature (kb) Public Key (kb) Secret Key (kb) Bit Security classical/ quantum XMSS / 118 XMSS-T / 128 XMSS / 98 XMSS-T / 128 Comment h = 20, d = 1, h = 20, d = 1 h = 60, d = 3 h = 60, d = 3 Intel(R) Core(TM) i7 3.50GHz XMSS-T uses message digest from Internet-Draft All using SHA2-256, w = 16 and k = 2

70 Open research topics 1. Message compression which is collision-resilient, provdies tight provable security, especially resists multi-target attacks (=> no etcr) => Has applications outside hash-based crypto! 2. Quantum query complexity for further properties E.g. PRF, UD, asec, Quantum security of existing hash function constructions. E.g. can classical attacks be improved (e.g. differential cryptanalysis) Formal proofs (see recent works on collapsing hashes)

71 SPHINCS

72 About the statefulness Works great for some settings However back-up... multi-threading... load-balancing

73 How to Eliminate the State

74 Few-Time Signature Schemes PAGE 77

75 Recap LD-OTS Message M = b1,,bn, OWF H * = n bit SK PK sk 1,0 sk 1,1 sk n,0 sk n,1 H H H H H H pk 1,0 pk 1,1 pk n,0 pk n,1 b1 Mux b2 Mux bn Mux Sig sk 1,b1 sk n,bn PAGE 78

76 HORS [RR02] Message M, OWF H, CRHF H = n bit Parameters t=2 a,k, with m = ka (typical a=16, k=32) * SK sk 1 sk 2 sk t-1 sk t H H H H H H PK pk 1 pk 1 pk t-1 pk t PAGE 79

77 HORS mapping function Message M, OWF H, CRHF H = n bit Parameters t=2 a,k, with m = ka (typical a=16, k=32) * M H b 1 b 2 b a b ar i 1 i k PAGE 80

78 HORS Message M, OWF H, CRHF H * = n bit Parameters t=2 a,k, with m = ka (typical a=16, k=32) SK sk 1 sk 2 sk t-1 sk t H H H H H H PK pk 1 pk 1 pk t-1 pk t H (M) b 1 b 2 b a b a+1 b ka-2 b ka-1 b ka i 1 Mux Mux i k sk i1 sk ik PAGE 81

79 HORS Security M mapped to k element index set M i {1,, t} k Each signature publishes k out of t secrets Either break one-wayness or r-subset-resilience: After seeing index sets M i j for r messages msg j, 1 j r, hard to find msg r+1 i msg j such that M r+1 1 j r M i j. Best generic attack: Succ r-ssr (A, q) = q rk t Security shrinks with each signature! k PAGE 82

80 HORST Using HORS with MSS requires adding PK (tn) to MSS signature. HORST: Merkle Tree on top of HORS-PK New PK = Root Publish Authentication Paths for HORS signature values PK can be computed from Sig With optimizations: tn (k(log t x + 1) + 2 x )n E.g. SPHINCS-256: 2 MB 16 KB Use randomized message hash PAGE 83

81 SPHINCS Stateless Scheme XMSS MT + HORST + (pseudo-)random index Collision-resilient Deterministic signing SPHINCS-256: 128-bit post-quantum secure Hundrest of signatures / sec 41 kb signature 1 kb keys

82 Signatures via Non- Interactive Proofs: The Case of Fish & Picnic Thanks to the Fish/Picnic team for slides

83 Interactive Proofs

84 ZKBoo

85 High-Level Approach Use LowMC v2 to build dedicated hash function with low AND-gate-depth Use ZKBoo to proof knowledge of a preimage Use Fiat-Shamir to turn ZKP into Signature in ROM (Fish), or Use Unruh s transform to turn ZKP into Signature in QROM (Picnic)

86 Performance

87 Open research topics II SPHINCS: More efficient few-time signatures Dedicated fast short, constant size input hash functions. Fish / Picnic More efficient (size!!!) QROM transform Dedicated, more efficient proof for knowledge of preimage? Hash functions with lower AND-gate depth.

88 Thank you! Questions? For references & further literature see PAGE 91