advertisement

Constant-round Non-malleability From Any One-way Function Rafael Pass Cornell University Joint work with Huijia (Rachel) Lin Cryptographic Protocols “Interactions among mutually distrustful players” Far beyond traditional goal of concealing messages – Electronic Auctions without a trusted auctioneer • Correctness: highest bidder wins • Privacy: no other bids are revealed – Electronic Elections without trusted vote counter • Correctness: votes are correctly counted • Privacy: individual votes remain secret – And much more: Electronic payment systems, Authentication protocols, Privacy-preserving data-mining… Secure Multi-party Computation: “Any task that can be securely implemented using a trusted party, can be securely implemented without the trusted party” [Y82, GMW86] The Classic Stand-Alone Model Alice Bob One set of parties executing a single protocol in isolation. On the Internet: Need Concurrent Security [DDN91,...] Many parties running many different protocol executions. The Chess-master Problem 8am: Lose! 8pm: Lose! Similar attack on Crypto protocols! Man-in-the-middle Attacks Responder/Initiator Initator Responder a a b b Alice MIM Can make use of message from RIGHT in LEFT Bob Man-in-the-middle Attacks Initator Responder/Initiator Responder Alice: a Alice:a Grrr! You are not Alice! Alice MIM Can make use of message from RIGHT in LEFT Bob Man-in-the-middle Attacks Initator Responder/Initiator Responder Alice: a Devil:a Bob:b Devil:b Alice MIM Can make use of message from RIGHT in LEFT Bob Commitment Scheme The “digital analogue” of sealed envelopes. Receiver Sender v Commitment One of the most basic cryptographic tasks. • natural abstraction • many applications (zero-knowledge, coin-tossing, secure computation…) Reveal v One way functions both sufficient and necessary [N’89, HILL’ 99] Example: Closed Auctions Bidder II Auctioneer Bidder I Would like to insure that bids are independent. ~ Bidder II would have loved to set, e.g. a = a + 1. Definition of commitments does not rule this out! For most commitments, can actually create dependency. MIM Sender Receiver/Sender C(v) Receiver C(v’) Possible that v’ = v+1 Even though MIM does not know v! Non-Malleable Commitments [Dolev Dwork Naor’91] MIM Sender Receiver/Sender i C(v) j Receiver C(v’) Non-Malleable Commitments [Dolev Dwork Naor’91] MIM Sender Receiver/Sender i C(i,v) j Non-malleability: if i j Receiver C(j, v’) then, v’ is “independent” of v Non-Malleable Commitments [Dolev Dwork Naor’91] ij j Man-in-the-middle execution: i Simulation: v j v' v v' ' Non-malleability: For every MIM, there exists a “simulator”, such that value committed by MIM is “indistinguishable” from value committed by simulator Non-Malleable Commitments [Dolev Dwork Naor’91] i v j v' v • • • Important in practice “Test-bed” for other tasks Applications to MPC DDN: Encoding Names in Messages Initiator Responder Iteration 1 ID = 010 Iteration 2 For i = 1 to n: • if IDi = 1 then – REAL exhange, – DUMMY exchange • If IDi = 0 Iteration 3 – DUMMY exchange – REAL exchange IDEA: make sure that at some point a MIM needs to either: • speak alone • give REAL when hearing DUMMY DDN: Encoding Names in Messages Initiator ID = 010 Responder/Initiator Responder ID’ = 110 If ID ID’, there exist iteration such that MIM gives REAL but receives DUMMY Non-malleable Commitments • Original Work by [DDN’91] – – • Based on any one-way function (OWF) But: O(log n) rounds Main question: how many rounds do we need? With “trusted set-up” solved: 1-round, OWF: [DIO’99,DKO,CF,FF,…,DG] Without set-up: • • [Barak’02]: O(1)-round Subexp CRH + dense crypto: [P’04,P-Rosen’05]: O(1) rounds using CRH • • • [Lin-P’09]: O(1)^log* n round using OWF [P-Wee’10]: O(1) using Subexp OWF [Wee’10]: O(log^* n) using OWF “Non BB” Non-malleable Commitments • Original Work by [DDN’91] – – • Based on any one-way function (OWF) But: O(log n) rounds Main question: how many rounds do we need? With “trusted set-up” solved: 1-round, OWF: [DIO’99,DKO,CF,FF,…,DG] Without set-up: • • O(1)-round from CRH or Subexp OWF O(log^* n) from OWF Main Theorem [Lin-P’10]: Thm: Assume one-way functions. Then there exists a O(1)round non-malleable commitment. • Note: Since commitment schemes imply OWF, we have that unconditionally that any commitments scheme can be turned into one that is O(1)-round and non-malleable. • Note: As we shall see, this also weakens assumptions for O(1)-round secure multi-party computation. The Idea: What if we could run “message scheduling in the head”? Let us focus on non-aborting and synchronizing adversaries. (never send invalid messages in left exec) Com(id,v): id = 00101 c=C(v) I know v s.t. c=C(v) Or I have “seen” sequence WI-POK Signature Chains Consider 2 “fixed-length” signature schemes Sig0, Sig1 (i.e., signatures are always of length n) with keys vk0, vk1. Def: (s,id) is a signature-chain if for all i, si+1 is a signature of “(i,s0)” using scheme idi s0 s1 s2 s3 s4 =r = Sig0(0,s0) = Sig0(1,s1) = Sig1(2,s2) = Sig0(3,s3) id1 id2 id3 id4 =0 =0 =1 =0 Signature Games You have given vk0, vk1 and you have access to signing oracles Sig0, Sig1 . Let denote the access pattern to the oracle; – that is i = b if in the i’th iteraction you access oracle b. Claim: If you output a signature-chain (s,id) Then, w.h.p, id is a substring of the access pattern . Com(id,v): vk0 r0 Sign0(r0) vk1 r1 Sign1(r1) c=C(v) I know v s.t. c=C(v) Or I have “seen” sequence WI-POK id = 00101 Com(id,v): vk0 r0 Sign0(r0) vk1 r1 Sign0(r1) c=C(v) I know v s.t. c=C(v) Or WI-POK I know a sig-chain (s,id) w.r.t id id = 00101 i = 0110.. Non-malleability through dance j = 00..1 vk0 vk0 r0 r0 Sign0(r0) Sign0(r0) vk1 vk1 r1 r1 Sign1(r1) Sign1(r1) c=C(v) c=C(v) WI-POK WI-POK w.r.t i w.r.t j Dealing with Aborting Adversaries Problem 1: – MIM will notice that I ask him to sign a signature chain – Solution: Don’t. Ask him to sign commitments of sigs… Problem 2: – I might have to “rewind” many times on left to get a single signature – So if I have id = 01011, access pattern on the right is 0*1*0*1*... – Solution: Use 3 keys (0,1,2); require chain w.r.t 2id12id22id3… Main Theorem Thm: Assume one-way functions. Then there exists a O(1)round non-malleable commitment. log* vs O(1)? An application Secure Multi-party Computation [Yao,GMW] A set of parties with private inputs. Wish to jointly compute a function of their inputs while preserving privacy of inputs (as much as possible) Security must be preserved even if some of the parties are malicious. Secure Multi-party Computation [Yao,GMW] Original work of [GMW87] – Trapdoor permutations (TDP), n rounds – (e.g., voting with 1M people => 1M rounds) More Recent: “Stronger assumptions, less rounds” – [KOS] • TDP, dense cryptosystems, log n rounds • TDP, CRH+dense crypto with SubExp sec, O(1)-rounds, non-BB – [P04] • TDP, CRH, O(1)-round, non-BB Thm: Same assumption as GMW => O(1)-round protocol What’s Next – Concurrency for General Interaction What’s Next – Adaptive Hardness Consider the Factoring problem: • Given the product N of 2 random n-bit primes p,q, can you provide the factorization Adaptive Factoring Problem: • Given the product N of 2 random n-bit primes p,q, can you provide the factorization, if you have access to an oracle that factors all other N’ that are products of equal-length primes Are these problems equivalent? Unknown! What’s Next – Adaptive Hardness Adaptively-hard Commitments [Canetti-Lin-P’10] • Commitment scheme that remains hiding even if Adv has access to a decommitment oracle Implies Non-malleability (and more!) Thm [CLP’10] Existence of commitments implies O(n^)round Adaptively-hard commitments Thank You