CRYPTOGRAPHIC PROTOCOLS 2014, LECTURE 2

Transcription

1 CRYPTOGRAPHIC PROTOCOLS 2014, LECTURE 2 assumptions and reductions Helger Lipmaa University of Tartu, Estonia

2 MOTIVATION Assume Alice designs a protocol How to make sure it is secure? Approach 1: proof by intimidation "don't you trust me" also "tautology" Theorem. Assume Protocol X is secure. Then Protocol X is secure

3 MOTIVATION Approach 2 (much better): prove that the protocol is secure Problem: only known how to do for a small number of protocols need major advances in complexity theory it is not known how to prove that any function takes more than a linear number of steps to compute Unconditional security

4 MOTIVATION Approach 3 (mostly correct): make an assumption: assume that some well-known problem (say, factoring) is hard prove that if that assumption holds, then your protocol is secure Computational security

5 SECURITY VERIFICATION Proof by intimidation Protocol designer's task Security verifier's task proof by intimidation Simpler: no need to prove anything Spend years cryptanalyzing OR trust the protocol proof by reduction More complex: must reduce security to some assumption Verify the usually short reduction. Trust the assumption

6 SOME KNOWN ASSUMPTIONS Factoring and friends The problem of distinguishing prime numbers!om composite numbers and of resolving the latter into their prime factors is known to be one of the most important and useful in arithmetic. ~~~~~~~ Carl Friedrich Gauss Discrete logarithm and friends Many more protocols Lattice assumptions Coding-theoretic assumptions... Many assumptions

7 SOME ASSUMPTIONS Factoring RSA Strong RSA DCRA Discrete Log CDH DDH Various pairing assumptions SVP RLWE gapsvp CVP LWE

8 SOME ASSUMPTIONS Number-theoretic Z_n Number-theoretic finite cyclic groups Lattice Factoring RSA Strong RSA Discrete Log CDH DDH SVP gapsvp Various pairing assumptions DCRA RLWE Underlying mathematical structure CVP LWE

9 SOME ASSUMPTIONS Factoring RSA Strong RSA Insecure Secure(?) Discrete Log CDH DDH SVP gapsvp Various pairing assumptions DCRA RLWE Security against quantum computers CVP LWE

10 SOME ASSUMPTIONS Strength/familiarity Strong RSA Factoring RSA DCRA Discrete Log CDH DDH Various pairing assumptions More assurance SVP RLWE Often more efficient gapsvp CVP weaker/known LWE stronger/less known

11 CHOICE OF ASSUMPTION: TRADEOFF More security assurance or better efficiency? Quantum security? Number-theoretic flavor? Any algebra needed by the goal? Compatibility with other protocols Some protocols are impossible/very inefficient with some assumptions

12 ASSUMPTION = EVERYTHING Choice of the assumption is very important Seeing an assumption already gives a flavor of what can(not) be done efficiently So let's learn some

13 RECALL: ISOMORPHISM Assume G₁ is additive and G₂ is multiplicative f : G₁ G₂ is isomorphism if it agrees with group operations f (x + y) = f (x) f (y) f (0) = 1 f (-x) = f (x) ¹ two groups are isomorphic if there exists isomorphism between them

14 ISOMORPHIC = EQUAL In mathematics, isomorphic groups are considered to be "essentially the same They have the same structure Instead of executing group operation in one group, you can map to another group, do group operation there, and then map back G₁ + G₁ f f ¹ f can be thought of as data representation G2 G2... assuming both f and f ¹ can be computed efficiently

15 ONE-WAY ISOMORPHISMS f : G₁ G₂ is a one-way isomorphism if 1. f is an isomorphism 2. f can be computed efficiently 3. f ¹ cannot be computed efficiently assumption (not known how to prove such things)

16 ONE-WAY ISOMORPHIC EQUAL G₁ efficient + G₁ efficient f f ¹ not efficient G2 efficient G2

17 RECALL: EXPONENTIATION expg : Zq G, expg (m) = gᵐ expg is isomorphism gᵐ + ⁿ = gᵐ gⁿ g⁰ = 1 g ᵐ = 1 / gᵐ

18 IS EXP ONE-WAY? What do you think? Depends on the group Easy: (R*, ): the inverse of exp is logarithm (Z, +), (Zq, +): exp = multiplication, inverse = division In finite groups, inverse of exp is called discrete logarithm

19 HARD DL GROUPS Instantiation 1 Let p be a big prime (3000+ digits) The order of Z p*={1, 2,..., p - 1} is p - 1 Let q p-1 be a smaller prime (160+ digits) By Sylow theorem, Zp* has a unique subgroup G of order q DL is assumed to be hard in G Best known algorithms to break DL in G have subexponential complexity in p and exponential complexity in q

20 REMINDER: BASIC COMPLEXITY THEORY Running time T(n) of algorithm = function of input length n Example. Running time of exponentiation is a function of the bitlength n of the group elements Simplification: in Zq, n = log q Efficient algorithm: T(n) is polynomial in n E.g.: T(n) = 1000 n^6 Inefficient algorithm: T(n) is not polynomial in n E.g.: T(n) = n^(log n)

21 EFFICIENT VS INEFFICIENT... but it will eventually become less efficient Superpolynomial might be more efficient for small n

22 COMPLEXITY IN CRYPTOGRAPHY When we encrypt, security should not depend on the message length but say on key size Instead of input length n, take security parameter κ Usually κ related to key length First, fix κ so that T(κ) of attacks is big and of "honest" algorithms is small Finally, choose corresponding key

23 COROLLARIES OF COMPLEXITY Most of algorithms work with undetermined κ In practical implementations fix κ so that protocol is fast but attacks are assumed to be hard E.g., attacks take time 2⁸⁰ If attacks are improved somewhat, increase κ accordingly

24 CHOOSING P p time of index calculus: best known DL (appr) log of time Efficient protocol has small value here log p time of exponentiation (appr) Too optimistic graph, so p is chosen much larger

25 COMPLEXITY NOTATION Θ (f (n)): asymptotically c f (n) for some constant c 100 n²+ 20 n - 10 = Θ(n²) O (f (n)): any fun. that does not grow faster than Θ (f (n)) o (f (n)): any function that grows slower than Θ (f (n)) Ω (f (n)): any fun. that does not grow slower than Θ (f (n)) ω (f (n)): any function that grows faster than Θ (f (n))

26 QUIZ Θ (n⁸) O (n⁸) Ω (n⁸) o (n⁸) ω (n⁸) Θ (n⁷) O (n⁷) Ω (n⁷) o (n⁷) ω (n⁷) Θ (n⁶) O (n⁶) Ω (n⁶) o (n⁶) ω (n⁶) Θ (n⁵) O (n⁵) Ω (n⁵) o (n⁵) ω (n⁵) Question: What is (n⁸ + n + 1) / (n² + n + 1)? Answer: it is n⁶ + smaller terms thus Θ (n⁶)

27 COMPLEXITY NOTATION polynomial: poly (n) = n^(o (1)) not faster than any polynomial superpolynomial: n^(ω (1)) faster than any polynomial exponential: 2^(Θ (n)) negligible: negl (n) = n^(-ω (1)) slower than inverse of any polynomial linear: Θ (n) asymptotically c n for some constant c etc: logarithmic, superlogarithmic, sublinear

28 BEST KNOWN DL ALGORITHMS Any groups of order q, n := log q Baby-step-giant-step and Pohlig-Hellman algorithms --- O ( q) Instantiation 1, parameters p and q Index calculus, O (e^( (2 ln p ln ln p))) Generic algorithms: only use group operations BSGS/PH algorithms O ( q) Recent advances in groups of order pᵐ for midsize m DL in any group can be broken by using quantum computer

29 HARD DL GROUPS Instantiation 2 Elliptic curve groups Let q be a small prime (160+ digits) Elliptic curve group G has order q Definition complicated (see supplementary notes) Best known algorithms to break DL in G have exponential complexity in q DL is assumed to be hard in well-chosen G

30 COMPARISON OF INSTANTIATIONS Exponent 1.58 due to Karatsuba algorithm Asymptotically not optimal, but good for inputs of that size Parameters Group element representation Complexity of multiplication Security Zp* p, log p 3200 q, log q 160 log p O((log p)^1.58) 2⁸⁰ E.C.G. q, log q 160 log q O((log q)^1.58) 2⁸⁰ q is much smaller than p, though constant in O( ) is larger

31 QUIZ Question: What is the asymptotic efficiency of exponentiation in the first instantiation? q = 2^(O (κ)), thus log q = Θ (κ) 2^κ = O (e^ (ln p ln ln p))) thus log p = Θ (κ² / log κ) Answer: complexity of multiplication times Θ (log p) multiplications Θ ((log p)^2.58) = Θ (κ^5.16 / (log κ)^2.58) Θ ((log p)^1.58) O ((log p)^2.58) O ((log p)^3) Ω ((log q)^1.58) O ((log q)^2.58) o ((log q)⁶) O ((log p)^1.58 log q) o ((log p)^2.58) O ((log q)^1.58 log p) Ω (1) Θ ((log q)^5.16) ω ((log p)^1.58)

32 DL ASSUMPTION: FORMAL Informally, we need that inverting exponentiation is hard Complications: exponent must be random (e.g., exponent is secret key) when exponent is smaller than L, one can compute DL g must be a generator in Θ ( L) steps inverting is impossible when g = 1 security must hold against probabilistic algorithms that can use random numbers break is only successful when adversary's advantage is >> 1 / q inverting is always possible with probability 1 / q (guessing answer randomly)

33 SECURITY GAME A challenger generates values from some fixed "valid" distributions and sends them to the adversary A Depending on the input and the output, the challenger declares A to be either successful or not After some computation, A returns some value to the challenger A breaks the assumption if her advantage is big compared to random guessing

34 DEF: DL GROUPS Let G be a finite cyclic group of order q, let g be its fixed generator One can take any g, or a random g Assume desc(g) contains a description of G, incl. g Adv[DL(G, A)] := Pr[DL(G,A) = 1] - 1 / q A ε-breaks DL in G iff Adv[DL(G, A)] ε G is a (τ,ε)-dl group iff Adv[DL(G, A)] ε for all probabilistic polynomial time adversaries A that take time τ G is a DL group iff it is a (poly(κ),negl(κ))-dl group Game DL(G, A) gk desc(g) m Zq h gᵐ m* A (gk, h) If m = m* return 1 else return 0

35 STUDY OUTCOMES Assumptions: motivation Some example assumptions, why so many Discrete logarithm basic idea formal definition