Zero-Knowledge Password Policy Check from Lattices

Abstract

Abstract. Passwords are ubiquitous and most commonly used to authenticate users when logging into online services. Using high entropy passwords is critical to prevent unauthorized access and password policies emerged to enforce this requirement on passwords. However, with current methods of password storage, poor practices and server breaches have leaked many passwords to the public. To protect one's sensitive information in case of such events, passwords should be hidden from servers. Verifier-based password authenticated key exchange, proposed by Bellovin and Merrit (IEEE S&P, 1992), allows authenticated secure channels to be established with a hash of a password (verifier). Unfortunately, this restricts password policies as passwords cannot be checked from their verifier. To address this issue, Kiefer and Manulis (ESORICS 2014) proposed zero-knowledge password policy check (ZKPPC). A ZKPPC protocol allows users to prove in zero knowledge that a hash of the user's password satisfies the password policy required by the server. Unfortunately, their proposal is not quantum resistant with the use of discrete logarithm-based cryptographic tools and there are currently no other viable alternatives. In this work, we construct the first post-quantum ZKPPC using lattice-based tools. To this end, we introduce a new randomised password hashing scheme for ASCII-based passwords and design an accompanying zero-knowledge protocol for policy compliance. Interestingly, our proposal does not follow the framework established by Kiefer and Manulis and offers an alternate construction without homomorphic commitments. Although our protocol is not ready to be used in practice, we think it is an important first step towards a quantum-resistant privacy-preserving password-based authentication and key exchange system.

Achieving password-hashing scheme over lattices

“…观察到, 现有的基于离散对数的口令散列方案 [21,22] 均使用Pedersen承诺方案设计而来. Nguyen等 [24] 利用格上基于SIS问题的KTX承诺, 提出了一种基于 格的口令散列协议, 该协议具有零知识口令策略检查的特性, 其构造依赖于复杂的随机排列, 但放松了 安全性要求, 使其盐值不具有不可区分性的特性. 此外, 非对称(或称基于验证因子的, verifier-based) PAKE协议 [20,25,26] 要求服务器端存储与口令相关的验证信息(例如, 带有与盐值相关的随机口令散 列).…”

“…因此, 为保证基于格的口令散列方案满足PAKE协议的要求, 本文遵循基于Pedersen类口令散列方 案 [21,22] 的技术路线, 提出了3种基于格上承诺口令散列方案. 相较于Nguyen等 [24] 复杂的permutation操 作, 本文方案具有更高的计算效率.…”

Forward-Secure Group Signatures from Lattices

“…It was then later adapted to the lattice setting for a restricted version of Inhomogeneous Short Integer Solution (ISIS ∞ ) problem by Kawachi et al [29]. More recently, Ling et al [44] generalized the protocol to handle more versatile relations that find applications in the designs of various lattice-based constructions (see, e.g., [37,35,52,38,36,39]). Libert et al [34] put forward an abstraction of Stern's protocol to capture a wider range of lattice-based relations, which we now recall.…”