Download presentation

Presentation is loading. Please wait.

Published byBailey Johnston Modified over 2 years ago

1
On Black-Box Separations in Cryptography Omer Reingold Closed captioning and other considerations provided by Tal Malkin, Luca Trevisan, and Salil Vadhan

2
Crypto - The Merry Old Days

3
Identification Digital Signatures Cryptographic Protocols, Primitives, and Assumptions Encryption Electronic Voting Electronic Commerce One-Way Functions Pseudo-Random Generators Trapdoor Permutations Factoring RSA DDH Oblivious Transfer Strong RSA Dense Crypto System Homomorphic Encryption UOWHFs ID Based Encryption PIRs

4
Determining The Relationships Among Different Primitives Most tasks in complexity-based crypto imply P NP (or even OWF). Simplify our conception of the world. Construct protocols with as strong security guarantee as possible. Reductions: Given any implementation of primitive A, construct implementation of primitive B.

5
OWF PRG PRF MACENC COM ZK ID UOWHF SIG TDP PKEOT KA CCA-PKE CLAW-FREE CF-HASH Some Known Reductions NIZK

6
Are All Crypto Primitives Equivalent? If so: either no cryptography or Cryptomania! But some tasks seem significantly harder than others (e.g. private key vs. public key encryption). In what sense can we claim that primitive A does not imply primitive B if we believe that both exist? After all, a reduction of B to A can ignore A and build B from scratch...

7
Black-Box Separations – Where it Begun Impagliazzo-Rudich [89] While not clear how to formalize/show non-implications in general can do that wrt black-box reductions.

8
(Fully) Black-Box Reductions Given a black-box implementation for primitive A, construct implementation of primitive B. A B Usually, still not structured enough to rule out: Need black-box proof of security (several flavors). Adv. for B Adv. for A A Such fully black-box reductions relativize (hold relative to every oracle).

9
What's not Black Box? No idea … ask Boaz … Oh well … Cook-Levin reduction is used in: OWF ZK proofs for all NP [GMW91] Non–BB carries on to applications: –Semi-honest OT malicious OT [ GMW87] –OWF ID schemes [FFS88] Similarly, circuit of f used in secure computation of f. [Yao86,GMW87] –[Beaver96] Few OTs + OWF -> Many OTs Baraks Non-BB ZK and subsequent results. Use both old and new non-bb techniques.

10
What do Black-Box Separations Mean? This talk will concentrate on mathematical rather than philosophical meaning. Still … Few Non black-box techniques (and in limited settings). Inherent limitation on efficiency. Therefore, black-box separations are explanation/indication for the hardness of finding reduction (esp. efficient ones). BB-reductions more robust – work wrt. physical implementations of primitives.

11
What do Black-Box Separations Mean? Insight into the relevant primitives. Guidance for non black-box reductions or even for black-box reductions. (Sometimes most meaningful when looking inside the box.) Analogy from complexity: A Cook/Karp reduction of problem A to problem B is a black-box proof that B P A P. SAT P QBF 2 P true but inherently non-BB (QBF 2 is quantified Boolean formula with 2 alternations).

12
What do Black-Box Separations Mean? Insight into the relevant primitives. Guidance for non black-box reductions or even for black-box reductions. (Sometimes most meaningful when looking inside the box.) Examples from cryptography: TDP seems to be of different complexity than OWF. [IR89] supports. Collision resistant hashing might have seemed similar in nature to OWFs. [Simon98] challenged (this is consistent with recent cryptanalysis attacks against popular hash functions).

13
What do Black-Box Separations Mean? Insight into the relevant primitives. Guidance for non black-box reductions or even for black-box reductions. (Sometimes most meaningful when looking inside the box.) Guidance for black-box constructions? Particular construction cannot be proved in BB? May be easier to change the construction than overcome the obstacle. Examples: –Want to reduce Stat-Commit to OWF? Probably not a good approach: Stat-Commit -> OWP -> OWF. –[Myers 04], shows no BB proof for one particular natural construction (static to adaptive security).

14
What do Black-Box Separations Mean? Insight into the relevant primitives. Guidance for non black-box reductions or even for black-box reductions. (Sometimes most meaningful when looking inside the box.) Word of warning: Potentially, a non black-box proof may follow a black-box approach most of the way with a small non black-box fix.

15
Black-Box and Oracle Separations [IR89] there exists an oracle relative to which one-way function exists but key- agreement does not: No fully black-box reduction of key- agreement to one-way function. Many other BB separations/lower bounds [Rud91,Sim98,KST99,KSS00,GKM+00,GT00, GMR01,CHL02,...] –Various notions of BB reductions, in particular not always implying oracle separation (e.g. [ GMR01]).

16
Crypto After IR (Impagliazzos Worlds) Trapdoor Permutation Public Key Encryption Key Agreement Secure Multi-Party Computation (OT) Private Key Encryption One Way Functions Digital Sig. Pseudorandom Generators Algoritmica, Heuristica, Pessiland Not even an hierarchy of problems [GKMVR00]

17
This Talk [IR89]: The separation, its proof and interpretation of results. As many separations and proof intuitions. Focus on techniques and subtleties. Beware: some cheating involved

18
The Impagliazzo-Rudich Results Thm: If P=NP, Key Agreement ( KA ) is impossible in the Random Oracle model: KA (Alice,Bob) Eve, for random permutation f, Eve f breaks (Alice f,Bob f ) Cor 1: There is an oracle relative to which OWP exists and KA does not. The oracle: (f, PSPACE) since P PSPACE =NP PSPACE Cor 2: There is no fully-BB reduction from KA to OWP. Cor 3: …

19
[IR89] - Why f is OWP Intuitively obvious: when trying to invert f on some y= f (x), have no chance unless accidentally query f on x. With q queries chances for that < 2q/2 n More formally: M making q queries, n-bit y Pr f [M f (y) = f - 1 (y)] < (2q+2)/2 n Fix n, by Markov Pr f { Pr y [M f (y) = f - 1 (y)] > n 2 (2q+2)/2 n } < 1/n 2 M, with prob. 1 over f Pr y [M f (y) = f - 1 (y)] > n 2 (2q+2)/2 n only finitely often …. With prob. 1 over f, M …

20
Why f is OWP Against Circuits Too many circuit families for uniform argument (not enumerable). [GT00]: f is exponentially hard even against circuits. High level idea: Consider C that makes q queries and -inverts f. C gives some non-trivial information on f a compact description of f, relative to C. Loosely, the description of f contains two carefully chosen subsets X and Y and f | {0,1} n \X –f (X)=Y. –Y contains 1/q frac. of ys on which C inverts. –X and Y allow reconstruction of f |X. Setting parameters correctly: #descriptions << (2 n )! C only -invert exp. small fraction of the f s.

21
[IR89] – How Eve Finds the Secret Recall, we assume P=NP, and want to show that Eve f breaks (Alice f,Bob f ). P=NP implies that without f no cryptographic hardness. In particular, no KA ! In fact, for the purpose of oracle separation, we can essentially assume Eve, Alice and Bob are all powerful and only bounded by number of queries to f. In this setting, a clear characterization of knowledge: The queries made to f and its answers.

22
[IR89] – How Eve Finds the Secret Cont. If s is the key agreed by Alice and Bob, assume wlog that both parties query f on s. Therefore s is anintersection query. Enough that Eve finds all likely intersection queries. Eves algorithm (over simplified): Let T be the transcript of (Alice f,Bob f ), let L be a list of queries and answers to f (initially empty). Repeat polynomial number of times: –Simulate: sample a random view of Alice which is consistent with T and L. –Update: Repeat all the simulated queries Alice makes, but this time to real f. Insert to L. Output a random query from L.

23
[IR89] – How Eve Finds the Secret Cont. Eves algorithm (over simplified): Let T be the transcript of (Alice f,Bob f ), let L be a list of queries and answers to f (initially empty). Repeat polynomial number of times: –Simulate: sample a random view of Alice which is consistent with T and L. –Update: Repeat all the simulated queries Alice makes, but this time to real f. Insert to L. Output a random query from L. Intuition: Whenever simulated Alice is consistent with real Bobs view, simulated Alice has a fair chance to query s. Any inconsistency reveals one of Bobs queries. This can happen only polynomial number of times.

24
[IR89] Results – Revisited Thm: If P=NP, Key Agreement ( KA ) is impossible in the Random Oracle model. Cannot get a more natural and meaningful separation. How can a reduction overcome this separation? Traditional interpretation: to overcome the separation the construction of KA must use code of OWP. [RTV04] shows that there is no limitation in using OWP as a black box in construction of KA. Separation might be overcome using code of adversary in proof of security (as in [Bar01,Bar02]).

25
Taxonomy of Black-Box Reductions I (the case OWF ) KA ) [RTV04] Black-box implementation: eff. (Alice, Bob) s.t. OWF f (Alice f,Bob f ) is a secure KA. Proof of security: Eve breaking (Alice f,Bob f ) ) Adv inverting f Fully-BB reduction: eff. Adv Eve (even not eff) [ Eve breaks (Alice f,Bob f ) ) Adv f, Eve inverts f ] Semi-BB reduction: eff Eve eff. Adv [ Eve f breaks (Alice f,Bob f ) ) Adv f inverts f ] [IR89] No relativizing, thus also No Fully; If P=NP no Semi f (Alice, Bob)

26
Semi-BB vs. Relativizing Fully-BB reduction: eff. Adv Eve (even not eff) [ Eve breaks (Alice f,Bob f ) ) Adv f, Eve inverts f ] Semi-BB reduction: eff Eve eff. Adv [ Eve f breaks (Alice f,Bob f ) ) Adv f inverts f ] [IR89] No relativizing, thus also No Fully; If P=NP no Semi Semi: BB implementation with arbitrary pf of security? No - [RTV04] No relativizing ) No Semi Pf idea: can embed into f an arbitrary oracle, in particular can embed Eve. Embedding technique due to [Sim98]

27
Semi-BB vs. Relativizing Semi-BB reduction: eff Eve eff. Adv [ Eve f breaks (Alice f,Bob f ) ) Adv f inverts f ] [RTV04] No relativizing ) No Semi Pf sketch: –Let O be oracle s.t. 9 OWF g and no KA –Define –Every (Alice f,Bob f ) can be broken in PPT f, but f cannot be inverted in PPT f ) no semi-BB reduction

28
Taxonomy II – BB Implementation with Free Proof of Security Fully-BB reduction: eff. Adv Eve (even not eff) [ Eve breaks (Alice f,Bob f ) ) Adv f, Eve inverts f ] Semi-BB reduction: eff Eve eff. Adv [ Eve f breaks (Alice f,Bob f ) ) Adv f inverts f ] Mildly-BB reduction: eff Eve eff. Adv [ Eve breaks (Alice f,Bob f ) ) Adv f inverts f ] Now Eve is really efficient. Fully-BBRelativizingSemi-BBMildly-BB Free Fully-BBRelativizingSemi-BBMildly-BB Free

29
The Power of Mildly-BB Mildly-BB reduction: eff Eve eff. Adv [ Eve breaks (Alice f,Bob f ) ) Adv f inverts f ] Only Mildly-BB separations are about efficiency of reductions [GT00,GGK03]. Thm: 9 OWF ) 9 KA if and only if there is a mildly-BB reduction from KA to OWF. Conclusion: the restriction is in BB proof of security rather than in BB implementation. Fully-BB RelativizingSemi-BBMildly-BB Free

30
The Power of Mildly-BB Mildly-BB reduction: eff Eve eff. Adv [ Eve breaks (Alice f,Bob f ) ) Adv f inverts f ] Thm: 9 OWF ) 9 KA if and only if there is a mildly-BB reduction from KA to OWF. Pf sketch: Given OWF oracle f (against PPT f ), construct secure KA (against PPT). Case I: 9 KA –Construction ignores oracle, just executes secure KA Fully-BBRelativizingSemi-BBMildly-BB Free

31
The Power of Mildly-BB Mildly-BB reduction: eff Eve eff. Adv [ Eve breaks (Alice f,Bob f ) ) Adv f inverts f ] Thm: 9 OWF ) 9 KA if and only if there is a mildly-BB reduction from KA to OWF. Pf sketch: Given OWF oracle f (against PPT f ), construct secure KA (against PPT). Case II: No KA and therefore no OWF –Every function easy to compute is easy to invert. ) Oracle- OWF f must be hard to compute. –KA protocol: Alice sends random ( x, r ), agree on h f ( x ), r i Fully-BBRelativizingSemi-BBMildly-BB Free

32
OWF vs. OWP [IR,KSS00] Random Oracle separates OWF from OWP. A much simpler argument for weaker result: Thm. G f is a permutation for every function f For all f can invert G f (using a PSPACE-complete oracle). Adv algorithm on input y= G f (x): Let L be a list of queries and answers to f (initially empty). Repeat polynomial number of times: –Simulate: generate some f and x such that f is consistent with L and y= G f (x). –Update: Repeat all the simulated queries of G f (x) but this time to real f. Insert to L. Output last x. Correctness: If x x then the evaluations G f (x) and G f (x) must reveal a new inconsistency of f and f.

33
OWF vs. OWP Cont. Where is the weakness? To argue that G is insecure we assumed it is correct: G f is a permutation for every function f. Is this legitimate?

34
More on Relatevizing vs. BB Reductions In some scenarios (e.g. KA -> OWF), No relativizing reduction, No fully-BB reduction. Not always: Consider the construction of Trapdoor (poly-1) Functions from PKE. –[BHSV98] gives a construction in the random oracle model. Hard to come up with an oracle separation (as the oracle may potentially be used for BHSV-transformation). –[GMR01] solves it by showing for any particular construction an oracle that foils it (rather than giving one oracle that foils all constructions). [Myers04] takes it further, considers one specific (but very natural) construction and gives an oracle that foils it. Are we happy/unhappy with this?

35
[Rudich91]: Hard to Reduce Interaction [Rud 91] Separate k-message KA from (k-1)-message KA. For k=3 oracle O contains: f 1, f 2, f 3, length tripling random functions, R defined below, П - PSPACE complete. 3 KA : On an incorrect input R outputs a random string. Bob s Alice z,r z = R (s,m 3 ) m 1 =f 1 (z,r) m 2 =f 2 (s,m 1 ) m 3 =f 3 (z,r,m 2 ) z

36
[Rud91]: No 2-KA ( PKE) relative to O Without R no KA [IR89] Let (Alice,Bob) be two message protocol. Assume Alice makes a useful query R (s,m 3 ). –(s,m 3 ) is a correct input to R must have been created by 3 correct consecutive invocations either Alice or Bob must already know z,r,s. –If its Alice, R is not needed. –Otherwise, Eve can also know (s,m 3 ) and apply R. Bob s Alice z,r z = R (s,m 3 ) m 1 =f 1 (z,r) m 2 =f 2 (s,m 1 ) m 3 =f 3 (z,r,m 2 ) z

37
How do we define BB access to a protocol? In [Rudich91] and most subsequent works this means black-box access to the message and output functions of the parties. Can consider a more restricted notion where the access is to a third party implementing the functionality. (Closer in spirit to a physical implementation). May make arguments much simpler but need to be careful. For example OT in this model does not imply OWF. Other possible formalizations in between [HKNRR05]

38
OWF vs. Collision Resistant Hashing [Simon98] gives an oracle separating the two. Here Simon Light: In particular, consider only regular hash functions (every image has the same number of preimages). –Regular coll. resistant implied by claw-free permutations. Oracle: f - random functions, П - PSPACE complete, and Q on input circuit C defined as follows: If C g is regular for every function g then Q outputs uniformly selected x and x such that C f (x) = C f (x). Note: relative to this oracle may have collision- resistant hash functions (using Q itself). [Simon98] handles this case as well.

39
OWF vs. Collision Resistant Hashing Cont. Oracle: f - random functions, П - PSPACE complete, and Q on input circuit C defined as follows: If C g is regular for every function g then Q outputs uniformly selected x and x such that C f (x) = C f (x). Proof intuition: Assume want to find f - 1 (y). Due to universal regularity, the only information given by x and x are the values of f queried by the evaluations C f (x), and C f (x). As long as none of these queries is f - 1 (y) not much help. By regularity, x and x are each uniformly distributed (though they are correlated). By union bound, only negligible chance to encounter f - 1 (y).

40
Limitation On Efficiency This line considers the most efficient (black-box) construction (rather than the minimal assumption necessary) [KST99,GT00, GGK03]. Example: OWP PRG. Thm [GT00] PRG that expands the seed by k bits requires (k/s) invocations of the OWP (where s is the security parameter of the OWP). PRGseed m bits f output m+k bits

41
Limitation On Efficiency Cont. Thm [GT00] PRG that expands the seed by k bits requires (k/s) invocations of the OWP (where s is the security parameter of the OWP). Idea: Define f(w,z)=g(w),z, where w is O(s)-bit long and g is random Each invocation only gives O(s) bits of randomness Can simulate f using randomness from the seed. PRGseed m bits f output m+k bits

42
Concluding Remarks Many more beautiful arguments we did not touch! BB separations - a useful research tool. The extent to which the proof of security is black-box plays a major role. Definitions are subtle, need to make sure we understand the mathematical/philosophical meaning of what we prove.

43
Some Open Problems More Non black-box techniques. Can we Razborov-Rudich Impagliazzo- Rudich ? Power of reductions that use code of primitive but are BB wrt adversary?

44
[ GKMVR00 ] incomparability of PKE and OT OT PKE by an extension of [Rud91]. PKE OT by oracle containing: f 1, f 2, R, П, (similar to [Rud91]) to allow PKE. But with a small twist… Bob z,s Alice r z m 1 =f 1 (r) m 2 =f 2 (z,s,m 1 ) z = R (r,m 2 ) Important: define f 2 and R to output on incorrect inputs (sort of validity tests) Prevent this specific key agreement from being fakable, and turns out to be sufficient.

Similar presentations

© 2016 SlidePlayer.com Inc.

All rights reserved.

Ads by Google