Adaptively Secure Broadcast, Revisited Juan A. Garay (AT&T), Jonathan Katz (UMD), Ranjit Kumaresan (UMD), Hong-Sheng Zhou (UMD) The title of my talk is ‘…’ I’m …, and this is joint work with ….

Talk Outline Preliminaries The Hirt-Zikas result [HZ10] Here: Broadcast Simulation-based security The Hirt-Zikas result [HZ10] Adaptive attacks on broadcast protocols Impossibility of adaptively secure broadcast! Here: (Re)examining their communication model Is adaptively secure broadcast possible? We first start by introducing broadcast and notions of security under which bcast protocols are analyzed - broadcast was historically studied in the static setting, using property-based definitions - surprisingly, [HZ10] showed that existing protocols are insecure against adaptive attacks - in fact, they prove impossibility of adaptively secure broadcast - Is this true? If so, what does that say about the feasibility of adaptively secure MPC? - looking more closely at their model, we observe that it is a worst-case model where adaptive corruptions can happen in the middle of a round... (explain their model, explain why this is different from the usual "atomic" model, and why the atomic model seems more realistic). - so is adaptively secure broadcast possible in the atomic model? - We show that it is...(describe the protocol) - As described, the protocol uses UC commitments. But this will require additional setup like a CRS, as well as strong crypto assumptions. Is that necessary? Note that a CRS is not needed in the static case, and OWF suffice there. - In fact, a weaker variant of commitment suffices for us...

Broadcast [PSL80,LSP82] Message m If the sender is honest, then all Bcast fundamental cryptographic network primitive Very closely related to byzantine agreement. Correctness on the left Agreement on the right m2 m3 m2 m3 If the sender is honest, then all parties output the sender’s message All honest parties always output the same message

Modeling the Problem Adversary model Communication model Centralized byzantine adversary Corrupts at most t out of n parties Static or adaptive adversary Static: parties corrupted before execution begins Adaptive: parties corrupted during protocol execution Communication model Point-to-point, secure and authenticated channels Synchronous network The bcast problem has been typically studied in a byzantine adversarial setting, where the centralized adv can corrupt at most some threshold param t out of n parties. The corruption could be either static or adaptive (how to talk about erasure?) The typical communication model assumes parties connected pairwise by … in an underlying synchronous network (more details on the network model soon…)

Prior Work Unconditional security iff t < n/3 [PSL80, LSP82, …] Computational security for t < n [PSL80, DS83, …] Assuming a public-key infrastructure (PKI) and digital signatures Most prior work focus on “property-based” notions of security There’s been a long line of work in broadcast. It is now well-known that we can get broadcast with unconditional security …., If we want a higher fault-tolerance, then we can still obtain broadcast provided an initial setup phase. Typically in a computational model, it is known how to obtain bcast for arbit number of corruptions. Point out that most prior work focuses on ‘’prop….

Simulation-Based Security Awkward or difficult to define adaptive security using property-based definitions “If the sender is honest, then…” – but what if the sender starts honest and is later corrupted? Cleaner definitions using the simulation paradigm (Side benefits: secure composition; security under concurrent executions) In this work, we are concerned with an alternate security model called simulation-based security. Number of benefits when working in this model. For e.g., Furthermore, Other side benefits include -secure composition (so important for broadcast since higher protocols typically designed assuming “broadcast channel”

The Simulation Paradigm [GMW87] A short pictorial representation for the simulation paradigm On the left is real execution Parties interact with themselves Real world as happening in the network On the right is … (this is the most secure model that one can imagine) Parties interact only with trusted party - e.g., the trusted third party might be realizing broadcast/ it might running an auction protocol No network, no interaction amongst themselves Intuitively the most secure model that can be imagined Ideal-world with a trusted third party carrying out task Real-world cryptographic protocol

The Simulation Paradigm (cont’d) ≈ For every adversary who is active on the left, we have an ideal world adversary on the right - Impossible to say which is the left execution and which is the right The views of the parties are indistinguishable REAL IDEAL

Universally Composable Security [Can01] Environment ≈ Concurrent Composition There is a stronger extension of the simulation paradigm - study security of concurrent executions of protocols - Multiple protocols running on the left, multiple protocols running on the right (here we have shown only one execution) - concurrent security + composable security. -- Composability is important because broadcast protocols are typically used as a subroutine in other larger protocols REAL IDEAL

The Broadcast Functionality Functionality FBC : FBC receives m from the sender; D FBC sends m to all recipients. For broadcast, how to define the trusted third party in the simulation paradigm? Simple intuitive 2 step definition Adaptive security in this model? -corruption of sender for e.g., could happen after TTP receives

Adaptively Secure Broadcast? Hirt-Zikas ’10: Adaptive attacks on all existing broadcast protocols All existing broadcast protocols are not adaptively secure Recently [HZ] show adaptive attacks on all existing protocols. Surprising Missed by property based definitions Real attacks on broadcast protocols Not just something that arises due to definitional issues

An Adaptive Attack Later… 1st round Message v Message v’ v’ v’ v' v’ Short animated look at the [HZ] adaptive attack First round message of sender received by the adv Depending on received m, adv decides to corrupt sender - subsequently behave as honest sender for the remainder of the protocol v' v’ 1st round Later…

Adaptively Secure Broadcast? Hirt-Zikas ’10: Adaptive attacks on all existing broadcast protocols Adaptively secure broadcast is impossible for t > n/2 The attack shown previously worked on all existing protocols In fact, using the simplest idea behind the attack, they even give an impossibility result when t > n/2 Raises a lot of questions: - No adaptively secure broadcast channel !! - What about secure computation protocols ?? 13

Communication Model: A Closer Look More justification animation Clarify that multi-send does not solve the problem of broadcast slide 17: this slide is the key to the whole talk, in some sense. I'm not sure it is entirely clear. Bullet 1a sounds like the standard rushing model (which we also assume). Bullet 1b is unclear: the corruption is *only* interesting when it's a sender (so I wouldn't write "incl. sender"). The impossibility result relies on the ability to corrupt in the middle of a round, and to change a message that was sent and not yet received. You could probably illustrate this with an animation. For our network model, we don't require that all parties get their messages at the same time. We just need to view sending messages in a round as "atomic": i.e., the honest sender puts n-1 messages (one to each party) on the respective channels, and the adversary cannot receive a message, then corrupt the sender, and then change a message he already sent. [HZ10] model “Atomic delivery model” Adversary can corrupt sender & change its messages in the same round. Crucial for their impossibility result Sender’s messages cannot be changed once sent [Can00,LLR02,…] No corruption “in the middle of a round”

Is Adaptive Security Possible? Is adaptively secure broadcast possible for t > n/2 if we assume “atomic” message delivery? Note: [HZ10] attacks work on known protocols even in this model Yes! Adaptively secure broadcast is possible for t < n [HZ] work in the left model. We want to work in the right model. Now that we are in the right model with atomic msg delivery, can we get adap.sec.bcast? Short answer given by us is yes. Indeed it is possible to get adap.sec.bcast for arbit # corruptions -however, variants of the [HZ10] adaptive attack still work. --sender corrupted in 2nd round, and behaves honestly with a diff mesg starting from round 2 --sender detected as corrupt, and typically correctness is not guaranteed for such senders

Relaxed Broadcast Functionality FRBC [HZ10] FRBC receives m from the sender; D FRBC sends m to the adversary D The adversary decides whether to corrupt the sender; if it does, the adversary may change m to any desired value D FRBC sends m to all recipients Imp subroutine in our protocol: relaxed broadcast functionality -same as fbc (1st and 4th) with the 2 highlighted modifications -adv learns m and gets a chance to corrupt sender and change value Exactly captures the effect of the HZ attack. -who also prove that existing protocols… Existing protocols (e.g., [DS83]) give adaptively secure relaxed broadcast for t < n

Commitments Hiding: m hidden from Bob Alice (message m) Bob m m Another gadget that we use in our constructions is secure commitments. -fundamental 2 or multi party primitive in secure computation -2 phase --commit --open -hiding -binding Hiding: m hidden from Bob Binding: Alice can open commitment only to m

Our Broadcast Protocol 1. Sender sends commitment to m using FRBC 2. Sender sends the decommitment to each receiver via point-to-point channels 3. Each receiver broadcasts the decommitment they received using FRBC 4. All players agree on the first valid decommitment, and output the corresponding message m Based on the two gadgets, ready to show protocol 4 stages – explain out Key: one honest party receives honest decom from honest sender Step 4: every honest party receives this honest decom

Avoiding Adaptive Attacks 1. Sender sends commitment to m using FRBC 2. Sender sends the decommitment to each receiver via point-to-point channels 3. Each receiver broadcasts the decommitment they received using FRBC 4. All players agree on the first valid decommitment, and output the corresponding message m Adversary learns nothing about m All honest parties receive the decommitment Reiterate key point: one honest player gets honest sender’s decom -(when the dealer starts out honest) the dealer's message is committed after stage 2 (even if the adversary corrupts the dealer at that point). -Then you can mention that this raises a problem: the dealer is not committed after stage 1 (since the adversary can corrupt the dealer and then send no valid decommitments). Even though this is not a fundamental problem -- since the adversary has to make its decision of whether to corrupt the dealer without knowing the dealer's message -- it is a problem for the simulator who has to give the commitment before knowing the dealer's message. Even if the sender is corrupted, the committed value cannot be changed

Simulation Simulator sends dummy commitments 1. Sender sends commitment to m using FRBC 2. Simulator gets m from FBC and generates a decommitment to m; it then sends this to all parties via point-to-point channels 3. Each receiver broadcasts decommitment viaFRBC 4. All players agree on a valid decommitment, and output the corresponding message m Simulator sends dummy commitments UC commitments allow simulator to open com to any m In the simulation, once the first stage is completed the simulator will have to send commitments on messages that he doesn’t know Still the simulation can be completed using UC coms which allow sim to open the broadcasted com to any message

Setup Assumptions? As written, we use UC commitments UC commitment require additional setup assumptions + stronger cryptographic assumptions that we would like to avoid! In fact, honest-binding commitments suffice Binding once the sender acts honestly during the commit phase Can be realized with no additional setup, based on OWF Example based on Pedersen’s commitment: -showed a protocol with UC com, which require --additional setup --stronger crypto assumptions Traditional bcast protocols require no further setup! -motivated to look for solutions which require no additional setup Propose a variant of std com called honest binding -can be realized with no additional setup -as name suggests, binding for a sender that is honest in the com phase --sufficient to avoid adaptive attacks (just semihonest com is not good enough for this!) --note: no binding for dishonest sender, but that’s ok ---honest-binding com can be used by dishonest sender ----two different decom later bcasted ---- but everyone knows com has 2 decoms and they choose the first one Honest sender Input m Choose h,x com = (h, gmhx) Simulator (No input) Choose r,y com = (gr, gy) Equivocation On input m Set x = (y-m)/r Output (gr,x)

Our Result (Summarized) Assuming a PKI and digital signatures, there exists a (universally composable) broadcast protocol secure against adaptive corruption of any t < n parties Main result -no setup -arbit corruptions -adap sec

Applications to Secure Computation Protocols for secure computation typically designed/analyzed assuming a broadcast channel Plug in a protocol that realizes FBC  security when run over a point-to- point network Can we use a protocol realizing FRBC instead? Better efficiency…? Secure computation in [HZ10] network model? We observe that FRBC suffices for most specific constructions Messages broadcast are always commitments to some value -Composition – typically designed or analyzed assuming channel --replace fbc by a protocol, and get composition security -we also have frbc which is --more efficient --necessary for secure computation in [HZ10], where adap bcast is impossible --in fact, frbc is sufficient for certain constructions ---bcast mesg are coms ---in both [HZ] as well as our atomic model

Summary Adaptively secure broadcast for t < n Our result: Assuming the ‘standard’ synchronous communication model Our result: Matches the threshold for statically secure broadcast Requires no additional setup or assumptions Can be safely used within arbitrary other protocols Investigate the asb problem in std. sync n/w And we showed a asb protocol that -gets the best threshold, i.e., secure against arbit corruption -no additional setup -safe for composition

Thank You