[PPT] - Hard-to-Compute Bits for Elliptic Curve-Based One-Way Functions PowerPoint Presentation

SLIDE 1

Hard-to-Compute Bits for Elliptic Curve-Based One-Way Functions

Alexandre Duc 1 Dimitar Jetchev 1

1EPFL, Switzerland

Crypto’2012, August 23rd, 2012, Santa Barbara, CA

Alexandre Duc , Dimitar Jetchev

SLIDE 2

Security of Individual Bits

Alexandre Duc , Dimitar Jetchev

SLIDE 3

Pairing-based One-Way and FAPI-2

E/Fp - elliptic curve (p is a prime),

Alexandre Duc , Dimitar Jetchev

SLIDE 4

Pairing-based One-Way and FAPI-2

E/Fp - elliptic curve (p is a prime), G - a large cyclic subgroup of points on E,

Alexandre Duc , Dimitar Jetchev

SLIDE 5

Pairing-based One-Way and FAPI-2

E/Fp - elliptic curve (p is a prime), G - a large cyclic subgroup of points on E, e : G × G → GT - a cryptographic pairing,

Alexandre Duc , Dimitar Jetchev

SLIDE 6

Pairing-based One-Way and FAPI-2

E/Fp - elliptic curve (p is a prime), G - a large cyclic subgroup of points on E, e : G × G → GT - a cryptographic pairing, By fixing the second argument, one gets fQ : G → GT, fQ(•) = e(•, Q)

Alexandre Duc , Dimitar Jetchev

SLIDE 7

Pairing-based One-Way and FAPI-2

E/Fp - elliptic curve (p is a prime), G - a large cyclic subgroup of points on E, e : G × G → GT - a cryptographic pairing, By fixing the second argument, one gets fQ : G → GT, fQ(•) = e(•, Q) FAPI-2 problem is the problem of inverting this function

Alexandre Duc , Dimitar Jetchev

SLIDE 8

Why is FAPI-2 relevant?

The security of the following schemes relies on the hardness of solving FAPI-2:

Alexandre Duc , Dimitar Jetchev

SLIDE 9

Why is FAPI-2 relevant?

The security of the following schemes relies on the hardness of solving FAPI-2: Boneh–Franklin: identity-based encryption scheme

Alexandre Duc , Dimitar Jetchev

SLIDE 10

Why is FAPI-2 relevant?

The security of the following schemes relies on the hardness of solving FAPI-2: Boneh–Franklin: identity-based encryption scheme Joux: three-party one-round key agreement protocol

Alexandre Duc , Dimitar Jetchev

SLIDE 11

Why is FAPI-2 relevant?

The security of the following schemes relies on the hardness of solving FAPI-2: Boneh–Franklin: identity-based encryption scheme Joux: three-party one-round key agreement protocol Hess: identity-based signature scheme

Alexandre Duc , Dimitar Jetchev

SLIDE 12

Why is FAPI-2 relevant?

The security of the following schemes relies on the hardness of solving FAPI-2: Boneh–Franklin: identity-based encryption scheme Joux: three-party one-round key agreement protocol Hess: identity-based signature scheme FAPI-2 is Hard! Solving FAPI-1 and FAPI-2 yields a solution to CDH.

Alexandre Duc , Dimitar Jetchev

SLIDE 13

Why is FAPI-2 relevant?

The security of the following schemes relies on the hardness of solving FAPI-2: Boneh–Franklin: identity-based encryption scheme Joux: three-party one-round key agreement protocol Hess: identity-based signature scheme FAPI-2 is Hard! Solving FAPI-1 and FAPI-2 yields a solution to CDH. Our Contribution Assuming the hardness of FAPI-2, we show that all the bits of the input to the pairing-based one-way function are secure.

Alexandre Duc , Dimitar Jetchev

SLIDE 14

Elliptic Curves, Weierstrass Equations, Isomorphism Classes

(Short) Weierstrass Equations Equations Ea,b : y2 = x3 + ax + b, a, b ∈ Fp, 4a3 + 27b2 = 0.

Alexandre Duc , Dimitar Jetchev

SLIDE 15

Elliptic Curves, Weierstrass Equations, Isomorphism Classes

(Short) Weierstrass Equations Equations Ea,b : y2 = x3 + ax + b, a, b ∈ Fp, 4a3 + 27b2 = 0. Two Weierstrass equations might represent isomorphic curves.

Alexandre Duc , Dimitar Jetchev

SLIDE 16

Elliptic Curves, Weierstrass Equations, Isomorphism Classes

(Short) Weierstrass Equations Equations Ea,b : y2 = x3 + ax + b, a, b ∈ Fp, 4a3 + 27b2 = 0. Two Weierstrass equations might represent isomorphic curves. Isomorphism classes Two elliptic curves Ea,b and Ea′,b′ are isomorphic (over Fp) if and

nly if a′ = λ−4a, b′ = λ−6b for some λ ∈ F×

p . The isomorphism

between Ea,b and Ea′,b′ is given by (x, y) → (λ2x, λ3y).

Alexandre Duc , Dimitar Jetchev

SLIDE 17

Elliptic Curves, Weierstrass Equations, Isomorphism Classes

(Short) Weierstrass Equations Equations Ea,b : y2 = x3 + ax + b, a, b ∈ Fp, 4a3 + 27b2 = 0. Two Weierstrass equations might represent isomorphic curves. Isomorphism classes Two elliptic curves Ea,b and Ea′,b′ are isomorphic (over Fp) if and

nly if a′ = λ−4a, b′ = λ−6b for some λ ∈ F×

p . The isomorphism

between Ea,b and Ea′,b′ is given by (x, y) → (λ2x, λ3y). Each isomorphism class thus contains precisely p − 1 short Weierstrass equations.

Alexandre Duc , Dimitar Jetchev

SLIDE 18

The main result

All bits of the pairing-based OWF are hard-to-compute If there is an oracle that predicts the kth bit of the input to fQ on a significant fraction of all short Weierstrass equations in an isomorphism class then there is an efficient algorithm to invert fQ.

Alexandre Duc , Dimitar Jetchev

SLIDE 19

The main result

All bits of the pairing-based OWF are hard-to-compute If there is an oracle that predicts the kth bit of the input to fQ on a significant fraction of all short Weierstrass equations in an isomorphism class then there is an efficient algorithm to invert fQ. Conclusion Thus, if FAPI-2 is hard, all the bits of the input of the pairing-based OWF are hard-to-compute.

Alexandre Duc , Dimitar Jetchev

SLIDE 20

Elliptic Curve-Based OWFs

The result is in fact much more general as few properties of the pairing-based function fQ are used.

Alexandre Duc , Dimitar Jetchev

SLIDE 21

Elliptic Curve-Based OWFs

The result is in fact much more general as few properties of the pairing-based function fQ are used. Bit Security for EC-based OWFs Let G be an elliptic curve group and f : G → GT be any function with the property that its definition is independent of the choice of short Weierstrass equation in the isomorphism class (e.g., the pairing-based OWF). Assuming that inverting f is hard, every bit

f the input to f is secure.

Alexandre Duc , Dimitar Jetchev

SLIDE 22

Elliptic Curve-Based OWFs

The result is in fact much more general as few properties of the pairing-based function fQ are used. Bit Security for EC-based OWFs Let G be an elliptic curve group and f : G → GT be any function with the property that its definition is independent of the choice of short Weierstrass equation in the isomorphism class (e.g., the pairing-based OWF). Assuming that inverting f is hard, every bit

f the input to f is secure.

Open Question: Are there other cryptographically interesting EC-based OWFs besides the pairing-based functions for which this result could apply?

Alexandre Duc , Dimitar Jetchev

SLIDE 23

Outline of the Method

Define a code - elliptic curve multiplication code (ECMC),

Alexandre Duc , Dimitar Jetchev

SLIDE 24

Outline of the Method

Define a code - elliptic curve multiplication code (ECMC), Codewords are in bijection with the inputs to the OWF,

Alexandre Duc , Dimitar Jetchev

SLIDE 25

Outline of the Method

Define a code - elliptic curve multiplication code (ECMC), Codewords are in bijection with the inputs to the OWF, Use oracle to get a noisy codeword close to the hidden input,

Alexandre Duc , Dimitar Jetchev

SLIDE 26

Outline of the Method

Define a code - elliptic curve multiplication code (ECMC), Codewords are in bijection with the inputs to the OWF, Use oracle to get a noisy codeword close to the hidden input, Inverting the function ⇔ list-decoding,

Alexandre Duc , Dimitar Jetchev

SLIDE 27

Outline of the Method

Define a code - elliptic curve multiplication code (ECMC), Codewords are in bijection with the inputs to the OWF, Use oracle to get a noisy codeword close to the hidden input, Inverting the function ⇔ list-decoding, List-decoding via Fourier transforms:

Alexandre Duc , Dimitar Jetchev

SLIDE 28

Outline of the Method

Define a code - elliptic curve multiplication code (ECMC), Codewords are in bijection with the inputs to the OWF, Use oracle to get a noisy codeword close to the hidden input, Inverting the function ⇔ list-decoding, List-decoding via Fourier transforms:

Codewords viewed as functions on F×

p ,

Alexandre Duc , Dimitar Jetchev

SLIDE 29

Outline of the Method

Define a code - elliptic curve multiplication code (ECMC), Codewords are in bijection with the inputs to the OWF, Use oracle to get a noisy codeword close to the hidden input, Inverting the function ⇔ list-decoding, List-decoding via Fourier transforms:

Codewords viewed as functions on F×

p ,

Heavy Fourier coefficients: computation of heavy Fourier coefficients (a version of the SFT algorithm by Akavia–Goldwasser–Safra)

Alexandre Duc , Dimitar Jetchev

SLIDE 30

Outline of the Method

Define a code - elliptic curve multiplication code (ECMC), Codewords are in bijection with the inputs to the OWF, Use oracle to get a noisy codeword close to the hidden input, Inverting the function ⇔ list-decoding, List-decoding via Fourier transforms:

Codewords viewed as functions on F×

p ,

Heavy Fourier coefficients: computation of heavy Fourier coefficients (a version of the SFT algorithm by Akavia–Goldwasser–Safra) Recoverability: for a given frequency, find all inputs having large Fourier coefficient at this frequency (a technique of Morillo–R` afols).

Alexandre Duc , Dimitar Jetchev

SLIDE 31

Using the prediction oracle - na¨ ıve idea!

Suppose that we are given

Alexandre Duc , Dimitar Jetchev

SLIDE 32

Using the prediction oracle - na¨ ıve idea!

Suppose that we are given a hidden point R ∈ G,

Alexandre Duc , Dimitar Jetchev

SLIDE 33

Using the prediction oracle - na¨ ıve idea!

Suppose that we are given a hidden point R ∈ G, a short Weierstrass equation W : y2 = x3 + ax + b,

Alexandre Duc , Dimitar Jetchev

SLIDE 34

Using the prediction oracle - na¨ ıve idea!

Suppose that we are given a hidden point R ∈ G, a short Weierstrass equation W : y2 = x3 + ax + b, a prediction oracle B that returns a prediction B(W , fQ(R)) for the kth bit of the x-coordinate of the input point R on W .

Alexandre Duc , Dimitar Jetchev

SLIDE 35

Using the prediction oracle - na¨ ıve idea!

Suppose that we are given a hidden point R ∈ G, a short Weierstrass equation W : y2 = x3 + ax + b, a prediction oracle B that returns a prediction B(W , fQ(R)) for the kth bit of the x-coordinate of the input point R on W . Define a noisy codeword w : F×

p → {±1} as follows

w(λ) := B(Wλ, fQ(R)), where Wλ : y2 = x3 + λ−4ax + λ−6b.

Alexandre Duc , Dimitar Jetchev

SLIDE 36

Codewords and Points

To each point R and each short Weierstrass equation W , one can associate a function (codeword) C W

R : F× p → {±1}

C W

R (λ) = Bk((RWλ)x) = Bk(λ2 · (RW )x),

where Bk returns (−1)b where b is the kth bit.

Alexandre Duc , Dimitar Jetchev

SLIDE 37

Codewords and Points

To each point R and each short Weierstrass equation W , one can associate a function (codeword) C W

R : F× p → {±1}

C W

R (λ) = Bk((RWλ)x) = Bk(λ2 · (RW )x),

where Bk returns (−1)b where b is the kth bit. Properties needed for list-decoding?

Alexandre Duc , Dimitar Jetchev

SLIDE 38

Codewords and Points

To each point R and each short Weierstrass equation W , one can associate a function (codeword) C W

R : F× p → {±1}

C W

R (λ) = Bk((RWλ)x) = Bk(λ2 · (RW )x),

where Bk returns (−1)b where b is the kth bit. Properties needed for list-decoding? Accessibility,

Alexandre Duc , Dimitar Jetchev

SLIDE 39

Codewords and Points

To each point R and each short Weierstrass equation W , one can associate a function (codeword) C W

R : F× p → {±1}

C W

R (λ) = Bk((RWλ)x) = Bk(λ2 · (RW )x),

where Bk returns (−1)b where b is the kth bit. Properties needed for list-decoding? Accessibility, Fourier concentration,

Alexandre Duc , Dimitar Jetchev

SLIDE 40

Codewords and Points

To each point R and each short Weierstrass equation W , one can associate a function (codeword) C W

R : F× p → {±1}

C W

R (λ) = Bk((RWλ)x) = Bk(λ2 · (RW )x),

where Bk returns (−1)b where b is the kth bit. Properties needed for list-decoding? Accessibility, Fourier concentration, Recoverability.

Alexandre Duc , Dimitar Jetchev

SLIDE 41

Fourier Concentration

Alexandre Duc , Dimitar Jetchev

SLIDE 42

Fourier Concentration

Fourier basis formed out of different frequencies (in our case, characters),

Alexandre Duc , Dimitar Jetchev

SLIDE 43

Fourier Concentration

Fourier basis formed out of different frequencies (in our case, characters), A function is Fourier concentrated if the number of significant frequencies (characters) is small.

Alexandre Duc , Dimitar Jetchev

SLIDE 44

List Decoding

Recoverability Given a frequency, find (in polynomial time) all codewords for which this frequency (character) is significant (i.e., has a large Fourier coefficient).

Alexandre Duc , Dimitar Jetchev

SLIDE 45

List Decoding

Recoverability Given a frequency, find (in polynomial time) all codewords for which this frequency (character) is significant (i.e., has a large Fourier coefficient). Fourier concentration + Recoverability ⇒ List Decoding

Alexandre Duc , Dimitar Jetchev

SLIDE 46

Fourier Concentration and the First Attempt

Recall that C W

R (λ) = Bk(λ2 · (RW )x)

This will work fine if C W

R

were Fourier concentrated.

Alexandre Duc , Dimitar Jetchev

SLIDE 47

Fourier Concentration and the First Attempt

Recall that C W

R (λ) = Bk(λ2 · (RW )x)

This will work fine if C W

R

were Fourier concentrated. Estimating the Fourier coefficients of the codewords C W

R

reduces to estimating certain Gauss sums,

Alexandre Duc , Dimitar Jetchev

SLIDE 48

Fourier Concentration and the First Attempt

Recall that C W

R (λ) = Bk(λ2 · (RW )x)

This will work fine if C W

R

were Fourier concentrated. Estimating the Fourier coefficients of the codewords C W

R

reduces to estimating certain Gauss sums, Gauss sums estimates - classical in analytic number theory,

Alexandre Duc , Dimitar Jetchev

SLIDE 49

Fourier Concentration and the First Attempt

Recall that C W

R (λ) = Bk(λ2 · (RW )x)

This will work fine if C W

R

were Fourier concentrated. Estimating the Fourier coefficients of the codewords C W

R

reduces to estimating certain Gauss sums, Gauss sums estimates - classical in analytic number theory, Not clear how to show polynomially many significant Fourier coefficients, so following this natural approach is not feasible.

Alexandre Duc , Dimitar Jetchev

SLIDE 50

Fourier Concentration and the First Attempt

Recall that C W

R (λ) = Bk(λ2 · (RW )x)

This will work fine if C W

R

were Fourier concentrated. Estimating the Fourier coefficients of the codewords C W

R

reduces to estimating certain Gauss sums, Gauss sums estimates - classical in analytic number theory, Not clear how to show polynomially many significant Fourier coefficients, so following this natural approach is not feasible. One needs a different list-decoding problem!

Alexandre Duc , Dimitar Jetchev

SLIDE 51

The Elliptic Curve Multiplication Code (ECMC)

Using an idea of Boneh–Shparlinski:

Alexandre Duc , Dimitar Jetchev

SLIDE 52

The Elliptic Curve Multiplication Code (ECMC)

Using an idea of Boneh–Shparlinski: Define a new prediction oracle as follows: B′(Wλ, fQ(R)) =

B(Wr(λ), fQ(R)), if λ ∈ F2

p

most probable value of Bk(x) else, where r : F2

p → Fp is a random square root function.

Alexandre Duc , Dimitar Jetchev

SLIDE 53

The Elliptic Curve Multiplication Code (ECMC)

Alexandre Duc , Dimitar Jetchev

SLIDE 54

The Elliptic Curve Multiplication Code (ECMC)

Elliptic Curve Multiplication Code (ECMC) Given a W : y2 = x3 + ax + b representing E, define C W

R

as C W

R (λ) = Bk(λ · (RW )x),

where RW is the tuple (x, y) representing the point R on W .

Alexandre Duc , Dimitar Jetchev

SLIDE 55

The Elliptic Curve Multiplication Code (ECMC)

Elliptic Curve Multiplication Code (ECMC) Given a W : y2 = x3 + ax + b representing E, define C W

R

as C W

R (λ) = Bk(λ · (RW )x),

where RW is the tuple (x, y) representing the point R on W . Fourier concentrated,

Alexandre Duc , Dimitar Jetchev

SLIDE 56

The Elliptic Curve Multiplication Code (ECMC)

Elliptic Curve Multiplication Code (ECMC) Given a W : y2 = x3 + ax + b representing E, define C W

R

as C W

R (λ) = Bk(λ · (RW )x),

where RW is the tuple (x, y) representing the point R on W . Fourier concentrated, Recoverable (a technique of Morillo–R` afols).

Alexandre Duc , Dimitar Jetchev

SLIDE 57

Summary and Open Questions

Summary of Results:

Alexandre Duc , Dimitar Jetchev

SLIDE 58

Summary and Open Questions

Summary of Results: Every bit to the input of any EC-based OWF is hard-to-compute,

Alexandre Duc , Dimitar Jetchev

SLIDE 59

Summary and Open Questions

Summary of Results: Every bit to the input of any EC-based OWF is hard-to-compute, In particular, input bits to FA pairing-based OWFs are hard-to-compute,

Alexandre Duc , Dimitar Jetchev

SLIDE 60

Summary and Open Questions

Summary of Results: Every bit to the input of any EC-based OWF is hard-to-compute, In particular, input bits to FA pairing-based OWFs are hard-to-compute, Open Questions:

Alexandre Duc , Dimitar Jetchev

SLIDE 61

Summary and Open Questions

Summary of Results: Every bit to the input of any EC-based OWF is hard-to-compute, In particular, input bits to FA pairing-based OWFs are hard-to-compute, Open Questions: Same result, but on a fixed Weierstrass equation,

Alexandre Duc , Dimitar Jetchev

SLIDE 62

Summary and Open Questions

Summary of Results: Every bit to the input of any EC-based OWF is hard-to-compute, In particular, input bits to FA pairing-based OWFs are hard-to-compute, Open Questions: Same result, but on a fixed Weierstrass equation, Assuming imperfect oracle on an isogeny class of curves (curves having a fixed number of points) - work in progress,

Alexandre Duc , Dimitar Jetchev

SLIDE 63

Summary and Open Questions

Summary of Results: Every bit to the input of any EC-based OWF is hard-to-compute, In particular, input bits to FA pairing-based OWFs are hard-to-compute, Open Questions: Same result, but on a fixed Weierstrass equation, Assuming imperfect oracle on an isogeny class of curves (curves having a fixed number of points) - work in progress, Assuming prediction of blocks of bits.

Alexandre Duc , Dimitar Jetchev