RKA Security beyond the Linear Barrier: IBE, Encryption and Signatures

Bellare, Mihir; Paterson, Kenneth G.; Thomson, Susan

doi:10.1007/978-3-642-34961-4_21

Cited by 63 publications

(57 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A large body of work shows how to protect specific cryptographic schemes against tampering attacks (see [4,3,23,5,25,12] and many more). While these works consider a strong tampering model (e.g., they do not require the split-state assumption), they only offer security for specific schemes.…”

Section: Other Work On Tamper Resiliencementioning

confidence: 99%

See 1 more Smart Citation

Continuous Non-malleable Codes

Faust

Mukherjee

Nielsen

et al. 2014

Theory of Cryptography

117

View full text Add to dashboard Cite

Abstract. Non-malleable codes are a natural relaxation of error correcting/detecting codes that have useful applications in the context of tamper resilient cryptography. Informally, a code is non-malleable if an adversary trying to tamper with an encoding of a given message can only leave it unchanged or modify it to the encoding of a completely unrelated value. This paper introduces an extension of the standard non-malleability security notion -so-called continuous non-malleability -where we allow the adversary to tamper continuously with an encoding. This is in contrast to the standard notion of non-malleable codes where the adversary only is allowed to tamper a single time with an encoding. We show how to construct continuous non-malleable codes in the common split-state model where an encoding consist of two parts and the tampering can be arbitrary but has to be independent with both parts. Our main contributions are outlined below:1. We propose a new uniqueness requirement of split-state codes which states that it is computationally hard to find two codewords X = (X0, X1) and X = (X0, X 1 ) such that both codewords are valid, but X0 is the same in both X and X . A simple attack shows that uniqueness is necessary to achieve continuous non-malleability in the split-state model. Moreover, we illustrate that none of the existing constructions satisfies our uniqueness property and hence is not secure in the continuous setting. 2. We construct a split-state code satisfying continuous non-malleability.Our scheme is based on the inner product function, collision-resistant hashing and non-interactive zero-knowledge proofs of knowledge and requires an untamperable common reference string. 3. We apply continuous non-malleable codes to protect arbitrary cryptographic primitives against tampering attacks. Previous applications of non-malleable codes in this setting required to perfectly erase the entire memory after each execution and required the adversary to be restricted in memory. We show that continuous non-malleable codes avoid these restrictions.

show abstract

Section: Other Work On Tamper Resiliencementioning

confidence: 99%

“…5 In case (X 0 , X 1 ) = (Y0, Y1) or (X 0 , X 1 ) = (Y0, Y1), then the entire encoding can be recovered even with more ease. In this case, whenever the oracle returns same we know Y0 = X 0 and Y1 ∈ {X 1 , X 1 }.…”

Section: Definition 4 (Uniqueness)mentioning

confidence: 99%

Continuous Non-malleable Codes

Faust

Mukherjee

Nielsen

et al. 2014

Theory of Cryptography

117

View full text Add to dashboard Cite

show abstract

“…Previous uses of key-malleability [8,16] for RKA security required additional conditions on the primitives, such as key-fingerprints in the first case and some form of collision-resistance in the second. For OWFs, it is considerably easier, key-malleability alone sufficing.…”

Section: Joining Signature To Encryption With No Public-key Overheadmentioning

confidence: 99%

“…Building Φ-RKA PRFs remains difficult, however, and we really have only one construction [8]. This has lead to direct (non-bootstrapping) constructions of Φ-RKA signatures for classes Φ of polynomials over certain specific pairing groups [16].…”

Section: Introductionmentioning

confidence: 99%

Key-Versatile Signatures and Applications: RKA, KDM and Joint Enc/Sig

Bellare

Meiklejohn

Thomson

2014

Advances in Cryptology – EUROCRYPT 2014

Self Cite

View full text Add to dashboard Cite

This paper introduces key-versatile signatures. Key-versatile signatures allow us to sign with keys already in use for another purpose, without changing the keys and without impacting the security of the original purpose. This allows us to obtain advances across a collection of challenging domains including joint Enc/Sig, security against related-key attack (RKA) and security for key-dependent messages (KDM). Specifically we can (1) Add signing capability to existing encryption capability with zero overhead in the size of the public key (2) Obtain RKA-secure signatures from any RKA-secure one-way function, yielding new RKA-secure signature schemes (3) Add integrity to encryption while maintaining KDM-security.

show abstract

“…In [9] the authors show how to go beyond the linear barrier by extending the class of allowed tampering functions to the class of polynomials of bounded degree for a number of public-key primitives. Also, the work of Goyal, O'Neill and Rao [26] considers polynomial relations that are induced to the inputs of a hash function.…”

Section: Previous Workmentioning

confidence: 99%

Bounded Tamper Resilience: How to Go beyond the Algebraic Barrier

Damgård

Faust

Mukherjee

et al. 2013

Advances in Cryptology - ASIACRYPT 2013

View full text Add to dashboard Cite

Abstract. Related key attacks (RKAs) are powerful cryptanalytic attacks where an adversary can change the secret key and observe the effect of such changes at the output. The state of the art in RKA security protects against an a-priori unbounded number of certain algebraic induced key relations, e.g., affine functions or polynomials of bounded degree. In this work, we show that it is possible to go beyond the algebraic barrier and achieve security against arbitrary key relations, by restricting the number of tampering queries the adversary is allowed to ask for. The latter restriction is necessary in case of arbitrary key relations, as otherwise a generic attack of Gennaro et al. (TCC 2004) shows how to recover the key of almost any cryptographic primitive. We describe our contributions in more detail below.1. We show that standard ID and signature schemes constructed from a large class of Σ-protocols (including the Okamoto scheme, for instance) are secure even if the adversary can arbitrarily tamper with the prover's state a bounded number of times and obtain some bounded amount of leakage. Interestingly, for the Okamoto scheme we can allow also independent tampering with the public parameters. 2. We show a bounded tamper and leakage resilient CCA secure public key cryptosystem based on the DDH assumption. We first define a weaker CPA-like security notion that we can instantiate based on DDH, and then we give a general compiler that yields CCA-security with tamper and leakage resilience. This requires a public tamperproof common reference string. 3. Finally, we explain how to boost bounded tampering and leakage resilience (as in 1. and 2. above) to continuous tampering and leakage resilience, in the so-called floppy model where each user has a personal hardware token (containing leak-and tamper-free information) which can be used to refresh the secret key.We believe that bounded tampering is a meaningful and interesting alternative to avoid known impossibility results and can provide important insights into the security of existing standard cryptographic schemes.

show abstract

RKA Security beyond the Linear Barrier: IBE, Encryption and Signatures

Cited by 63 publications

References 29 publications

Continuous Non-malleable Codes

Continuous Non-malleable Codes

Key-Versatile Signatures and Applications: RKA, KDM and Joint Enc/Sig

Bounded Tamper Resilience: How to Go beyond the Algebraic Barrier

Contact Info

Product

Resources

About