Detecting Dangerous Queries:
description
Transcript of Detecting Dangerous Queries:
Detecting Dangerous Queries:
Brent Waters
A New Approach for Chosen Ciphertext Security
Susan Hohenberger Allison Lewko
2
Public Key Encryption [DH76,RSA78,GM84]
SKPubK
Passive Attacker : Chosen Plaintext Attack (CPA)
3
Active Attackers [NY90,DDN91,RS91]
SKPubK
Chosen Ciphertext Attack (CCA)
IND-CPA [GM84]
Challenger
Setup PK
M0 ,M1
b’ {0,1}
CT* = Enc(PK, Mb )b{0,1}
AdvA = Pr[b=b’]-1/2
Indistinguishability under Chosen Plaintext Attack
IND-CCA [NY90,DDN91,RS91]
Challenger
Setup PK
M0 ,M1
b’ {0,1}
CT* = Enc(PK, Mb )b{0,1}
AdvA = Pr[b=b’]-1/2
Indistinguishability under Chosen Ciphertext Attack
CTDec(SK,CT)
CTDec(SK,CT) CT CT*
IND-CCA [NY90,DDN91,RS91]
Challenger
Setup
M0 ,M1
b’ {0,1}
CT* = Enc(PK, Mb )
AdvA = Pr[b=b’]-1/2
Indistinguishability under Chosen Ciphertext Attack
CTDec(SK,CT)
CTDec(SK,CT) CT
CT*CCA-1: No 2nd phase of oracle queries
b{0,1}
PK
The Grand Goal: CCA from CPA
7
CCA
CPA
Prior Methods (Standard Model)
8
NIZK [BFM88,NY90,DDN91,RS91,S99]
• NIZK proves well formness• NIZKs are rare: TPD/RSA, Pairings No:DDH,
Lattices
Cramer-Shoup plus [CS98,02,…]• Efficient systems from number theory• DDH,DCR, Factoring, IBE [CHK04],
No:Lattices
Prior Methods (Standard Model)
9
Lossy TDFs [PW08,RS09,…]
• Randomness recovery => use to verify CT
• Change PK in proof• DDH, Lattices
1-bit to many bit CCA[MS09]
• General techniques• Partial randomness recovery
Our Result
10
New General Approach for CCA security:
Detectable Chosen Ciphertext Security (DCCA)
CCA
DCCA
DCCA Security: Intuition
11
CCA secure if avoid “dangerous” queries1) Hard to produce bad queries w/o challenge CT2) Can detect dangerous queries
Example: Concatenate 1 bit CCA ciphertexts1CT* 1 0
Dangerous Query for CT*: CT = Reorder of CT*
1)Hard to produce w/o CT* 2) Easy to detect
Detectable Encryption System
12
Setup(1n) ! (PK,SK)
Encrypt(PK,M) ! CT
Decrypt(SK,CT) ! M
F( PK, CT* , CT) ! {0,1}
Outputs ‘1’ if CT is a “dangerous” query for CT*
Two Security Properties
Property 1: Hard to Predict (Strong)
Challenger
Setup PK,SK
MCT* = Enc(PK, M )
AdvA = Pr[F(PK,CT,CT*)=1]
CT
Property 2: Indistinguishability
Challenger
Setup PK
M0 ,M1
b’ {0,1}
CT* = Enc(PK, Mb )b{0,1}
AdvA = Pr[b=b’]-1/2
CTDec(SK,CT)
CTDec(SK,CT) CT CT*F(PK,CT*,CT)=0
CCA2=>DCCA=>CCA1
Ex. 1: n-bit DCCA from 1 bit CCA
15
Idea: Use basic concatenation
1 1 0
F(PK,CT*,CT): 9 (i,j) s.t. CTi*=CTj
Enc(PK,m) ! C1=Enc(PK,m1), …, Cn=Enc(PK,mn)
Ex. 2: Tag-Based Encryption [MRY04,K06]
16
Tag-Based Encryption: (1)Each ciphertext associated with a tag(2) Is CCA secure as long as TagCT* not queried
F(PK,CT*,CT): TagCT* = TagCT
Examples: CHK04-lite, Kiltz06, PW08 (CCA-1 version), DDN91 (w/o signature)
Ex. 3: Heuristic/Sloppy CCA
17
Idea: DCCA easier to meet than CCA(1)Heuristic approach(2) Sloppy: E.g. “Slack” bit in group
representation
Apply transformation in case messed up
CT:
The Ingredients
18
1-Bounded CCA CPA
Detectable CCA
PSV06,CDMW08
Trivial
Msg 2 {0,1}* and randomness 2 {0,1}n
Justified by Pseudo Random Generators
Our Construction
19
Setup
20
Setup(1n):1) Setup1B (1n) ! (PKA, SKA)2) SetupCPA (1n) ! (PKB, SKB)3) SetupDCCA (1n) ! (PKin, SKin)
PK= PKA, PKB, PKin
SK= SKA, SKB, SKin
Encryption
21
Encrypt(PK,M):1) Choose random ra ,rb , rin 2 {0,1}n 2) Cin = EncDCCA( (M,ra, rb ) ; rin ) 3) CA=Enc1B (Cin; ra), CB=EncCPA (Cin; rb) 4) CT= CA , CB
;ra(M, ra ,rb); rin ;rb(M, ra ,rb); rinCA= CB=
Decryption
22
Decrypt(SK, CT= (CA , CB) ) :1) Cin’ = Dec(SKA , CA )2) (M’, ra’, rb’) = Dec(SKin , Cin’ )3) CA’=Enc1B (Cin’; ra’), CB’=EncCPA (Cin ;rb’) 4) If CA CA ’ OR CB CB’ reject ;else M’
;ra(M, ra ,rb); rin ;rb(M, ra ,rb); rinCA= CB=
Idea: Recover (M, ra , rb ) then re-encrypt
A Few Comments
23
;ra(M, ra ,rb); rin
Features: Naor-Yung 2-key & Myers-shelat nesting
;rb(M, ra ,rb); rinCA= CB=
Embedded Randomness vs. NIZK
Proof w/ embedding randomness:Good: Decrypt from either sideProblem: Embedding challenge
What is the trouble?
24
;ra(M, ra ,rb); rin
Challenge CT= CA *, CB * encryptions of Cin *
;rbCin*= CB*=
Problem Query: Get Cin’ s.t. F(PKDCCA, Cin *, Cin’) =1
Bad Event: Query C= CA , CB s.t.(1)CA CA *(2)Dec( SK_A, CA) = Cin’ where F(PKDCCA, Cin *, Cin’)
=1
CA*= Cin*= (M, ra ,rb); rin
Nested Indist. Game
25
;ra(M, ra ,rb); rin
Attacker gets CCA queries Challenge Inner encrypts Msg + randomness or all 0’s
;rbCin*= CB*=CA*= Cin*= (M, ra ,rb); rin
z=1
;ra(00…00); rin ;rbCin*= CB*=CA*= Cin*= (00…00); rin
z=0 No embedded randomness
If prove under this game we are done!
Roadmap
26
Eliminate bad event => Security follows from DCCA
(1)Eliminate with z=0 (no embedded randomness)(2) Indirectly infer z=1 case from (1)
Bad Event Analysis (no embedded randomness)
27
Nested ;ra(00…00); rin ;rb(00…00); rin
Right-Erased ;ra(00…00); rin ;rb1111…111
Switch -Decrypt
Full-Erased ;ra ;rb1111…111
Show probabilities are close
IND-CPA
1Bounded CCA
=negl(n) unpredictability
1111…111
BE-Nested vs. BE-Right-Erase
28
;rb(00…00); rin
Standard IND-CPA reduction• Know SKA, SKin , not SKB
• Observe BE using SKA
;rb1111…111vs.
Switch Decrypt
29
Switch from using SKA to SKB to decrypt• These are equivalent from Attacker’s
view• Best of both worlds: Challenge CT not
embed randomness, but queries must!
BE-Right-Erased vs. BE-Full-ErasedFull-Erased ;ra ;rb1111…1111111…111
(M, ra ,rb); rinCin*= is gone! Unpredictability: Pr[Bad event in Full Erase] =
negl(n)
BE-Right-Erased vs. BE-Full-Erased
31
1-Bounded CCA reduction• Know SKB, SKin , not SKA
• Problem: Cannot observe bad event using SKB
• Solution: “Peek” at 1 A query using 1-Bounded 1/Q chance of seeing it
vs.(00…00); rin ;ra1111…111
No Bad Event for embedded randomness
Suppose it did happen => We break DCCA indist.
(00…00); rin
2) Submit Msg0 =(M, ra, rb) , Msg1 = (00…00)1) Run Indist Game on A (while playing DCCA)
3) Get back either
(M, ra ,rb); rin or
4) Create challenge CT (know SKA, SKB)5) Use DCCA oracle to answer non-dangerous
queriesWhat if get dangerous query? Stuck!But then we know it must be Msg0 => breaks
DCCA!
Finishing it off
33
;ra(M, ra ,rb); rin ;rbCin*= CB*=CA*= Cin*= (M, ra ,rb); rin
z=1
;ra(00…00); rin ;rbCin*= CB*=CA*= Cin*= (00…00); rin
z=0 No embedded randomness
N.I. easy to prove from DCCA if no bad eventsCCA security follows immediately
Summary
34
• New abstraction: Detectable CCA security• Build CCA from it• Cover 1 to many bit enc. , tag-based, & more• Embedded randomness --- blessing & problems• Indirect inference on bad event
Could CCA-1 work?
35
Idea: Replace DCCA component w/ CCA-1Problem 1: Proof needs to detect
(CT*) :Decrypts CT*, encrypts M in another CT’
Problem 2: Can create an oracle that breaks it
Q1: The oracle is strong! Is there middle ground?
Q2: Structure for CCA-1? Proof idea?
Our Picture (not necessarily to scale)
36
CCA
CPA
DCCA
CCA-1
37
Thank you