Related Randomness Attacks for Public Key Encryption

Abstract

Abstract. Several recent and high-profile incidents give cause to believe that randomness failures of various kinds are endemic in deployed cryptographic systems. In the face of this, it behoves cryptographic researchers to develop methods to immunise -to the extent that it is possible -cryptographic schemes against such failures. This paper considers the practically-motivated situation where an adversary is able to force a public key encryption scheme to reuse random values, and functions of those values, in encryption computations involving adversarially chosen public keys and messages. It presents a security model appropriate to this situation, along with variants of this model. It also provides necessary conditions on the set of functions used in order to attain this security notation, and demonstrates that these conditions are also sufficient in the Random Oracle Model. Further standard model constructions achieving weaker security notions are also given, with these constructions having interesting connections to other primitives including: pseudo-random functions that are secure in the related key attack setting; Correlated Input Secure hash functions; and public key encryption schemes that are secure in the auxiliary input setting (this being a special type of leakage resilience).

Public-Key Encryption Secure Against Related Randomness Attacks for Improved End-to-End Security of Cloud/Edge Computing

“…Feltz and Cremers [24] analyzed the authenticated key exchange protocols and showed that bad randomness results in the insecurity of the protocols. Paterson et al [25] introduced a security model for PKE schemes called ''related randomness attacks model'', in which the adversary has the ability to force the usages of related randomness in encryption which are abstracted to the outputs of specified functions applied to some initial randomness. They also proposed many kinds of schemes in this model.…”

“…The related randomness security under Chosen Plaintext/Ciphertext Attack(RRA-CPA/RRA-CCA for short) is two formal security definition introduced by [25] for PKE. Let A = (A 1 , A 2 ) be a PPT adversary of a PKE scheme with a class of of functions, and the advantage of A to break the related randomness security of is defined as follows:…”

Secure Outsourced Medical Data against Unexpected Leakage with Flexible Access Control in a Cloud Storage System

“…Although the aforementioned schemes devote to securing the outsourced EMRs, they are unable to deal with the situation of unexpected privacy leakage, let alone to minimize its effect. In a cloud storage system, the leakage threats mainly include secret credential leakage [22,23], encapsulation-related randomness leakage [24,25], internal files, accounts or other records leakage, etc. e target of our paper is to minimize the impact of leakage in the event that these unexpected issues happen.…”

Authenticated Key Exchange under Bad Randomness, Revisited

“…Cryptographic primitives are heavy users of randomness, but due to problems including insufficient estimation of system entropy, poor design of algorithms, bugs in software, and virtual machine randomness resetting, random number generators may fail to generate required randomness in practice [1]. This failure of randomness can cause catastrophic results: private signing keys of digital signatures could be exposed [2], low-entropy plaintexts in public-key encryption schemes might be recovered [3], the procedure of key generation would be severely weakened [4,5], ephemeral Diffie-Hellman keys may become predictable, resulting in the exposure of session keys [3], and electronic wallet security might be compromised [3]. Obviously, standard security notions of indistinguishability under chosen plaintext attacks or chosen ciphertext attacks [6] (IND-CPA or IND-CCA security) are not sufficient when these attacks on randomness are possible.…”

“…Obviously, standard security notions of indistinguishability under chosen plaintext attacks or chosen ciphertext attacks [6] (IND-CPA or IND-CCA security) are not sufficient when these attacks on randomness are possible. This observation leads the research community to target effort into addressing this problem (e.g., [3,[7][8][9]). However, it is unlikely that the failures of randomness can be completely eliminated [3].…”