déjà q: using dual systems to revisit q-type assumptions

Déjà Q: Using Dual Systems to Revisit q-Type Assumptions

Melissa Chase (MSR Redmond)Sarah Meiklejohn (UC San Diego → University College London)

1

Pairing-based cryptography: a brief history

2

Historically, pairings have provided great functionality


2


• First IBE instantiation [BF01]


2



• Many other breakthroughs have followed [BBS04,GS08,KSW08,LW11,...]


2




With great functionality, comes great (ir)responsibility!


2





• First assumption: BDH (given (ga,gb,gc), compute e(g,g)abc)


2






• Later assumptions: Subgroup Hiding [BGN05], Decision Linear, SXDH


2






• Later assumptions: Subgroup Hiding [BGN05], Decision Linear, SXDH

• Even later assumptions: q-SDH, q-ADHSDH, q-EDBDH, q-SDH-III, q-SFP, “source group q-parallel BDHE,” etc.

Why are q-type assumptions worrisome?

3


3

AliceBob

CharlesDoraErnie

FredGeorgeHannahIsabelleJulian

KateLouiseMelissaNicholas

Otis

PhilQuentinRachelSarahTristan

IBE universe


3

BDH ⇒AliceBob

CharlesDoraErnie



Otis


IBE universe


3

BDH ⇒AliceBob

CharlesDoraErnie



Otis


UrsulaVanessaWilliamXavier

Yevgeniy

IBE universe


3

BDH ⇒AliceBob

CharlesDoraErnie



Otis



Yevgeniy

IBE universe

q-SDH ⇒ AliceBob

CharlesDoraErnie



Otis


(g,gx,…,gxq)


3

BDH ⇒AliceBob

CharlesDoraErnie



Otis



Yevgeniy

IBE universe

q-SDH ⇒ AliceBob

CharlesDoraErnie



Otis



Yevgeniy

(g,gx,…,gxq)


3

BDH ⇒AliceBob

CharlesDoraErnie



Otis



Yevgeniy

IBE universe

q-SDH ⇒/ AliceBob

CharlesDoraErnie



Otis



Yevgeniy

(g,gx,…,gxq)


3

BDH ⇒AliceBob

CharlesDoraErnie



Otis



Yevgeniy

IBE universe

q-SDH ⇒/

q+5-SDH ⇒

AliceBob

CharlesDoraErnie



Otis



Yevgeniy

(g,gx,…,gxq)

(g,gx,…,gxq,…,gxq+5)


3

BDH ⇒AliceBob

CharlesDoraErnie



Otis



Yevgeniy

IBE universe

q-SDH ⇒/

q+5-SDH ⇒

>

AliceBob

CharlesDoraErnie



Otis



Yevgeniy

(g,gx,…,gxq)

(g,gx,…,gxq,…,gxq+5)


3

BDH ⇒AliceBob

CharlesDoraErnie



Otis



Yevgeniy

IBE universe

q-SDH ⇒/

q+5-SDH ⇒

>

t/√q steps [Cheon06]

t/√q+5 steps

AliceBob

CharlesDoraErnie



Otis



Yevgeniy

Moving away from q-type assumptions

4

Dual systems [W09,…] have proved effective at removing q-type assumptions


4


• Properties of bilinear groups: subgroup hiding and parameter hiding


4



• Abstract dual systems into three steps


4




Apply dual systems directly to variants of the uber-assumption [BBG05,B08]


4





• Reduce* to an assumption that holds by a statistical argument

*currently only in composite-order groups


4






• Adapt dual systems to work for deterministic primitives

*currently only in composite-order groups


4






• Adapt dual systems to work for deterministic primitives

Extension to Dodis-Yampolskiy PRF [DY05]*currently only in composite-order groups

Outline

5

Outline

5

Bilinear groups

Outline

5

Bilinear groups q-Type assumptions

Outline

5


Extensions

Outline

5


Extensions Conclusions

Outline

5



Bilinear groupsSubgroup hiding Parameter hiding

Dual systems

Standard bilinear group: (N, G, H, GT, e, g, h)

Properties of (bilinear) groups

6



6

Group order; prime or composite



6


}

|G| = |H| = κN; |GT| = λN



6


}

|G| = |H| = κN; |GT| = λN

e: G × H → GT bilinearity: e(ga,hb) = e(g,h)ab ∀a,b∈Z/NZ

non-degeneracy: e(x,y) = 1 ∀y∈H ⇒ x = 1



6


}

|G| = |H| = κN; |GT| = λN



}

G = <g>; H = <h>



6


}

|G| = |H| = κN; |GT| = λN



}

G = <g>; H = <h>

subgroup hiding



6


}

|G| = |H| = κN; |GT| = λN



}

G = <g>; H = <h>

subgroup hidingparameter hiding

Composite-order bilinear group: (N, G, GT, e, g) where N = pq

Subgroup hiding

7



Subgroup hiding

7


Gp Gq


Subgroup hiding [BGN05]:

Subgroup hiding

7


Gp Gq



Subgroup hiding

7


Gp Gq

≈



Subgroup hiding

7


Gp Gq

≈

random element of Gp × Gq



Subgroup hiding

7


Gp Gq

≈(indistinguishable from)




Subgroup hiding

7


Gp Gq

≈(indistinguishable from)

random element of Gp


Parameter hiding [L12]

Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements


8




g2f(x1,...,xc)

8

g1f(x1,...,xc)




g2f(x1,...,xc)

8

≈g1f(x1,...,xc)




g2f(x1,...,xc)

8

≈g1f(x1,...,xc) g1f(x1,...,xc)g2f(x1′,...,xc′)




g2f(x1,...,xc)

8

is independent from





g2f(x1,...,xc)

8

is independent from

xi mod p reveals nothing about xi mod q (CRT)


Typical dual-system proof for IBE [W09,LW10,...]

9


9

Challenge ciphertext


9

ID queries



normal:

normal:

9

ID queries



normal:

(subgroup hiding)

normal:

9

ID queries



normal:

(subgroup hiding)

(parameter hiding)

normal:

9

ID queries



normal:

semi-functional (SF):

(subgroup hiding)

(parameter hiding)

normal:

9

ID queries



normal:


(subgroup hiding)

(parameter hiding)

(subgroup hiding)

normal:

9

ID queries



normal:


(subgroup hiding)

(parameter hiding)

(subgroup hiding)

(parameter hiding)

normal:

9

ID queries



normal:


(subgroup hiding)

(parameter hiding)

(subgroup hiding)

(parameter hiding)

normal:


9

ID queries



normal:


(subgroup hiding)

(parameter hiding)

(subgroup hiding)

(parameter hiding)

normal:


9

SF keys don’t decrypt SF ciphertexts!

ID queries


Dual systems in three easy steps

10


10

1. start with base scheme


normal:

10

1. start with base scheme


normal:

10

1. start with base scheme2. transition to SF version


normal:


(subgroup hiding)

(parameter hiding)

10



normal:


(subgroup hiding)

(parameter hiding)

10


(subgroup hiding)


normal:


(subgroup hiding)

(parameter hiding)

10


(subgroup hiding)

(subgroup hiding)


normal:


(subgroup hiding)

(parameter hiding)

10

1. start with base scheme2. transition to SF version3. argue information is hidden

(subgroup hiding)

(subgroup hiding)

Outline

11

Cryptographic background Pseudorandom functions


Bilinear groupsq-Type assumptions

The uber-assumption Relating uber-assumptions

A bijection trick

The “uber-assumption” [BBG05,B08]

Uber-assumption is parameterized by (c,R,S,T,f)

12



• c = number of variables: x1,...,xc ← R

12




• R = <1,ρ1,...,ρr>: A is given g, {gρi(x1,...,xc)}

12





• S = <1,σ1,...,σs>: A is given h, {hσi(x1,...,xc)}

12






• T = <1,τ1,...,τt>: A is given e(g,h), {e(g,h)τi(x1,...,xc)}

12







• f(x1,...,xc): A needs to compute e(g,h)f(x1,...,xc) (or distinguish it from random)

12







• f(x1,...,xc): A needs to compute e(g,h)f(x1,...,xc) (or distinguish it from random)

uber(c,R,S,T,f) assumption: given (R,S,T) values, hard to compute/distinguish f

12

Example uber-assumption: exponent q-SDH

exponent q-SDH [ZS-NS04]: given (g,gx,…,gxq), distinguish gxq+1 from random

13



• c = number of variables: c = 1

13




• R = <1,ρ1,…,ρr>: ρi(x) = xi (∀i 0≤i≤q)

13




• R = <1,ρ1,…,ρr>: ρi(x) = xi (∀i 0≤i≤q)

• S = <1>

• T = <1>

13




• R = <1,ρ1,…,ρr>: ρi(x) = xi (∀i 0≤i≤q)

• S = <1>

• T = <1>

• f(x1,…,xc): f(x) = xq+1

13




• R = <1,ρ1,…,ρr>: ρi(x) = xi (∀i 0≤i≤q)

• S = <1>

• T = <1>

• f(x1,…,xc): f(x) = xq+1

exponent q-SDH is uber(1,<1,{xi}>,<1>,<1>,xq+1)

13

Applying dual systems to exponent q-SDH

14

1. start with base scheme2. transition to SF version 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)


g1r1x1,…,g1r1x1q

14

1. start with base scheme2. transition to SF version 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)


g1r1x1,…,g1r1x1q

14

1. start with base scheme 2. transition to SF version3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)


subgroup hiding

g1r1x1,…,g1r1x1q g1r1x1i ⋅

g2r1′x1i

vs.

14


uber(c,<1,{xi}>,<1>,<1>,xq+1)


subgroup hiding


g2r1′x1i

parameter hiding

g1r1x1i ⋅

g2r1′x2i

vs.

14


uber(c,<1,{xi}>,<1>,<1>,xq+1)


subgroup hiding


g2r1′x1i

parameter hiding

g1r1x1i ⋅

g2r1′x2ig1r1x1i + r2x2i

⋅ g2r1′x2i

subgroup hiding

vs.

vs.

14


uber(c,<1,{xi}>,<1>,<1>,xq+1)


subgroup hiding


g2r1′x1i

parameter hiding

g1r1x1i ⋅

g2r1′x2ig1r1x1i + r2x2i

⋅ g2r1′x2i

subgroup hidingsubgroup hiding

g1r1x1+r2x2,…,g1r1x1q+r2x2q

vs.

vs.vs.

14


uber(c,<1,{xi}>,<1>,<1>,xq+1)


subgroup hiding

g1r1x1,…,g1r1x1q

parameter hiding



14


uber(c,<1,{xi}>,<1>,<1>,xq+1)


subgroup hiding

g1r1x1,…,g1r1x1q

parameter hiding



g1∑rkxk,…,g1∑rkxkq

14


uber(c,<1,{xi}>,<1>,<1>,xq+1)


subgroup hiding

g1r1x1,…,g1r1x1q

parameter hiding



g1∑rkxk,…,g1∑rkxkq

14

1. start with base scheme 2. transition to SF version 3. argue information is hidden

uber(c,<1,{xi}>,<1>,<1>,xq+1)


15


uber(c,R,<1,{xi}>,<1>,xq+1) → uber(lc,<1,{ ∑rkxki}>,<1>,<1>,∑rkxkq+1)


15




15

r r ... r 1 x . x x1 x . x x. . .. . .1 x . x x




15

=

r r ... r 1 x . x x1 x . x x. . .. . .1 x . x x

yy..y

So A is really given 1. start with base scheme 2. transition to SF version 3. argue information is hidden


16

=

r r ... r 1 x . x x1 x . x x. . .. . .1 x . x x

yy..y



16

=

Vandermonde matrix, so if l=q+2 this is invertible

r r ... r 1 x . x x1 x . x x. . .. . .1 x . x x

yy..y



16

=


Consider set S of l-sized sets; then r,y∈S

Matrix multiplication is map M: S → Spermutation

r r ... r 1 x . x x1 x . x x. . .. . .1 x . x x

yy..y



16

=


This is chosen uniformly at random from S



r r ... r 1 x . x x1 x . x x. . .. . .1 x . x x

yy..y



16

=


This is chosen uniformly at random from S



This is distributed uniformly random as well!

r r ... r 1 x . x x1 x . x x. . .. . .1 x . x x

yy..y


More generally, this is true if

!

!

!

has linearly independent columns (or rows)

Applying dual systems to the uber-assumption

17

1 ρ . ρ f(x1 ρ . ρ f(x. . . .. . . .1 ρ . ρ f(x



!

!

!



17

1 ρ . ρ f(x1 ρ . ρ f(x. . . .. . . .1 ρ . ρ f(x


Decisional uber(c,R,S,T,f) holds if: 1. subgroup hiding and parameter hiding hold

2. S = T = <1> 3. f is not a linear combination of ρi


!

!

!



17

1 ρ . ρ f(x1 ρ . ρ f(x. . . .. . . .1 ρ . ρ f(x




only computational requirement


!

!

!



17

1 ρ . ρ f(x1 ρ . ρ f(x. . . .. . . .1 ρ . ρ f(x




only computational requirement

limitation

Outline

18

Cryptographic background q-Type assumptions

Data Conclusions

Bilinear groups

ExtensionsBroader classes of assumptions

Dodis-Yampolskiy PRF

Strengthening our results

sh ph sh sh

19


sh ph sh sh

Remember that we needed two types of subgroup hiding …

…even when given a generator for

19


sh ph sh sh



vs.

19


sh ph sh sh



vs. vs.

19


sh ph sh sh



This restricts us to “one-sided” assumptions

vs. vs.

19

2. S = T = <1>


sh ph sh sh




vs. vs.

19

(g,gx,…,gxq) → gxq+1 or random[eq-SDH]

2. S = T = <1>


sh ph sh sh




vs. vs.

19

(g,gx,…,gxq) → gxq+1 or random

(g,gx,…,gxq,hx) → compute (c,g1/x+c)

[eq-SDH]

[q-SDH]

2. S = T = <1>


sh ph sh sh

vs. vs.

20

sh ph

Remember that we needed two types of subgroup hiding…


sh ph sh sh

To address this, switch back to regular dual systems

vs. vs.

20

sh ph



sh ph sh sh


vs. vs.

20

sh ph


Computational uber(c,R,S,T,f) holds if: 1. subgroup hiding and parameter hiding hold

2. f is not a linear combination of ρi

limitation


sh ph sh sh


This implies (for example) that q-SDH [BB04] follows from subgroup hiding....

…and so does everything based on q-SDH (like Boneh-Boyen signatures)*

vs. vs.

20

sh ph


*when instantiated in asymmetric composite-order groups [BRS11]

Reexamining the Dodis-Yampolskiy PRF

21

f(x) = u1/sk+x for fixed sk←R; x∈a(λ)


21


Theorem [DY05]: Advvrf ≤ a(λ)·Adva(λ)-DBDHI


21



verifiable random function


21



require u=e(g,h)verifiable random function


21



require u=e(g,h)verifiable random function q-type assumption


21



require u=e(g,h) looseness: need |a(λ)| ≤ poly(λ)verifiable random function q-type assumption


21



Theorem: Advprf ≤ q·Advsgh



21





pseudorandom function


21





require composite orderpseudorandom function


21





require composite orderpseudorandom function static assumption


21





require composite order a(λ) of arbitrary sizepseudorandom function static assumption

Outline

22

Cryptographic background q-Type assumptions


Bilinear groups

Conclusions

Conclusions and open problems

23

We applied the dual-system technique directly to a broad class of assumptions


23


Limitation: Restricted to (asymmetric) composite-order (bilinear) groups


23



Limitation: Can’t get rid of every q-type assumption


23




Full version!: cs.ucsd.edu/~smeiklejohn/files/eurocrypt14a.pdf


23




Full version!: cs.ucsd.edu/~smeiklejohn/files/eurocrypt14a.pdf


23

Thanks! Any questions?

déjà q: using dual systems to revisit q-type assumptions

Documents