Advances in Cryptology - CRYPTO '98, 18 conf

Lecture Notes in Computer Science Edited by G. Goos, J. Hartmanis and J. van Leeuwen

1462

Hugo Krawczyk (Ed.)

Advances in Cryptology CRYPTO ' 98 18th Annual International Cryptology Conference Santa Barbara, California, USA August 23-27, 1998 Proceedings

~ Springer

Series Editors Gerhard Goos, Karlsruhe University, Germany Juris Hartmanis, Cornell University, NY, USA Jan van Leeuwen, Utrecht University, The Netherlands

Volume Editor Hugo Krawczyk Department of Electrical Engineering Technion Haifa 32000, Israel E-mail: [email protected] Cataloging-in-Publication data applied for

Die Deutsche Bibliothek - CIP-Einheitsaufnahme Advances in cryptology : proceedings / Crypto '98, 18th Annual International Cryptology Conference, Santa Barbara, California, USA, August 23 - 27, 1998. Hugo Krawczyk (ed.). [IACR]. - Berlin ; Heidelberg ; New York ; Barcelona ; Budapest ; Hong Kong ; London ; Milan ; Paris ; Singapore ; Tokyo : Springer, 1998 (Lecture notes in computer science ; Vol. 1462) ISBN 3-540-64892-5

CR Subject Classification (1991): E.3, G.2.1, D.4.6, K.6.5, F.2.1-2, C.2, J.1 ISSN 0302-9743 ISBN 3-540-64892-5 Springer-Verlag Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. 9 Springer-Verlag Berlin Heidelberg 1998 Printed in Germany Typesetting: Camera-ready by author SPIN 10638300 06/3142 - 5 4 3 2 1 0

Printed on acid-free paper

Preface

Crypto '98, the Eighteenth Annual Crypto Conference, is sponsored by the International Association for Cryptologic Research (IACR), in cooperation with the IEEE Computer Society Technical Committee on Security and Privacy and the Computer Science Department, University of California, Santa Barbara (UCSB). The General Chair, Andrew Klapper, is responsible for local organization and registration. The Program Committee considered 144 papers and selected 33 for presentation. This year's conference program also includes two invited lectures. Michael Rabin will deliver an IACR Distinguished Lecture on the subject of "Authentication". The tradition of IACR Distinguished Lectures at Crypto and Eurocrypt conferences was initiated a few years ago and it honors scientists who have made outstanding contributions to the field of cryptography. Michael Rabin is one of the most prominent pioneers of modern cryptography with many brilliant contributions to the fundamental aspects of this science. The second invited lecture, titled "Cryptography and the Internet", will be delivered by Steve Bellovin. I believe that Bellovin's talk stresses an important point, namely, the need for the active participation of the crypto community in the challenging task of transferring cryptographic science into real-world applications and implementations. In addition to these two invited lectures, Miles Smid from the US National Institute of Standards and Technology (NIST) will present a first report on the Advanced Encryption Standard (AES) Conference, which takes place shortly before Crypto'98. The AES Conference's goal is to present candidate encryption algorithms from which a new US standard for symmetric encryption is to be produced. Finally, we will have the traditional Rump Session for informal short presentations of new results. Stuart Haber kindly agreed to run this session. These proceedings include the revised versions of the 33 papers accepted by the Program Committee. These papers were selected from all the submissions to the conference on the basis of perceived originality, quality and relevance to the field of cryptography. Revisions were not checked as to their contents. The authors bear full responsibility for the contents of their papers. The selection of papers is a difficult and challenging task. I am very grateful to the Program Committee members who did an excellent job in reviewing the submissions in spite of the severe time constraints imposed by the Program Committee's work schedule. Each submission was refereed by at least three reviewers. In total, close to 600 reports were provided by the reviewers - about 18 000 lines of text in total! The Program Committee was assisted by a large number of colleagues who reviewed submissions in their areas of expertise. External reviewers included: W. Aiello, A. Antipa, S. Arita, B. Baum-Waidner, D. Beaver, A. Beimel, M. Bellare, J. Benaloh, C. Bennett, C. Berg, J. Black, S. BlakeWilson, D. Bleichenbacher, G. Bleumer, T. Boogaerts, C. Cachin, J. Ca.menisch, R. Canetti, B. Chor, S. Contini, R. Cramer, C. Crepeau, G. Di Crescenzo,

yl J-F. Dhem, U. Feige, M. Fitzi, R. Gallant, J. A. Garay, P. Gemmell, R. Gennaro, J. Giesen, N. Gilboa, O. Goldreich, S. Haber, S. Halevi, T. Helleseth, M. Hirt, R. Impagliazzo, Y. Ishai, G. Itkis, M. Jakobsson, C. Jutla, J. Kilian, F. Koeune, R. Kohlas, T. Krovetz, E. Kushilevtiz, X. Lai, R. Lambert, P. Landrock, A. Lauder, A. Lenstra, P. MacKenzie, D. Malkhi, H. Massias, W. Meier, M. Michels, V. Miller, M. Naor, M. N~islund, K. Nissim, K. Nyberg, H. Peterson, E. Petrank, B. Pinkas, B. Preneel, C. Rackoff, S. Rajagopalan, O. Reingold, P. Rohatgi, A. Rosen, K. Sakurai, P. Shor, R. Sidney, T. Spies, M. Stadler, D. Stinson, Y. Tsiounis, Y. Tsunoo, D. Tygar, S. Ulfberg, R. Venkatesan, M. Waidner, S. Wolf, R. Wright, Y. Yacobi, Y. Yin, A. Young, and O. Ytrehus. My thanks go to all these reviewers and I apologize for any inadvertent omissions. I also wish to thank the committee's two advisory members, Butt Kaliski and Mike Wiener, the program chairs for Crypto '97 and '98, for their advice, help, and support. Crypto '98 is the first IACR conference with both electronic submissions and an electronic version of the proceedings. The electronic submission option was a clear choice for most authors, with 90% of the papers submitted this way. All credit and thanks for the setup and smooth operation of this process go to Joe Kilian who volunteered to run this first electronic experience for Crypto. To this end, Joe adapted the electronic submission software developed by ACM's SIGACT group. I thank the ACM for allowing the use of their system. The electronic version of these proceedings will be published by Springer and will be available under h t t p : / / l i n k , s p r i n g e r , d e / s e r i e s / l n c s / In organizing the scientific program of the conference and putting together these proceedings I have been assisted by many people in addition to those mentioned above. I would like to especially thank the following people: Tal Rabin for providing me with essential help and support in many of the organizational aspects; Andrew Klapper, the General Chair of the conference, for freeing me from all the issues not directly related to the scientific program and proceedings; Gitta Abraham for secretarial help; Robert Schapire for providing excellent software for automating many of the chores of running a conference program committee; Kevin McCurley for his help with the electronic submissions procedure; Don Coppersmith for much timely help and support. Finally, I wish to thank the authors of all submissions for making this conference possible, and the authors of accepted papers for their work and cooperation in the production of these proceedings.

June 1998

Hugo Krawczyk Program Chair Crypto '98

CRYPTO

'98

August 23-27, 1998, Santa Barbara, California, USA Sponsored by the

International Association for Cryptologic Research (IACR) in cooperation with

IEEE Computer Society Technical Committee on Security and Privacy Computer Science Department, University of California, Santa Barbara General Chair Andrew Klapper, University of Kentucky, USA

Program Chair Hugo Krawczyk, Technion, Israel and IBM Research, USA

Program Committee Dan Boneh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Stanford University, USA Don Coppersmith . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . IBM Research, USA Yair Frankel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CertCo, USA Matt Franklin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A T & T Labs-Research, USA Johan Hs .......................... Royal Institute of Technology, Sweden Lars Knudsen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . University of Bergen, Norway Ueli Maurer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E T H Zurich, Switzerland Alfred Menezes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Waterloo University, Canada Andrew Odlyzko . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A T & T Labs-Research, USA Rafail Ostrovsky . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Bellcore, USA Jean-Jacques Quisquater . . . . . . . . . . . . . . . . . . . . . . Universit~ de Louvain, Belgium Tal Rabin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . IBM Research, USA Matt Robshaw . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RSA Laboratories, USA Phillip Rogaway . . . . . . . . . . . . . . . . . . . . . . . University of California at Davis, USA Rainer Rueppel . . . . . . . . . . . . . . . . . . . . . R 3 Security Engineering AG, Switzerland Kazue Sako . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . NEC, Japan Dan Simon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Microsoft Research, USA Moti Yung . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CertCo, USA

Advisory members B u t t Kaliski (Crypto'97 program chair) . . . . . . . . . . . . . . . . RSA Laboratories, USA Michael J. Wiener (Crypto'99 program chair) . . . . . Entrust Technologies, Canada

Table of Contents

Chosen-Ciphertext Security Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS # 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Daniel Bleichenbacher A Practical Public Key Cryptosystem Provably Secure Against Adaptive Chosen Ciphertext Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

13

Ronald Cramer, Victor Shoup Relations Among Notions of Security for Public-Key Encryption Schemes . 26

Mihir Bellare, Anand Desai, David Pointcheval, PhiUip Rogaway

Invited Lecture Cryptography and the Internet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

46

Steven M. Bellovin

Cryptanalysis of Hash Functions and Block Ciphers Differential Collisions in SHA-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

56

Florent Chabaud, Antoine Joux From Differential Cryptanalysis to Ciphertext-Only Attacks . . . . . . . . . . . . .

72

Alex Biryukov, Eyal Kushilevitz

Distributed Cryptography A Simplified Approach to Threshold and Proactive RSA . . . . . . . . . . . . . . . .

89

Tal Rabin New Efficient and Secure Protocols for Verifiable Signature Sharing and Other Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

105

Dario Catalano, Rosario Gennaro Trading Correctness for Privacy in Unconditional Multi-party Computation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

121

Matthias Fitzi, Martin Hirt, Ueli Maurer

Identification and Certification Fast Digital Identity Revocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

William Aiello, Sachin Lodha, Rafail Ostrovsky

137

Self-Delegation with Controlled P r o p a g a t i o n - or - W h a t If You Lose Your Laptop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

153

Oded Goldreich, Birgit Pfitzmann, Ronald L. Rivest Identity Escrow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

169

Joe Kilian, Erez Petrank

Block Cipher Design and Analysis Generalized Birthday Attacks on Unbalanced Feistel Networks . . . . . . . . . . .

186

Charanjit S. Jutla Quadratic Relation of S-box and Its Application to the Linear Attack of Full Round DES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

200

Takeshi Shimoyama, Toshinobu Kaneko Cryptanalysis of Block Ciphers with Probabilistic Non-linear Relations of Low Degree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

212

Thomas Jakobsen

Algebraic Cryptanalysis Cryptanalysis of the Ajtai-Dwork C r y p t o s y s t e m . . . . . . . . . . . . . . . . . . . . . . .

223

Phon9 Nguyen, Jacques Stern Cryptanalysis of the Chor-Rivest C r y p t o s y s t e m . . . . . . . . . . . . . . . . . . . . . . . .

243

Serge Vaudenay Cryptanalysis of the Oil & Vinegar Signature Scheme . . . . . . . . . . . . . . . . . . .

257

Aviad Kipnis, Adi Shamir

Relations Among Cryptographic Primitives From Unpredictability to Indistinguishability: A Simple Construction of P s e u d o - R a n d o m Functions from MACs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

267

Moni Naor, Omer Reingold Many-to-One T r a p d o o r Functions and their Relation to Public-Key Cryptosystems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

283

Mihir Bellare, Shai Halevi, Amit Sahai, Salil Vadhan

I A C R Distinguished Lecture Authentication, Enhanced Security and Error Correcting Codes . . . . . . . . . .

299

Yonatan Aumann, Michael O. Rabin

Algebraic Schemes An Efficient Discrete Log Pseudo R a n d o m Generator . . . . . . . . . . . . . . . . . . .

Sarvar Patel, Ganapathy S. Sundaram

304

• Fast RSA-type Cryptosystem Modulo pkq . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tsuyoshi Takagi An Elliptic Curve Implementation of the Finite Field Digital Signature Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Neal Koblitz Quantum

327

Cryptography

Quantum Bit Commitment from a Physical Assumption . . . . . . . . . . . . . . . . Louis Salvail Signatures,

318

Random

Functions

338

and Ideal Ciphers

On Concrete Security Treatment of Signatures Derived from Identification 354 Kazuo Ohta, Tatsuaki Okamoto Building PRFs from PRPs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chris Hall, David Wagner, John Kelsey, Bruce Schneier Security Amplification by Composition: The Case of Doubly-Iterated, Ideal Ciphers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . William Aiello, Mihir BeUare, Giovanni Di Crescenzo, Ramarathnam Venkatesan

370

390

Zero-Knowledge On the Existence of 3-Round Zero-Knowledge Protocols . . . . . . . . . . . . . . . . Satoshi Hada, Toshiaki Tanaka

408

Zero-Knowledge Proofs for Finite Field Arithmetic, or: Can Zero-Knowledge Be for Free? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424 Ronald Cramer, Ivan Damg~rd Concurrent Zero-Knowledge: Reducing the Need for Timing Constraints .. 442 Cynthia Dwork, Amit Sahai Implementation The Solution of McCurley's Discrete Log Challenge . . . . . . . . . . . . . . . . . . . . Damian Weber, Thomas Denny

458

Optimal Extension Fields for Fast Arithmetic in Public-Key Algorithms .. 472 Daniel V. Bailey, Christof Paar Rights

Protection

Time-Stamping with Binary Linking Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . Ahto Buldas, Peeter Laud, Helger Lipmaa, Jan Villemson

486

• Threshold Traitor Tracing ...........................................

502

Moni Naor, Benny Pinkas Author Index

.................................................

519

Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1 Daniel Bleichenbacher Bell Laboratories 700 Mountain Ave., Murray Hill, NJ 07974 [email protected]

Abstract. This paper introduces a new adaptive chosen ciphertext attack against certain protocols based on RSA. We show that an RSA private-key operation can be performed if the attacker has access to an oracle that, for any chosen ciphertext, returns only one bit telling whether the ciphertext corresponds to some unknown block of data encrypted using PKCS #1. An example of a protocol susceptible to our attack is SSL V.3.0. Keywords: chosen ciphertext attack, RSA, PKCS, SSL

1

Overview

In this paper, we analyze the following situation. Let n, e be an RSA public key, and let d be the corresponding secret key. Assume that an attacker has access to an oracle that, for any chosen ciphertext c, indicates whether the corresponding plaintext cd mod n has the correct format according to the RSA encryption standard PKCS #1. We show how to use this oracle to decrypt or sign a message. The attacker carefully prepares ciphertexts that are sent to the oracle. Combining the returns from the oracle, the attacker gradually gains information on cd . The chosen ciphertexts are based on previous outcomes of the oracle. Thus, this technique is an example of an adaptive chosen-ciphertext attack. Usually, a chosen ciphertext attack is based on the theoretical assumption that the attacker has access to a decryption device that returns the complete decryption for a chosen ciphertext. Hence, if a public-key cryptosystem is susceptible to a chosen-ciphertext attack, that often is considered to be only a theoretical weakness. However, the attack shown in this paper is practical, because it is easy to get the necessary information corresponding to the oracle reply. The attack can be carried out if, for example, the attacker has access to a server that accepts encrypted messages and returns an error message depending on whether the decrypted message is PKCS conforming. This paper is organized as follows. We describe the RSA encryption standard PKCS #1 in Section 2. In Section 3, we describe and analyze our chosenciphertext attack. Different situations in which this attack can be carried out H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 1–12, 1998. c Springer-Verlag Berlin Heidelberg 1998

2

Daniel Bleichenbacher

are listed in Section 4. We then analyze the vulnerability of SSL to our attack in Section 5. In Section 6, we report experiments with the technique. In Section 7, we conclude by offering recommendations.

2

PKCS #1

In this section, we describe briefly the RSA encryption standard PKCS #1; refer to [11] for details. Currently, there are three block formats: Block types 0 and 1 are reserved for digital signatures, and block type 2 is used for encryption. We describe only block type 2, because it is relevant for this paper.

00

02

padding string

00

data block

Fig. 1. PKCS #1 block format for encryption. The first two bytes in this format are constant. The length of the padding block can vary.

Let n, e be an RSA public key, and let p, q, d be the corresponding secret key (i.e, n = pq and d ≡ e−1 (mod ϕ(n))). Moreover, let k be the byte length of n. Hence, we have 28(k−1) ≤ n < 28k . A data block D, consisting of |D| bytes, is encrypted as follows. First, a padding string P S, consisting of k −3−|D| nonzero bytes, is generated pseudo-randomly. Here, |D| must not exceed k − 11; in other words, the byte length of P S is a least 8. Now, the encryption block EB = 00||02||P S||00||D is formed (Figure 1), is converted into an integer x, and is encrypted with RSA, giving the ciphertext c ≡ xe (mod n). The representation of the ciphertext is not important for this paper. We are, however, interested in how the receiver parses a ciphertext. First, he gets an integer x0 by decrypting the ciphertext with his private key. Then, he converts x0 into an encryption block EB0 . Now he looks for the first zero byte, which indicates the ending of the padding string PS and the start of the data block D. The following definition specifies when this parsing process is successful. Definition 1. An encryption block EB consisting of k bytes – that is, EB = EB1 ||...||EBk is called PKCS conforming – if it satisfies the requirements of block type 2 in PKCS #1. In particular, EB must satisfy the following conditions: – – – –

EB1 = 00. EB2 = 02. EB3 through EB10 are nonzero. At least one of the bytes EB11 through EBk is 00.

Chosen Ciphertext Attacks Against Protocols

3

We also call a ciphertext c PKCS conforming if its decryption is PKCS conforming. Note that the definition of conforming does not include possible integrity checks. We show in Section 3 that it should not be possible for an attacker to decide whether a chosen ciphertext is PKCS conforming. It is sometimes possible for an attacker to do so even if the data block contains further integrity checks.

3

Chosen-Ciphertext Attacks

In a chosen-ciphertext attack, the attacker selects the ciphertext, sends it to the victim, and is given in return the corresponding plaintext or some part thereof. A chosen-plaintext attack is called adaptive if the attacker can chose the ciphertexts depending on previous outcomes of the attack. It is well known that plain RSA is susceptible to a chosen-ciphertext attack [5]. An attacker who wishes to find the decryption m ≡ cd (mod n) of a ciphertext c can chose a random integer s and ask for the decryption of the innocent-looking message c0 ≡ se c mod n. From the answer m0 ≡ (c0 )d , it is easy to recover the original message, because m ≡ m0 s−1 (mod n). Another well-known result is that the least significant bit of RSA encryption is as secure as the whole message [8] (see also [1]). In particular, there exists an algorithm that can decrypt a ciphertext if there exists another algorithm that can predict the least significant bit of a message given only the corresponding ciphertext and the public key. H˚ astad and N¨ aslund recently extended this result to show that all individual RSA bits are secure [9]. Hence, it is not necessary for an attacker to learn the complete decrypted message in a chosen-ciphertext attack: Single bits per chosen ciphertext may be sufficient. The result reported in this paper is similar. We assume that the attacker has access to an oracle that, for every ciphertext, returns whether the corresponding plaintext is PKCS conforming. We show that we can use this oracle to compute cd (mod n) for any chosen integer c. Theoretically, we can use H˚ astad’s and N¨ aslund’s algorithm [9] to find c. In this paper, we describe a different algorithm that has as its goal to minimize the number of chosen ciphertexts; thus, we show the practicality of the attack. That is, we are not trying to generalize the attack; rather, we would like to take advantage of specific properties of PKCS #1. In particular, the algorithm relies on the facts that the first two bytes of the PKCS #1 format are constant, and that we know these two bytes with certainty when a ciphertext is accepted. Also, we use heuristic arguments in our the analysis of the algorithm to approximate the number of expected chosen ciphertexts, rather than finding an upper bound. 3.1

Description of the Attack

First, we give a short overview over the attack; then, we describe the attack in detail.

4

Daniel Bleichenbacher

Assume that the attacker wants to find m ≡ cd (mod n), where c is an arbitrary integer. Basically, the attacker chooses integers s, computes c0 ≡ cse

(mod n),

and sends c0 to the oracle. If the oracle says that c0 is PKCS conforming, then the attacker knows that the first two bytes of ms are 00 and 02. For convenience, let B = 28(k−2) . Recall that k is the length of n in bytes. Hence, that ms is PKCS conforming implies that 2B ≤ ms mod n < 3B. By collecting several such pieces of information, we can eventually derive m. Typically, 220 chosen ciphertexts will be sufficient, but this number varies widely depending on numerous implementation details. The attack can be divided into three phases. In the first phase, the message is blinded, giving a ciphertext c0 that corresponds to an unknown message m0 . In the second phase, the attacker tries to find small values si for which the ciphertext c0 (si )e mod n is PKCS conforming. For each successful value for si , the attacker computes, using previous knowledge about m0 , a set of intervals that must contain m0 . We elaborate this process later. The third phase starts when only one interval remains. Then, the attacker has sufficient information about m0 to choose si such that c0 (si )e mod n is much more likely to be PKCS conforming than is a randomly chosen message. The size of si is increased gradually, narrowing the possible range of m0 until only one possible value remains. Now we describe this attack in detail. The variable Mi will always be a set of (closed) intervals that is computed after a successful si has been found, such that m0 is contained in one of the intervals of Mi . Step 1: Blinding. Given an integer c, choose different random integers s0 ; then check, by accessing the oracle, whether c(s0 )e mod n is PKCS conforming. For the first successful value s0 , set c0 ← c(s0 )e mod n M0 ← {[2B, 3B − 1]} i ← 1. Step 2: Searching for PKCS conforming messages. Step 2.a: Starting the search. If i = 1, then search for the smallest positive integer s1 ≥ n/(3B), such that the ciphertext c0 (s1 )e mod n is PKCS conforming. Step 2.b: Searching with more than one interval left. Otherwise, if i > 1 and the number of intervals in Mi−1 is at least 2, then search for the smallest integer si > si−1 , such that the ciphertext c0 (si )e mod n is PKCS conforming.

Chosen Ciphertext Attacks Against Protocols

5

Step 2.c: Searching with one interval left. Otherwise, if Mi−1 contains exactly one interval (i.e., Mi−1 = {[a, b]}), then choose small integer values ri , si such that bsi−1 − 2B (1) ri ≥ 2 n and

2B + ri n 3B + ri n ≤ si < , b a

(2)

until the ciphertext c0 (si )e mod n is PKCS conforming. Step 3: Narrowing the set of solutions. After si has been found, the set Mi is computed as       [  2B + rn 3B − 1 + rn max a, , min b, (3) Mi ← si si (a,b,r)

for all [a, b] ∈ Mi−1 and

bsi − 2B asi − 3B + 1 ≤r≤ . n n

Step 4: Computing the solution. If Mi contains only one interval of length 1 (i.e., Mi = {[a, a]}), then set m ← a(s0 )−1 mod n, and return m as solution of m ≡ cd (mod n). Otherwise, set i ← i + 1 and go to step 2. Remarks. Step 1 can be skipped if c is already PKCS conforming (i.e., when c is an encrypted message). In that case, we set s0 ← 1. However, step 1 is always necessary for computing a signature, even if we do not wish to get a blind signature. In Step 2.a, we start with s1 = dn/(3B)e, because, for smaller values m0 s1 is never PKCS conforming. We use condition (1) because we want to divide the remaining interval in each iteration roughly in half. We can often improve the attack by using more information. For example, we have not used the fact that any PKCS-conforming message m0 si contains at least one zero byte. Moreover, if the attack is performed in a client–server environment, where both parties use the message m0 si to generate session keys, we might be able to find this message by exhaustive search if we already knew a sufficient portion of it. 3.2

Analysis of the Attack

We now analyze the correctness of the attack and approximate the complexity of, and, in particular, the number of oracle accesses necessary for, this attack. We must make a few heuristic assumptions; hence, we cannot give a rigorous proof of our result. First, we approximate the probability Pr(P ) that a randomly chosen integer 0 ≤ m < n is PKCS conforming. Let Pr(A) = B n be the probability that, for a

6

Daniel Bleichenbacher

randomly chosen integer, the first two bytes are 00 and 02, respectively. Since we have 216 B > n > 28 B, it follows that 2−16 < Pr(A) < 2−8 . The RSA modulus is usually chosen to be a multiple of 8; hence, Pr(A) will usually be close to 2−16 . The probability that the padding block PS contains at least 8 non-zero bytes followed by a zero byte is 8 k−10 !   255 255 . Pr(P |A) = · 1− 256 256 Assuming a modulus n of at least 512 bit (i.e. k ≥ 64), we have 0.18 < Pr(P |A) < 0.97; hence, we have

0.18 · 2−16 < Pr(P ) < 0.97 · 2−8 .

Next, we explain why our algorithm finds m0 and thus m. We prove that m0 ∈ Mi for all i by induction over i. Since m0 is PKCS conforming, we have 2B ≤ m0 ≤ 3B − 1, and so, trivially, m0 ∈ M0 . Now assume that m0 ∈ Mi−1 . Hence, there exists an interval [a, b] ∈ Mi−1 with a ≤ m0 ≤ b. Since m0 si is PKCS conforming, there exists an integer r such that 2B ≤ m0 si − rn ≤ 3B − 1, and hence asi − (3B − 1) ≤ rn ≤ bsi − 2B. We also have 3B − 1 + rn 2B + rn ≤ m0 ≤ . si si Hence, it follows from the definition of Mi that m0 is contained in one of the intervals. Now we analyze the complexity of the attack. The messages in step 1 are chosen randomly; therefore, this step needs about 1/Pr(P ) accesses to the oracle on average to find s0 . We assume again that, on average, we need 1/Pr(P ) accesses to the oracle to find si for i ≥ 1 in step 2.a and 2.b. (See also the remark at the end of this section.) Let ωi be the number of intervals in Mi . Using heuristic arguments, we can expect that ωi will satisfy the following equation for i ≥ 1.  i B ωi ≤ 1 + 2i−1 si (4) n l m Indeed, the length of an interval in Mi is upper bounded by sBi . The knowledge   that m0 si is PKCS conforming alone would lead to sinB intervals of the form     3B − 1 + rn 2B + rn , , (5) Ir = si si   since r can take at most sinB values in equation (3).

Chosen Ciphertext Attacks Against Protocols

7

  In particular, M1 will contain about s1nB intervals. If i > 1, then each of the intervals Ir or a fraction of Ir is included in Mi if Ir overlaps with one interval of Mi−1 . No interval Ir can overlap with two intervals in Mi−1 . If intervals Ir were randomly distributed, then the probability that one intersects with Mi−1 would be upper bounded by   1 1 ωi−1 . + si si−1 Hence, we get Equation (4) by taking into account that one interval must contain m0 . In our case, we expect s2 to be approximately 2/Pr(P ), and we have 2(B/n)2 /Pr(P ) = 2B/(nPr(P |A)) < 2B/(0.18n) < 1/20. Hence, w2 is 1 with high probability. Thus, we expect that Step 2.b will be executed only once. Now we analyze Step 2.c. We have Mi = {[a, b]}; hence, a ≤ m0 ≤ b, and thus 2B + ri n 3B − 1 + ri n 3B − 1 + ri n 2B + ri n ≤ . ≤ si ≤ ≤ b m0 m0 a i n 3B−1+ri n The length of the interval [ 2B+r , ] is b a

3B − 1 + ri n 2B + ri n B−1 1B−1 3B − 1 + ri n 2B + ri n − ≥ . − ≥ ≥ a b m0 m0 m0 3 B Therefore, we can expect to find a pair ri , si that satisfies (2) for about each third value of ri that is tried. Thus, it seems easy to find such pairs ri , si that satisfy (1) and (2) just by iterating through possible values for ri . i n 3B−1+ri n The probability that si ∈ [ 2B+r ] is roughly 1/2. Thus, we will m0 , m0 find a PKCS-conforming si after trying about 2/Pr(P |A) chosen ciphertexts. Since the remaining interval in Mi is divided in half in each step 2.c, we expect to find m0 with about 3/Pr(P ) + 16k/Pr(P |A) chosen ciphertexts, where k denotes the size of the modulus in bytes. For Pr(P ) = 0.18 · 2−16 and k = 128 (which corresponds to a 1024-bit modulus), we expect that the attack needs roughly 220 chosen ciphertexts to succeed. The bit length of the modulus is usually a multiple of 8; hence, Pr(P ) is close to 0.18 · 2−16 , as assumed previously. Remarks. The probabilities in this section were computed under the assumption that the values si are independent of each other. We made that assumption to allow a heuristic analysis of the algorithm. However, the assumption may be wrong in special cases. For example, let us assume that m0 and si m0 are both PKCS conforming with padding strings of similar length; that is, we have, for some integer j, m0 = 2 · 28(k−2) + 28j PS + D si m0 = 2 · 28(k−2) + 28j PS0 + D0 .

8

Daniel Bleichenbacher

Then, (2si − 1)m0 is PKCS conforming with high probability, since (2si − 1)m0 = 2 · 28(k−2) + 28j (2PS0 − PS) + 2D0 − D often is PKCS conforming too. We believe that such relations generally help the attacker, but it in certain situations the attack might require many more chosen ciphertexts than our analysis indicates. Usually, the bit size of the RSA modulus is a multiple of 8. This choice is a good one, because, for such a modulus, Pr(P ) is small. A modulus with a bit length 8k − 7 would make the attack much easier, because, in that case, only about 213 chosen messages would be necessary.

4

Access to an Oracle

In this section, we describe three situations in which an attacker could get access to an oracle. 4.1

Plain Encryption

Let us assume that a cryptographic protocol starts as follows. Alice generates a message m (e.g., a randomly chosen key). She encrypts it with PKCS #1, without applying any further integrity checks, and sends the ciphertext to Bob. Bob decrypts the message. If the format of the message is not PKCS conforming, then he returns an error; otherwise, he proceeds according to the protocol. If Eve impersonates Alice, she can easily send messages to Bob and check them for conformance. Note that Eve’s attack works even when the protocol includes strong authentication at a later step, since Eve has obtained useful information before she has to respond with an authenticated message. Note that the RSA encryption standard PKCS #1 [11, page 8, note 3] recommends that a message digest be included before an RSA operation, but for only the signing procedure. Even though the standard mentions that an encrypted message does not ensure integrity by itself, the standard does not indicate where such an integrity check should be included. 4.2

Detailed Error Messages

Thus far, we have shown that a reliable integrity check is an important part of an RSA encryption. One way to include such a check is to let the sender sign the message with his private key, before he encrypts it with the receiver’s public key. Then, an attacker can no longer hope to create a correct message by accident. Her attack will nonetheless be successful when, in the case of a failed verification, the receiver returns an error message that gives detailed information about where the verification failed. In particular, it would compromise security to return different error messages for a message that is not PKCS conforming and for a message where only the signature verification failed.

Chosen Ciphertext Attacks Against Protocols

4.3

9

A Timing Attack

Certain applications combine encryption and signatures. In such cases, a reliable integrity check often is part of the signature, but is not included in the encryption. Let us assume that an encrypted message c is decrypted and verified as shown in the following pseudo-code: 1. 2. 3. 4.

Let m ≡ cd (mod n) be the RSA-decryption of c. If m is not PKCS conforming, then reject. Otherwise, verify the signature of m. If the signature is not correct, then reject; otherwise, accept.

An attacker will not be able to generate a chosen ciphertext c such that this message has a correct signature. However, she will be able to generate messages such that c sometimes passes the check in step 2 and is rejected only after the signature is checked. Hence, by measuring the server’s response time, an attacker could determine whether c is PKCS conforming. This timing attack is much easier to perform than is Kocher’s timing attack [10], which measures the time difference of single modular multiplications – a small fraction of the time used for one exponentiation. In our case, however, we have to distinguish between performing only an decryption and performing both an decryption and a signature verification. In the worst case, the time for the signature verification could be significantly longer than the time for the decryption – when, for example, we have a 512-bit encryption key because of export restrictions, but we use a 2048-bit key to ensure strong authentication. In addition, the attacker can chose what signing key is sent to the server.

5

SSL V.3.0

00

02

padding string

00

03

00

premastersecret 46 bytes

Fig. 2. SSL block format. Unlike the PKCS format, this format contains the SSL version number. Moreover, the length of the data block is constant.

The situation discussed in this paper arises in SSL V.3.0 [7] during the handshake protocol. In particular. the client and server first exchange the messages client.hello and server.hello, which, among other information exchanges, select the cryptographic routines. After that, the client and server may send their public keys and certificates. The client then generates a random secret bit

10

Daniel Bleichenbacher

string called pre master secret, encrypts that secret bit string with RSA (if that mode was chosen earlier), and sends the resulting ciphertext to the server. The server decrypts the ciphertext. If the plaintext is not PKCS conforming, the server sends an alert message to the client and closes the connection; otherwise, the server continues the handshake protocol. Finally, the client has to send a finished message, which contains strong authentication. In particular, the client has to know the pre master secret to compute that message. Because an attacker must generate a finished message that depends on the pre master secret, she cannot complete the handshake protocol successfully. However, she does not have to complete it; she gets the necessary information – namely, whether her chosen message is PKCS conforming – before the protocol is finished. There are details of SSL V.3.0 that might hinder this attack if they are implemented the right way. Figure 2 shows the format of the message containing the pre master secret before the latter is encrypted with RSA. It contains the version number of the protocol, the purpose of which is to detect versionrollback attacks, in which an attacker tries to modify the hello messages such that both client and server use the compatibility mode and hence use the Version 2.0, instead of Version 3.0, protocols. One implementation that we analyzed [12] checks the version number only if the server is running in the compatibility mode, because otherwise obviously no rollback attack has occurred. A much more secure implementation would check the version number in all modes, and, if it identified a mismatch, would send back to the client the same error alert as it sends in the case of a decryption error. The result would be that a randomly generated message would be accepted with a probability of about 2−40 ; although such a protocol still could not be called secure, the attack shown in this paper would at least be impractical. The SSL documentation does not specify clearly the error conditions and corresponding alerts. As a result, different implementations of SSL do not react consistently with one another in error situations.

6

Experimental Results

We implemented the algorithm described in Section 3 and verified experimentally that this algorithm can decrypt a PKCS #1 encrypted message given access to an oracle that, for any ciphertext, indicates whether the the corresponding plaintext is PKCS conforming. We tested the algorithm with different 512-bit and 1024-bit keys. The algorithm needed between 300 thousand and 2 million chosen ciphertexts to find the message. We implemented our own version of the oracle, rather than using an existing software product. Finney checked three different SSL servers [6] to find out how carefully the servers analyze the message format and what error alerts are returned. One of the servers verified only the PKCS format. The second server checked the PKCS format, message length, and version number, but returned different message

Chosen Ciphertext Attacks Against Protocols

11

alerts, thus still allowing our attack. Only the third server checked all aspects correctly and did not leak information by sending different alerts.

7

Conclusion

We have shown a chosen-ciphertext attack that can be carried out when only partial information about the corresponding message is leaked. We conclude not only that it is important to include a strong integrity check into an RSA encryption, but also that this integrity check must be performed in the correct step of the protocol – preferably immediately after decryption. The phase between decryption and integrity check is critical, because even sending out error messages can present a security risk. We also believe that we have provided a strong argument to use plaintext-aware encryption schemes, such as the one described by Bellare and Rogaway [3]. Note that plaintext awareness implies security against chosenciphertext attacks [2,3]. In particular, Version 2 of PKCS #1, which makes use of [3], is not susceptible to the attack described in this paper. It is a good idea to have a receiver check the integrity of a message immediately after decrypting that message. Even better is to check integrity before decrypting a message, as Cramer and Shoup show is possible [4].

Acknowledgments I thank Markus Jakobsson, David M. Kristol, and Jean-Fran¸cois Misarsky, as well as the members of the program committee, for all their comments and suggestions. I am grateful for the cooperation of the people at RSA Laboratories. I thank Hal Finney for telling me about his experiments on different SSL servers. I am also grateful to Lyn Dupr´e for editing this paper.

References 1. W. Alexi, B. Chor, O. Goldreich, and P. Schnorr. Bit security of RSA and Rabin functions. SIAM Journal of computing, 17(2):194–209, Apr. 1988. 3 2. M. Bellare, A. Desai, D. Pointcheval, and P. Rogaway. Relations among notions of security for public-key encryptions schemes. In H. Krawczyk, editor, Advances in Cryptology – CRYPTO ’98, Lecture Notes in Computer Science. Springer Verlag. (in press). 11 3. M. Bellare and P. Rogaway. Optimal asymmetric encryption. In A. D. Santis, editor, Advances in Cryptology – EUROCRYPT ’94, volume 950 of Lecture Notes in Computer Science, pages 92–111, Berlin, 1995. Springer Verlag. 11, 11, 11 4. R. Cramer and V. Shoup. A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack. In H. Krawczyk, editor, Advances in Cryptology – CRYPTO ’98, Lecture Notes in Computer Science. Springer Verlag. (in press). 11 5. G. I. Davida. Chosen signature cryptanalysis of the RSA (MIT) public key cryptosystem. Technical Report TR-CS-82-2, Departement of Electrical Engineering and Computer Science, University of Wisconsin, Milwaukee, 1982. 3

12

Daniel Bleichenbacher

6. H. Finney. personal communication. 10 7. A. O. Freier, P. Karlton, and P. C. Kocher. The SSL Protocol, Version 3.0. Netscape, Mountain View, CA, 96. 9 8. S. Goldwasser, S. Micali, and P. Tong. Why and how to establish a private code on a public network. In Proc. 23rd IEEE Symp. on Foundations of Comp. Science, pages 134–144, Chicago, 1982. 3 9. J. H˚ astad and M. N¨ aslund. The security of individual RSA bits. manusrcipt, 1998. 3, 3 10. P. C. Kocher. Timing attacks on implementations of Diffie–Hellman RSA, DSS, and other systems. In N. Koblitz, editor, Advances in Cryptology – CRYPTO ’96, volume 1109 of Lecture Notes in Computer Science, pages 104–113, Berlin, 1996. Springer Verlag. 9 11. RSA Data Security, Inc. PKCS #1: RSA Encryption Standard. Redwood City, CA, Nov. 1993. Version 1.5. 2, 8 12. E. A. Young. SSLeay 0.8.1. url = http://www.cryptsoft.com/ 10

A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack Ronald Cramer1 and Victor Shoup2 1

Institute for Theoretical Computer Science, ETH Zurich, 8092 Zurich, Switzerland [email protected] 2 IBM Zurich Research Laboratory, S¨ aumerstr. 4, 8803 R¨ uschlikon, Switzerland [email protected]

Abstract. A new public key cryptosystem is proposed and analyzed. The scheme is quite practical, and is provably secure against adaptive chosen ciphertext attack under standard intractability assumptions. There appears to be no previous cryptosystem in the literature that enjoys both of these properties simultaneously.

1

Introduction

In this paper, we present and analyze a new public key cryptosystem that is provably secure against adaptive chosen ciphertext attack (as defined by Rackoff and Simon [20]). The scheme is quite practical, requiring just a few exponentiations over a group. Moreover, the proof of security relies only on a standard intractability assumption, namely, the hardness of the Diffie-Hellman decision problem in the underlying group. The hardness of the Diffie-Hellman decision problem is essentially equivalent to the semantic security of the basic El Gamal encryption scheme [12]. Thus, with just a bit more computation, we get security against adaptive chosen ciphertext attack, whereas the basic El Gamal scheme is completely insecure against adaptive chosen ciphertext attack. Actually, the basic scheme we describe also requires a universal one-way hash function. In a typical implementation, this can be efficiently constructed without extra assumptions; however, we also present a hash-free variant as well. While there are several provably secure encryption schemes in the literature, they are all quite impractical. Also, there have been several practical cryptosystems that have been proposed, but none of them have been proven secure under standard intractability assumptions. The significance of our contribution is that it provides a scheme that is provably secure and practical at the same time. There appears to be no other encryption scheme in the literature that enjoys both of these properties simultaneously. H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 13–25, 1998. c Springer-Verlag Berlin Heidelberg 1998

14

Ronald Cramer and Victor Shoup

Chosen Ciphertext Security Semantic security, defined by Goldwasser and Micali [14], captures the intuition that an adversary should not be able to obtain any partial information about a message given its encryption. However, this guarantee of secrecy is only valid when the adversary is completely passive, i.e., can only eavesdrop. Indeed, semantic security offers no guarantee of secrecy at all if an adversary can mount an active attack, i.e., inject messages into a network or otherwise influence the behavior of parties in the network. To deal with active attacks, Rackoff and Simon [20] defined the notion of security against an adaptive chosen ciphertext attack. If an adversary can inject messages into a network, these messages may be encryptions, and the adversary may be able to extract partial information about the corresponding cleartexts through its interactions with the parties in the network. Rackoff and Simon’s definition models this type of attack by simply allowing an adversary to obtain decryptions of its choice, i.e., the adversary has access to a “decryption oracle.” Now, given an encryption of a message—the “target” ciphertext—we want to guarantee that the adversary cannot obtain any partial information about the message. To achieve this, we have to restrict the adversary’s behavior in some way, otherwise the adversary could simply submit the target ciphertext itself to the decryption oracle. The restriction proposed by Rackoff and Simon is the weakest possible: the adversary is not allowed to submit the target ciphertext itself to the oracle; however, it may submit any other ciphertext, including ciphertexts that are related to the target ciphertext. A different notion of security against active attacks, called non-malleability, was proposed by Dolev, Dwork, and Naor [9]. Here, the adversary also has access to a decryption oracle, but his goal is not to obtain partial information about the target ciphertext, but rather, to create another encryption of a different message that is related in some interesting way to the original, encrypted message. For example, for a non-malleable encryption scheme, given an encryption of n, it should be infeasible to create an encryption of n + 1. It turns out that non-malleability and security against adaptive chosen ciphertext attack are equivalent [10]. A cryptosystem secure against adaptive chosen ciphertext attack is a very powerful cryptographic primitive. It is essential in designing protocols that are secure against active adversaries. For example, this primitive is used in protocols for authentication and key exchange [11,10,2] and in protocols for escrow, certified e-mail, and more general fair exchange [1,22]. The practical importance of this primitive is also highlighted by the adoption of Bellare and Rogaway’s OAEP scheme [4] (a practical but only heuristically secure scheme) as an internet encryption standard and for use in the SET protocol for electronic commerce. There are also intermediate notions of security, between semantic security and adaptive chosen ciphertext security. Naor and Yung [19] propose an attack model where the adversary has access to the decryption oracle only prior to obtaining the target ciphertext, and the goal of the adversary is to obtain partial information about the encrypted message. Naor and Yung called this type

A Practical Public Key Cryptosystem Provably Secure

15

of attack a chosen ciphertext attack; it has also been called a “lunch-time” or “midnight” attack. In this paper, we will always use the phrase adaptive chosen ciphertext attack for Rackoff and Simon’s definition, to distinguish it from Naor and Yung’s definition.

Previous Work Provably Secure Schemes. Naor and Yung [19] presented the first scheme provably secure against lunch-time attacks. Subsequently, Dolev, Dwork, and Naor [9] presented a scheme that is provably secure against adaptive chosen ciphertext attack. All of the previously known schemes provably secure under standard intractability assumptions are completely impractical (albeit polynomial time), as they rely on general and expensive constructions for non-interactive zeroknowledge proofs. Practical Schemes. Damgard [8] proposed a practical scheme that he conjectured to be secure against lunch-time attacks; however, this scheme is not known to be provably secure, and is in fact demonstrably insecure against adaptive chosen ciphertext attack. Zheng and Seberry [24] proposed practical schemes that are conjectured to be secure against chosen ciphertext attack, but again, no proof based on standard intractability assumptions is known. Lim and Lee [16] also proposed practical schemes that were later broken by Frankel and Yung [13]. Bellare and Rogaway [3,4] have presented practical schemes for which they give heuristic proofs of adaptive chosen ciphertext security; namely, they prove security in an idealized model of computation, the so-called random oracle model, wherein a hash function is represented by a random oracle. Shoup and Gennaro [22] also give El Gamal-like schemes that are secure against adaptive chosen ciphertext attack in the random oracle model, and that are also amenable to efficient threshold decryption. We stress that although a security proof in the random oracle model is of some value, it is still only a heuristic proof. In particular, these types of proofs do not rule out the possibility of breaking the scheme without breaking the underlying intractability assumption. Nor do they even rule out the possibility of breaking the scheme without finding some kind of weakness in the hash function, as recently shown by Canetti, Goldreich, and Halevi [7].

Outline of paper In §2 we review the basic definitions that we need for security and intractability assumptions. In §3 we outline our basic scheme, and in §4 we prove its security. In §5 we discuss some implementation details and variations on the basic scheme.

16

2 2.1

Ronald Cramer and Victor Shoup

Definitions Security Against Adaptive Chosen Ciphertext Attack

We recall Rackoff and Simon’s definition. Security is defined via the following game played by the adversary. First, the encryption scheme’s key generation algorithm is run, with a security parameter as input. Next, the adversary makes arbitrary queries to a “decryption oracle,” decrypting ciphertexts of his choice. Next the adversary chooses two messages, m0 , m1 , and sends these to an “encryption oracle.” The encryption oracle chooses a bit b ∈ {0, 1} at random, and encrypts mb . The corresponding ciphertext is given to the adversary (the internal coin tosses of the encryption oracle, in particular b, are not in the adversary’s view). After receiving the ciphertext from the encryption oracle, the adversary continues to query the decryption oracle, subject only to the restriction that the query must be different than the output of the encryption oracle. At the end of the game, the adversary outputs b0 ∈ {0, 1}, which is supposed to be the adversary’s guess of the value b. If the probability that b0 = b is 1/2 + , then the adversary’s advantage is defined to be . The cryptosystem is said to be secure against adaptive chosen ciphertext attack if the advantage of any polynomial-time adversary is negligible (as a function of the security parameter). 2.2

The Diffie-Hellman Decision Problem

There are several equivalent formulations of the Diffie-Hellman decision problem. The one that we shall use is the following. Let G be a group of large prime order q, and consider the following two distributions: – the distribution R of random quadruples (g1 , g2 , u1 , u2 ) ∈ G4 ; – the distribution D of quadruples (g1 , g2 , u1 , u2 ) ∈ G4 , where g1 , g2 are random, and u1 = g1r and u2 = g2r for random r ∈ Zq . An algorithm that solves the Diffie-Hellman decision problem is a statistical test that can effectively distinguish these two distributions. That is, given a quadruple coming from one of the two distributions, it should output 0 or 1, and there should be a non-negligible difference between (a) the probability that it outputs a 1 given an input from R, and (b) the probability that it outputs a 1 given an input from D. The Diffie-Hellman decision problem is hard if there is no such polynomial-time statistical test. This formulation of the Diffie-Hellman decision problem is equivalent to several others. First, making the substitution g1 → g, g2 → g x , u1 → g y , u2 → g xy ,

A Practical Public Key Cryptosystem Provably Secure

17

one sees that this is equivalent to distinguishing Diffie-Hellman triples (g x , g y , g xy ) from non-Diffie-Hellman triples (g x , g y , g z ). Note that by a trivial random self-reducibility property, it does not matter if the base g is random or fixed. Second, although we have described it as a problem of distinguishing two distributions, the Diffie-Hellman decision problem is equivalent to the worst-case decision problem: given (g x , g y , g z ), decide—with negligible error probability— if z = xy mod q. This equivalence follows immediately from a random selfreducibility property first observed by Stadler [23] and later by Naor and Reingold [17]. Related to the Diffie-Hellman decision problem is the Diffie-Hellman problem (given g, g x and g y , compute g xy ), and the discrete logarithm problem (given g and g x , compute x). There are obvious polynomial-time reductions from the Diffie-Hellman decision problem to the Diffie-Hellman problem, and from the Diffie-Hellman problem to the discrete logarithm problem, but reductions in the reverse direction are not known. Moreover, these reductions are essentially the only known methods of solving the Diffie-Hellman or Diffie-Hellman decision problems. All three problems are widely conjectured to be hard, and have been used as assumptions in proving the security of a variety of cryptographic protocols. Some heuristic evidence for the hardness of all of these problems is provided in [21], where it is shown that they are hard in a certain natural, structured model of computation. See [23,17,6] for further applications and discussion of the Diffie-Hellman decision problem. Note that the hardness of the Diffie-Hellman decision problem is equivalent to the semantic security of the basic El Gamal encryption scheme. Recall that in the basic El Gamal scheme, we encrypt a message m ∈ G as (g r , hr m), where h is the public key of the recipient. On the one hand, if the Diffie-Hellman decision problem is hard, then the group element hr could be replaced by a random group element without changing significantly the behavior of the attacker; however, if we perform this substitution, the message m is perfectly hidden, which implies security. On the other hand, if the Diffie-Hellman decision problem can be efficiently solved, then an attacker can break El Gamal as follows. The attacker chooses two messages m0 , m1 , giving these to an encryption oracle. The encryption oracle produces an encryption (u, e) = (g r , hr mb ), where b ∈ {0, 1} is chosen at random. The attacker’s task is to determine b, which he can do by simply determining which of (u, h, e/m0 ) and (u, h, e/m1 ) is a Diffie-Hellman triple. Note that the basic El Gamal scheme is completely insecure against adaptive chosen ciphertext attack. Indeed, given an encryption (u, e) of a message m, we can feed the (u, g · e) to the decryption oracle, which gives us g · m.

18

2.3

Ronald Cramer and Victor Shoup

Collision-Resistant Hash Functions

A family of hash functions is said to be collision resistant if upon drawing a function H at random from the family, it is infeasible for an adversary to find two different inputs x and y such that H(x) = H(y). A weaker notion is that of a universal one-way family of hash functions [18]. Here, it should be infeasible for an adversary to choose an input x, draw a random hash function H, and then find a different input y such that H(x) = H(y). Such hash function families are also called target collision resistant. See [5] for recent results and further discussion.

3

The Basic Scheme

We assume that we have a group G of prime order q, where q is large. We also assume that cleartext messages are (or can be encoded as) elements of G (although this condition can be relaxed—see §5.2). We also use a universal one-way family of hash functions that map long bit strings to elements of Zq (although we can do without this—see §5.3). Key Generation. The key generation algorithm runs as follows. Random elements g1 , g2 ∈ G are chosen, and random elements x1 , x2 , y1 , y2 , z ∈ Zq are also chosen. Next, the group elements c = g1x1 g2x2 , d = g1y1 g2y2 , h = g1z are computed. Next, a hash function H is chosen from the family of universal one-way hash functions. The public key is (g1 , g2 , c, d, h, H), and the private key is (x1 , x2 , y1 , y2 , z). Encryption. Given a message m ∈ G, the encryption algorithm runs as follows. First, it chooses r ∈ Zq at random. Then it computes u1 = g1r , u2 = g2r , e = hr m, α = H(u1 , u2 , e), v = cr drα . The ciphertext is (u1 , u2 , e, v). Decryption. Given a ciphertext (u1 , u2 , e, v), the decryption algorithm runs as follows. It first computes α = H(u1 , u2 , e), and tests if u1x1 +y1 α u2x2 +y2 α = v. If this condition does not hold, the decryption algorithm outputs “reject”; otherwise, it outputs m = e/uz1 .

A Practical Public Key Cryptosystem Provably Secure

19

We first verify that this is an encryption scheme, in the sense that the decryption of an encryption of a message yields the message. Since u1 = g1r and u2 = g2r , we have ux1 1 ux2 2 = g1rx1 g2rx2 = cr . Likewise, uy11 uy22 = dr and uz1 = hr Therefore, the test performed by the decryption algorithm will pass, and the output will be e/hr = m.

4

Proof of Security

In this section, we prove the following theorem. Theorem 1. The above cryptosystem is secure against adaptive chosen ciphertext attack assuming that (1) the hash function H is chosen from a universal one-way family, and (2) the Diffie-Hellman decision problem is hard in the group G. To prove the theorem, we will assume that there is an adversary that can break the cryptosystem, and that the hash family is universal one-way, and show how to use this adversary to construct a statistical test for the Diffie-Hellman decision problem. For the statistical test, we are given (g1 , g2 , u1 , u2 ) coming from either the distribution R or D. At a high level, our construction works as follows. We build a simulator that simulates the joint distribution consisting of adversary’s view in its attack on the cryptosystem, and the hidden bit b generated by the generated oracle (which is not a part of the adversary’s view). We will show that if the input comes from D, the simulation will be nearly perfect, and so the adversary will have a non-negligible advantage in guessing the hidden bit b. We will also show that if the input comes from R, then the adversary’s view is essentially independent of b, and therefore the adversary’s advantage is negligible. This immediately implies a statistical test distinguishing R from D: run the simulator and adversary together, and if the simulator outputs b and the adversary outputs b0 , the distinguisher outputs 1 if b = b0 , and 0 otherwise. We now give the details of the simulator. The input to the simulator is (g1 , g2 , u1 , u2 ). The simulator runs the following key generation algorithm, using the given g1 , g2 . The simulator chooses x1 , x2 , y1 , y2 , z1 , z2 ∈ Zq at random, and computes c = g1x1 g2x2 , d = g1y1 g2y2 , h = g1z1 g2z2 . The simulator also chooses a hash function H at random. The public key that the adversary sees is (g1 , g2 , c, d, h, H). The simulator knows (x1 , x2 , y1 , y2 , z1 , z2 ).

20

Ronald Cramer and Victor Shoup

Note that the simulator’s key generation algorithm is slightly different from the key generation algorithm of the actual cryptosystem; in the latter, we essentially fix z2 = 0. The simulator answers decryption queries as in the actual attack, except that it computes m = e/(uz11 uz22 ). We now describe the simulation of the encryption oracle. Given m0 , m1 , the simulator chooses b ∈ {0, 1} at random, and computes e = uz11 uz22 mb , α = H(u1 , u2 , e), v = u1x1 +y1 α u2x2 +y2 α , and outputs (u1 , u2 , e, v). That completes the description of the simulator. As we will see, when the input to the simulator comes from D, the output of the encryption oracle is a perfectly legitimate ciphertext; however, when the input to the simulator comes from R, the output of the decryption oracle will not be legitimate, in the sense that logg1 u1 6= logg2 u2 . This is not a problem, and indeed, it is crucial to the proof of security. The theorem now follows immediately from the following two lemmas. Lemma 1. When the simulator’s input comes from D, the joint distribution of the adversary’s view and the hidden bit b is is statistically indistinguishable from that in the actual attack. Consider the joint distribution of the adversary’s view and the bit b when the input comes from the distribution D. Say u1 = g1r and u2 = g2r . It is clear in this case that the output of the encryption oracle has the right distribution, since ux1 1 ux2 2 = cr , uy11 uy22 = dr , and uz11 uz22 = hr ; indeed, these equations imply that e = mb hr and v = cr drα , and α itself is already of the right form. To complete the proof, we need to argue that the output of the decryption oracle has the right distribution. Let us call (u01 , u02 , e0 , v 0 ) ∈ G4 a valid ciphertext if logg1 u01 = logg2 u02 . 0 0 0 Note that if a ciphertext is valid, with u01 = g1r and u02 = g2r , then hr = 0 (u01 )z1 (u02 )z2 ; therefore, the decryption oracle outputs e/hr , just as it should. Consequently, the lemma follows immediately from the following: Claim. The decryption oracle—in both an actual attack against the cryptosystem and in an attack against the simulator—rejects all invalid ciphertexts, except with negligible probability. We now prove this claim by considering the distribution of the point P = (x1 , x2 , y1 , y2 ) ∈ Z4q , conditioned on the adversary’s view. Let log(·) denote logg1 (·), and let w = log g2 . ¿From the adversary’s view, P is a random point on the plane P formed by intersecting the hyperplanes log c = x1 + wx2

(1)

A Practical Public Key Cryptosystem Provably Secure

21

and log d = y1 + wy2 .

(2)

These two equations come from the public key. The output from the encryption oracle does not constrain P any further, as the hyperplane defined by log v = rx1 + wrx2 + αry1 + αrwy2

(3)

contains P. Now suppose the adversary submits an invalid ciphertext (u01 , u02 , v 0 , e0 ) to the decryption oracle, where log u01 = r10 and log u02 = wr20 , with r10 6= r20 . The decryption oracle will reject, unless P happens to lie on the hyperplane H defined by log v 0 = r10 x1 + wr20 x2 + α0 r10 y1 + α0 r20 wy2 , (4) where α0 = H(u01 , u02 , e0 ). But it is clear that the equations (1), (2), and (4) are linearly independent, and so H intersects the plane P at a line. It follows that the first time the adversary submits an invalid ciphertext, the decryption oracle rejects with probability 1 − 1/q. This rejection actually constrains the point P, puncturing the plane H at a line. Therefore, for i = 1, 2, . . ., the ith invalid ciphertext submitted by the adversary will be rejected with probability at least 1−1/(q−i+1). ¿From this it follows that the decryption oracle rejects all invalid ciphertexts, except with negligible probability. Lemma 2. When the simulator’s input comes from R, the distribution of the hidden bit b is (essentially) independent from the adversary’s view. Let u1 = g1r1 and u2 = g1wr2 . We may assume that r1 6= r2 , since this occurs except with negligible probability. The lemma follows immediately from the following two claims. Claim 1. If the decryption oracle rejects all invalid ciphertexts during the attack, then the distribution of the hidden bit b is independent of the adversary’s view. To see this, consider the point Q = (z1 , z2 ) ∈ Z2q . At the beginning of the attack, this is a random point on the line log h = z1 + wz2 ,

(5)

determined by the public key. Moreover, if the decryption oracle only decrypts valid ciphertexts (u01 , u02 , e0 , v 0 ), then the adversary obtains only linearly depen0 0 0 dent relations r0 log h = r0 z1 + r0 wz2 (since (u01 )z1 (u02 )z2 = g1r z1 g2r z2 = hr ). Thus, no further information about Q is leaked. Consider now the output (u1 , u2 , e, v) of the simulator’s encryption oracle. We have e =  · mb , where  = uz11 uz22 . Now, consider the equation log  = r1 z1 + wr2 z2 .

(6)

Clearly, (5) and (6) are linearly independent, and so the conditional distribution of —conditioning on b and everything in the adversary’s view other than e— is uniform. In other words,  is a perfect one-time pad. It follows that b is independent of the adversary’s view.

22

Ronald Cramer and Victor Shoup

Claim 2. The decryption oracle will reject all invalid ciphertexts, except with negligible probability. As in the proof of Lemma 1, we study the distribution of P = (x1 , x2 , y1 , y2 ) ∈ Z4q , conditioned on the adversary’s view. ¿From the adversary’s view, this is a random point on the line L formed by intersecting the hyperplanes (1), (2), and log v = r1 x1 + wr2 x2 + αr1 y1 + αwr2 y2 .

(7)

Equation (7) comes from the output of the encryption oracle. Now assume that the adversary submits an invalid ciphertext (u01 , u02 , e0 , v 0 ) 6= (u1 , u2 , e, v), where log u01 = r10 and log u02 = wr20 , with r10 6= r20 . Let α0 = H(u01 , u02 , e0 ). There are three cases we consider. Case 1. (u01 , u02 , e0 ) = (u1 , u2 , e). In this case, the hash values are the same, but v 0 6= v implies that the decryption oracle will certainly reject. Case 2. (u01 , u02 , e0 ) 6= (u1 , u2 , e) and α0 6= α. The decryption oracle will reject unless the point P lies on the hyperplane H defined by (4). However, the equations (1), (2), (7), and (4) are linearly independent. This can be verified by observing that   1 w 0 0 0 0 1  w 2 0 0 0  det   r1 wr2 αr1 αwr2  = w (r2 − r1 )(r2 − r1 )(α − α ) 6= 0. r10 wr20 α0 r10 α0 wr20 Thus, H intersects the line L at a point, from which it follows (as in the proof of Lemma 1) that the decryption oracle rejects, except with negligible probability. Case 3. (u01 , u02 , e0 ) 6= (u1 , u2 , e) and α0 = α. We argue that if this happens with nonnegligible probability, then in fact, the family of hash functions is not universal one-way—a contradiction. Note that if we made the stronger assumption of collision resistance, there would be essentially nothing to prove, but with the weaker universal one-way assumption, an argument is needed. We use the adversary to break the universal one-way hash function as follows. We modify the encryption oracle in the simulator, so that it outputs (u1 , u2 , e, v) as before, except that now, e ∈ G is simply chosen completely at random. Up until such time that a collision occurs, the adversary’s view in this modified simulation is statistically indistinguishable from the view in the original simulation, and so the adversary will also find a collision with nonnegligible probability in the modified simulation. But the argument (u1 , u2 , e) to H is independent of H, and in particular, we can choose it before choosing H.

5

Implementation Details and Variations

In this section, we briefly discuss some implementation details and possible variations of the basic encryption scheme.

A Practical Public Key Cryptosystem Provably Secure

5.1

23

A Simple Implementation

We choose a large prime p such that p − 1 = 2q, where q is also prime. The group G is the subgroup of order q in Z∗p . We restrict a message to be an element of the set {1, . . . , q}, and “encode” it by squaring it modulo p, giving us an element in G. We can recover a message from its encoding by computing the unique square root of its encoding modulo p that is in the set {1, . . . , q}. For the hash function, one could use a function like SHA-1, or possibly some keyed variant, and make the appropriate collision-resistance assumption. However, it is only marginally more expensive to do the following, which is based only on the hardness of discrete logarithms in G. Say we want to hash a bit string to an integer mod q. Write the bit string as a sequence (a1 , . . . , ak ), with each ai ∈ {0, . . . , q − 1}. To define the hash function, choose h1 , . . . , hk in G at random. The hash of (a1 , . . . , ak ) is then the least non-negative residue of ±ha1 1 · · · hakk ∈ Z∗p , where the sign is chosen so that this value is in {1, . . . , q}. This hash function is collision resistant, provided computing discrete logarithms in G is hard. To see this, note that from a collision, we obtain a nonzero sequence (a1 , . . . , ak ) mod q such that ha1 1 · · · hakk ∈ {1, −1} ∩ G = {1}. Using a standard argument, it is easy to see that finding such a relation is equivalent to computing discrete logarithms. Note that the group elements g1 , g2 and h1 , . . . , hk can be system-wide parameters, used by all users of the system. 5.2

A Hybrid Implementation

It would be more practical to work in a smaller subgroup, and it would be nice to have a more flexible and efficient way to encode messages. To do this, assume we have a symmetric-key cipher C with a key length of l bits. Now choose a large prime p such that p − 1 = qm, where q is a 3l-bit prime. The group G is the subgroup of order q in Z∗p . A message in this scheme is just an arbitrary bit string. To encrypt a message m, we modify our encryption algorithm, computing e = CK (m), where the encryption key K is computed by hashing hr to an l-bit string with a public 2-universal hash function. For the hash function H used in the encryption scheme, something like SHA-1, possibly keyed, would be appropriate. The security of this variant is easily proved using the techniques of this paper, along with the left-over hash lemma [15], assuming the cipher C is semantically secure. 5.3

A Hash-Free Variant

We can actually eliminate the hash function H from the scheme, so that the security can be based strictly on the Diffie-Hellman decision problem for an

24

Ronald Cramer and Victor Shoup

arbitrary group G. Suppose the strings we need to hash in the original scheme are of the form (a1 , . . . , ak ), where 0 ≤ ai < p. In the modified scheme, we replace the group element d in the public key by d1 , . . . , dk . For 1 ≤ i ≤ k, we have di = g1yi1 g2yi2 , where yi1 and yi2 are random elements of Zq included in the secret key. When encrypting, we compute v = cr

k Y

dai i r ,

i=1

and when decrypting, we verify that Pk Pk x1 + ai yi1 x2 + ai yi2 i=1 i=1 u2 . v = u1 Using the same proof techniques as for the basic scheme, it is straightforward to prove that this modified version is secure against adaptive chosen ciphertext attack, assuming the Diffie-Hellman decision problem in G is hard. 5.4

A “lite” Version Secure Against Lunch-Time Attacks

To achieve security against lunch-time attacks only, one can simplify the basic scheme significantly, essentially by eliminating d, y1 , y2 , and the hash function H. When encrypting, we compute v = cr , and when decrypting, we verify that v = ux1 1 ux2 2 .

Acknowledgments We would like to thank Moni Naor for his very useful comments on an earlier draft of this paper, and in particular, for pointing out that a universal one-way hash function is sufficient to prove the security of our basic scheme, and for suggesting the hash-free variant in §5.3.

References 1. N. Asokan, V. Shoup, and M. Waidner. Optimistic fair exchange of digital signatures. In Advances in Cryptology–Eurocrypt ’98, 1998. 14 2. M. Bellare, R. Canetti, and H. Krawczyk. A modular approach to the design and analysis of authentication and key exchange protocols. In 30th Annual ACM Symposium on Theory of Computing, 1998. 14 3. M. Bellare and P. Rogaway. Random oracles are practical: a paradigm for designing efficient protocols. In First ACM Conference on Computer and Communications Security, pages 62–73, 1993. 15 4. M. Bellare and P. Rogaway. Optimal asymmetric encryption. In Advances in Cryptology—Crypto ’94, pages 92–111, 1994. 14, 15 5. M. Bellare and P. Rogaway. Collision-resistant hashing: towards making UOWHFs practical. In Advances in Cryptology–Crypto ’97, 1997. 18

A Practical Public Key Cryptosystem Provably Secure

25

6. D. Boneh and R. Venkatesan. Hardness of computing the most significant bits of secret keys in Diffie-Hellman and related schemes. In Advances in Cryptology– Crypto ’96, pages 129–142, 1996. 17 7. R. Canetti, O. Goldreich, and S. Halevi. The random oracle model, revisted. In 30th Annual ACM Symposium on Theory of Computing, 1998. To appear. 15 8. I. Damgard. Towards practical public key cryptosystems secure against chosen ciphertext attacks. In Advances in Cryptology–Crypto ’91, pages 445–456, 1991. 15 9. D. Dolev, C. Dwork, and M. Naor. Non-malleable cryptography. In 23rd Annual ACM Symposium on Theory of Computing, pages 542–552, 1991. 14, 15 10. D. Dolev, C. Dwork, and M. Naor. Non-malleable cryptography, 1998. Manuscript (updated, full length version of STOC paper). 14, 14 11. C. Dwork and M. Naor. Method for message authentication from non-malleable cryptosystems, 1996. U. S. Patent No. 05539826. 14 12. T. El Gamal. A public key cryptosystem and signature scheme based on discrete logarithms. IEEE Trans. Inform. Theory, 31:469–472, 1985. 13 13. Y. Frankel and M. Yung. Cryptanalysis of immunized LL public key systems. In Advances in Cryptology–Crypto ’95, pages 287–296, 1995. 15 14. S. Goldwasser and S. Micali. Probabilistic encryption. Journal of Computer and System Sciences, 28:270–299, 1984. 14 15. R. Impagliazzo, L. Levin, and M. Luby. Pseudo-random number generation from any one-way function. In 21st Annual ACM Symposium on Theory of Computing, pages 12–24, 1989. 23 16. C. H. Lim and P. J. Lee. Another method for attaining security against adaptively chosen ciphertext attacks. In Advances in Cryptology–Crypto ’93, pages 420–434, 1993. 15 17. M. Naor and O. Reingold. Number-theoretic constructions of efficient pseudorandom functions. In 38th Annual Symposium on Foundations of Computer Science, 1997. 17, 17 18. M. Naor and M. Yung. Universal one-way hash functions and their cryptographic applications. In 21st Annual ACM Symposium on Theory of Computing, 1989. 18 19. M. Naor and M. Yung. Public-key cryptosystems provably secure against chosen ciphertext attacks. In 22nd Annual ACM Symposium on Theory of Computing, pages 427–437, 1990. 14, 15 20. C. Rackoff and D. Simon. Noninteractive zero-knowledge proof of knowledge and chosen ciphertext attack. In Advances in Cryptology–Crypto ’91, pages 433–444, 1991. 13, 14 21. V. Shoup. Lower bounds for discrete logarithms and related problems. In Advances in Cryptology–Eurocrypt ’97, 1997. 17 22. V. Shoup and R. Gennaro. Securing threshold cryptosystems against chosen ciphertext attack. In Advances in Cryptology–Eurocrypt ’98, 1998. 14, 15 23. M. Stadler. Publicly verifiable secrete sharing. In Advances in Cryptology– Eurocrypt ’96, pages 190–199, 1996. 17, 17 24. Y. Zheng and J. Seberry. Practical approaches to attaining security against adaptively chosen ciphertext attacks. In Advances in Cryptology–Crypto ’92, pages 292–304, 1992. 15

Relations Among Notions of Security for Public-Key Encryption Schemes Mihir Bellare1 , Anand Desai1 , David Pointcheval2 , and Phillip Rogaway3 1

Dept. of Computer Science & Engineering, University of California at San Diego, 9500 Gilman Drive, La Jolla, CA 92093, USA. {mihir,adesai}@cs.ucsd.edu URL: http://www-cse.ucsd.edu/users/{mihir,adesai} 2 ´ Laboratoire d’Informatique de l’Ecole Normale Sup´erieure, 75005 Paris, France, and GREYC, D´ept d’Informatique, Universit´e de Caen, 14032 Caen Cedex, France. [email protected] URL: http://www.dmi.ens.fr/~pointche/ 3 Dept. of Computer Science, Engineering II Bldg., University of California at Davis, Davis, CA 95616, USA. [email protected] URL: http://www.cs.ucdavis.edu/~rogaway/

Abstract. We compare the relative strengths of popular notions of security for public key encryption schemes. We consider the goals of privacy and non-malleability, each under chosen plaintext attack and two kinds of chosen ciphertext attack. For each of the resulting pairs of definitions we prove either an implication (every scheme meeting one notion must meet the other) or a separation (there is a scheme meeting one notion but not the other, assuming the first notion can be met at all). We similarly treat plaintext awareness, a notion of security in the random oracle model. An additional contribution of this paper is a new definition of non-malleability which we believe is simpler than the previous one. Keywords: Asymmetric encryption, Chosen ciphertext security, Nonmalleability, Rackoff-Simon attack, Plaintext awareness, Relations among definitions.

1

Introduction

In this paper we compare the relative strengths of various notions of security for public key encryption. We want to understand which definitions of security imply which others. We start by sorting out some of the notions we will consider. 1.1

Notions of Encryption Scheme Security

A convenient way to organize definitions of secure encryption is by considering separately the various possible goals and the various possible attack models, and then obtain each definition as a pairing of a particular goal and a particular attack model. This viewpoint was suggested to us by Moni Naor [22]. H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 26–46, 1998. c Springer-Verlag Berlin Heidelberg 1998

Relations Among Notions of Security for Public-Key Encryption Schemes

27

We consider two different goals: indistinguishability of encryptions, due to Goldwasser and Micali [17], and non-malleability, due to Dolev, Dwork and Naor [11]. Indistinguishability (IND) formalizes an adversary’s inability to learn any information about the plaintext x underlying a challenge ciphertext y, capturing a strong notion of privacy. Non-malleability (NM) formalizes an adversary’s inability, given a challenge ciphertext y, to output a different ciphertext y 0 such that the plaintexts x, x0 underlying these two ciphertexts are “meaningfully related”. (For example, x0 = x + 1.) It captures a sense in which ciphertexts can be tamper-proof. Along the other axis we consider three different attacks. In order of increasing strength these are chosen plaintext attack (CPA), non-adaptive chosen ciphertext attack (CCA1), and adaptive chosen ciphertext attack (CCA2). Under CPA the adversary can obtain ciphertexts of plaintexts of her choice. In the public key setting, giving the adversary the public key suffices to capture these attacks. Under CCA1, formalized by Naor and Yung [23], the adversary gets, in addition to the public key, access to an oracle for the decryption function. The adversary may use this decryption function only for the period of time preceding her being given the challenge ciphertext y. (The term non-adaptive refers to the fact that queries to the decryption oracle cannot depend on the challenge y. Colloquially this attack has also been called a “lunchtime,” “lunch-break,” or “midnight” attack.) Under CCA2, due to Rackoff and Simon [24], the adversary again gets (in addition to the public key) access to an oracle for the decryption function, but this time she may use this decryption function even on ciphertexts chosen after obtaining the challenge ciphertext y, the only restriction being that the adversary may not ask for the decryption of y itself. (The attack is called adaptive because queries to the decryption oracle can depend on the challenge y.) As a mnemonic for the abbreviations CCA1 / CCA2, just remember that the bigger number goes with the stronger attack. One can “mix-and-match” the goals {IND, NM} and attacks {CPA, CCA1, CCA2} in any combination, giving rise to six notions of security: IND-CPA, IND-CCA1, IND-CCA2, NM-CPA, NM-CCA1, NM-CCA2 . Most are familiar (although under different names). IND-CPA is the notion of [17];1 IND-CCA1 is the notion of [23]; IND-CCA2 is the notion of [24]; NM-CPA, NM-CCA1 and NM-CCA2 are from [11,12,13]. 1.2

Implications and Separations

In this paper we work out the relations between the above six notions. For each pair of notions A, B ∈ { IND-CPA, IND-CCA1, IND-CCA2, NM-CPA, NM-CCA1, NM-CCA2 }, we show one of the following: – A ⇒ B: A proof that if Π is any encryption scheme meeting notion of security A then Π also meets notion of security B. 1

Goldwasser and Micali referred to IND-CPA as polynomial security, and also showed this was equivalent to another notion, semantic security.

28

Mihir Bellare et al.

 NM-CCA1  PP P iP PP PP P P 1 4 PPPPPP 3 1 PP PP PP q PP ? ?  IND-CPA IND-CCA1  NM-CPA

5



-

NM-CCA2

6 1

2

? IND-CCA2

Fig. 1. An arrow is an implication, and in the directed graph given by the arrows, there is a path from A to B if and only A ⇒ B. The hatched arrows represent separations we actually prove; all others follow automatically. The number on an arrow or hatched arrow refers to the theorem in this paper which establishes this relationship. – A 6⇒ B: A construction of an encryption scheme Π that provably meets notion of security A but provably does not meet notion of security B.2 We call a result of the first type an implication, and a result of the second type a separation. For each pair of notions we provide one or the other, so that no relation remains open. These results are represented diagrammatically in Figure 1. The (unhatched) arrows represent implications that are proven or trivial, and the hatched arrows represent explicitly proven separations. Specifically, the non-trivial implication is that IND-CCA2 implies NM-CCA2, and the separations shown are that IND-CCA1 does not imply NM-CPA; nor does NM-CPA imply IND-CCA1; nor does NM-CCA1 imply NM-CCA2. Figure 1 represents a complete picture of relations in the following sense. View the picture as a graph, the edges being those given by the (unhatched) arrows. (So there are eight edges.) We claim that for any pair of notions A, B, it is the case that A implies B if and only if there is a path from A to B in the graph. The “if” part of this claim is of course clear from the definition of implication. The “only if” part of this claim can be verified for any pair of notions by utilizing the hatched and unhatched arrows. For example, we claim that IND-CCA1 does not imply IND-CCA2. For if we had that IND-CCA1 implies IND-CCA2 then this, coupled with NM-CCA1 implying IND-CCA1 and IND-CCA2 implying NM-CCA2, would give NM-CCA1 implying NM-CCA2, which we know to be false. That IND-CCA2 implies all of the other notions helps bolster the view that adaptive CCA is the “right” version of CCA on which to focus. (IND-CCA2 has already proven to be a better tool for protocol design.) We thus suggest that, in the future, “CCA” should be understood to mean adaptive CCA. 2

This will be done under the assumption that there exists some scheme meeting notion A, since otherwise the question is vacuous. This (minimal) assumption is the only one made.

Relations Among Notions of Security for Public-Key Encryption Schemes

1.3

29

Plaintext Awareness

Another adversarial goal we will consider is plaintext awareness (PA), first defined by Bellare and Rogaway [4]. PA formalizes an adversary’s inability to create a ciphertext y without “knowing” its underlying plaintext x. (In the case that the adversary creates an “invalid” ciphertext what she should know is that the ciphertext is invalid.) So far, plaintext awareness has only been defined in the random oracle (RO) model. Recall that in the RO model one embellishes the customary model of computation by providing all parties (good and bad alike) with a random function H from strings to strings. See [3] for a description of the random oracle model and a discussion of its use. The six notions of security we have described can be easily “lifted” to the RO model, giving six corresponding definitions. Once one makes such definitional analogs it is easily verified that all of the implications and separations mentioned in Section 1.2 and indicated in Figure 1 also hold in the RO setting. For example, the RO version of IND-CCA2 implies the RO version of NM-CCA2. Since PA has only been defined in the RO model it only makes sense to compare PA with other RO notions. Our results in this vein are as follows. Theorem 6 shows that PA (together with the RO version of IND-CPA) implies the RO version of IND-CCA2. In the other direction, Theorem 7 shows that the RO version of IND-CCA2 does not imply PA. 1.4

Definitional Contributions

Beyond the implications and separations we have described, we have two definitional contributions: a new definition of non-malleability, and a refinement to the definition of plaintext awareness. The original definition of non-malleability [11,12,13] is in terms of simulation, requiring, for every adversary, the existence of some appropriate simulator. We believe our formulation is simpler. It is defined via an experiment involving only the adversary; there is no simulator. Nonetheless, it does not lose strength: Theorem 8 (due to [5]) says that our definition implies that of [12,13] under any form of attack. The definitions are not known to be equivalent because the other direction is open. See Appendix A. We stress that the results in this paper are not affected by the definitional change; they hold under either definition. We view the new definition as an additional, orthogonal contribution which could simplify the task of working with non-malleability. We also note that our definitional idea lifts to other settings, like defining semantic security [17] against chosen ciphertext attacks. (Semantic security seems not to have been defined against CCA.) With regard to plaintext awareness, we make a small but important refinement to the definition of [4]. The change allows us to substantiate their claim that plaintext awareness implies chosen ciphertext security and non-malleability, by giving us that PA (plus IND-CPA) implies the RO versions of IND-CCA2 and NM-CCA2. Our refinement is to endow the adversary with an encryption oracle, the queries to which are not given to the extractor. See Section 4.

30

Mihir Bellare et al.

1.5 Motivation In recent years there has been an increasing role played by public key encryption schemes which meet notions of security beyond IND-CPA. We are realizing that one of their most important uses is as tools for designing higher level protocols. For example, encryption schemes meeting IND-CCA2 appear to be the right tools in the design of authenticated key exchange protocols in the public-key setting [1]. As another example, the designers of SET (Secure Electronic Transactions) selected an encryption scheme which achieves more than IND-CPA [25]. This was necessary, insofar as the SET protocols would be wrong if instantiated by a primitive which achieves only IND-CPA security. Because encryption schemes which achieve more than IND-CPA make for easier-to-use (or harder-to-misuse) tools, emerging standards rightly favor them. We comment that if one takes the CCA models “too literally” the attacks we describe seem rather artificial. Take adaptive CCA, for example. How could an adversary have access to a decryption oracle, yet be forbidden to use it on the one point she really cares about? Either she has the oracle and can use it as she likes, or she does not have it at all. Yet, in fact, just such a setting effectively arises when encryption is used in session key exchange protocols. In general, one should not view the definitional scenarios we consider too literally, but rather understand that these are the right notions for schemes to meet when these schemes are to become generally-useful tools in the design of high level protocols. 1.6 Related Work and Discussion The most recent version of the work of Dolev, Dwork and Naor (the manuscript [13]) has, independently of our work, considered the question of relations between notions of encryption, and contains (currently in Remark 3.6) various claims that overlap to some extent with ours. (Public versions of their work, namely the 1991 proceedings version [11] and the 1995 technical report [12], do not contain these claims.) It is not the purpose of this paper to discuss specific schemes designed for meeting any of the notions of security described in this paper. Nonetheless, as a snapshot of the state of the art, we attempt to summarize what is known about meeting “beyond IND-CPA” notions of security. Schemes proven secure under standard assumptions include that of [23], which meets IND-CCA1, that of [11], which meets IND-CCA2, and the much more efficient recent scheme of Cramer and Shoup [8], which also meets IND-CCA2. Next are the schemes proven secure in a random oracle model; here we have those of [3,4], which meet PA and are as efficient as schemes in current standards. Then there are schemes without proofs, such as those of [9,26]. Finally, there are schemes for non-standard models, like [15,24]. It follows from our results that the above mentioned scheme of [8], shown to meet IND-CCA2, also meets NM-CCA2, and in particular is non-malleable under all three forms of attack. Bleichenbacher [6] has recently shown that a popular encryption scheme, RSA PKCS #1, does not achieve IND-CCA1.

Relations Among Notions of Security for Public-Key Encryption Schemes

31

We comment that non-malleability is a general notion that applies to primitives other than encryption [11]. Our discussion is limited to its use in asymmetric encryption. Similarly, chosen ciphertext attack applies to both the symmetric and asymmetric settings, but this work is specific to the latter. Due to space limitations, we have omitted various parts of this paper. A full version of the paper is available [2].

2

Definitions of Security

This section provides formal definitions for the six notions of security of an asymmetric (ie., public key) encryption scheme discussed in Section 1.1. Plaintext awareness will be described in Section 4. We begin by describing the syntax of an encryption scheme, divorcing syntax from the notions of security. Experiments. We use standard notations and conventions for writing probabilistic algorithms and experiments. If A is a probabilistic algorithm, then A(x1 , x2 , . . . ; r) is the result of running A on inputs x1 , x2 , . . . and coins r. We let y ← A(x1 , x2 , . . .) denote the experiment of picking r at random and letting y be A(x1 , x2 , . . . ; r). If S is a finite set then x ← S is the operation of picking an element uniformly from S. If α is neither an algorithm nor a set then x ← α is a simple assignment statement. We say that y can be output by A(x1 , x2 , . . .) if there is some r such that A(x1 , x2 , . . . ; r) = y. Syntax and conventions. The syntax of an encryption scheme specifies what kinds of algorithms make it up. Formally, an asymmetric encryption scheme is given by a triple of algorithms, Π = (K, E, D), where • K, the key generation algorithm, is a probabilistic algorithm that takes a security parameter k ∈ N (provided in unary) and returns a pair (pk, sk) of matching public and secret keys. • E, the encryption algorithm, is a probabilistic algorithm that takes a public key pk and a message x ∈ {0, 1}∗ to produce a ciphertext y. • D, the decryption algorithm, is a deterministic algorithm which takes a secret key sk and ciphertext y to produce either a message x ∈ {0, 1}∗ or a special symbol ⊥ to indicate that the ciphertext was invalid. We require that for all (pk, sk) which can be output by K(1k ), for all x ∈ {0, 1}∗, and for all y that can be output by Epk (x), we have that Dsk (y) = x. We also require that K, E and D can be computed in polynomial time. As the notation indicates, the keys are indicated as subscripts to the algorithms. Recall that a function  : N → R is negligible if for every constant c ≥ 0 there exists an integer kc such that (k) ≤ k −c for all k ≥ kc . 2.1

Framework

The formalizations that follow have a common framework that it may help to see at a high level first. In formalizing both indistinguishability and non-malleability we regard an adversary A as a pair of probabilistic algorithms, A = (A1 , A2 ). (We will say that A is polynomial time if both A1 and A2 are.) This corresponds

32

Mihir Bellare et al.

to A running in two “stages.” The exact purpose of each stage depends on the particular adversarial goal, but for both goals the basic idea is that in the first stage the adversary, given the public key, seeks and outputs some “test instance,” and in the second stage the adversary is issued a challenge ciphertext y generated as a probabilistic function of the test instance, in a manner depending on the goal. (In addition A1 can output some state information s that will be passed to A2 .) Adversary A is successful if she passes the challenge, with what “passes” means again depending on the goal. We consider three types of attacks under this setup. In a chosen-plaintext attack (CPA) the adversary can encrypt plaintexts of her choosing. Of course a CPA is unavoidable in the public-key setting: knowing the public key, an adversary can, on her own, compute a ciphertext for any plaintext she desires. So in formalizing definitions of security under CPA we “do nothing” beyond giving the adversary access to the public key; that’s already enough to make a CPA implicit. In a non-adaptive chosen ciphertext attack (CCA1) we give A1 (the public key and) access to a decryption oracle, but we do not allow A2 access to a decryption oracle. This is sometimes called a non-adaptive chosen ciphertext attack, in that the decryption oracle is used to generate the test instance, but taken away before the challenge appears. In an adaptive chosen ciphertext attack (CCA2) we continue to give A1 (the public key and) access to a decryption oracle, but also give A2 access to the same decryption oracle, with the only restriction that she cannot query the oracle on the challenge ciphertext y. This is an extremely strong attack model. As a mnemonic, the number i in CCAi can be regarded as the number of adversarial stages during which she has access to a decryption oracle. Additionally, the bigger number corresponds to the stronger (and chronologically later) formalization. By the way: we do not bother to explicitly give A2 the public key, because A1 has the option of including it in s. 2.2

Indistinguishability of Encryptions

The classical goal of secure encryption is to preserve the privacy of messages: an adversary should not be able to learn from a ciphertext information about its plaintext beyond the length of that plaintext. We define a version of this notion, indistinguishability of encryptions (IND), following [17,21], through a simple experiment. Algorithm A1 is run on input the public key, pk. At the end of A1 ’s execution she outputs a triple (x0 , x1 , s), the first two components being messages which we insist be of the same length, and the last being state information (possibly including pk) which she wants to preserve. A random one of x0 and x1 is now selected, say xb . A “challenge” y is determined by encrypting xb under pk. It is A2 ’s job to try to determine if y was selected as the encryption of x0 or x1 , namely to determine the bit b. To make this determination A2 is given the saved state s and the challenge ciphertext y. For concision and clarity we simultaneously define indistinguishability with respect to CPA, CCA1, and CCA2. The only difference lies in whether or not

Relations Among Notions of Security for Public-Key Encryption Schemes

33

A1 and A2 are given decryption oracles. We let the string atk be instantiated by any of the formal symbols cpa, cca1, cca2, while ATK is then the corresponding formal symbol from CPA, CCA1, CCA2. When we say Oi = ε, where i ∈ {1, 2}, we mean Oi is the function which, on any input, returns the empty string, ε. Definition 1. [IND-CPA, IND-CCA1, IND-CCA2] Let Π = (K, E, D) be an encryption scheme and let A = (A1 , A2 ) be an adversary. For atk ∈ {cpa, cca1, def cca2} and k ∈ N let Advind-atk (k) = A,Π

h 1 2 · Pr (pk, sk) ← K(1k ) ; (x0 , x1 , s) ← AO 1 (pk) ; b←{0, 1} ; y ← Epk (xb ) : i 2 AO 2 (x0 , x1 , s, y) = b − 1 where and O2 (·) = ε If atk = cpa then O1 (·) = ε If atk = cca1 then O1 (·) = Dsk (·) and O2 (·) = ε If atk = cca2 then O1 (·) = Dsk (·) and O2 (·) = Dsk (·) We insist, above, that A1 outputs x0 , x1 with |x0 | = |x1 |. In the case of CCA2, we further insist that A2 does not ask its oracle to decrypt y. We say that Π is secure in the sense of IND-ATK if A being polynomial-time implies that ind-atk (·) is negligible. 2 AdvA,Π 2.3

Non-Malleability

Notation. We will need to discuss vectors of plaintexts or ciphertexts. A vector is denoted in boldface, as in x. We denote by |x| the number of components in x, and by x[i] the i-th component, so that x = (x[1], . . . , x[|x|]). We extend the set membership notation to vectors, writing x ∈ x or x 6∈ x to mean, respectively, that x is in or is not in the set {x[i] : 1 ≤ i ≤ |x|}. It will be convenient to extend the decryption notation to vectors with the understanding that operations are performed componentwise. Thus x ← Dsk (y) is shorthand for the following: for 1 ≤ i ≤ |y| do x[i] ← Dsk (y[i]). We will consider relations of arity t where t will be polynomial in the security parameter k. Rather than writing R(x1 , . . . , xt ) we write R(x, x), meaning the first argument is special and the rest are bunched into a vector x with |x| = t−1. Idea. The notion of non-malleability was introduced in [11], with refinements in [12,13]. The goal of the adversary, given a ciphertext y, is not (as with indistinguishability) to learn something about its plaintext x, but only to output a vector y of ciphertexts whose decryption x is “meaningfully related” to x, meaning that R(x, x) holds for some relation R. The question is how exactly one measures the advantage of the adversary. This turns out to need care. One possible formalization is that of [11,12,13], which is based on the idea of simulation; it asks that for every adversary there exists a certain type of “simulator” that does just as well as the adversary but without being given y. Here, we introduce a novel formalization which seems to us to be simpler. Our formalization does not

34

Mihir Bellare et al.

ask for a simulator, but just considers an experiment involving the adversary. It turns out that our notion implies DDN’s, but the converse is not known. See Appendix A for a brief comparison. Our formalization. Let A = (A1 , A2 ) be an adversary. In the first stage of the adversary’s attack, A1 , given the public key pk, outputs a description of a message space, described by a sampling algorithm M . The message space must be valid, which means that it gives non-zero probability only to strings of some one particular length. In the second stage of the adversary’s attack, A2 receives an encryption y of a random message, say x, drawn from M . The adversary then outputs a (description of a) relation R and a vector y (no component of which is y). She hopes that R(x, x) holds, where x ← Dsk (y). An adversary (A1 , A2 ) is successful if she can do this with a probability significantly more than that with which R(˜ x, x) holds for some random hidden x˜ ← M . Definition 2. [NM-CPA, NM-CCA1, NM-CCA2] Let Π = (K, E, D) be an encryption scheme and let A = (A1 , A2 ) be an adversary. For atk ∈ {cpa, cca1, cca2} and k ∈ N define def nm-atk nm-atk nm-atk (k) = SuccA,Π (k) − SuccA,Π,$ (k) AdvA,Π nm-atk where SuccA,Π (k) =

def

h 1 Pr (pk, sk) ← K(1k ) ; (M, s) ← AO 1 (pk) ; x ← M ; y ← Epk (x) ;

i 2 (R, y) ← AO (M, s, y) ; x ← D (y) : y ∈ 6 y ∧ ⊥ ∈ 6 x ∧ R(x, x) sk 2

nm-atk (k) = and SuccA,Π,$

def

h 1 ˜ ← M ; y ← Epk (x) ; Pr (pk, sk) ← K(1k ) ; (M, s) ← AO 1 (pk) ; x, x i 2 (R, y) ← AO x, x) 2 (M, s, y) ; x ← Dsk (y) : y 6∈ y ∧ ⊥ 6∈ x ∧ R(˜ where and O2 (·) = ε If atk = cpa then O1 (·) = ε If atk = cca1 then O1 (·) = Dsk (·) and O2 (·) = ε If atk = cca2 then O1 (·) = Dsk (·) and O2 (·) = Dsk (·) We insist, above, that M is valid: |x| = |x0 | for any x, x0 that are given non-zero probability in the message space M . We say that Π is secure in the sense of NM-ATK if for every polynomial p(k): if A runs in time p(k), outputs a (valid) message space M samplable in time p(k), and outputs a relation R computable nm-atk (·) is negligible. 2 in time p(k), then AdvA,Π The condition that y 6∈ y is made in order to not give the adversary credit for the trivial and unavoidable action of copying the challenge ciphertext. Otherwise, she could output the equality relation R, where R(a, b) holds iff a = b, and output

Relations Among Notions of Security for Public-Key Encryption Schemes

35

y = (y), and be successful with probability one. We also declare the adversary unsuccessful when some ciphertext y[i] does not have a valid decryption (that is, ⊥ ∈ x), because in this case, the receiver is simply going to reject the adversary’s message anyway. The requirement that M is valid is important; it stems from the fact that encryption is not intended to conceal the length of the plaintext. One might want to strengthen the notion to require that the adversary’s advantage remains small even in the presence a priori information about the message x; such incorporation of message “history” was made in Goldreich’s formalizations of semantic security [14] and the definition of non-malleability in [12,13]. For simplicity we have omitted histories, but note that the above definition can be easily enhanced to take histories into account, and we explain how in [2].

3

Relating IND and NM

We state more precisely the results summarized in Figure 1 and provide proofs. As mentioned before, we summarize only the main relations (the ones that require proof); all other relations follow as corollaries. 3.1

Results

The first result, that non-malleability implies indistinguishability under any type of attack, was of course established by [11] in the context of their definition of non-malleability, but since we have a new definition of non-malleability, we need to re-establish it. The (simple) proof of the following is in [2]. Theorem 1. [NM-ATK ⇒ IND-ATK] If encryption scheme Π is secure in the sense of NM-ATK then Π is secure in the sense of IND-ATK for any attack ATK ∈ {CPA, CCA1, CCA2}. Remark 1. Recall that the relation R in Definition 2 was allowed to have any polynomially bounded arity. However, the above theorem holds even under a weaker notion of NM-ATK in which the relation R is restricted to have arity two. The proof of the following is in Section 3.2. Theorem 2. [IND-CCA2 ⇒ NM-CCA2] If encryption scheme Π is secure in the sense of IND-CCA2 then Π is secure in the sense of NM-CCA2. Remark 2. Theorem 2 coupled with Theorem 1 and Remark 1 says that in the case of CCA2 attacks, it suffices to consider binary relations, meaning the notion of NM-CCA2 restricted to binary relations is equivalent to the general one. Now we turn to separations. Adaptive chosen ciphertext security implies nonmalleability according to Theorem 2. In contrast, the following says that nonadaptive chosen ciphertext security does not imply non-malleability. The proof is in Section 3.3.

36

Mihir Bellare et al.

Theorem 3. [IND-CCA16⇒NM-CPA] If there exists an encryption scheme Π which is secure in the sense of IND-CCA1, then there exists an encryption scheme Π 0 which is secure in the sense of IND-CCA1 but which is not secure in the sense of NM-CPA. Now one can ask whether non-malleability implies chosen ciphertext security. The following says it does not even imply the non-adaptive form of the latter. (As a corollary, it certainly does not imply the adaptive form.) The proof is in Section 3.4. Theorem 4. [NM-CPA6⇒IND-CCA1] If there exists an encryption scheme Π which is secure in the sense of NM-CPA, then there exists an encryption scheme Π 0 which is secure in the sense of NM-CPA but which is not secure in the sense of IND-CCA1. Now the only relation that does not immediately follow from the above results or by a trivial reduction is that the version of non-malleability allowing CCA1 does not imply the version that allows CCA2. See Section 3.5 for the proof of the following. Theorem 5. [NM-CCA16⇒NM-CCA2] If there exists an encryption scheme Π which is secure in the sense of NM-CCA1, then there exists an encryption scheme Π 0 which is secure in the sense of NM-CCA1 but which is not secure in the sense of NM-CCA2. 3.2

Proof of Theorem 2

We are assuming that encryption scheme Π is secure in the IND-CCA2 sense. We show it is also secure in the NM-CCA2 sense. The intuition is simple: since the adversary has access to the decryption oracle, she can decrypt the ciphertexts she would output, and so the ability to output ciphertexts is not likely to add power. For the proof, let B = (B1 , B2 ) be an NM-CCA2 adversary attacking Π. nm-cca2 (k) is negligible. To this end, we describe an We must show that AdvB,Π IND-CCA2 adversary A = (A1 , A2 ) attacking Π. sk Algorithm AD 1 (pk) (M, s) ← B1Dsk (pk) x0 ← M ; x1 ← M s0 ← (M, s) return (x0 , x1 , s0 )

0 0 sk Algorithm AD 2 (x0 , x1 , s , y) where s = (M, s) Dsk (R, y) ← B2 (M, s, y) ; x ← Dsk (y) if (y 6∈ y ∧ ⊥ 6∈ x ∧ R(x0 , x)) then d ← 0 else d ← {0, 1} return d

Notice A is polynomial time under the assumption that the running time of B, the time to compute R, and the time to sample from M are all bounded by a fixed ind-cca2 (k) = pk (0) − pk (1) polynomial in k. The advantage of A is given by AdvA,Π def

where for b ∈ {0, 1} we let pk (b) = h sk Pr (pk, sk) ← K(1k ) ; (x0 , x1 , s0 ) ← AD 1 (pk) ; y ← Epk (xb ) : i 0 sk AD 2 (x0 , x1 , s , y) = 0 .

Relations Among Notions of Security for Public-Key Encryption Schemes

37

def

Also for b ∈ {0, 1} we let p0k (b) = h Pr (pk, sk) ← K(1k ) ; (M, s) ← B1Dsk (pk) ; x0 , x1 ← M ; y ← Epk (xb ) ;

i (R, y) ← B2Dsk (M, s, y) ; x ← Dsk (y) : y 6∈ y ∧ ⊥ ∈ / x ∧ R(x0 , x) .

Now observe that A2 may return 0 either when x is R-related to x0 or as a result of the coin flip. Continuing with the advantage then, 1 1 1 ind-cca2 AdvA,Π (k) = pk (0)−pk (1) = ·[1+p0k (0)]− ·[1+p0k (1)] = ·[p0k (0)−p0k (1)] 2 2 2 We now observe that the experiment of B2 being given a ciphertext of x1 and nm-cca2 (k). On the other hand, R-relating x to x0 , is exactly that defining SuccB,Π,$ nm-cca2 in case it is x0 , we are looking at the experiment defining SuccB,Π (k). So Advnm-cca2 (k) = p0 (0) − p0 (1) = 2 · Advind-cca2 (k) . k ind-cca2 AdvA,Π (k)

B,Π

k

A,Π

But we know that is negligible because Π is secure in the sense nm-cca2 of IND-CCA2. It follows that AdvB,Π (k) is negligible, as desired. 3.3

Proof of Theorem 3

Assume there exists some IND-CCA1 secure encryption scheme Π = (K, E, D), since otherwise the theorem is vacuously true. We now modify Π to a new encryption scheme Π 0 = (K0 , E 0 , D0 ) which is also IND-CCA1 secure but not secure in the NM-CPA sense. This will prove the theorem. The new encryption scheme Π 0 = (K0 , E 0 , D0 ) is defined as follows. Here x denotes the bitwise complement of string x, namely the string obtained by flipping each bit of x. 0 0 Algorithm Epk (x) Algorithm K0 (1k ) Algorithm Dsk (y1 ky2 ) k return Dsk (y1 ) (pk, sk) ← K(1 ) y1 ← Epk (x) ; y2 ← Epk (x) return (pk, sk) return y1 ky2

In other words, a ciphertext in the new scheme is a pair y1 k y2 consisting of the encryption of the message and its complement. In decrypting, the second component is ignored. In [2] we establish that Π 0 is not secure in the sense of NM-CPA sense, while it is secure in the sense of IND-CCA1. 3.4

Proof of Theorem 4

Let’s first back up a bit and provide some intuition about why the theorem might be true and how we can prove it. Intuition and first attempts. At first glance, one might think NM-CPA does imply IND-CCA1 (or even IND-CCA2), for the following reason. Suppose an adversary has a decryption oracle, and is asked to tell whether a given ciphertext y is the encryption of x0 or x1 , where x0 , x1 are messages she has chosen earlier. She is not allowed to call the decryption oracle on y. It seems then the only strategy she could have is to modify y to some related y 0 , call the decryption oracle on y 0 , and use the answer to somehow help her determine

38

Mihir Bellare et al.

whether the decryption of y was x0 or x1 . But if the scheme is non-malleable, creating a y 0 meaningfully related to y is not possible, so the scheme must be chosen-ciphertext secure. The reasoning above is fallacious. The flaw is in thinking that to tell whether y is an encryption of x0 or x1 , one must obtain a decryption of a ciphertext y 0 related to the challenge ciphertext y. In fact, what can happen is that there are certain strings whose decryption yields information about the secret key itself, yet the scheme remains non-malleable. The approach to prove the theorem is to modify a NM-CPA scheme Π = (K, E, D) to a new scheme Π 0 = (K0 , E 0 , D0 ) which is also NM-CPA but can be broken under a non-adaptive chosen ciphertext attack. (We can assume a NM-CPA scheme exists since otherwise there is nothing to prove.) A first attempt to implement the above idea (of having the decryption of certain strings carry information about the secret key) is straightforward. Fix some ciphertext u not 0 in the range of E and define Dsk (u) = sk to return the secret key whenever it is given this special ciphertext. In all other aspects, the new scheme is the same as the old one. It is quite easy to see that this scheme falls to a (non-adaptive) chosen ciphertext attack, because the adversary need only make query u of its decryption oracle to recover the entire secret key. The problem is that it is not so easy to tell whether this scheme remains non-malleable. (Actually, we don’t know whether it is or not, but we certainly don’t have a proof that it is.) As this example indicates, it is easy to patch Π so that it can be broken in the sense of IND-CCA1; what we need is that it also be easy to prove that it remains NM-CPA secure. The idea of our construction below is to use a level of indirection: sk is returned by D0 in response to a query v which is itself a random string that can only be obtained by querying D0 at some other known point u. Intuitively, this scheme will be NM-CPA secure since v will remain unknown to the adversary. Our construction. Given a non-malleable encryption scheme Π = (K, E, D) we define a new encryption scheme Π 0 = (K0 , E 0 , D0 ) as follows. Here b is a bit. 0 0 Algorithm Epk Algorithm K0 (1k ) k u (x) Algorithm Dsk k u k v (b k y) k (pk, sk) ← K(1 ) y ← Epk (x) if b = 0 then return Dsk (y) u, v ← {0, 1}k return 0 k y else if y = u then return v pk 0 ← pk k u else if y = v return sk sk 0 ← sk k u k v else return ⊥ return (pk 0 , sk 0 )

Analysis. The proof of Theorem 4 is completed by establishing that Π 0 is vulnerable to a IND-CCA1 attack but remains NM-CPA secure. The proofs of these claims can be found in [2]. 3.5

Proof of Theorem 5

The approach, as before, is to take a NM-CCA1 secure encryption scheme Π = (K, E, D) and modify it to a new encryption scheme Π 0 = (K0 , E 0 , D0 ) which is also NM-CCA1 secure, but can be broken in the NM-CCA2 sense.

Relations Among Notions of Security for Public-Key Encryption Schemes

39

Intuition. Notice that the construction of Section 3.4 will no longer work, because the scheme constructed there, not being secure in the sense of IND-CCA1, will certainly not be secure in the sense of NM-CCA1, for the same reason: the adversary can obtain the decryption key in the first stage using a couple of decryption queries. Our task this time is more complex. We want queries made in the second stage, after the challenge is received, to be important, meaning they can be used to break the scheme, yet, somehow, queries made in the first stage cannot be used to break the scheme. This means we can no longer rely on a simplistic approach of revealing the secret key in response to certain queries. Instead, the “breaking” queries in the second stage must be a function of the challenge ciphertext, and cannot be made in advance of seeing this ciphertext. We implement this idea by a “tagging” mechanism. The decryption function is capable of tagging a ciphertext so as to be able to “recognize” it in a subsequent query, and reveal in that stage information related specifically to the ciphertext, but not directly to the secret key. The tagging is implemented via pseudorandom function families. Our construction. Let Π = (K, E, D) be the given NM-CCA1 secure encryption scheme. Fix a family F = { F k : k ≥ 1 } of pseudorandom functions as per [18]. (Notice that this is not an extra assumption. We know that the existence of even a IND-CPA secure encryption scheme implies the existence of a one-way function [20] which in turn implies the existence of a family of pseudorandom functions [19,18].) Here each F k = { FK : K ∈ {0, 1}k } is a finite collection in which each key K ∈ {0, 1}k indexes a particular function FK : {0, 1}k → {0, 1}k . We define the new encryption scheme Π 0 = (K0 , E 0 , D0 ) as follows. Recall that ε is the empty string. Algorithm K0 (1k ) (pk, sk) ← K(1k ) K ← {0, 1}k sk 0 ← sk k K return (pk, sk 0 )

0 Algorithm Epk (x) y ← Epk (x) return 0 k y k ε

0 Algorithm Dsk k K (b k y k z) where b is a bit if (b = 0) ∧ (z = ε) then return Dsk (y) else if (b = 1) ∧ (z = ε) then return FK (y) else if (b = 1) ∧ (z = FK (y)) return Dsk (y) else return ⊥

Analysis. The proof of Theorem 5 is completed by establishing that Π 0 is vulnerable to a NM-CCA2 attack but remains NM-CCA1 secure. Formal proofs of these two claims can be found in [2]. Let us sketch the intuition here. The first is easy to see. In stage 2, given challenge ciphertext 0ky k ε, the adversary would like to get back Dsk 0 (0ky k ε) = Dsk (y), but is not allowed to query its oracle at 0ky k ε. However, she can query 1kykε to get FK (y) and then query 1kykFK (y) to get back the decryption of y under sk. At that point she can easily win.

40

Mihir Bellare et al.

The key point for the second claim is that to defeat the scheme, the adversary must obtain FK (y) where 0 k y k ε is the challenge. However, to do this she requires the decryption oracle. This is easy for an NM-CCA2 adversary but not for an NM-CCA1 adversary, which has a decryption oracle available only in the first stage, when y is not yet known. Once y is provided (in the second stage) the possibility of computing FK (y) is small because the decryption oracle is no longer available to give it for free, and the pseudorandomness of F makes it hard to compute on one’s own.

4

Results on PA

In this section we define plaintext awareness and prove that it implies the random oracle version of IND-CCA2, but is not implied by it. Throughout this section we shall be working exclusively in the RO model. As such, all notions of security defined earlier refer, in this section, to their RO counterparts. These are obtained in a simple manner. To modify Definitions 1 and 2, begin the specified experiment (the experiment which defines advantage) by choosing a random function H from the set of all functions from strings to infinite strings. Then provide an H-oracle to A1 and A2 , and allow that Epk H H and Dsk may depend on H (which we write as Epk and Dsk ). 4.1 Definition Our definition of PA is from [4], except that we make one important refinement. An adversary B for plaintext awareness is given a public key pk and access H to the random oracle H. We also provide B with an oracle for Epk . (This is our refinement, and its purpose is explained later.) The adversary outputs a ciphertext y. To be plaintext aware the adversary B should necessarily “know” the decryption x of its output y. To formalize this it is demanded there exist some (universal) algorithm K (the “plaintext extractor”) that could have output x just by looking at the public key, B’s H-queries and the answers to them, and the H answers to B’s queries to Epk . (Note the extractor is not given the queries that H B made to Epk , just the answers received.) Let us now summarize the formal definition and then discuss it.H By (hH , C, y) ← run B H,Epk (pk) we mean the following. Run B on input pk H and oracles H and Epk , recording B’s interaction with its oracles. Form into a list hH = ((h1 , H1 ), . . . , (hqH , HqH )) all of B’s H-oracle queries, h1 , . . . , hqH , and the corresponding answers, H1 , . . . , HqH . Form into a list C = (y1 , . . . , yqE ) H the answers (ciphertexts) received as a result of Epk -queries. (The messages that formed the actual queries are not recorded.) Finally, record B’s output, y. Definition 3. [Plaintext Awareness – PA] Let Π = (K, E, D) be an encryption scheme, let B be an adversary, and let K be an algorithm (the “knowledge def

extractor”). For any k ∈ N let Succpa K,B,Π (k) = h Pr H ← Hash ; (pk, sk) ← K(1k ) ;

i H H (hH , C, y) ← run B H,Epk (pk) : K(hH , C, y, pk) = Dsk (y) .

Relations Among Notions of Security for Public-Key Encryption Schemes

41

We insist that y 6∈ C; that is, B never outputs a string y which coincides with the H value returned from some Epk -query. We say that K is a λ(k)-extractor if K has running time polynomial in the length of its inputs and for every adversary B, Succpa K,B,Π (k) ≥ λ(k). We say that Π is secure in the sense of PA if Π is secure in the sense of IND-CPA and there exists a λ(k)-extractor K where 1 − λ(k) is negligible. 2 Let us now discuss this notion with particular attention to our refinement, which, as we said, consists of providing the adversary with an encryption oracle. At first glance this may seem redundant: since B already has the public key, can’t B encrypt without making use of the encryption oracle? Absolutely. But in the RO model encrypting points oneself may involve making H-queries (remember that the encryption function now depends on H), meaning that B will necessarily know any RO queries used to produce the ciphertext. (Formally, H they become part of the transcript run B H,Epk .) This does not accurately model the real world, where B may have access to ciphertexts via eavesdropping, in which case B does not know the underlying RO queries. By giving B an encryption oracle whose H-queries are not made a part of B’s transcript we get a stronger definition. Intuitively, should you learn a ciphertext y1 for which you do not know the plaintext, still you should be unable to produce a ciphertext H (other than y1 ) whose plaintext you do not know. Thus the Epk oracle models the possibility that B may obtain ciphertexts in ways other than encrypting them herself. We comment that plaintext awareness, as we have defined it, is only achievable in the random oracle model. (It is easy to see that if there is a scheme not using the random oracle for which an extractor as above exists then the extractor is essentially a decryption box. This can be formalized to a statement that an IND-CPA scheme cannot be plaintext aware in the above sense without using the random oracle.) It remains an interesting open question to find an analogous but achievable formulation of plaintext awareness for the standard model. One might imagine that plaintext awareness coincides with semantic security coupled with a (non-interactive) zero-knowledge proof of knowledge [10] of the plaintext. But this is not valid. The reason is the way the extractor operates in the notion and scheme of [10]: the common random string (even if viewed as part of the public key) is under the extractor’s control. In the PA notion, pk is an input to the extractor and it cannot play with any of it. Indeed, note that if one could indeed achieve PA via a standard proof of knowledge, then it would be achievable in the standard (as opposed to random oracle) model, and we just observed above that this is not possible with the current definition. 4.2

Results

The proof of the following is in Section 4.3. Theorem 6. [PA ⇒ IND-CCA2] If encryption scheme Π is secure in the sense of PA then it is secure in the RO sense of IND-CCA2.

42

Mihir Bellare et al.

Corollary 1. [PA ⇒ NM-CCA2] If encryption scheme Π is secure in the sense of PA then Π is secure in the RO sense of NM-CCA2. Proof. Follows from Theorems 6 and the RO-version of Theorem 2. The above results say that PA ⇒ IND-CCA2 ⇒ NM-CCA2. In the other direction, we have the following, whose proof is in [2]. Theorem 7. [IND-CCA26⇒PA] If there exists an encryption scheme Π which is secure in the RO sense of IND-CCA2, then there exists an encryption scheme Π 0 which is secure in the RO sense of IND-CCA2 but which is not secure in the sense of PA. 4.3

Proof of Theorem 6

Intuition. The basic idea for proving chosen ciphertext security in the presence of some kind of proof of knowledge goes back to [15,16,7,10]. Let us begin by recalling it. Assume there is some adversary A = (A1 , A2 ) that breaks Π in the IND-CCA2 sense. We construct an adversary A0 = (A01 , A02 ) that breaks Π in the IND-CPA sense. The idea is that A0 will run A and use the extractor to simulate the decryption oracle. At first glance it may seem that the same can be done here, making this proof rather obvious. That is not quite true. Although we can follow the same paradigm, there are some important new issues that arise and must be dealt with. Let us discuss them. The first is that the extractor cannot just run on any old ciphertext. (Indeed, if it could, it would be able to decrypt, and we know that it cannot.) The extractor can only be run on transcripts that originate from adversaries B in the form of Definition 3. Thus to reason about the effectiveness of A0 we must present adversaries who output as ciphertext the same strings that A0 would ask of its decryption oracle. This is easy enough for the first ciphertext output by A, but not after that, because we did not allow our Bs to have decryption oracles. The strategy will be to define a sequence of adversaries B1 , . . . , Bq so that Bi uses the knowledge extractor K for answering the first i − 1 decryption queries, and then Bi outputs what would have been its i-th decryption query. In fact this adversary A0 might not succeed as often as A, but we will show that the loss in advantage is still tolerable. Yet, that is not the main problem. The more subtle issue is how the encryption oracle given to the adversary comes into the picture. Adversary Bi will have to call its encryption oracle to “simulate” production of the challenge ciphertext received by A2 . It cannot create this ciphertext on its own, because to do so would incorrectly augment its transcript by the ensuing H-query. Thus, in fact, only one call to the encryption oracle will be required — yet this call is crucial. Construction. For contradiction we begin with an IND-CCA2 adversary A = ind-cca2 (k) against Π. In addition, (A1 , A2 ) with a non-negligible advantage, AdvA,Π we know there exists a plaintext extractor, K, with high probability of success, Succpa K,B,Π (k), for any adversary B. Using A and K we construct an IND-CPA ind-cpa (k) against adversary A0 = (A01 , A02 ) with a non-negligible advantage, AdvA 0 ,Π

Relations Among Notions of Security for Public-Key Encryption Schemes Algorithm A01 (pk; R) hH ← () Take R1 from R Run A1 (pk; R1 ), wherein When A1 makes a query, h, to H: A01 asks its H-oracle h, obtaining H(h) Put (h, H(h)) at end of hH Answer A1 with H(h) H : When A1 makes its jth query, y, to Dsk x ← K(hH, ε, y, pk) Answer A1 with x Finally A1 halts, outputting (x0 , x1 , s) return (x0 , x1 , (s, hH, pk))

43

Algorithm A02 (x0 , x1 , (s, hH, pk), y; R) Take R2 from R Run A2 (x0 , x1 , s, y; R2 ), wherein When A2 makes a query, h, to H: A02 asks its H-oracle h, obtaining H(h) Put (h, H(h)) at end of hH Answer A2 with H(h) When A2 makes its jth query, y 0 , H : to Dsk x ← K(hH, (y), y 0 , pk) Answer A2 with x Finally A2 halts, outputting bit, d return d

Fig. 2. Construction of IND-CPA adversary A0 = (A01 , A02 ) based on given IND-CCA2 adversary A = (A1 , A2 ) and plaintext extractor K.

Π. Think of A0 as the adversary A with access only to a simulated decryption oracle rather than the real thing. Let () denote the empty list. Recall that if C(·, ·, · · ·) is any probabilistic algorithm then C(x, y, · · · ; R) means we run it with coin tosses fixed to R. The adversary A0 is defined in Figure 2. Analysis. To reason about the behavior of A0 we define a sequence of adversaries B1 , . . . , Bq , where q is the number of decryption queries made by A. Using the existence of B1 , B2 , . . . we can lower bound the probability of the correctness of K’s answers in A01 . The analysis can be found in [2].

Acknowledgments

Following an oral presentation of an earlier version of this paper, Moni Naor suggested that we present notions of security in a manner that treats the goal and the attack model orthogonally [22]. We are indebted to him for this suggestion. We thank Hugo Krawczyk, Moti Yung, and the (other) members of the CRYPTO ’98 program committee for excellent and extensive comments. Finally we thank Oded Goldreich for many discussions on these topics. The first author was supported by a 1996 Packard Foundation Fellowship in Science and Engineering, and by NSF CAREER Award CCR-9624439. The second author was supported in part by the above mentioned grants of the first author. The fourth author was supported by NSF CAREER Award CCR9624560 and a MICRO grant from RSA Data Security, Inc..

44

Mihir Bellare et al.

References 1. M. Bellare, R. Canetti and H. Krawczyk, A modular approach to the design and analysis of authentication and key exchange protocols. Proceedings of the 30th Annual Symposium on Theory of Computing, ACM, 1998. 30 2. M. Bellare, A. Desai, D. Pointcheval, and P. Rogaway, Relations among notions of security for public-key encryption schemes. Full version of this paper, available via http://www-cse.ucsd.edu/users/mihir/ 31, 35, 35, 37, 38, 39, 42, 43, 45, 46 3. M. Bellare and P. Rogaway, Random oracles are practical: a paradigm for designing efficient protocols. First ACM Conference on Computer and Communications Security, ACM, 1993. 29, 30 4. M. Bellare and P. Rogaway, Optimal asymmetric encryption – How to encrypt with RSA. Advances in Cryptology – Eurocrypt 94 Proceedings, Lecture Notes in Computer Science Vol. 950, A. De Santis ed., Springer-Verlag, 1994. 29, 29, 30, 40 5. M. Bellare and A. Sahai, private communication, May 1998. 29, 46, 46 6. D. Bleichenbacher, A chosen ciphertext attack against protocols based on the RSA encryption standard PKCS #1, Advances in Cryptology — CRYPTO ’98 Proceedings, Lecture Notes in Computer Science, H. Krawczyk, ed., SpringerVerlag 1998. 30 7. M. Blum, P. Feldman and S. Micali, Non-interactive zero-knowledge and its applications. Proceedings of the 20th Annual Symposium on Theory of Computing, ACM, 1988. 42 8. R. Cramer and V. Shoup, A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack. Advances in Cryptology — CRYPTO ’98 Proceedings, Lecture Notes in Computer Science, H. Krawczyk, ed., Springer-Verlag 1998. 30, 30 9. I. Damg˚ ard, Towards practical public key cryptosystems secure against chosen ciphertext attacks. Advances in Cryptology – Crypto 91 Proceedings, Lecture Notes in Computer Science Vol. 576, J. Feigenbaum ed., Springer-Verlag, 1991. 30 10. A. De Santis and G. Persiano, Zero-knowledge proofs of knowledge without interaction. Proceedings of the 33rd Symposium on Foundations of Computer Science, IEEE, 1992. 41, 41, 42 11. D. Dolev, C. Dwork, and M. Naor, Non-malleable cryptography. Proceedings of the 23rd Annual Symposium on Theory of Computing, ACM, 1991. 27, 27, 29, 30, 30, 31, 33, 33, 35, 45 12. D. Dolev, C. Dwork, and M. Naor, Non-malleable cryptography. Technical Report CS95-27, Weizmann Institute of Science, 1995. 27, 29, 29, 30, 33, 33, 35, 45 13. D. Dolev, C. Dwork, and M. Naor, Non-malleable cryptography. Manuscript, 1998. 27, 29, 29, 30, 33, 33, 35, 45, 46 14. O. Goldreich, A uniform complexity treatment of encryption and zeroknowledge. Journal of Cryptology, Vol. 6, 1993, pp. 21-53. 35 15. Z. Galil, S. Haber and M. Yung, Symmetric public key encryption. Advances in Cryptology – Crypto 85 Proceedings, Lecture Notes in Computer Science Vol. 218, H. Williams ed., Springer-Verlag, 1985. 30, 42 16. Z. Galil, S. Haber and M. Yung, Security against replay chosen ciphertext attack. Distributed Computing and Cryptography , DIMACS Series in Discrete Mathematics and Theoretical Computer Science, Vol. 2, ACM, 1991. 42

Relations Among Notions of Security for Public-Key Encryption Schemes

45

17. S. Goldwasser and S. Micali, Probabilistic encryption. Journal of Computer and System Sciences, 28:270–299, 1984. 27, 27, 29, 32 18. O. Goldreich, S. Goldwasser and S. Micali, How to construct random functions. Journal of the ACM, Vol. 33, No. 4, 1986, pp. 210–217. 39, 39 19. J. H˚ astad, R. Impagliazzo, L. Levin and M. Luby, Construction of a pseudorandom generator from any one-way function. Manuscript. Earlier versions in STOC 89 and STOC 90. 39 20. R. Impagliazzo and M. Luby, One-way functions are essential for complexity based cryptography. Proceedings of the 30th Symposium on Foundations of Computer Science, IEEE, 1989. 39 21. S. Micali, C. Rackoff and R. Sloan, The notion of security for probabilistic cryptosystems. SIAM J. of Computing, April 1988. 32 22. M. Naor, private communication, March 1998. 26, 43 23. M. Naor and M. Yung, Public-key cryptosystems provably secure against chosen ciphertext attacks. Proceedings of the 22nd Annual Symposium on Theory of Computing, ACM, 1990. 27, 27, 30 24. C. Rackoff and D. Simon, Non-interactive zero-knowledge proof of knowledge and chosen ciphertext attack. Advances in Cryptology – Crypto 91 Proceedings, Lecture Notes in Computer Science Vol. 576, J. Feigenbaum ed., Springer-Verlag, 1991. 27, 27, 30 25. SETCo (Secure Electronic Transaction LLC), The SET standard book 3 formal protocol definitions (version 1.0). May 31, 1997. Available from http://www.setco.org/ 30 26. Y. Zheng and J. Seberry, Immunizing public key cryptosystems against chosen ciphertext attack. IEEE Journal on Selected Areas in Communications, vol. 11, no. 5, 715–724 (1993). 30

A

Comparing our Notion of NM with Simulation NM

Let SNM refer to the original, simulation-based definition of nonmalleability [11,12,13]. Its three forms are denoted SNM-CPA, SNM-CCA1, and SNM-CCA2. (In the full version of this paper [2] we recall DDN’s definition. A key feature one must note here however is that the simulator is not allowed access to a decryption oracle, even in the CCA cases. We note that we are here discussing the version of SNM without “history”; we will comment on histories later.) The question we address here is how NM-ATK compares to SNM-ATK for each ATK ∈ {CPA, CCA1, CCA2}. It is easy to see that NM-CPA ⇒ SNM-CPA. Intuitively, our definition can be viewed as requiring, for every adversary A, a specific type of simulator, which we can call a “canonical simulator,” A0 = (A01 , A02 ). The first stage, A01 , is identical to A1 . The second simulator stage A2 simply chooses a random message from the message space M that was output by A01 , and runs the adversary’s second stage A2 on an encryption of that message. Since A does not have a decryption oracle, A0 can indeed do this. If we continue to think in terms of the canonical simulator in the CCA cases, the difficulty is that this “simulator” would, in running A, now need access to a decryption oracle, which is not allowed under SNM. Thus it might appear that our definition is actually weaker, corresponding to the ability to simulate by

46

Mihir Bellare et al.

simulators which are also given the decryption oracle. However, this appearance is false; in fact, NM-ATK implies SNM-ATK for all three types of attacks ATK, including CCA1 and CCA2. This was observed by Bellare and Sahai [5]. A proof of the following can be found in [2]. Theorem 8. [5] [NM-ATK ⇒ SNM-ATK] If encryption scheme Π is secure in the sense of NM-ATK then Π is secure in the sense of SNM-ATK for any attack ATK ∈ {CPA, CCA1, CCA2}. Are the definitions equivalent? For this we must consider whether SNM-ATK ⇒ NM-ATK. This is true for ATK = CCA2 (and thus the definitions are equivalent in this case) because [13] asserts that SNM-CCA2 implies IND-CCA2 and Theorem 2 asserts IND-CCA2 implies NM-CCA2. For ATK ∈ {CPA, CCA1} the question remains open. Finally, on the subject of histories, we remark that all that we have discussed here is also true if we consider the history-inclusive versions of both definitions.

Cryptography and the Internet Steven M. Bellovin AT&T Labs–Research, Florham Park, NJ, USA [email protected] http://www.research.att.com/~smb

Abstract. After many years, cryptography is coming to the Internet. Some protocols are in common use; more are being developed and deployed. The major issue has been one of cryptographic engineering: turning academic papers into a secure, implementable specification. But there is missing science as well, especially when it comes to efficient implementation techniques.

1

Introduction

In early 1994, CERT announced1 that widespread password monitoring was occuring on the Internet. In 1995, Joncheray published a paper explaining how an eavesdropper could hijack a TCP connection [Jon95]. In mid-1998, there is still very little use of cryptography. Finally, though, there is some reason for optimism. A number of factors have combined to change people’s behavior. First, of course, there is the rise of the Internet as a mass medium, and along with it the rise of Internet commerce. Consider the following quote from a popular Web site: How does ——.com protect my credit card if I order online? ——.com takes every precaution to protect the privacy of your credit card information. We utilize Secure Socket Layers (SSL), the most advanced security system available. All of your ordering information – including your name, address, and credit card number – is encrypted using a Secure Server for maximum security. Your credit card and billing information cannot be read as it travels to our ordering system. In addition, our ordering system is not connected to the Internet and is not accessible in any way. You can also use our Standard Server, pay by phone option, or fax us your order. There are several noteworthy things here. First, of course, they advertise their use of encryption. Second, as evidenced by the phone payment option—a relatively common choice—there is still persistent public uneasiness about Internet security. Cryptography, of course, is part of the solution; thus, companies that wish to attract business are touting their use of encryption. 1

CERT Advisory CA-94:01, 3 February 1994.

H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 46–55, 1998. c Springer-Verlag Berlin Heidelberg 1998

Cryptography and the Internet

47

A second major driver for the adoption of cryptography has been the transformation of the Internet into the data network. More and more, corporations are using the Internet for general data transfer, in the same was as they have traditionally used the phone network for voice traffic. A branch office may have its own link to the Internet and communicate with the home office via this channel, instead of using a leased line. Telecommuters can use an ISP’s modem pool to dial in to work. But both of these practices are risky without encryption. Finally, the technology is ready. Computers are fast enough that the overhead for encryption is—barely, in some cases—tolerable. Standards exist for the much important types of encryption. And most—but not all—of the necessary science exists.

2

Current Uses of Cryptography on the Internet

Perhaps the most mature cryptographic technology in use on the Internet is secure email. Two different schemes—PGP and S/MIME—have achieved reasonably broad penetration. Both have been hampered, though, by lack of a widespread public-key infrastructure. While not strictly necessary, especially for use within comparatively small groups, a more broadly-based certificate graph is necessary for some uses. Imagine, for example, trying to solve the “spam” email problem by relying on PGP’s Web of Trust.2 Another notable use of cryptography is SSL, the Secure Socket Layer. While in theory quite general, in practice SSL is used almost exclusively for communication between Web browsers and servers. Furthermore, in almost all cases authentication is at best one-way—servers have certificates; clients rarely do— and in practice is unauthenticated, since most users of the technology neither know nor care what a certificate is, nor who has signed it. For that matter, the popular browsers give very little guidance on whether or not certificates should be accepted, what the meaning of the signing certificate is, etc. We thus have the dual of the situation with secure email: the certificate authorities exist, and are used, but to little practical effect. The third major area for cryptography in the Internet is the networklayer encryption and authentication protocol set, IPSEC.3 There is also a key exchange protocol derived from Diffie et al’s STS [DvW92] and Krawczyk’s SKEME [Kra96]. IPSEC provides broad-spectrum protection of communications, below the application and transport layers. It is thus invisible to them, but protects them nevertheless. 2 3

“Spam” is the common term for bulk, unsolicited commercial email. At this point, the new IPSEC RFCs have not yet been issued, though they are expected momentarily. The existing ones—RFCs 1825-1829—describe an obsolete version of the protocol. While they are useful as a general guide to IPSEC, there are a number of cryptographically significant differences between them and the newer standards.

48

Steven M. Bellovin

IPSEC also provides the ability to trade cost for granularity of protection. A single IPSEC key can protect a user, a host, or an entire network. An organization can use a single gateway, to minimize its costs; conversely, it can add IPSEC to every host, thus guarding against certain attacks within its site. Since IPSEC is just starting to be deployed, it is impossible to assess its usage patterns. Still, in at least two likely deployment patterns—firewall-to-firewall in a virtual private network (VPN) configuration, and remote employees-to-firewall— the certificate will be used for authorization. This suggests that certificates will be meaningful, but that a widespread PKI will not be needed; instead, each corporation will issue its own certificates. If IPSEC is used in other than end-to-end mode, some intermediate points must be trusted. Furthermore, since the topology of the Internet is dynamic, there may not be a fixed set of trusted parties between two endpoints wishing to converse. In many cases, such delegations should be digitally signed by the ultimate endpoint. In other cases, such as a corporate firewall, the delegation is in fact in the reverse order. That is, the administrator for some zone gigacorporation.com could in fact specify the IPSEC proxies for all hosts within that domain. Regardless, the exact set of IPSEC gateways to be used must be discovered anew for each connection. Mention should also be made of SET, a secure electronic payment protocol developed by the banking and credit card industry. It’s especially interesting because it’s a multiparty protocol: the consumer, the merchant, and the bank. It is worth noting the collision here between cryptographic theory and commercial reality: while one might think that a signature-based protocol would eliminate any need to transmit an actual credit card number, that turns out not to be the case; some merchants use credit card numbers as the look-up key for the customer databases, and are unwilling to lose the previous purchase history. Accordingly, the card number may still be sent to the merchant, though of course in encrypted form.

3

Planned Uses and Missing Pieces

There are a number of things we would like to do on the Internet; however, we don’t know how to do them. I will focus on three: efficient cryptographic processing, routing, and multi-party cryptography. The first is, of course, obvious: we need faster algorithms. While Moore’s Law has helped, often the effect of a faster CPU is that system designers demand more of it. A modern tunnel server, for example, may handle hundreds of simultaneous connections. But if these sessions are cryptographically protected, more CPU power is needed. Worse yet, the public key operations to establish these connections are very expensive. If a server handling 500 remote users crashes and reboots, it can be a quite a while before all of the sessions are re-established: the necessary public-key operations are quite expensive. A less obvious place where efficiency improvements are desperately needed is for authentication and integrity algorithms. During the development of IPSEC,

Cryptography and the Internet

49

we learned that encryption without integrity-checking is all but useless [Bel96]— it turned out to be practical to use the error propagation properties of CBC mode to construct all manner of useful but fraudulent packets. To give just one example, an attacker could splice together the body of a target packet with the header of a packet destined for his or her program. The current choices for such integrity algorithms—IPSEC currently specifies HMAC [BCK96] with either MD5 [Riv92] or SHA-1 [NIS95]—are too slow in many cases, and are not particularly suited for hardware accelerators [Tou96]. Alternatively, an encryption mode or algorithm that prevented any tampering with the ciphertext might suffice. (Rivest’s all-or-nothing encryption mode [Riv97] is too expensive.) There is also a strong need for secure routing protocols. Internet routers exchange reachability and link cost information with their neighbors; from this, each router computes the optimal path to each destination network on the Internet.4 There is no global knowledge of the actual topology. If a router lies about the networks it can reach, its neighbors will be deceived. This in turn can result in traffic being diverted to paths controlled by an enemy. While traffic encryption should prevent eavesdropping, routing attacks represent at least a denial of service attack, and—in the absence of other encryption—more serious threats. It is not obvious how to use cryptography to secure this structure. Protecting the routing exchanges between each pair of routers is straight-forward enough; the problem, however, is that each router knows only what its neighbors have said. They themselves could have been deceived. A solution will involve verifying the full path back to the owner of the network. And that in turn requires calculating and verifying many digital signatures, which is prohibitively expensive. While some work has been done [SK97, SMGLA97, HPT97, MB96], much more remains. Another interesting research area is providing adequate security for multicast sessions. While a number of protocols have been proposed, it is not clear that they are suitable. There are a number of reasons for this; prominent among them is that there is no one model for what multicast is. It may be a television-style broadcast, with authentication of all messages and perhaps encryption so that only subscribers can watch. It may be a conversation between a small number of participants. It may be a combination of a broadcast and a question-and-answer session; while anyone can speak, the session is under control of a central site, which must have the ability to exclude disruptive participants. A constraint on multicast security mechanisms is the trust model. Many proposed protocols assume that the key distribution graph is somehow related to the packet-forwarding graph. For some common uses of multicast technology, this is a bad assumption. Packet-forwarding is often configured by Internet Service Providers; ordinary users can and do create multicast sessions. A compromise 4

The actual routing structure of the Internet is far more complex than is explained here.

50

Steven M. Bellovin

position may be some way to identify some trustable subset of the forwarding graph; discovering this set—and deciding that it is trustable—is not trivial.

4

Trust and Policy Management

Many of the problems discussed earlier can be summed up in one question: who can be trusted to do what? More precisely, how can a user or a computer acting on that user’s behalf know what certificates are acceptable for a given action? Furthermore, out of the set of potentially trustable parties, which are the right ones under some given set of circumstances.? The problem shows up most clearly with IPSEC, where a machine may need to discover the identity of a security gateway for some connection. Even in that case, there can be considerably more complexity. For example, two hosts may wish to use end-to-end encryption. However, both sites are behind firewalls that wish to do their own encryption between them. Furthermore, one host may need to use authentication from it to the outbound firewall, to validate its right to send traffic out of the location. A related issue is the specification of the desired policy. How can an administrator communicate to assorted hosts the identities, both cryptographic and network, of the various gateways that must be involved in a secure connection? More to the point, how is it communicated securely? Who is authorized to set such policies, and how do the endpoints know it? With SSL and secure email, the trust question is made more complex because the answer must relate to the real world. If I request a secure connection to www.wsj.com, my Web browser warns me that the certificate was issued to interactive.wsj.com. Should these two be considered identical? The company name is Dow Jones; is that right? How should I know that, a priori? And domain names are often confusing; nasa.com bears no relation to nasa.gov. Will a user notice the distinction? One can assert that no matter the cryptographic tricks, the user of a certificate is (and should be) responsible for validating its authenticity. Often, though, it is impossible for the user to do so. In particular, a conventional certificate does not indicate what roles the holder can fulfill. The company name in my certificate indicates correctly that I work for a telecommunications company; it does not say whether or not I am authorized to accept payment for phone bills. Possibly, schemes such as PolicyMaker [BFL96, BFS98] or SDSI [RL96] will solve this problem. But enumerating all possible roles for a certificate is easy; enumerating the roles it may not fill is very hard. Furthermore, the distinction may be too subtle for a program. A server certificate valid for, say, accepting orders for books via a Web page may not be the proper certificate for software orders, even from the same Web server. But it may be the proper certificate for sending email to the customer care agent. We must also be wary of techniques that work for humans, but not for programs. A person may be wary enough to note that my certificate contains that word “research”, or that it says nothing about bill collection. But will a program

Cryptography and the Internet

51

check this? IPSEC may become the first large-scale use of certificates intended for checking by programs, not humans. Are our certificates adequate for the task?

5

Cryptography versus Cryptographic Engineering

Often, designing cryptosystems for use in the Internet is one of cryptographic engineering. Partly, it’s a matter of translating abstract notions into concrete packet formats. That is relatively simple. It’s harder to find a way to fit cryptography into a protocol that wasn’t designed to accept it. But the hardest job is maintaining security in the face of actual network practice. Consider, for example, the question of encrypting a message M . The academic paper on the subject would likely have said something like “Alice transmits {M }K to Bob”. An implementation specification might say “Use CAST-128 in CBC mode, with key K, an IV as specified above, the whole preceded by a twobyte length field. The receiver’s identity is specified in the previous message.” But even that isn’t sufficient. As we all know, ciphers can be broken. An implementable cryptographic protocol must have some way to indicate which cipher is being used. That in turn raises questions of what ciphers must be common to all implementations. Worse yet, the cipher to be used must be negotiated, and negotiated securely; an enemy who can force the use of DES instead of a more secure cipher may be able to do considerable damage. Often, different security considerations produce contradictory constraints. In [Bel96], I showed that it was much more secure to use a separate key for each connection, as opposed to a single key for all connections between a pair of hosts. But in [Bel97], I showed that per-connection keying aided an enemy cryptanalyst. Which is right? Operational considerations produce their own conflicts. The Domain Name System (DNS) relies on caches, timeouts, and hierarchies of servers to reduce the load on the network. The design, originally specified in 1983 [Moc83], requires that the record’s time-to-live be in the original response to a query, that it be decremented by servers that cache the response, and that this modified value be passed along to any machines that receive their response from the caching server. But that conflicted badly with a later desire to add digital signatures to DNS records [EK97]. Not only would recalculating the signature each time be prohibitively expensive, the caching server does not (and should not) possess the necessary signing key. Thus, the modified time-to-live field cannot be passed along in a secure fashion. Perhaps the lifetime should have been expressed as an absolute expiration time (though that has problems of its own). But Secure DNS is constrained to live with the earlier structure. Secure DNS has run into other complications as well. The format of the signed records was designed to permit the signing operation to be done offline, to safeguard the private key. However, this operational requirement conflicts with the DNS Dynamic Update protocol [BRTV97]. It has also resulted in a situation where the mechanism to indicate that a record does not exist—signed

52

Steven M. Bellovin

front- and back-pointers—can be used by an enemy to learn all of the names in a domain, which conflicts with other security requirements. But safeguarding the signing key is critical; not only does it act as a certificate-signing key, fraudulent DNS records can be used to perpetrate a wide variety of attacks on Internet systems [Bel95]. IPSEC often conflicts with firewalls. A firewall cannot examine, and hence pass or reject, an encrypted packet. Should end-to-end encryption be permitted through firewalls? The fact that a packet is encrypted and authenticated does not mean that it is harmless; an attacker may have penetrated an external system that is authorized to make incoming calls. Even outgoing calls can be used to launch attack. Suppose that a firewall is configured to permit all outbound calls. Naturally, the reply packets must be allowed back in. However, if the port numbers are encrypted the firewall cannot distinguish between a reply packet and a packet attacking a different port on the inside host. There are no good solutions for this problem. Presumably, some sort of keysharing with the firewall must take place. Again, that demands strong verification of the firewall’s right to the information. It may also demand multiparty key negotiation, or perhaps proxy cryptography [BBS98].

6

Protocol Verification

It should come as no surprise that the cryptographic protocols and mechanisms used in the Internet are in need of verification. They are complex, and as we all know, it is very easy to make mistakes in designing even simple cryptographic protocols. But the analysis here is harder, because it must contend with the complexities of real systems and real operational environments. Several examples of this can be found in [Bel96]. In one class of attacks, I showed how replays could be used to trick the host operating system into decrypting messages. There were a number of variants of this attack; the simplest involved waiting until the target program had ended, then binding to its “port” and reinjecting the messages. The key remains secure, but the plaintext is revealed. A more subtle flaw is exploited by Wagner’s short-block guessing attack. The attacker attempts to guess at the contents of packets containing a single byte of application data. It requires a modest (and practical) amount of chosen plaintext (28 blocks) and a simple (28 packet) active attack. If the injected packet contains an erroneous guess of the data byte, the receiving machine will silently discard the packet. If the guess is correct, the network-level checksum will also be correct and the receiving machine will acknowledge the packet. (The ACK messages can be seen as a side channel, similar to those exploited by Kocher in his timing and power consumption attacks.) To my knowledge, existing formal techniques cannot detect attacks such as these. At the very least, the formalism would have to include a complete description of the networking environment, and probably more besides.

Cryptography and the Internet

53

There has already been some useful input from the theory community. IPSEC originally used keyed hash functions as MACs; Preneel and van Oorschot’s attacks on these [Pv95, Pv96] caused us to adopt HMAC [BCK96], an algorithm that was proven to be secure, instead. Unfortunately, the help has not always been appreciated. The resentment has come not because of “interference” but because of its timing. In an environment where the phrase “sometimes it’s time to shoot the engineers and ship the product” can be uttered, a complaint late in the design cycle is often rejected, simply because it’s too late.

7

What Cryptography Can’t Do

Cryptography is not a panacea for the security problems of the Internet. By my count, no more than 15% of the CERT advisories over the last 10 years describe vulnerabilities that would be irrelevant in a world with ubiquitous cryptography. Most of the other advisories concerned buggy programs, a failing that cryptography cannot address. Indeed, there were a number of reports of flaws in assorted encryption and authentication programs. A second problematic area is the existence—dare I say the prevalence?—of bad cryptography. While part of the problem is lack of science—we’re all familiar with new attacks on old algorithms and protocols—more of the trouble is a lack of education. About the time I was writing this note, it was disclosed that a major vendor’s network encryption product inadvertently used DES with a 48bit key size. That was bad enough, though forgiveable and fixable. But the same product used ECB mode, an egregious error described as a deliberate design choice. Other vendors misuse stream ciphers [SM98] or invent their own flimsy algorithms—and then rely on obscurity for protection. Finally, the user interface to cryptographic functions is often lacking. I will give just one example, an encrypting mail program based on a symmetric cryptosystem. To avoid the need for the recipient to have any particular applications software, this program packages up everything into a self-extracting executable that prompts the recipient for the shared secret key. It is adding insult to injury that the keylength employed is a magnanimous 32 bits. . .

References [BBS98]

[BCK96]

[Bel95]

Matt Blaze, G. Bleumer, and Martin Strauss. Divertible protocols and atomic proxy cryptography. In Proceedings of Eurocrypt ’98, 1998. to appear. 52 M. Bellare, R. Canetti, and H. Krawczyk. Keying hash functions for message authentication. In Advances in Cryptology: Proceedings of CRYPTO ’96, pages 1–15. Springer-Verlag, 1996. 49, 53 Steven M. Bellovin. Using the domain name system for system breakins. In Proceedings of the Fifth Usenix Unix Security Symposium, pages 199–208, Salt Lake City, UT, June 1995. 52

54

Steven M. Bellovin

[Bel96]

[Bel97]

[BFL96]

[BFS98]

[BRTV97]

[DvW92]

[EK97]

[HPT97]

[Jon95]

[Kra96]

[MB96]

[Moc83]

[NIS95] [Pv95]

[Pv96] [Riv92] [Riv97]

[RL96]

Steven M. Bellovin. Problem areas for the IP security protocols. In Proceedings of the Sixth Usenix Unix Security Symposium, pages 205– 214, July 1996. 49, 51, 52 Steven M. Bellovin. Probable plaintext cryptanalysis of the IP security protocols. In Proceedings of the Symposium on Network and Distributed System Security, pages 155–160, 1997. 51 Matt Blaze, Joan Feigenbaum, and Jack Lacy. Decentralized trust management. In IEEE Symposium on Security and Privacy, pages 164–173, 1996. 50 Matt Blaze, Joan Feigenbaum, and Martin Strauss. Compliance checking in the PolicyMaker trust management system. In Proceedings of the 2nd Financial Crypto Conference, 1998. to appear. 50 J. Bound, Y. Rekhter, S. Thomson, and P. Vixie. Dynamic updates in the domain name system (DNS UPDATE). Request for Comments (Proposed Standard) 2136, Internet Engineering Task Force, April 1997. (Obsoletes RFC1035). 51 W. Diffie, P.C. van Oorschot, and M.J. Wiener. Authentication and authenticated key exchange. Designs, Codes and Cryptography, page 107, 1992. 47 D. Eastlake and C. Kaufman. Domain name system security extensions. Request for Comments (Proposed Standard) 2065, Internet Engineering Task Force, January 1997. (Obsoletes RFC1034). 51 Ralf Hauser, Tony Przgienda, and Gene Tsudik. Reducing the cost of security in link-state routing. In Proceedings of the Symposium on Network and Distributed System Security, pages 93–99, 1997. 49 Laurent Joncheray. A simple active attack against TCP. In Proceedings of the Fifth Usenix Unix Security Symposium, Salt Lake City, UT, 1995. 46 Hugo Krawczyk. SKEME: A versatile secure key exchange mechanism for internet. In Proceedings of the Internet Society Symposium on Network and Distributed System Security, pages 114–127, February 1996. 47 S.L. Murphy and M.R. Badger. Digital signature protection of the OSPf routing protocol. In Proceedings of the Symposium on Network and Distributed System Security, pages 93–102, 1996. 49 P. Mockapetris. Domain names: Concepts and facilities. RFC 882, Internet Engineering Task Force, November 1983. (Obsoleted by RFC1034); (Updated by RFC973). 51 NIST. Secure hash standard (SHS), April 1995. Federal Information Processing Standards Publication 180-1. 49 B. Preneel and Paul C. van Oorschot. MDx-MAC and building fast MACs from hash functions. In Proceedings of CRYPTO ’95, pages 1–14, 1995. 53 B. Preneel and Paul C. van Oorschot. On the security of two mac algorithms. In Proceedings of Eurocrypt ’96, pages 19–32, 1996. 53 R. Rivest. The MD5 message-digest algorithm. Request for Comments (Informational) 1321, Internet Engineering Task Force, April 1992. 49 Ronald Rivest. All-or-nothing encryption and the package transform. In Proceedings of the Fast Software Encryption Conference, 1997. To appear. 49 Ronald Rivest and Butler Lampson, 1996. Several papers can be found at http://theory.lcs.mit.edu/~cis/sdsi.html. 50

Cryptography and the Internet [SK97]

55

K.E. Sirois and S.T. Kent. Securing the nimrod routing architecture. In Proceedings of the Symposium on Network and Distributed System Security, pages 74–84, 1997. 49 [SM98] Bruce Schneier and P. Mudge. Cryptanalysis of Microsoft’s Point-toPoint Tunneling Protocol (PPTP), November 1998. 5th ACM Conference on Computer and Communications Security, to appear. 53 [SMGLA97] B.R. Smith, S. Murthy, and J.J. Garcia-Luna-Aceves. Securing distancevector routing protocols. In Proceedings of the Symposium on Network and Distributed System Security, pages 85–92, 1997. 49 [Tou96] Joseph D. Touch. Performance analysis of MD5. In Proceedings of ACM SIGCOMM ’95, pages 77–86, 1996. 49

Differential Collisions in SHA-0 Florent Chabaud and Antoine Joux ´ Centre d’Electronique de l’Armement CASSI/SCY/EC F-35998 Rennes Arm´ees, France {chabaud,joux}@celar.fr Abstract. In this paper we present a method for finding collisions in SHA-0 which is related to differential cryptanalysis of block ciphers. Using this method, we obtain a theoretical attack on the compression function SHA-0 with complexity 261 , which is thus better than the birthday paradox attack. In the case of SHA-1, this method is unable to find collisions faster than the birthday paradox. This is a strong evidence that the transition to version 1 indeed raised the level of security of SHA.

1 1.1

Description of SHA Historical Overview

The Secure Hash Standard (SHS) [7] was issued by the National Institute of Standards and Technology in 1993. It was largely inspired from Rivest’s MD4 [5]. However, a certain number of basic blocks of this function were different from MD4 ones, but no explanation was given for the choices. Two years later, an addendum was made to the standard, slightly altering the function [8]. This change was claimed to correct a technical weakness in SHA but no justification was given. Yet, it was reported that a collision attack better than the birthday paradox had been found by the NSA. Independantly, several attacks on the original MD4 function, and its MD5 improvement [6] have been published [2,4]. However, these attacks couldn’t be applied to the Secure Hash Algorithm (neither in the first nor in the second version) because of the expansion used. 1.2

Notation

The symbols we use in this paper are defined Table 1. Besides, we denote by capital letters 32-bits words, and X (i) stand for the value of X used at i-th round of SHA. 1.3

Description of SHA

Description of the Hash Function. The hash functions in the SHA family deal with 512 bits message blocks and output a 160 hash value. This hash value is formed by concatenating 5 registers of 32 bits each. In order to hash a message, several steps are performed: H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 56–71, 1998. c Springer-Verlag Berlin Heidelberg 1998

Differential Collisions in SHA-0

57

Table 1. Notations Notation IFq hX, Y, . . . , Zi + ⊕ ∨ ∧ ROL` (X) Xi

Definition Finite field with q elements. Concatenation of 32-bits words. Addition on 32-bits words modulo 232 . Exclusive or on bits or 32-bits words. Inclusive or on bits or 32-bits words. Logical and on bits or 32-bits words. Rotation by ` bits of a 32-bits word. The ith bit of 32-bits word X, from the least significant 0 to the most significant 31.

1. Pad the message to be hashed by adding a 1, aa appropriate number of 0 and the 64 bits integer representing the length of the message. After this padding operation, the message is formed of a integral number of 512 blocks. 2. Initialize 5 registers of 32 bits A, B, C, D and E with fixed constants: – A = 0x67452301 – B = 0xEFCDAB89 – C = 0x98BADCFE – D = 0x10325476 – E = 0xC3D2E1F0 3. For each message block, copy A, B, C, D and E respectively in AA, BB, CC, DD and EE. Apply the compression function to AA, BB, CC, DD, EE and the message block. This yields AA0 , BB 0 , CC 0 , DD0 and EE 0 . These 5 values are then added respectively to A, B, C, D and E. 4. Output the concatenation of A, B, C, D and E. In the remaining of this paper, we try to find collisions on the compression function, from which collision on the hash function are trivial. Description of the Compression Function. Following [7], we denote by

(0) W , . . . , W (15) the 512 bits input of SHA, constituted by 16 words of 32 bits. The first step of SHA-0 is to perform an expansion on these 512 bits. The result of this expansion is given by the following relation: W (i) = W (i−3) ⊕ W (i−8) ⊕ W (i−14) ⊕ W (i−16) , ∀i, 16 ≤ i < 80 .

(1)

These 80 words of 32 bits are used to alter the five 32-bits words state denoted of the compression by A(i) , B (i) , C (i) , D(i) , E (i)

. The initial state is the input  function. We now denote it A(0) , B (0) , C (0) , D(0) , E (0) . 

The modification of A(i) , B (i) , C (i) , D(i) , E (i) state is performed by the following transformation, where the function f (i) and the constant K (i) are set according to Table 2, and ADD(U, V, W, X, Y ) = U +V +W +X +Y (mod 232 ):

58

Florent Chabaud and Antoine Joux

for i = 0 to 79


A(i+1) = ADD W (i) , ROL5 A(i) , f (i) B (i) , C (i) , D(i) , E (i) , K (i) B (i+1) = A(i)
C (i+1) = ROL30 B (i) D(i+1) = C (i) E (i+1) = D(i)

Table 2. SHA definition of function f (i) (X, Y, Z), and constant K (i) . Round i 0–19 20–39 40–59 60–79

Function f (i) Constant K (i) Name Definition ¯ ∧ Z) IF (X ∧ Y ) ∨ (X 0x5A827999 XOR (X ⊕ Y ⊕ Z) 0x6ED9EBA1 MAJ (X ∧ Y ) ∨ (X ∧ Z) ∨ (Y ∧ Z) 0x8F1BBCDC XOR (X ⊕ Y ⊕ Z) 0xCA62C1D6

The output of the compression function  is the 160 bits word obtained in the fi

nal state A(80) , B (80) , C (80) , D(80) , E (80) . By collision, we understand the stan



dard meaning of finding two input words W (0) . . . W (15) and W 0(0) . . . W 0(15)

(80) (80) (80) (80) (80)  ,C ,D ,E , using the that gives the same 160-bits output A , B 

same initial value A(0) , B (0) , C (0) , D(0) , E (0) . The basic architecture of SHA can be illustrated by Fig. 1. The expansion box 512 2560 to (IF2 ) , that maps can be considered as a linear application from (IF2 )

(0)   W . . . W (15) to W (0) . . . W (79) . This linear mapping is the only difference between first and second version of SHA. More precisely, the extension of SHA-1 is obtained by replacing (1) by the following equation, which differs from (1) by the one bit rotation to the left:   W (i) = ROL1 W (i−3) ⊕ W (i−8) ⊕ W (i−14) ⊕ W (i−16) , ∀i, 16 ≤ i < 80 . (2) We will denote E0 the initial expansion described by (1), and E1 the modified expansion described by (2). This generic architecture defines a family of hash functions that could be derived by changing the expansion box.

2 2.1

Propagation of Local Perturbations in SHA-Like Hash Functions Weakened SHA Variations

The Bare Architecture of SHA. We first want to study the propagation of local perturbations in a fully linear variation of SHA, in order to discriminate between

Differential Collisions in SHA-0

input (512 bits) expansion E 2560 bits · · · 80 blocks of 32 bits · · · ith block at ith iteration

A

ROL5

ADD

B ROL30 C

f

K

D E

Fig. 1. SHA architecture

59

60

Florent Chabaud and Antoine Joux

the roles of the bare architecture of the hash functions on one side and of the elementary building blocks on the other side. Within the compression function of a hash function in the SHA family, there are two sources of non-linearity, the f (i) functions and the addition function ADD. Thus, the first hash function we consider is SHI11 the compression function in the SHA family built by starting from SHA-0 (thus using expansion E0 ) and by replacing the ADD function by an exclusive-or on 5 variables, and all the f (i) by XOR functions. We denote as usual by W (i) the ith word of the expansion (0 ≤ i < 80), and (i) (i) the 32 bits of this word are numbered W0 , . . . , W31 . We now relax the constraints on the W vector and temporary forget that it results from an expansion process. Thus, we can apply any local perturbation (i) on any bit of W . For example, we can negate the value of W1 . This change (i+1) (i+2) (i+3) will modify bit 1 of A , bit 1 of B , bit 31 of C , bit 31 of D(i+4) (i+5) and finally bit 31 of E . If we want to prevent further changes, we need to (i+1) (i+2) (i+3) (i+4) (i+5) , W1 , W31 , W31 and W31 . These new negate the values of bits W6 modifications prevent the change on bit 1 of A(i+1) to change bit 6 of A(i+2) , the change on bit 1 of B (i+2) to change bit 1 of A(i+3) , the change on bit 31 of C (i+3) to change bit 31 of A(i+4) , the change on bit 31 of D(i+4) to change bit 31 of A(i+5) and the change on bit 31 of E (i+5) to change bit 31 of A(i+6) . Thus (i) (i+1) (i+2) (i+3) (i+4) (i+5) , W1 , W31 , W31 and W31 gives two different negating W1 , W6 paths from A(i) , B (i) , C (i) , D(i) and E (i) to A(i+6) , B (i+6) , C (i+6) , D(i+6) and E (i+6) , and yields a local collision. This is summarized in Fig. 2. Note 1. It is clear that what we say for bit 1, can be generalized for any other bit from 0 to 31. However, it will become clear in the following (see Sect. 1), that this choice is the best one for our purpose. Hence, we focus on this value through the rest of this paper. Since everything is linear, we can apply simultaneously as many local collisions as we want and get two different paths from A(0) , B (0) , C (0) , D(0) and E (0) to A(80) , B (80) , C (80) , D(80) and E (80) , the first path using the original W and the second one using the modified one which we denote by W 0 . The question that now arises is “How to choose the local collisions to come back under the condition that both W and W 0 result from an expansion process ?” Choosing the local collisions simply means to build an error vector m0 of 80 (i) bits (numbered from 0 to 79) with a 1 in position i if we want to negate W1 . (i) However, we can’t choose to negate W1 for i ≥ 75, since a perturbation in round i is never corrected before round i + 6, and since all perturbations must be corrected by round 80.   (0) (79) Let m0 , . . . , m0 be one of these error vectors. We deduce from it the E D (−5) (79) perturbative mask on W , M0 = M0 , . . . , M0 defined by: (i)

∀i, −5 ≤ i ≤ −1, M0 = 0 1

SHI1 is a French pun involving cats and dogs.

Differential Collisions in SHA-0 Perturbation

61

Corrections on bits

on bit 1 Initial state A(i) B (i) C (i)

(i)

W6

W1

W31

W31

W31

(i)

A(i+1)

A(i+2)

A(i+3)

A(i+4)

A(i+5)

W1 A1

(i+1)

(i+2)

(i+3)

(i+4)

(i+1)

(i+5)

B (i+5)

B1

(i+2)

C (i+5)

C31

(i+3)

D(i)

D(i+5)

D31

(i+4)

E (i)

E31

E (i+5)

Subscripts denote the perturbed bit of the state.

Fig. 2. SHI1 propagation of perturbation (i)

∀i, 0 ≤ i ≤ 79, M0,k = 0 if k 6= 1; (i)

(i)

∀i, 0 ≤ i ≤ 79, M0,1 = m0

.

This mask is completed by 5 zero-blocks, because the corrective masks are now deduced from this perturbative mask by translation and rotation. The first corrective mask M1 is deduced from M0 by a translation by one round, and a rotation of 5 bits to left. This rotation comes from the description of the SHA transformation (see Sect. 1.3 and Fig. 2). Hence, it applies on bits numbered k = 6. We have:   (i) (i−1) . (3) ∀i, −4 ≤ i ≤ 79, M1 = ROL5 M0 The second corrective mask M2 is deduced from M0 by a translation by two rounds and no rotation (see Fig. 2). (i)

(i−2)

∀i, −3 ≤ i ≤ 79, M2 = M0

.

(4)

Similarly, M3 (resp. M4 , M5 ) are deduced from M0 by translation by three (resp. four, five) rounds, and apply on bits numbered k = 31.   (i) (i−3) ; (5) ∀i, −2 ≤ i ≤ 79, M3 = ROL30 M0   (i) (i−4) ∀i, −1 ≤ i ≤ 79, M4 = ROL30 M0 ; (6)   (i) (i−5) ∀i, 0 ≤ i ≤ 79, M5 = ROL30 M0 ; (7)

62

Florent Chabaud and Antoine Joux

Now, what we need is that the global differential mask M defined by (i)

(i)

(i)

(i)

(i)

(i)

∀i, 0 ≤ i ≤ 79, M (i) = M0 ⊕ M1 ⊕ M2 ⊕ M3 ⊕ M4 ⊕ M5

,

(8)

must be an output of E0 . This condition holds if all masks Mk satisfy (1), which is ensured if the initial perturbative mask satisfies the following equation: (i)

(i−3)

M0 = M0

(i−8)

⊕ M0

(i−14)

⊕ M0

(i−16)

⊕ M0

, ∀i, 11 ≤ i < 80 .

(9)

Moreover, since E0 does not interleave bits (see (1)), we can split the expansion in 32 identical boxes e0 expanding 16 bits to 80 bits, and defined by (1) considered upon bits. The box e0 is small enough to be exhaustively enumerated. The number of possible masks is in fact relatively small, as there are only 128 of the 216 = 65536 possible inputs, that satisfy (9), and the constraint of 5 zeroes on rounds 75 to 79, and thus give a mask m0 . Given such a mask, one can obtain M , and, by reversing the linear application E0 , one can compute the corresponding 512 bits input mask µ such that M = E0 (µ). As the expansion boxes of the SHA  functions are coded in a systematic  way, it is clear that µ = M (0) , . . . , M (15) . For all input W = W (0) . . . W (15) , W 0 = W ⊕ µ has same output by the linear compression function SHI1. Introducing Non Linear Functions. From a Deterministic to a Probabilistic Method. We now want to study the impact of non-linear functions f (i) in the security of hash function from the SHA family. We consider a second function SHI2, the compression function in the SHA family built by starting from SHA-0 (thus using expansion E0 ) and by replacing the ADD function by an exclusive-or on 5 variables. This can also be seen as SHI1 with added non-linear functions f (i) . It can easily be seen that in some cases the f (i) behaves like a XOR. Thus, the previous attack may work. The questions that arise are “When does it work?” and “What is the probability of success?” In order to compute the probability we need to make a detailed analysis of the IF and M AJ functions. Since these functions work in parallel on 32 bits, we need only study what happens on a single bit. Assuming that we study the behavior of the transition from f (i) (B (i) , C (i) , D(i) ) to f (i) (B 0(i) , C 0(i) , D0(i) ), by looking carefully at the rotations and at our perturbation model one can see that different cases can occur: 1. There is no change at all in the inputs, i.e. B (i) = B 0(i) , C (i) = C 0(i) and D(i) = D0(i) . In that case the output f (B 0(i) , C 0(i) , D0(i) ) = f (B (i) , C (i) , D(i) ) does not change and f (i) behaves as XOR. 2. There is a single difference in the entries on bit 1 of B (i) , i.e. B 0(i) = B (i) ⊕21 . In that case, f (i) behaves as a XOR, if and only if f (i) (B 0(i) , C 0(i) , D0(i) ) = f (i) (B (i) , C (i) , D(i) ) ⊕ 21 .

Differential Collisions in SHA-0

63

3. There is a single difference in the entries on bit 31 of C (i) or D(i) (exclusive or). In that case, f (i) behaves as a XOR, if and only if f (i) (B 0 , C 0(i) , D0(i) ) = f (i) (B (i) , C (i) , D(i) ) ⊕ 231 . 4. There are two differences in the entries on bits 31 of C (i) and D(i) , that is to say C 0(i) = C (i) ⊕ 231 and D0(i) = D(i) ⊕ 231 . In that case, f (i) behaves as a XOR, if and only if the output of f (i) does not change f (i) (B 0(i) , C 0(i) , D0(i) ) = f (i) (B (i) , C (i) , D(i) ). We can now look at the three last cases for the M AJ and IF function. For the M AJ function, Cases 2 and 3 behave identically, the change in the output occurs if and only if the two bits of input that do not change are opposite. This occur with probability 1/2. In Case 4, the output does not change if and only (i) (i) if the two bits C31 and D31 change in opposite directions. This occurs with probability 1/2. (i) For the IF function, in Case 2 the output changes if and only if bits C31 and (i) D31 are opposite. This occurs with probability 1/2. In Case 3, the output changes (i) (i) if and only if bit B31 points on the changing bit (i.e. B31 = 1 if C 0(i) = C (i) ⊕231 (i) changes and B31 = 0 if D0(i) = D(i) ⊕ 231 changes), this occurs with probability 1/2. In Case 4, the output will always change, so the probability of good behavior is 0. This implies, that we need to choose a perturbation pattern with no two adjacent perturbations in the IF rounds. More precisely, as the IF rounds occur from round 0 to 19 (see Table 2), and Case 4 involves states C (i) and D(i) , no two adjacent perturbations can appear before round 16, but there may be two adjacent perturbations on rounds 16 and 17, because the propagation of the error will occur for C (i) and D(i) on round 20 (see Fig. 2). Under all our constraints, we were able to find a pattern with a global probability of success of about 1/224 . We represent hereafter the corresponding 80 bits output of the e0 box. The 5 preceding zeroes are just there to recall that this pattern satisfies the constraints developed in Sect. 1: 00000 00100010000000101111 01100011100000010100 01000100100100111011 00110000111110000000 This pattern m0 is ended and preceded by 5 zeroes, and has no two adjacent bits in the 16 first rounds. By the same construction as described in Sect. 1, we obtain a differential mask that can be applied on input word, and gives a collision with non negligible probability. We reference this mask by M. Evaluating the probability of success is quite tricky, because the 16 first rounds must not be included in this evaluation. The reason for this appears when implementing the collision search. Implementing the Collision Search. We now mask M that 

have the differential we can try to apply on any input word W (0) . . . W (15) . In order to check

64

Florent Chabaud and Antoine Joux

whether we have a collision or not, one has to verify for every perturbation, if the correction is done well, that is to say, if the function f (i) behaves like a XOR. Since each perturbation appears in 3 different (successive) f (i) , we need to consider many elementary probabilities. In our example, there are perturbations in positions 2, 6, 14, 16, 17, 18, 19, 21, 22, 26, 27, 28, 35, 37, 41, 45, 48, 51, 54, 55, 56, 58, 59, 62, 63, 68, 69, 70, 71 and 72. Table 3 shows which case each perturbation is related to, for the three f (i) involved. √ Note 2. In Table 3, Case 4 in M AJ case is counted for a probability 1/ 2 for each of the two perturbations involved. In this way, the global overall probability of 1/2 seen above is obtained.

Table 3. Probability of success of mask M in SHI2 model Perturbation in round i 2 6 14 16 17 18, 19, 21 22, 26, 27 28, 35 37 41 45 48 51 54 55 56 58, 59, 62 63, 68, 69 70, 71, 72

f (i+2) case f (i+3) case f (i+4) case

overall probability probability logarithm 1/8 3 1/8 3 1/8 3 = 2 + 1 (see Note 3) 1/4 2 1/2 1

IF IF IF IF IF

2 2 2 2 2

IF IF IF IF XOR

3 3 3 3 –

IF IF IF XOR XOR

3 3 3 – –

XOR

–

XOR

–

XOR

–

1

0

XOR M AJ M AJ M AJ M AJ M AJ M AJ M AJ

– 2 2 2 2 2 2 2

M AJ M AJ M AJ M AJ M AJ M AJ M AJ M AJ

3 3 3 3 3 3 4 4

M AJ M AJ M AJ M AJ M AJ M AJ M AJ XOR

3 3 3 3 3 4 4 –

1/4 1/8 1/8 1/8 1/8 √ 1/4 2 1/4 √ 1/2 2

2 3 3 3 3 2.5 2 1.5

XOR

–

XOR

–

XOR

–

1

0

As the input word is transmitted with no modification through the expansion, it is possible to split the search in two. First, we search W (0) . . . W (14) such that the function f (i) behaves like a XOR when the mask is applied. This occurs with probability 1/26, as the two perturbations involved are in positions 2 and 6. Then, W (0) . . . W (14) being fixed, we try many values of W (15) (of course we must try less than 232 , in practice any large number such as 10000 is satisfactory). Such a W (15) can lead to a collision after 80 rounds if all the other rounds behave nicely. As can be seen on Table 3, this happen with probability 1/226 . Since the

Differential Collisions in SHA-0

65

first part of the construction is done once for many W (15) , the second probability gives the real cost of the enumeration. Note 3. This first evaluation gives an overall probability of 1/226 in place of the claimed probability. But we can further refine this approach and get rid of some of the probability coming from perturbation of round 14. The first function related to this perturbation is the IF function seen in round 16. This function (16) (16) behaves nicely if bits C1 and D1 differs. These bits are known in round 14, (14) (13) since they are copies of A3 and A3 . This allows us to transfer a probability of 1/2 from the second part of the enumeration to the first one. This reduces the probability to 1/225 . The second function related to perturbation of round 14 is the IF function (17) seen in round 17. This function behaves nicely if bit B31 is a 1. Since this bit (16) is a copy of A31 , one can check its correctness just after choosing W (15) , and, if necessary, change bit 31 of W (15) before starting the testing process. This reduces the probability to the announced 1/224 . Note 4. In the case of SHI2, the collision search is very fast and can be performed in less than a half minute. Here is a sample collision: 1a6191b0 062ec496 2270fdbd 002831a9

3c4a331c 48611ca8 2a8090f0 50fe1535

1f228ea2 583401bc 4b12fd98 61ac0d3d

403b7609 399879d0 473cc7a1 f26700ec

3c4a331c c8611ca8 aa8090f0 50fe1535

1f228ea0 d83401be cb12fd98 61ac0d3f

403b7649 b9987990 c73cc7a1 f26700ac

and 1a6191b0 062ec494 2270fdbf 002831a9 both give 1334f224 21a3efc9 b667d2b2 2890013b 56013ca9 after the 80 rounds of the SHI2 function. Introducing Addition. Eventually, before dealing with SHA-0 and SHA-1 we want to study the influence of the addition ADD on our scheme of attack. We consider a third function SHI3, the compression function in the SHA family built by starting from SHA-0 (thus using expansion E0 ) and by replacing the nonlinear functions IF and M AJ by the function XOR. This can also be seen as SHI1 with the addition ADD put back. The new point here is that a perturbation may lead to carries. If we can prevent this from happening, everything will behave nicely as before. At first, it seems that each perturbation bit and each correction bit may lead to carry. This

66

Florent Chabaud and Antoine Joux

would imply an elementary probability of 1/26 per perturbation, and therefore give no usable attack. However, remember that we choose to apply perturbation (i+3) on bit 1 of W (i) thus getting three corrections on bits in position 31 (W31 , (i+4) (i+5) W31 , W31 ). Since there is no possible carry from bit 31, this halves the logarithm of the elementary probability, and this explains our above choice . (i) We can reduce this even further, suppose that W1 is a 0 and that it changes 0(i) (i+1) 0(i+1) to a 1 in W1 , if no carry occurs (probability 1/2) then A1 is a 0 (and A1 (i+1) is a 1). Following this change in the computation of A(i+2) , we see that W6 0(i+1) should be a 1 (and W6 should be a 0), otherwise the correction would lead to a carry. If this condition holds then the correction always occur without carry. The most difficult point is to correct the change in the computation of A(i+3) . (i+2) 0(i+2) to 1 (and W1 to 0). Then the correction As before, we choose to fix W1 (i+2) behaves nicely if the first bit of the result of the XOR function is equal to B1 (i+1) (i+2) (i+2) (i.e A1 ). This is true whenever C1 = D1 (with probability 1/2). (i) The very same arguments show that the probabilities are the same when W1 0(i) is a 1 (and changes to a 2 in W1 ). In fact, the important issue is that a change from 0 to 1 (an incrementation) must be corrected by a change from 1 to 0 (a decrementation) and that a change from 1 to 0 must be corrected by a change from 0 to 1. The elementary probability to consider is formed from a factor 1/2 to ensure that the initial perturbation engenders no carry, and another 1/2 to ensure that the XOR keeps the change in the same direction. Two technical complications arise in this case, the first one is that we need (i) (i+1) (i+2) to build W in such a way that W1 , W6 and W1 will satisfy the above (non-linear) constraints. Since E0 does not interleave bits, we build W1 and W6 at the very beginning and keep them fixed for the rest of the attack. The second complication comes from the fact that nothing prevents us from getting a change (i) (i+2) in W1 , and another in W1 , in that case we get different conditions on W1 and W6 but the elementary probability of 1/4 still holds. In practice, we were able to find a pattern with probability of 1/244 (computed as in the SHI2 case)2 . This pattern is: 00000 01000010100100011110 01011000001110000000 00001100000011011000 00011000101101100000 and we will denote M0 its associated differential mask. Note 5. In this second pattern, we have no condition on adjacent perturbations, since we consider f (i) to always be the XOR function. Thus, one can note that this pattern has two adjacent perturbative bits on rounds 15 and 16. 2

One can refine the enumeration process to force the perturbations of round 16 and 17 and their associated corrections to be successful. The details are too tricky to be explained here, but will appear in the journal version of this paper. This leads to a 240 running time, which was confirmed by our implementation.

Differential Collisions in SHA-0

67

Associated to this pattern, the conditions on bits 1 and 6 of W and the expansion E0 made us choose the following values for these bits: Bit1: 01110010000000011000 10101101011110000110 11010101111101101010 00001001111101010111 Bit6: 00010000000110100000 10110001101001110011 01101101011111000010 00001011101101110111 Note 6. After a few days of computation, we were able to find an explicit collision for SHI3: 53c29e14 0c0abc30 0da433ac 1a3f8b70

44fe051b 3806260d 6337b011 0e7a4620

4a8ce882 76cbeb2f 1041e2a9 25e81245

576e1943 1b8379a8 20b44364 289acb2b

44fe0519 b806260d e337b051 8e7a4622

4a8ce8c2 f6cbeb2d 9041e2ab a5e81245

576e1941 1b8379e8 20b44366 a89acb29

and 53c29e14 8c0abc30 0da433ac 9a3f8b30 both give 983d1f8e e619f190 2e94fa09 0b0d479c 4c536e3e after the 80 rounds of the SHI3 function. 2.2

True SHA-0 Case

Having studied SHI1, SHI2, and SHI3, we now come back to the SHA-0 case. In this case, all perturbations have to be inserted without any carry, as in SHI3 case. Moreover, we need to probe deeper into the analysis of the IF and M AJ functions, that we carried out to deal with SHI2. Let us start with the IF function. As in SHI2, we must consider Cases 2, 3 and 4. Case 4 is always unacceptable in a pattern of attack. In case 3, everything remains the same: the change must go through the IF function, and it happens with probability 1/2. In case 2, the change must go through the function. Moreover, as in SHI3 case, its direction must be preserved. These two conditions are satisfied with probability 1/4. For the M AJ function, we can remark that M AJ never reverses the direction of a change, so that cases 2 and 3 are left unchanged, and each one leads to an elementary probability of 1/2. However, case 4 undergoes an interesting change.

68

Florent Chabaud and Antoine Joux

The new fact, as compared to SHI2, is that as in SHI3, we have the following additional properties: (i+3)

C31

(i+4) D31

(i+1)

= A1 =

(i+2) A1

(i)

= W1 =

,

(i+1) W1

.

This means that in case 4, M AJ behaves as a XOR as soon as the following equation holds, (i) (i+1) , (10) W1 6= W1 (i+3)

(i+4)

and D31 because the result of M AJ does not change if and only if C31 change in opposite directions. Thus, when there are perturbations in round i and i + 1 with 36 ≤ i ≤ 55,, if we add the additional constraints (10) on W1 , then the elementary probability of case 4 for the M AJ function is 1. These conditions are added to the previous ones described for SHI3, when building W1 and W6 . Taking in account all these constraints, we were able to find two good patterns, with probability of success 1/268 (resp. 1/269 ). These patterns are: 00000 00010000000100100000 00100001101101111110 11010010000101010010 10100010111001100000 c=68 00000 00100010000000101111 01100011100000010100 01000100100100111011 00110000111110000000 c=69 We can now build the differential masks deduced from each pattern by the construction of Sect. 1. The second pattern was denoted M in Sect. 1. We denote the first one by M00 . Note 7. The computation of the probabilities can be done from Tables 5 and 4. As explained in Note 3, the perturbation in round 14 is on the boundary between the two enumerations. It contributes to the overall probability of success by a single 1/2. Note 8. Given a pattern M00 (resp. M), once W1 and W6 are chosen according to the constraints, the collision search by itself remains unchanged (see Sect. 1). The expected running complexity is thus 268 (resp. 269 ). However, being more careful when implementing the collision search, we can get rid of the remaining probability implied by the perturbation in round 14. We hence obtain a running complexity of 267 (resp. 268 ). Moreover, in case of M, one can also suppress the probabilities implied by the perturbations in round 16 and 17. This further decreases the probability of success of M to the claimed value of 261 . This ultimate trick can also be used in SHI2 model. Thus, instead of the probability 1/224 obtained in Note 3, we can obtain a probability of 1/220 .

Differential Collisions in SHA-0

69

Table 4. Probability of success of mask M for SHA-0 Perturbation in round i 2 6 14 16 17 18, 19, 21 22, 26, 27 28, 35 37 41 45 48 51 54 55 56 58, 59, 62 63, 68, 69 70, 71, 72

f (i+2) case f (i+3) case f (i+4) case

overall probability probability logarithm 1/32 5 1/32 5 1/32 4+1 1/16 4 1/8 3

IF IF IF IF IF

2 2 2 2 2

IF IF IF IF XOR

3 3 3 3 –

IF IF IF XOR XOR

3 3 3 – –

XOR

–

XOR

–

XOR

–

1/4

2

XOR M AJ M AJ M AJ M AJ M AJ M AJ M AJ

– 2 2 2 2 2 2 2

M AJ M AJ M AJ M AJ M AJ M AJ M AJ M AJ

3 3 3 3 3 3 4 4

M AJ M AJ M AJ M AJ M AJ M AJ M AJ XOR

3 3 3 3 3 4 4 –

1/16 1/16 1/16 1/16 1/16 1/8 1/4 1/4

4 4 4 4 4 3 2 2

XOR

–

XOR

–

XOR

–

1/4

2

Note 9. In the middle of the second 20-rounds block of pattern M with probability 1/269 (basic search) or 1/261 (improved search), we were lucky to find a group of 5 zeroes (in fact 6 but 5 is sufficient for our purpose). This allows us to stop the attack after this group, with a partial collision on 35 rounds of SHA. Here is such a partial collision: 78fb1285 4a4d1c83 a08e7920 38bef788

77a2dc84 186e8429 16a3e469 2274a40c

4035a90b 74326988 2ed4213d 4c14e934

b61f0b39 7f220f79 4a75b904 cee12cec

77a2dc84 986e8429 96a3e469 2274a40c

4035a909 f432698a aed4213d 4c14e936

b61f0b79 ff220f39 ca75b904 cee12cac

and 78fb1285 4a4d1c81 a08e7922 38bef788

both yield after 35 rounds of SHA-0: 7b907fb9 d050108b 88d6e6d6 5c70d4a3 7e06a692 The probability to find such a collision is 1/222 , using the basic collision search, or 1/214 , using the improved collision search.

70

Florent Chabaud and Antoine Joux

Table 5. Probability of success of mask M00 for SHA-0 Perturbation in round i 3 11 14 22, 27, 28 30, 31, 33 34, 35 36 37 38 40 41 43 46 51 53 55 58, 60, 62 66, 68, 69 70, 73, 74

3

f (i+2) case f (i+3) case f (i+4) case

overall probability probability logarithm 3 1/32 5 3 1/32 5 3 1/32 4+1

IF IF IF

2 2 2

IF IF IF

3 3 3

IF IF IF

XOR

–

XOR

–

XOR

–

1/4

2

XOR XOR XOR M AJ M AJ M AJ M AJ M AJ M AJ M AJ

– – – 2 2 2 2 2 2 2

XOR M AJ M AJ M AJ M AJ M AJ M AJ M AJ M AJ M AJ

– 4 4 3 4 3 3 3 3 3

M AJ M AJ M AJ M AJ M AJ M AJ M AJ M AJ M AJ M AJ

4 4 3 4 3 3 3 3 3 3

1/4 1/4 1/8 1/8 1/8 1/16 1/16 1/16 1/16 1/16

2 2 3 3 3 4 4 4 4 4

XOR

–

XOR

–

XOR

–

1/4

2

SHA-1 Case

In the SHA-1 case, the bits are interleaved and therefore it is no more possible to split the expansion in 32 little expansions. However, the invariance by translation is still true. Hence, it is still feasible to deduce the 5 corrective masks from a perturbative one, using the construction of Sect. 1. More precisely, given a perturbative mask M0 that is an output of E1 , Equ. (3) to (7) still hold, and the constructed mask M defined by (8) is again an output of E1 . Finding the perturbative mask M0 can be done using coding theory tools [3], because the mask can be considered as a low-weight codeword of the extension. Performing such a search on E1 leads to some very short codewords as compared to the dimensions of the code. However, with very high probability, no codeword of weight less than 100 exists in E1 , that satisfies the constraints (see Sect. 1), whereas there exists 27 weighted codewords in E0 . As every bit of the perturbative mask M0 implies at least a factor 1/4 in the overall probability of success, our attack will therefore be totally inefficient on SHA-1. However, it remains an open problem to see if differential masks exist in the SHA-1 case, because our attack builds very specific masks.

Differential Collisions in SHA-0

4

71

Conclusion

We have developed a new kind of attack on SHA functions that yields better results than the classical birthday-paradox attack on SHA-0. This attack is related to the well known differential cryptanalysis [1] in that it looks for some kind of characteristic masks that can be added to input word with non trivial probability of unchanging the output of the compression function. The expansion of SHA-1 seems to be designed to counter this kind of attack, which should increase the level of confidence in this standard.

Acknowledgments We wish to thank Matthew Robshaw and the referees for their valuable remarks and improvements to this paper.

References 1. E. Biham, and A. Shamir. Cryptanalysis of the Full 16-Round DES, CRYPTO’92 LNCS 740, pp 487–496, 1993. 71 2. B. den Boer, and A. Bosselaers. Collisions for the compression function of MD5, EUROCRYPT’93 LNCS 773, pp 293–304, 1994. 56 3. A. Canteaut, and F. Chabaud. A new algorithm for finding minimum-weight words in a linear code: Application to primitive narrow-sense BCH codes of length 511, IEEE Trans. Inform. Theory, IT-44(1), pp 367–378, Jan. 1998. 70 4. H. Dobbertin. Cryptanalysis of MD4, Fast Software Encryption LNCS 1039, pp 53–69, 1996. 56 5. R. Rivest. The MD4 Message-Digest Algorithm, CRYPTO’90 LNCS 537, pp 303– 311, 1991. 56 6. R. Rivest. The MD5 Message-Digest Algorithm, Network Working Group Request for Comments: 1321, April 1992. http://theory.lcs.mit.edu/~rivest/Rivest-MD5.txt 56 7. Secure Hash Standard. Federal Information Processing Standard Publication # 180, U.S. Department of Commerce, National Institute of Standards and Technology, 1993. 56, 57, 71 8. Secure Hash Standard. Federal Information Processing Standard Publication # 1801, U.S. Department of Commerce, National Institute of Standards and Technology, 1995 (addendum to [7]). 56

From Differential Cryptanalysis to Ciphertext-Only Attacks Alex Biryukov1 and Eyal Kushilevitz2 1

Applied Mathematics Department, Technion - Israel Institute of Technology, Haifa, Israel 32000. [email protected] 2 Computer Science Department, Technion - Israel Institute of Technology, Haifa, Israel 32000. [email protected]

Abstract. We present a method for efficient conversion of differential (chosen plaintext) attacks into the more practical known plaintext and ciphertext-only attacks. Our observation may save up to a factor of 220 in data over the known methods, assuming that plaintext is ASCII encoded English (or some other types of highly redundant data). We demonstrate the effectiveness of our method by practical attacks on the block-cipher Madryga and on round-reduced versions of RC5 and DES. Keywords: block-ciphers, Madryga, RC5, DES, ciphertext-only attack, differential cryptanalysis, differential-linear attack.

1

Introduction

Differential cryptanalysis [1,12] is a very powerful technique for the analysis of block-ciphers. It has been used with success against many block-ciphers, e.g. [1,2,3,18,4]. One weakness of differential cryptanalysis is that it finds chosen plaintext attacks; these are much less practical than known-plaintext and certainly than ciphertext-only attacks. Ciphertext-only attacks are the most useful attacks on cryptosystems, since they require only passive eavesdropping from the attacker. Such attacks are usually hard to find, since the assumptions on the knowledge of the attacker are minimal. Exceptions include the most basic ciphers, like simple substitution or Vigen`ere [11]. Although there exists a general method for converting any differential chosen plaintext attack into the more favorable known plaintext attack [1], this conversion becomes (almost) impractical due to the huge increase in the data requirements. If a differential attack uses m chosen-plaintext pairs, the correw√ sponding known-plaintext attack will need about 2 2 2m known plaintexts, where w is the block size (in bits) of the analyzed cryptosystem. For example, if a differential attack on a cryptosystem with 64-bit block uses only eight chosen-plaintext pairs, the corresponding known-plaintext attack will require 234 known plaintext-ciphertext pairs, an increase which makes this attack much less practical. H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 72–88, 1998. c Springer-Verlag Berlin Heidelberg 1998

From Differential Cryptanalysis to Ciphertext-Only Attacks

73

In this paper we show a method of converting successful differential chosenplaintext attacks into known-plaintext and even ciphertext-only attacks without loosing as much efficiency as the above mentioned method, and under a reasonable assumption that plaintext comes from a redundant source. Notice that due to plaintext redundancy, the probability of some input differences increases, and the probability of other input differences decreases or even becomes negligible. If the probability of the input differences which are useful for the differential attack is increased (depending on the type of input redundancy and the type of input differences required for the attack on the particular cipher), then the cipher is weaker against the differential attack combined with the redundancy assumption. We show, for example, that under the assumption that plaintext comes from ASCII encoded English encrypted in ECB (Electronic CodeBook) mode, the probability of input differences with small Hamming weight (which are the differences needed for most of the known attacks) increases significantly. Therefore, only about 214 known-plaintexts are needed for a known-plaintext attack of the previous example, saving a factor of 220 in data. Moreover, our observation helps to turn differential attacks into much more desirable ciphertext-only attacks, with modest increase in data. Our efficient conversion method applies also for the combined differential-linear attacks [13], which can be converted into efficient known-plaintext attacks. This paper is organized as follows: In section 3 we outline the principles of our method. Then, we demonstrate its applicability for various ciphers; we start by presenting a new differential attack on Madryga [14,21] with only sixteen chosen plaintext pairs. We use this cipher as a testing ground for the development of our ideas. Then, we proceed to a ciphertext-only attack on Madryga with only several thousand ciphertexts. We continue demonstrating the effectiveness of our approach with a ciphertext-only attack on 4-round RC5 using only 217 ciphertexts, and a known plaintext attack on 6-round RC5 (as of today this is the first known plaintext attack on this cipher) with about 218 plaintext/ciphertext pairs (the previous known-plaintext attack on this cipher [8] required 257 for 6-round RC5 but it was found erroneous [22]). We show a new known-plaintext attack on seven round DES [19] with about 217 known plaintexts.1 Finally we show, that our attacks are applicable not only to ECB mode, but also to the first block of the CBC (Cipher Block Chaining) mode if the initial vector (IV) is unchanged for several datagrams or incremented sequentially, starting from a random value (as is usually the practice on the Internet), and to the counter mode [21]. To conclude, we show that differential attacks are very subjective to the underlying plaintext redundancies. We mark the importance of studying differential attacks on ciphers together with the underlying redundancies of the protocols, they are used in. We also suggest methods, that may help to prevent attacks of the kind described in this paper. 1

For FEAL [16,17] there exist several very efficient known-plaintext attacks which use specific features of this cipher. Our analysis is applicable to FEAL as well but yields inferior results.

74

2

Alex Biryukov and Eyal Kushilevitz

Differential Cryptanalysis

Differential cryptanalysis is a very efficient chosen plaintext attack on blockciphers [1]. The idea of differential cryptanalysis is to analyze pairs of plaintexts instead of single plaintexts. An attacker chooses the difference ∆P between plaintexts (P, P ∗ ) and studies the propagation (avalanche) of the changes in the encryption process. During the attack he searches and then studies the ciphertexts pairs (C, C ∗ ), which exhibit difference ∆C, predicted by his analysis. Let us introduce some terminology related to differential cryptanalysis. The difference between two bit-strings X and X ∗ of equal length is defined as X ⊕ X ∗ = ∆X, where ⊕ is a bitwise XOR operation. We call a pair of plaintexts (P, P ∗ ) a good pair with respect to differential analysis of a cipher, if it exhibits the difference propagation and the output difference ∆C, predicted by the analysis of a cipher. We call noise all pairs that are suspected to be good pairs (i.e. pass all our criteria for good pairs (which we call filters)), but which do not exhibit the difference propagation, predicted by the analysis. It is well known, that unlike other chosen plaintext attacks, differential cryptanalytic attacks can be easily converted to known plaintext attacks [1]. The idea is similar to the Birthday paradox. Denote the length of the blocks in bits by w. Suppose that differential chosen plaintext attack needs m pairs to succeed, and w√ that we are given n ≈ 2 2 2m random known plaintexts and their ciphertexts. These plaintexts can form about 2w · m pairs. Since the block size is w bits, there are only 2w possible different XOR values wand thus, due to the uniform distribution of the plaintexts, there are about 2 2w·m = m pairs for each XOR value (and thus, we expect m pairs with the specific differences, used by the attack). In order to find pairs with useful input differences, one can sort the array of n known plaintext/ciphertexts by plaintexts, and then search for pairs with particular differences; the total complexity of this process is O(n log n). Once these pairs are discovered a regular differential attack on the cipher may begin.

3

On Ciphertext-Only Attacks

In this section we describe our method for converting successful differential attacks into ciphertext-only attacks (and known-plaintext attacks) with huge savings over the method described in the previous section. We show practical cases, where this conversion can be applied very efficiently. The essence of differential cryptanalysis is in studying the differences between plaintexts, without using the plaintexts themselves (although there are many ways of helping the analysis by adding the information about plaintexts). Thus, one can perform a ciphertext-only attack on a cipher as soon as he is able to detect ciphertext pairs that come from good plaintext pairs. Suppose that we are in a ciphertext-only attack scenario and that we are given only a pool of n ciphertexts, without the knowledge of the corresponding plaintexts. It may seem 2 that we will have to check all the n2 pairs, which is usually infeasible, and that we will not be able to detect pairs that exhibit useful input difference (as we show

From Differential Cryptanalysis to Ciphertext-Only Attacks

75

in the previous section). However, two observations may help in our case. First, the structure of the ciphertext difference in a good pair may be very restricted, and thus the search in a sorted pool of ciphertexts will still have O(n log n) complexity. The second observation is related to the possible redundancy of the encrypted plaintexts. Usually not all 2w blocks are ”legal” plaintexts, and the probabilities of possible plaintexts may be very non-uniform. Thus, among the pairs taken from a pool of redundant plaintexts, some differences will be very frequent, and some will never occur. Let us proceed with an important but simple to analyze example of plaintext redundancy. Suppose that the plaintext source, produces blocks of w bits, and has entropy of e bits (so there are w − e redundant bits per block). Suppose also that the entropy is ”bit-local”: a fixed subset of e bits out of w is chosen and may get all 2e possible values uniformly. The other w − e = r redundant bits are fixed to arbitrary values. This sort of redundancy describes many types of computerized information (database records, network packets, etc.). Denote the set of all such blocks as Se , and denote the set of all differences, produced by elements of Se as ∆Se . Let there exist a fast differential attack on the cipher, which succeeds with m chosen pairs, using differences from the set ∆Se . If the differences used by the differential attack are not in ∆Se , then the cipher (taken together with the redundancy assumption) is more secure against this differential attack, than in the general (uniformly random plaintext) case2 . For the described e√ 2 type of redundancy, we can use only ne ≈ 2 2m ciphertexts, which form about 2e m pairs. This pool contains about m pairs with useful input differences for a differential attack. If the corresponding plaintexts are known to the attacker, he can simply sort the table of given plaintexts and search in the sorted table for pairs that exhibit the necessary input differences and proceed to analysis of the pairs as in a regular differential attack. If the corresponding plaintexts are not known, we are in a ciphertext-only scenario. If we expect (due to differential analysis) a ciphertext difference in a good pair to have a definite structure (for example, ∆C should be a particular constant), then the probability for a random pair to have similar ciphertext difference may be as small as 2−w . Suppose for simplicity, that the probability 1 of a good pair is p ≈ m (i.e., one good pair is enough to start a differential attack, which is true in many cases). Since in a ciphertext-only scenario we do not know which m pairs exhibit useful input differences, we can only hope that about one pair in a pool of 2e m pairs of ciphertexts will be good for the differential attack3 . The Signal/Noise ratio (ratio of the probability of a good pair to the probability 2

3

This may lead to a method of strengthening for differentially-weak ciphers. Add redundancy to the plaintext, in a way, that prohibits successful input differences. For example one can use error correcting code (plaintexts be codewords), in order to avoid input differences of low Hamming weight. However, in order to find it we do not need to check all 2e m pairs. If we are looking for a well defined ciphertext difference, search in a sorted pool of ne ciphertexts will have O(ne log ne ) complexity.

76

Alex Biryukov and Eyal Kushilevitz −e

−1

r

m of noise) for the ciphertext-only attack in this case is S/N = 2 2−w = 2m . The attack will be successful if S/N > 1. We can generalize the description above in two ways. First, it may be more useful to consider a set of possible ”good” output differences ∆G of size 2k , rather than one output difference. If differences from the set ∆G are equally likely to r−k appear in a good pair, then the Signal/Noise ratio will decrease to 2 m , but the probability of a good pair will increase (since we relax the conditions on the differential propagation pattern), and thus m will decrease. In this case we have to solve a more complex search problem. For example, we would like to find all pairs with differences of low Hamming weight in reasonable time. We can state this problem as follows:

Problem 1 Find all pairs (si , sj ), i 6= j, in a given set S of n binary words from {0, 1}w , such that dH (si , sj ) ≤ k (here dH denotes Hamming distance). Let us call such pairs k-neighbors. We can reduce this problem to a well studied approximate string matching (approximate dictionary queries) problem. However most of the algorithms for this problem are linear in the document size n. Since we have to call this algorithm n times (to check neighbors of each element of the set), this results in a complexity of O(n2 ), which is the complexity of checking all pairs in the set. In [23] an efficient algorithm, based on tries, which runs in O(k|Σ|k ) expected worst case time (here |Σ| denotes the alphabet size), independently of the document size (n) is presented. Trie indices combine suffixes and so are compact in storage. Applying this algorithm to our problem, we get O(nk2k ) complexity. Though exponential in k, it still provides a better algorithm than exhaustive check of all pairs if log n > k + 1 + log k. Thus, for a set of size 220 , the search of all 15-neighbors can be performed faster than 239 using tries. Since we have seen that redundancy in some cases helps for differential attacks, our second observation concerns another useful type of redundancy — the natural language redundancy. For a natural language L over alphabet A, denote by An the set of all n-grams of the language. Then the n-gram entropy of the language is: X H(X1 , . . . , Xn ) = −P (χn = s) log P (χn = s), s∈An

where χn = (X1 , . . . , Xn ) ∈ An . We say that the language has entropy HL if: HL = lim

n→∞

H(X1 , . . . , Xn ) n

In the case of the English language successive approximations of HL go as: log2 26 ≈ 4.7, the first order approximation (English letter frequencies) gives ≈ 4.2, digram frequencies give ≈ 3.9. Shannon [24] suggests a value of 2.3 bits per letter for eight letter blocks. By various experiments, for large n the entropy decreases into the interval 1.0 ≤ HL ≤ 1.5. By a gambling technique Cover and King [6] give an estimate of 1.3 bits of information per letter. In [5] an upper

From Differential Cryptanalysis to Ciphertext-Only Attacks

77

bound of 1.75 bit per letter is estimated from a large sample of ASCII encoded English text. Our experiments with large English files show, that some differences are very frequently encountered, even in a small quantities of English plaintext. For example, differences with low Hamming weights (especially one-bit differences at the beginning and at the end of the block) are very frequent. For a more detailed study of these differences see Appendix A. This fact can be used in a differential known-plaintext and even in differential ciphertext-only attacks on block-ciphers that are weak with respect to these differences. In the following sections we demonstrate new attacks on Madryga, RC5 and DES which follow the ideas expressed in this section4 . As we explained here and as we will show in the further sections, differential attacks are very subjective to the underlying plaintext redundancies. We stress the importance of studying differential attacks on ciphers together with underlying redundancies of the protocols, they are used in.

4

Attacks on Madryga

We used the Madryga block-cipher [14,21] as a testing ground for the development of our ideas. In the following subsections we describe this cipher and our attacks on it. We first find a very fast differential attack on Madryga, which uses negligible amount of data, and then proceed to a differential ciphertext-only attack on this cipher, which is also very efficient. 4.1

Description of Madryga

Madryga is a blockcipher proposed in 1984 by W. E. Madryga [14]. It was designed for efficient software implementation. It consists of data-dependent rotations and exclusive or’s with the bytes of the key. Madryga was designed as an alternative to DES (with larger key size – 64 bits) in order to permit efficient implementation both in software and hardware. Here is a description of the encryption algorithm. Block size and key size in Madryga may vary, but 64-bit block size was suggested for compatibility with DES. The key size in this case is also 64 bits. The encryption process consists of two nested cycles. The out-most cycle consists of eight iterations of the inner cycle. The inner cycle consists of eight local operations on the block. A work frame (Frame) of three consecutive bytes b1 b2 b3 is chosen in the plaintext block (Text), starting from the second last byte (the block is treated as a cyclic entity). The 64-bit key (Key) is rotated by three bit positions to the right and exclusive or’ed with the 64-bit constant (KeyHash). Rotation amount is extracted from the three least significant bits of b3 . Then the least significant byte of the key is exclusive or’ed with b3 . The concatenation of b1 b2 is rotated by 4

For the rest of the paper, all attacks are described for the English language model of redundancy, but they work even better in the ”bit-local” model of redundancy, when the entropy e is the English language entropy.

78

Alex Biryukov and Eyal Kushilevitz

the rotation amount to the left. Then the working frame is shifted one byte to the right and the process continues. The working frame moves to the right from the starting second-last byte to the starting third-last byte. Here is a Madryga implementation (WORD is 64 bits): /* MADRYGA encryption engine, 64-bit implementation. WORD EncKey; /* Secret Key WORD KeyHash = 0x0F1E2D3C4B5A6978; /* Key Hash Constant WORD Key; /* Work Key WORD Text; /* Plaintext block WORD Frame; /* Work Frame #define FrameMask 0xFFFF #define TextMask 0xFFFFFFFFFFFF0000 Key = EncKey; for(i=0; i < 8; i++){ /* for(j=0; j < 8; j++){ /* Frame = ROTL(Text,8*j)&FrameMask;/* Key = ROTR(Key,3)^KeyHash; /* /* rotation_count = (Text >> (56-8*j)) & Text ^= (Key & 0xFF) << (56-8*j); RotateFrame( rotation_count); /* Text = (Text & ROTR(TextMask,8*j)) | } }

4.2

*/ */ */ */ */ */

Eight rounds */ Eight bytes/block*/ Copy to Frame */ Rotate & XOR */ with Hash */ 0x7;

Copy from Frame */ ROTL(Frame,64-8*j);

Differential Attack on Madryga

In this subsection we present a very efficient differential attack on Madryga, with 82% probability of success, that uses only sixteen chosen plaintext pairs. Another differential attack, using 5000 chosen plaintexts was developed by Shirriff [25]. We start with two observations. The first observation is that keyscheduling in Madryga is very simple: the initial key is at least as long as the block-size (64 bits in our case). In every iteration (every time the work frame is shifted) the key is rotated to the right 3 bits, and exclusive or’ed with the key hash constant. That means that simple equations relate bits of the key at each stage to the bits of the initial key. The second observation is that block-sizes larger than 64 bits may only weaken Madryga. Data-dependent rotations in Madryga are very local, and are the only tool to provide avalanche. It will take much longer for small differences to propagate in a larger block. We note that rotation amounts of the first round are known to an attacker. They are saved before the last byte of the working frame is exclusive or’ed with the corresponding byte of the key. Thus in a chosen plaintext attack, starting with one-bit difference in plaintexts, and setting to zero (or other appropriate value) two rotation amounts that may move this bit, one can assure that onebit difference is preserved after the first round (after eight frame operations)

From Differential Cryptanalysis to Ciphertext-Only Attacks

79

and after the second round, if difference is placed in the upper five bits of the 1 byte. With probability (0.57)4 ≈ 10 (the probability for a difference bit not to influence the rotation amounts after one round is intuitively 58 , but due to weak randomizing properties of Madryga it is slightly lower – 0.57; exact analysis was done by [25] and is confirmed by our experiments) this one-bit difference will propagate to the end of the sixth round (we number the rounds of Madryga 1, 2, . . . , 8). At the 7th and 8th rounds, we allow the difference to propagate arbitrarily (and it is even better for us if the one-bit difference will not be preserved). Due to the very slow avalanche in Madryga, it is clear that starting with chosen plaintext pair differing by one bit, we will see many zeroes in the ciphertext difference. The question is: what information about the secret key can be derived from such a pair. In order to learn more from each pair, we do not care for the behavior of the difference in the last two rounds (similar to the 2R attack in [1]). This may cause many ciphertext differences, but we use a ”go up” idea similar to [4] to trace guesses about the key bits and the difference to a one-bit difference after the sixth round. This way we get more bits of the key from each pair (at least four and up to thirty bits, depending on the difference locations in the last round), and at the same time increase the probability of a good pair. Since each found key bit can be traced exactly to a bit of the initial key (due to a simple keyscheduling algorithm in Madryga), our aim is to find about 30 key bits. The rest can be found by a reduced exhaustive search. Putting together the ideas expressed in this section, we need only about sixteen chosen pairs with one-bit differences in order to find partial information about the secret key. The rest can be done by a reduced exhaustive search, which 1 16 becomes feasible. Success probability of this attack is 1 − (1 − 10 ) ≈ 0.82. 4.3

Ciphertext-Only Attack on Madryga

In this section we demonstrate how our method can be used in order to derive ciphertext-only attacks. The differential attack described in the previous section succeeds with only about sixteen chosen pairs. Therefore the corresponding known plaintext attack, due to the conventional technique [1], will require about 235 known plaintexts. Although this number can be reduced, since any one-bit, and even two-bit input difference will suffice for our attack, the pool of required known plaintexts is still too big. Under a reasonable assumption of highly redundant plaintext (for example English text in ASCII format) the amount of data can be significantly reduced. Let us present an example of a ciphertext-only attack on Madryga with only ≈ 212 ciphertexts, corresponding to English plaintexts (95 printable ASCII characters), taken from the beginning of ”The Hound of the Baskervilles” by 12
Sir Arthur Conan Doyle. In the pool of 22 ≈ 223 English pairs, on the average about 26.6 pairs have one-bit differences. The probability that a one-bit difference will be preserved during six rounds of Madryga is about (0.57)6 ≈ 2−5 (this is lower than in the chosen plaintext case, since we cannot control the location of the difference bit and the surrounding rotation counts before the first

80

Alex Biryukov and Eyal Kushilevitz

round). Thus, about four good pairs are contained in the pool (even more if we consider other small input differences). Some of those can be detected due to low Hamming weight of the ciphertext difference. For any pair suspected to be a good pair, we ”go up” two rounds (using an idea from [4]), performing the necessary guessing, and check if we arrive at a one-bit difference. This idea is a very efficient filter, which helps us to discard almost all wrong pairs. If the pair is good, it provides us with 10–30 bits of the secret key. Combining the guesses from several good pairs we find about 30 bits of the key. The rest can be found by a simplified exhaustive search, or by further analysis of the given ciphertexts. Below, we provide an example of the attack discussed above. Note that plaintexts and Plaintext Differences are unknown to the attacker, and they appear here only for the sake of completeness. We printed only ciphertext pairs with Hamming weight (HW) less than 12 (the probability for a random pair to have such a low Hamming weight is ≈ 2−25 ). The probability for a random pair −58 to have one-bit ciphertext difference is 264 and in this example there are 64 = 2 two such differences5 ! Plain1 Plain2 Plaintext Difference Ciphertext Difference HW ----------------------------------------------------------------------’e have b’ ’u have b’ 1000000000000000 0000008000000000 1 ’t such a’ ’d such a’ 1000000000000000 0010000000000000 1 ’ fr’ ’ br’ 0000000000000400 000000D1E01C0100 11

5

Known Plaintext and Ciphertext-Only Analysis of RC5

RC5 is a fast block-cipher designed by Rivest in 1994 [20]. RC5 has an attractively simple structure. It is also very flexible to changes of parameters. RC5 has adaptable word size w in order to suit processors of different word-lengths, a variable number of rounds r and a variable-length cryptographic key b (so that the user can choose the level of security appropriate for his application). The ”nominal” choice of parameters proposed in [20] is: 32 bit words, 12 rounds and a 16 byte key. This version of RC5 is referred to as: RC5-32/12/16. Another version with 64 bit words and 16 rounds was suggested for future 64 bit architectures (RC5-64/16/16). The main feature of the cipher is intensive use of data dependent rotations. We use a description of RC5 as a so-called Feistel cipher from [8]. Denote by (L0 , R0 ) the left and right halves of the plaintext, and let Si be the ith subkey from the expanded key table S generated before encryption. The particular expansion algorithm has no influence on our cryptanalysis. As in all previous attacks, we assume that the subkeys produced by the key schedule are uniformly random. This is a reasonable assumption which helps us concentrate on the properties of the encryption engine itself (it also simplifies the analysis of probabilities). Let w denote the word size which is 32 for RC5-32/12/16. Then the ciphertext (L2r+1 , R2r+1 ) is calculated by the following equations: 5

Note that one-bit ciphertext differences are less useful to us in this scenario, since they disclose less bits of the key.

From Differential Cryptanalysis to Ciphertext-Only Attacks

81

L 1 = L 0 + S0 R1 = R0 + S1 for i = 2 to 2r + 1 do Li = Ri−1 Ri = ((Li−1 ⊕ Ri−1 ) <<< Ri−1 ) + Si , where r – is the number of rounds, A <<< B denotes the rotation of word A by (B mod w) positions to the left (if w = 32, then the rotation amount is contained in five least significant bits of B), + denotes addition (mod 2w ), and ⊕ denotes bitwise XOR. The two equations in the body of the loop are called half-round. Note that two consecutive half-rounds correspond to one original round of RC5. The two initial equations are called the zeroth half-round. Several attacks on RC5 were published [8,10,4]. Currently the best known attack on RC5-32/12/16 is [4], a differential attack which uses 244 chosen plaintexts. As of today no known-plaintext attack on RC5, even with reduced number of rounds, exists due to recent result [22] which found gaps in the linear attack on RC5 described in [8]. In this section we show a ciphertext-only attack on RC5 up to four rounds using only 217 ciphertexts and a known plaintext attack on RC5 up to six rounds, which requires about 218 known plaintext-ciphertexts. The attack described in [4] uses chosen plaintext pairs with small input differences6 . Our main observation is that, as in the previous section, assuming that plaintext comes from an ASCII encoded English (all 95 printable characters are possible), the probability of a small input difference is very high. This is true due to high redundancy of the English language, and due to the special properties of ASCII encoding (for example, upper and lower case letters differ in exactly one bit, etc.). See Appendix A for a study and examples of one-bit differences in ASCII encoded English. Our experiments show that if the differential attack on RC5 uses m√pairs, the corresponding known-plaintext attack by our method will use ≈ 210 · 2m known plaintexts. For example, since the differential attack on six rounds of RC5 requires 216 chosen plaintexts [4] our method provides a known plaintext attack on six-round RC5 with about 218 known plaintexts. However there are several important differences between the two approaches. First of all, note that the actual probability of a good pair for six rounds of RC5 is estimated in [4] to be about 2−12.6 , and 216 chosen plaintexts are required in order to detect several good pairs. Then, the differential attack generates new pairs according to the ”space oracle” suggested by several good pairs. For example, pairs with the same five least significant bits of L0 and R0 as in a good pair. This increases the probability of finding additional good pairs. In our case, we can also detect the oracle structure, but we cannot use it to a full extent by generating pairs according to it. However, we can still use it in order to refine the filtration process, since many good pairs are missed by the attack at the first stage. In our experiments we used 218 different known plaintexts (taken from books by Charles Dickens) and they resulted in about 216.6 pairs with one-bit 6

This attack uses mainly symmetric two-bit differences like 80000000 80000000, however symmetric differences are more rare than one-bit differences in our case, and thus we use one-bit differences, which are still good enough.

82

Alex Biryukov and Eyal Kushilevitz

difference. Among these we were able to detect six pairs with ciphertext difference Hamming weights less than 20 (the probability for a random pair to pass this test is about 2−16.6 ), ranging from 14 to 19. They belonged to three space oracles: two pairs to one oracle, three to another and one pair to another one. Having detected the space oracles, it becomes possible to detect more good pairs missed by the first step, due to the increase of the Signal/Noise ratio by a factor of ≈ 210 . In fact, the pool of 216.6 plaintexts with one-bit differences contains 8–16 good pairs. This amount of good pairs is enough in order to find about ten bits of the last round subkey of RC5. Although the full attack on RC5 according to [4] will require about 30 good pairs, it seems that a more thorough analysis of the given pool of pairs, assisted by a partial knowledge of the key will defeat six-round RC5 (two-bit and three-bit differences, that we omitted for simplicity of the present description will help). Furthermore, the pool of 217 ciphertexts can be used for a ciphertext-only attack on RC5 with four rounds, and detect several good pairs even for five rounds of RC5. The decrease in the number of rounds is due to more complicated filtration, required by the ciphertext-only attack. The idea of this attack is as follows. We know, that the set of all 233 pairs produced by a given pool contains lots of good pairs (more than 27 good pairs). The problem is that without knowing the corresponding plaintexts we have to check all the possible pairs, which considerably complicates the filtration process. The solution is to search for the differences with lower Hamming weight than in a known plaintext case (less than 10). Note, that oracle information from the plaintexts is unavailable in the ciphertext-only case. However, we are still able to detect about 16 good pairs with low Hamming weights (from 4 to 8 in our experiment) and derive the partial key information from them exactly as in the known plaintext case. Using the partial key information, we can proceed to check the pairs with heavier differences and thus find almost all bits of the last subkey. The attack then continues with the same data, but with RC5 reduced by one-half round. Note, that given a pool of the same size, encrypted by RC5 with five rounds, we still can detect several good pairs with high probability. A natural question that arises here is why we do not continue our attack for more rounds of RC5. For example, due to our calculation the known plaintext √ attack on eight-round RC5 by our method will require about 210 · 2 · 228 = 224.5 known plaintexts which still is a very practical amount of data7 . The problem is that we need different plaintexts. In the case of a redundant source of plaintexts we can easily get about 2nH blocks (where n denotes the size of the block in bytes, and H denotes the entropy a single byte (letter)). For the English language, organized in eight-letter blocks, we can get about 218 –219 different plaintext blocks in a file of similar size (about 30% blocks appear several times in the file of this size). Although it is possible to exceed the 2nH bound due to many rare blocks that there are in English, one will have to request much more data in the search for new blocks. Notice, however, that for 128-bit blocks this bound is 7

A pool of only about 220 different English pairs contains one good pair for eightround RC5 with high probability, but how to detect it?

From Differential Cryptanalysis to Ciphertext-Only Attacks

83

about 230 (due to the larger block size, the entropy is lower — between 1.5 and 1.7, and the distribution of the blocks is much more uniform). Thus, our method is able to penetrate RC5-64/r/16 (a 128-bit version of RC5) for more rounds. We leave the details of this attack for the full version of this paper.

6

Known Plaintext Analysis of DES

The Data Encryption Standard [19] is one of the most important block-ciphers nowadays. In the 90-s two powerful methods of cryptanalysis were developed in attempt to break DES: differential cryptanalysis [1] and linear cryptanalysis [15]. The first attack uses 247 chosen plaintexts, the second uses 243 known plaintexts. A mixed differential-linear approach was developed in [13] and successfully demonstrated on DES reduced to eight rounds. This combined approach starts as a differential attack for four rounds, preserving parity of particular bit subsets, which are then used by linear relations for the last four rounds. Their attack is a chosen plaintext attack with about 512 chosen plaintexts. In this section we show that due to differential behavior of the first rounds of the attack of [13], it is perfectly suitable for our method of converting differential attacks into known-plaintext and ciphertext-only attacks. Note however that we cannot afford structures, that were used in [13] to gain the first round for free and to decrease the data requirements from 1400 to 900 pairs. Thus, our attack works against DES, reduced to seven rounds (and not eight rounds as in [13]). We checked the probability of the input difference used in [13], assuming that plaintext is ASCII encoded English8 . In our experiment we used a file with the book ”David Copperfield” by Charles Dickens. This file contains 218 eight-byte blocks, among these about 217.3 blocks are different. This file contains more than 215 different pairs with one-bit input differences. However these differences are distributed very non-uniformly between the 64 possible bit-locations (see Appendix A). About two thirds of the differences occur in the four least significant bits of the first byte and in the four least significant bits of the last byte. The probability of a one-bit difference is relatively low for the middle bits of the block. Taking into account the initial permutation (IP) of DES (which was irrelevant to the analysis in [13]), the two bit locations toggled by the differential-linear attack occupy bits 42,50 (corresponds to original 2,3 bits) or bits 44,52 (corresponds to original 10,11 bits). In our experiment only 2 + 26 = 28 pairs toggled the first group of bits, but 388 + 1348 = 1736 toggled the second group. This data is more than sufficient, since 1400 pairs can be used by [13]’s attack in order to find six bits of the key with success probability more than 95%. Note that our aim here is to demonstrate how our ideas work in practice and not to provide the most efficient attack in a specific case. This task would require a thorough study of the underlying redundancy together with the cryptanalysis of the cipher. For example, one may find new attacks, which are optimal only in this special case. See table 1 for a summary of our results. 8

The input difference toggles bits 2 and/or 3, or 10 and/or 11, the bits are counted from 1 to 64 from msb to lsb.

84

Alex Biryukov and Eyal Kushilevitz

Cipher Data for the Attack Madryga 16 chosen plaintext pairs or 4000 ciphertexts RC5 (4 rounds) 217 ciphertexts RC5 (6 rounds) 218 known plaintexts DES (7 rounds) 217 known plaintexts

Table 1. Summary of our attacks for English plaintexts or bit-local redundancies with English entropies.

7

Discussion

In this section we discuss modes of operation of block-ciphers in the context of our attacks. See [21] for a full account on available modes of operation for block-ciphers. The attacks described in this paper are applicable first and foremost to redundant data encrypted in ECB mode or to the case, when by an error CBC decryption is performed instead of CBC encryption. However, data for these attacks can be derived from the CBC encryption mode as well in the case, when the initial vector (IV) (which is added to the first block of the plaintext before the encryption) is not frequently changed. Another case is the case of sequential IV increments (for example, a counter starting from a random value). These are common practice on the Internet, and are suggested in [9] and in several other Internet-drafts. This method is used to prevent repetitions of the first block, assuming that the first block of the datagram is constant in many applications. However, this method of IV choice provides many pairs, all with small input differences, which can be used by our attack (given the first blocks of 2k such datagrams we get k · 2k−1 pairs with one-bit differences). Another method of IV choice is the encryption of thee datagram sequence numbers or other incremented entities, and sending IV in clear (explicit IV method) in order to avoid problems with loss, duplication or re-ordering of datagrams. This method is also very vulnerable to our analysis, and so is the case with other cryptographicaly weak pseudo-random IV generators (even having relatively long periods). Note that compression option, available in several protocols, does not influence this attack, since it uses only the first block of the plaintext. A good method of IV choice, that is suggested in several recent Internet-drafts, is the last ciphertext block of the previous datagram. This method seems to provide much better resistance to the attacks described in this paper. Another application of our attack is to the block-cipher counter mode [21]. In this case a sequence of numbers is used as the input to a cipher in order to generate a pseudo-random stream. However, due to the sequential nature of the numbers being encrypted, the attacker obtains lots of data with small input differences, so this mode of operation is particularly vulnerable to our attack. There is a simple and efficient method that may increase the complexity of the present attacks (at least for the types of redundancies, used in our examples).

From Differential Cryptanalysis to Ciphertext-Only Attacks

85

Seeing that a combination of a cipher with ASCII encoded English is dangerous, one can perform a fixed random permutation of the ASCII table. Before the encryption, each plaintext byte is to be substituted for a new, permuted value. Although due to the structure of the language, there still will be many blocks differing only in one symbol, the probability of one-bit differences will decrease considerably. Another method is to use error-correcting code, and let codewords represent possible plaintexts. This way one can eliminate all the low Hamming weight differences in the plaintext. Note however, that adding redundancy to the plaintext must be checked with the other existing attacks.

Acknowledgments We would like to thank the Project Gutenberg [7], which was our source for printed texts in English and Eli Biham for helpful discussions.

References 1. E. Biham, A. Shamir, Differential Cryptanalysis of the Data Encryption Standard, Springer-Verlag, 1993. 72, 72, 72, 74, 74, 79, 79, 83 2. E. Biham, A. Shamir, Differential Cryptanalysis of Feal and N-Hash, Lecture Notes in Computer Science 547, Advances in Cryptology – EUROCRYPT’91, pp.1–17, Springer-Verlag, 1991. 72 3. E. Biham, A. Shamir, Differential Cryptanalysis of Snefru, Khafre, REDOC-II, LOKI and Lucifer, Lecture Notes in Computer Science 576, Advances in Cryptology – CRYPTO’91, pp.156–171, Springer-Verlag, 1992. 72 4. A. Biryukov, E. Kushilevitz, Improved Cryptanalysis of RC5, to appear, proceedings of EUROCRYPT’98. 72, 79, 80, 81, 81, 81, 81, 81, 82 5. P. F. Brown, V. J. Della Pietra, R. L. Mercer, S. A. Della Pietra, An Estimate of an Upper Bound for the Entropy of English, Computational Linguistics, Vol. 18, N. 1, pp.31–40, 1992. 76 6. T. M. Cover, R. King, A Convergent Gambling Estimate of the Entropy of English, IEEE Transactions on Information Theory, Vol. 24, N. 4, pp.413–421, 1978. 76 7. Project Gutenberg, http://www.promo.net/pg 85 8. B. S. Kaliski, Y. L. Yin, On Differential and Linear Cryptanalysis of the RC5 Encryption Algorithm, Lecture Notes in Computer Science 963, Advances in Cryptology – CRYPTO’95, pp.171–184, Springer-Verlag, 1995. 73, 80, 81, 81 9. P. Kharn, P. Metzger, W. Simpson, The ESP DES-CBC Transform, ftp://ftp.isi.edu/in-notes/rfc1829.txt, 1995. 84 10. L. R. Knudsen, W. Meier, Improved Differential Attacks on RC5, Lecture Notes in Computer Science 1109, Advances in Cryptology – CRYPTO’96, pp.216–228, Springer-Verlag, 1996. 81 11. A. G. Konheim, Cryptography: A Primer, New York: John Wiley & Sons, 1981. 72 12. X. Lai, J. L. Massey, S. Murphy, Markov Ciphers and Differential Cryptanalysis, Lecture Notes in Computer Science 547, Advances in Cryptology – EUROCRYPT’91, pp.17–38, Springer-Verlag, 1992. 72

86

Alex Biryukov and Eyal Kushilevitz

13. S. K. Langford, M. E. Hellman, Differential-Linear Cryptanalysis, Lecture Notes in Computer Science 839, Advances in Cryptology – CRYPTO’94, pp.17–25, Springer-Verlag, 1994. 73, 83, 83, 83, 83, 83, 83, 83 14. W. E. Madryga, A High Performance Encryption Algorithm, Computer Security: A Global Challenge, Elsevier Science Publishers, pp. 557–570, 1984. 73, 77, 77 15. M. Matsui, Linear Cryptanalysis Method of DES Cipher, Lecture Notes in Computer Science 765, Advances in Cryptology – EUROCRYPT’93, pp.386–397, Springer-Verlag, 1994. 83 16. S. Miyaguchi, A. Shiraishi, A. Shimizu, Fast Data Encryption Algorithm Feal-8, Review of Electrical Communications Laboratories, Vol. 36, N. 4, pp.433-437, 1988. 73 17. S. Miyaguchi, Feal-N specifications, NTT, 1989. 73 18. S. Murphy, The Cryptanalysis of FEAL-4 with 20 Chosen Plaintexts, Journal of Cryptology, pp.145–154, 1990. 72 19. National Bureau of Standards, Data Encryption Standard, U.S. Department of Commerce, FIPS pub. 46, 1977. 73, 83 20. R. L. Rivest, The RC5 Encryption Algorithm, Lecture Notes in Computer Science 1008, Fast Software Encryption, pp.86–96, Springer-Verlag, 1994. 80, 80 21. B. Schneier, Applied Cryptography Second Edition, John Wiley & Sons, New York, NY, 1996. 73, 73, 77, 84, 84 22. A. A. Sel¸cuk, New Results in Linear Cryptanalysis of RC5, to appear, proceedings of Fast Software Encryption 5, 1998. 73, 81 23. H. Shang, T. H. Merrettal, Tries for Approximate String Matching, IEEE Transactions on Knowledge and Data Engineering, Vol. 8, N. 4, 1996. 76 24. C. Shannon, Prediction and Entropy in Printed English, Bell Systems Technical Journal, Vol. 30, N. 1, pp.50–64, 1951. 76 25. K. Shirriff, Differential Cryptanalysis of Madryga, unpublished manuscript, http://ftp.cs.berkeley.edu/ucb/sprite/www/papers/madryga.ps, October 1995. 78, 79

A

An Example of one-bit English plaintext differences

In this Appendix we present a short study of ASCII encoded English difference behavior. We feel however, that this subject is worth a more thorough study. In the left part of Figure 1 we present the distribution of weights of the differences in a sample of 10000 blocks. We compare several English texts of the same length: a sample from Dickens, a sample from Conan Doyle, a sample from Merkle’s description of Khufu and Khafre block-ciphers and the 1st-order approximation to English (correct letter frequencies) with a sample of 10000 uniformly random blocks. Axis x marks the weights of the difference from 0 to 64. Axis y marks the number of pairs with difference weight x. One sees that all samples behave close to binomial distribution, however the mean of the random sample is around 32 while the mean of all English samples is about 20. This is explained by the fact, that English text consists mainly from ASCII encoded letters, and thus only five least significant bits of each byte (40 bits altogether) may vary, while the 24 most significant bits are constant most of the time. Thus, even before starting the analysis of the language itself, one sees that differences in ASCII encoded English are shifted to the low Hamming weight end. However in

From Differential Cryptanalysis to Ciphertext-Only Attacks

87

the 10000-block Random sample there were no differences with Hamming weight less than 11. The English samples behave very similar to each other, with an exception of the 1st-order English, which is the highest of them. This is at the cost of reduced probability of differences in the low Hamming weight tail of the distribution. However in the main part of this paper we are interested exactly in these low Hamming weight differences (e.g. one, two and three-bit differences). This shows, that simple 1st-order English is a bad approximation, for the needs of our analysis. We observed that first order word approximation and especially second order word approximation, behave very close to the real English in the area of low Hamming weight differences.

Pairs x 106

Pairs x 103 Random

-

5.50 1st ord Merkle

5.00

16.00

Doyle 4.50

Dickens

14.00

4.00 12.00 3.50 10.00 3.00

8.00

2.50

2.00

6.00

1.50 4.00 1.00 2.00 0.50

0.00

0.00 HWeight 0.00

10.00

20.00

30.00

40.00

50.00

Bits 0.00

10.00

20.00

30.00

40.00

50.00

60.00

Fig. 1. Distribution of differences: (a) left figure compares English samples vs. Random sample; (b) right figure shows distribution of one-bit differences.

In the right part of Figure 1 we show the distribution of one-bit differences in English, calculated from a sample of about 217 different blocks, taken from ”David Copperfield” by Charles Dickens. Here we number the bit locations from 0 to 63 (from lsb to msb). As mentioned above, one sees that only about 40 out of 64 bit locations account for significant amounts of one-bit differences (due to ASCII encoding of English letters). One may see that 23 of the differences occur in the four least significant bits of the first byte, and in the four least significant bits of the last byte of the block. The probability of the one-bit differences in the middle bits of the block is relatively low. Below we present an example of English one-bit differences. These are the 85 one-bit differences obtained from a file of 5000 blocks, taken from the beginning of ”The Hound of the Baskervilles” by Sir Arthur Conan Doyle. The same data was used in our ciphertext-only attack on Madryga in section 4.3.

88

Alex Biryukov and Eyal Kushilevitz

’ there h’ ’d left h’ ’ ’ ’ to be a’ ’ntation,’ ’rles’s d’ ’uld be m’ ’ examina’ ’ which s’ ’nding or’ ’ examina’ ’e been a’ ’e moor a’ ’ which c’ ’ have re’ ’ stick, ’ ’ br’ ’ was of ’ ’ have be’ ’?" "Do’ ’" "And’ ’ The ’ ’mer. "’ ’had you ’ ’er and s’ ’act ’ ’nd that ’ ’ the moo’ ’d at the’ ’e that t’ ’n that t’ ’t have b’ ’ Baskerv’ ’"I have ’ ’e upon t’ ’ld count’ ’en ’ ’s. ’ ’and ’ ’d such a’ ’He was a’ ’., from ’

’ there i’ ’d left i’ ’ "’ ’ to be c’ ’ntation.’ ’rles’s f’ ’uld be o’ ’ examine’ ’ which w’ ’nding ov’ ’ examini’ ’e been i’ ’e moor i’ ’ which s’ ’ have se’ ’ stick. ’ ’ fr’ ’ was on ’ ’ have re’ ’?" "To’ ’" "Ind’ ’ the ’ ’mes. "’ ’hat you ’ ’es and s’ ’ast ’ ’nt that ’ ’ The moo’ ’e at the’ ’d that t’ ’o that t’ ’u have b’ ’"Baskerv’ ’ I have ’ ’g upon t’ ’nd count’ ’an ’ ’w. ’ ’ind ’ ’t such a’ ’he was a’ ’n, from ’

0000000000000001 0000000000000001 0000000000000002 0000000000000002 0000000000000002 0000000000000002 0000000000000002 0000000000000004 0000000000000004 0000000000000004 0000000000000008 0000000000000008 0000000000000008 0000000000000010 0000000000000100 0000000000000200 0000000000000400 0000000000000800 0000000000001000 0000000000001000 0000000000080000 0000000020000000 0000010000000000 0000100000000000 0001000000000000 0010000000000000 0010000000000000 0020000000000000 0100000000000000 0100000000000000 0100000000000000 0100000000000000 0200000000000000 0200000000000000 0200000000000000 0200000000000000 0400000000000000 0400000000000000 0800000000000000 1000000000000000 2000000000000000 4000000000000000

’by the l’ ’er and r’ ’ health,’ ’hapter 1’ ’of the m’ ’ted. ’ ’ tha’ ’ to my a’ ’, with a’ ’ tha’ ’ the sta’ ’e last f’ ’ to be c’ ’" "I d’ ’e the re’ ’Holmes, ’ ’ do’ ’ do’ ’ my infe’ ’ the far’ ’ the Med’ ’y of the’ ’ on ’ ’wed, and’ ’ as the ’ ’ed ’ ’ it may ’ ’, d’ ’ds with ’ ’ht that ’ ’s. ’ ’u have b’ ’ that Dr’ ’d in ’ ’f the ch’ ’an ’ ’p upon t’ ’ve ’ ’f which ’ ’e have b’ ’Were the’

’by the m’ ’er and s’ ’ health.’ ’hapter 3’ ’of the o’ ’ted. "’ ’ the’ ’ to my e’ ’, with e’ ’ thi’ ’ the sti’ ’e last n’ ’ to be s’ ’" "I t’ ’e the se’ ’Holmes. ’ ’ lo’ ’ to’ ’ my inve’ ’ the nar’ ’ the med’ ’y on the’ ’ of ’ ’wet, and’ ’ is the ’ ’et ’ ’ It may ’ ’d’ ’es with ’ ’it that ’ ’r. ’ ’t have b’ ’"that Dr’ ’f in ’ ’d the ch’ ’en ’ ’t upon t’ ’re ’ ’n which ’ ’u have b’ ’were the’

0000000000000001 0000000000000001 0000000000000002 0000000000000002 0000000000000002 0000000000000002 0000000000000004 0000000000000004 0000000000000004 0000000000000008 0000000000000008 0000000000000008 0000000000000010 0000000000000010 0000000000000100 0000000000000200 0000000000000800 0000000000001000 0000000000001000 0000000000080000 0000000000200000 0000000800000000 0000080000000000 0000100000000000 0008000000000000 0010000000000000 0020000000000000 0100000000000000 0100000000000000 0100000000000000 0100000000000000 0100000000000000 0200000000000000 0200000000000000 0200000000000000 0400000000000000 0400000000000000 0400000000000000 0800000000000000 1000000000000000 2000000000000000

A Simplified Approach to Threshold and Proactive RSA Tal Rabin IBM T.J. Watson Research Center PO Box 704, Yorktown Heights, New York 10598 [email protected]

Abstract. We present a solution to both the robust threshold RSA and proactive RSA problems. Our solutions are conceptually simple, and allow for an easy design of the system. The signing key, in our solution, is shared at all times in additive form, which allows for simple signing and for a particularly efficient and straightforward refreshing process for proactivization. The key size is (up to a very small constant) the size of the RSA modulus, and the protocol runs in constant time, even when faults occur, unlike previous protocols where either the size of the key has a linear blow-up (at best) in the number of players or the run time of the protocol is linear in the number of faults. The protocol is optimal in its resilience as it can tolerate a minority of faulty players. Furthermore, unlike previous solutions, the existence and availability of the key throughout the lifetime of the system, is guaranteed without probability of error. These results are derived from a new general technique for transforming distributed computations for which there is a known n-out-n solution into threshold and robust computations. Keywords: RSA, threshold signatures, proactive signatures, threshold and proactive RSA

1

Introduction

In the distributed computation model there are problems for which the simplest solution is achieved by requiring that all players participate in the computation. Yet, clearly this requirement mandates to give up other very desirable properties, such as enabling a threshold of players to carry out the computation, and to withstand faulty behavior of players. The question which arises is are these things contradictory or whether we can utilize the simple protocol but still preserve the properties of threshold and robustness. In this paper we present a general paradigm for transforming an all player protocol into a threshold and robust protocol, while maintaining the original simplicity of the protocol. We will apply this paradigm to the specific problem of threshold and proactive RSA. The issue of maintaining secret signing keys in a distributed fashion for long periods of time, while enabling uninterrupted signing capabilities is addressed by threshold signatures and proactive security. H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 89–104, 1998. c Springer-Verlag Berlin Heidelberg 1998

90

Tal Rabin

Threshold signature schemes allow a group of players to “hold” the key and enable them, as a group, to produce signatures. We shall refer to such a scheme as a (t, n)-threshold signature scheme if there are n players and given a message m, any subset of players of size at least t + 1 can generate the signature on m. The scheme is t-secure if no subset of at most t players can compute a signature on a message not previously signed. A player will be considered corrupted if he does not follow his intended protocol. The scheme is t-robust if it can correctly compute signatures even in the presence of up to t corrupted players. The basic assumption for threshold schemes is that there are at most t faults during the lifetime of the system. Proactive signature schemes use threshold signature schemes as the basis but drastically reduce the assumption concerning failures. The lifetime of the system is split into time periods, and in each such time period it is assumed that no more than t players will be corrupted. We shall say that a scheme is t-proactive if it is secure and robust even in the presence of up to t corrupted players in every time period, where the set of corrupted players can change arbitrarily from one time period to the next. The main idea would be to preserve the value of the key but to change its representation from one period to another, so that the representations are independent. Thus, an attacker wishing to compromise the system will need to corrupt t + 1 players in a short period of time. Threshold signatures are part of a general approach known as threshold cryptography which was introduced in the works of Desmedt [Des87], Boyd [Boy89], Croft and Harris [CH89] and Desmedt and Frankel [DF89]1 . Secure robust threshold schemes for discrete log based systems have been given: El-Gamal [CMI93,Har94] and DSS [GJKR96a]. Yet, solutions for RSA seemed more elusive; the need to protect the secrecy of the factors of the composite N , among other things, disabled the direct adaptation of the techniques used in the discrete log cases to RSA. In two independent works [Boy89,Fra89] gave a first simple and elegant solution for distributed RSA, which was to maintain the signing key d (the RSA exponent) in additive form, among n players P1 , ..., Pn . Player Pi would hold a value di , where d = d1 + ...+ dn . This allows for a straight forward signing scheme, as md = md1 · ... · mdn . Thus, each player Pi gives the value mdi which is called the partial signature, and all the partial signatures are combined to form the complete signature on m. The major drawback of the n-out-n additive solution is that it does not provide for threshold (and hence robustness); if each one of these shares is held by a different player, and one of the players crashes we have lost the secret key. Desmedt and Frankel [DF91] initiated the study of threshold-RSA and gave a heuristic solution to the problem, which was followed by provably secure threshold schemes [FD92,DDFY94]. These schemes provided a step forward, however, in order to overcome the problems generated by the structure of the RSA key, very cumbersome mathematical structures were introduced. Two results followed, which used these same structures, but added robustness [FGY96,GJKR96b]. 1

For a ’94 survey we refer to [Des94].

A Simplified Approach to Threshold and Proactive RSA

91

Proactive signatures are part of a general approach known as proactive security which was introduced in the works of Ostrovsky and Yung [OY91] and Canetti and Herzberg [CH94]2 . The notion of proactive signatures and a framework for discrete log based proactive signatures was given in [HJJ+ 97], in particular incorporating the threshold DSS [GJKR96a] into this framework achieves a proactive DSS. The first solution for proactive RSA was given by Jakobsson et al. [JJKY95], but this solution was exponential in the size of the threshold. Frankel et al. [FGMY97a] used a probabilistic construction to enable a nonexponential solution. While being quite efficient for small instances this solution does not seem to scale gracefully. Furthermore, their solution did not have optimal resilience, i.e. it could not tolerate the maximal possible number of corrupted players. In a recent paper by Frankel et al. [FGMY97b] the first realistic and general solution to proactive RSA was given. By introducing new techniques they modified and proved the protocol of [DF91], and further extended it to solve the problem of proactiveness3. Utilizing our new paradigm we present a solution to both the robust threshold RSA and proactive RSA problems. The main advantage of our solutions, over previous ones, is that they are conceptually simple, and allow for an easy design of the system. We return to the construction of sharing the key at all times in additive form, which allows for simple signing and for a particularly efficient and straightforward refreshing process for proactivization. The key size is (up to a very small constant) the size of the RSA modulus, and the protocol runs in constant time, even when faults occur, unlike previous protocols where either the size of the key has a linear blow-up (at best) in the number of players or the run time of the protocol is linear in the number of faults. The protocol is optimal in its resilience as it can tolerate a minority of faulty players. Furthermore, the existence and availability of the key throughout the lifetime of the system, is guaranteed without probability of error.

2

Overview

Achieving Threshold.4 As stated the key will be shared using an n-out-n additive sharing, this results in each player holding an additive share di of the key. The threshold will be achieved through the notion of share back-up. That is, the share di will be further shared using a t-out-n secret sharing scheme. Thus, if at some point a player crashes, we will be able to retrieve that player’s additive share by activating the back-up using the reconstruction process. We shall show later ways to avoid the exposure of the additive share. The threshold property of our scheme will be inherited from the threshold property of the secret sharing 2 3 4

For a survey we refer to [CGHN97]. Some related results appear in [DJ97]. We assume a trusted dealer in our constructions but this can be substituted using the results of [BF97] for generating an RSA key in a distributed manner. Thus, the following description of our protocol starts after the key has been distributed to the players.

92

Tal Rabin

scheme. To achieve robustness the simple threshold secret sharing scheme can be substituted by a verifiable secret sharing scheme (VSS), which can tolerate t malicious faults. Thus, we achieved our goal of maintaining the sharing in additive form while providing threshold. Proactive Refreshing of Shares. The above additive scheme also lends itself nicely to proactivization, which requires to maintain the same key value yet , ..., dnew will to change its representation. A new set of additive shares dnew 1 n be generated by having each additive share di sub divided into di,1 , ..., d and i,n Pn recombining these values into new additive shares by summing dnew = j=1 dj,i . i Pn Pn = d, i.e. a new representation of d. Measures We have that i=1 di = i=1 dnew i need to be taken to ensure that this resharing has been executed properly, this will be done via a comparison of publicly known values. Share Back-up Refreshing. We will say that the share back-up of a player is valid if the value represented by the VSS is the share held by the player. Clearly, this is a requirement without which the whole idea of back-up will not work. The initial dealer is trusted, hence we assume that the back-up is valid. But now that each player has a new additive share, the share back-up needs to be refreshed as well, as it is no longer a valid back-up of the new share. This is achieved by having each player share his new share using a VSS protocol. The verification that the share back-up is valid is carried out through a comparison of values. The most important point to note is that all verifications performed in this process are computed on publicly known information and without any zeroknowledge proofs for possession of discrete log which characterize the solution of [FGMY97b]. Discarding the zero-knowledge proofs from the proactivization process is not only an issue of efficiency in computation/communication, but allows for a simpler design. Achieving Robustness. The decision on when to activate the back-up is more complex. It can be activated in cases where crashes occur, because then we know which share to reconstruct. But in the case where players are acting in a malicious manner, we first have to determine who they are before reconstructing their share from the back-up. This will be done by employing the robustness techniques which enable to verify that a partial signature was generated correctly [FGY96,GJKR96b]. Avoiding Share Exposure. It should be noted that the exposure of a player’s share when he fails does not compromise the security of the system because as long as not all shares are exposed the secrecy of the key is maintained. And as it is an assumption of the model in threshold cryptography that at no time are all the servers crashed or compromised, the security is maintained. Yet, if it is undesirable in some applications (parallel signing) or situations (a simple crash) to expose a player’s share then this can be avoided through the following. The back-up of a value will not be a single VSS but rather the value itself will be split into n parts, one assigned to each player, each such part will be further shared using VSS5 . When a player does not provide the needed partial signature then each part will be privately reconstructed to the player assigned 5

For related techniques see [GHY87]

A Simplified Approach to Threshold and Proactive RSA

93

to it. Parts assigned to faulty players will be reconstructed publicly. Thus, the original share of the player will not be exposed. If at a later time the player recovers from the crash, then his share can be privately reconstructed to him, and he would be required to refresh the back-up (even though it is valid), and then he can resume proper operation. A further extension would also enable the parallel signatures. Practical Efficiency. In the signature generation, when no faults occur, each player needs to compute a single exponentiation using a small key which is about 2 times the length of the RSA modulus. It can be optimized to eliminate the zeroknowledge proofs by checking whether the generated signature is valid. When faults occur there is the need to first check which players are faulty and then to recover the additive share of these players from the back-up. The recovery operation is an execution of a VSS Reconstruction Phase, which is an efficient protocol. Both the signature generation and the proactivization protocols are constant round protocols, even when faults occur. The proactivization process does not require zero-knowledge proofs in any case. General Paradigm The above described solution is in fact a general paradigm for transforming distributed n-out-n computations into threshold and robust computations. Given a distributed n-out-n computation where each player holds inputs which are need for the computation, these inputs need to be shared using a VSS scheme for back-up. The computation is carried out using all n players, but in the event that one (or up to t) of the players fails to cooperate, or is faulty, then his information can be reconstructed from the “back-up” copy and incorporated into the computation. Thus, the simplicity of the n-out-n protocol can be maintained while adding the properties of threshold and robustness.

3

Model

The following description is taken in part from [HJJ+ 97]. Communication Model. We assume that our computation model is composed of a set of n players {P1 , . . . , Pn } who can be modeled by polynomial-time randomized Turing machines. They are connected by a complete network of private (i.e. untappable) point-to-point channels. In addition, the players have access to a dedicated broadcast channel; by dedicated we mean that if player Pi broadcasts a message, it will be recognized by the other players as coming from Pi . These assumptions (privacy of the communication channels and dedication of the broadcast channel) allow us to focus on a high-level description of the protocols. However, it is worth noting that these abstractions can be substituted with standard cryptographic techniques for privacy, commitment and authentication. Yet, in the proactive case, under these substitutions care needs to be given to refreshing the communication keys. Time. Time is divided into time periods which are determined by the common global clock. Each time period consists of a short refresh period, during which the players engage in an interactive refreshing protocol. After the refresh,

94

Tal Rabin

there is a signature generation period, in which the players generate signatures on given messages. The Adversary. We assume an adversary, A, which can corrupt up to t of the n players in the network in each time period. A player is considered corrupted during a time period if he was corrupted during that time period or if he was corrupted during the preceeding refresh period. Furthermore, it is a malicious adversary, i.e. it learns all the information held by the corrupted players, and may cause them to divert from the specified protocol in any (possible malicious) way. We assume the adversary to be computationally bounded, implying that he cannot forge RSA signatures. Furthermore, we assume the adversary to be static6 .

4

Robust Threshold RSA

Following the method set forth in this paper we shall share the RSA secret key by a sum of shares, refer to these shares as additive-shares. We will achieve robustness by generating share back-up, i.e. each such additive-share will be further shared using a robust threshold verifiable secret sharing (VSS) scheme. Thus, we are guaranteed that we will not “lose” the additive-shares. Upon request to generate a signature each player will produce a partial signature under his additive-share. These partial signatures are combined to generate the signature. In order to optimize the protocol we will first verify whether this combined signature is valid, and if it is not then we will proceed to detect the players who have given incorrect partial signatures. We shall have a method which enables a player to prove that his partial signature is correct. If a player fails to provide the system with a correct partial signature his additive-share is reconstructed from the back-up. In order to make the composition of the additive-shares and the shares from back-up work properly, an underlying assumption has been made, and it is that the back-up value of a specific player is in fact the additive-share held by him. For ease of exposition we assume that the original dealer, sharing the secret, is honest and hence this property is satisfied, but when we move into the full proactive solution this will no longer be a valid assumption. Thus, we bear in mind this point, and will return to it in Section 5. We shall start by directly describing the Robust Threshold RSA while assuming a black-box VSS protocol. This VSS protocol enables to share a secret via its Sharing Phase, and to reconstruct a secret using its Reconstruction Phase. Denote this protocol as Feldman-Zn -VSS, (see Section 4.3). The robust threshold RSA is comprised of two protocols, an initial key distribution which is carried out once at the onset of the system. The second is the protocol for generating signatures. These protocols are described in detail in Sections 4.1 and 4.2. 6

In the full paper we shall give a proof for a static adversary at each time period. And another proof for an adaptive adversary, but at a cost in the computations of the zero-knowledge proofs.

A Simplified Approach to Threshold and Proactive RSA

4.1

95

Distributing the Secret Key

Before distributing the secret key we assume that a set-up process has been carried out in which the RSA key generation took place and the RSA key pair has been computed7 . Denote the public key by (N, e) where N = pq and p, q are primes of the form8 p = 2p0 + 1, q = 2q 0 + 1 and p0 , q 0 are primes. The private key is d where ed ≡ 1 mod φ(N ). Furthermore, the parameters of the system are set, i.e. the number of players n and the threshold t, where n ≥ 2t + 1. An element g of high order is chosen. In order to enable the proof of security the 2 4 high order element will be computed by setting g = g0L mod N where g0 is an 4

element of high order and L = n!. After this set-up process the dealer proceeds to share the key d by generating shares which sum up to the private key, and then backing-up each one of the shares using a VSS protocol. Furthermore, as discussed we will need to be able to verify partial signatures generated under each additive-key di . The dealer lays down this ability by generating a witness signature for each additive-key in the form g di mod N . This witness will be utilized in the signature generation protocol in order to verify partial signatures. In order to unify the description Pn for the players we added a public share dpublic , such that d = dpublic + i=1 di . The steps carried out by the dealer are described in Figure 1. ∗ Input: secret key d ∈ Zφ(N) , composite N , element g of high order in ZN number of players n and threshold t 2 2 1. Choose Pn and hand Pi value di ∈R [−nN ..nN ] for 1 ≤ i ≤ n, set dpublic = d − i=1 di . 4

2. Compute and broadcast the witness wi = g di mod N, 1 ≤ i ≤ n. 3. Share the value di using Feldman-ZN -VSS Sharing Phase (Figure 3) on input, value di , high order element g, composite N , the number of players n, and threshold t.

Fig. 1. Secret Key Distribution The size of the key used for signature generation, in our protocol is comparable to that of [FGMY97b], and is 2 log(nN ), and much smaller than that of [DDFY94] which is n log N and [FGMY97a] which is 106 log N for n = 10, t = 4. Our memory requirements are comparable to those of [DDFY94] and are 2n log(nN ), yet larger by a factor of n than those of [FGMY97b]. 7 8

For a distributed key generation process see Boneh and Franklin [BF97] The special form of the primes is required only to enable the efficient protocol of [GJKR96b] for proving that a partial signature is correct. If there is a need to carry out a distributed key generation then the requirement on the format of the primes can be dropped and the techniques of [FGY96] can be employed for verifying the partial signature.

96

4.2

Tal Rabin

Signature Generation

Given a message m, its signature under the public key is md mod N . In our setting this signature needs to be generated by the players in a distributed manner where each individual player uses P his partial key. As the secret key n d d is shared using a sum, i.e. d = d + public i=1 di ∈ Z, we have that m = Pn Q n mdpublic + i=1 di = mdpublic i=1 mdi mod N . Thus, if each player publicizes the di correct value m mod N which we refer to as the partial signature, then the signature can be directly computed from the partial signatures. And in fact the signature can be generated and verified before proceeding to verify each partial signature. Thus, if an error was detected we will require each player to prove that he has generated his partial signature properly. For each share di there is a public witness wi mod N which can be viewed as a commitment to the value di . When player Pi is required to prove the correctness of his partial signature σi , he will prove with respect to the witness wi that the discrete log of the partial signature is equivalent to the discrete log of the witness. If the player fails this proof, i.e. he did not generate a proper partial signature, his share di will be retrieved from the back-up VSS. This results in a constant round protocol even in the presence of faults. The protocol for signature generation is described in Figure 2.

Public information: high order element g, composite N wi mod N for 1 ≤ i ≤ n witness for Pi ’s partial key Input: message m 1. Player Pi publishes partial signature σi = mdi mod N 2. Pi proves using the protocol of [GJKR96b] (see Footnote 8) that DLm σi = DLg wi . 3. If proof fails for player Pi all players reconstruct di using the Feldman-ZN -VSS di Reconstruction Phase (Figure Qn 3), and compute σi = m mod N . dpublic σ mod N . 4. Set SIG(m) = m i=1 i

Fig. 2. Signature Generation

4.3

Verifiable Secret Sharing (VSS) over ZN

In our protocol we need to share a value s ∈ [−nN 2 ..nN 2 ] in a verifiable method. As explained above we are in effect “storing” the value s using the VSS protocol, as a back-up in case one of the players fails. Given that the only motivation for sharing s would be for back-up it seems that we could use any VSS protocol computed over a prime field, where the prime is larger than the possible range of s. In theory this is true, and we could use for example the VSS protocol of [BGW88], which is information theoretically secure. But as we have alluded

A Simplified Approach to Threshold and Proactive RSA

97

to previously we will need to check that the value shared for player Pi using the VSS corresponds to the actual additive-share held by this player. Using general zero-knowledge proofs this could still be done. Yet, we would like to provide more efficient methods for achieving these goals9. Thus, we will depart from carrying out the VSS over a prime field, and modify the protocol to work over the integers. Such solutions have been given by [DF91,FGMY97b], yet their solutions need to satisfy additional properties, which we do not require, hence these solutions are slightly more complex10 . The following protocol is similar to the one described in [FGMY97b], but which satisfies our needs. As the protocol is based on Feldman’s VSS [Fel87], we shall refer to it as Feldman-ZN -VSS. Theorem 1. The protocol described in Figure 3 is a verifiable secret sharing scheme satisfying the properties of unanimity, acceptance of good secrets, verifiability and unpredictability11 . We shall prove only the unpredictability property in Lemma 1 and 2, as the proof of the other properties follow directly from Feldman’s proof [Fel87]. We defer the simulation of the protocol to Section 4.4 where we prove the Robust Threshold RSA. Lemma 1. Given a t-adversary who can corrupt at most t players, the view of the adversary of the secret shares generated by the protocol Feldman-ZN -VSS of a secret s using a polynomial f (x), such that f (0) = s, and of the sharing of a random secret r by a polynomial r(x) with coefficients taken from the appropriate range are statistically indistinguishable. Proof appears in Appendix A. 4

2

∗ Lemma 2. Assume elements g0 , g = g0L (L = n!) of maximal order in ZN . s Given values α1 , ...αt and an additional value g mod N it is possible to compute 4 values g a1 , ..., g at mod N such that the polynomial f (x) = at xt + ... + a1 x + sL satisfies that f (i) = αi for 1 ≤ i ≤ t. 4

Proof. Define the polynomial f (x) =

Pt i=0

Q

Q

αi j6=i

i−j

j6=i (x− j)

4

where α0 = sL.

This polynomial satisfies the property that f (i) = αi for 1 ≤ i ≤ t, thus it remains to be shown that we can compute g raised to the coefficients of 9

10

11

It may be possible to use Feldman’s VSS over a prime field, which also enables efficient proofs of the above mentioned property, but this sharing would also reveal g di mod p. Though this additional information may not weaken the system, we have not found a way to prove its security. [FGMY97b] need to work over groups where the polynomial interpolation can satisfy that the Lagrangian coefficient of each component is easily computed and is in Z. In our protocol when we decide to use the VSS back-up it will be to directly reconstruct it, thus we can expose all shares and there is an option to carry out the interpolation in a prime field (where the prime will be chosen to be of a certain size). For the definition of VSS see [FM88].

98

Tal Rabin

Sharing Phase: Input: secret value s ∈ [−nN 2 ..nN 2 ] and composite N ∗ element g of high order in ZN n number of players, t threshold value The dealer carries out the following steps: 1. choose at , ..., a1 ∈ [−nL2 N 3 ..nL2 N 3 ] and define f (x) = at xt + ... + a1 x + sL 2. compute f (i) ∈ Z for 1 ≤ i ≤ n 4

4

4

and bt = g at , ..., b1 = g a1 , b0 = g sL mod N 3. hand player Pi the value f (i) and broadcast bt , ..., b0 Verification steps:

Qt

j

(b )i if the equation is not satisfied he 1. Player Pi verifies that g f (i) = j=0 j requests that the dealer make f (i) public. 2. The dealer broadcasts all shares requested in the previous step, if he fails to do so he is disqualified. 3. Player Pi carries out the verification of Step 1 for all public shares. If the verification fails the dealer is disqualified. Reconstruction Phase: Input: high order element g, composite N , number of players n, threshold t values bt , ..., b0 mod N 1. Player Pi broadcasts f (i) 2. Pj finds a set I of size t + 1 of indices such that ∀i ∈ I it holds that g f (i) = Qt j (b )i j=0 j 3. P P > 2nN 2 and computes the secret s, s Pj chooses Q a prime −j f (i) j∈I,j6=i i−j /L mod P i∈I

4

=

Fig. 3. Feldman-ZN -VSS this polynomial. Rearranging terms we have that the coefficient of xk is ak = P t Q αi λ for 0 ≤ k ≤ t, where the λk,i are computable known coni=0 (i−j) k,i j6=i

stants. A problem may arise that we would need to deal with fractions, i.e. extract roots, which is infeasible, but this has been solved through the choice of the element g. Thus g ak can be effectively computed as follows: Pt g

ak

i=0

=g

Q

2 α0 λk,0 Lt!

g0

αi j6=i

(i−j)

Qt

λk,i

=

Q

Qt

αi λk,i ) i=1 (g0

i=0 g Q L2 j6=i

αi

j6=i

(i−j)

(i−j)

λk,i

=

s λk,0 L t!

= (g )

Qt

αi λk,i ) i=1 (g0

Q

L2

j6=i

(i−j)

A Simplified Approach to Threshold and Proactive RSA

4.4

99

Proof of Robust Threshold RSA Protocol

Theorem 2. Under the assumption that factoring is intractable the protocol described in Figures 1 and 2 is a constant round secure, robust, threshold RSA scheme, in the presence of t malicious faults where the total number of players is n ≥ 2t + 1. In order to prove the security of our scheme we will use a simulation argument for the view of the adversary. Intuitively, this means that the adversary who sees all the information of the corrupted players and the signature on m, could generate by itself all the other public information produced by the protocol. A simulator for the key distribution and the signature generation is shown in Figure 4. It runs on input the elements g, g0 the value g d mod N which is the commitment to the key d, and the message m and its signature. The proof of Theorem 2 appears in Appendix A.

5

Proactive RSA

In the previous section we have described a robust threshold RSA, and the last property which we would like to add is proactive. Proactiveness is achieved through changing the representation of the key, but not its value. Given that the current representation of the key is d1 + ... + dn we would like to change it to dnew + ... + dnew 1 n . Once we have changed the representation of the key we will also need to change the representation of the back-up, and this is for two reasons: the first being that it contains the current representation and thus it should be removed, the second is that we need to have a valid back-up for the new representation, otherwise the back-up would be worthless. The essence of the proactivization protocol is that each player takes his additive-share di of the key d, splits it into sub-shares which sum up to di , and gives each player such a sub-share. Then each player adds up all the subshares which he received in order to attain his new share for the new time period. If all players act properly it is clear to see that the new sharing is still a sharing of the key d, yet the sharing is totally independent of the previous sharing. Then each player would further share his new additive share using the VSS protocol to generate the share back-up. As we do not assume that the players act properly we add steps to ensure the correctness of the proactivization. The two issues for verification are the following: 1. That the sum of the sub-shares which Pi generated is the value of the share di . This verification is easily achieved by generating witness/commitments to the new additive sub-shares, and checking in the exponent that the distribution was done properly. 2. The second verification relates to the need to ensure that the back-up generated using the VSS is in fact the new additive share held by the player. Note that after the above mentioned verification we have a witness for the

100

Tal Rabin

4

2

Input: elements g0 , g = g0L , the commitment to the signing key g d mod N the number of players and threshold n, t message m, and its signature md mod N Each step of the simulator corresponds to the same numbered step in the appropriate protocol. Note that information held solely by good players is never exposed, and thus we do not simulate it. SIM1 - Computation Secret Key Distribution 1. choose shares dˆ1 , ..., dˆn−1 ∈R [−nN 2 ..nN 2 ] and dˆpublic ∈R [−n2 N 2 ..n2 N 2 + N ] 4

4

ˆ

ˆ

ˆ n−1 = g dn−1 mod N 2. (a) compute w ˆ 1 = g d1 , ..., w dˆpublic Qn−1

4

ˆ

(b) set w ˆ n = g dn = g d /(g w ˆ i ) mod N i=1 3. Feldman-ZN -VSS (a) using Steps 1-3 of Figure 3 share the value dˆi for 1 ≤ i ≤ n − 1, this results in polynomials fˆi (x) such that fˆi (0) = dˆi L, and public information ˆ g aˆi,t , ..., g aˆi,1 , g di L mod N , where fˆi (x) = a ˆi,t xt + ... + a ˆi,1 x + dˆi L (b) generate a polynomial r(x) with coefficients in [−nL2 N 3 ..nL2 N 3 ] and con4 stant term 0. Set fˆn (i) = r(i), 1 ≤ i ≤ t. Using Lemma 2 on input fˆn (i) L for 1 ≤ i ≤ t and w ˆ n compute the values g aˆn,t , ..., g aˆn,1 mod N Signature Generation 4

ˆ

1. (a) compute σ ˆ i = mdi mod N for 1 ≤ i ≤ n − 1 4

Qn−1

σ public i=1 σ ˆ i ) mod N (b) set σ ˆ n = md /(ˆ 2. execute simulation of zero-knowledge proof as in [FGY96,GJKR96b]

Fig. 4. Simulator for Key Distribution and Signature Generation

new additive-share (through some computation), this witness is of the form new winew = g di mod N . Furthermore, when the VSS protocol is carried out for sharing a secret s, a by-product of this computation is the value g sL mod N . Thus in order to verify that the player shared the correct value all that needs to be checked is that g sL = (winew )L mod N . The share-refreshing protocol for the update period is presented in Figure 5. Theorem 3. Under the assumption that factoring is intractable the protocol described in Figures 1, 2 and 5 is a constant round secure, robust, threshold proactive RSA scheme, in the presence of t malicious faults where the total number of players is n ≥ 2t + 1. We omit the simulator and lemmas related to the size of the shares, and the fact that the repeated distribution of the signing key through additive shares

A Simplified Approach to Threshold and Proactive RSA

101

Public information: element g, composite N wi mod N for 1 ≤ i ≤ n Input of player Pi : secret share di such that g di = wi mod N 1. Player Pi randomly chooses values di,j ∈R [−N 2 ..N 2 ] for 1 ≤ j ≤ n, sets

Pn

2. 3.

4. 5.

6.

7.

4

di,public = di − j=1 di,j , computes and broadcasts gi,j = g di,j mod N . Player Pi sends to player Pj the value di,j . Verification of distribution of proper share size and public commitments: Pj verifies that di,j ∈ [−N 2 ..N 2 ] and that gi,j = g di,j mod N if not then he requests that di,j be made public and set gi,j to g raised to this public value. If Pi does not cooperate in Step 3 then his value di is reconstructed using the Reconstruction Phase (Figure 3). Verification that the sub shares Qn in fact sum up to the previous share of Pi : Pj verifies that wi = gi,public j=1 gi,j mod N , if not then player Pi ’s share di is reconstructed using the Reconstruction PnPhase. new = d (note that the value g di mod Pi computes his new share dnew i j=1 j,i Qn di,j mod N is already public), and shares it using Feldman-ZN -VSS N = j=1 g Sharing Phase. This results in a value g sL mod N where s is the secret that Pi shared. new If Pi fails to share his secret or (g di )L 6= g sL mod N then each player Pj exposes dj,i . If Pj fails to expose dj,i then dj is reconstructed by all players.

Fig. 5. Share-refreshing Protocol does not reveal any statistically significant information. These proofs are similar in flavor to the ones appearing in [FGMY97a], and will appear in the full paper.

Acknowledgments Special thanks go to Rosario Gennaro and Hugo Krawczyk for endless conversations on this topic. We thank Jessica Staddon for comments on an earlier version of the paper.

References BF97.

BGW88.

Boy89.

D. Boneh and M. Franklin. Efficient generation of shared RSA keys. In Crypto ’97, pages 425–439, 1997. Springer-Verlag. LNCS No. 1294. 91, 95 M. Ben-Or, S. Goldwasser, and A. Wigderson. Completeness Theorems for Noncryptographic Fault-Tolerant Distributed Computations. In Proc. 20th Annual Symp. on the Theory of Computing, pages 1–10. ACM, 1988. 96 C. Boyd. Digital Multisignatures. In H. Baker and F. Piper, editors, Cryptography and Coding, pages 241–246. Claredon Press, 1989. 90, 90

102

Tal Rabin

CGHN97.

R. Canetti, R. Gennaro, A. Herzberg, and D. Naor. Proactive Security: Long-term Protextion Against Break-ins. CryptoBytes, 3(1):1–8, 1997. 91 CH89. R. A. Croft and S. P. Harris. Public-key cryptography and re-usable shared secrets. In H. Baker and F. Piper, editors, Cryptography and Coding, pages 189–201. Claredon Press, 1989. 90 CH94. R. Canetti and Amir Herzberg. Maintaining security in the presence of transient faults. Crypto ’94, pages 425–438, 1994. Springer-Verlag. LNCS No. 839. 91 CMI93. M. Cerecedo, T. Matsumoto, and H. Imai. Efficient and secure multiparty generation of digital signatures based on discrete logarithms. IEICE Trans. Fundamentals, E76-A(4):532–545, 1993. 90 DDFY94. Alfredo De Santis, Yvo Desmedt, Yair Frankel, and Moti Yung. How to share a function securely. In Proc. 26th Annual Symp. on the Theory of Computing, pages 522–533. ACM, 1994. 90, 95, 95 Des87. Yvo Desmedt. Society and group oriented cryptography: A new concept. In Crypto ’87, pages 120–127, Berlin, 1987. Springer-Verlag. LNCS No. 293. 90 Des94. Yvo G. Desmedt. Threshold cryptography. European Transactions on Telecommunications, 5(4):449–457, July 1994. 90 DF89. Yvo Desmedt and Yair Frankel. Threshold cryptosystems. In G. Brassard, editor, Advances in Cryptology — Crypto ’89, pages 307–315, Berlin, 1989. Springer-Verlag. LNCS No. 435. 90 DF91. Y. Desmedt and Y. Frankel. Shared generation of authenticators and signatures. In J. Feigenbaum, editor, Advances in Cryptology — Crypto ’91, pages 457–469, Berlin, 1991. Springer-Verlag. LNCS No. 576. 90, 91, 97 DJ97. Y. Desmedt and S. Jajodia. Redistributing secret shares to new access structures and its applications. Tech. Report ISSE-TR-97-01, George Mason University, July 1997. ftp://isse.gmu.edu/pub/techrep/97 01 jajodia.ps.gz. 91 FD92. Yair Frankel and Yvo Desmedt. Parallel reliable threshold multisignature. TR-92-04-02, April, Dept. of EE and CS, U of Wisconsin, 1992. 90 Fel87. P. Feldman. A Practical Scheme for Non-Interactive Verifiable Secret Sharing. In Proc. 28th Annual FOCS , pages 427–437. IEEE, 1987. 97, 97 FGMY97a. Yair Frankel, P. Gemmell, P. Mackenzie, and M. Yung. Proactive RSA. In Crypto ’97, pages 440–454, 1997. Springer-Verlag. LNCS No. 1294. 91, 95, 101 FGMY97b. Y. Frankel, P. Gemmell, P. Mackenzie, and M. Yung. Optimal resilience proactive public-key cryptosystems. In Proc. 38th FOCS , pages 384–393. IEEE, 1997. 91, 92, 95, 95, 97, 97, 97 FGY96. Y. Frankel, P. Gemmell, and M. Yung. Witness-based Cryptographic Program Checking and Robust Function Sharing. In Proc. 28th STOC, pages 499–508. ACM, 1996. 90, 92, 95, 100, 104 FM88. P. Feldman and S. Micali. An Optimal Algorithm for Synchronous Byzantine Agreement. In Proc. 20th STOC, pages 148–161. ACM, 1988. 97 Fra89. Y. Frankel. A practical protocol for large group oriented networks. In Eurocrypt ’89, pages 56–61, 1989. Springer-Verlag. LNCS No. 434. 90 GHY87. Z. Galil, S. Haber, and M. Yung. Cryptographic computation: Secure fauttolerant protocols and the public-key model. In Crypto ’87, pages 135–155, 1987. Springer-Verlag. LNCS No. 293. 92

A Simplified Approach to Threshold and Proactive RSA

103

GJKR96a. R. Gennaro, S. Jarecki, H. Krawczyk, and T. Rabin. Robust threshold DSS signatures. In Eurocrypt ’96, pages 354–371, 1996. Springer-Verlag. LNCS No. 1070. 90, 91, 104 GJKR96b. R. Gennaro, S. Jarecki, H. Krawczyk, and T. Rabin. Robust and efficient sharing of RSA functions. In Crypto ’96, pages 157–172, 1996. SpringerVerlag. LNCS No. 1109. 90, 92, 95, 96, 100 Har94. L. Harn. Group oriented (t, n) digital signature scheme. IEE Proc.Comput.Digit.Tech, 141(5):307–313, Sept 1994. 90 HJJ+ 97. Amir Herzberg, M. Jakobsson, Stanislaw Jarecki, Hugo Krawczyk, and Moti Yung. Proactive public key and signature systems. In 1997 ACM Conference on Computers and Communication Security, 1997. 91, 93 JJKY95. M. Jakobsson, S. Jarecki, H. Krawczyk, and M. Yung. Proactive RSA for Constant-Size Thresholds. Upublished manuscript, 1995. 91 OY91. R. Ostrovsky and M. Yung. How to withstand mobile virus attacks. In Proc. 10th PODC , pages 51–59. ACM, 1991. 91

A

Proofs of Theorem and Lemmas from Section 4

Proof. of Lemma 1 Denote the set of players which the adversary has corrupted by Pbad , and w.l.o.g it is a set of maximal size, i.e. |Pbad | = t. We prove that with high probability there exists a sharing of r with a polynomial r(x) which satisfies that for each player Pi ∈ Pbad the share f (i) received in the sharing of s is equal to the share received in the sharing of r, i.e. r(i) = f (i). Furthermore, the coefficients of r(x) are taken from the appropriate range. Define a polynomial h(x), such that h(0) = (s − r)L and for all Pi ∈ Pbad it holds that h(i) = 0. As we have defined the polynomial h(x) in t + 1 points we can interpolate and compute its coefficients. It remains to be shown that the coefficients are integers and to compute their range. X

h(x) =

Pi ∈Pbad ∪{0}

h(i)

Y j6=i,Pj ∈Pbad ∪{0}

x−j i−j

The only non-zero value ofQ h(x) is at evaluation point 0. Thus we have that i the above is equal to (s − r)L Pj ∈Pbad x−j −j . The coefficient of x is: X

Y (s − r)L Q (−j) Pj ∈Pbad (−j) P j∈B B⊂Pbad ,|B|=i Q The value L/ Pj ∈Pbad (−j) is an integer (note L = n!) hence the coefficient of xi is an integer. Furthermore, the coefficient can be bounded (in absolute value) by  X (s − r)Lt! t ≤ (s − r)Lt! ≤ nL2 N 2 (s − r)L ≤ (s − r)L ≤ i!(t − i)! i B⊂Pbad ,|B|=i

104

Tal Rabin

The desired polynomial r(x) is f (x)−h(x), its coefficients are integers and are in the range [−(nL2 N 3 + nL2 N 2 )..nL2 N 3 + nL2 N 2 ]. Thus, the probability that 2 N2 the coefficients of r(x) will not be in the right range is at most t 2(nL22nL N 3 +nL2 N 2 ) = t t u N +1 . Proof. of Theorem 2 Correctness & Robustness. We assume Pn that the dealer carries out his protocol properly12 , hence d = dpublic + i=1 di , wi = g di mod N and the VSS corresponding to player Pi in fact shares the value di . It is easy to see that the signature generation protocol computes the correct value. Security. We give our proof by providing a simulator for the protocol, denoted SIM1, which simulates both the key distribution protocol and the signature generation protocol. Fixing an adversary A, the view of the adversary on execution of the protocol and its view on execution of the simulator are indistinguishable. W.l.o.g. assume that the adversary corrupts players P1 , ..., Pt 13 . We analyze the information viewed by the adversary which is generated by an execution of the protocol and the simulator. Secret Key Distribution 1. dˆi is a random value in [−nN 2 ..nN 2 ] and so is di for 1 ≤ i ≤ t. The value dˆpublic is a random value in [−n2 N 2 ..n2 N 2 + N ] where dpublic is from [−n2 N 2 + d..n2 N 2 + d] these distributions are statistically indistinguishable (details are clear). 2. (a) the values w ˆ i are generated in the same manner as wi and as the additiveshares have the same distribution so do the w ˆ i ’s and wi ’s for 1 ≤ i ≤ n−1 (b) as the distribution of dˆpublic is indistinguishable from that of dpublic so ˆ is the distribution of g dpublic mod N and g dpublic mod N . (c) it is easily argued that the distribution of g r mod N where r ∈ [1..ord(g)] and the distribution of g s mod N where s ∈ [−nN 2 ..nN 2 ] are statistiˆ cally indistinguishable, hence g dn is indistinguishable from g dn (resp.). 3. (a) the simulator carries out exactly the same protocol as the true execution with input values which have the same distribution as the inputs of the protocol, hence the resulting information from the VSS protocol has the same distribution. (b) the argument for this step follows from Lemma 1. Signature Generation 1. (a) follows from the argument on the distribution of dˆi . (b) same argument as in Step 2c 2. follows from the simulation proof of [FGY96,GJKR96a] t u 12 13

We can relax this assumption by introducing more verification steps in the Key Distribution Phase. W.l.o.g that it is the first t players, and that it is no less than t.

New Efficient and Secure Protocols for Verifiable Signature Sharing and Other Applications? Dario Catalano1 and Rosario Gennaro2 1

Dipartimento di Matematica, Universita’ di Catania. Viale A. Doria 6, 95100 Catania. [email protected] 2 I.B.M. T.J.Watson Research Center, P.O.Box 704, Yorktown Heights, NY 10598. [email protected]

Abstract. Verifiable Signature Sharing (VΣS ) enables the recipient of a digital signature, who is not necessarily the original signer, to share such signature among n proxies so that a subset of them can later reconstruct it. The original RSA and Rabin VΣS protocols were subsequently broken and the original DSS VΣS lacks a formal proof of security. We present new protocols for RSA, Rabin and DSS VΣS . Our protocols are efficient and provably secure and can tolerate the malicious behavior of up to half of the proxies. Furthermore we believe that some of our techniques are of independent interest. Some of the by-products of our main result are: a new threshold cryptosystem, a new undeniable signature scheme and a way to create binding RSA cryptosystems.

1

Introduction

The concept of Verifiable Signature Sharing (VΣS ) was introduced by Franklin and Reiter in [14]. VΣS enables the recipient of a digital signature, who is not necessarily the original signer, to share such signature among n proxies so that a subset of them can later reconstruct it. A VΣS protocol is divided in a sharing phase and a recover phase. At the end of the sharing phase each proxy can verify that a valid signature for the given document can be reconstructed. At the end of the recover phase such signature is reconstructed no matter what a malicious subset of proxies may do. Previous Work. In [14] efficient protocols were given for RSA, Rabin, ElGamal, Schnorr and DSS signatures. However their RSA and Rabin VΣS protocols were subsequently broken in [7]. Also their DSS VΣS achieves only an heuristic form of security. In [3] Burmester shows an unifying approach to VΣS based on homomorphism of secret sharing schemes. The approach is very elegant and also secure. ?

Extended abstract. A final version of this paper http://www.research.ibm.com/security/vsigmas.ps

H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 105–121, 1998. c Springer-Verlag Berlin Heidelberg 1998

can

be

found

at

106

Dario Catalano and Rosario Gennaro

However its generality does not yield extremely efficient protocols when applied to typical real-life signature schemes. Thus the question of efficient and provably secure VΣS schemes for RSA/Rabin and DSS was still open. Our Contribution. In this paper we present new protocols for RSA, Rabin and DSS VΣS . Our protocols are efficient and provably secure. They can tolerate a malicious sharer (who tries to share something different from a valid signature) and the malicious behavior of up to half of the proxies during sharing or reconstruction time. Motivation. It is important to notice that VΣS can be solved in theory using known cryptographic techniques for zero-knowledge proofs [22,19] and multiparty computation [20,2,5]. However these solutions are hardly practical. We focus instead on practical solutions since there are several real-life applications which would greatly benefit from secure and efficient VΣS protocols. In order to motivate the problem we present first some of the most interesting applications in which VΣS can be used. The main application of VΣS is the incorporation of digital cash into multiparty protocols. Consider the example of cash escrow: digital cash can be represented as the bank’s signature on a digital coin or e-check. By using VΣS financial institutions can divide the cash among a set of authorities so that only through the cooperation of a threshold of them it is possible to spend it, yet the authorities can verify that they collectively have the cash. A related application is secure distributed auctions: bidders to an auction may be required to verifiably share a signature on a check for the amount of their bid. This way it will be impossible for the winner of the bid to default (since the proxies can reconstruct his check), while the payments of the losers will never be recovered. More generally VΣS is useful when a signed document should become valid only under certain conditions. By verifiably sharing the signature, one makes sure that the signature will be recovered if and only if such conditions are created. Other Applications. We believe that parts of our solution are relevant on their own. For example, in Section 3 we present a new threshold cryptosystem which is possibly of independent interest. VΣS protocols are somewhat related to undeniable signatures (introduced by Chaum in [4]), i.e. signatures that can be verified only with the help of the signer. RSA-based undeniable signatures were recently introduced in [17]. Our RSA construction can be seen as an alternative to [17] (though admittedly a less efficient scheme). Interestingly the structure of our RSA VΣS protocol can also be used to construct binding RSA cryptosystems. In [31] the concept of binding cryptography was introduced. In a binding publickey cryptosystem the sender encrypts a message under both the public key of the receiver and the public key of a third party and prove in (non-interactive) ZK that the two ciphertexts contain the same message. In [31] a scheme for binding ElGamal was presented. We show that our RSA VΣS scheme can be used to construct binding RSA public key encryptions. Details about these applications can be found in the final paper.

Protocols for Verifiable Signature Sharing and Other Applications

1.1

107

Overview of Our Solution

Let Bob be the signer, Alice the recipient of the signature and P1 , . . . , Pn the proxies (see Section 2 for a detailed description of the model). The RSA scheme. Let (NB , vB ) be Bob’s RSA public key. The matching signing key is sB such that sB vB = 1 mod φ(NB ). We assume the standard “hashand-sign” paradigm. Alice receives a message M from Bob and Bob’s signature S = msB mod NB on it where m = H(M ) for some collision-resistant hash function H. Alice wants to verifiably share the value S among the proxies P1 , . . . , Pn . That is, at the end of the sharing phase the proxies must be assured that they hold shares of Bob’s signature on m (from now on we will drop the hashing step since it is irrelevant to our purposes). Our new RSA VΣS scheme is based on a completely novel approach. Alice will not share S using conventional secret sharing schemes, but instead she will encrypt S using a threshold cryptosystem, i.e. a public key whose matching secret key is kept shared at the proxies. That is, she gives to the proxies the values m and CS = EEK (S) where E is a public key encryption scheme and the decryption key DK is shared at the proxies, i.e. each proxy Pi has a share DKi of a t-out-of-n secret sharing of DK. At this point all we need is a mechanism to convince the proxies that the decryption of CS is really the signature S on m without revealing S. The crux of the problem was to design a threshold cryptosystem that would make such proof efficient. The main idea here is to use the ElGamal encryption scheme [10,11] over the same composite modulus NB over which the signature was computed. This will allows us to construct efficient methods to convince the proxies that the ciphertext contains the signature. We present two such methods. (1) One is for Alice to provide a zero-knowledge proof [22] that CS contains S. We present an efficient ZK proof for this task. (2) The other variant consists on the proxies using their private key to decrypt a message CˆS publicly computable from CS . If such decryption equals the message m, then the proxies are guaranteed that CS contains the signature S. Method (1) is more efficient for the proxies, but requires interaction with Alice. Method (2) is more efficient for Alice and requires no interaction between her and the proxies. The solution is described in detail in Section 4. The DSS scheme. The DSS VΣS scheme is a modified version of the ElGamal VΣS scheme from [14] which allows for a proof of security. The solution is described in Section 5. 1.2

Related Work

Some ideas in our new RSA VΣS scheme have appeared previously in the literature although in different contexts and with different usage. Performing secret sharing by encrypting a value with a symmetric key that is shared among the proxy appeared first in [23] as a way to shorten the size of shares in computationally secure secret sharing schemes.

108

Dario Catalano and Rosario Gennaro

The idea of encrypting a signature and then proving in ZK that the ciphertext contains a valid signature has appeared in several places. In [8] it was proposed as a general paradigm to construct undeniable signatures but the specific efficient solutions work only for ElGamal-like signatures. In [1] this technique was used to construct fair exchange of digital signatures between two parties using an off-line trusted center. The paper is not concerned with using a threshold cryptosystem for encrypting the signature. Moreover they present general solutions for RSA and DSS signatures using any kind of public-key encryption but employing inefficient binary cut-and-choose ZK proofs which require a number of public-key operations which is proportional to the security parameter. Stadler in [30] uses ElGamal over a composite to verifiably encrypt e-roots. But when it comes to share such encryptions, his scheme can only deal with additive access structures, thus resulting in an O(nt ) exponential blow-up to achieve a t-out-of-n threshold scheme. The construction of an ElGamal-like threshold cryptosystem over a composite modulus uses techniques from the areas of threshold [9,15] and proactive [13,27] RSA signature schemes.

2

Preliminaries

The Model. We assume there are three entities. The signer (which in the following we will usually call Bob), the recipient (Alice) and a set of n proxies. The VΣS protocol will be between Alice and the proxies and must not involve Bob. We assume that Alice and the proxies are connected by a full network of private channels and by a broadcast channel. These assumptions allow us to focus on a high-level description of the protocols. However, it is worth noting that these abstractions can be substituted with standard cryptographic techniques for privacy, commitment and authentication. In some of the variations of our protocols it will not be necessary to have private channels between Alice and the proxies. We assume that there exist an adversary A who can corrupt Alice and at most t of the proxies. By corrupting a player, A can read his memory and cause him to deviate arbitrarily from the protocol. We assume the adversary is static i.e. the set of corrupted players is decided at the beginning of the computation of a protocol. Finally we assume communication to be synchronous. We do however allow for rushing adversaries, i.e. adversaries who decide the messages of the bad players at round R after having seen the messages of the good players at the same round. Notation. In the rest of the paper n will denote the number of proxies and L = n!. If N is a composite modulus, we denote with G0 an element of maximal 2 ∗ and with G = GL order in ZN 0 mod N . DLogG A mod N is the discrete log in base G of A modulo N . Definition. We follow the ideas in the definition of VΣS presented in [14], although we believe our formalization to be simpler and more rigorous. VΣS consists of a pair of protocols (ΣShare , ΣRecover ) for Alice and the proxies. The input of ΣShare for all the players is a message m and the public

Protocols for Verifiable Signature Sharing and Other Applications

109

verification key V K of the signer. The secret input for Alice is a signature S of m under the signer’s key. The output of ΣShare for each proxy Pi is a value Si , which can assume the special value Si = ω denoting that the proxy has rejected the sharing. The protocol ΣRecover is then run on the output of ΣShare by the proxies. We say the VΣS = (ΣShare , ΣRecover ) is a Verifiable Signature Sharing protocol with fault-tolerance t if for any adversary A that can corrupt Alice and at most t proxies the following conditions are met: completeness If Alice is not corrupted then the output of ΣRecover is a signature S on m under the signer’s key V K. soundness If a good proxy Pi outputs Si = ω at the end of ΣShare then each good player Pj outputs Sj = ω. If Si 6= ω for good players then the output of ΣRecover is a signature S on m under the signer’s key V K. security Define the view V of the adversary A as the set of messages sent and received by the bad players (including the broadcasted ones) at the end of ΣShare . Then there exists an algorithm S called the simulator which on input only m and V K and black-box access to A, produces output strings with a distribution which is computationally indistinguishable from V. We accept a negligible probability (over the coin tosses of the players) that these conditions are violated. Informally, completeness means that if Alice really shares the right signature, then, no matter what malicious proxies do, the signature will be recovered at the end. Soundness means that if Alice is malicious, then either she will be caught trying to cheat (i.e. sharing something different from a valid signature) or she will share a valid signature anyway. Security finally says that a run of ΣShare gives the adversary no information he could not compute on his own from the message and the public key. In particular (unless the signature scheme is not secure) no information about the signature S. Computational Assumptions. Our RSA VΣS protocol uses the so-called Decisional Diffie-Hellman Assumption (DDH) over a composite modulus. Informally this assumption says that given two random Diffie-Hellman “public keys” A = Ga and B = Gb the resulting shared key Gab is indistinguishable from a random value to an observer who does not know any of the secret keys a, b. More formally stated: Assumption 1 Let N be a composite modulus product of two large primes. ∗ Let G be an element of ZN and G the group generated by it. Consider the two probability distributions on G 3 defined as DH = (Ga , Gb , Gab ) mod N and R = (Ga , Gb , Gc ) mod N for a, b, c chosen randomly and uniformly in ZN . We assume that the two distributions are computationally indistinguishable. The Decisional Diffie-Hellman Assumption is related to the regular Diffie-Hellman assumption that says that given Ga and Gb one cannot compute Gab in polynomial time. Clearly this assumption relies on the hardness of computing discrete logs. Reductions in the inverse direction are not known.

110

Dario Catalano and Rosario Gennaro

ElGamal over a composite. We recall the functioning of the ElGamal encryption scheme [10,11] over a composite modulus [24,29]. The public encryption key is EK = (N, G, Y ) where N is an RSA modulus product of two primes, G ∗ is an element of ZN of large order and Y is computed as Y = GX mod N with X ∈R ZN . X is the secret decryption key. A message M is encrypted under EK by choosing a random K ∈R ZN and computing A = GK mod N and B = Y K · M mod N . The ciphertext is the pair (A, B). Decryption of a pair (A, B) is computed by taking M = B/AX mod N . Notice that in order to decrypt, all it is required is to raise A to the secret exponent X. The ElGamal encryption scheme can be thought as a one-time pad with a one-time Diffie-Hellman key (the value Y K = GXK ). Thus if the message M is in the same group generated by G it is an easy task to show that the DDH implies the semantic security of the ElGamal encryption scheme (semantic security defined in [21], means that it is impossible for an observer to distinguish between the encryption of two messages). If the message space is larger than the group generated by G then the semantic security of the ElGamal encryption scheme is a seemingly stronger assumption than the DDH. 2.1

Tools

We will use the polynomial-based t-out-of-n secret sharing due to Shamir [28]. Let q be a prime: given a secret σ ∈ Zq , the dealer chooses at random a Pt polynomial f (z) = σ + j=1 aj z j of degree t and gives to player Pi a share σi = f (i) mod q. Clearly t players have no information about the secret while t+1 can reconstruct it by polynomial interpolation. Notice that a (n−1)-out-of-n secret sharing can be obtained simply by sharing σ as a sum σ = σ1 + . . . + σn . Basic secret sharing protocols cannot cope with a malicious dealer who gives out random points that do not lie on a polynomial of degree t and/or with malicious players who contribute false shares at reconstruction time. A Verifiable Secret Sharing (VSS) protocol [6] solves these problems. Here we recall Feldman’s VSS [12]. The dealer follows Shamir’s scheme but in addition he broadcasts the values α0 = g σ mod p and αj = g aj mod p where p is a prime such that q divides p − 1 and g is an element of order q in Zp∗ . The α values will allow the players to check that the values σi really define a secret by checking that Q j g σi = j αij mod p. If the value they hold is inconsistent they complain about the dealer who will reveal their share (that should match the above equation). The α values also allow detection of incorrect shares σi0 at reconstruction time. This protocol can tolerate up to t = n/2 malicious faults including the dealer. Notice that the value of the secret is only computationally secure, e.g., the value g σ mod p is leaked. To avoid this problem it is possible to use Pedersen’s VSS [26] which protects the secret in an information-theoretic sense. P In this implementation the dealer chooses a second t-degree polynomial f 0 = j bj z j and sends the value τi = f 0 (i) mod p to player Pi in addition to the share σi as above. The dealer then commits to each coefficient of the polynomials f, f 0 as follows: he publishes the values βj = g aj hbj mod p where h is an element in the subgroup generated by g such that the discrete log of h in base g is

Protocols for Verifiable Signature Sharing and Other Applications

111

unknown. ThisQwill allow the players to check the received shares by checking j that g σi hτi = j βji mod p. At revealing time the players are required to reveal both σi and τi and the above equation is used to validate the shares. It is possible to prove that the VSS fails if and only if the adversary is able to compute the discrete log of h in base g. Notice that the value of the secret is unconditionally protected since the only value revealed is β0 = g σ hb0 .

3

A New Threshold Cryptosystem

Our RSA VΣS scheme relies on a new ElGamal-based threshold cryptosystem which we present in this section. We believe this new threshold cryptosystem to be of independent interest. Although the construction of this ElGamal-based threshold cryptosystem is new, the techniques used in this section appears in several papers related to threshold [9,15] and proactive [13,27] RSA signature schemes. Threshold Cryptosystems. Let E be a public key encryption scheme. A threshold cryptosystem TE for a scheme E distributes the operation of key generation and decryption among a set of n parties P1 , . . . , Pn . That is, TE is defined by two protocols: T-Key-Gen a randomized protocol that returns as public output the public encryption key EK and as private output for player Pi a value DKi such that DK1 , . . . , DKn constitute a t-out-of-n threshold secret sharing of DK. T-Decrypt each player Pi takes as public input a ciphertext C = EEK (M ) and as secret input his share DKi and returns as public output the message M The two protocols should be secure i.e. they should function correctly and reveal no extra information even in the presence of an adversary that corrupts maliciously up to t players1. In particular notice that the private key DK should not be exposed during T-Decrypt. Formal definitions for threshold cryptosystems appear in the final paper. A Threshold Cryptosystem for ElGamal over a composite. There are several complications that arise from trying to generalize the approach in [25] to work for ElGamal modulo a composite. First of all we will require for our application that the modulus N will be given as a parameter to the key generation protocol2 without its factorization. This implies that the value φ(N ) is unknown to the parties who have to jointly choose and share X. Our threshold cryptosystem overcomes this problem using techniques discovered by [13] for the application of proactive RSA. Feldman’s VSS over a composite. First we present how to modify Feldman’s VSS to work modulo a composite of unknown factorization. This protocol was 1 2

Notice that we are talking about robust protocols that work in the presence of malicious faults. Unless otherwise noted when we say “secure” we mean also “robust”. Jumping ahead, N will be the same modulus from Bob’s public key

112

Dario Catalano and Rosario Gennaro

discovered in [13]. They used it as a crucial tool to refresh shares of a proactive RSA signature scheme. We slightly modified it to work as a component of our key generation protocol. The main idea behind the protocol is for the the dealer to share the secret σ over the integers (since he doesn’t know φ(N )). The coefficients of the sharing polynomial must be chosen large enough to statistically hide information. The protocol appears in Figure 1. Lemma 1. Feldman-ZN -VSS is a VSS of fault-tolerance t for any t, n such that n > 2t.

Feldman-ZN -VSS Input for all players: a composite number N and an element G of maximal ∗ order in ZN . Input for the dealer: a secret σ ∈ [−N 2 . . . N 2 ]. Sharing Phase. 1. The dealer chooses t random integers a1 , . . . , at ∈ [−L2 N 3 . . . L2 N 3 ] and consider the polynomial f (z) = Lσ + a1 z + . . . + at z t 2. The dealer sends to player Pi the integer σi = f (i) and broadcasts α0 = Gσ mod N and αi = Gai mod N . 3. Player Pi checks that Gσi = αL 0

t Y

j

αij mod N

(1)

j=1

If the check fails he asks that the dealer makes σi public. If more than t player make this request the dealer is disqualified. 4. The dealer reveals σi for the players who asked and the previous check is carried out on all public shares. If it fails the dealer is disqualified. Reconstruction Phase. Player Pi broadcasts σi . Accept those for which Equation (1) is satisfied. Take t + 1 accepted shares and compute the secret σ via polynomial interpolation on a prime field large enough (i.e. p > nt+2 L2 N 3 ).

Fig. 1. Feldman VSS over a composite modulus

Key Generation Protocol. We are now ready to show the key generation protocol for the threshold ElGamal scheme. The general idea follows the one of Pedersen [25] for the case of discrete-log cryptosystems in a prime field. Each player Pi shares a random value xi via Feldman’s VSS. The secret key x will be the sum of those random values, while the public key y = g x is easily computable from the public information of the VSS protocols. The key generation continues by having each player sum up the

Protocols for Verifiable Signature Sharing and Other Applications

113

shares he received to create his own share of the secret key for a t-out-of-n secret sharing. There are two difficulties with the above approach however: – Since each Feldman’s VSS reveals g xi it is possible for a rushing adversary to choose the xi ’s of the bad players so that a specific y = g x will appear. Even if the adversary were not rushing, it would be possible for her during the complain phase to “pull out” some bad players (by having them disqualified) in order to affect the value of y. At the end it is not possible to prove that the pair x, y is built with the right (uniform) distribution. This problem was first noticed by [16]. Their solution, which we are going to employ on this paper, is to perform an information-theoretically secure VSS first for xi (for example Pedersen’s VSS) and then on top of that (using the same sharing polynomial) perform the checks required by the Feldman’s VSS. This has the effect of forcing the decision of the adversary when the xi ’s are informationtheoretically secure and thus the choice of the adversary is independent from the ones of the good players. – When working over a composite modulus the threshold decryption protocol is unnecessarily cumbersome if the key is represented in a t-out-of-n fashion. Thus we follow a different approach. Each player will keep as a share of the secret key the random value he originally shared: this is a (n − 1)-out-ofn secret sharing. The shares a player received during Feldman-ZN -VSS will be used for backup in case some other player fails during the decryption protocol. This paradigm was introduced by [27] and called share-backup. The protocol TEG-Key-Gen (for Threshold ElGamal Key Generation) appears in figure 2. Decryption Protocol. We are now left to show the decryption protocol. The approach is the same as the decryption protocol modulo a prime in [25], but it uses the techniques from [13,27], to make it work modulo a composite. The idea is to get a partial decryption from each player by exponentiating the ciphertext to his own additive (not threshold!) share of the secret key. Since the secret key is the sum of the additive shares, the product of the partial decryptions will be the correct decryption. To prevent bad players from contributing bad partial decryption we force them to prove in ZK that they are correct with respect to the witnesses generated during the key generation protocol. The ZK proof for this task is described3 in [15]. The protocol TEG-Decrypt appears in Figure 3. Theorem 1. TEG = (TEG-Key-Gen, TEG-Decrypt) is a secure threshold cryptosystem for ElGamal over a composite with fault-tolerance t for any t, n such that n > 2t.

3

[15] requires the modulus N to be a product of safe primes. It is possible to lift this assumption however by using a different protocol.

114

Dario Catalano and Rosario Gennaro

TEG-Key-Gen Input for all players: A composite number N product of two primes and ∗ an element G of maximal order in ZN . 1. Each player Pi selects a random number xi ∈R [−N 2 . . . N 2 ] and t random integers ai1 , . . . , ait ∈ [−L2 N 3 . . . L2 N 3 ] and consider the polynomial fi (z) = Lxi + ai1 z + . . . + ait z t . Player Pi performs an unconditionally secure VSS of xi using sharing polynomial fi (z) (for example Pedersen’s VSS over a large enough prime field). Let Good be the set of players who are not disqualified at the end of this step. 2. Player Pi broadcasts αi0 = Gxi mod N and αik = Gaik mod N . 3. Let xji = fj (i) be the integer player Pi received during step 1. Player Pi checks that Gxji = αL j0

t Y

k

αijk mod N

(2)

k=1

If the check fails Pi opens the commitment to the share he received in Step 1 and proves that Pj is cheating. 4. Each Pj caught cheating on the previous step is exposed. That is the value xj is reconstructed using the VSS of step 1. The value αj0 is reset to Gxj mod N . Q 5. The public key is set to Y = i∈Good αi0 mod N (including the exposed values). The private share of player Pi is the vector (xi , {xji }j∈Good ).

Fig. 2. A Pedersen-like joint key generation with share-backup

TEG-Decrypt Input for all players: A composite number N product of two primes, an ∗ element G of maximal order in ZN , the public output of TEG-Key-Gen and a ciphertext (A, B). Private Input for Player Pi : The secret output of TEG-Key-Gen, i.e. the vector (xi , {xji }j∈Good ). 1. Each player Pi ∈ Good broadcasts the partial decryption Ai = Axi mod N and proves in ZK using the protocol from [15] that DLogA Ai = DLogG α0i . 2. If Pi ∈ Good and he fails the ZK proof of the above step, all the players run the reconstruction phase of Feldman-ZN -VSS and compute xi and Ai = Axi mod N on their own. mod N . 3. Output the message M = Q B i∈Good

Ai

Fig. 3. Threshold Decryption for ElGamal over a composite

Protocols for Verifiable Signature Sharing and Other Applications

4

115

Sharing an RSA Signature

The Problem. Let (NB , vB ) be Bob’s RSA public key. The matching signing key is sB such that sB vB = 1 mod φ(NB ). Alice receives a message m from Bob and Bob’s signature S = msB mod NB on it. Alice wants to verifiably share the value S among the proxies P1 , . . . , Pn . That is at the end of the sharing the proxies must be assured that they hold a sharing of Bob’s signature on m. The Basic Paradigm. We depart from the approach used by Franklin and Reiter [14] of directly sharing the signature S. Instead we follow the alternative approach to obtain secret sharing using an encryption of the secret with a key which is shared at the proxies. Assume that the proxies have established an instance of a public key encryption scheme E with public key EK and that the matching secret key SK is shared among them in a t-out-of-n fashion. Then all Alice has to do to share S among the proxies is to simply give them the value CS = EP K (S). Indeed t or less proxies have no information about the secret key, thus they cannot decrypt S. In order to achieve the verifiability property we need a proof that CS indeed contains the signature S. Achieving Verifiability. The above proof could be constructed using general zero-knowledge proof techniques, with a loss of efficiency. The key idea to obtain an efficient proof is to encrypt the signature S (created under Bob’s public key (NB , vB )) using an instance of the ElGamal cryptosystem over the same composite modulus NB . If Y = GX mod NB is the public key of the proxies, Alice will encrypt the ∗ signature by choosing a random K ∈ ZN and computing AS = GK mod NB B K and BS = Y · S mod NB . This will allow for an efficient verifiability check using the ZK proof in Figure 4. Alice will be the prover and the proxies will be the verifiers. The protocol is based on [30] with some efficiency improvements (it is not necessary to repeat it several times.) Lemma 2. The protocol EGRSA-ZK-Proof is a honest-verifier zero-knowledge proof that (AS , BS ) is an ElGamal encryption under the key (NB , G, Y ) of the signature S of m under the key (NB , vB ). To make the above protocol ZK against any verifier, known techniques [18] can be used. In particular the Verifier can commit to the challenge before the Prover speaks. The Basic Protocol. On input a message m, Bob’s signature S on it and Bob’s public key NB , vB Alice does the following. She generates an instance of the ElGamal encryption scheme over the composite NB . She generates G as a random power of m (for reasons that will appear clear in the security proof). She selects a random X ∈ [−NB2 , . . . , NB2 ] and the public key Y = GX mod NB . She then encrypts S under by selecting a random K ∈ ZNB and setting AS = GK mod NB and BS = Y K · S mod NB . She hands m, NB , vB , G, Y, AS , BS to the proxies. Then she proves in ZK that AS , BS is indeed an encryption of the

116

Dario Catalano and Rosario Gennaro

EGRSA-ZK-Proof Input for Prover and Verifier: The message m, Bob’s RSA public key NB , vB , the ElGamal public key G, Y = GX , the ciphertext (AS = GK , BS = Y K · S). Secret input for the Prover: A value S such that m = S vB mod NB and the random value K. ∗ 1. The Prover chooses a random value R ∈R ZN and sets r = RvB mod NB B (notice that R is a signature on r according to Bob’s public key). The Prover encrypts R under the ElGamal key of the proxies, i.e. she chooses J ∈R ZN 3 and sets AR = GJ mod NB and BR = Y J · R mod NB . She B sends r, AR , BR to the proxies. 2. The Verifier sends a random challenge c ∈ ZNB 3. The Prover answers with L = J + cK (integer value) and T = RS c mod NB . The Verifier accepts if (a) GL = AR · AcS mod NB , (b) BR · BSc = Y L · T mod NB and (c) T vB = rmc mod NB .

Fig. 4. A ZK Proof that an ElGamal encryption contains an RSA signature

signature S using the EGRSA-ZK-Proof from Figure 4. Finally the last thing left is to share X using Feldman-ZN -VSS from Figure 1. This will guarantee the proxies that they have the correct decryption key to reconstruct S. To recover S the proxies will run the reconstruction phase of Feldman-ZN VSS and then use X to decrypt S. The protocol is described in Figure 5. Notice that this protocol does not make use of the full threshold cryptosystem we have outlined in the previous section but only of the Feldman-ZN -VSS protocol. Theorem 2. Under the Decisional Diffie-Hellman assumption modulo a composite the protocol RSA-VΣS-1 is a secure VΣS protocol for RSA with faulttolerance t, for any n, t with n > 2t. An Alternative Protocol. In this section we show a variation of the previous protocol. The reason we present an alternative protocol is to improve the efficiency of the scheme for Alice. Indeed in this scheme we take full advantage of the new threshold cryptosystem described in Section 3. The main difference with respect to the previous protocol is that the key generation for the ElGamal scheme is done distributively by the proxies instead than by Alice. This will also allow for a very efficient verification that the ciphertext contains the required signature. Indeed the proxies can verify that the

Protocols for Verifiable Signature Sharing and Other Applications

117

RSA-VΣS-1 Input for Alice: The message m, Bob’s RSA public key NB , vB , the signature S on m, i.e. a value such that m = S vB mod NB . RSA-ΣShare-1 1. Alice chooses uniformly at random – r ∈ ZNB and sets G = mr mod NB . 2 2 – X ∈ [−NB , . . . , NB ] and sets Y = GX mod NB . – K ∈ ZNB and sets AS = GK mod NB and BS = Y K · S mod NB . She sends to the proxies m, NB , vB , r, Y, AS , BS . The proxies compute G = mr mod NB . 2. Alice runs the proof EGRSA-ZK-Proof as the prover on input m, NB , vB , G, Y, AS , BS with the proxies as the Verifier. The proxies reject if Alice fails the proof. 3. Alice runs Feldman-ZN -VSS for X as the dealer with the proxies. The proxies reject if Alice fails the VSS protocol. RSA-ΣRecover-1 The proxies run the Reconstruction Phase of Feldman-ZN -VSS and compute BS X and output S = A X mod NB . S

Fig. 5. Basic RSA VΣS Protocol

pair (AS , BS ) is constructed correctly by checking that BSvB (Y K · S)vB Y K·vB · S vB = = m mod NB vB X = K X·v (AS ) (G ) B Y K·vB

(3)

i.e. just by running the TEG-Decrypt protocol on the pair (AvSB , BSvB ). The full protocol appears in Figure 6. Theorem 3. Under the Decisional Diffie-Hellman assumption modulo a composite the protocol RSA-VΣS-1 is a secure VΣS protocol for RSA with faulttolerance t, for any n, t with n > 2t. Comments, Variants and Optimizations. Due to space limitations we refer the reader to the final version of the paper for a description of several variants of the above protocols and a detailed efficiency analysis.

5

Sharing a DSS Signature

The Problem. Recall the DSS signature scheme. The public parameters are a large prime p, a 160-bit prime q that divides p − 1 and an element g of order q in Zp∗ . Bob (the signer) has a secret key x which is a random number in Zq . The

118

Dario Catalano and Rosario Gennaro

RSA-VΣS-2 Input for Alice: The message m, Bob’s RSA public key NB , vB , the signature S on m, i.e. a value such that m = S vB mod NB . RSA-ΣShare-2 1. Alice sends to the proxies the message m, Bob’s public key (NB , vB ) and a random value r ∈ ZNB 2. The proxies run TEG-Key-Gen on input the modulus NB and the basis G = mr mod NB . They return to Alice the public key Y = GX mod NB . 3. Alice encrypts S using the ElGamal encryption scheme with public key (NB , G, Y ). That is, she generates a random number K in ZNB and computes AS = GK mod NB and BS = Y K ·S mod NB . Alice sends (AS , BS ) to the proxies. 4. The proxies run TEG-Decrypt protocol on the pair (AvSB , BSvB ). If the output is m they accept otherwise they reject. RSA-ΣRecover-2 The proxies run TEG-Decrypt protocol on the pair (AS , BS ).

Fig. 6. Alternative RSA VΣS Protocol matching public key is y = g x mod p. A message M is signed by first hashing it down via SHA-1, i.e. m = SHA-1(M ). Then Bob chooses a random number k ∈R Zq , and computes r = g k mod p mod q and s = k −1 (m + xr) mod q. The signature is the pair (r, s). A signature is verified by computing σ = s−1 mod q and checking that r = (g m y r )σ mod p mod q. Alice receives the message M and the pair (r, s) and she wants to verifiably share the pair (r, s) among the proxies P1 , . . . , Pn . The Approach from [14]. We follow the same provably secure approach used in [14] to verifiably share an ElGamal signature. The main difference between a (plain) ElGamal signature and DSS4 is that r = g k mod p (without the extra modq reduction) and s = k −1 (m − xr) (a − instead of a +). The idea in [14] was for Alice to give out r in the clear to the proxies and to share s via a Feldman VSS using an appropriate basis for the verification. For some reason (probably because the extra reduction modq for r seems at first sight not to allow this approach) they decided to switch the roles between r and s in the DSS VΣS . Alice gives out s in the clear and shares r via Feldman’s VSS. However their simulation does not go through, although they claim heuristically that it is secure. Our Approach. We show that a careful adaptation of the ElGamal VΣS from [14] can be shown to be secure. Alice gives out r in the clear to the proxies and shares σ = s−1 via Feldman VSS using the basis G = g m y r (which the 4

Apart from the way messages are hashed which is irrelevant for the purpose of VΣS .

Protocols for Verifiable Signature Sharing and Other Applications

119

proxies can compute on their own from g, y, m, r). Notice that by doing this she reveals r∗ = Gσ mod p. So in order to check that the shared value is really the correct signature the proxies must simply check that r∗ mod q = r. Notice that revealing r∗ (i.e. the value of r before the reduction modq) does not turn into a security problem since this information is easily simulatable (see the proof). Indeed the reduction modq of r serves only to shorten the signature and has no security purpose. The full protocol appears in Figure 7.

DSS-VΣS Input for all players: Bob’s DSS public key (p, q, g, y), a message M and its hash value m. Secret Input for Alice: A DSS signature r, s from Bob on M . DSS-ΣShare 1. Alice broadcasts r to the proxies. She runs Feldman’s VSS on input the secret σ = s−1 and with basis G = g m y r . Let α0 be the commitment to the secret generated by the Feldman’s VSS, i.e. if Alice is honest α0 = Gσ mod p. 2. The proxies run the verification phase of Feldman VSS (including the complaint phase). They reject the sharing if either Alice is disqualified during the verification of Feldman’s VSS or α0 6= r mod q. DSS-ΣRecover The proxies run the reconstruction phase of Feldman’s VSS to recover σ. They compute s = σ −1 mod q and output r, s.

Fig. 7. A protocol for DSS VΣS

Theorem 4. Protocol DSS-VΣS is a secure VΣS protocol for DSS with faulttolerance t, for any n, t with n > 2t.

Acknowledgment We would like to thank Tal Rabin for several discussions over the topic of proactive RSA.

References 1. N. Asokan, V. Shoup and M. Waidner. Optimistic fair exchange of digital signatures. EUROCRYPT’98. 108 2. M. Ben-Or, S. Goldwasser, and A. Wigderson. Completeness Theorems for Noncryptographic Fault-Tolerant Distributed Computations. STOC’88 pp.1–10, 1988. 106

120

Dario Catalano and Rosario Gennaro

3. M. Burmester. Homomorphism of secret sharing schemes: a tool for verifiable signature sharing. EUROCRYPT’96, pp.96–106. LNCS vol.1070. 105 4. David Chaum and Hans Van Antwerpen. Undeniable signatures. CRYPTO’89, pages 212–217. LNCS vol. 435. 106 5. D. Chaum, C. Crepeau, and I. Damgard. Multiparty Unconditionally Secure Protocols. STOC’88, pp.11–19, 1988. 106 6. B. Chor, S. Goldwasser, S. Micali, and B. Awerbuch. Verifiable secret sharing and achieving simultaneity in the presence of faults. FOCS’85, pp.383–395, 1985. 110 7. D. Coppersmith, M. Franklin, J. Patarin and M. Reiter. Low-exponent RSA with related messages. EUROCRYPT’96, pp.1–9. LNCS vol.1070. 105 8. I. Damgard and T. Pedersen. New convertible undeniable signature schemes. EUROCRYPT’96, pp.372–386. LNCS vol. 1070. 108 9. A. De Santis, Y. Desmedt, Y. Frankel, and M. Yung. How to share a function securely. STOC’94, pp.522–533, 1994. 108, 111 10. W. Diffie and M.E. Hellman. New Directions in Cryptography. IEEE Transactions on Information Theory, v. IT-22, no. 6, pp. 644-654, November 1976. 107, 110 11. T. ElGamal. A public-key cryptosystem and a signature scheme based on discrete logarithms. IEEE Transactions on Information Theory, IT-31(4):469–472, 1985. 107, 110 12. P. Feldman. A Practical Scheme for Non-Interactive Verifiable Secret Sharing. FOCS’87, pp.427–437, 1987. 110 13. Y. Frankel, P. Gemmell, P. Mackenzie, and M. Yung. Optimal Resilience Proactive Public-Key Cryptosystems. FOCS’97, pp.384–393. 108, 111, 111, 112, 113 14. M. Franklin and M. Reiter. Verifiable Signature Sharing. EUROCRYPT’95, pp.50– 63. LNCS vol.921. 105, 105, 107, 108, 115, 118, 118, 118, 118 15. R. Gennaro, S. Jarecki, H. Krawczyk, and T. Rabin. Robust and efficient sharing of RSA functions. CRYPTO’96, pp.157–172. LNCS vol. 1109. 108, 111, 113, 113, 114 16. R. Gennaro, S. Jarecki, and T. Rabin. Securely revisiting distributed key generation. Manuscript. 113 17. R. Gennaro, H. Krawczyk and T. Rabin. RSA-Based Undeniable Signatures. CRYPTO’97, LNCS vol.1294. 106, 106 18. O. Goldreich and A. Kahan. How to Construct Constant-Round Zero-Knowledge Proof Systems for NP. J. of Cryptology, Vol.9, No.3, pp.167–190, 1996. 115 19. O. Goldreich, S. Micali, and A. Wigderson. Proofs that Yield Nothing But Their Validity or All Languages in NP Have Zero-Knowledge Proof Systems . Journal of the ACM, 38(1):691–729, 1991. 106 20. O. Goldreich, S. Micali, and A. Wigderson. How to play any mental game. STOC’87, pp.218–229, 1987. 106 21. S. Goldwasser and S. Micali. Probabilistic Encryption. JCSS, 28(2), pp.270–299, April 1984. 110 22. S. Goldwasser, S. Micali, and C. Rackoff. The knowledge complexity of interactive proof-systems. SIAM. J. Computing, 18(1):186–208, February 1989. 106, 107 23. H. Krawczyk. Secret sharing made short. CRYPTO’93, pp.136–146, LNCS 773. 107 24. K.S. McCurley. A key distribution system equivalent to factoring. Journal of Cryptology. vol.1, pp.95–105, 1988. 110 25. T. Pedersen. A threshold cryptosystem without a trusted party. EUROCRYPT’91, pp.522-526, LNCS vol. 547 111, 112, 113 26. T. Pedersen. Non-interactive and information-theoretic secure verifiable secret sharing. CRYPTO’91, pp.129-140, LNCS vol. 576 110

Protocols for Verifiable Signature Sharing and Other Applications

121

27. T. Rabin. A Simplified Approach to Threshold and Proactive RSA. To appear in CRYPTO’98. 108, 111, 113, 113 28. A. Shamir. How to share a secret. Communications of the ACM, 22:612–613, 1979. 110 29. Z. Shmuely. Composite Diffie-Hellman public-key generating systems are hard to break. Technion Dept. of Computer Science Technical Report no.356, 1985. 110 30. M. Stadler. Publicly Verifiable Secret Sharing. EUROCRYPT’96, pp.190–199, LNCS vol.1070. 108, 115 31. E. Verheul and H. van Tilborg. Binding ElGamal. EUROCRYPT’97, LNCS 1233. 106, 106

Trading Correctness for Privacy in Unconditional Multi-Party Computation? (Extended Abstract) Matthias Fitzi, Martin Hirt, and Ueli Maurer Department of Computer Science Swiss Federal Institute of Technology (ETH), Zurich CH-8092 Zurich, Switzerland, {fitzi,hirt,maurer}@inf.ethz.ch

Abstract. This paper improves on the classical results in unconditionally secure multi-party computation among a set of n players, by considering a model with three simultaneously occurring types of player corruption: the adversary can actively corrupt (i.e. take full control over) up to ta players and, additionally, can passively corrupt (i.e. read the entire information of) up to tp players and fail-corrupt (i.e. stop the computation of) up to tf other players. The classical results in multi-party computation are for the special cases of only passive (ta = tf = 0) or only active (tp = tf = 0) corruption. In the passive case, every function can be computed securely if and only if tp < n/2. In the active case, every function can be computed securely if and only if ta < n/3; when a broadcast channel is available, then this bound is ta < n/2. These bounds are tight. Strictly improving these results, one of our results states that, in addition to tolerating ta < n/3 actively corrupted players, privacy can be guaranteed against every minority, thus tolerating additional tp ≤ n/6 passively corrupted players. These protocols require no broadcast and have an exponentially small failure probability. When zero failure probability is required, privacy can be maintained against any minority, but one can even tolerate ta ≤ n/4 of these players to be corrupted actively. We further show that the bound t < n/2 for passive corruption holds even if the adversary is additionally allowed to make the passively corrupted players fail. Moreover, we characterize completely the achievable thresholds ta , tp and tf for four scenarios. Zero failure probability is achievable if and only if 2ta + 2tp + tf < n and 3ta + tp + tf < n; this holds whether or not a broadcast channel is available. Exponentially small failure probability with a broadcast channel is achievable if and only if 2ta + 2tp + tf < n; without broadcast, the additional condition 3ta + tf < n is necessary and sufficient. Keywords: Secure multi-party computation, unconditional security, verifiable secret sharing, threshold cryptography. ?

Research supported by the Swiss National Science Foundation (SNF), SPP project no. 5003-045293.

H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 121–136, 1998. c Springer-Verlag Berlin Heidelberg 1998

122

1 1.1

Matthias Fitzi et al.

Introduction Secure Multi-Party Computation

Consider a set of n players who do not trust each other. Nevertheless they want to compute an agreed function of their inputs in a secure way. Security means achieving correctness of the result of the computation while keeping the players’ inputs private, even if some of the players cheat. This is the well-known secure multi-party computation problem (e.g. [Yao82,GMW87,BGW88,CCD88,RB89]). For an excellent overview see [Fra93,Can95]. Secure multi-party computation can alternatively, and more generally, be seen as the problem of performing a task among a set of players that is specified by involving a trusted party, where the goal of the protocol is to replace the need for the trusted party. In other words, the functionality of the trusted party is shared among the players. Secure function evaluation described above can be seen as a special case of this more general setting. Most protocols described in the literature in the context of secure function evaluation also apply in the general context. This is also true for the protocols described in this paper. There exists a rich literature on the subject. Previous approaches can be classified according to a number of criteria that are briefly discussed below. – Communication: The communication models differ with respect to several criteria: Whether or not secure communication channels are available, whether or not broadcast channels are available, and whether the communication channels are synchronous or asynchronous. Some papers also consider incomplete network topologies, i.e. limited connectivity. – Adversaries: Cheating players can be modeled by assuming a central adversary that can corrupt players. One generally distinguishes between actively corrupted players, passively corrupted players, and fail-corrupted players. – Security: The basic security requirements are privacy and correctness. Privacy means that the adversary obtains no information about the uncorrupted players’ inputs beyond what he learns from seeing the corrupted players’ inputs and the output of the computation. Correctness means that the adversary cannot prevent the uncorrupted players from learning the correct output. Furthermore, robustness means that once the inputs have been committed by the players, the adversary cannot stop the computation. We refer to [Can97,Can98] for a precise definition of security in multi-party computation. The types of tolerable adversaries have recently been generalized in a number of directions (adaptive adversaries [CFGN96], uncoercibility [CG96], nonthreshold adversaries [HM97]), and some authors have investigated multi-party computation for various minimality and complexity criteria [FKN94,CGT95,FY92,Kus89]. Security can also be classified according to the adversary’s computational resources (limited, hence cryptographic security, e.g. [CDG87,GMW87], or unlimited, hence unconditional or information theoretic security, e.g. [BGW88,CCD88,RB89]). In the information-theoretic model one can

Trading Correctness for Privacy

123

distinguish between protocols with exponentially small (e.g. [CCD88,RB89]) or with zero failure probability (e.g. [BGW88]). We refer to the latter as perfect multi-party computation. – Generality: Many papers describe protocol constructors which, for any given function, generate a protocol for securely computing this function (e.g. [Yao82,GMW87,GHY87,BGW88,CCD88,RB89,Cha89]), while other approaches are tailored to a particular function like voting (e.g. [CFSY96]), auctioning [FR96], sharing of encryption or signature operations [SDFY94,GJKR96a,GJKR96b], or private information retrieval [CGKS95,KO97].1 1.2

Previous Results and Motivation

Ben-Or, Goldwasser and Wigderson [BGW88] and independently Chaum, Cr´epeau and Damg˚ ard [CCD88] proved two fundamental results in unconditional multi-party computation among a set of n players. When the adversary only passively corrupts players, secure multi-party computation is possible if and only if the number of corrupted players is less than n/2. When the adversary only actively corrupts players, secure multi-party computation is possible if and only if the number of corrupted players is less than n/3. T. Rabin and Ben-Or [RB89] proved that when a broadcast channel is available, then the threshold for active corruption is n/2. These bounds are tight in the sense that every function can be securely computed when the threshold condition is satisfied, but there exist functions (in fact almost all functions) that cannot be securely computed when the threshold condition is violated. The protocols of [BGW88] have zero failure probability, i.e. they are perfect. The failure probability can be made exponentially small for the protocols of [CCD88] and [RB89]. The results of [RB89] cannot be achieved with zero failure probability. This paper introduces and investigates a new model for multi-party computation in which the adversary can simultaneously perform three different kinds of player corruption: active corruption, passive corruption, and fail-corruption. Special cases of adversaries that perform different kinds of player corruption have previously been considered in the literature. Chaum [Cha89] considered general multi-party protocols that are secure against an adversary that can corrupt either up to d players actively or, alternatively, can corrupt up to c players passively, but in his model only one type of corruption occurs at the same time.2 In other words, the adversary chooses between active or passive corruption and all corrupted players are corrupted in the same way. The protocols achieve correctness (with negligible failure probability) with respect to any d actively corrupted, 1 2

The major reason for designing protocols for special functions compared to applying a general-purpose protocol is the potential gain of efficiency. For instance, the thresholds c = 1 and d = b(n − 1)/2c given in the example in Section 3.1 of [Cha89] cannot be tolerated if simultaneous passive and active corruption occur.

124

Matthias Fitzi et al.

or privacy with respect to any c passively corrupted players, where 2c + d < n is required. Meyer and Pradhan [MP91] treated the case of simultaneous active and fail-corruptions for Byzantine agreement. The simultaneous presence of active and passive player corruption was considered by Dolev et al. [DDWY93] in the context of secure message transmission over general networks. That paper also mentions the possibility of extending those results to multi-party computation. In contrast to [Cha89], the models of [MP91,DDWY93] and also of this paper consider a mixed adversary that simultaneously performs different kinds of corruption. 1.3

Contributions of this Paper

We introduce a new model for unconditionally secure multi-party computation among a set of n players where the adversary may actively corrupt, passively corrupt, and fail-corrupt some of the players. We refer to this model as the mixed model. A (ta , tp , tf )-adversary (or simply a (ta , tp )-adversary when tf = 0) may actively corrupt up to ta players and, additionally, passively corrupt up to tp and fail-corrupt up to tf other players. To actively corrupt a player means to take full control over the corrupted player, i.e. to receive and send arbitrary messages in this player’s name. To passively corrupt a player means to have access to all information that this player receives during the whole protocol, including his inputs to the protocol (if any). To fail-corrupt a player means that the adversary may stop the communication from and to that player at an arbitrary time during the protocol. Once a player is caused to fail, he will not recover. However, the adversary is not allowed to read the internal data of a fail-corrupted player, unless the player is also passively corrupted at the same time. In other words, if the adversary wants both to read the internal information of a player and to be able to make the player fail, then he must both passively corrupt and fail-corrupt that player, and the player is counted for both thresholds tp and tf . Note that the cases ta = tf = 0 and tp = tf = 0 correspond to the passive and active model, respectively, as considered in the previous literature. A protocol is (ta , tp , tf )-secure (or (ta , tp )-secure) if any (ta , tp , tf )-adversary (or (ta , tp )-adversary) obtains no additional information about the non-corrupted players’ inputs (beyond what is provided by the function output) and cannot falsify the outcome of the computation. For a precise definition of security, see [Can97,Can98]. In this paper, we consider information-theoretic security, i.e. the adversary can use unlimited computational resources. Players are connected pairwise by secure communication channels in a synchronous network. The necessary and sufficient conditions for secure multi-party computation to be achievable for all functions are derived for the following four cases: – Perfect security, without a broadcast channel, is possible if and only if 2ta + 2tp + tf < n and 3ta + tp + tf < n. – Perfect security, with a broadcast channel, is possible under the same condition, i.e., broadcast does not help increasing the number of players that can be corrupted when perfect security is required.

Trading Correctness for Privacy

125

– Unconditional security (negligible failure probability), without a broadcast channel, is possible if and only if 2ta + 2tp + tf < n and 3ta + tf < n. – Unconditional security, with a broadcast channel, is possible if and only if 2ta + 2tp + tf < n. 1.4

Outline

In Sections 2 and 3 tight bounds on the existence of perfectly secure (Section 2) or unconditionally secure (Section 3) protocols are given for the mixed model without fail-corruptions. In Section 4, these bounds are generalized for the mixed model with fail-corruptions, and the protocols are extended to achieve these generalized bounds. Some conclusions are given in Section 5.

2

Perfectly Secure Multi-Party Computation

The construction of perfectly secure protocols for the mixed model without failcorruptions is based on the protocol of [BGW88] for the active model. We first give a very brief summary of that protocol, and then present some modifications needed for tolerating a mixed adversary. 2.1

The Protocol of Ben-Or, Goldwasser, and Wigderson

The protocol of [BGW88] for the active model requires that the function to be computed is represented as an arithmetic circuit over a finite field (F , +, ∗), where three types of gates are available: an addition gate takes two inputs and outputs their sum, a multiplication gate takes two inputs and outputs their product, and a randomness gate takes no input and outputs a random field element. The protocol proceeds in three stages: In the input stage, every player uses verifiable secret sharing (VSS) to share his input among all players. In the computation stage, the agreed circuit is evaluated gate by gate, where all intermediate results are shared among the players using VSS. In the final stage, the shared result is reconstructed. We briefly describe the subprotocols for verifiable secret sharing and for multiplication. Let n denote the number of players, and let t denote the upper bound on the number of players that the adversary may actively corrupt. Verifiable secret sharing is based on Shamir’s secret sharing scheme [Sha79]. To every player a unique field element wi is associated, where w is a primitive n-th root of unity. In the sharing protocol, the dealer randomly selects a twodimensional polynomial f (x, y) of degree t in both variables such that f (0, 0) is the value to be shared, and sends the polynomials fi (x) = f (x, wi ) and gi (y) = f (wi , y) to the i-th player. Then the i-th and the j-th player verify the cross-over ?

?

points fi (wj ) = gj (wi ) and gi (wj ) = fj (wi ) and complain about inconsistencies. Whenever a player recognizes an inconsistency, he asks the dealer to broadcast the value of the inconsistent cross-over points. Whenever a player receives a

126

Matthias Fitzi et al.

value from the dealer that is not consistent with a previously received value, he accuses the dealer, who then has to broadcast both polynomials of the accusing player. Then the player uses these broadcast polynomials as his polynomials. If more than t players accused the dealer, then clearly the dealer is corrupted and every player picks the default zero polynomial as the dealer’s polynomial. Finally, the share of the i-th player is fi (0). This sharing protocol guarantees that all the shares lie on a polynomial of degree t, and that if the dealer is honest (uncorrupted), then any t players do not obtain any joint information about the secret. In the reconstruction protocol, each player sends his share of the result to those players who should learn this value. Each of them can then correct faulty shares using the properties of the underlying Reed-Solomon code [MS81], and interpolate the secret. At most t shares are faulty and the minimal distance of the Reed-Solomon code with n shares and degree t is n−t−1. Hence (n−t−1)/2 ≥ t faults can efficiently be corrected and reconstruction is possible. Linear Functions. Multiplication by scalars and addition of shared values, and hence the computation of any linear function, can be performed (without communication) by each player doing the corresponding computation on his shares and keeping the result as a share of the new value. Multiplication of two shared values is more involved. Here we describe the improved protocol of [GRR98]. First, every player verifiably secret shares both shares of the two values he holds. Because a corrupted player could secret share a wrong share, the syndrome of the reshared shares is computed in a distributed manner (syndrome computing is linear) and is then reconstructed (reconstruction involves local error-correction for every player). Using this syndrome vector, each player can derive the error vector and can correct his shares according to the error vector. Then, each player shares the product of his two factor shares and proves by a subprotocol that the shared value indeed is the product of his two factor shares. At this point, every player holds a share of all n product shares, and as shown in [GRR98] the interpolation of these product shares results in the product of the two factors. Interpolation is linear and can be computed locally on the shares of the product shares. 2.2

Protocol Modifications for the Mixed Model

Lemma 1. For n players and arbitrary thresholds ta and tp satisfying 3ta +tp < n, there exists a verifiable secret-sharing scheme that is perfectly secure against a (ta , tp )-adversary. Proof. The scheme is a variation of the verifiable secret-sharing scheme presented in [BGW88] whereby the degree of the used polynomials is set to d = ta + tp . This modification was first proposed in [DDWY93] and [Dwo90]. In the sharing protocol, the dealer selects a two-dimensional polynomial f (x, y) of degree d in each variable and sends the polynomials fi (x) and gi (y) to the i-th player. Then the players verify the cross-over points and complain about inconsistencies.

Trading Correctness for Privacy

127

Whenever a player recognizes that the dealer is misbehaving, he accuses the dealer. If more than ta players accused the dealer, then clearly the dealer is faulty and every player picks the default zero polynomial as the dealer’s polynomial. Therefore, in the reconstruction protocol the parameter t of the maximal number of errors is set to ta . Clearly, this scheme tolerates a (ta , tp )-adversary. The complete information the adversary obtains during the protocol contains at most ta + tp shares, which gives no information about the secret (unless the dealer is corrupted). On the other hand, coordinated misbehavior of up to ta players can be tolerated because in the reconstruction protocol, up to (n − d − 1)/2 faulty shares can be corrected (half of the minimum distance of the underlying Reed-Solomon code), which is at least ta . t u Lemma 2. A set of n players can (ta , tp )-securely multiply two shared values if 2ta + 2tp < n and 3ta + tp < n. Proof. The multiplication protocol is along the lines of the multiplication protocol in [BGW88] (including the improvements of [GRR98]), whereby the VSS of Lemma 1 with polynomials of degree d = ta + tp is used. First, every player verifiably secret shares both shares he holds of the two factors (using the VSS scheme of Lemma 1), then the syndrome of the reshared shares is computed and the shares are corrected according to the syndrome. Now, each player shares the product of his two factor shares (again by applying the VSS scheme of Lemma 1) and uses the techniques described in [BGW88] to prove that the shared value is indeed the product of his two factor shares. Then the players interpolate the product [GRR98], and therefore we need that the degree of this polynomial is smaller than n, i.e. 2d < n, which is satisfied because of the condition 2ta + 2tp < n. The described protocol is secure as long as the underlying verifiable secret-sharing protocol is secure, which is guaranteed for 3ta + tp < n by Lemma 1. t u Lemma 3. There are deterministic functions that four players p1 , p2 , p3 , and p4 cannot compute perfectly securely with respect to an adversary who may passively corrupt p1 and (additionally) actively corrupt one of p2 , p3 , or p4 . Even a broadcast channel does not help. Proof. For the sake of contradiction assume that for every deterministic function there exists a protocol among the four players p1 , p2 , p3 , and p4 , where the adversary may passively corrupt p1 and, at the same time, actively corrupt one of the players p2 , p3 , or p4 . In a first step, when assuming a broadcast channel and a public common random source (which will later be shown to be unnecessary), every protocol secure in this scenario can be converted into a protocol among the three players p2 , p3 , and p4 , basically by having each player locally simulate p1 . More precisely, instead of sending a message to p1 , the message is broadcast. When p1 generates a random field element, the common random source is used. The local computations of p1 are performed locally by each player, as every

128

Matthias Fitzi et al.

player knows the internal state of p1 . We now argue that in a setting with three players and a broadcast channel, a common random source is of no use when perfect security is required. Perfect security, i.e. zero failure probability, means that failure must not occur for any particular output sequence of the random source. Hence one can assume that the output sequence is the all-zero sequence (or any other particular sequence), and we are back in a model without common random source. For three players, assuming broadcast, perfect security (for every function) against an active adversary who may corrupt one of the players is impossible as stated in [RB89]. Hence, there exist protocols that are not perfectly secure with respect to the stated adversary. t u Theorem 1. A set of n players can compute every function perfectly (ta , tp )securely if and only if 2ta + 2tp < n and 3ta + tp < n. The computation is polynomial in n and linear in the size of the circuit. This holds whether or not a broadcast channel is available. Proof. (⇐=) As shown in Lemma 1, the verifiable secret-sharing scheme of [BGW88] can be modified such that a (ta , tp )-adversary is tolerated if 3ta +tp < n. Addition and selection of random field elements need no modification (except that the VSS scheme of Lemma 1 is used). Due to the conditions 2ta + 2tp < n and 3ta + tp < n, multiplication can be performed as explained in Lemma 2. (=⇒) In order to prove the necessity of this condition, first consider the case where 2ta + 2tp ≥ n. Clearly, a (ta , tp )-secure protocol is also (0, ta + tp )-secure (i.e. (ta + tp )-secure against a passive adversary), and the protocol would be perfectly secure against a passive adversary that corrupts a majority of the players. This contradicts Theorem 2 of [BGW88]. Second, consider the case where 2ta + 2tp < n and 3ta + tp ≥ n (hence ta > tp ≥ 0). The case tp = 0 (hence 3ta ≥ n) contradicts the result of [RB89] cited in the proof of Lemma 3, thus assume that tp > 0. Assume that every function can be computed (ta , tp )-securely, so in particular, for every deterministic function there exists a protocol that is (ta , tp )-secure. This protocol can be transformed into a protocol for the four players p1 , p2 , p3 and p4 , where p2 , p3 , and p4 each play for ta players, and p1 plays for the remaining (at most tp ) players. Since the original (assumed) protocol is (ta , tp )-secure, this new protocol is secure with respect to an adversary that passively corrupts p1 and actively corrupts one of t u p2 , p3 , or p4 . This contradicts Lemma 3.

3

Unconditionally Secure Multi-Party Computation

We now show that by allowing a negligible rather than zero failure probability, the bounds for the number of corrupted players can be improved. Theorem 2. Allowing a negligible failure probability and given a broadcast channel, a set of n players can compute every function (ta , tp )-securely if and only if 2ta + 2tp < n. The computation is polynomial in n and linear in the size of the circuit.

Trading Correctness for Privacy

129

Proof. (⇐=) The protocol of [RB89] tolerates up to ta < n/2 actively corrupted players. Hence, for all ta and tp that satisfy 2ta + 2tp < n, this protocol is also (ta , tp )-secure.3 The efficiency of this protocol is proven in [RB89]. (=⇒) If for some ta and tp satisfying 2ta + 2tp ≥ n, every function were (ta , tp )securely computable, then every function would also be securely computable against a passive majority, contradicting Theorem 2 of [BGW88]. t u Theorem 3. Allowing a negligible failure probability, without a broadcast channel, a set of n players can compute every function (ta , tp )-securely if and only if 2ta + 2tp < n and 3ta < n. The computation is polynomial in n and linear in the size of the circuit. Proof. (⇐=) The protocol of [RB89] is (ta , tp )-secure if 2ta + 2tp < n. Provided that ta < n/3, a broadcast channel can be simulated among the players [LSP82,FM88,GM93]. Simulating broadcast in the protocol of [RB89] yields a protocol that is (ta + tp )-secure for all ta and tp that satisfy 2ta + 2tp < n and 3ta < n. The efficiency of this protocol immediately follows from the efficiency of the protocols in [RB89] and in [FM88,GM93]. (=⇒) The necessity of the condition 2ta + 2tp < n has already been shown in the proof of Theorem 2. On the other hand, let 3ta ≥ n, and suppose that for every function there exists an unconditionally secure multi-party protocol with negligible failure probability. Since broadcast is one particular function, there would also exists a broadcast protocol that is unconditionally secure against one third of the players, contradicting a result of [LSP82,KY]. t u

4

Multi-Party Computation Tolerating Fail-Corruptions

In this section we generalize the results of the previous two sections by allowing the adversary to fail-corrupt up to tf players, and we give tight bounds for the number of actively corrupted, passively corrupted and fail-corrupted players that can be tolerated (where players that are passively corrupted and fail-corrupted at the same time must be counted for both thresholds). First, we consider a perfect model (with or without a broadcast channel), then an unconditional model with a broadcast channel, and last, an unconditional model without a broadcast channel. Theorem 4. A set of n players can compute every function perfectly (ta , tp , tf )securely if and only if 2ta + 2tp + tf < n and 3ta + tp + tf < n. The computation is polynomial in n and linear in the size of the circuit. This holds whether or not a broadcast channel is available. 3

However, the VSS reconstruction protocol of [RB89] needs a slight modification such that it is possible to reveal a shared value only to some of the players (the original protocol reveals the secret always to all players in parallel, thus only applies to the secure function evaluation model).

130

Matthias Fitzi et al.

Proof. (⇐=) The protocol described in the proof of Theorem 1 needs further modifications in order to be (ta , tp , tf )-secure. Invariant. The degree of the polynomials used for secret sharing is set to d = ta + tp . The invariant during the computation is that every (intermediate) value is shared among the players by a polynomial of degree d, and that every player is committed to his share. This means that whenever a player has to reveal his share, every player can verify whether the revealed share is the correct share or not. VSS. Note that the described VSS of Lemma 1 either achieves this invariant, or the dealer is detected to be corrupted: After the sharing protocol, either there were more than ta accusations against the dealer (in this case, the dealer is disqualified, see below), or every player holds his share, and a share of the share of each other player (called a share-share). The set of the share-shares of a given share can be considered as a shared commitment of that share (cf. [CDM98]). In order to reconstruct the secret, every player must reveal his share by broadcasting the polynomial used for sharing his share, and every player verifies that his corresponding share-share really lies on the broadcast polynomial. If not, the player broadcasts a complaint against the revealing player. If the revealing player is honest, there are at most ta complaints. Now consider the case that the revealing player is actively corrupted and broadcasts a wrong polynomial. There are at most ta + tf players who possibly do not complain even if their shares do not lie on the broadcast polynomial. However, if the polynomial is wrong, it differs from the correct polynomial at least at n − d = n − ta − tp positions, and hence at least (n − ta − tp ) − (ta − tf ) complaints are reported, which is strictly more than ta (since 3ta + tp + tf < n). Once every player has revealed his share, the secret is reconstructed by interpolating the shares for which at most ta complaints were reported (there are at least n − ta − tf such shares).4 Computations. Addition and other linear functions can easily be computed on the shared values (preserving the invariant), since both the secret sharing and the commitments are linear. The multiplication protocol is along the lines of the protocol described in Lemma 2. Due to the invariant every share is also shared among the players, and there is no need for having every player share his factor shares as in [BGW88]. Every player can directly verifiably secret share his product share and use the technique described in [BGW88] to prove that this shared value is equal to the product of his two shares (if the player fails to prove this, he is disqualified; see below). Due to the linearity of the rest of the computation, the invariant is preserved. Note that, as used in [CDM98], this 4

This construction only covers global reconstruction where every player learns the shared secret. If some result must be revealed to only certain players, then the reconstruction protocol must be slightly modified: Every player sends his share, the polynomial with which his share was shared (committed), and all his share-shares to the players who are supposed to learn the output, who then locally determine which of the shares are correct (at most ta wrong share-shares), and interpolate the verified shares.

Trading Correctness for Privacy

131

multiplication protocol does not involve error correction but error detection (in contrast to the multiplication protocol of [BGW88]). Disqualifying players. One major issue of the above protocol is how to deal with disqualified players. In [BGW88], the disqualified players’ data is reconstructed (implicitly by computing the error vector). But in this protocol, a disqualified player can either be actively corrupted or fail-corrupted, and his share must only be reconstructed if the player is actively corrupted. Therefore we need a more involved solution for treating disqualified players. If during the verifiable secret sharing protocol or during the multiplication protocol a player is disqualified, then he is excluded from all further computation. Generally, the shares of a disqualified player must not be revealed. Indeed, the shares of up to tf disqualified players can simply be omitted (this is tolerated in the multiplication protocol). Thus, the first tf times that some player is disqualified the player is excluded from the computation, but no further steps are necessary. If more than tf players are disqualified, the multiplication protocol does not work anymore (there are not enough shares to interpolate the double-degree polynomial). However, among the disqualified players there are at most tf fail-corrupted players, and the other disqualified players (say k) must be actively corrupted. Hence, among the remaining (non-disqualified) players there are at most ta − k actively corrupted players. At this point, every intermediate value is reshared using a scheme for n0 = n−k players, tolerating only t0a = ta −k actively corrupted players. In order to do so, for every intermediate value, every player verifiably secret shares his share of that value among the n0 remaining players by using polynomials of degree d − k, and proves that the shared share is equal to his original share. This can easily be verified by computing the difference of these two shares (in a distributive manner, i.e. every player subtracts one share-share from the other) and by verifying that the difference is zero. Finally, the secret is interpolated in a distributive manner (interpolation is linear). This results in every player having a reduced-degree share of the secret which is committed by a reduced-degree polynomial. If during this degree-reduction protocol some players refuse to cooperate, these players are also disqualified and the reduction protocol restarts (with an increased k). The number of restarts is limited by ta because at most ta + tf players can ever be disqualified. The broadcast channel used in the protocol can be simulated by the broadcast protocol of [MP91] tolerating ta active and tf fail corruptions when 3ta + tf < n. (=⇒) In order to prove the necessity of the conditions of the theorem, assume that for some ta , tp , and tf there exists for every function a (ta , tp , tf )-secure protocol among n players. Trivially, each such protocol is also a (ta , tp )-secure protocol among n0 = n − tf players, simply by considering the case that the adversary fail-corrupts the last tf players at the very beginning of the protocol. However, as proven in Theorem 1, a (ta , tp )-secure protocol among n0 players exists for every function only if the conditions 2ta + 2tp < n0 and 3ta + tp < n0 are satisfied, which implies the conditions of the theorem. t u The following theorem shows that in the passive model, resilience against fail-corruptions is for free, i.e. the same bound that holds in the passive model

132

Matthias Fitzi et al.

also holds in a model in which the adversary may make the passively corrupted players fail. Theorem 5. A set of n players can compute every function perfectly securely with respect to an adversary that may passively corrupt and fail-corrupt up to t players if and only if 2t < n. The computation is polynomial in n and linear in the size of the circuit. Proof. The protocol described in the proof of Theorem 4 achieves this bound after some slight modifications: The degree of all polynomials is set to d = t, and whenever a player fails, then his share is reconstructed using the share-shares, and becomes common knowledge. Theorem 6. Allowing a negligible failure probability and given a broadcast channel, a set of n players can compute every function (ta , tp , tf )-securely if and only if 2ta + 2tp + tf < n. The computation is polynomial in n and linear in the size of the circuit. Proof (sketch). (⇐=) The protocol described in Theorem 2 needs to be modified along the lines of the modifications in the proof of Theorem 4. During the protocol, the shares of disqualified players are never reconstructed. Instead, the first tf disqualified players are simply excluded from the protocol, and their shares are omitted (are considered as erasures when interpolating). However, after more than tf players have been disqualified, it is impossible to perform further multiplications (there are not enough shares to interpolate the polynomial with double degree), and therefore all shared values are reshared using polynomials of smaller degree. In order to do so, the WSS of every share is upgraded to VSS, then the player verifiably secret shares the same share using VSS with reduced degree and proves that the same share was reshared. Finally, the secret is reconstructed in a distributive manner (interpolation is linear), using this new reduced-degree VSS, which results in each player having shared his reduced-degree share by WSS. If during this degree-reduction process a player refuses to cooperate, then this player is also disqualified and the degree-reduction process restarts (where the degree of the polynomials is decremented once more). (=⇒) The optimality of the conditions follows directly from the proof of Theorem 2 by assuming an adversary that corrupts the last tf players at the very beginning of the protocol (obtaining a protocol among n − tf players that is (ta , tp )-secure). Theorem 7. Allowing a negligible failure probability, without a broadcast channel, a set of n players can compute every function (ta , tp , tf )-securely if and only if 2ta + 2tp + tf < n and 3ta + tf < n. The computation is polynomial in n and linear in the size of the circuit. Proof (sketch). The additional condition 3ta + tf < n allows to simulate the assumed broadcast channel in the proof of Theorem 6 by a protocol [MP91]. The optimality of the condition follows immediately from the optimality of the condition in Theorem 6 and of the protocol in [MP91].

Trading Correctness for Privacy

5

133

Conclusions

We have proposed a new model for multi-party computation that, by considering the simultaneous presence of actively, passively and fail-corrupted players, is more general than those in the previous literature. We proved the exact conditions for the existence of unconditionally secure multi-party computation for four natural cases. Moreover, we gave constructions of efficient protocols for all cases. One of the main problems in multi-party computation is that it is not known a priori which players are corrupted. Trivially, if it is known in advance that a certain subset of the players are corrupted (the type of corruption is irrelevant), then the exact conditions for secure protocols to exist are those of this paper applied to the set of remaining players after elimination of the known cheaters. It is surprising that regarding fail-corruptions, this condition holds even when it is not known in advance which players will be fail-corrupted. This follows from the fact that in all bounds tf appears with coefficient only 1. In contrast, tp appears with coefficient 2, and hence every passive corruption must be compensated by one additional non-corrupted player. In the model with exponentially small error probability and a broadcast channel, misbehaviour is detected and hence active corruptions count equally as passive corruptions. In all other models, ta appears with coefficient 3, and hence every active corruption must be compensated by two additional non-corrupted players. Figure 1 summarizes our results. Because the conditions for protocols with failures are the same as those without failures when the number n of players is reduced by tf to n0 = n − tf , the bounds are illustrated only in two dimensions (ta and tp ) for a constant tf . The brightly shaded area is achievable by perfectly secure multi-party computation. By accepting an exponentially small failure probability, one can additionally achieve the semi-dark shaded area. Finally, if a broadcast channel is available, one can even achieve the dark shaded area. These bounds are tight.

n0 2 n0 3

ta 3 6 2

Broadcast 2ta +2tp < n0

Unconditional 0

Perfect

4 3ta < n 5

3ta +tp < n0

n0 = n − tf

1 tp -

n0 2

Fig. 1. Graphical representation of the results.

134

Matthias Fitzi et al.

For the following considerations we restrict our view to the special case with no fail-corruptions (tf = 0, and hence n0 = n). The classical results in unconditional multi-party computation are special cases of the mixed model. The results of Ben-Or, Goldwasser and Wigderson [BGW88] correspond to the points 1 (passive model) and 2 (active model) in Figure 1. The result of Rabin and BenOr [RB89] corresponds to point 3. The points 4 (ta = n/3, tp = n/6) and 5 (ta = n/4, tp = n/4) illustrate that the results of [BGW88] for the active as well as for the passive model can be improved. In addition to ta < n/3 actively corrupted players (point 2), one can tolerate additional tp ≤ n/6 passively corrupted players (point 4). However, this protocol has a negligible failure probability. When perfect security is required, there exist protocols that tolerate not only tp < n/2 passively corrupted players (point 1), but even half of these players being corrupted actively (point 5). Finally, by approaching point 5 from point 2 in the case of perfect security, we can improve the resilience for privacy by reducing the resilience for correctness: In perfectly secure multi-party computation, three additional passive corruptions can be tolerated instead of one active corruption, thus trading correctness for privacy.

Acknowledgments We would like to thank Ran Canetti for sending us early versions of [Can97,Can98] and David Chaum, Ronald Cramer, Rosario Gennaro, Tal Rabin, Markus Stadler, and Michael Waidner for interesting discussions. Finally, we are grateful to the anonymous referees for their constructive remarks.

References BGW88.

Can95.

Can97. Can98. CCD88.

CDG87.

M. Ben-Or, S. Goldwasser, and A. Wigderson. Completeness theorems for non-cryptographic fault-tolerant distributed computation. In Proc. 20th ACM Symposium on the Theory of Computing (STOC), pages 1–10, 1988. 122, 122, 123, 123, 123, 123, 125, 125, 126, 127, 127, 128, 128, 129, 130, 130, 131, 131, 134, 134 R. Canetti. Studies in Secure Multiparty Computation and Applications. PhD thesis, Weizmann Institute of Science, Rehovot 76100, Israel, June 1995. 122 R. Canetti. Modular composition of multi-party cryptographic protocols, Nov. 1997. Manuscript. 122, 124, 134 R. Canetti. Security and composition of multi-party cryptographic protocols, June 1998. Manuscript. 122, 124, 134 D. Chaum, C. Cr´ epeau, and I. Damg˚ ard. Multiparty unconditionally secure protocols (extended abstract). In Proc. 20th ACM Symposium on the Theory of Computing (STOC), pages 11–19, 1988. 122, 122, 123, 123, 123, 123 D. Chaum, I. Damg˚ ard, and J. van de Graaf. Multiparty computations ensuring privacy of each party’s input and correctness of the result. In

Trading Correctness for Privacy

135

Advances in Cryptology — CRYPTO ’87, volume 293 of Lecture Notes in Computer Science, pages 87–119. Springer-Verlag, 1987. 122 CDM98. R. Cramer, I. Damg˚ ard, and U. Maurer. Span programs and general multiparty computation. Manuscript, 1998. 130, 130 CFGN96. R. Canetti, U. Feige, O. Goldreich, and M. Naor. Adaptively secure multiparty computation. In Proc. 28th ACM Symposium on the Theory of Computing (STOC), pages 639–648, Nov. 1996. 122 CFSY96. R. Cramer, M. K. Franklin, B. Schoenmakers, and M. Yung. Multiauthority secret-ballot elections with linear work. In Advances in Cryptology — EUROCRYPT ’96, volume 1070 of Lecture Notes in Computer Science, pages 72–83. IACR, Springer-Verlag, May 1996. 123 CG96. R. Canetti and R. Gennaro. Incoercible multiparty computation. In Proc. 37th IEEE Symposium on the Foundations of Computer Science (FOCS), 1996. 122 CGKS95. B. Chor, O. Goldreich, E. Kushilevitz, and M. Sudan. Private information retrieval. In Proc. 36th IEEE Symposium on the Foundations of Computer Science (FOCS), pages 41–51, Oct. 1995. 123 CGT95. C. Cr´epeau, J. van de Graaf, and A. Tapp. Committed oblivious transfer and private multi-party computation. In Advances in Cryptology — CRYPTO ’95, volume 963 of Lecture Notes in Computer Science, pages 110–123. Springer-Verlag, 1995. 122 Cha89. D. Chaum. The spymasters double-agent problem. In Advances in Cryptology — CRYPTO ’89, volume 435 of Lecture Notes in Computer Science, pages 591–602. Springer-Verlag, 1989. 123, 123, 123, 124 DDWY93. D. Dolev, C. Dwork, O. Waarts, and M. Yung. Perfectly secure message transmission. Journal of the ACM, 40(1):17–47, Jan. 1993. 124, 124, 126 Dwo90. C. Dwork. Strong verifiable secret sharing. In Proc. 4th International Workshop on Distributed Algorithms ’90, volume 486 of Lecture Notes in Computer Science, pages 213–227. Springer-Verlag, 1990. 126 FKN94. U. Feige, J. Kilian, and M. Naor. A minimal model for secure computation. In Proc. 26th ACM Symposium on the Theory of Computing (STOC), pages 554–563, 1994. 122 FM88. P. Feldman and S. Micali. Optimal algorithms for Byzantine agreement. In Proc. 20th ACM Symposium on the Theory of Computing (STOC), pages 148–161, 1988. 129, 129 FR96. M. K. Franklin and M. K. Reiter. The design and implementation of a secure auction service. IEEE Transactions on Software Engineering, 22(5):302–312, May 1996. 123 Fra93. M. K. Franklin. Complexity and Security of Distributed Protocols. PhD thesis, Columbia University, 1993. 122 FY92. M. K. Franklin and M. Yung. Communication complexity of secure computation. In Proc. 24th ACM Symposium on the Theory of Computing (STOC), pages 699–710, 1992. 122 GHY87. Z. Galil, S. Haber, and M. Yung. Cryptographic computation: Secure faulttolerant protocols and the public-key model. In Advances in Cryptology — CRYPTO ’87, volume 293 of Lecture Notes in Computer Science, pages 135–155. Springer-Verlag, 1987. 123 GJKR96a. R. Gennaro, S. Jarecki, H. Krawczyk, and T. Rabin. Robust and efficient sharing of RSA functions. In Advances in Cryptology — CRYPTO ’96, volume 1109 of Lecture Notes in Computer Science, pages 157–172. SpringerVerlag, Aug. 1996. 123

136

Matthias Fitzi et al.

GJKR96b. R. Gennaro, S. Jarecki, H. Krawczyk, and T. Rabin. Robust threshold DSS signatures. In Advances in Cryptology — EUROCRYPT ’96, volume 1070 of Lecture Notes in Computer Science, pages 354–371. Springer-Verlag, May 1996. 123 GM93. J. A. Garay and Y. Moses. Fully polynomial Byzantine agreement in t + 1 rounds (extended abstract). In Proceedings of the Twenty-Fifth Annual ACM Symposium on Theory of Computing, pages 31–41, San Diego, California, May 1993. 129, 129 GMW87. O. Goldreich, S. Micali, and A. Wigderson. How to play any mental game — a completeness theorem for protocols with honest majority. In Proc. 19th ACM Symposium on the Theory of Computing (STOC), pages 218–229, 1987. 122, 122, 123 GRR98. R. Gennaro, M. O. Rabin, and T. Rabin. Simplified VSS and fasttrack multiparty computations with applications to threshold cryptography. In Proc. 17th ACM Symposium on Principles of Distributed Computing (PODC), 1998. 126, 126, 127, 127 HM97. M. Hirt and U. Maurer. Complete characterization of adversaries tolerable in secure multi-party computation. In Proc. 16th ACM Symposium on Principles of Distributed Computing (PODC), pages 25–34, Aug. 1997. 122 KO97. E. Kushilevitz and R. Ostrovsky. Replication is not needed: Single data base computationally-private information retrieval. In Proc. 38th IEEE Symposium on the Foundations of Computer Science (FOCS), pages 364– 373, 1997. 123 Kus89. E. Kushilevitz. Privacy and communication complexity (extended abstract). In Proc. 30th IEEE Symposium on the Foundations of Computer Science (FOCS), pages 416–421, 1989. 122 KY. A. Karlin and A. C. Yao. Unpublished manuscript. 129 LSP82. L. Lamport, R. Shostak, and M. Pease. The Byzantine generals problem. ACM Transactions on Programming Languages and Systems, 4(3):382–401, July 1982. 129, 129 MP91. F. J. Meyer and D. K. Pradhan. Consensus with dual failure modes. In IEEE Transactions on Parallel and Distributed Systems ’91, volume 2, pages 214–221, 1991. 124, 124, 131, 132, 132 MS81. R. J. McEliece and D. V. Sarwate. On sharing secrets and Reed-Solomon codes. Communications of the ACM, 24:583–584, 1981. 126 RB89. T. Rabin and M. Ben-Or. Verifiable secret sharing and multiparty protocols with honest majority. In Proc. 21st ACM Symposium on the Theory of Computing (STOC), pages 73–85, 1989. 122, 122, 123, 123, 123, 123, 123, 128, 128, 129, 129, 129, 129, 129, 129, 134 SDFY94. A. de Santis, Y. Desmedt, Y. Frankel, and M. Yung. How to share a function securely. In Proc. 26th ACM Symposium on the Theory of Computing (STOC), pages 522–533, 1994. 123 Sha79. A. Shamir. How to share a secret. Communications of the ACM, 22:612– 613, 1979. 125 Yao82. A. C. Yao. Protocols for secure computations. In Proc. 23rd IEEE Symposium on the Foundations of Computer Science (FOCS), pages 160–164. IEEE, 1982. 122, 123

Fast Digital Identity Revocation (Extended Abstract) William Aiello1 , Sachin Lodha2? , and Rafail Ostrovsky1 1

2

Bell Communications Research, [email protected] [email protected] Rutgers University Computer Science Department, [email protected]

Abstract. The availability of fast and reliable Digital Identities is an essential ingredient for the successful implementation of the public-key infrastructure of the Internet. All digital identity schemes must include a method for revoking someone’s digital identity in the case that this identity is stolen (or canceled) before its expiration date (similar to the cancelation of a credit-cards in the case that they are stolen). In 1995, S. Micali proposed an elegant method of identity revocation which requires very little communication between users and verifiers in the system. In this paper, we extend his scheme by reducing the overall CA to Directory communication, while still maintaining the same tiny user to vendor communication. We contrast our scheme to other proposals as well. Keywords: Certificate authority, certificate revocation, signatures, public-key infrastructure, digital identities.

1

Introduction

MOTIVATION: Digital identities (and author-identities of messages) are essential for business, private, and government use of the Internet. For example, they are needed for on-line shopping, business-to-business transactions, on-line banking, code-authentication, company-internal identities, etc. (see, for example [16,17]). The U.S. Federal government, NIST, the U.S. Post-office, Visa and Master Card, some major banks, and private companies (like VeriSign, SIAC, IBM, GTE, and Microsoft) are all building digital identity infrastructures. While the general design of all these schemes is similar, and relies on public-key cryptography and Certificate Authority services, the details (and hence the efficiency) of what it means for a digital identity to be valid , and how it can be revoked differs from scheme to scheme. ?

Part of this work was done while this author visited Bellcore, also partially supported by DIMACS.

H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 137–153, 1998. c Springer-Verlag Berlin Heidelberg 1998

138

William Aiello et al.

THE GENERAL SETTING: The general setting consists of two ingredients blended together, namely, public-key cryptography [1] and a Certificate Authority Infrastructure (PKI). We briefly review both notions. Public-key cryptography encompasses digital signatures and public-key encryption. A digital signature scheme is a triple of algorithms, a key generation algorithm which generates a public key and a secret key, the signing algorithm and the verification algorithm. The signing algorithm uses the public and private key to generate a signature for an arbitrary document. The verification algorithm uses just the public key to verify the signature of a document. The specifications require that all signatures generated with the valid secret key are verified by the verification algorithm; and, without the private key it is computationally infeasible to generate a signature for a (previously unsigned) message which the verification algorithm would accept. Public-key encryption is also a triple of algorithms, a key-generation algorithm which produces private and secret keys an encryption algorithm and a decryption algorithm. Anyone, given the public key can encrypt a message using the encryption algorithm, but only those who have the secret key can efficiently decrypt. For formal definitions and further details see [13,3,4]. When using public-key cryptography over the Internet, the main issue is the ability to associate the right public-keys to the right individuals/organizations. The overall strategy for doing so is as follows. In its simplest form, we assume one or more trusted Certificate Authority (CA) centers which initially run the signature key generation algorithm to compute its own public and secret keys. Each CA holds its secret key under great security but widely distributes (say, publishes in NY-Times) its public key (or uses some other method to “bind” the public key to the CA). Now, any entity, who wishes to establish its digital identity with this CA, first generates its own public-key/private-key pair. Then, it submits its public key along with its name and other required identifying information to this CA. The CA checks the name and identifying information and if satisfied signs the public key and the name of the individual along with some subset of the identifying information, including expiration date a serial number, and possibly other information. (The amount of identifying information and the scrutiny of the information checking establish the level of trust with which a public key is “bound” to the identified entity.) Now, any user can verify that a message came from this individual by verifying both the signature of the message against a given public key and also verifying that this public key together with the right name and the valid expiration date are properly signed by CA. The above simple scheme extends to various hierarchies of CA structures (such as Federal Public Key Infrastructure (PKI) hierarchy, banks, company-internal CA, etc.) where a user will belong to many such hierarchies [14]. (See also [15] and references therein for more general structures.) For all these schemes, no matter what the structure is, one of the main bottlenecks is the issue of revocation. THE MAIN BOTTLENECK: When a public-key, together with an expiration date, is signed by a CA, there remains a risk. That is, a user’s private key and

Fast Digital Identity Revocation

139

certificate may be stolen/compromised, or a company’s private key and certificate may be retained by a former employee. Without a method for certificate revocation, these keys may be used by unauthorized parties. Just as with creditcards, occasional revocation is a fact of life. According to some estimates, about 10% of public keys will usually be revoked before they expire [9]. Thus, an important element of any CA scheme (or hierarchy) is its revocation procedure. Notice, that with revocation, the above simple setting becomes more involved, since now to verify that some public key is valid, one must not only check that it has been signed by the proper CA, but also that is has not been revoked. (Moreover, in case of CA hierarchy, one must certify that the CA public key has not been revoked either). Thus, the definition of one’s identity depends on the revocation rules in an essential way. In this paper, we extend an elegant method of S. Micali [9,10] of doing revocations. Before we explain our approach, let us review the design objectives and previous work done on this issue. THE SETTING: Our setting is the one identical to [9]. We review it here. We consider some finite universe of users. The setting consists of one or several trusted certificate authorities, which distribute, at regular intervals (for example, each day), information regarding revoked certificates to several untrusted directories D. (The reason for having many directories is to allow replication of data) For each day, any directory should be able to provide a proof whether any user’s u public key is valid or revoked. Of course, we insist that the directory (which is untrusted) can not cheat and change revocation status for any user. The proof of the revocation status the Directory can provide either to user himself (who can then pass it along to any vendor or any other user who wishes to check that the user’s identity is still valid). The critical costs of the scheme are of course the size of the proof of the validity of user’s identity (i.e., this proof should be as small as possible, since this is the most frequently used operation,) as well as the communication from Certificate Authority to the Directories for each period. PREVIOUS WORK: We briefly discuss some of the earlier work done on this problem. Previous to our work, three possible revocation strategies were proposed: the “centralized on-line solution”; Certificate Revocation Lists (see, for example, [16]) and Micali’s proposal and patent [9,10]. Independent of our work, two other schemes by Kocher [6] and Naor and Nissim [11] have been proposed. We review all these schemes below and point out the differences. In the centralized on-line solution, similar to credit-cards, there is a CA trusted central database, which maintains the status of all public-keys that have not expired. The user, in order to verify that a public-key has not been revoked makes a query to this central database, and receives an answer. The answer must be authenticated, either implicitly by use of a private network, with a CA signature, or with CA private-key authentication, provided that the CA shares with this user a private authentication key. This centralized solution has several drawbacks: the CA must be accessed for the verification processes on-line (or

140

William Aiello et al.

risk using revoked public-key) and its answer must be authenticated (to prevent man-in-the-middle attacks of somebody impersonating to the CA). The centralized on-line solution is not acceptable in many cases, and thus a distributed solution is sought. One such solution is the so-called Certificate Revocation List (CRL) (see, for example, VeriSign [16]). In this approach the CA composes a list, say each day, of all keys thus far revoked and signs this list. This list along with the CA’s signature of the list is the CRL for that day. Each day the CA sends the CRL to all the untrusted revocation directories all over the network. To verify a public key certificate, the verifier first checks the expiration date. If the certificate has not expired it contacts any directory for that day’s CRL. If the public key does not appear in the CRL it is still valid. This solution is better than the centralized solution, since now many sites maintain the CRL list, and every such site, instead of maintaining the status of all public-keys must only maintain a list of revoked public-keys, where typically R, the number of revoked keys is much less than the number of keys N . The drawback is that the proof that some key is still valid is the entire CRL list, signed by the CA. In 1995 Micali proposed a scheme in which a verifier needs only a small number of additional bits beyond a user’s signature and the user’s public key certificate and only a small amount of extra computation to insure that the user has not been revoked [9,10]. In this scheme, Micali uses the idea of off-line/online signatures [2], which in turn builds on the work of Lamport [7]. The basic idea is as follows. Let f be a one-way permutation which is easy to compute but hard to invert (in practice, MD5 or other hash-functions are used). Now, for each user, u, the CA picks a random xu and computes yu = f (f (f · · · f (xu ))), where f is applied, for example, for 365 times to compute yu . This yu is called user u’s “0-token.” For each user the CA includes the user’s 0-token along with the users public key, and expiration date and other certificate information in its signed certificate. Now, after the first day, for each user u whose public key has not been revoked that day, the CA releases user u’s “1-token”, f −1 (yu ), to the directories in the network (which is can compute from xu or from cached intermediate values of f i (xu )). Note that, given a 0-token for a user u it is easy to check whether a candidate token is a 1-token for user u, but computationally infeasible to compute a 1-token for user u. To verify on the second day that the public key of a user u was not revoked on the first day, a verifier gets a candidate token from a directory or a candidate token from the user (who retrieved it already from a directory). The verifier then checks whether the candidate is a 1-token for the user. In general, if u’s certificate is not revoked up through day i, the CA provides u’s i-token, f −i (yu ), to the directories. Verifier on the i + 1st day check whether candidate tokens are i-tokens for users. The advantage of the scheme is that communication between a directory and a user (or verifier) is small and need not be authenticated. If a given protocol calls for the user to retrieve the day i-token from the directory then the token remains a short certificate for day i + 1 that user has not been revoked. In addition, verifying a day i-token is less expensive then verifying the signature of a CRL. The disadvantage is that the scheme requires (for each day) the CA to send N − R tokens to each

Fast Digital Identity Revocation

141

directory where N is the number of public keys and R is the number of revoked keys. Micali also considers (as in our setting) the case where a directory may act maliciously by not forwarding the day i-token of a user it received from the CA to the user or verifier. A non-revoked user could thus be considered revoked by a verifier. To prevent this Micali modifies his scheme as follows. For each user the CA also chooses a random x0u , the “revocation token,” and includes f (x0u ) in u’s certificate, along with the 0-token and other certificate information. When u’s public key is revoked the CA sends the revocation token to the directories. When a directory is queried about a user on day i + 1 it must return either the day i-token or the revocation token for that user. Recently, Naor-Nissim [11] have improved upon a scheme of Kocher [6]. We will describe the requirements of their scheme. For the details of the scheme see [11]. For R revoked keys, in the Naor-Nissim scheme the CA maintains an authenticated 2-3 tree of hash values of depth O(log R). For each public key which is revoked in an update period, the CA must update this special tree by computing O(log R) new hash values. As long as one key is added to this revocation tree the root must be recomputed and signed. The CA sends to the directories the lists of users to insert and delete, and a signature of the root. The directories insert and delete the users from the tree, recompute the hash values and check the signature of the root. When a user queries a directory concerning the revocation status of a key, the directory sends O(log R) hash values and the signature of the root. To verify the revocation status of a key, a user must compute O(log R) hash values, compare them in a specified way with the hash values from the directory and verify the signature of the root hash value. In summary, the CA to Directory communication of Naor-Nissim scheme is superior to our scheme (as well as Micali’s scheme) but the verification of the revocation status of the user (or vendor) is smaller for Micali scheme and our scheme. OUR RESULTS: We will build on Micali’s scheme [9,10] to maintain its advantage of efficient verification. Recall that in Micali’s scheme every user’s certificate contains one 0-token. In order for the user to remain unrevoked on day i + 1 the CA must publish the i-token associated with the user’s 0-token. In our scheme the CA will incorporate k 0-tokens into the certificate for each user rather than just one, where k will be a parameter of our scheme. The sets of 0-tokens for the users will be distinct, however, the sets may intersect substantially. The rule for remaining unrevoked will now be slightly different. In order for a user to remain unrevoked on day i + 1 the CA need only publish an i-token associated with one of the user’s 0-tokens. Since the sets of 0-tokens may intersect, one i-token may act as a certificate of non-revocation for many users. Thus the CA may not need to publish N − R tokens when R keys have been revoked as in Micali’s scheme. For example, we show that if the number of 0-tokens in each certificate is log N , and the sets of 0-tokens in each user’s certificate are selected properly, then the number of tokens a CA must publish during an update period is R log N/R. In this paper we insist that the proof from user to vendor of the validity of user’s ID remains very small, as in Micali’s scheme. For the scheme of Naor-

142

William Aiello et al.

Nissim, this is not the case (i.e., while [11] substantially save on the CA to Directories communication over [9], their proof of validity is bigger). In this paper, we study the tradeoff between the number of 0-tokens needed in a certificate and the number of tokens a CA must publish per update period. We summarize our results (and compare it to Micali’s scheme) below. Note that N stands for the number of not-yet-expired certificates, R stands for number of revoked certificates, and c is a parameter in the general scheme, typically a constant. Scheme # Tokens from # Tokens per Name CA to directories Certificate Micali’s Scheme N −R 1 Our Hierarchical Scheme R log (N/R) log N Our Generalized Scheme R logc (N/R) + R (2c−1 − 1) logc N

Table 1. Comparison of Our Results and Micali’s scheme

Notice that if the number of revocations is small our scheme is faster then Micali’s approach. However, even if the number of revocations is large, and in fact for any value of R, 0 ≤ R ≤ N we show that the information update cost is better then the above table indicates, and in fact is always smaller then N − R of Micali’s scheme. In practical settings, both our hierarchical scheme and our general scheme with c = 3 provide savings in communication compared to the Micali’s approach. (For example, for the hierarchical scheme, with 10% revocation rate we gain 2.7 multiplicative factor improvement, and for 1% revocation rate we gain 14.9-fold improvement over Micali’s communication from CA to Directories, while still required a single hash-value (i.e. 128 bits) proof of the validity of one’s identity. For the generalized scheme with c = 3 we get 2.9-fold improvement for the 10% revocation rate and 19-fold improvement for 1% revocation rate) If the percentage of revoked users is smaller then the savings are more substantial. We should remark here that Micali’s method to avoid malicious directories by including one extra token in each certificate applies to our scheme as well and we will not explicitly include this in the description of our scheme. In the Naor-Nissim scheme [11], the communication from CA to Directories is smaller then our scheme and Micali’s scheme. However, both Micali’s scheme and our scheme, the directories need only send one token (of 128 bits) in response to a query about any key. Paper outline: In the next section we describe our scheme and prove a bound of R log R/N on the number of tokens the CA must send the directories. In Section 3 we describe a generalization of our scheme which requires the CA to send asymptotically fewer tokens to the directories using a novel complement cover construction. (We believe that this construction is of independent interest, and might be useful for other purposes as well.) In Section 4 we describe a variant of our scheme which includes an incremental feature. That is, if some public key

Fast Digital Identity Revocation

143

is revoked on day i, we do not have to pay for this on the following days (i.e. we pay for each revocation only once.) We now proceed with the details of our scheme.

2 2.1

Hierarchical Scheme Description of the Scheme

For concreteness, we will assume that certificates are valid for D days and that certificates are revoked once per day. Let f be a one-way permutation from n bits to n bits. Consider the following sequence: (r, f (r), f 2 (r), . . . , f D (r)) where r is a uniformly chosen n bit string. We will call this the chain of r and denote it by cr . We will index this sequence in reverse order and starting from 0. That is, the 0th element of the sequence,cr (0), is f D (r). We will call this the 0-token of the chain of r. Similarly, cr (1) = f D−1 (r) which we will call the 1-token of the chain of r. Note that the 1-token is the inverse of the 0-token, i.e., cr (1) = f −1 (cr (0)) = f D−1 (r). More generally, define cr (j) = f −j (cr (0)) = f D−j (r), j ≥ 1. We will call cr (j) the j-token of the chain of r. Note it is easy to verify whether a token τ is an i-token of a chain once the 0-token (or a j-token, 0 ≥ j < i) of a chain is known. Simply compute f i (τ ) (f i−j (τ )) and check for equality with the 0-token (j-token). However, by the properties of a one-way permutation, given any number of the j-tokens of a chain, 0 ≥ j < i, it is computationally infeasible to compute the i-token of the chain. Before we describe our revocation scheme it will be useful to review Micali’s revocation scheme. In the Micali scheme, for each user v there is a random n bit string rv and a chain crv . For notational simplicity we will hereafter refer to this as the chain of v and denote it by cv . In this scheme the 0-token of v, cv (0), is incorporated into the certificate of v which is signed by the CA. If user v has not been revoked up to and including day i then the CA will issue the i-token of v in response to queries about the status of user v’s certificate. Otherwise, the CA will not issue an i-token. To verify that signer v has not been revoked up to and including day i, a verifier must have v’s certificate and a candidate i-token τ for v which he obtains from either the CA, a directory, or v (who had previously obtained it from the CA or a directory). He accepts that v has not been revoked up to and including day i if τ is verified to be the i-token of v. We will now describe our first and simplest scheme for revocation. For simplicity we will assume that the number of users N = 2l is a power of 2 and that all users are issued certificates at the beginning of day 1. (We remark that these assumptions can be relaxed. We introduce them here for the clarity of exposition.) Each user is given an l bit id v ∈ {0, 1}l . We associate these ids with the leaves of a labeled complete binary tree of height l in the natural way. That is, label the root by the null string φ, and label its two children by 0 and 1. Given any node in the tree whose label is a binary string s of length less than l, label

144

William Aiello et al.

one child with s0 and the other with s1. For each node u in this tree the CA computes a chain cu . For an l bit id, v, let (φ = v0 , v1 , . . . , vl−1 , vl = v) denote the nodes on the path from the root to v in this tree. Call the set of chains for this path the path of chains of v which we denote by pcv , i.e., pcv = (cv0 , . . . , cvl ). Furthermore, call the set of i-tokens of this path of chains the path of i-tokens of v and denote this symbolically as pcv (i), i.e., pcv (i) = (cv0 (i), . . . , cvl (i)). Of course, given the path of 0-tokens of v it is easy to verify whether a token τ is on the path of i-tokens of v (and even easier to verify whether τ is the i-token of, say, the jth node on the path). The CA’s Certificates: When creating a certificate for user v, the CA includes pcv (0), the path of 0-tokens of v, in the certificate (rather than just including the 0-token of chain cv in the certificate as in the Micali scheme). Note that this path consists of log N + 1 0-tokens. The CA’s Update Operation: Let Ri be the set users which have been revoked at some point up to and including day i. At the end of day i, the CA will calculate a subset of nodes of the labelled tree, called the day-i verification nodes with the following two properties. 1. For every v ∈ / Ri , there is at least one node of the path of v which is a day-i verification node. 2. For every user r ∈ Ri , none of the nodes on the path of r is a day-i verification node. For each node which is a day-i verification node, the CA can compute (or has cached) the i-token of that node. Call the collection of all such i-tokens the day-i verification tokens. The CA sends the day-i verification tokens to the directories. A Directory’s Query Response: In response to queries on day i + 1 concerning user u, if u has not been revoked through the end of day i, then at least one node on the path of u is a day-i verification node. The directory issues the i-token of one such node. This i-token is, by definition, a member of the day-i verification tokens. If u has been revoked, no node on the path of u is a member of the day-i verification nodes and, hence, the directory cannot issue an i-token. The Verifier’s Operation: A verifier v must verify both the signature of a signer u and u’s certificate. This certificate contains the path of 0-tokens of u. We assume that the verifier has retrieved u’s certificate and a candidate i-token, τ , from either the signer, the CA, or a directory. He accepts that u has not been revoked up to and including day i if τ is verified to be an i token of one of the nodes on the path of u. By property 1 of the day-i verification nodes, for a non-revoked signer u, an i token of one of the nodes on the path of v will be available for the verifier and the verifier will thus accept v.

Fast Digital Identity Revocation

145

By property 2 of the day-i verification nodes, and the definition of oneway permutation, it is computationally infeasible for a revoked user, u, or any accomplice to deliver a token to the verifier which the verifier will accept as being an i-token of a node on the path of u. Calculating the Day-i Verification Nodes Given a set of revoked users Ri , the CA can calculate the day-i verification nodes by operating on the labelled tree as follows. First, mark as “revoked” every node in the path of every revoked user. Now, the day-i verification nodes consists of all non-revoked nodes which are children of a revoked node. It is easy to verify that this set satisfies the two properties above and moreover, that it is the minimal set which satisfies these two properties. As an example, suppose that none of the users have been revoked on day one, then the set of day-1 verification tokens consists of a single token: the 1-token of the root. Since this 1-token is on every users’ path of 1-tokens, a verifier which is given this token will accept every user. As another example, suppose that the user denoted by the string of all 1s is revoked the 1st day. The day-1 verification tokens consists of the 1-tokens of the l nodes 0, 10, 110, . . . , 11 · · · 110. It is easy to verify that this set can be used to accept all but the revoked user. In the next section we analyze the size of the set of verification nodes as a function of the number of revoked users. 2.2

Size of the Set of Verification Nodes

In this section we derive an upper bound on the number of day-i verification nodes (and hence the number of day-i verification tokens) as a function of the number of nodes which have been revoked up to and including day i. Let N denote the number of users and r be the number of revoked users. Definition 1. Let T¯(N, R) be the number of verification nodes in the labelled tree for N users when the set of revoked users (leaves) is R. Let T (N, r) = max|R|=r T¯ (N, R). We will assume that N is a power of 2. We now prove the following. Theorem 1. For r = 0, T (N, r) = 1. For 1 < r ≤ N/2, T (N, r) ≤ r log (N/r). And, for N/2 ≤ N T (N, r) ≤ N − r. Proof Sketch: Let N = 2l so that the labelled tree is a complete binary tree of height l. When |R| = r = 0, the set of verification nodes just consists of the root of the labelled tree and thus T (N, 0) = 1 for all N . When r = 1, our algorithm will mark as revoked all the nodes on the path of this revoked user. The algorithm puts all nodes which are children of revoked nodes into the set of verification nodes. There are log N such children. So, T (N, 1) = log N ∀N . Now consider the case when r > 1. First consider the case when r = 2k , k ≥ 1, is a power of 2. Consider the r subtrees in the labelled tree whose roots

146

William Aiello et al.

are the nodes at depth k in the labelled tree. These trees have height l − k. We ˜ as follows. R, ˜ for |R| ˜ = r, is in R ˜ if there is define the family of revoked sets R ˜ in each of the subtrees of height l − k. exactly one revoked user of R ˜∈R ˜ each By our previous analysis for one revoked user in a tree, for any R subtree of height l − k requires l − k verification nodes. Note that no other ˜ ∈ R, ˜ the total number of verification nodes are required. Hence, for any R ˜ is just r(l − k) = r log N/r. We will now show that verification nodes, T (N, R), ˜ that T¯ (N, R) < r log N/r. Actually we will prove the stronger for any set R ∈ / R, statement in the lemma below. We will use the following definition. For any set of revoked users R let sR be the number of subtrees of height l − k with no elements of R. Lemma 1. For r a power of 2 and for any set of revoked users R of size r there ˜ in R ˜ such that T¯ (N, R) ≤ T¯ (N, R) ˜ − sR . is a R Proof: We begin with two simple lemmas. Lemma 2. Let R be the set of revoked leaves and consider a maximal subtree with no revoked leaves of height h. Let u be a leaf of this subtree. Then, T¯ (N, R ∪ {u}) = T¯(N, R) + h − 1. To see this note that for the set R the subtree was covered by one verification node at the root of the subtree. However, the number of verification nodes in the subtree after u is added to the revoked set is h. t u Lemma 3. Let R, for |R| ≥ 2 be the set of revoked leaves and consider a minimal subtree containing exactly two elements of R of height h0 . Let u be one of the two elements. Then T¯(N, R − {v}) = T¯ (N, R) − (h0 − 2). To see this note that in R the subtree has 2h − 2 verification nodes whereas R − {v} it has h verification nodes. We will prove the Lemma 1 by induction. That is, we will show that for any R with |R| = r and sR ≥ 1, there is an R0 with |R0 | = r such that sR0 = sR − 1 and T (N, R) ≤ T (N, R0 ) − 1. Clearly, the lemma will then follow. t u So, consider an R with |R| = r and sR ≥ 1 subtrees of height l − k with no elements of R. Let u be one of the leaves of one of these subtrees. Let v be a leaf in R of a subtree of height l − k with two or more leaves in R. Such a subtree must exists. Let R0 = (R/{v}) ∪ {u}. Note that the number of subtrees of height l − k with no elements of R0 is sR − 1. The maximal subtree containing u but containing no elements of R has height at least l − k. The minimal subtree containing v and exactly one other element of R has height at most l − k. Thus using the two claims, we conclude that T¯ (N, R) ≤ T¯ (N, R0 ) − 1. This concludes the proof of the lemma. t u We now consider the case when r is not a power of 2. We write r as 2k + m ˜ in where k = blog rc and 0 < m < 2k . We define the family of revocation sets R ˜ a similar fashion to the case when r is a power of two. The revocation set R is in ˜ if R ˜ has the following properties. Call a subtree of height l − k − 1 a i-subtree R

Fast Digital Identity Revocation

147

˜ Now, of the 2k+1 subtrees of height l − k − 1, r = 2k + m if i of its leaves are in R. of them are 1-subtrees and 2k − m of them are 0-subtrees. Furthermore, each of the 0-subtrees is “paired” with a 1-subtree. That is, the sibling of the root of each 0-subtree is a root of a 1-subtree. (Note that such a pairing is possible since the number of 0-subtrees is strictly less than the number of 1-subtrees.) ˜ in Now let us consider the number of verification tokens required for a R ˜ R. Because each 0-subtree is paired with a 1-subtree, the root of each 0-subtree must be a verification node. The number of verification nodes required for each 1˜ in R, ˜ T (N, R) ˜ = r(l − k − 1) + 2k − m. subtree is just l − k − 1. Thus, for each R k ˜ If r > N/2 so that k = l − 1, then T (N, R) = 2 − m = N − r. Otherwise ˜ = r(l − k) − 2m. Since T (N, R) r log (r/2k ) = r log (1 +

m r ) ≤ m k < 2m k 2 2

it follows that r log (N/2k ) − 2m ≤ r log (N/r). As before, for an arbitrary revocation set R we define sR to be the number of 0-subtrees for R. Note that sR ≥ 2k − m for every R of size r = 2k + m. As in ˜ have the maximum the case when r is a power of two, the revocations sets in R number of verification nodes. This follows from the following lemma. Lemma 4. Consider a set of revoked users R whose size, 2k + m, is not a power ˜ in R ˜ such that T¯(N, R) ≤ T¯(N, R) ˜ − (sR − of 2. For each such R there is a R k (2 − m)). Proof: The proof is in two stages. In the first stage we start with an arbitrary R and find an R0 with 2k − m 0-subtrees such that T¯(N, R) ≤ T¯(N, R0 ) − (sR − (2k − m)). The first stage is identical to the proof of Lemma 1. It proceeds by induction. Each step reduces the number of 0-subtrees by one and increases the number of verification nodes by at least one. The second stage begins with R0 ˜ ∈ R. ˜ We will illustrate the first step of this stage. If R0 ∈ ˜ and ends with an R /R then there are two 0-subtrees whose roots are siblings and two 1-subtrees whose roots are subtrees. Let v be one of the elements of R0 in one of the two 1-subtrees and let u be a leaf of one of the 0-subtrees. Let R00 = (R0 /{v}) ∪ {u}. By our previous claims T (N, R0 ) ≤ T (N, R00 )− 1. This process can proceed by induction on the number of 0-subtrees paired with 1-subtrees until we have a verification ˜ ∈ R. ˜ set R t u We remark that T (N, r) ≤ N − r. This can be shown algebraically or just by observing that by construction, the number of verification nodes is never more than the number of non-revoked users. The number of tokens the CA needs to issue after r users have become revoked is at most T (N, r) in our scheme, and hence, this is at most the number of tokens the CA needs to issue in the Micali scheme which is N − r. For small r there is a large gap between the number of tokens which need to be issued in both schemes. For example, if r = N/64 (i.e., a revocation rate of approximately 1.5%), then N − r = (63/64)N is larger than T (N, r) ≤ (6/64)N by almost a factor of ten.

148

3

William Aiello et al.

Generalized Hierarchical Scheme

In this section we will first describe a set-theoretic object we call a complement cover family. We will then show that it properly captures the idea of assigning tokens to the non-revoked users. Finally, we will describe several complement cover families which thus yield constructions for the revocations problem. 3.1

Complement Cover Families

Consider a universe U of size N . Let R be any subset of U and let S and F ¯ = U − R denote the complement of R. denote families of subsets of U . Let R S ¯ Definition 2. S is a complement cover of R iff W ∈S W = R. Definition 3. F is a complement cover family of U iff for every subset R of U , F contains a complement cover of R. That is, for every subset R of U , there is a subset S of F such that S is a complement cover of R, We will see below that for all of our constructions of a complement cover family F, for every subset R of U , there is a unique subset S of F which is a complement cover of V . We will call such families unique complement cover families. For any unique complement cover family F , and every subset R of U , let CCF (R) denote the unique complement cover of R which is contained in F. Furthermore, denote the function δF as the size of the complement cover of F which is defined as follows: δF (r) = maxR∈U,|R|=r |CCF (R)|. For every complement cover F and every element of u ∈ U , define HF (u) as the sets in F which contain u. Let hF (u) = |HF (u)| denote the height of u in F . By abuse of notation, define the height of F , hF as maxu∈U hF (u). Note that if u∈ / R then the intersection of CCF (R) and HF (u) is not empty, otherwise it is empty. This follows from the definition of a complement cover family. We will now show how a unique complement cover family can be used as a data structure for certificate revocation. Let U be the set of users and F a unique complement cover family of U . The CA creates a chain for each set S of F. Call this chain cS . The CA’s Certificates: Recall that for every user u, HF (u) is the collection of subsets which contain u. For each such subset there is a chain. Call this set of chains the chains of HF (u). Denote the set of i-tokens of the chains of HF (u) as the i-tokens of HF (u). The certificate signed by the CA of each user u contains the 0-tokens of HF (u). The CA’s Update Operation: As before, let Ri denote the set of users which have been revoked at some point up to and including day i. At the end of day i, The CA will set the day-i verification sets to be CCF (Ri ), the complement cover of Ri . Define the set of day-i verification tokens to be the i-tokens of each set in the complement cover of Ri . The CA sends the day-i verification tokens to the directories.

Fast Digital Identity Revocation

149

A Directory’s Query Response: In response to queries on day i + 1 concerning user v, if v has not been revoked through the end of day i, the directory computes the intersection of HF (v) and CCF (Ri ). The directory issues an i-token of one of the sets in the intersection. Note that this i-token is in the set of day-i verification tokens. If v has been revoked, the intersection is empty and, hence, the directory cannot issue a token. The Verifier’s Operation: The day-i verification tokens are used by verifiers on day i + 1 to test whether users have or have not been revoked at some point up through the end of day i. This is done as follows. For a signer, v, as before a verifier is given v’s certificate. This certificate contains the 0-tokens of HF (v). In addition the verifier retrieves a candidate i-token, τ , from either the signer, the CA, or some other source. He accepts that v has not been revoked up to and including day i if τ is verified to be one of the i-tokens of HF (v). By the definition of the complement cover of Ri , for a non-revoked user v one of the i-tokens of HF (v) will be available for the verifier and the verifier will thus accept v. In addition, by the definition of one-way permutation, it is computationally infeasible for a revoked user or any accomplice to deliver a token to the verifier which the verifier will accept as being an i-token of HF (v). Since unique complement cover families are useful as revocation data structures we are interested in finding a family F of U such that 1. |F| is O(N c ) for some small constant c, i.e., number of chains required in the system is practical. 2. hF is small, i.e., the number of 0-tokens in the certificate of every user is small. 3. The complement cover of every set, CCF , can be efficiently computed. 4. The size of the complement covers, δF (·) as a function of the size of the revoked users is small. 3.2

Example Complement Cover Families

We consider two extreme, but simple, solutions for this problem : S – F = {{1}, {2}, . . . , {N }}. Given any R, U − R = x∈R / {x}. Thus, F is a complement cover of U . Clearly, |F | = N . Note that δF (r) = N − r and hF = 1. Observe that this corresponds to Micali’s scheme. Note that since δF (r) = N − r, the number of tokens the CA must issue when r is small is quite large. – F = 2U . Given any R, U − R ∈ F . So, δF (r) = 1. Thus, the number of day-i verification tokens is 1 regardless of the number of revoked users. However, the certificate size is hF = 2N −1 and |F | = 2N . Thus, the solution is obviously not practical because the size of the certificates and the CA’s data structure is exponential. These two families stand at two opposite poles - the first family has small size and small hF but a large δF , and the second family has a small δF but large size and large hF . Below we will describe a scheme which has the advantages of both of the above.

150

William Aiello et al.

3.3

Description of General Scheme

We will now describe a construction for a unique complement cover family which is parameterized by integer c ≥ 2. For simplicity, suppose that N = cl for some positive l. The first subset we put into the family is the entire set of cl elements. We next divide the elements into c subsets of size cl−1 each and put these subsets into the family. These are level 1 subsets. Further divide each level 1 subset into c subsets of size cl−2 . These are level 2 subsets. Continue dividing the subsets and adding them to the family until all the level l subsets of size one have been added to the family. The collection of level i subsets which are subsets of the same level i − 1 subset are called siblings and the level i − 1 subset is called their parent. For example, in Fig. 1, {4}, {5} and {6} are siblings in level 2 and their parent is {4, 5, 6}. Note that thus far we have (cl+1 − 1)/(c − 1) subsets in the family and every element of U is in l + 1 sets. If c = 2 we are done. Otherwise, we will continue to add to this family as follows. For each collection of sibling subsets do the following. First, form subsets
which are the union of any two siblings. There are 2c such subsets. Add these to the family.
Then, form the subsets which are the union of any three siblings.
There are 3c such subsets. Add these to the family. In general, form the ci subsets which are the union of i siblings, for 1 < i < c, and add these to the family. This completes the subsets of the family. Using edges to represent the (maximal, nontrivial) subset relation, this complement cover family can be represented by a graph. See Fig. 1 for an example when c = 3 and N = 32 .

{1,2,3,4,5,6,7,8,9}*

{1,2,3,4,5,6}*

{4,5,6,7,8,9}

{1,2,3,7,8,9}*

Level 1 {1,23}*

{1,2}*

{1}*

{1,3}*

{2}*

{4,5,6}

{2,3}*

{3}

{4,5}

{4}

{4,6}

{5}

{7,8,9}

{5,6}

{6}

{7,8}

{7}

{7,9}

{8}

Siblings

{8,9}

{9}

Level 2 Siblings

Fig. 1. An example of the complement cover of {1, 2} for c = 3 and N = 9. The revoked nodes are marked with an asterisk. The sets which comprise the complement cover are circled.

Fast Digital Identity Revocation

151

The size of this family is 2c cl − 1 c (2 − 2) + 1 ≤ N . c−1 c−1 Also, it is easy to see that every element of U is in l(2c − 1) + 1 = hF ≤ 2c log N/ log c subsets of F. The complement cover of a revoked set R, CCF (R), can be computed as follows. As in the hierarchical scheme, first mark as revoked each singleton set whose sole member is a member of R. In Fig. 1 these sets are denoted by an asterisk. Then mark as revoked each subset of F which is a superset of any of these marked sets. In the graph representation, start by marking the revoked leaves. Then mark the immediate supersets of the marked leaves. Continue working up the graph until every superset of a marked set has been marked. In Fig. 1, the marked sets are marked with an asterisk. The elements of CCF (R) are the maximal subsets of F which have not been marked. In Fig. 1, they are circled. These elements are easy to find. For each set of siblings at a given level in which at least one of the sets, but not all, is marked as revoked do the following. If exactly one of the siblings is not marked, it is a member of CCF (R). For example, node {3} in Fig. 1. Otherwise, there is a unique subset of the parent of the siblings which is the union of the unmarked siblings. For example, node {4, 5, 6, 7, 8, 9} in Fig. 1. This set is a member of CCF (R). The size of the complement covers is given by δF (r) ≤ r logc N/ck − m ≤ r logc N/r − ck . This can be shown using methods similar to those for the hierarchical scheme. It is instructive to instantiate the scheme for several values of c. 1. c = 2 : This is the Hierarchical scheme. The size of the complement cover is |F| = 2N − 1, δF (r) ≤ r log (N/r) and hF = log N + 1. 2. c = 3 : This is an interesting case. It gives us a complement cover family of size 3N −2 with δF (v) = logv 3 log Nv ). Note that there is a 50% increase in size of F compared to the Hierarchical scheme, but more than a 50% decrease in δ (since log 3 = 1.585). So, it could be an alternative to the Hierarchical scheme. log N/v log N 3. c = log N : |F| = (O(N 2 ), δF (v) ≤ v log log N ) and hF ≤ N log log N . Although this setting achieves the lowest value for the size of the complement cover, |F| and hF may not be practical for moderately large N .

4

Incremental Version

Under the current scheme, if r1 users are revoked on day 1 and r2 users are revoked on day 2, the number of day 2 verification nodes is a function of r1 whereas the number of day 3 verification nodes is based on r1 + r2 although the number of users revoked the previous day was only r2 . We propose the following modification to our scheme such that the number of verification nodes needed

152

William Aiello et al.

for a given day depends only on the number of users revoked the previous day and not on all of the users revoked thus far. For the first modification we replace each chain of tokens of length 365 with a hash tree of depth 2 · 365, analogous to [8,5]. The root value of the hash tree becomes the 0-token. There is one such hash tree and 0-token associated with every node in the labelled tree of N elements. On day i, for each node v in the day-i verification set, the CA gives the log(2 · 365) + 1 hash values needed to compute the path from leaf 2i in the the hash tree to the 0-token associated with the node v. Call this the day-i verification path for node v. Note that given the day-j, for 1 ≤ j < i, verification paths for node v, it is computationally infeasible to compute the day-i verification path for v. This motivates our second modification to the scheme. Recall that each user’s certificate contains log N 0-tokens, one for each node in the labelled tree on the path from the user’s id to the root. Previously, for a user to be verified on day i, the verifier would a need a day-i verification path for one of the user’s 0-tokens. We change the protocol as follows. On day i, the CA computes the day-i verification set of nodes in the labelled tree using just the users revoked the previous day. The CA sends to the directory a day-i verification path for each node in the day-i verification set. Now, for a user to be verified on day i, the verifier will need a day-1 through day-i verification path with the additional property that the root of each of the verification paths is contained in the set of 0-tokens in the user’s certificate. This scheme reduces the CA to directory communication costs substantially. It can be shown that the average daily cost is proportional to at most (R/365) log(365N/R) where R is the total number of revocations throughout the year. Of course, this reduction is gained at the expense of a larger communication requirement for the verifier which is proportional to i for day i. This latter communication requirement can be reduced to log 365 by requiring the CA to produce incremental verification paths for the log 365 times scales of 2 days, 4 days, 8 days, etc. This only increases the average daily communication cost of the CA by a factor of 2.

References 1. W. Diffie, M. Hellman, “New directions in cryptography”, IEEE Trans. on Inf. Theory, IT-22, pp. 644–654, 1976. 138 2. S. Even, O. Goldreich and S. Micali “On-line/Off-line Digital Signatures” CRYPTO 1989. 140 3. S. Goldwasser, S. Micali “Probabilistic Encryption” JCSS Vol. 28 No. 22. April 1984. 138 4. S. Goldwasser, S. Micali, R. Rivest “A Digital Signature Scheme Secure Against Adaptive Chosen-Message Attacks” SIAM Journal of Computing, Vol. 17, No 2, April 1988, pp. 281-308. 138 5. C. Jutla and M. Yung “Paytree: amortized signature for flexible micropayments” In Second USENIX workshop on Electronic Commerce, November 1996. 152

Fast Digital Identity Revocation

153

6. P. Kocker, “A quick introduction to Certificate Revocation Trees (CRTs),” http://www.valicert.com/company/crt.html. 139, 141 7. L. Lamport “Password authentication with insecure communication” Communications of ACM, 24(11):770-771, November 1981. 140 8. R. C. Merkle, “A Certified Digital Signature,” Proceedings of Crypto‘89, pp. 234–246, 1989. 152 9. S. Micali “Enhanced Certificate Revocation System” Technical memo MIT/LCS/TM-542 , November 1995. available online URL ftp://ftppubs.lcs.mit.edu/pub/lcs-pubs/tm.outbox/ 139, 139, 139, 139, 140, 141, 142 10. S. Micali “Certificate Revocation System” U.S. Patent number 5666416, issued Sep. 9, 1997. 139, 139, 140, 141 11. M. Naor and K. Nissim, “Certificate Revocation and Certificate Update,” Proceedings of USENIX ‘98. 139, 141, 141, 142, 142 12. R. Rivest “The MD5 message-digest algorithm” Internet Request for Comments, April 1992. RFC 1321 available online URL http://theory.lcs.mit.edu/rivest/publications.html 13. R. Rivest, A. Shamir, L. Adleman “A Method for Obtaining Digital Signature and Public Key Cryptosystems” Comm. ACM, Vol 21, No. 2, 1978. 138 14. R. Rivest, B. Lampson “SDSI-A Simple Distributed Security Infrastructure” available online URL http://theory.lcs.mit.edu/ rivest/sdsi10.html 138 15. M. Reiter, S. Stubblebine “Towards Acceptable Metrics of Authentication” In Proc. of 1997 IEEE Symposium on Security and Privacy. 138 16. VeriSign Corporation, available online URL http://www.verisign.com/ 137, 139, 140 17. Microsoft “Proposal for Authenticating Code Via the Internet” April 1996, available online URL http://www.eu.microsoft.com/security/tech/authcode/authcode.htm 137

Self-Delegation with Controlled Propagation – or – What If You Lose Your Laptop Oded Goldreich1 , Birgit Pfitzmann2 , and Ronald L. Rivest3 1

Department of Computer Science, Weizmann Institute of Science, Rehovot, Israel. 2 Universit¨ at des Saarlandes, Fachbereich Informatik, Saarbr¨ ucken, Germany. 3 Laboratory for Computer Science, MIT, Cambridge, Mass., USA.

Abstract. We introduce delegation schemes wherein a user may delegate certain rights to himself, but may not safely delegate these rights to others. In our motivating application, a user has a primary (longterm) key that receives some personalized access rights, yet the user may reasonably wish to delegate these rights to new secondary (short-term) keys he creates to use on his laptop when traveling, to avoid having to store his primary secret key on the vulnerable laptop. We propose several cryptographic schemes, both generic ones under general assumptions and more specific practical ones, that fulfill these somewhat conflicting requirements, without relying on special-purpose (e.g., tamper-proof) hardware. This is an extended abstract of our work [19].

1

Introduction

In a networked world, users are represented by their public keys. A message whose digital signature verifies with a user’s public key is assumed to have been signed by that user. Hence, users have to maintain the secrecy of their signing keys. In real life, however, they may wish to use relatively insecure computing devices, e.g., networked UNIX machines or laptops, for digital transactions. How can a user make use of such insecure devices while preserving the secrecy of his secret key? One natural solution is for the user to use the secret key of his primary (long-term) key pair only on secure computing devices, and to create secondary (temporary, short-term) key pairs as needed for use on less secure devices. The user delegates a restricted amount of authority from the primary key pair to such a secondary key pair by signing a delegation certificate. This is simply a statement of the form “the secondary public-key hkey2i can be used instead of the primary public-key hkey1i for the following purposes and under the following conditions and/or limitations: hdescriptioni”. The statement is signed with the primary secret key. This delegation certificate is transferred to the insecure device together with the secondary key pair, and is appended to all messages signed with the secondary key, so that the recipient may verify the delegation. If a secondary secret key is compromised, the loss is minimized because only a restricted amount of authority was delegated to it. H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 153–168, 1998. c Springer-Verlag Berlin Heidelberg 1998

154

Oded Goldreich et al.

This is a good solution for many cases, but fails in cases where personalized rights are assigned to a key. Here the intention is to restrict the right to a specific person, and this is implemented by requiring a signature (or identification) relative to the key associated with this person. This person may indeed give away its (primary) secret key, and thus the requirement “for personal use” is not really enforced. However, the assumption behind such schemes is that users are highly motivated not to give away their (primary) secret key because this key allows others to do many more things in the user’s name. Thus, the user is deterred from propagating certain personalized rights to others by the fact that other rights will be automatically propagated along with the former rights. For example, a user may be willing to illegally propagate its personal subscription to some service, but not if this is linked to the propagation of the right to withdraw money from his bank account. The new problem introduced by using secondary keys in a setting where personalized rights are to be enforced, is that the users are no longer deterred from propagating personalized rights which they may delegate to secondary keys. This is the case since the delegation certificate may limit the rights of a secondary key to a specific right (e.g., subscription), thus leaving no additional risk for the user if he propagates this secondary key (and the subscription which goes with it). Hence, it seems that delegation of rights to secondary keys and the enforcement of personalized rights are in conflict (see further discussion below). Resolving this conflict is the central goal of this paper. Put in other words, we ask: How can delegation of rights be managed such that a user can delegate these rights to himself, but not to others? Corresponding to our motivating example – the use of insecure computing devices – we only consider solutions that do not employ special-purpose hardware (e.g., tamper-resistant or with biometrics). We consider two different approaches, which we term statutory and transparent. The latter means that the measures are invisible to users except for the unavoidable fact that issuers, holders, and verifiers of a personalized right must be aware that this right is personalized. Both approaches only approximate the above goal. Loosely speaking, they do this by fulfilling the following two weaker requirements (with respect to secondary keys to which personalized rights are delegated): 1. Restricted damage from loss of secondary keys: Loss of a few secondary secret keys causes no (or little) damage to the user, beyond the loss and possible abuse (by the finder or thief) of the power delegated by the user to these secondary keys. 2. Deterring propagation of secondary keys: Giving away many secondary secret keys to other users (e.g., friends) greatly endangers the user in the sense that this may have consequences which are highly unpleasant to the user (and extend way beyond the rights associated with these secondary keys). The slackness present in this formulation seems inevitable since the finder/thief in the first requirement is “indistinguishable” from the friends in the second. Thus, the distinction is made quantitatively.

Self-Delegation with Controlled Propagation

155

The paper focuses on the transparent approach, where the solutions are cryptographic. (These cryptographic schemes may have applications beyond the scope of the self-delegation problem.) The statutory approach, which has noncryptographic solutions, is only discussed in the next subsection. We refrain from addressing the non-technical question of which of the approaches is “better”. We note, however, that the solutions in the two approaches differ in several aspects, and all aspects should be taken into account when evaluating these solutions. 1.1

The Statutory Approach

Following the above paradigm, one may devise simple solutions in which trusted authorities (i.e., a judicial system) inflict suitable punishments on users which are proven to have propagated personalized rights to others. The case against a user will consist of sufficiently many secondary secret-keys (with corresponding certificates assigning personalized rights); it is assumed that no user is going to incriminate himself, whereas other users may be less careful not to incriminate another user. Furthermore, users may even be encouraged (again by statutory means; e.g., awards) to incriminate others. Such a judicial system is very flexible – it may consider special circumstances and determine the verdict based on these. On the other hand, such a system has a significant overhead. Another type of statutory arrangement, closer in spirit to the solution presented next, is to define an action taken with sufficiently many validated secondary secret key (regardless of their assigned rights) as if it was taken by the user (i.e., with the corresponding primary key). However, in such a case, all verifiers of any signatures, even those that have nothing to do with personalized rights, must be aware of this arrangement. Thus, this solution too is not transparent. 1.2

The Transparent Approach

In the transparent approach, users are deterred from delegating personalized rights to others by ensuring that the recipient learns something about the primary secret key of the delegator. A user will then again be highly motivated not to delegate such rights so as not to risk giving up the fundamental rights associated with the primary secret key. The basic principle of all our proposals is that the user has to validate his secondary keys with respect to his primary secret key (in addition to signing an ordinary delegation certificate). As described below, the validation process will deter the user from delegating personalized rights to others. Use of personalized rights is granted only when one proves possession of a validated secondary-key (or possession of the primary-key, as usual), mere possession of a secondary-key (without corresponding validation) will not do. The conflicting goals stated above, are thus rephrased as follows: 1. Restricted damage from loss of secondary keys: Loss of a few validated secondary secret keys will not endanger the security of the primary secret key. That is, they yield little or no knowledge about the primary secret key.

156

Oded Goldreich et al.

2. Deterring propagation of secondary keys: Many validated secondary secret keys allow the recipient to recover the primary secret key efficiently. We present several constructions achieving such a balance. Our constructions are categorized by the following parameters: Generic vs. specific: In Section 3, we present generic schemes which apply to any primary and secondary keys. They rely on non-interactive zero-knowledge proofs [3], and thus on the existence of trapdoor one-way permutations [12,21]. In Section 4, we present more specific and efficient constructions where the primary key pair must belong to a discrete-logarithm based cryptographic scheme like Schnorr or DSS signatures [25,11]. Gradual vs. threshold: In Constructions 1 thru 1.2, the security of the primary secret key degrades gradually with the number of secondary secret keys available to an adversary until the primary secret key is totally revealed. In Constructions 2 and 3, the primary secret key is fully secret up to a certain threshold number of secondary secret keys available to an adversary (e.g., 3, 10, or 100), but is easily recovered from any number of secondary secret keys larger than this or a second threshold. Additionally, some schemes allow the application to freely fix after how many secondary secret keys the adversary will get the primary secret key (i.e., the slope of the gradual degradation or the threshold, respectively), whereas in others this number is predefined by other system parameters, e.g., the key length. Limitations for secondary keys: Apart from honest users, service providers may wish to limit the rights associated with secondary keys. We handle these limitations associated with a secondary key in a general way, and call their description a limitations index. An archetypical example of limitation indices are time periods, such as days, during which a secondary key is valid. Other examples include upper bounds on value of transactions, lists of specific services, etc. A relevant parameter for our schemes is the size of the domain of potential limitation indices. For example, if secondary keys are associated with days, which is indeed a very important case, then the domain of indices is relatively small. If, on the other hand, limitation indices stand for arbitrary specification of rights such as expressed by 1000-words English-text documents, then the domain is huge. The domains in Construction 1.2 is unbounded, in Constructions 2 and 3 bounded, but exponentially large in the security parameter, and in Construction 1.1 relatively small. (Indeed, using appropriate hashing, one may use schemes with an exponentially large domain of limitation indices as if their domain were unbounded.) Our proposals for self-delegation of personalized rights are not in conflict with normal delegation of other types of rights: Both types of rights can be given on the same primary and secondary keys and even with the same delegation certificates. The only difference is that for personalized rights, verifiers will require the presence of validation information related to the primary key of the

Self-Delegation with Controlled Propagation

157

original owner of the right, whereas in other cases they only require a delegation certificate. 1.3

Related Work

Delegation certificates are merely documents which assert that certain rights associated to a specific public key are to be passed to another public key. Such documents are verifiable with respect to the former public key, and are binding (as all digital signatures) under certain statutory provisions. Technical problems with such certificates occur where one makes additional requirements (e.g., anonymity, standardization of contexts, or non-transferability) regarding such certificates. None of these extensions is required in our case. In our case the goal is to restrict the delegation of some rights; specifically, of personalized rights. Thus, ordinary delegation certificates will not do, unless they are augmented by either an auxiliary statutory arrangement or auxiliary validation information, as discussed above. (In fact, one may view the augmentation of delegation certificates, suggested above, as a new type of certificate which one may call a self-delegation certificate.) Other approaches to the issue of limiting the delegation of rights were suggested in [4,5]. We note the analogy between the current work and [10]: The latter paper presents a transparent approach to copyright protection, in contrast to the (typical) statutory approach based on fingerprinting following [27]. Some analogy exists also between self-delegation schemes and (τ − 1)-spendable coins [7,23]. Conceptually speaking, the problems are different since there is no requirement on personal use in the latter, and the main issue is untraceability (otherwise identification of overspenders would be trivial). Technically speaking, one can see that the analogy does not extend too far since here we construct self-delegation schemes based on standard complexity assumptions, whereas such schemes are not known for untraceable cash.

2

The Model

Our model and constructions of self-delegation schemes only concern the core part of the applications described so far, and are therefore largely independent of the concrete application. In particular, we only deal with the primary and secondary keys, and not with certificates that third parties give to assign rights to the primary keys, such as the above-mentioned certificate asserting subscriberhood – these can be realized in standard ways, for example, by signatures with keys held by the third parties on the keys handled in the self-delegation scheme, and thus be added to our constructions in a modular way. Furthermore, we do not explicitly consider the user’s own authorization of the secondary keys, i.e., the delegation certificates (from primary key to secondary key) as described in the introduction. This is not quite as independent of our schemes as the statements by third parties, but whenever the underlying cryptographic scheme is a signature scheme, the delegation certificates can be made in a standard way with the primary secret key.

158

Oded Goldreich et al.

The notion of a generic scheme will more precisely mean the following: An arbitrary underlying cryptographic scheme may be given that contains an algorithm for generating primary key pairs and one for generating secondary key pairs, possibly depending on a primary key pair. The typical case is simply that an algorithm G for generating one key pair is given, and all primary and secondary key pairs are generated independently with this algorithm. Our mechanism allows to control propagation of such secondary keys without posing additional dangers on the underlying scheme and without making assumptions about how the keys of the underlying scheme may be used. For instance, signing (with a secret key) is not a zero-knowledge procedure, and in some protocols secret keys may even sometimes be revealed. Our controlled self-delegation schemes should not pose any additional risk to the keys, i.e., beyond the risk involved in using the given underlying cryptographic schemes. The schemes in Section 3 are of this type, and those in Section 4 are only slightly less generic in that they assume a specific generation algorithm for the primary secret key. We briefly mention variants that may be a little more efficient, but require that primary and secondary keys are only used in well-defined ways, e.g., within a specific signature scheme. In the rest of the model section, we concentrate on generic schemes. We have to consider three types of parties: a server, which corresponds to a key certification infrastructure, users, who have primary and secondary keys, and verifiers, with whom the users interact using their secondary keys. A selfdelegation scheme with controlled propagation has four protocols: Server setup: Here the server generates and publishes global parameters. Registration: Here the user, having generated a primary key pair (sk, pk) from an underlying cryptographic scheme, registers the primary public key with the server. We call the secret information that the user stores at the end of the registration his extended primary secret key, and the corresponding information published by the server the user’s extended primary public key. For simplicity, we often omit the term “extended”, and use (sk, pk) to denote also the extended key pair. Secondary key validation: Here the user, having generated a secondary key pair (sk` , pk` ) from the underlying cryptographic scheme, wants to validate it for a certain limitations index `. He produces a validation tag, denoted val` , that he will use later to convince verifiers of the validity of the secondary key pair (when not having the primary secret key available). Verification: Here a user wants to convince a verifier, typically a service provider, that a certain public key pk` can be used as a secondary key for the primary public key pk. We stress that the user’s secret inputs are only sk` and val` ; he no longer has the primary secret key available. The verifier also inputs the limitations index ` for which pk` is supposed to be valid and global parameters published in server setup. Note that controlled propagation would make no sense if the verifier did not check `; e.g., if ` denotes a specific date, the verifier must enter the current date rather than

Self-Delegation with Controlled Propagation

159

let the alleged user enter a date of his choice (which would always be the one for which the key is valid). These protocols must be efficient, preferably as efficient as the underlying cryptographic scheme. Clearly, correctly validated secondary keys for correctly registered primary public keys should (almost) always be accepted by honest verifiers. We call a triple (sk` , val` , pk` ) a correctly validated secondary key triple if it is a possible output of the correct secondary key generation and validation program. This is what a thief gets from an honest user. However, dishonest users who try to give away secondary keys to others are not restricted to correctly validated keys. We say that a user gives a second person a valid secondary key triple (for a public key pk and a limitations index `) if the information enables the second person to convince an honest verifier almost certainly. Formally, this notion is only meaningful in connection with the second person’s program, which may be arbitrary, yet must be efficient. For simplicity, we concentrate on users giving away full-quality secondary keys, but with definitions as in [1] this can be generalized to giving away information that will only convince the verifier with a certain probability. Our two goals can now be formulated in more detail as follows: Restricted damage from key disclosure: If a certain user is honest, it should be infeasible for an adversary (thief) who only obtains few correctly validated secondary key triples to generate additional valid secondary key triples. Here, “additional” means for a limitations index `∗ for which the adversary has not obtained a correctly validated secondary key triple. The adversary should also not get too much knowledge about existing non-stolen secondary secret keys sk` nor about the primary secret key. More precisely, as we concentrate on generic schemes, we have to speak about any knowledge gained by validation tags. A suitable terminology is that of knowledge complexity (cf., [20,18]).1 Specifically, gradual schemes have a parameter δ, called the slope, so that each correctly validated secondary key triple only gives δ bits of knowledge. Schemes with threshold have a parameter τ , called the threshold, so that less than τ correctly validated secondary key triples do not give the adversary any knowledge. Controlled propagation: If a user gives a second person many different valid secondary key triples, then the second person can efficiently compute the user’s primary secret key. Here, “different” means for different limitations indices. 1

Loosely speaking, saying that a protocol (or a message) gives κ bits of knowledge with respect to a given state means that whatever can be efficiently computed after the execution of the protocol (or receipt of the message) can also be computed efficiently with probability at least 2−κ from the state alone. Thus, for small κ, more precisely κ = O(log n) where n is the key length, if one can find the primary secret key with non-negligible probability after receiving at most κ bits of knowledge, then one can do the same without receiving these bits. (Recall that f (n) is non-negligible if f (n) ≥ 1/poly(n)).

160

Oded Goldreich et al.

In schemes with threshold, “many” typically means at least τ , but there are also schemes with a second threshold τ ∗ > τ , (i.e., allowing a gap). Gradual schemes have a similar parameter β, which will typically be about n/δ, where n is the key length. For simplicity, we assume that all the security parameters δ, τ etc., are chosen at the server setup time. Typically, users are concerned with restricted damage from key disclosure and therefore wish τ to be large (or δ to be small), whereas service providers, mainly concerned with propagation control, want the opposite. We consider the following types of attacks: The adversary for the first goal, “restricted damage”, knows the user’s primary public-key. It includes (both other users and) verifiers who have verified any number of this user’s secondary public keys and with whom the user has then interacted using these keys, e.g., by signing messages. In a strong form of the requirement, the adversary also includes the server (i.e., the user may not want or need to trust the server). The adversary for the second goal, “controlled propagation”, consists of any number of colluding users and other verifiers. Typically, we only speak of “the user” because independence is clear. In some of our constructions achieving this goal depends on proper behaviour of the server (which is supposed to generate some random parameters). In all the following schemes, the first goal, “restricted damage”, is stated and proven with respect to a static adversary, i.e., the limitations indices of the revealed validation tags are determined beforehand rather than chosen adaptively by the adversary. We believe that all schemes are in fact adaptively secure, but refrain at this point from formulating and proving our belief. We also assume for the time being that each participant only carries out one protocol at a time (i.e., we do not consider protocol interleaving).

3

Generic Schemes

The basic idea is that each validation tag val` contains some little “piece of information” σ` about the primary secret key sk. The holder of a secondary key can only convince verifiers if he knows this σ` . Convincing the verifier must be done in zero-knowledge, so that verifiers do not gain an advantage in finding a user’s primary secret key. On the other hand, knowledge of σ` ’s is related to the gradual release of a secret (as introduced for secret exchange in [2]): Knowledge of a few such pieces (i.e., σ` ’s) does not endanger the secret, whereas knowledge of many “orthogonal” pieces does endanger it. A crucial point is to ensure this “orthogonality” whenever many pieces are given to a second person in violation of the “controlled propagation” goal. To ensure this, the value of σ` is made to depend on the limitations index `. Our constructions differ in the way this is achieved. In the proof that he knows σ` , the user also has to prove that σ` is correct with respect to the primary secret key sk, which is no longer available in the

Self-Delegation with Controlled Propagation

161

verification stage. Hence this part of the proof will be precomputed in the secondary key validation protocol. We use a non-interactive zero-knowledge proof system [3], more precisely one where one common random string Ref can be used for an arbitrary number of proofs [12]. (This result also applies to the more efficient basic construction in [21].) In schemes with a small set of limitations indices, we could improve efficiency by using a non-interactive zero-knowledge proof system capable of only proving one assertion, and providing enough reference strings in advance. Finally, we have to guarantee that all σ` ’s refer to the same primary secret key sk. This is easy if the underlying cryptographic scheme guarantees that for every primary public key pk, there is only one possible primary secret key sk and its validity can be verified in polynomial time. For example, this is the case with the prime factorization of RSA moduli or the discrete logarithm of an element in logarithm-based schemes. Yet, in other cases, additional information aux may be required to verify the validity of secrets with respect to publicly available information. Typically, the randomness used in the key-generation process suffices. We then denote by pk the entire information that is published. This motivates our interest in schemes where a 3-ary relation Pred with the following properties exists: NP-recognition of secret keys: Pred is recognizable in polynomial-time. This implies that the set of valid public keys Pred1 = {pk|∃sk, aux : (sk, aux, pk) ∈ Pred} and of valid key pairs Pred2 = {(sk, pk)|∃aux : (sk, aux, pk) ∈ Pred} are in NP and therefore have zero-knowledge proof systems [17]. Unique secret keys: For every pk, there exists at most one sk such that (sk, pk) ∈ Pred2 . Key generation of the given cryptographic scheme produces triples (sk, aux, pk) ∈ Pred. Using any one-way function, one may transform any cryptographic scheme into one with unique secret keys, while maintaining computational secrecy. 3.1 Gradual Schemes The following construction is actually a framework for several slightly different versions with different properties. Construction 1 (generic, gradual, framework): Let a cryptographic scheme with unique secret keys with a relation Pred as above be given. Server setup: The server chooses the length n of the secret keys and the slope δ, where δ divides n. It randomly generates a reference string Ref ∈ {0, 1}poly(n) for the non-interactive zero-knowledge proof system, and sets up a scheme that defines a sequence r1 , r2 , ... of n-bit strings so that anyone can obtain r` in poly(n, log `) time. Several such schemes are discussed below.

162

Oded Goldreich et al.

Registration: Suppose a user has generated a primary key pair (sk, pk), together with the value aux so that (sk, aux, pk) ∈ Pred. The user proves to the server in zero-knowledge that pk is valid, i.e., lies in Pred1 . Secondary key validation: The validation tag for this user’s secondary key w.r.t. the limitations index ` is the pair (σ` , π` ) where (1) σ` is the inner product in GF(2δ ) of sk and r` , where both are considered as n/δ-dimensional vectors over GF(2δ ). (2) π` is a non-interactive zero-knowledge proof, with respect to the reference string Ref , that there exists sk so that (sk, pk) ∈ Pred2 and σ` is the inner product of sk and r` . Verification: The user gives the verifier an interactive zero-knowledge proof of knowledge [20,1] that he knows (σ` , π` ) such that π` is a valid non-interactive zero-knowledge proof as in Item (2) of the validation protocol. We stress that the common input to the interactive proof consists of Ref , pk, and r` .

Proposition 1 (generic, gradual, framework): Any instantiation of Construction 1, that is, no matter how the r` ’s are determined, has the following properties: 1. Restricted damage from key disclosure: The scheme leaks no knowledge except δ bits in each correct validation tag. The user only needs to trust the server for the randomness of the reference string Ref . 2. Controlled propagation: If the user gives a second person valid secondary key triples for a certain set of limitations indices, L, then the second person can efficiently compute the inner product of one fixed primary secret key sk with each value r` corresponding to ` ∈ L. Proof sketch: We first prove Part 1 (“restricted damage”). First, one easily sees that in the registration and verification protocols, the user does not give away any knowledge beyond the standard operation of the public-key infrastructure, because the rest of the protocols gives zero-knowledge proofs. Next, we consider the knowledge an adversary gains by obtaining a correctly validated secondary key triple. Recall that we only need to consider what is revealed on top of the secondary secret key itself, i.e., in the validation tag (σ` , π` ). These are merely δ bits of knowledge, since σ` is only δ bits long and π` is a zero-knowledge proof referring to σ` and values the adversary knows already. (Recall that knowledge complexity is bounded by the actual length of objects and at most additive [18].) We now prove Part 2 (“controlled propagation”). By the soundness of the interactive zero-knowledge proof of knowledge, having a valid secondary key triple (i.e., information that enables the second person to convince an honest verifier) implies that the second person knows a correct pair (σ` , π` ). More formally, there is an effective way (called a knowledge extractor [1]) to reconstruct this pair given access to the second person’s strategy and his auxiliary information. Now the soundness of the non-interactive zero-knowledge proof π` implies that

Self-Delegation with Controlled Propagation

163

σ` is in fact the inner product of the one fixed sk and r` . (Here the uniqueness property of Pred2 is used.) 2 The scheme defining the sequence r1 , r2 , ... should guarantee that sufficiently many of these values span almost the entire vector space, so that giving away many valid secondary keys compromises the primary key. Our first such scheme guarantees this in an optimal way, but can only be used for a domain of up to 2δ − 1 limitations indices. This value is small because δ should be at most logarithmic in n to satisfy the restricted-damage condition. Thus, this scheme is most adequate for cases like our motivating example where the limitations indices correspond to days; e.g., δ = 10 allows 1023 days, after which the primary key pairs could be renewed. Construction 1.1 (generic, gradual, severely bounded limitations indices): We use Construction 1 with the following r` ’s: The server fixes an easily computable enumeration α1 , ..., α2δ −1 of the non-zero elements of GF(2δ ). The value r` is ), where β = n/δ. the vector (1, α` , ..., αβ−1 ` Proposition 2 (generic, gradual, severely bounded limitations indices): Construction 1.1has the following controlled-propagation property: Any β valid secondary key triples yield the primary secret key. Proof sketch: Any β vectors r` form a Vandermonde matrix, which is always non-singular. Thus the system of equations that the second person has (by the general controlled-propagation property of Construction 1) is of full rank. The easily found solution is the primary secret key. 2 To use Construction 1 with a larger domain of limitations indices, we essentially use uniformly random values r` . The server can set these up in different ways: Construction 1.2 (generic, gradual, less bounded limitations indices): We use Construction 1 with one of the following schemes for generating the r` ’s: 1. For medium-sized limitation set: The server generates and publishes, as part of the setup stage, a list of a certain number m of uniformly chosen values r` . 2. For unbounded limitation set: The server provides a “random oracle” (or Beacon) service throughout the lifetime of the system; r` equals the answer of this random oracle on query `. The random oracle may be implemented by the server by using a pseudorandom function [16]. To analyze the controlled-propagation quality of these constructions, we need a technical lemma about the probability that too many of the r` ’s are linearly dependent. Note that when we talk of the rank of a matrix chosen from a subset of a field, we mean its rank over the field (i.e., the maximum number of linearly independent rows with respect to coefficients from the field).

164

Oded Goldreich et al.

Lemma 1 Let m, n, t, R be integers so that m > n > R and m ≥ t ≥ R, and q be a prime power. Let S ⊆ GF(q). Then, the probability PrS (m, n, t, R) that a uniformly chosen m-by-n matrix over S contains t rows which together have rank at most R is bounded above by PrS (m, n, t, R) ≤

(2m)t · |S|−(n−R)·(t−R) . t!

Proof omitted. For simplicity, we now restrict ourselves to the binary case (i.e., δ = 1). Proposition 3 (generic, gradual, less bounded limitations indices): For the first variant of Construction 1.2 , with δ = 1, the following controlled-propagation property holds: With probability at least 1 − 2−n , over the choice of the r` ’s, if a user gives away 2n valid secondary key triples to a second person, the second person can efficiently list a set of at most m2 possibilities for the primary secret key. For the second variant of Construction 1.2, the above holds provided the user makes at most m oracle queries. Proof omitted. The second person can use the above list in different ways: For example, he can efficiently perform any task requiring this secret key with probability 1/m2 , by uniformly selecting an element of this list. Alternatively, in many applications, additional publicly available information can be used to determine which of these keys is correct. 3.2

A Threshold Scheme

We now show a generic threshold construction. The threshold τ can be chosen very freely, i.e., between 1 and 2n − 1, where n is the length of the keys. The set of limitations indices is bounded, but the bound can be much larger than in Construction 1.1: It is now 2n . Construction 2 (generic, threshold, exponentially large indices domain): Let a cryptographic scheme with unique secret keys with a relation Pred as above be given. Additionally, we need a secure commitment scheme that is unconditionally binding; e.g., as in [22]. Server setup: The server chooses parameters n for the length of secret keys and τ for the threshold and a reference string Ref ∈ {0, 1}poly(n) for the non-interactive zero-knowledge proof system. It fixes an easily computable enumeration α1 , ..., α2n −1 of the non-zero elements of GF(2n ). Registration: Suppose a user has generated a primary key pair (sk, pk), together with the value aux so that (sk, aux, pk) ∈ Pred. He first proves to the server in zero-knowledge that pk is valid, i.e., lies in Pred1 . Next, he uniformly selects a polynomial of degree τ − 1 over GF(2n ) with the primary def P −1 pj · xj with p0 = sk. secret key as the constant coefficient, say, p(x) = τj=0

Self-Delegation with Controlled Propagation

165

This corresponds to setting up a secret sharing scheme as in [26]. He makes a commitment C to all the non-constant coefficients using the given commitment scheme. Typically, the length of the commitment automatically shows that the content is a polynomial of degree τ − 1, otherwise this must be shown in zero-knowledge. The user’s extended primary public key is (pk, C). Secondary key validation: The validation tag for this user’s secondary key for the limitations index ` is the pair (σ` , π` ) where (1) σ` is the value of the polynomial p at the point α` ; (2) π` is a non-interactive zero-knowledge proof with respect to the reference string Ref that there exist sk and p so that (sk, pk) ∈ Pred2 , the non-constant coefficients of p correspond to the commitment C, the constant term p0 equals sk, and σ` = p(α` ). Verification: The user gives a zero-knowledge proof that he knows a correct pair (σ` , π` ).

Proposition 4 Construction 2 satisfies 1. Restricted damage from key disclosure: Public information and the validation tags of at most τ − 1 correctly validated secondary key triples leak no knowledge. The user need not trust the server except for the randomness of the reference string Ref . 2. Controlled propagation: Any τ valid secondary key triples yield the primary secret key. Proof sketch: The second part follows as in Proposition 2. For Part 1, the security of the commitment scheme and the zero-knowledge proofs implies that the only non-negligible source of knowledge is in the values σ` . These are τ −1 shares of a secret sharing scheme with threshold τ and therefore give no information about the secret sk [26]. 2

4

Discrete-Logarithm Schemes

We now present a practical self-delegation scheme for cryptographic schemes based on discrete logarithms in groups of prime order. Important examples are Schnorr and DSS signatures [25,11]. The advantage over the schemes in the previous section is that no general zero-knowledge proof techniques are needed, and the resulting self-delegation schemes are essentially as efficient as the underlying schemes. The secondary keys can even be from a different cryptographic scheme; only the primary key pair has to be from the discrete-logarithm-based scheme. More precisely, we assume an underlying cryptographic scheme with the following key generation: First a prime q is chosen, typically 160 bits long; next a prime p, typically 512 bits, such that q divides p − 1; and then an element g of order q in the multiplicative group modulo p. A secret key is a uniformly

166

Oded Goldreich et al.

chosen value sk ∈ GF(q)∗ = {1, ..., q − 1}, and the corresponding main part of the public key is h = g sk mod p. The actual scheme is a slight extension to Feldman’s Verifiable Secret Sharing (VSS) scheme based on discrete logarithms [13]. The validation tags are simply shares of the secret key. We need two extra properties for our application: First, if we want a large domain of limitations indices, the VSS scheme must allow a large number of potential shares with an efficient way to index them. Secondly, in our case it is not the shareholders who need to verify the validity of the shares (the shareholders in the motivating example are the laptops), but external verifiers, i.e., we need an efficient zero-knowledge proof of knowledge of a proper share. Although these extra properties are not required in the general definition of VSS (cf., [8]), they happen to hold in Feldman’s VSS. This gives the following scheme, for any τ ≥ 2. Construction 3 (discrete log, threshold): Let any cryptographic scheme based on discrete logarithms in groups of prime order be given, i.e., the primary key generation is as described above. Server setup: For simplicity, we let the server generate the parameters (q, p, g) of the underlying scheme. The domain of limitations indices is {1, ..., q − 1}. The server also selects an arbitrary threshold τ . Registration: Given a primary key pair (sk, pk) from the underlying discrete logarithm scheme, the user randomly selects a polynomial pol of degree τ − 1 over GF(q) with sk as its constant coefficient. That is, it selects uniformly coefficients (c1 , ..., cτ −1 ) in GF(q). This polynomial is the extended primary secret key. The extended primary public key consists of the values hj = g cj mod p, for j = 1, ..., τ − 1. Secondary key validation: The validation tag for this user’s secondary key for the limitations index ` is the value val` = pol(`), i.e., val` = sk +

τ −1 X

cj `j mod q.

j=1

Note that this validation tag can be seen as a secret key, denoted sk∗` , of the underlying discrete logarithm scheme; the corresponding public key would be pk∗` = g val` mod p. Verification: The verifier can compute this value pk∗` as pk∗` = pk ·

τY −1

j

h`j mod p

j=1

using the values hj in the user’s extended primary public key. Now the user has to give a zero-knowledge proof of knowledge of val` , i.e., of the discrete logarithm of pk∗` (cf., [6,15]). An alternative is Schnorr identification [25], which needs only one exponentiation on each side, but is only known to be witness-hiding [14].

Self-Delegation with Controlled Propagation

167

The security of this scheme is obvious from the perfect security of the Verifiable Secret Sharing scheme when the public key is already given [24]: Less than τ validation tags, i.e., shares, give no information about the secret beyond what is known by the public key, whereas τ validation tags enable reconstruction. An alternative way of using this core scheme is to use the values val` ’s directly as secondary secret keys (i.e., = sk∗` ’s), instead of as validation tags for independently generated secondary key pairs. This improves efficiency in cases where we can omit the proof of knowledge (because the subsequent usage of sk∗` establishes knowledge of it). However, in such a case we have to be careful about how the security of the underlying scheme and our self-delegation scheme influence each other. In particular, the legitimate use of sk∗` in the underlying scheme is typically not zero-knowledge and might therefore additionally endanger the primary secret key sk via our self-delegation scheme. Thus, security in such usage has to be considered specifically for each concrete underlying scheme (e.g., for Schnorr or DSS signatures). Specifically, for Schnorr identification scheme [25], security does hold (for further details see our report [19]). In case the set of limitations indices is much smaller than q (e.g., as in case where limitations correspond to days of a year), efficiency is greatly improved since the evaluation of pk∗` by a Horner-like schema only involves exponentiations with small numbers. That is, pk∗` can be computed from the hj ’s and `, by iteratively computing vi+1 = (hτ −i · vi )` mod p, starting with v1 = 1 and ending with pk∗` = vτ · pk.

Acknowledgments We thank Michael Waidner for interesting discussions. This research was partially supported by DARPA grant DABT63-96-C-0018.

References 1. M. Bellare and O. Goldreich: On Defining Proofs of Knowledge; in Crypto ’92, Springer-Verlag, LNCS Vol. 740, pp. 390-420, 1992. 159, 162, 162 2. M. Blum: How to Exchange (Secret) Keys; ACM Transactions on Computer Systems, Vol. 1, No. 2, pp. 175-193, 1983. 160 3. M. Blum, P. Feldman, and S. Micali: Non-Interactive Zero-Knowledge and its Applications; in 20th STOC, pp. 103-112, 1988. 156, 161 4. D. Chaum: Showing credentials without identification: Transferring signatures between unconditionally unlinkable pseudonyms; in Auscrypt ’90, LNCS 453, Springer-Verlag, Berlin 1990, pages 246-264. 157 5. D. Chaum: Achieving Electronic Privacy; Scientific American, August, pp. 96101, 1976. 157 6. D. Chaum, J.-H. Evertse, and J. van de Graaf: An improved protocol for demonstrating possession of discrete logarithms and some generalizations; in Eurocrypt ’87, Springer-Verlag, LNCS Vol. 304, pp. 127-141, 1988. 166 7. D. Chaum, A. Fiat and M. Naor: Untraceable Electronic Cash; in Crypto ’88, LNCS 403, Springer-Verlag, Berlin 1990, pages 319-327. 157

168

Oded Goldreich et al.

8. B. Chor, S. Goldwasser, S. Micali and B. Awerbuch: Verifiable Secret Sharing and Achieving Simultaneity in the Presence of Faults; in 26th FOCS, pages 383–395, 1985. 166 9. W. Diffie and M. E. Hellman: New Directions in Cryptography; IEEE Transactions on Information Theory, Vol. 22, No. 6, pp. 644-654, 1976. 10. C. Dwork, J. Lotspiech, and M. Naor: Digital Signets: Self-Enforcing Protection of Digital Information; in 28th STOC, pp. 489-498, 1996. 157 11. The Digital Signature Standard Proposed by NIST; Communications of the ACM, Vol. 35, No. 7, pp. 36-40, 1992. 156, 165 12. U. Feige, D. Lapidot, and A. Shamir: Multiple non-interactive zero knowledge proofs based on a single random string; in 31st FOCS, pp. 308-317, 1990. 156, 161 13. P. Feldman: A practical scheme for non-interactive verifiable secret sharing; in 20th FOCS, pp. 427-437, 1987. 166 14. U. Feige and A. Shamir: Witness Indistinguishability and Witness Hiding Protocols; in 22nd STOC, pp. 416-426, 1990. 166 15. A. Fiat and A. Shamir: How to Prove Yourself: Practical Solutions to Identification and Signature Problems; in Crypto ’86, Springer-Verlag, LNCS Vol. 263, pp. 186-194, 1987. 166 16. O. Goldreich, S. Goldwasser, S. Micali: How to Construct Random Functions; Journal of the ACM, Vol. 33, No. 4, pp. 792-807, 1986. 163 17. O. Goldreich, S. Micali, and A. Wigderson: Proofs that Yield Nothing but their Validity or All Languages in NP Have Zero-Knowledge Proof Systems; Journal of the ACM, Vol. 38, No. 1, pp. 691-729, 1991. 161 18. O. Goldreich and E. Petrank: Quantifying Knowledge Complexity; in 32nd FOCS, pp. 59-68, 1991. To appear in Computational Complexity. 159, 162 19. O. Goldreich, B. Pfitzmann and R.L. Rivest: Self-Delegation with Controlled Propagation – or – What If You Lose Your Laptop; Record 97-12 of the Theory of Cryptography Library, url: http://theory.lcs.mit.edu/∼tcryptol. 153, 167 20. S. Goldwasser, S. Micali, and C. Rackoff: The Knowledge Complexity of Interactive Proof Systems; SIAM Journal on Computing, Vol. 18, No. 1, pp. 186-208, 1989. 159, 162 21. J. Kilian and E. Petrank: An Efficient Noninteractive Zero-Knowledge Proof System for NP with General Assumptions; Journal of Cryptology, Vol. 11, No. 1, pp. 1-27, 1998. 156, 161 22. M. Naor: Bit Commitment Using Pseudorandomness; Journal of Cryptology, Vol. 4, No. 2, pp. 151-158, 1991. 164 23. T. Okamoto and K. Ohta: Disposable Zero-Knowledege Authentications and their Applications to Untraceable Electronic Cash; in Crypto ’89, LNCS 435, SpringerVerlag, Berlin 1990, pages 481-496. 157 24. T. P. Pedersen: Distributed Provers with Applications to Undeniable Signatures; in Eurocrypt ’91, Springer-Verlag, LNCS Vol. 547, pp. 221-242, 1991. 167 25. C. P. Schnorr: Efficient Signature Generation by Smart Cards; Journal of Cryptology, Vol. 4, No. 3, pp. 161-174, 1991. 156, 165, 166, 167 26. A. Shamir: How to Share a Secret; Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979. 165, 165 27. N. R.Wagner: Fingerprinting; in Proceedings of IEEE Symposium on Security and Privacy, pp. 18-22, 1983. 157

Identity Escrow Joe Kilian1 and Erez Petrank2 1 NEC Research Institute 4 Independence Way, Princeton, NJ 08540, USA. [email protected] 2 IBM Haifa Research Lab, MATAM Haifa 31905, Israel [email protected] Work done while at DIMACS.

Abstract. We introduce the concept of escrowed identity, an application of key-escrow ideas to the problem of authentication. In escrowed identity, one party A does not give his identity to another party B, but rather gives him information that would allow an authorized third party E to determine A’s identity. However, B receives a guarantee that E can indeed determine A’s identity. We consider a number of possible features of escrowed identity schemes, and describe a variety of implementations that achieve various subsets of these features. In particular, we observe that group signature schemes can be used to escrow identities, achieving most (though not all) of the desired features. The most interesting feature we consider is separability. The escrow agency is not involved in the day to day operation of the identification system, but is only called in when anonymity must be revoked. In the extreme case, there exist identity escrow schemes in which an arbitrary party (possessing a public key) can be designated an escrow agent without any knowledge or participation on their part until they are asked to revoke someone’s anonymity.

1

Introduction

We consider a client that obtains regular or continual access to a service or facility. Examples include driving a toll highway with a regular commuter pass, parking regularly in a garage, entering one’s club premises, or using internet services. In order to get the service, the client must convince the gate keeper that he is entitled to the service. The client can do this by identifying himself at the entrance. But must he really identify himself? Such identification raises critical issues of privacy. For example, a more pervasive highway authority might as a side effect allow the tracing of people’s movements to an unprecedented degree. On the other hand, what if the client remains completely anonymous, say, by an access code that is secret, but common to all clients? In certain rare circumstances, the service provider (and society at large) may have a compelling reason to know the identity of the client. For example, consider an automated access system for a parking garage. The garage cares that the person entering it is authorized to do so; the person’s precise identity is normally not a valid concern. However, suppose that on some night a person was murdered in the garage. At H. Krawczyk (Ed.): CRYPTO’98, LNCS 1462, pp. 169–185, 1998. c Springer-Verlag Berlin Heidelberg 1998

170

Joe Kilian and Erez Petrank

this point, the garage owner and society at large may have a legitimate interest in knowing who was there on that night. Or, one might wish to have a computer “chat room” in which one has conditional anonymity: As long as one follows the rules laws, ones identity is secure from even the system administrator. But if one flagrantly breaks the rules (such as arranging drug deals in the “Lion King” kiddie chat room), suitable law enforcement agencies can be appealed to in order to determine one’s identity. The reader may envision other examples such as a drunk driver causing a fatal accident on the highway, etc. Traditionally, access control has been all or nothing. One obtains all the information about the other person up front, with no recourse to learn more if circumstances warrant. This rigidity generally leads one to allow less privacy, since one is likely to want as much information as one can get just in case a “bad case” arises. We give a more flexible alternative. We consider a more flexible, two-tier approach to authentication. On the first tier, a person gives only as much information about themselves as is strictly necessary for ordinary circumstances. On the second tier, a person gives a more precise statement of their identity that may be needed in extraordinary circumstances. This second tier is only accessible with the help of a third party, which is separate from (and not under the control of) the party managing access. We describe identity escrow schemes in Section 1.1 below. Key escrow has proven an active and contentious field of research and discussion (c.f. [24,25,22,18,21,23,27]). Most of the attention in this area has been restricted to the simple case of communication: party A sends an encrypted message EK (M ) to party B; some centralized authority is given the capability to recover either K or the specific message M . As discussed in Section 3, group signatures has an escrow-like feature in which the anonymity of a signer may be revoked. We add yet a new domain for the application of key escrow ideas: authentication and identity schemes. Some distinctive features of this application are that – Escrowed identity may actually enhance privacy. By default, many identity schemes require a person to give their entire identity “up front.” A protocol in which this information is only released under special circumstances may prove an acceptable, and more private substitute. – Escrowed identity schemes work to the advantage of at least one of the parties invoking them. In traditional key escrow systems, both party only lose by following the escrow system, and have everything to gain by bypassing it (which is generally quite easy to do). 1.1

Escrowed Identity

An escrowed identity system consists of the following parties: Identifier: The identifier is the client who identifies himself to the verifier (the gate-keeper). Issuer: The issuer issues certificates to the identifier that allow him to identify himself in an escrowed manner.

Identity Escrow

171

Verifier: The verifier is typically the access provider who verifies the first-tier identity process as well as the escrow proof for the second-tier identity. Escrow Agent(s): The escrow agent(s) use information forwarded by the verifier to make a second-tier identification of the identifier. These parties execute the following protocols: Initializing the system: The certificate issuer, and in some cases the escrow agent, computes whatever private information and publishes whatever public information is necessary to initialize the system. Issuing a certificate: The certificate issuer gives a certificate to the identifier. Checking the weak identity: The identifier convinces the verifier that he has a certificate, gives an escrowed certificate and convinces the verifier that the escrowed certificate is valid. Recovering the complete identity: The verifier gives the escrow agent(s) the escrowed certificate, and the escrow agent(s) recovers the identity of the identifier. There are a number of desirable features of escrowed identity systems. Ideally, one would like an efficient protocol that achieves all of these features. However, as we discuss below, there is a tradeoff between feature coverage and efficiency among the known escrowed identity protocols. Hence, we will describe for each implementation the features it does or does not achieve. The following features are most pertinent to the notion of escrowed identity: Valid first-tier identification: If a user receives a legitimate certificate from the issuer, and if he follows his protocol, then he will succeed in convincing a verifier that he is a legitimate user (i.e. has a certificate) with probability 1. Conversely, a computationally bounded user that has not been issued a certificate by the issuer will fail to convince the verifier of having a certificate with probability almost 1. (This implies that producing a certificate without the issuer’s private key is computationally hard.) Secure second-tier identity: After the verifier has seen one or more first-tier identification proofs, he cannot fake a legitimate identity in the sense described above. Guaranteed escrow for second-tier identity: A computationally bounded user can interactively prove with high confidence that he has escrowed his second-tier identity; the escrow agency can determine this identity from the transcript of this proof. (This imply that producing a second certificate from a given legitimate on is computationally hard). One may further demand that even if many identifiers collaborate, the escrow agency may still recover the identity of one of them with high probability. Resistance to impersonation: The escrow agency, even after recovering many identities of many users from the transcripts of weak identity proofs, cannot fake any legitimate identity in the sense described above. In particular, this implies that the escrowed identity does not reveal the certificate of the user. Similarly, one can require that the certificate issuer cannot fake the identity of someone already in the system.

172

Joe Kilian and Erez Petrank

Separability: The escrow agency is completely independent of the other parties unless a request to uncover the second-tier identity is made. An issuer, verifier and user can set up an identification system without ever registering with or communicating in any way with the escrow agent. The escrow agency is only “woken up” when there is a request to revoke anonymity.

Containing the escrow agent Introducing an escrow agent into a system almost inevitably reduces its security. However, the nature of the problem and the separability property allows us to minimize the damage. By separating the escrow agency from the initialization and normal operation of the identification system, we can have the agency be dormant most of the time. For example, if the escrow agency is implemented with secure hardware, this hardware can be stored in a secure bank vault until needed. This helps to reduce the chance that an escrow agent will be compromised. A further check on a rogue escrow agent is that the verifier has to ask for a more precise identification. Key escrow for communication is typically coercive, and requires that someone be able to obtain the ciphertext of any two people’s communications without their request or consent. Thus, the possibilities for widespread abuse are greater than with our scenario. Nevertheless, it is only prudent to allow for multiple escrow agents; the escrow agents in most of our protocols can be made to work using simple group cryptography (e.g. [15,30]).

1.2

History and Related Work

An earlier version of this work appeared in [20], using cut-and-choose techniques for the zero-knowledge proofs. The current version describes much more efficient implementations based on group signature schemes. Group signature schemes were introduced by Chaum and Heyst [12], and subsequently developed in [13,10,28,11]. Independently and concurrently with [20], Camenisch and Stadler [11] developed new schemes for efficient group signatures, one of which can quite efficiently achieve most of our goals; we describe this solution in Section 3. At the heart of escrowed identity and group signatures is an efficient proof that an encrypted value possesses some property. Frankel, Tsiounis and Yung [17] and Young and Yung [33] give very efficient protocols of this type. Again, these proofs are are not completely applicable to our setting, but suggest that dramatically more efficient identity escrow schemes may be possible. The notion of keeping a trusted agency dormant except for “emergencies” has been proposed in a number of contexts. Asokan, Shoup and Waidner [1] show how to use a dormant third party for a variety of applications related to the exchange of digital signatures. Young and Yung [33] show how to use a dormant escrow agent for key escrow. Brickell, Gemmel and Kravitz [5] and Stadler, Piveteau and Camenisch [32] show how to use a dormant escrow agent in electronic cash systems (more efficient schemes are presented in [29,17]). Quite recently, Micali [26] has shown how to use a dormant agent for certified mail.

Identity Escrow

1.3

173

Road Map

In Section 2 we describe some of the building blocks we use for our protocols. In Section 3 we discuss how to implement identity escrow using group signature schemes. In Section 4 we show how to achieve stronger separability . In Section 5 we show an implementation of an escrowed identity scheme based on the ElGamal encryption and signature schemes.

2

Preliminaries

We describe some of the basic building blocks we use in our protocol. 2.1

Bit Commitments

We work in the argument framework of Brassard, Chaum and Cr´epeau [7]. In this paradigm, all parties are assumed to be computationally bounded. It is shown in [7] how to commit to bits in statistical zero-knowledge, based on the intractability of certain number-theoretic problems. D˚ amgard,