1. Spreading Alerts Quietly and the Subgroup Escape Problem Aleksandr Yampolskiy (Yale) Joint work with James Aspnes, Zoë Diamadi, Kristian Gjøsteen, and René Peralta

2. Outline Motivation Blind coupon mechanism Abstract group structure Instantiating the abstract group structure How to spread alerts Conclusions and open problems

3. Our model Message-passing network of n nodes. Two types of nodes: regular or sentinel. Sentinel nodes run Intrusion Detection Software which looks for attacker’s presence.

4. The attacker… Observes all network traffic. Controls the timing and content of delivered messages.

5. Our goal Can sentinel nodes quickly alert all network nodes to attacker’s presence? We want to prevent the attacker from - fabricating false alerts - identifying the presence or source of alert We are attacked!

6. Blind coupon mechanism A blind coupon mechanism (BCM) is a PPT tuple (G, V, C, D): Key generation G(1 k ):  Outputs public and secret keys (PK, SK) and two strings (d, s).  Secret key defines the sets of dummy coupons D SK and signal coupons S SK. We call (D SK  S SK ) valid coupons. Also, d 2 D SK, s 2 S SK.

7. Blind coupon mechanism (cont.) Verification algorithm V PK (y) returns 1 if y is valid, 0 otherwise. Decoding algorithm D SK (y) outputs 0 if y is a dummy coupon; 1 if it is a signal coupon. Combining algorithm z à C PK (x, y) outputs a signal coupon iff one of the inputs is a signal coupon.

8. Blind coupon mechanism (cont.) Def: A BCM (G, V, C, D) is secure if  signal and dummy coupons look similar  cannot generate a signal coupon from scratch  combining algorithm is blinding ¼ 01 1 Pr[ ] =  ¼ 00 C(, ) 0 c ¼ 01 1 c, 1 0, 1 1

9. Abstract group structure (U, G, D) Special group structure yields an efficient BCM. A finite set U, a cyclic group G µ U, generated by s, and its subgroup D · G, generated by d. |G|/|D| is prime. Also, |G|/|U| and |D|/|G| are small. U G D invalid dummy signal

10. G D Hardness assumptions Subgroup Membership Problem: given a tuple (U, G, D, d, s) and y 2 G, it is hard to decide whether y 2 D or y 2 G n D. Many examples: DDH, QRA, Paillier, etc. G ??? ¼

11. Hardness assumptions (cont.) Subgroup Escape Problem: given a tuple (U, G, D, d), it is hard to find an element y 2 G n D Has not appeared in the literature before. G G ¼ ??? D

12. The BCM construction on (U, G, D) The BCM (G, C, V, D) is as follows: Key generation: Let PK=(U, G, d) and SK=|D|. Combining algorithm: C PK (x, y) outputs d r 0 ◦x r 1 ◦y r 2, where r 0,r 1,r 2 2 r {0,…, 2 2k -1} Verification algorithm: V PK (y) checks that y 2 G. Decoding algorithm: D SK (y) outputs 0 (dummy) if y SK =1 and outputs 1 (signal) otherwise.

13. Security theorem Theorem: If the subgroup membership problem and subgroup escape problems for (U, G, D) are hard, then our BCM is secure. Proof idea: C PK (x, y)=d r 0 ◦x r 1 ◦y r 2 ) it is blinding  x,y 2 D ) C PK (x,y) uniform in D  x 2 G\D ) x r1 D uniform in G\D ) C PK (x, y) uniform in G subgroup membership hard ) subgroup escape hard ) ¼ 01 1 Pr [ ] = 

14. Security theorem (cont.) Challenge: Find concrete (U, G, D) for which subgroup membership and subgroup escape problems are hard. Answer: Elliptic curves over Z n, where n=pq. Bilinear groups with specific order.

15. Elliptic Curves over Z n Set of (x:y:z) such that y 2 z ≡ x 3 + axz 2 + bz 3 (mod n) where gcd(4a 2 -27b 3,n)=1. Fact: Points of elliptic curve form an additive group E(Z n ) for n=pq. Key property of E(Z n ): hard to find new group elements except by using group operation on previously known group elements. Previously considered a nuisance [Lenstra ‘87, Demytko ‘98] rather than a useful cryptographic property [Gjøsteen ’04]. P1P1 P2P2 P 1 + P 2

16. Elliptic Curves over Z n (cont.) Challenge: Find (x:y:z) such that y 2 z ≡ x 3 + axz 2 + bz 3 (mod n). Answer: It seems hard! Choose x and solve for y: compute √mod n. Choose y and solve for x: solve cubic equation. Find x and y simultaneously: not obvious. LLL-based methods don’t seem to pose a threat. Finding rational non-torsion points on curves over Q seems hard.

17. Elliptic Curves over Z n (cont.) Let p,q,l 1,l 2,l 3 be primes. Using complex multiplication techniques [Lay- Zimmer ‘94], we can find curves E p /F p and E q /F q with #E p (F p )=l 1 l 2, #E q (F q )=l 3. Let n=pq. Then E(Z n ) ¼ E p (F p ) £ E q (F q ) with #E(Z n )=l 1 l 2 l 3. Let U be projective plane, G be E(Z n ), and D · G be its subgroup of order l 1 l 3. Let PK=(G,D,n), SK=(p,q,l 1,l 2,l 3 ). U GD invalid signal dummy

18. Elliptic Curves over Z n (cont.) Verification Algorithm: Given a coupon (x:y:z), it is easy to check if y 2 z ≡ x 3 +axz 2 +bz 3 (mod n). Subgroup Membership Problem: Hard to distinguish elements of D (order l 1 l 3 ) from elements of G n D.  For E P (F P ), distinguishing elements of prime order from elements of composite order is hard unless can factor #E P (F P ) [Gjo05].  Computing #E(Z n ) is as hard as factoring n [Kunihiro-Koyama ’98].  Thus, #E p (F p ) is hidden. Subgroup Escape Problem: Hard as long as adversary cannot find random group elements in G=E(Z n ).

19. Spreading alerts with the BCM During initial network setup, the administrator generates keys for BCM (G, C, V, D). He gives dummy coupons to all nodes. Sentinel nodes also receive signal coupons. 1 0 0 0 0

20. Spreading alerts with the BCM Nodes continually broadcast coupons to their neighbors. - Initially, everyone transmits dummy coupons. - Sentinel nodes switch to sending signal coupons upon detecting an attacker. Attacker may tamper with messages. 0 1 $#!@ 1 1 0 0 0

21. Spreading alerts with the BCM Upon receiving a coupon, a node verifies that the coupon is valid. 0 1 1 0 0 0 $#!@ 1 V( )=0 V( )=1

22. Spreading alerts with the BCM Upon receiving a coupon, a node verifies that the coupon is valid. If the coupon is valid, the node combines it with its own coupon. Otherwise, the coupon is discarded. 0 1 0 0 1 C(, ) 0 1 0

23. Security theorem Theorem: If the BCM is secure, then so is the alert propagation mechanism. Proof idea: Because adversary cannot distinguish between dummy and signal coupons, he cannot test their presence or absence in the network traffic. Same for coupon forgery.

24. Efficiency Synchronous flooding model: All nodes receive an alert in  steps, where  is the diameter of the subgraph of non-faulty nodes. Simple epidemic model: Communication graph is complete. All nodes receive an alert in O(n log n) steps.

25. Conclusion Useful crypto primitive BCM ( Æ -homomorphic bit commitment). It can be used to construct an undetectable anonymous private channel. New crypto tool? Subgroup escape assumption. Non-interactive proofs of circuit satisfiability of length linear in the number of Æ gates. Applications to i-voting [Chaum et al. ’04].

26. Open problems Can BCM with constant expansion ratio be constructed using standard assumptions? Can we transmit multiple bits without a linear blow up in message size? ?