Foundation of Cryptography, Lecture 5 MACs and Signatures Iftach - - PowerPoint PPT Presentation

▶
foundation of cryptography lecture 5 macs and signatures
SMART_READER_LITE
LIVE PREVIEW

Foundation of Cryptography, Lecture 5 MACs and Signatures Iftach - - PowerPoint PPT Presentation

Aug 14, 2022 262 likes •1.41k views

Foundation of Cryptography, Lecture 5 MACs and Signatures Iftach Haitner, Tel Aviv University Tel Aviv University. March 17, 2013 Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 1 / 39 Part I Message Authentication Codes

slide-1
SLIDE 1

Foundation of Cryptography, Lecture 5 MACs and Signatures

Iftach Haitner, Tel Aviv University

Tel Aviv University.

March 17, 2013

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 1 / 39

slide-2
SLIDE 2

Part I Message Authentication Codes (MACs)

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 2 / 39

slide-3
SLIDE 3

Message Authentication Code (MACs)

Definition 1 (MAC) A trippet of PPT’s (Gen, Mac, Vrfy) such that:

1

Gen(1n) outputs a key k ∈ {0, 1}∗

2

Mac(k, m) outputs a “tag" t

3

Vrfy(k, m, t) output 1 (YES) or 0 (NO) Consistency: Vrfyk(m, t) = 1 ∀k ∈ Supp(Gen(1n)), m ∈ {0, 1}n and t = Mack(m)

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 3 / 39

slide-4
SLIDE 4

Message Authentication Code (MACs)

Definition 1 (MAC) A trippet of PPT’s (Gen, Mac, Vrfy) such that:

1

Gen(1n) outputs a key k ∈ {0, 1}∗

2

Mac(k, m) outputs a “tag" t

3

Vrfy(k, m, t) output 1 (YES) or 0 (NO) Consistency: Vrfyk(m, t) = 1 ∀k ∈ Supp(Gen(1n)), m ∈ {0, 1}n and t = Mack(m) Definition 2 (Existential unforgability) A MAC (Gen, Mac, Vrfy) is existential unforgeable (EU), if ∀ PPT A: Pr

k←Gen(1n) (m,t)←AMack ,Vrfyk (1n)

[Vrfyk(m, t) = 1 ∧ Mack was not asked on m] = neg(n)

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 3 / 39

slide-5
SLIDE 5

Message Authentication Code (MACs)

Definition 1 (MAC) A trippet of PPT’s (Gen, Mac, Vrfy) such that:

1

Gen(1n) outputs a key k ∈ {0, 1}∗

2

Mac(k, m) outputs a “tag" t

3

Vrfy(k, m, t) output 1 (YES) or 0 (NO) Consistency: Vrfyk(m, t) = 1 ∀k ∈ Supp(Gen(1n)), m ∈ {0, 1}n and t = Mack(m) Definition 2 (Existential unforgability) A MAC (Gen, Mac, Vrfy) is existential unforgeable (EU), if ∀ PPT A: Pr

k←Gen(1n) (m,t)←AMack ,Vrfyk (1n)

[Vrfyk(m, t) = 1 ∧ Mack was not asked on m] = neg(n) Remark: convention

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 3 / 39

slide-6
SLIDE 6

Definition of MAC cont.

“Private key" definition

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 4 / 39

slide-7
SLIDE 7

Definition of MAC cont.

“Private key" definition Security definition too strong?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 4 / 39

slide-8
SLIDE 8

Definition of MAC cont.

“Private key" definition Security definition too strong?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 4 / 39

slide-9
SLIDE 9

Definition of MAC cont.

“Private key" definition Security definition too strong? Any message?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 4 / 39

slide-10
SLIDE 10

Definition of MAC cont.

“Private key" definition Security definition too strong? Any message?Use of Verifier?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 4 / 39

slide-11
SLIDE 11

Definition of MAC cont.

“Private key" definition Security definition too strong? Any message?Use of Verifier? “Replay attacks"

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 4 / 39

slide-12
SLIDE 12

Definition of MAC cont.

“Private key" definition Security definition too strong? Any message?Use of Verifier? “Replay attacks" Strong existential unforgeable MACS (for short, strong MAC): infeasible to generate new valid tag (even for message for which a MAC was asked)

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 4 / 39

slide-13
SLIDE 13

Restricted MACs

Definition 3 (Length-restricted MAC) Same as in Definition 1, but for k ∈ Supp(G(1n)), Mack and Vrfyk only accept messages of length n.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 5 / 39

slide-14
SLIDE 14

Restricted MACs

Definition 3 (Length-restricted MAC) Same as in Definition 1, but for k ∈ Supp(G(1n)), Mack and Vrfyk only accept messages of length n. Definition 4 (ℓ-time MAC) A MAC scheme is existential unforgeable against ℓ queries (for short, ℓ-time MAC), if it is existential unforgeable as in Definition 2, but A can only make ℓ queries.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 5 / 39

slide-15
SLIDE 15

Section 1 Constructions

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 6 / 39

slide-16
SLIDE 16

Zero-time MAC

Construction 5 (Zero-time MAC) Gen(1n): output k ← {0, 1}n. Mack(m): output k. Vrfyk(m, t): output 1 iff t = k.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 7 / 39

slide-17
SLIDE 17

Zero-time MAC

Construction 5 (Zero-time MAC) Gen(1n): output k ← {0, 1}n. Mack(m): output k. Vrfyk(m, t): output 1 iff t = k. Claim 6 The above scheme is zero-time MAC

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 7 / 39

slide-18
SLIDE 18

Zero-time MAC

Construction 5 (Zero-time MAC) Gen(1n): output k ← {0, 1}n. Mack(m): output k. Vrfyk(m, t): output 1 iff t = k. Claim 6 The above scheme is zero-time MAC Does it remind you something?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 7 / 39

slide-19
SLIDE 19

Subsection 1 Restricted-Length MAC

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 8 / 39

slide-20
SLIDE 20

ℓ-wise independent functions

Definition 7 (ℓ-wise independent) A function family H from {0, 1}n to {0, 1}m is ℓ-wise independent, if for every distinct x1, . . . , xℓ ∈ {0, 1}n and every y1, . . . , yℓ ∈ {0, 1}m, it holds that Prh←H [h(x1) = y1 ∧ . . . ∧ h(xℓ) = yℓ] = 2−ℓm.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 9 / 39

slide-21
SLIDE 21

ℓ-times, restricted-length MAC

Construction 8 (ℓ-time MAC) Let H = {Hn : {0, 1}n → {0, 1}n} be an efficient (ℓ + 1)-wise independent function family. Gen(1n): output h ← Hn. Mac(h, m): output h(m). Vrfy(h, m, t): output 1 iff t = h(m).

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 10 / 39

slide-22
SLIDE 22

ℓ-times, restricted-length MAC

Construction 8 (ℓ-time MAC) Let H = {Hn : {0, 1}n → {0, 1}n} be an efficient (ℓ + 1)-wise independent function family. Gen(1n): output h ← Hn. Mac(h, m): output h(m). Vrfy(h, m, t): output 1 iff t = h(m). Claim 9 The above scheme is a length-restricted, ℓ-time MAC

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 10 / 39

slide-23
SLIDE 23

ℓ-times, restricted-length MAC

Construction 8 (ℓ-time MAC) Let H = {Hn : {0, 1}n → {0, 1}n} be an efficient (ℓ + 1)-wise independent function family. Gen(1n): output h ← Hn. Mac(h, m): output h(m). Vrfy(h, m, t): output 1 iff t = h(m). Claim 9 The above scheme is a length-restricted, ℓ-time MAC Proof: ?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 10 / 39

slide-24
SLIDE 24

OWF = ⇒ restricted-length MAC

Construction 10 Same as Construction 8, but uses function F = {Fn : {0, 1}n → {0, 1}n} instead of H.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 11 / 39

slide-25
SLIDE 25

OWF = ⇒ restricted-length MAC

Construction 10 Same as Construction 8, but uses function F = {Fn : {0, 1}n → {0, 1}n} instead of H. Claim 11 Assuming that F is a PRF, then Construction 10 is an existential unforgeable MAC.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 11 / 39

slide-26
SLIDE 26

OWF = ⇒ restricted-length MAC

Construction 10 Same as Construction 8, but uses function F = {Fn : {0, 1}n → {0, 1}n} instead of H. Claim 11 Assuming that F is a PRF, then Construction 10 is an existential unforgeable MAC. Proof:

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 11 / 39

slide-27
SLIDE 27

OWF = ⇒ restricted-length MAC

Construction 10 Same as Construction 8, but uses function F = {Fn : {0, 1}n → {0, 1}n} instead of H. Claim 11 Assuming that F is a PRF, then Construction 10 is an existential unforgeable MAC. Proof: Easy to prove if F is a family of random functions. Hence, also holds in case F is a PRF.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 11 / 39

slide-28
SLIDE 28

Subsection 2 Any Length

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 12 / 39

slide-29
SLIDE 29

Collision Resistant Hash Family

Definition 12 (collision resistant hash family (CRH)) A function family H = {Hn : {0, 1}∗ → {0, 1}n} is collision resistant, if Pr

h←Hn (x,x′)←A(1n,h)

[x = x′ ∈ {0, 1}∗ ∧ h(x) = h(x′)] = neg(n) for any PPT A.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 13 / 39

slide-30
SLIDE 30

Collision Resistant Hash Family

Definition 12 (collision resistant hash family (CRH)) A function family H = {Hn : {0, 1}∗ → {0, 1}n} is collision resistant, if Pr

h←Hn (x,x′)←A(1n,h)

[x = x′ ∈ {0, 1}∗ ∧ h(x) = h(x′)] = neg(n) for any PPT A. Not known to implied by OWFs.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 13 / 39

slide-31
SLIDE 31

Length-restricted MAC = ⇒ MAC

Construction 13 (Length restricted MAC = ⇒ MAC) Let (Gen, Mac, Vrfy) be a length-restricted MAC, and let H = {Hn : {0, 1}∗ → {0, 1}n} be an efficient function family. Gen′(1n): Sample k ← Gen(1n) and h ← Hn. Output k′ = (k, h) Mac′

k,h(m) = Mack(h(m))

Vrfy′

k,h(t, m) = Vrfyk(t, h(m))

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 14 / 39

slide-32
SLIDE 32

Length-restricted MAC = ⇒ MAC

Construction 13 (Length restricted MAC = ⇒ MAC) Let (Gen, Mac, Vrfy) be a length-restricted MAC, and let H = {Hn : {0, 1}∗ → {0, 1}n} be an efficient function family. Gen′(1n): Sample k ← Gen(1n) and h ← Hn. Output k′ = (k, h) Mac′

k,h(m) = Mack(h(m))

Vrfy′

k,h(t, m) = Vrfyk(t, h(m))

Claim 14 Assume H is an efficient collision-resistant family and (Gen, Mac, Vrfy) is existential unforgeable, then (Gen′, Mac′, Vrfy′) is existential unforgeable MAC.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 14 / 39

slide-33
SLIDE 33

Length-restricted MAC = ⇒ MAC

Construction 13 (Length restricted MAC = ⇒ MAC) Let (Gen, Mac, Vrfy) be a length-restricted MAC, and let H = {Hn : {0, 1}∗ → {0, 1}n} be an efficient function family. Gen′(1n): Sample k ← Gen(1n) and h ← Hn. Output k′ = (k, h) Mac′

k,h(m) = Mack(h(m))

Vrfy′

k,h(t, m) = Vrfyk(t, h(m))

Claim 14 Assume H is an efficient collision-resistant family and (Gen, Mac, Vrfy) is existential unforgeable, then (Gen′, Mac′, Vrfy′) is existential unforgeable MAC. Proof: ?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 14 / 39

slide-34
SLIDE 34

Part II Signature Schemes

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 15 / 39

slide-35
SLIDE 35

Signature schemes

Definition 15 (Signature schemes) A trippet of PPT’s (Gen, Sign, Vrfy) such that

1

Gen(1n): output a pair of keys (s, v) ∈ {0, 1}∗ × {0, 1}∗

2

Sign(s, m): output a “signature" σ ∈ {0, 1}∗

3

Vrfy(v, m, σ): output 1 (YES) or 0 (NO) Consistency: Vrfyv(m, σ) = 1 for any (s, v) ∈ Supp(Gen(1n)), m ∈ {0, 1}∗ and σ ∈ Supp(Signs(m))

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 16 / 39

slide-36
SLIDE 36

Signature schemes

Definition 15 (Signature schemes) A trippet of PPT’s (Gen, Sign, Vrfy) such that

1

Gen(1n): output a pair of keys (s, v) ∈ {0, 1}∗ × {0, 1}∗

2

Sign(s, m): output a “signature" σ ∈ {0, 1}∗

3

Vrfy(v, m, σ): output 1 (YES) or 0 (NO) Consistency: Vrfyv(m, σ) = 1 for any (s, v) ∈ Supp(Gen(1n)), m ∈ {0, 1}∗ and σ ∈ Supp(Signs(m)) Definition 16 (Existential unforgability) A signature scheme is existential unforgeable (EU), if ∀ PPT A Pr

(s,v)←Gen(1n) (m,σ)←ASigns (1n,v)

[Vrfyv(m, σ) = 1 ∧ Signs was not asked on m] = neg(n)

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 16 / 39

slide-37
SLIDE 37

Signature schemes cont.

Signature = ⇒ MAC

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 17 / 39

slide-38
SLIDE 38

Signature schemes cont.

Signature = ⇒ MAC “Harder" to construct than MACs: (even restricted forms) require OWF

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 17 / 39

slide-39
SLIDE 39

Signature schemes cont.

Signature = ⇒ MAC “Harder" to construct than MACs: (even restricted forms) require OWF Oracle access to Vrfy is not given

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 17 / 39

slide-40
SLIDE 40

Signature schemes cont.

Signature = ⇒ MAC “Harder" to construct than MACs: (even restricted forms) require OWF Oracle access to Vrfy is not given Strong existential unforgeable signatures (for short, strong signatures): infeasible to generate new valid signatures (even for message for which a signature was asked)

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 17 / 39

slide-41
SLIDE 41

Signature schemes cont.

Signature = ⇒ MAC “Harder" to construct than MACs: (even restricted forms) require OWF Oracle access to Vrfy is not given Strong existential unforgeable signatures (for short, strong signatures): infeasible to generate new valid signatures (even for message for which a signature was asked)

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 17 / 39

slide-42
SLIDE 42

Signature schemes cont.

Signature = ⇒ MAC “Harder" to construct than MACs: (even restricted forms) require OWF Oracle access to Vrfy is not given Strong existential unforgeable signatures (for short, strong signatures): infeasible to generate new valid signatures (even for message for which a signature was asked) Theorem 17 OWFs imply strong existential unforgeable signatures.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 17 / 39

slide-43
SLIDE 43

Section 2 OWFs = ⇒ Signatures

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 18 / 39

slide-44
SLIDE 44

Subsection 1 One-time signatures

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 19 / 39

slide-45
SLIDE 45

Length-restricted signatures

Definition 18 (length-restricted signatures) Same as in Definition 15, but for (s, v) ∈ Supp(G(1n)), Signs and Vrfyv only accept messages of length n.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 20 / 39

slide-46
SLIDE 46

Bounded-query signatures

Definition 19 (ℓ-time signatures) A signature scheme is existential unforgeable against ℓ-query (for short, ℓ-time signature), if it is existential unforgeable as in Definition 16, but A can

  • nly ask for ℓ queries.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 21 / 39

slide-47
SLIDE 47

Bounded-query signatures

Definition 19 (ℓ-time signatures) A signature scheme is existential unforgeable against ℓ-query (for short, ℓ-time signature), if it is existential unforgeable as in Definition 16, but A can

  • nly ask for ℓ queries.

Claim 20 Assuming CRH exists, then length restricted k-time signatures can be used to construct k-time signatures.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 21 / 39

slide-48
SLIDE 48

Bounded-query signatures

Definition 19 (ℓ-time signatures) A signature scheme is existential unforgeable against ℓ-query (for short, ℓ-time signature), if it is existential unforgeable as in Definition 16, but A can

  • nly ask for ℓ queries.

Claim 20 Assuming CRH exists, then length restricted k-time signatures can be used to construct k-time signatures. Proof: ?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 21 / 39

slide-49
SLIDE 49

Bounded-query signatures

Definition 19 (ℓ-time signatures) A signature scheme is existential unforgeable against ℓ-query (for short, ℓ-time signature), if it is existential unforgeable as in Definition 16, but A can

  • nly ask for ℓ queries.

Claim 20 Assuming CRH exists, then length restricted k-time signatures can be used to construct k-time signatures. Proof: ? Proposition 21 Wlg, the signer of a k-time signature scheme, for fixed k, is deterministic Proof: ?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 21 / 39

slide-50
SLIDE 50

OWF = ⇒ length-restricted one-time signatures

Construction 22 (length-restricted, one-time signature) Let f : {0, 1}n → {0, 1}n.

1

Gen(1n):

1

s0

1, s1 1, . . . , s0 n, s1 n ← {0, 1}n,

2

s =

  • s0

1, s1 1, . . . , s0 n, s1 n

  • 3

Output v =

  • v0

1 = f(s0 1), v1 1 = f(s1 1), . . . , v0 n = f(s0 n), v1 n = f(s1 n)

  • 2

Sign(s, m): σ = (sm1

1 , . . . , smn n )

3

Vrfy(v, m, σ = (σ1, . . . , σn)): check that f(σi) = vmi

i

for all i ∈ [n]

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 22 / 39

slide-51
SLIDE 51

OWF = ⇒ length-restricted one-time signatures

Construction 22 (length-restricted, one-time signature) Let f : {0, 1}n → {0, 1}n.

1

Gen(1n):

1

s0

1, s1 1, . . . , s0 n, s1 n ← {0, 1}n,

2

s =

  • s0

1, s1 1, . . . , s0 n, s1 n

  • 3

Output v =

  • v0

1 = f(s0 1), v1 1 = f(s1 1), . . . , v0 n = f(s0 n), v1 n = f(s1 n)

  • 2

Sign(s, m): σ = (sm1

1 , . . . , smn n )

3

Vrfy(v, m, σ = (σ1, . . . , σn)): check that f(σi) = vmi

i

for all i ∈ [n] Lemma 23 If f is a OWF , then Construction 22 is a length restricted one-time signature scheme.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 22 / 39

slide-52
SLIDE 52

OWF = ⇒ length-restricted one-time signatures

Construction 22 (length-restricted, one-time signature) Let f : {0, 1}n → {0, 1}n.

1

Gen(1n):

1

s0

1, s1 1, . . . , s0 n, s1 n ← {0, 1}n,

2

s =

  • s0

1, s1 1, . . . , s0 n, s1 n

  • 3

Output v =

  • v0

1 = f(s0 1), v1 1 = f(s1 1), . . . , v0 n = f(s0 n), v1 n = f(s1 n)

  • 2

Sign(s, m): σ = (sm1

1 , . . . , smn n )

3

Vrfy(v, m, σ = (σ1, . . . , σn)): check that f(σi) = vmi

i

for all i ∈ [n] Lemma 23 If f is a OWF , then Construction 22 is a length restricted one-time signature scheme. Is this a strong signature scheme?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 22 / 39

slide-53
SLIDE 53

OWF = ⇒ length-restricted one-time signatures

Construction 22 (length-restricted, one-time signature) Let f : {0, 1}n → {0, 1}n.

1

Gen(1n):

1

s0

1, s1 1, . . . , s0 n, s1 n ← {0, 1}n,

2

s =

  • s0

1, s1 1, . . . , s0 n, s1 n

  • 3

Output v =

  • v0

1 = f(s0 1), v1 1 = f(s1 1), . . . , v0 n = f(s0 n), v1 n = f(s1 n)

  • 2

Sign(s, m): σ = (sm1

1 , . . . , smn n )

3

Vrfy(v, m, σ = (σ1, . . . , σn)): check that f(σi) = vmi

i

for all i ∈ [n] Lemma 23 If f is a OWF , then Construction 22 is a length restricted one-time signature scheme. Is this a strong signature scheme? With some additional work, it can be turned into a strong one.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 22 / 39

slide-54
SLIDE 54

Proving Lemma 23

Let a PPT A, I ⊆ N and p ∈ poly that break the security of Construction 22, we use A to invert f.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 23 / 39

slide-55
SLIDE 55

Proving Lemma 23

Let a PPT A, I ⊆ N and p ∈ poly that break the security of Construction 22, we use A to invert f. Algorithm 24 (Inv) Input: y ∈ {0, 1}n

1

Choose (s, v) ← Gen(1n) and replace vi∗

j∗ for a random i∗ ∈ [n] and

j∗ ∈ {0, 1}, with y.

2

Abort, if A(1n, v) asks to sign message m ∈ {0, 1}n with mi∗ = j∗. Otherwise, use s to answer the query.

3

Let (m′, σ′) be A’s output. Abort, if σ′ is not a valid signature for m′, or m′

i∗ = j∗.

Otherwise, return σi∗.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 23 / 39

slide-56
SLIDE 56

Proving Lemma 23

Let a PPT A, I ⊆ N and p ∈ poly that break the security of Construction 22, we use A to invert f. Algorithm 24 (Inv) Input: y ∈ {0, 1}n

1

Choose (s, v) ← Gen(1n) and replace vi∗

j∗ for a random i∗ ∈ [n] and

j∗ ∈ {0, 1}, with y.

2

Abort, if A(1n, v) asks to sign message m ∈ {0, 1}n with mi∗ = j∗. Otherwise, use s to answer the query.

3

Let (m′, σ′) be A’s output. Abort, if σ′ is not a valid signature for m′, or m′

i∗ = j∗.

Otherwise, return σi∗. v is distributed as is in the real “signature game"

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 23 / 39

slide-57
SLIDE 57

Proving Lemma 23

Let a PPT A, I ⊆ N and p ∈ poly that break the security of Construction 22, we use A to invert f. Algorithm 24 (Inv) Input: y ∈ {0, 1}n

1

Choose (s, v) ← Gen(1n) and replace vi∗

j∗ for a random i∗ ∈ [n] and

j∗ ∈ {0, 1}, with y.

2

Abort, if A(1n, v) asks to sign message m ∈ {0, 1}n with mi∗ = j∗. Otherwise, use s to answer the query.

3

Let (m′, σ′) be A’s output. Abort, if σ′ is not a valid signature for m′, or m′

i∗ = j∗.

Otherwise, return σi∗. v is distributed as is in the real “signature game" v is independent of i∗ and j∗.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 23 / 39

slide-58
SLIDE 58

Proving Lemma 23

Let a PPT A, I ⊆ N and p ∈ poly that break the security of Construction 22, we use A to invert f. Algorithm 24 (Inv) Input: y ∈ {0, 1}n

1

Choose (s, v) ← Gen(1n) and replace vi∗

j∗ for a random i∗ ∈ [n] and

j∗ ∈ {0, 1}, with y.

2

Abort, if A(1n, v) asks to sign message m ∈ {0, 1}n with mi∗ = j∗. Otherwise, use s to answer the query.

3

Let (m′, σ′) be A’s output. Abort, if σ′ is not a valid signature for m′, or m′

i∗ = j∗.

Otherwise, return σi∗. v is distributed as is in the real “signature game" v is independent of i∗ and j∗. Therefore Inv inverts f w.p.

1 2np(n) for every n ∈ I.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 23 / 39

slide-59
SLIDE 59

Subsection 2 Stateful Schemes

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 24 / 39

slide-60
SLIDE 60

Stateful signature schemes1

Definition 25 (Stateful scheme) Same as in Definition 15, but Sign might keep state.

1Also known as memory-dependant schemes Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 25 / 39

slide-61
SLIDE 61

Stateful signature schemes1

Definition 25 (Stateful scheme) Same as in Definition 15, but Sign might keep state. Make sense in many applications (e.g., smartcards)

1Also known as memory-dependant schemes Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 25 / 39

slide-62
SLIDE 62

Stateful signature schemes1

Definition 25 (Stateful scheme) Same as in Definition 15, but Sign might keep state. Make sense in many applications (e.g., smartcards) We’ll later use it a building block for building stateless scheme

1Also known as memory-dependant schemes Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 25 / 39

slide-63
SLIDE 63

Stateful schemes — straight-line construction

Let (Gen, Sign, Vrfy) be a strong one-time signature scheme. Construction 26 (straight-line construction) Gen′(1n): Output (s′, v′) = (s1, v1) ← Gen(1n). Sign′

s1(mi), where mi is i’th message to sign:

1

Let (si+1, vi+1) ← Gen(1n)

2

Let σi = Signsi(mi, vi+1)

3

Output σ′

i = (σ′ i−1, mi, vi+1, σi).a

Vrfy′

v1(m, σ′ = (m1, v2, σ1), . . . , (mi, vi+1, σi)):

Check that

1

Vrfyvj((mj, vj+1), σj) = 1 for every j ∈ [i]

2

mi = m

aσ′ 0 is the empty string. Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 26 / 39

slide-64
SLIDE 64

Stateful schemes — straight-line construction

Let (Gen, Sign, Vrfy) be a strong one-time signature scheme. Construction 26 (straight-line construction) Gen′(1n): Output (s′, v′) = (s1, v1) ← Gen(1n). Sign′

s1(mi), where mi is i’th message to sign:

1

Let (si+1, vi+1) ← Gen(1n)

2

Let σi = Signsi(mi, vi+1)

3

Output σ′

i = (σ′ i−1, mi, vi+1, σi).a

Vrfy′

v1(m, σ′ = (m1, v2, σ1), . . . , (mi, vi+1, σi)):

Check that

1

Vrfyvj((mj, vj+1), σj) = 1 for every j ∈ [i]

2

mi = m

aσ′ 0 is the empty string. Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 26 / 39

slide-65
SLIDE 65

Straight-line construction cont.

The state of Sign′ is used for maintaining the most recent signing key (e.g., si), and the last published signature that connects si to v1.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 27 / 39

slide-66
SLIDE 66

Straight-line construction cont.

The state of Sign′ is used for maintaining the most recent signing key (e.g., si), and the last published signature that connects si to v1. While polynomial time, it is rather inefficient scheme: both running time and signature size are linear in number of published signatures.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 27 / 39

slide-67
SLIDE 67

Straight-line construction cont.

The state of Sign′ is used for maintaining the most recent signing key (e.g., si), and the last published signature that connects si to v1. While polynomial time, it is rather inefficient scheme: both running time and signature size are linear in number of published signatures. That (Gen, Sign, Vrfy) works for any length (specifically, it is possible to sign message that is longer than the verification key), is critically used.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 27 / 39

slide-68
SLIDE 68

Straight-line construction cont.

The state of Sign′ is used for maintaining the most recent signing key (e.g., si), and the last published signature that connects si to v1. While polynomial time, it is rather inefficient scheme: both running time and signature size are linear in number of published signatures. That (Gen, Sign, Vrfy) works for any length (specifically, it is possible to sign message that is longer than the verification key), is critically used.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 27 / 39

slide-69
SLIDE 69

Straight-line construction cont.

The state of Sign′ is used for maintaining the most recent signing key (e.g., si), and the last published signature that connects si to v1. While polynomial time, it is rather inefficient scheme: both running time and signature size are linear in number of published signatures. That (Gen, Sign, Vrfy) works for any length (specifically, it is possible to sign message that is longer than the verification key), is critically used. Lemma 27 (Gen′, Sign′, Vrfy′) is a stateful, strong signature scheme.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 27 / 39

slide-70
SLIDE 70

Straight-line construction cont.

The state of Sign′ is used for maintaining the most recent signing key (e.g., si), and the last published signature that connects si to v1. While polynomial time, it is rather inefficient scheme: both running time and signature size are linear in number of published signatures. That (Gen, Sign, Vrfy) works for any length (specifically, it is possible to sign message that is longer than the verification key), is critically used. Lemma 27 (Gen′, Sign′, Vrfy′) is a stateful, strong signature scheme. Proof: Assume ∃ PPT A′, p ∈ poly and infinite set I ⊆ N, such that A′ breaks the strong security of (Gen′, Sign′, Vrfy′) with probability

1 p(n) for all n ∈ I.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 27 / 39

slide-71
SLIDE 71

Straight-line construction cont.

The state of Sign′ is used for maintaining the most recent signing key (e.g., si), and the last published signature that connects si to v1. While polynomial time, it is rather inefficient scheme: both running time and signature size are linear in number of published signatures. That (Gen, Sign, Vrfy) works for any length (specifically, it is possible to sign message that is longer than the verification key), is critically used. Lemma 27 (Gen′, Sign′, Vrfy′) is a stateful, strong signature scheme. Proof: Assume ∃ PPT A′, p ∈ poly and infinite set I ⊆ N, such that A′ breaks the strong security of (Gen′, Sign′, Vrfy′) with probability

1 p(n) for all n ∈ I. We

present PPT A that breaks the security of (Gen, Sign, Vrfy).

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 27 / 39

slide-72
SLIDE 72

Straight-line construction cont.

The state of Sign′ is used for maintaining the most recent signing key (e.g., si), and the last published signature that connects si to v1. While polynomial time, it is rather inefficient scheme: both running time and signature size are linear in number of published signatures. That (Gen, Sign, Vrfy) works for any length (specifically, it is possible to sign message that is longer than the verification key), is critically used. Lemma 27 (Gen′, Sign′, Vrfy′) is a stateful, strong signature scheme. Proof: Assume ∃ PPT A′, p ∈ poly and infinite set I ⊆ N, such that A′ breaks the strong security of (Gen′, Sign′, Vrfy′) with probability

1 p(n) for all n ∈ I. We

present PPT A that breaks the security of (Gen, Sign, Vrfy). We assume for simplicity that p also bounds the query complexity of A′

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 27 / 39

slide-73
SLIDE 73

Proving Lemma 27 cont.

Let (mt, σ′ = (m1, v2, σ1), . . . , (mt, vt+1, σt)) be the pair output by A′

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 28 / 39

slide-74
SLIDE 74

Proving Lemma 27 cont.

Let (mt, σ′ = (m1, v2, σ1), . . . , (mt, vt+1, σt)) be the pair output by A′ Claim 28 Whenever A′ succeeds, ∃ i ∈ [p] such that:

1

Sign′ has output σ′

  • i−1 = (m1, v2, σ1), . . . , (m
  • i−1, v
  • i, σ
  • i−1)

2

Sign′ has not output σ′

  • i = (m1, v2, σ1), . . . , (m
  • i, v
  • i+1, σ
  • i)

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 28 / 39

slide-75
SLIDE 75

Proving Lemma 27 cont.

Let (mt, σ′ = (m1, v2, σ1), . . . , (mt, vt+1, σt)) be the pair output by A′ Claim 28 Whenever A′ succeeds, ∃ i ∈ [p] such that:

1

Sign′ has output σ′

  • i−1 = (m1, v2, σ1), . . . , (m
  • i−1, v
  • i, σ
  • i−1)

2

Sign′ has not output σ′

  • i = (m1, v2, σ1), . . . , (m
  • i, v
  • i+1, σ
  • i)

Proof: ?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 28 / 39

slide-76
SLIDE 76

Proving Lemma 27 cont.

Let (mt, σ′ = (m1, v2, σ1), . . . , (mt, vt+1, σt)) be the pair output by A′ Claim 28 Whenever A′ succeeds, ∃ i ∈ [p] such that:

1

Sign′ has output σ′

  • i−1 = (m1, v2, σ1), . . . , (m
  • i−1, v
  • i, σ
  • i−1)

2

Sign′ has not output σ′

  • i = (m1, v2, σ1), . . . , (m
  • i, v
  • i+1, σ
  • i)

Proof: ? It follows that v

  • i was sampled by Sign′

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 28 / 39

slide-77
SLIDE 77

Proving Lemma 27 cont.

Let (mt, σ′ = (m1, v2, σ1), . . . , (mt, vt+1, σt)) be the pair output by A′ Claim 28 Whenever A′ succeeds, ∃ i ∈ [p] such that:

1

Sign′ has output σ′

  • i−1 = (m1, v2, σ1), . . . , (m
  • i−1, v
  • i, σ
  • i−1)

2

Sign′ has not output σ′

  • i = (m1, v2, σ1), . . . , (m
  • i, v
  • i+1, σ
  • i)

Proof: ? It follows that v

  • i was sampled by Sign′

Let s

  • i be the signing key generated by Sign′ along with v
  • i, and let
  • m = (m
  • i, v
  • i+1)

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 28 / 39

slide-78
SLIDE 78

Proving Lemma 27 cont.

Let (mt, σ′ = (m1, v2, σ1), . . . , (mt, vt+1, σt)) be the pair output by A′ Claim 28 Whenever A′ succeeds, ∃ i ∈ [p] such that:

1

Sign′ has output σ′

  • i−1 = (m1, v2, σ1), . . . , (m
  • i−1, v
  • i, σ
  • i−1)

2

Sign′ has not output σ′

  • i = (m1, v2, σ1), . . . , (m
  • i, v
  • i+1, σ
  • i)

Proof: ? It follows that v

  • i was sampled by Sign′

Let s

  • i be the signing key generated by Sign′ along with v
  • i, and let
  • m = (m
  • i, v
  • i+1)

Vrfyv

  • i(

m, σ

  • i) = 1

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 28 / 39

slide-79
SLIDE 79

Proving Lemma 27 cont.

Let (mt, σ′ = (m1, v2, σ1), . . . , (mt, vt+1, σt)) be the pair output by A′ Claim 28 Whenever A′ succeeds, ∃ i ∈ [p] such that:

1

Sign′ has output σ′

  • i−1 = (m1, v2, σ1), . . . , (m
  • i−1, v
  • i, σ
  • i−1)

2

Sign′ has not output σ′

  • i = (m1, v2, σ1), . . . , (m
  • i, v
  • i+1, σ
  • i)

Proof: ? It follows that v

  • i was sampled by Sign′

Let s

  • i be the signing key generated by Sign′ along with v
  • i, and let
  • m = (m
  • i, v
  • i+1)

Vrfyv

  • i(

m, σ

  • i) = 1

Signs

  • i was not queried by Sign′ on

m and output σ

  • i.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 28 / 39

slide-80
SLIDE 80

Proving Lemma 27 cont.

Let (mt, σ′ = (m1, v2, σ1), . . . , (mt, vt+1, σt)) be the pair output by A′ Claim 28 Whenever A′ succeeds, ∃ i ∈ [p] such that:

1

Sign′ has output σ′

  • i−1 = (m1, v2, σ1), . . . , (m
  • i−1, v
  • i, σ
  • i−1)

2

Sign′ has not output σ′

  • i = (m1, v2, σ1), . . . , (m
  • i, v
  • i+1, σ
  • i)

Proof: ? It follows that v

  • i was sampled by Sign′

Let s

  • i be the signing key generated by Sign′ along with v
  • i, and let
  • m = (m
  • i, v
  • i+1)

Vrfyv

  • i(

m, σ

  • i) = 1

Signs

  • i was not queried by Sign′ on

m and output σ

  • i.

Signs

  • i was queried at most once by Sign′

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 28 / 39

slide-81
SLIDE 81

Definition of A

Algorithm 29 (A) Input: 1n, v Oracle: Signs

1

Choose i∗ ← [p = p(n)] and (s′, v′) ← Gen′(1n).

2

Emulate a random execution of A′Sign′

s′ with a single twist:

◮ On the i∗’th call to Sign′

s′, set vi∗ = v (rather than choosing it via

Gen)

◮ When need to sign using si∗, use Signs. 3

Let (m, σ = (m1, v1, σ1), . . . , (mq, vq, σq)) ← A′

4

Output ((mi∗, vi∗), σi∗) (abort if i∗ > q))

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 29 / 39

slide-82
SLIDE 82

Definition of A

Algorithm 29 (A) Input: 1n, v Oracle: Signs

1

Choose i∗ ← [p = p(n)] and (s′, v′) ← Gen′(1n).

2

Emulate a random execution of A′Sign′

s′ with a single twist:

◮ On the i∗’th call to Sign′

s′, set vi∗ = v (rather than choosing it via

Gen)

◮ When need to sign using si∗, use Signs. 3

Let (m, σ = (m1, v1, σ1), . . . , (mq, vq, σq)) ← A′

4

Output ((mi∗, vi∗), σi∗) (abort if i∗ > q)) The emulated game A′Sign′

s′ has the same distribution as the real game.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 29 / 39

slide-83
SLIDE 83

Definition of A

Algorithm 29 (A) Input: 1n, v Oracle: Signs

1

Choose i∗ ← [p = p(n)] and (s′, v′) ← Gen′(1n).

2

Emulate a random execution of A′Sign′

s′ with a single twist:

◮ On the i∗’th call to Sign′

s′, set vi∗ = v (rather than choosing it via

Gen)

◮ When need to sign using si∗, use Signs. 3

Let (m, σ = (m1, v1, σ1), . . . , (mq, vq, σq)) ← A′

4

Output ((mi∗, vi∗), σi∗) (abort if i∗ > q)) The emulated game A′Sign′

s′ has the same distribution as the real game.

Signs is called at most once

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 29 / 39

slide-84
SLIDE 84

Definition of A

Algorithm 29 (A) Input: 1n, v Oracle: Signs

1

Choose i∗ ← [p = p(n)] and (s′, v′) ← Gen′(1n).

2

Emulate a random execution of A′Sign′

s′ with a single twist:

◮ On the i∗’th call to Sign′

s′, set vi∗ = v (rather than choosing it via

Gen)

◮ When need to sign using si∗, use Signs. 3

Let (m, σ = (m1, v1, σ1), . . . , (mq, vq, σq)) ← A′

4

Output ((mi∗, vi∗), σi∗) (abort if i∗ > q)) The emulated game A′Sign′

s′ has the same distribution as the real game.

Signs is called at most once A breaks (Gen, Sign, Vrfy) whenever i∗ = i.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 29 / 39

slide-85
SLIDE 85

Subsection 3 Somewhat-Stateful Schemes

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 30 / 39

slide-86
SLIDE 86

A somewhat-stateful scheme

Let (Gen, Sign, Vrfy) be a strong one-time signature scheme. Construction 30 (A somewhat-stateful scheme) Gen′(1n): Output (s′, v′) = (sλ, vλ) ← Gen(1n). Sign′

sλ(m): choose an unused r ∈ {0, 1}n

1

For i = 0 to n − 1: if ar1,...,i was not set before:

1

For both j ∈ {0, 1}, let (sr1,...,i ,j, vr1,...,i ,j) ← Gen(1n)

2

Let ar1,...,i = (vr1,...,i ,0, vr1,...,i ,1).

3

Let σr1,...,i = Signsr1,...,i (ar1,...,i )

2

Output (r, aλ, σλ, . . . , ar1,...,n−1, σr1,...,n−1, σr = Signsr(m)) Vrfy′

vλ(m, σ′ = (r, aλ, σλ, . . . , ar−1, σr1,...,n−1, σr)

Check that

1

Vrfyvr1,...,i (ar1,...,i, σr1,...,i) = 1 for every i ∈ {0, . . . , n − 1}

2

Vrfyvr(m, σr) = 1, for vr = (ar1,...,n−1)rn

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 31 / 39

slide-87
SLIDE 87

A somewhat-stateful Scheme, cont.

Each one-time signature key is used at most once.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 32 / 39

slide-88
SLIDE 88

A somewhat-stateful Scheme, cont.

Each one-time signature key is used at most once.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 32 / 39

slide-89
SLIDE 89

A somewhat-stateful Scheme, cont.

Each one-time signature key is used at most once. Lemma 31 (Gen′, Sign′, Vrfy′) is a stateful strong signature scheme.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 32 / 39

slide-90
SLIDE 90

A somewhat-stateful Scheme, cont.

Each one-time signature key is used at most once. Lemma 31 (Gen′, Sign′, Vrfy′) is a stateful strong signature scheme. Proof: ?

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 32 / 39

slide-91
SLIDE 91

A somewhat-stateful Scheme, cont.

Each one-time signature key is used at most once. Lemma 31 (Gen′, Sign′, Vrfy′) is a stateful strong signature scheme. Proof: ? Note that Sign′ does not keep track of the message history.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 32 / 39

slide-92
SLIDE 92

A somewhat-stateful Scheme, cont.

Each one-time signature key is used at most once. Lemma 31 (Gen′, Sign′, Vrfy′) is a stateful strong signature scheme. Proof: ? Note that Sign′ does not keep track of the message history. More efficient scheme — Enough to construct tree of depth ω(log n) (i.e., to choose r ∈ {0, 1}ℓ∈ω(log n))

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 32 / 39

slide-93
SLIDE 93

Subsection 4 Stateless Schemes

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 33 / 39

slide-94
SLIDE 94

Stateless Scheme

Let Πk be the set of all functions from

i∈[k]{0, 1}i to {0, 1}k to {0, 1}n, let

q ∈ poly be “large enough", and let H = {Hn : {0, 1}∗ → {0, 1}n} be a CRH. Construction 32 (Inefficient stateless Scheme) Gen′(1n): Sample (sλ, vλ) ← Gen(1n) and π ← Πq(n) and h ← Hn. Output (s′ = (s, π, h), v′ = v). Sign′

s(m): Set r = π(h(m))1,...,n.

1

For i = 0 to n − 1: if ar1,...,i was not set before:

1

For both j ∈ {0, 1}, let (sr1,...,i ,j, vr1,...,i ,j) ← Gen(1n; π(r 1,...,i, j))

2

Let σr1,...,i = Signsr1,...,i (ar1,...,i = (vr1,...,i ,0, vr1,...,i ,1))

2

Output (r, aλ, σλ, . . . , ar1,...,n−1, σr1,...,n−1, σr = Signsr(m)) Vrfy′: unchanged

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 34 / 39

slide-95
SLIDE 95

Stateless Scheme

Let Πk be the set of all functions from

i∈[k]{0, 1}i to {0, 1}k to {0, 1}n, let

q ∈ poly be “large enough", and let H = {Hn : {0, 1}∗ → {0, 1}n} be a CRH. Construction 32 (Inefficient stateless Scheme) Gen′(1n): Sample (sλ, vλ) ← Gen(1n) and π ← Πq(n) and h ← Hn. Output (s′ = (s, π, h), v′ = v). Sign′

s(m): Set r = π(h(m))1,...,n.

1

For i = 0 to n − 1: if ar1,...,i was not set before:

1

For both j ∈ {0, 1}, let (sr1,...,i ,j, vr1,...,i ,j) ← Gen(1n; π(r 1,...,i, j))

2

Let σr1,...,i = Signsr1,...,i (ar1,...,i = (vr1,...,i ,0, vr1,...,i ,1))

2

Output (r, aλ, σλ, . . . , ar1,...,n−1, σr1,...,n−1, σr = Signsr(m)) Vrfy′: unchanged One one-time signature key might be used several times, but always on the same message.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 34 / 39

slide-96
SLIDE 96

Stateless Scheme

Let Πk be the set of all functions from

i∈[k]{0, 1}i to {0, 1}k to {0, 1}n, let

q ∈ poly be “large enough", and let H = {Hn : {0, 1}∗ → {0, 1}n} be a CRH. Construction 32 (Inefficient stateless Scheme) Gen′(1n): Sample (sλ, vλ) ← Gen(1n) and π ← Πq(n) and h ← Hn. Output (s′ = (s, π, h), v′ = v). Sign′

s(m): Set r = π(h(m))1,...,n.

1

For i = 0 to n − 1: if ar1,...,i was not set before:

1

For both j ∈ {0, 1}, let (sr1,...,i ,j, vr1,...,i ,j) ← Gen(1n; π(r 1,...,i, j))

2

Let σr1,...,i = Signsr1,...,i (ar1,...,i = (vr1,...,i ,0, vr1,...,i ,1))

2

Output (r, aλ, σλ, . . . , ar1,...,n−1, σr1,...,n−1, σr = Signsr(m)) Vrfy′: unchanged One one-time signature key might be used several times, but always on the same message. Efficient scheme:

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 34 / 39

slide-97
SLIDE 97

Stateless Scheme

Let Πk be the set of all functions from

i∈[k]{0, 1}i to {0, 1}k to {0, 1}n, let

q ∈ poly be “large enough", and let H = {Hn : {0, 1}∗ → {0, 1}n} be a CRH. Construction 32 (Inefficient stateless Scheme) Gen′(1n): Sample (sλ, vλ) ← Gen(1n) and π ← Πq(n) and h ← Hn. Output (s′ = (s, π, h), v′ = v). Sign′

s(m): Set r = π(h(m))1,...,n.

1

For i = 0 to n − 1: if ar1,...,i was not set before:

1

For both j ∈ {0, 1}, let (sr1,...,i ,j, vr1,...,i ,j) ← Gen(1n; π(r 1,...,i, j))

2

Let σr1,...,i = Signsr1,...,i (ar1,...,i = (vr1,...,i ,0, vr1,...,i ,1))

2

Output (r, aλ, σλ, . . . , ar1,...,n−1, σr1,...,n−1, σr = Signsr(m)) Vrfy′: unchanged One one-time signature key might be used several times, but always on the same message. Efficient scheme:

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 34 / 39

slide-98
SLIDE 98

Stateless Scheme

Let Πk be the set of all functions from

i∈[k]{0, 1}i to {0, 1}k to {0, 1}n, let

q ∈ poly be “large enough", and let H = {Hn : {0, 1}∗ → {0, 1}n} be a CRH. Construction 32 (Inefficient stateless Scheme) Gen′(1n): Sample (sλ, vλ) ← Gen(1n) and π ← Πq(n) and h ← Hn. Output (s′ = (s, π, h), v′ = v). Sign′

s(m): Set r = π(h(m))1,...,n.

1

For i = 0 to n − 1: if ar1,...,i was not set before:

1

For both j ∈ {0, 1}, let (sr1,...,i ,j, vr1,...,i ,j) ← Gen(1n; π(r 1,...,i, j))

2

Let σr1,...,i = Signsr1,...,i (ar1,...,i = (vr1,...,i ,0, vr1,...,i ,1))

2

Output (r, aλ, σλ, . . . , ar1,...,n−1, σr1,...,n−1, σr = Signsr(m)) Vrfy′: unchanged One one-time signature key might be used several times, but always on the same message. Efficient scheme: use PRF (?)

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 34 / 39

slide-99
SLIDE 99

Subsection 5 “CRH free" Schemes

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 35 / 39

slide-100
SLIDE 100

Target collision-resistant functions

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 36 / 39

slide-101
SLIDE 101

Target collision-resistant functions

Definition 33 (target collision-resistant functions (TCR)) A function family H = {Hn} is target collision resistant, if Pr

(x,a)←A1(1n);h←Hn;x′←A2(a,h) [x = x′ ∧ h(x) = h(x′)] = neg(n)

for any pair of PPT’s A1, A2.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 36 / 39

slide-102
SLIDE 102

Target collision-resistant functions

Definition 33 (target collision-resistant functions (TCR)) A function family H = {Hn} is target collision resistant, if Pr

(x,a)←A1(1n);h←Hn;x′←A2(a,h) [x = x′ ∧ h(x) = h(x′)] = neg(n)

for any pair of PPT’s A1, A2. Theorem 34 OWFs imply efficient compressing TCRs.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 36 / 39

slide-103
SLIDE 103

Target collision-resistant functions

Definition 33 (target collision-resistant functions (TCR)) A function family H = {Hn} is target collision resistant, if Pr

(x,a)←A1(1n);h←Hn;x′←A2(a,h) [x = x′ ∧ h(x) = h(x′)] = neg(n)

for any pair of PPT’s A1, A2. Theorem 34 OWFs imply efficient compressing TCRs. Proof:

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 36 / 39

slide-104
SLIDE 104

Target collision-resistant functions

Definition 33 (target collision-resistant functions (TCR)) A function family H = {Hn} is target collision resistant, if Pr

(x,a)←A1(1n);h←Hn;x′←A2(a,h) [x = x′ ∧ h(x) = h(x′)] = neg(n)

for any pair of PPT’s A1, A2. Theorem 34 OWFs imply efficient compressing TCRs. Proof: not that trivial...

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 36 / 39

slide-105
SLIDE 105

Target one-time signatures

For simplicity we will focus on non-strong schemes.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 37 / 39

slide-106
SLIDE 106

Target one-time signatures

For simplicity we will focus on non-strong schemes. Definition 35 (target one-time signatures) A signature scheme (Gen, Sign, Vrfy) is target one-time existential unforgeable (for short, target one-time signature), if Pr

m←A(1n) (s,v)←Gen(1n) (m′,σ)←A(Signs(m))

[m′ = m ∧ Vrfyv(m′, σ) = 1] = neg(n) for any PPT A

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 37 / 39

slide-107
SLIDE 107

Target one-time signatures

For simplicity we will focus on non-strong schemes. Definition 35 (target one-time signatures) A signature scheme (Gen, Sign, Vrfy) is target one-time existential unforgeable (for short, target one-time signature), if Pr

m←A(1n) (s,v)←Gen(1n) (m′,σ)←A(Signs(m))

[m′ = m ∧ Vrfyv(m′, σ) = 1] = neg(n) for any PPT A Claim 36 OWFs imply target one-time signatures.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 37 / 39

slide-108
SLIDE 108

Random one-time signatures

Definition 37 (random one-time signatures) A signature scheme (Gen, Sign, Vrfy) is random one-time existential unforgeable (for short, random one-time signature), if Pr

m←Mn; (s,v)←Gen(1n) (m′,σ)←A(m,Signs(m))

[m′ = m ∧ Vrfyv(m′, σ) = 1] = neg(n) for any PPT A and any efficiently samplable string ensemble M = {Mn}n∈N.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 38 / 39

slide-109
SLIDE 109

Random one-time signatures

Definition 37 (random one-time signatures) A signature scheme (Gen, Sign, Vrfy) is random one-time existential unforgeable (for short, random one-time signature), if Pr

m←Mn; (s,v)←Gen(1n) (m′,σ)←A(m,Signs(m))

[m′ = m ∧ Vrfyv(m′, σ) = 1] = neg(n) for any PPT A and any efficiently samplable string ensemble M = {Mn}n∈N. Claim 38 Assume (Gen, Sign, Vrfy) is target one-time signature scheme, then it is random one-time signature scheme.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 38 / 39

slide-110
SLIDE 110

“CRH free" schemes

Lemma 39 If (Gen, Sign, Vrfy) and H in Construction 32 are target-one-time signature scheme and TCR respectively, then it is a signature scheme.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 39 / 39

slide-111
SLIDE 111

“CRH free" schemes

Lemma 39 If (Gen, Sign, Vrfy) and H in Construction 32 are target-one-time signature scheme and TCR respectively, then it is a signature scheme. Proof:

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 39 / 39

slide-112
SLIDE 112

“CRH free" schemes

Lemma 39 If (Gen, Sign, Vrfy) and H in Construction 32 are target-one-time signature scheme and TCR respectively, then it is a signature scheme. Proof: Focus on the target-one-time signatures. Assume for simplicity that an adversary cannot make the signer use the same r for for signing two different messages.

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 39 / 39

slide-113
SLIDE 113

“CRH free" schemes

Lemma 39 If (Gen, Sign, Vrfy) and H in Construction 32 are target-one-time signature scheme and TCR respectively, then it is a signature scheme. Proof: Focus on the target-one-time signatures. Assume for simplicity that an adversary cannot make the signer use the same r for for signing two different messages. Show that

1

Random-one-time signature suffice for the nodes signatures

2

Target-one-time signature suffice for the leaves signatures

Iftach Haitner (TAU) Foundation of Cryptography March 17, 2013 39 / 39