Dj Q: Using Dual Systems to Revisit q-Type Assumptions Melissa Chase - PowerPoint PPT Presentation

Properties of (bilinear) groups Standard bilinear group: (N, G, H, G T , e, g, h) } Group order; prime or composite |G| = |H| = κ N; |G T | = λ N e: G × H → G T bilinearity: e(g a ,h b ) = e(g,h) ab ∀ a,b ∈ Z/NZ non-degeneracy: e(x,y) = 1 ∀ y ∈ H ⇒ x = 1 6

Properties of (bilinear) groups Standard bilinear group: (N, G, H, G T , e, g, h) } } Group order; G = <g>; H = <h> prime or composite |G| = |H| = κ N; |G T | = λ N e: G × H → G T bilinearity: e(g a ,h b ) = e(g,h) ab ∀ a,b ∈ Z/NZ non-degeneracy: e(x,y) = 1 ∀ y ∈ H ⇒ x = 1 6

Properties of (bilinear) groups Standard bilinear group: (N, G, H, G T , e, g, h) } } Group order; G = <g>; H = <h> prime or composite |G| = |H| = κ N; |G T | = λ N e: G × H → G T bilinearity: e(g a ,h b ) = e(g,h) ab ∀ a,b ∈ Z/NZ non-degeneracy: e(x,y) = 1 ∀ y ∈ H ⇒ x = 1 6

Properties of (bilinear) groups Standard bilinear group: (N, G, H, G T , e, g, h) } } Group order; G = <g>; H = <h> prime or composite |G| = |H| = κ N; |G T | = λ N e: G × H → G T bilinearity: e(g a ,h b ) = e(g,h) ab ∀ a,b ∈ Z/NZ non-degeneracy: e(x,y) = 1 ∀ y ∈ H ⇒ x = 1 subgroup hiding 6

Properties of (bilinear) groups Standard bilinear group: (N, G, H, G T , e, g, h) } } Group order; G = <g>; H = <h> prime or composite |G| = |H| = κ N; |G T | = λ N e: G × H → G T bilinearity: e(g a ,h b ) = e(g,h) ab ∀ a,b ∈ Z/NZ non-degeneracy: e(x,y) = 1 ∀ y ∈ H ⇒ x = 1 subgroup hiding parameter hiding 6

Subgroup hiding Composite-order bilinear group: (N, G, G T , e, g) where N = pq subgroup hiding parameter hiding 7

Subgroup hiding Composite-order bilinear group: (N, G, G T , e, g) where N = pq G p G q subgroup hiding parameter hiding 7

Subgroup hiding Composite-order bilinear group: (N, G, G T , e, g) where N = pq G p G q Subgroup hiding [BGN05]: subgroup hiding parameter hiding 7

Subgroup hiding Composite-order bilinear group: (N, G, G T , e, g) where N = pq G p G q ≈ Subgroup hiding [BGN05]: subgroup hiding parameter hiding 7

Subgroup hiding Composite-order bilinear group: (N, G, G T , e, g) where N = pq G p G q ≈ Subgroup hiding [BGN05]: subgroup hiding random element of G p × G q parameter hiding 7

Subgroup hiding Composite-order bilinear group: (N, G, G T , e, g) where N = pq G p G q ≈ Subgroup hiding [BGN05]: (indistinguishable from) subgroup hiding random element of G p × G q parameter hiding 7

Subgroup hiding Composite-order bilinear group: (N, G, G T , e, g) where N = pq G p G q random element of G p ≈ Subgroup hiding [BGN05]: (indistinguishable from) subgroup hiding random element of G p × G q parameter hiding 7

Parameter hiding [L12] Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements subgroup hiding parameter hiding 8

Parameter hiding [L12] Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements subgroup hiding parameter hiding 8

Parameter hiding [L12] Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements g 1f(x1,...,xc) g 2f(x1,...,xc) subgroup hiding parameter hiding 8

Parameter hiding [L12] Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements ≈ g 1f(x1,...,xc) g 2f(x1,...,xc) subgroup hiding parameter hiding 8

Parameter hiding [L12] Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements ≈ g 1f(x1,...,xc) g 2f(x1,...,xc) g 1f(x1,...,xc) g 2f(x1 ′ ,...,xc ′ ) subgroup hiding parameter hiding 8

Parameter hiding [L12] Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements ≈ g 1f(x1,...,xc) g 2f(x1,...,xc) g 1f(x1,...,xc) g 2f(x1 ′ ,...,xc ′ ) is independent from subgroup hiding parameter hiding 8

Parameter hiding [L12] Parameter hiding: elements correlated across subgroups are distributed identically to uncorrelated elements ≈ g 1f(x1,...,xc) g 2f(x1,...,xc) g 1f(x1,...,xc) g 2f(x1 ′ ,...,xc ′ ) is independent from subgroup hiding parameter hiding x i mod p reveals nothing about x i mod q (CRT) 8

Typical dual-system proof for IBE [W09,LW10,...] 9

Typical dual-system proof for IBE [W09,LW10,...] Challenge ciphertext 9

Typical dual-system proof for IBE [W09,LW10,...] Challenge ciphertext ID queries 9

Typical dual-system proof for IBE [W09,LW10,...] Challenge ciphertext normal: ID queries normal: 9

Typical dual-system proof for IBE [W09,LW10,...] Challenge ciphertext normal: (subgroup hiding) ID queries normal: 9

Typical dual-system proof for IBE [W09,LW10,...] Challenge ciphertext normal: (subgroup hiding) (parameter hiding) ID queries normal: 9

Typical dual-system proof for IBE [W09,LW10,...] Challenge ciphertext normal: (subgroup hiding) (parameter hiding) semi-functional (SF): ID queries normal: 9

Typical dual-system proof for IBE [W09,LW10,...] Challenge ciphertext normal: (subgroup hiding) (parameter hiding) semi-functional (SF): ID queries normal: (subgroup hiding) 9

Typical dual-system proof for IBE [W09,LW10,...] Challenge ciphertext normal: (subgroup hiding) (parameter hiding) semi-functional (SF): ID queries normal: (subgroup hiding) (parameter hiding) 9

Typical dual-system proof for IBE [W09,LW10,...] Challenge ciphertext normal: (subgroup hiding) (parameter hiding) semi-functional (SF): ID queries normal: (subgroup hiding) semi-functional (SF): (parameter hiding) 9

Typical dual-system proof for IBE [W09,LW10,...] Challenge ciphertext normal: (subgroup hiding) (parameter hiding) semi-functional (SF): SF keys don’t decrypt SF ciphertexts! ID queries normal: (subgroup hiding) semi-functional (SF): (parameter hiding) 9

Dual systems in three easy steps 10

Dual systems in three easy steps 1. start with base scheme 10

Dual systems in three easy steps normal: 1. start with base scheme 10

Dual systems in three easy steps normal: 1. start with base scheme 2. transition to SF version 10

Dual systems in three easy steps normal: (subgroup hiding) semi-functional (SF): (parameter hiding) 1. start with base scheme 2. transition to SF version 10

Dual systems in three easy steps normal: (subgroup hiding) semi-functional (SF): (parameter hiding) (subgroup hiding) 1. start with base scheme 2. transition to SF version 10

Dual systems in three easy steps normal: (subgroup hiding) semi-functional (SF): (parameter hiding) (subgroup hiding) (subgroup hiding) 1. start with base scheme 2. transition to SF version 10

Dual systems in three easy steps normal: (subgroup hiding) (parameter hiding) (subgroup hiding) semi-functional (SF): (subgroup hiding) 1. start with base scheme 2. transition to SF version 10

Dual systems in three easy steps normal: (subgroup hiding) (parameter hiding) (subgroup hiding) semi-functional (SF): (subgroup hiding) 1. start with base scheme 2. transition to SF version 3. argue information is hidden 10

Outline q-Type assumptions The uber-assumption Cryptographic background Bilinear groups Pseudorandom functions Relating uber-assumptions A bijection trick Extensions Conclusions 11

The “uber-assumption” [BBG05,B08] Uber-assumption is parameterized by (c,R,S,T,f) 12

The “uber-assumption” [BBG05,B08] Uber-assumption is parameterized by (c,R,S,T,f) • c = number of variables: x 1 ,...,x c ← R 12

The “uber-assumption” [BBG05,B08] Uber-assumption is parameterized by (c,R,S,T,f) • c = number of variables: x 1 ,...,x c ← R • R = <1, ρ 1 ,..., ρ r >: A is given g, {g ρ i(x1,...,xc) } 12

The “uber-assumption” [BBG05,B08] Uber-assumption is parameterized by (c,R,S,T,f) • c = number of variables: x 1 ,...,x c ← R • R = <1, ρ 1 ,..., ρ r >: A is given g, {g ρ i(x1,...,xc) } • S = <1, σ 1 ,..., σ s >: A is given h, {h σ i(x1,...,xc) } 12

The “uber-assumption” [BBG05,B08] Uber-assumption is parameterized by (c,R,S,T,f) • c = number of variables: x 1 ,...,x c ← R • R = <1, ρ 1 ,..., ρ r >: A is given g, {g ρ i(x1,...,xc) } • S = <1, σ 1 ,..., σ s >: A is given h, {h σ i(x1,...,xc) } • T = <1, τ 1 ,..., τ t >: A is given e(g,h), {e(g,h) τ i(x1,...,xc) } 12

The “uber-assumption” [BBG05,B08] Uber-assumption is parameterized by (c,R,S,T,f) • c = number of variables: x 1 ,...,x c ← R • R = <1, ρ 1 ,..., ρ r >: A is given g, {g ρ i(x1,...,xc) } • S = <1, σ 1 ,..., σ s >: A is given h, {h σ i(x1,...,xc) } • T = <1, τ 1 ,..., τ t >: A is given e(g,h), {e(g,h) τ i(x1,...,xc) } • f(x 1 ,...,x c ): A needs to compute e(g,h) f(x1,...,xc) (or distinguish it from random) 12

The “uber-assumption” [BBG05,B08] Uber-assumption is parameterized by (c,R,S,T,f) • c = number of variables: x 1 ,...,x c ← R • R = <1, ρ 1 ,..., ρ r >: A is given g, {g ρ i(x1,...,xc) } • S = <1, σ 1 ,..., σ s >: A is given h, {h σ i(x1,...,xc) } • T = <1, τ 1 ,..., τ t >: A is given e(g,h), {e(g,h) τ i(x1,...,xc) } • f(x 1 ,...,x c ): A needs to compute e(g,h) f(x1,...,xc) (or distinguish it from random) uber(c,R,S,T,f) assumption: given (R,S,T) values, hard to compute/distinguish f 12

Example uber-assumption: exponent q-SDH exponent q-SDH [ZS-NS04]: given (g,g x ,…,g xq ), distinguish g xq+1 from random 13

Example uber-assumption: exponent q-SDH exponent q-SDH [ZS-NS04]: given (g,g x ,…,g xq ), distinguish g xq+1 from random • c = number of variables: c = 1 13

Example uber-assumption: exponent q-SDH exponent q-SDH [ZS-NS04]: given (g,g x ,…,g xq ), distinguish g xq+1 from random • c = number of variables: c = 1 • R = <1, ρ 1 ,…, ρ r >: ρ i (x) = x i ( ∀ i 0 ≤ i ≤ q) 13

Example uber-assumption: exponent q-SDH exponent q-SDH [ZS-NS04]: given (g,g x ,…,g xq ), distinguish g xq+1 from random • c = number of variables: c = 1 • R = <1, ρ 1 ,…, ρ r >: ρ i (x) = x i ( ∀ i 0 ≤ i ≤ q) • S = <1> • T = <1> 13

Example uber-assumption: exponent q-SDH exponent q-SDH [ZS-NS04]: given (g,g x ,…,g xq ), distinguish g xq+1 from random • c = number of variables: c = 1 • R = <1, ρ 1 ,…, ρ r >: ρ i (x) = x i ( ∀ i 0 ≤ i ≤ q) • S = <1> • T = <1> • f(x 1 ,…,x c ): f(x) = x q+1 13

Example uber-assumption: exponent q-SDH exponent q-SDH [ZS-NS04]: given (g,g x ,…,g xq ), distinguish g xq+1 from random • c = number of variables: c = 1 • R = <1, ρ 1 ,…, ρ r >: ρ i (x) = x i ( ∀ i 0 ≤ i ≤ q) • S = <1> • T = <1> • f(x 1 ,…,x c ): f(x) = x q+1 exponent q-SDH is uber(1,<1,{x i }>,<1>,<1>,x q+1 ) 13

Applying dual systems to exponent q-SDH uber(c,<1,{x i }>,<1>,<1>,x q+1 ) 1. start with base scheme 2. transition to SF version 3. argue information is hidden 14

Applying dual systems to exponent q-SDH uber(c,<1,{x i }>,<1>,<1>,x q+1 ) g 1r1x1 ,…,g 1r1x1q 1. start with base scheme 2. transition to SF version 3. argue information is hidden 14

Applying dual systems to exponent q-SDH uber(c,<1,{x i }>,<1>,<1>,x q+1 ) g 1r1x1 ,…,g 1r1x1q 1. start with base scheme 2. transition to SF version 3. argue information is hidden 14

Applying dual systems to exponent q-SDH uber(c,<1,{x i }>,<1>,<1>,x q+1 ) subgroup hiding vs. g 1r1x1 ,…,g 1r1x1q g 1r1x1i ⋅ g 2r1 ′ x1i 1. start with base scheme 2. transition to SF version 3. argue information is hidden 14

Applying dual systems to exponent q-SDH uber(c,<1,{x i }>,<1>,<1>,x q+1 ) subgroup hiding vs. g 1r1x1 ,…,g 1r1x1q g 1r1x1i ⋅ g 2r1 ′ x1i parameter hiding g 1r1x1i ⋅ g 2r1 ′ x2i 1. start with base scheme 2. transition to SF version 3. argue information is hidden 14

Applying dual systems to exponent q-SDH uber(c,<1,{x i }>,<1>,<1>,x q+1 ) subgroup hiding vs. g 1r1x1 ,…,g 1r1x1q g 1r1x1i ⋅ g 2r1 ′ x1i parameter hiding vs. subgroup hiding g 1r1x1i + r2x2i g 1r1x1i ⋅ ⋅ g 2r1 ′ x2i g 2r1 ′ x2i 1. start with base scheme 2. transition to SF version 3. argue information is hidden 14

Applying dual systems to exponent q-SDH uber(c,<1,{x i }>,<1>,<1>,x q+1 ) subgroup hiding vs. g 1r1x1 ,…,g 1r1x1q g 1r1x1i ⋅ g 2r1 ′ x1i parameter hiding vs. vs. subgroup hiding subgroup hiding g 1r1x1+r2x2 ,…,g 1r1x1q+r2x2q g 1r1x1i + r2x2i g 1r1x1i ⋅ ⋅ g 2r1 ′ x2i g 2r1 ′ x2i 1. start with base scheme 2. transition to SF version 3. argue information is hidden 14

Applying dual systems to exponent q-SDH uber(c,<1,{x i }>,<1>,<1>,x q+1 ) subgroup hiding g 1r1x1 ,…,g 1r1x1q parameter hiding subgroup hiding subgroup hiding g 1r1x1+r2x2 ,…,g 1r1x1q+r2x2q 1. start with base scheme 2. transition to SF version 3. argue information is hidden 14

Applying dual systems to exponent q-SDH uber(c,<1,{x i }>,<1>,<1>,x q+1 ) subgroup hiding g 1r1x1 ,…,g 1r1x1q parameter hiding subgroup hiding subgroup hiding g 1r1x1+r2x2 ,…,g 1r1x1q+r2x2q 1. start with base scheme g 1 ∑ rkxk ,…,g 1 ∑ rkxkq 2. transition to SF version 3. argue information is hidden 14

Applying dual systems to exponent q-SDH uber(c,<1,{x i }>,<1>,<1>,x q+1 ) subgroup hiding g 1r1x1 ,…,g 1r1x1q parameter hiding subgroup hiding subgroup hiding g 1r1x1+r2x2 ,…,g 1r1x1q+r2x2q 1. start with base scheme g 1 ∑ rkxk ,…,g 1 ∑ rkxkq 2. transition to SF version 3. argue information is hidden 14

Applying dual systems to exponent q-SDH 1. start with base scheme 2. transition to SF version 3. argue information is hidden 15