Synchronized Aggregate Signatures from the RSA Assumption Brent - - PowerPoint PPT Presentation

Synchronized Aggregate Signatures from the RSA Assumption

Brent Waters

Susan Hohenberger

2

Aggregate Signatures[Boneh-Gentry-Lynn-Shacham03]

PK1

Idea: Compress several signatures into one

PK2 PKn

…

PK3 Sig1 Sig2 Sign

…

Sig3 M1 M2 Mn

…

M3 SigAgg

Suggested Applications: (1) BGP Routing (2) Certificate Chains

(B) Must aggregate on same period (A) Sign at “periods” (C) Sign once per period

Synchronized Aggregate

Suggested Applications: (1) Sensor network reporting (2) Block chain as synchronization point

Prior work

Gentry-Ramzan 06

• Bilinear maps
• ID-based
• Random oracle model

Ahn-Green-Hohenberger10

• Bilinear maps
• Standard model

Our Results

Aggregate-signatures from RSA (standard model) ID-based Aggregate-signatures from RSA (RO model)

5

This Talk

Part I: A Basic RSA Scheme Part II: Shrinking the Signing Time Part III: Performance Glimpse

6

Part I A Basic RSA Scheme

7

Sequential Aggregate Algorithms

Setup(1λ, 1T ) → pp

KeyGen(pp) → (pk, sk)

Sign(pp, sk, m ∈ M, t ∈ [1, T]) → σ

Aggregate(pp, t, (pk1, m1, σ1), . . . , (pkn, mn, σn)) → σ

AggVerify(pp, t, (pk1, m1), . . . , (pkn, mn), σ) → out

Correctness: AggVerify will output 1 on legitimately formed signatures

8

Wins if:

1n, 1T (pk∗, sk∗) ← KeyGen(pp) pk∗, (pk1, sk1), . . . , (pkn, skn) (m, t) t∗, (pk∗, pkj1, . . . , pkjk), (m∗, m1, . . . , mk), σ∗ (1) AggVerify(pp, t∗, (pk∗, m∗), (pkj1, m1), . . . , (pkjn, mn), σ∗) = 1 (2) Each t queried at most once (3) Message m∗ not queried pp ← Setup(1λ, 1T )

For i ∈ [n] (pki, ski) ← KeyGen(pp)

σ ← Sign(pp, sk∗, m, t)

9

Setup

Setup(1λ, 1T ) (1) Choose random primes p, q; N = pq; g ∈ Z∗

N

(2) Choose key K; HK : [T], primes. Let ei = HK(i) (3) Y = g

Q

i∈[T ] ei

pp = (N, g, Y, K)

10

Key Generation

KeyGen(pp) (1) Choose random u0, u1, . . . , u ∈ ZN (2) Uj = Y uj = guj

Q

i∈[T ] ei for j = 0 to

pk = U0, U1, . . . , U` sk = u0, u1, . . . , u`

11

Signing and Aggregating

Sign(pp, sk, t)

σ = (gu0 Q`

j=1 guj·mj) Q

i∈[T ]\t ei = (U0

Q`

j=1 U mj j

)1/et

Aggregate(pp, t, (pk1, m1, σ1), . . . , (pkn, mn, σn))

σagg = Qn

i σi

AggVerify(pp, t, (pk1, m1), . . . , (pkn, mn), σagg)

σet

agg ?

= Qi

n(Ui,0

Q`

j U mi,j i,j

)

12

Proof Tidbits

(2) Program K s.t. HK(t∗) = e∗

• [HW09] guarantee for t 6= t∗ have et 6= et∗

RSA Challenge: N, e∗, h find h1/e∗

(3) Embed Challenge

Choose random V0, . . . , V` ∈ Z∗

N

(1) Guess t∗ 2 T; and (j∗, b∗) s.t. m∗

j = b AND m(t∗) j

6= b

• Loss of 2 · T

Uj = V

Q

i∈T ei

j

for j 6= j∗

Uj∗ = h

Q

i∈T \t∗ ei

U0 = V

Q

i∈T ei

· h−(1−b)·Q

i∈T \t∗ ei

Sign for all t except t*

The Good

RSA assumption

Goals

Make signing much faster (without killing other parameters) Use same signature format. Keep security proof! Standard model Reasonable verification time, signature & key sizes

The Bad

Signing time linear in T

• T = 232 takes 27 days!!

14

Part II Reasonable Signing Times

Storage

Let E = Q

i∈[T ] ei

vE/e1

vE/e2

vE/e3

Result

2 lg(T) group elements storage lg(T) exponentiations & prime searches per sign Share storage setup Itkis-Rezin 01 Pebbling: Less explicit; no shared setup

v

v ∈ Z∗

N

16

Storage Tuples

(w ∈ Z∗

N, i ∈ [1, lg(T)], open ∈ [T], closing ∈ [T], count ∈ [T])

R = [open, open + 2i−1 − 1] ∪ [closing + count, closing + 2i−1 − 1]

w = vE/(Q

i∈R ei)

E = Q

i∈[T ] ei

“Working” to increase count incrementally

17

Initializing Storage

levels : T = 2levels+1 − 2

For i = 1 to levels

R = [2i − 1, 2i+1 − 2]

w = vE/(Q

i∈R ei)

(w, i, open = 2i − 1 + 2i−1, closing = 2i − 1, count = 0)}

Si = {(w, i, open = 2i − 1, closing = 2i − 1 + 2i−1, count = 0),

18

Updating Storage

For i = 1 to levels

Find (if any) (w, i, open, closing, count) with smallest open value

Replace with (w0 = weclosing+count, i, open, closing, count + 1)

19

Updating Storage

For i = levels down to 2

Remove (if any) tuples of form (w, i, open, closing, count = 2i−1)

Create (w, i − 1, open0 = open, closing0 = open + 2i2, count = 0)

(w, i − 1, open0 = open + 2i2, closing0 = open, count = 0)

Storage

Global Storage Setup

Storage

v

v ∈ Z∗

N

u ∈ Z

vu

Much cheaper to transform storage!

21

Part III A Performance Snapshot

Parameters Performance

• T = 232 ≈ 14 sigs/s over 10 years
• N 2048 bit modulus
• SHA-256 for prime search
• 256 bits: 8 chunks of 32 bits

Signature Size 256 bytes Private Key Size 18.3KB Signing Time 60ms Verification Time 1ms