Hedged Public-Key Encryption: How to Protect against Bad Randomness

Abstract

Abstract. Public-key encryption schemes rely for their IND-CPA security on per-message fresh randomness. In practice, randomness may be of poor quality for a variety of reasons, leading to failure of the schemes. Expecting the systems to improve is unrealistic. What we show in this paper is that we can, instead, improve the cryptography to offset the lack of possible randomness. We provide public-key encryption schemes that achieve IND-CPA security when the randomness they use is of high quality, but, when the latter is not the case, rather than breaking completely, they achieve a weaker but still useful notion of security that we call IND-CDA. This hedged public-key encryption provides the best possible security guarantees in the face of bad randomness. We provide simple RO-based ways to make in-practice IND-CPA schemes hedge secure with minimal software changes. We also provide non-RO model schemes relying on lossy trapdoor functions (LTDFs) and techniques from deterministic encryption. They achieve adaptive security by establishing and exploiting the anonymity of LTDFs which we believe is of independent interest.

Reset Indifferentiability from Weakened Random Oracle Salvages One-Pass Hash Functions

“…Moreover, for public-key encryption (as cryptosystem C) and Chosen Distribution Attack [1,2] (as game S) we will prove that C(WRO) is S-secure, which implies the appropriateness of the new concept of the WRO model.…”

“…The IND-SIM security is a very weak property that an adversary cannot distinguish between encryptions of chosen messages under chosen randomness and the output of a simulator. 2 We show that any IND-SIM secure [21] 2 This definition is meaningless in the standard model because the encryption algorithm uses no further randomness beyond that input. 3 From Theorem 2 and 3, the CDA security in the WRO model is preserved if WRO is replaced with the ChopMD construction and the FOLSponge construction.…”

“…Thus, the next step is to show that there exists a secure cryptosystem for a multi-stage game in the WRO model. We consider public-key encryption (PKE) (as cryptosystem C) for the Chosen Distribution Attack (CDA) game [1,2] (as game S). Roughly, we say a PKE scheme is CDA secure if message privacy is preserved even if an adversary can control distributions of messages and randomness in generating the challenge ciphertext.…”

“…Roughly, we say a PKE scheme is CDA secure if message privacy is preserved even if an adversary can control distributions of messages and randomness in generating the challenge ciphertext. The CDA game captures several flavors of PKE settings (e.g., deterministic PKE (DPKE) [1,3,8,14,18], hedged PKE (HPKE) [2], and message-locked PKE [4]), and such PKE settings are tools for many practical applications. Thus, our target is to find a CDA secure cryptosystem in the WRO model.…”

“…They showed that any CPA secure PKE scheme in the RO model can be (redundancy-freely) transformed to an IND-SIM secure PKE scheme in the RO model via conversion REwH1 [2]. The IND-SIM security is a very weak property that an adversary cannot distinguish between encryptions of chosen messages under chosen randomness and the output of a simulator.…”