Embed Size (px)
DESCRIPTION
Proxy cryptography Anca-Andreea Ivan , Yevgeniy Dodis
Citation preview
PDSGNYU
1
Proxy Cryptography Revisited
Anca-Andreea Ivan , Yevgeniy DodisNew York University
NDSS 2003
PDSGNYU
2
Outline of the talk
Introduction – What and Why? Related work Unidirectional (UPF ) vs. Bidirectional (BPF) Encryption UPF Encryption BPF Signature UPF & BPF Conclusions
PDSGNYU
3
Introduction
Problem: Allow Bob to decrypt ciphertext or sign messages on behalf
of Alice, without knowing the secret key of Alice. Solution:
Third party (Escrow) helps Bob Proxy functions
Our goal: Formalize and clarify the notion proxy functions Construct simple schemes satisfying the formal definitions
PDSGNYU
4
Scenario: Key Escrow
User
FBII have a warrant to monitor email
for one week.
Escrow (ISP)
PDSGNYU
5
Scenario: Key Escrow
User
FBII have a warrant to monitor email
for one week.
Escrow (ISP)
PDSGNYU
6
Related work
Atomic proxy functions [BlSt98] Mobile agents proxy signatures [KBKL01,LKK01]
Proxy signature is different from original signature Two-party signatures [BeSa02,MR01a,MR01b,NKDM03]
Interactive protocols Two-party encryption [Mac03]
Interactive protocols Threshold cryptography [Des89,…]
PDSGNYU
7
Blaze/Strauss scheme – closer look
[BlSt98] Informal definition for
encryption/signature proxy functions
Try to modify existing cryptographic primitives to satisfy the definitions
Result: Weak security guarantees Semi-formal implementations El-Gamal encryption Modified Fiat-Shamir
signatures
[IvDo03] Starting with the problem at hand,
create formal model and definitions
Design simple, possibly new schemes that satisfy the definitions
Result: Strong, formal security
guarantees Encryption and signatures (…) Unidirectional and
bidirectional
PDSGNYU
8
Unidirectional proxy function (UPF)
BobAlice
Key distribution
Escrow
PDSGNYU
9
Bidirectional proxy function (BPF)
BobAlice
Key distribution
Escrow
PDSGNYU
10
Definition of UPF Encryption
BobAlice
Key distribution
Escrow
UEnc
UDec
c=UEnc(m)c’=p(c) m=f(c’)
PDSGNYU
11
Encryption UPF - Security
Classic CCA: “The only way to decrypt c = Enc(m) of an unknown message m, is to ask the decryptor to decrypt c.”
Unidirectional proxy functions CCA: CCA secure against Bob when helped by Escrow: “The only
way for Bob to decrypt c = Enc(m) of an unknown message m is by asking Escrow to transform c with p(c).”
CCA secure against Escrow when helped by Bob: “The only way for Escrow to decrypt c = Enc(m) of an unknown message m is to ask Bob to decrypt c’ = f(c) .”
Similarly, we can define CPA and OW security.
PDSGNYU
12
Generic Encryption UPF
DK2DK1
E2 E1
D2 D1c’=D1(c)
c=E1(E2(m))
Key distribution
BobAlice Escrow
DK1,DK2
EK1,EK2
DK1,DK2
m=D2(c’)
DK2DK1
PDSGNYU
13
BobAlice Escrow
Key distribution
Specialized UPF Encryption El-Gamal (CPA), RSA (OW), BF-IBE (IB-CPA)
DK=d=d1*d2
d2d1
d2d1
c=me mod n
cc’=cd1 mod n m=c’d2 mod n
m=cd mod n
d=d1 * d2
EK=e
PDSGNYU
14
Definition of BPF Encryption
BobAlice
Key distribution
Escrow
c=BEnc(m)
m=BDec(c) c c’=(c) m=BDec(c’)
PDSGNYU
15
Encryption BPF - Security
BPF Alice Bob = UPF Alice Bob + UPF Bob Alice Bidirectional proxy functions CCA:
CCA secure against Alice when helped by Escrow CCA secure against Escrow when helped by Alice CCA secure against Bob when helped by Escrow CCA secure against Escrow when helped by Bob
Similarly, we can define CPA and OW security.
PDSGNYU
16
Generic Encryption BPF
DK2,DK3
DK2,DK3
BobAlice Escrow
Key distribution
DK1,DK2DK3,DK1
E1 E2
D2D1 D2 E3 D3 D1
E3 E1
DK1,DK2 DK3,DK1
EK1,EK2,EK3
PDSGNYU
17
Specialized Encryption BPFEl-Gamal (CPA)
BobAlice
Key distribution
Escrowx2-x1
DK1=x1DK2=x2x2-x1
c=(gr,mgrx1)
m=c/grx1
c c’=(gr,mgrx1gr(x2-x1))c’ m=c’/grx2
x1 x2
EK1=gx1,EK2=gx2
PDSGNYU
18
Signatures
Signatures schemes are similar to encryption schemes.
Signatures UPF S’ = ( UniGen , UniSig , UniVer , PSig , FSig ) Generic UPF (UF-CMA) Specialized UPF – RSA-Hash
Signatures BPF S’ = ( BiGen , BiSig , BiVer , ) Generic Signatures BPF
PDSGNYU
19
Conclusions Start from the problem formulated in [BlSt98] Created formal model and security definitions Designed simple schemes
Encryption & Signatures; UPF/BPF; Generic and Specialized Future work:
Generic schemes have a factor of two slowdown compared to classic schemes.
Specialized schemes eliminate the slowdown, but could not create specialized schemes for all classic schemes (e.g. Cramer-Shoup).
Better scalability to multi-user setting. Natural asymmetric proxy functions.
PDSGNYU
21
Scenario 1: I am going away
for one week. Please cooperate.
Vice-president 2Vice-president 1
President
PDSGNYU
22
Unidirectional vs. Bidirectional Scenario 1: Can the vice-presidents have “meaningful” keys? Scenario 2: Can the FBI have a “meaningful” key? A “meaningful” key is a key that can be used by itself for
signature/encryption. Unidirectional:
“Meaningful” KU KF , KP s.t. both KF and KP have no meaning on their own. FBI and Proxy should not be able to attack the User without cooperation.
Bidirectional: “Meaningful” KU , KF KP s.t. only KP has no “meaning” FBI and Proxy should not be able to attack the User without cooperation. User and Proxy should not be able to attack the FBI without cooperation.
PDSGNYU
23
Encryption proxy functions
Bidirectional Unidirectional
c1=EncU(m1) U(DKU): m1=DecU(c1)
c2=EncF(m2)
m2=DecU(c’2)
P(KP): c’1= P (c1)
m2=DecF(c2)
c1=EncU(m1) U(DKU): m1=DecU(c1)
P(K’P): c’1= f(c1) F(K’F): m1=g(c’1)
c2=EncF(m2) F(DKF): m2=DecF(c2)
P(K”P): c2’= f(c2) U(K”U): m2=g(c’2)
P(KP): c’2= P (c2)
F(DKF): m1=DecF(c’1)
PDSGNYU
24
Signature proxy functions
Bidirectional Unidirectional
T=VerU(s1) U(SKU): s1=SigU(m1)s’2=SigU(m2)
s2=SigF(m2) T=VerF(s2)
T=VerU(s1) U(SKU): s1=SigU(m1)
P(K’P): s1= f(s’1) F(K’F): s’1=g(m1)
T=VerF(s2) F(DKF): s2=SigF(m2)
P(K”P): s2= f(s’2) U(K”U): s’2=g(m2)
F(SKF): s’1=SigF(m1)
P(KP): s1= P (s’1)P(KP): s2= P (s’2)
PDSGNYU
25
Specialized Encryption UPFEl-Gamal (CPA), RSA (OW), BF-IBE (IB-CPA)
RSA: E = ( Gen, Enc(m) = me mod n, Dec(c) = cd mod n ) Idea: split the secret key into two shares. ( EKU , DKU ) Gen EKU = e ; DKU = d = d1 * d2 ; KP = d1 KF = d2
UEnc( m ) = Enc(m ) = me mod n UDec( c ) = Dec( c ) = ce mod n f( c ) = cd2 mod n = c’ ; p( c’ ) = cd1 mod n f( p( Enc( m ) ) ) = m RSA-UPF is unidirectionally OW secure.
Open problem: design scheme for Cramer-Shoup (CCA)
DKU=d1 * d2
KP=d1 KF =d2
PDSGNYU
26
Generic Encryption BPF Idea: P “re-encrypts” c = Enc(m) with a key shared by
U and F.
E = ( Gen , Enc , Dec ) BiGen: ( EK1,DK1, EK2,DK2, EK3,DK3) Gen ; DKU = ( DK1,DK2 ) ; DKF = ( DK2,DK3 ) ; KP = ( DK1,DK3 ) BiEnc(m) = Enc1( Enc2( m ) ) = c BiDec(c) = Dec2( Dec1 ( c ) ) = m ( c ) = Enc3( Dec1(c ) ) = c’
E’ is bidirectionally CCA2 secure if E is CCA2 secure.
DK1,DK2
DK3,DK2DK1,DK3
PDSGNYU
27
Specialized Encryption BPF El-Gamal (CPA):
E = ( Gen, Enc(m) = ( gr , grx m ), Dec(c)= grxm/(gr)x )
( EKU = gx1, DKU = x1 ) Gen ; ( EKF = gx2 ,DKF = x2 ) Gen ;
KP = DKF – DKU = x2-x1
BiEncU( m ) = EncU(m ) = ( gr , grx1 m )
BiDecU( c ) = DecU( c ) = grx1m/(gr)x1
P( BiEncU( m ) ) = ( gr , grx1 m gr(x2-x1) ) = (gr , grx2m)
BiDecF( P( BiEncU( m ) ) ) = m
El-Gamal-BPF is bidirectionally CPA secure.
Note: RSA cannot be made bidirectional (because of factorization). In the case of El-Gamal, it is safe to publish the public keys.
