An Introduction to Pairings in Cryptography

Transcription

1 An Introduction to Pairings in Cryptography Craig Costello Information Security Institute Queensland University of Technology INN652 - Advanced Cryptology, October 2009

2 Outline 1 Introduction to Pairings Why do we love pairings? What are pairings? 2 Pairings in cryptography Using pairings ID-based cryptography 3 Groups involved in pairings Pairing types 4 Conclusion

3 Why do we love pairings? The pairing explosion: Why cryptographers love pairings? 1991: MOV attack used pairings on ECC 2001: Boneh-Franklin - identity-based encryption - (open problem since mid 80 s) 2001: Joux - one round tripartite key-agreement 2004: Boneh, Lynn and Shacham - short signatures 2000 now: A heap of other researchers - a heap of other things (ring signatures, key agreements, certificateless PKC, heirarchical) 2004: (QUT) Boyd, Dawson et al. - Key Issuing

4 Why do we love pairings? Why do I love pairings? One of the most active and exciting areas in public key crypto All the juicy ingredients: Number theory, algebraic geometry, abelian varieties, finite fields,... Good balance between some in-depth mathematical theory and how pairings behave in practice Because they re very interesting and fun Because I have to...

5 What are pairings? What are pairings? A bilinear pairing e is just a mapping where 2 inputs pair to result in a value e(p, Q) = t The bilinearity property is as follows: e(ap, bq) = t ab = e(bp, aq) Behold the magic of bilinearity (a quick key exchange). TA holds master secret s. Alice s identity is A. Bob s is B. TA issues Alice sa. TA issues Bob sb. Alice e(sa, B) = e(a, B) s = e(a, sb) Bob

6 What are pairings? Why Elliptic Curves? There is only one known mathematical setting where desirable bilinear pairings exist: (hyper)elliptic curves (last week) Therefore in e(p, Q), P and Q are points on an elliptic curve LAST WEEK: Attacks on elliptic curves are much slower than on finite fields (160 bit group order for elliptic curves comparable to 1024 bit security in finite fields) Lucky for elliptic curves The fact that elliptic curves just happen to be more efficient than finite fields is a happy coincidence... we need them to pair with regardless

7 What are pairings? ECC vs PBC Pairing based cryptography (PBC) is different to elliptic curve cryptography (ECC): both use elliptic curves and rely on ECDLP but PBC has many many more computational problems that we build interesting protocols with...

8 What are pairings? How deep will we go into pairings today? We will get a feel for the power of the bilinearity property We will see some of its most notable achievements in the protocol world We will discuss some (mainly one) of the hard problems that pairing-based protocols are based on We will (at a very abstract level) briefly discuss the groups that are involved in pairing computations... but we WILL NOT be discussing any theory on how to compute a pairing (divisor theory, Weil reciprocity, Miller s algorithm) and why this gives bilinearity

9 What are pairings? Basic properties of pairings A mapping e : G 1 G 2 G T such that: 1 Groups G 1, G 2 and G T are all of prime order r (at least for this lecture). We write G 1 and G 2 with additive notation (points on elliptic curve) and G T with multiplicative notation. 2 Bilinear: linear in both arguments e(p + Q, R) = e(p, R) e(q, R) e(p, R + S) = e(p, R) e(p, S) e(ap, br) = e(p, R) ab = e(bp, ar) 3 Non-degenerate: e(p, R) 1 for some P G 1 and Q G 2. 4 Computability: e(p, R) can be efficiently computed.

10 What are pairings? Bilinearity: the pairing mechanism up close e(ap, br) = e(p, R) ab = e(bp, ar) = e(ap, R) b = e(p, ar) b = e(bp, R) a = e(p, br) a = e(p, abr)... etc The point multiples jump in and out of the index into either argument, i.e. they switch between the arguments. From two points P and Q we can get e(p, Q) (this is trivially computing the pairing value) From two points P and Q and an integer r Z we can trivially get e(p, Q) r by exponentiating

11 What are pairings? Bilinearity: the pairing mechanism up close (cont) If we don t want someone to know r (which may be our secret key), it is still possible for them to compute e(p, Q) r provided they also know P and Q Send them rp or rq and they can compute e(rp, Q) = e(p, Q) r or e(p, rq) = e(p, Q) r. They would have to solve an instance of ECDLP to recover the secret r... or would they???

12 What are pairings? Two Discrete Log Problems to Attack Recall from a couple of slides ago: TA issues Alice sa. Alice computes e(sa, B) = e(a, B) s. Alice can compute t = e(a, B) from public identities. Alice has sa, A E(F q ), as well as t s, t F q k. To find master secret s, Alice can attack whichever discrete log problem is easiest Pairing based cryptography is a balancing act 1 Hard ECDLP in G 1, G 2 2 Hard DLP in G T 3 Efficient algorithms across all groups We can achieve good balance if we can be flexible with k

13 What are pairings? The embedding degree General Pairings e : G 1 G 2 G T G 1 is almost always a subgroup of E(F q ). G 2 is almost always a subgroup of E(F q k ). G T is the multiplication group of a finite field F q k called the embedding degree). (k is The embedding degree k is called the embedding degree and plays a big role in pairing-based crypto...

14 What are pairings? Pairing-friendly elliptic curves Elliptic curve arithmetic occurs in F q (the base field) Pairing arithmetic occurs in F q k (the extension field) This means protocol users have to deal with arithmetic in both F q and F q k Attackers would want both (or either field) to be as small as possible for potential attacks... We want the fields to be out of the attackers reach to be safe... but not too big (we have to work there) The embedding degree helps us balance out the difficulty of both attacks (simultaneously) and the difficulty of us operating in these fields

15 What are pairings? Pairing-friendly elliptic curves (cont)... Definition: the embedding degree Let E be an elliptic curve defined over F q with order divisible by large prime r. The embedding degree of E with respect to r is the smallest positive integer k with r q k 1. In general k r and F q k would be too large to deal with There are many clever ways to construct so-called pairing-friendly elliptic curves (FST - A taxonomy of pairing-friendly elliptic curves ) Moral of the story: k must be small, but not too small...

16 What are pairings? Complexity of Discrete Logs It is substantially easier to compute discrete logs in the finite field F q k (subexponential complexity) than it is in E(F q ) (exponential complexity) The number of points on E, denoted #E(F q ) q (see last week s tutorial) For 2 80 (80-bit) security, #E(F q ) whilst F q k therefore k... For (128-bit) security, #E(F q ) whilst F q k therefore k... For (256-bit) security, #E(F q ) whilst F q k therefore k... #E grows (exponentially) at same rate as security, but F q k grows must faster (lucky we can be flexible with k)

17 Using pairings 1991: The MOV attack on ECC Menezes-Okamoto-Vanstone attacked ECC using pairings in 1991 (MOV - Reducing elliptic curve logarithms to logarithms in a finite field ) Given P, Q G, the discrete log problem on the elliptic curve is to find a such that Q = ap. (ECDLP) Let g = e(p, R) 1 for some R G. Let h = e(q, R) = e(ap, R) = e(p, R) a = g a. Therefore attacker can look at the discrete log problem in the finite field G T (obtaining a from g and h) This attack only works for symmetric pairings on supersingular curves (we will see why later) which have low embedding degree (arghhhh!)

18 Using pairings DDH is easy Decision Diffie-Hellman DDH problem in G is to distinguish between the distributions P, ap, bp, abp and P, ap, bp, cp where a, b, c are chosen randomly in Z r and P is chosen randomly in G. Assume a symmetric pairing e : G G G T. Since e(ap, bp) = e(p, P) ab it is easy to decide DDH by checking if e(ap, bp) = e(p, cp)? Therefore DDH is easy in G, even though CDH is still hard.

19 Using pairings Bilinear Diffie-Hellman (BDH) Assumption Bilinear Diffie-Hellman Problem Suppose e : G G G T is a symmetric pairing. Given P, ap, bp, cp G for a, b, c Z r, the BDH problem is to compute e(p, P) abc. The BDH assumption says that there exists no efficient algorithm to solve the BDH problem with non-negligible probability Can t really force three arguments into the pairing to get all three integers into the exponent...

20 Using pairings Joux s Three-Party Key Exchange Protocol (2000) Fix generator P G with e : G G G T Parties A, B, C respectively choose random a, b, c Z r A broadcasts ap, B broadcasts bp, C broadcasts cp All three parties can now compute the shared secret e(p, P) abc = e(bp, cp) a = e(ap, cp) b = e(ap, bp) c Attacker gets a look at P, ap, bp, cp... (locked inside the BDH problem/assumption) Basically three party version of Diffie-Hellman key exchange (but happens simultaneously)

21 ID-based cryptography ID-based cryptography - what and why? In ordinary public key cryptography, public keys are random strings Certificates are required to authenticate public keys Certificate management is a huge problem (issuing, path discovery, verification, revocation...)

22 ID-based cryptography Identities as public keys Shamir in 1984 proposed ID-based cryptography: make the public key equal to the identity of the owner In traditional PKI you need three items: identity, public key, certificate In ID-based cryptography these are all replaced by one item: the identity Identity string can be anything... huh?

23 ID-based cryptography Key generation in ID-based cryptography A Trusted Authority (TA) issues private keys to users during a registration process Users cannot generate their own keys ID-based cryptography has inherent key escrow of private keys TA keys can be shared to distribute trust What about key revocation? Partial solution is to include validity period in identity string.

24 ID-based cryptography Workflow ID-based public keys can be defined and used before the private key even exists. This property can be used to control the order of certain system events (workflow). Sending secrets into the future include validity start period as part of identity string; TA should only issue decryption key after validity start period Access control Include access control information as part of identity string TA should only issue decryption key on production of authorisation information

25 ID-based cryptography Boneh-Franklin IBE First ID-based encryption scheme with proof of security, published (SOK scheme in 2001 is roughly the same, but no security proof, and published in Japanese) Boneh-Franklin also give security model for IBE Basic version provides CPA security, enhanced version provides CCA security This paper was the main trigger for a flood of research in pairing-based cryptography As of today, 2264 citations on Google scholar

26 ID-based cryptography IBE - the four stages 1 Setup: the system parameters are set up 2 Extract: any identity sends identity string to TA and TA issues private key back to identity 3 Encrypt: users encrypt! 4 Decrypt: users decrypt!

27 ID-based cryptography Boneh Franklin IBE: SETUP 1 Generate parameters G, G T, e, where eg G G T is a symmetric pairing on groups of prime order r 2 Select two hash functions H 1 : {0, 1} G, H 2 : G T {0, 1} n, where n is the length of the plaintexts. 3 Choose an arbitrary generator P G 4 Select a master-key s uniformly at random from Z r and set P 0 = sp. 5 Public parameters are G, G T, e, r, P, P 0, H 1, H 2

28 ID-based cryptography Boneh Franklin IBE: Extract, Encrypt, Decrypt 1 Extract: Given an identity ID {0, 1}, set d ID = sh 1 (ID) as the private key of the identity. 2 Encrypt: Inputs are the message M and a target identity ID. 1 Choose random t Z r 2 Compute the ciphertext C = tp, M H 2 (e(h 1 (ID), P 0 ) t ). 3 Decrypt: Given a ciphertext U, V and a private key d ID, compute: M = V H 2 (e(d ID, U)).

29 ID-based cryptography Boneh Franklin IBE Analogous to ElGamal encryption, can also be related to Joux s protocol. Both sender (who has t) and reciever (who has d ID ) can compute e(h 1 (ID), P) st (let s see?)

30 ID-based cryptography Informal Security of Boneh Franklin IBE Adversary sees message XORed with hash of e(h 1 (ID), P 0 ) t Adversary also sees P 0 = sp and U = tp Write H 1 (ID = zp for some (unknown) z. Then e(h 1 (ID), P 0 ) t = e(p, P) stz. Because H 2 is modeled as a random oracle, adversary needs to compute e(p, P) stz when given as inputs sp, tp, zp. This is an instance of the BDH problem.

31 What do we want in a pairing General Pairings e : G 1 G 2 G T 1 We want to be able to efficiently hash random strings to G 1 and G 2 2 We (usually) want an efficiently computable isomorphism ψ : G 2 G 1 3 We want to be flexible in our choice of the embedding degree k Unfortunately, achieving all three of these properties simultaneously is not currently possible Prior to this being well known, cryptographers often made incorrect assumptions

32 The r-torsion The points P and Q in the pairing come from the r-torsion E[r] = Z r Z r. The green subgroup is usually chosen as G 1 for efficiency... all we need is another subgroup G 2 to pair elements of G 1 with. We can get out of the blue subgroups (trace map), but we can t hash into them Ironically, the only other subgroup we can hash to (the red subgroup), is the only one we can t map back out of.

33 Supersingular Curves The only time we can simultaneously do these two things is unfortunately on supersingular curves where our embedding degree k = 2, 3, 6 is restricted. This inability to satisfy all desired properties forces us to define different types of pairings, each with its own pros and cons

34 Pairing types Type 1 Pairings Can efficiently hash both P and Q onto the base field subgroup Use the distorsion map to send Q into a linearly independent subgroup Pairing defined over same group so isomorphism exists BUT... Supersingular curves only (k = 2 for large characteristic)

35 Pairing types Type 2 Pairings Can efficiently hash P onto the base field subgroup The trace map will map Q back to the base field subgroup Available over all curves and embedding degrees BUT... cannot randomly sample from this blue group without knowing the discrete logarithm

36 Pairing types Type 3 Pairings Can hash P and Q to their subgroups Available over all curves and embedding degrees BUT... no map from this Q s group back to P s group

37 Pairing types Type 4 Pairings Can hash both P and Q onto their subgroups Available over all curves and embedding degrees There will always be a map back (the trace map) Cannot hash points into the same subgroup (no discrete log between two Q s)

38 Pairing types Pairings in Protocols There have been schemes published that incorrectly assume that all properties of pairings can be utilised simultaneously Cryptographers must be careful when developing protocols that the pairings they need actually exist

39 Summary from last week We (cryptographers) need groups to work with Elliptic curves are a powerful (but weird-looking) group We can use elliptic curve group law to define protocols that existed on other groups like Z p This is ECC Elliptic curves are (coincidentally) the only place we can construct cryptographically useful pairings...

40 Summary from this week Pairings are bilinear maps Bilinear maps are extremely useful Therefore pairings are extremely useful We only looked at one hard problem/assumption (BDH). There are a heap more. (Google Pairing-based crypto lounge ) We only looked at a couple of protocols. There are a heap more. (Google Pairing-based crypto lounge )... or wait for me to upload the tutorial questions

41 Conclusion Elliptic curves are awesome Pairings are awesome Come and do a Ph.D in one of these topics