abstract cryptography joint work with renato rennercs.au.dk/fileadmin/ · joint work with renato...

Abstract Cryptographyand secure MPC

Ueli Maurer

ETH Zurich

joint work with Renato Renner

Secure Multi-Party Computation Workshop, Aarhus, June 2012.

Abstraction

Abstraction

Algebraic abstraction:

• group 〈G, ?, e, 〉

Abstraction


• group 〈G, ?, e, 〉• field 〈F,+, ·,0,1〉

Abstraction


• group 〈G, ?, e, 〉• field 〈F,+, ·,0,1〉• vector space, graph, data structures, OSI layers, ...

Abstraction



Levels of abstraction:

1. Abstract group: 〈G, ?, e, 〉

2. Instantiations: Integers, real number, elliptic curves

3. Representations: e.g. projective coordinates for ECs

Abstraction



What is the abstraction of:

• cryptosystem ?• digital signature scheme ?• MPC protocol ?• zero-knowledge proof ?• algorithm, distinguisher, hybrid argument, ...?

Abstraction



Goals of abstraction:

• eliminate irrelevant details, minimality• simpler definitions• generality of results• simpler proofs• elegance• didactic suitability, understanding

Levels of abstraction in AC

# main concept concepts treated at this level

0. Constructions composability, construction trees

0’. Games isomorphism

1. Abstract systems cryptographic algebras

2. Discrete systems indistinguishability proofs

3. System implem. complexity, efficiency, asymptotics

The construction paradigm


Many scientific disciplines can be seen as being constructive.



Construct an object S from another object R via construction α.




Notation: R α−→ S





Examples:• A (k, n)-error-correcting code constructs a reliable channel

from a noisy channel:







NCn(enc,dec)−→ RCk








• An extractor constructs a uniform m-bit string Umfrom any RV X with min-entropy > m+ c and Us:

(X,Us)ext−→ Um





Examples:• A (k,m)-PRG constructs a uniform m-bit string

from a uniform k-bit string:

UkPRG−→ Um





Examples:• A (k,m)-PRG constructs a uniform m-bit string

from a uniform k-bit string:

UkPRG−→ Um

• A key agreement protocol (KAP) constructs a sharedsecret n-bit key from ???:

??? KAP−→ KEYn





Involved types:

• resource• constructor• construction notion




Notation: Rα,ε−→ S

Involved types:

• resource• constructor• construction notion• metric on space of resources

d(R,S) ≤ ε ⇐⇒ R ≈ε S








R(β, γ),ε−→ S :⇐⇒ S ≈ε β R γ








R(β, γ),ε−→ S :⇐⇒ S ≈ε β R γ

NCn(enc,dec),ε−→ RCk ⇐⇒ RCk ≈ε enc NCn dec

Constructions and composability

resource set 〈Ω, ||〉, constructor set 〈Γ, , | , id〉



Construction = subset of Ω× Γ×Ω

Possible notation: R α−→ S





Definition: A construction is serially composable if

1. R α−→ S ∧ Sβ−→ T ⇒ R

αβ−→ T






1. R α−→ S ∧ Sβ−→ T ⇒ R

αβ−→ T

and generally composable if also:

2. R id−→ R

3. R α−→ S ⇒ R||Tα|id−→ S||T






1. R α−→ S ∧ Sβ−→ T ⇒ R

αβ−→ T

and generally composable if also:

2. R id−→ R

3. R α−→ S ⇒ R||Tα|id−→ S||T

∧ T||Rid|α−→ T||S

One-time pad: A constructive perspective

1

C , C , ...1ciphertext

1 2

key21 key

21

2

2

addition modulo 2

M , M , ... M , M , ...plaintext plaintext

K , K , ... K , K , ...

One-time pad: A constructive perspective

1

C , C , ...1ciphertext

1 2

key21 key

21

2

2

addition modulo 2

M , M , ... M , M , ...plaintext plaintext

K , K , ... K , K , ...

Perfect secrecy (Shannon):

C and M are statistically independent.

One-time pad in constructive cryptography

.

otp-decB otp-encA [KEY,AUT] ≡ simE SEC


. .

A B

E

AUT

A

E

B

$KEY



. otp−enc

A B

E

AUT

A

E

B

$KEY



. otp−decotp−enc

A B

E

AUT

A

E

B

$KEY



. .

BA

ESEC

otp−decotp−enc

A B

E

AUT

A

E

B

$KEY



.

$

sim

BA

ESEC

otp−decotp−enc

A B

E

AUT

A

E

B

$KEY



.

|.|

$

sim

BA

ESEC

otp−decotp−enc

A B

E

AUT

A

E

B

$KEY



. .

|.|

$

sim

BA

ESEC

otp−decotp−enc

A B

E

AUT

A

E

B

$KEY


written as a construction: [KEY,AUT]OTP−→ SEC

Symmetric encryption in CC

.

|.|

$

sim

SEC

A B

E

dec

D

enc

EA B

E

AUT

A

E

B

$KEY

decB encA [KEY,AUT] ≈ simE SEC

written as a construction: [KEY,AUT]tSYMt−→ SEC

Constructive cryptography

Resource S is constructed from R by protocol π:

R π−→ S



R π−→ S

Example: Alice-Bob-Eve setting, π = (π1, π2)



R π−→ S


R π−→ S :⇔ ∃σ : π1A π2

B R ≈ σE S



R π−→ S


R π−→ S :⇔ ∃σ : π1A π2

B R ≈ σE S

and

π1A π2

B ⊥E R ≈ ⊥E S

Proof of composition theorem for ABE-setting

SR

σ

E

BAπ2π1

E

BA


TS

SR

σ′

B

E

Aπ′2π′

1E

BA

σ

E

BAπ2π1

E

BA


TS

SR

σ′

B

E

Aπ′2π′

1E

BA

σ

π′1

E

BAπ′1 π2π1

E

BA


TS

SR

σ′

B

E

Aπ′2π′

1E

BA

σ

π′1

E

BAπ′1 π2π1

E

BA

Definition: d non-expanding: d(αiR,αiS) ≤ d(R,S)


TS

SR

σ′

B

E

Aπ′2π′

1E

BA

σ

π′1

E

BAπ′1 π2π1

E

BA


Example: efficient (e.g. poly-time) implementable systems


TS

SR

σ′

B

E

Aπ′2π′

1E

BA

σ

π′2π′

1E

BAπ′2π′

1 π2π1

E

BA




TS

SR

σ

σ′

B

E

A

σ

π′2π′

1E

BA

σ

π′2π′

1E

BAπ′2π′

1 π2π1

E

BA



Cryptographic algebra 〈Φ,Σ〉

R2

3

4

1


R2

3

4

1α


R2

3

4

1

β

α


R2

3

4

1 γ

β

α


R2

3

4

1 γ

β

α

Resource set Φ (here for interface set I = 1,2,3,4)Converter set Σ


R2

3

4

1 γ

β

α

Resource set Φ (here for interface set I = 1,2,3,4)Converter set Σ

Algebraic laws:

• αiR ∈Φ for all R ∈Φ, α ∈Σ, i ∈ I• αiβjR = βjαiR for all i 6= j

• 1iR = R for all i

Games and isomorphisms

1,2 1,2,31

2

1 2 3

8 8

5 3

7

5

Alice Bob

outcome


1,2 1,2,31

2

1 2 3

5 7

3 3

8

7

outcome

1,2 1,2,31

2

1 2 3

8 8

5 3

7

5

Alice Bob

outcome


?=~

1,2 1,2,312

1 2 35 7

3 3

8

7

outcome

1,2 1,2,312

1 2 38 8

5 3

7

5

Alice Bob

outcome


1,2 1,2,31

2

1 2 3

8 8

5 3

7

5

Alice Bob

outcome


a,b,c 1,2a

b

1 2

3 5

7

3 5c

8

outcome

1,2 1,2,31

2

1 2 3

8 8

5 3

7

5

Alice Bob

outcome


=~

a,b,c 1,2a

b

1 2

3 5

7

3 5c

8

outcome

1,2 1,2,31

2

1 2 3

8 8

5 3

7

5

Alice Bob

outcome


=~

a,b,c 1,2a

b

1 2

3 5

7

3 5c

8

outcome

1,2 1,2,31

2

1 2 3

8 8

5 3

7

5

Alice Bob

outcome

Complete local relations

Resource isomorphisms

SR1

2

3

4

2

3

4

1

π


SR

β4

β3

β2

β11

2

3

4

α4

α3

α2

α1

2

3

4

1

π


SR

β4

β3

β2

β11

2

3

4

α4

α3

α2

α1

2

3

4

1

π

Theorem: R is isomorphic to S ....


SR

β4

1

2

3

4

2

3

4

1

π



SR

β4

π4 β4

1

2

3

4

2

3

4

1

π



SR

π4

π3

π2

π11

2

3

4

2

3

4

1

π



SR1

2

3

4

α4

2

3

4

1

π



SR

α4

σ4

1

2

3

4

α4

2

3

4

1

π



SR

σ4

σ3

σ2

σ11

2

3

4

2

3

4

1

π



SR

σ4

σ3

σ2

σ11

2

3

4

2

3

4

1

π = (π1, . . . ,πn) σ = (σ1, . . . ,σn)



SR

σ4

σ3

σ2

σ11

2

3

4

2

3

4

1

π = (π1, . . . ,πn) σ = (σ1, . . . ,σn)

Theorem: R is isomorphic to S via π, denoted R ∼=π S, if

∃σ ∀P ⊆ I : πP R ≡ σP S


SR

σ4

σ3

π2

π11

2

3

4

2

3

4

1

π = (π1, . . . ,πn) σ = (σ1, . . . ,σn)


∃σ ∀P ⊆ I : πP R ≡ σP S


SR σ3

σ2

σ1

π4

1

2

3

4

2

3

4

1

π = (π1, . . . ,πn) σ = (σ1, . . . ,σn)


∃σ ∀P ⊆ I : πP R ≡ σP S


SR

σ4

σ2

π3π11

2

3

4

2

3

4

1

π = (π1, . . . ,πn) σ = (σ1, . . . ,σn)


∃σ ∀P ⊆ I : πP R ≡ σP S

Example: 2-party resources

R ∼=π S :⇐⇒

π1Rπ2 ≈ σ1Sσ2π1Rπ2 ≈ σ1Sσ2π1Rπ2 ≈ σ1Sσ2π1Rπ2 ≈ σ1Sσ2


R ∼=π S :⇐⇒


⇔ abstract UC


R ∼=π S :⇐⇒


Special case: R = channel (neutral element, e.g. π1R = π1)


R ∼=π S :⇐⇒



⇒ π1π2 ≈ Sσ2σ1S ≈ S


R ∼=π S :⇐⇒



Theorem: A resource S such that SαS 6≈ S for all α cannotbe constructed from a communication channel.

⇒ π1π2 ≈ Sσ2σ1S ≈ S


R ∼=π S :⇐⇒




Corollary [CF01]: Commitment cannot be constructed (froma communication channel).

⇒ π1π2 ≈ Sσ2σ1S ≈ S


R ∼=π S :⇐⇒





C

⇒ π1π2 ≈ Sσ2σ1S ≈ S


R ∼=π S :⇐⇒





CC

⇒ π1π2 ≈ Sσ2σ1S ≈ S


R ∼=π S :⇐⇒





?CC α

⇒ π1π2 ≈ Sσ2σ1S ≈ S


R ∼=π S :⇐⇒





Corollary: A delayed communication channel cannot beconstructed (from a communication channel).

⇒ π1π2 ≈ Sσ2σ1S ≈ S

Abstraction by sets of resources

Definition: A specification is a setR of resources.



Of special interest: Specifications with (for each party)• a guaranteed choice space• a possible choice space




guaranteed choice space





possible choice space




actual choice space






actual choice space



S

ψ4

ψ3

ψ2

ψ1

2

3

4

1




Definition: S is an abstraction of R via π:

R vπ S :⇐⇒ ∀R∈R ∃S∈S : R ∼=π S




Definition: S is an abstraction of R via π:

R vπ S :⇐⇒ ∀R∈R ∃S∈S : R ∼=π S

Theorem: R vπ S is generally composable.

Example: Encryption, capturing coercibility

|.|

$

sim_E

SEC

dec

D

enc

EA B

E

AUT

A

E

B

$KEY


sim_B

|.|

$

sim_E

SEC

enc

EA B

E

AUT

A

E

B

$KEY


sim_B

|.|

$

sim_E

SEC

enc

EA B

E

AUT

A

E

B

$KEY

Theorem: An unleakable (uncoercible) securecommunication channel cannot be constructed from anauthenticated channel and a secret key.

Some Features of Abstract Cryptography


• top-down abstraction



• isomorphism: exact relation between ideal and real




• no central adversary; local simulators





• all resources captured– communication model not hard-wired into the model– absence can be modeled






• feasibility/efficiency notions free; not hard-wired







• specifications: guaranteed/possible choice domains







• specifications: guaranteed/possible choice domains

• existing frameworks can be captured as special cases– universal composability (UC) by Canetti– reactive simulatability by Pfitzmann/Waidner/Backes– indifferentiability [MRH04]– collusion-preserving computation [AKMZ12]

Thank you!

Constructing channels and keys: •-calculus

A−−−→ B (insecure) channel from A to B

The symbol “•” stands for exclusive access to the channel.

“•” at output: receiver is exclusive −→ confidentiality

“•” at input: sender is exclusive −→ authenticity

A−−−→•B secret channel from A to B

A •−−−→ B authentic channel from A to B

A •−−−→•B secure channel from A to B (secret and authentic)

A •===• B secret key shared by A and B

A ===• B one-sided key: A knows that at most B knowsthe key, but B does not know who holds the key.

Key transport in CC

A •t1t2−−−→•B

KT−→ At2•===• B

Key transport in CC

A •t1t2−−−→•B

KT−→ At2•===• B

At1t2−−−→•B

KT−→ At2

===• B

Key transport in CC

A •t1t2−−−→•B

KT−→ At2•===• B

At1t2−−−→•B

KT−→ At2

===• B

Attention: A •t1t2−−−→ B

KT−→/ At2•=== B

Symmetric cryptosystem in CC

At1

===• BA

t2t3−−−→ Bt2 ≥ t1

SYM−→ A

t2t3−−−→•B

Symmetric cryptosystem in CC

At1

===• BA

t2t3−−−→ Bt2 ≥ t1

SYM−→ A

t2t3−−−→•B

At1

===• BA •

t2t3−−−→ Bt2 ≥ t1

SYM−→ A •

t2t3−−−→•B

MACs in CC

At1•=== B

At2t3−−−→ B

t2 ≥ t1

MAC−→ A •

t2t3−−−→ B

MACs in CC

At1•=== B

At2t3−−−→ B

t2 ≥ t1

MAC−→ A •

t2t3−−−→ B

At1•=== B

At2t3−−−→•Bt2 ≥ t1

MAC−→ A •

t2t3−−−→•B

Combining Encryption and MAC

Goal: At1•===• B

At2t3−−−→ B

t2 ≥ t1

???−→ A •

t2t3−−−→•B



At2t3−−−→ B

t2 ≥ t1

???−→ A •

t2t3−−−→•B

Key expansion:

At1•===• B

PRG−→A

t1•===• BA

t1•===• B



At2t3−−−→ B

t2 ≥ t1

???−→ A •

t2t3−−−→•B

Key expansion:

At1•===• B

PRG−→A

t1•===• BA

t1•===• B

Encrypt-then-MAC:A

t1•=== B

At2t3−−−→ B

t2 ≥ t1

MAC−→ A •

t2t3−−−→ B

At1

===• BA •

t2t3−−−→ Bt2 ≥ t1

SYM−→ A •

t2t3−−−→•B



At2t3−−−→ B

t2 ≥ t1

???−→ A •

t2t3−−−→•B

Key expansion:

At1•===• B

PRG−→A

t1•===• BA

t1•===• B

MAC-then-encrypt:A

t1===• B

At2t3−−−→ B

t2 ≥ t1

SYM−→ A

t2t3−−−→•B

At1•=== B

At2t3−−−→•Bt2 ≥ t1

MAC−→ A •

t2t3−−−→•B

Public-key cryptosystems in CC

A •t1t2−−−→ B

At4t3←−−− B

t3 > t2

PKC−→ A •

t4t3←−−− B

Public-key cryptosystems in CC

A •t1t2−−−→ B

At4t3←−−− B

t3 > t2

PKC−→ A •

t4t3←−−− B

A •t1t2−−−→ B

At4t3←−−−•B

t3 > t2

PKC−→ A •

t4t3←−−−•B

Diffie-Hellman key agreement in CC

A •−−−→ B

A←−−−•B

DH−→ A •===• B

Diffie-Hellman key agreement in CC

A •−−−→ B

A←−−−•B

DH−→ A •===• B

A •−−−→ B

A←−−−B

DH−→/ A •=== B

Digital signature schemes in CC

A •t1t2−−−→ B

At3t4−−−→ B

t4 ≥ t2

DSS−→ A •

t3t4−−−→ B


A •t1t2−−−→ B

At3t4−−−→ B

t4 ≥ t2

DSS−→ A •

t3t4−−−→ B

A •t1t2−−−→ B

At3t4−−−→•Bt4 ≥ t2

DSS−→ A •

t3t4−−−→•B


A •t1t2−−−→ B

At3t4−−−→ B

t4 ≥ t2

DSS−→ A •

t3t4−−−→ B

A •t1t2−−−→ B

At3t4−−−→•Bt4 ≥ t2

DSS−→ A •

t3t4−−−→•B

Note: Conservation law of the •-calculus.


A •t1t2−−−→ B

At3t4−−−→ B

t4 ≥ t2

DSS−→ A •

t3t4−−−→ B

A •t1t2−−−→ B

At3t4−−−→•Bt4 ≥ t2

DSS−→ A •

t3t4−−−→•B

Note: Conservation law of the •-calculus.

Are there any other cryptographic transformations?

abstract cryptography joint work with renato rennercs.au.dk/fileadmin/ · joint work with renato...

Documents