Security of Systems Department of Computer Science Radboud

Identity based cryptographyThe case of encryption schemes

David Galindo

d.galindo@cs.ru.nl

Security of Systems

Department of Computer Science

Radboud Universiteit Nijmegen

Identity based cryptography – p. 1/25

Outline

Motivation

Outline

Motivation

DefinitionsIdentity Based Encryption (IBE)Secure IBEs

Outline

Motivation

DefinitionsIdentity Based Encryption (IBE)Secure IBEsBilinear maps and problems

Outline

Motivation

Schemes2001 Boneh&Franklin scheme (ROM)2004 Waters scheme (standard model)

Outline

Motivation

Schemes2001 Boneh&Franklin scheme (ROM)2004 Waters scheme (standard model)

Future research

Motivation: PKI

To use Public Key Cryptography we need to bind identitiesand keys.

Public Key Infrastructures

Motivation: PKI

A Certification Authority (CA) issues certificates:

U user’s identity

PK public key

D1 issue date

D2 expiration date

Motivation: PKI

U user’s identity

PK public key

D1 issue date

D2 expiration date

Certificate(U, PK)SigCA(U, PK,D1, D2)

Motivation: PKI

U user’s identity

PK public key

D1 issue date

D2 expiration date

Certificate(U, PK)SigCA(U, PK,D1, D2)

Certificate Revocation Problem

Motivation: PKI (ii)

Before performing the cryptographic operation involving thepublic key, we must validate Certificate(U, PK).

Easy for signature schemes. User U sends the certificatealong with its signature on a message m

(Certificate(U, PK), SigPK(m),m)

Difficult for encryption schemes. Before sending a messagem to user U, we should know if it is in possession of a validcertificate.

We would like to perform the public operationwithout extra communication.

Identity Based Encryption (IBE)

Main idea The public key is an identity ID ∈ {0, 1}∗

A Key Generation Center KGC issues private keys for ID

An IBE scheme consists of 4 algorithms:

Setup Takes a security parameter ℓ and outputs systemparamaters params and master-key.

Encrypt Takes as inputs params, ID ∈ {0, 1}∗ and message M

and outputs a ciphertext C.

ExtractPrivateKey Takes as inputs params, master-key andID ∈ {0, 1}∗ and outputs a private decryption key dID.

Decrypt Takes as inputs params, private key dID andmessage C and outputs a message M .

Certificate revocation problem can be “avoided” usingID = bob@company.com||year||month||day

Security notions for IBE schemes

IND-ID-CPA security for an IBE scheme E

Initialization The challenger runs setup , gives the adversaryA the description of E , params and keeps dID secret.

Phase 1 A issues adaptive queries of the type

Extraction query 〈IDi〉

Challenge A outputs two equal length M0,M1 and an IDch onwhich it wishes to be challenged. The challengerb← {0, 1} and sets C = Encrypt(params,IDch,Mb)

Phase 2 As in Phase 1, except submitting IDch.

Guess A outputs a bit b′ and wins if b′ = b.

IND-ID-CCA security for an IBE scheme E

Decryption query 〈IDi, Ci〉

Guess A outputs a bit b′ and wins if b′ = b.

Bilinear maps and bilinear groups

Let G, GT be prime order p abelian groups in which thediscrete logarithm is believed to be hard.

Let G, GT be prime order p abelian groups in which thediscrete logarithm is believed to be hard.By a bilinear map we will refer to a non-degenerate bilinearfunction t̂ : G×G→ GT .

Computational Diffie-Hellman problem on G GivenP, aP, bP ← G as input, compute abP ∈ G, wherea← Z

Decisional Diffie-Hellman problem on G Given P, aP, bP, cP ← G

as input, output yes if c = ab and no otherwise, wherea, b← Z

Decisional Diffie-Hellman problem on G Given P, aP, bP, cP ← G

as input, output yes if c = ab and no otherwise, wherea, b← Z

(P, aP, bP, cP ) is a DH tuple iff t̂(aP, bP ) = t̂(P, abP ).

BDH problems

Bilinear Diffie-Hellman (BDH) Problem on G. GivenP, aP, bP, cP ← G as input, compute W = t̂(P, P )abc ∈ GT .

BDH problems

Decision Bilinear Diffie-Hellman (DBDH) Problem on G. GivenP, aP, bP, cP ← G as input, and T ← GT ,; output yes ifT = t̂(P, P )abc and no otherwise.

Boneh-Franklin identity basedencryption scheme

Basic scheme

An IND-ID-CPA is defined first.BasicIdent

Basic scheme

Setup.

Choose P ← G, s← Z∗p and set Ppub = sP ∈ G

Basic scheme

Setup.

Choose H1 : {0, 1}∗ → G∗ and H2 : GT → {0, 1}n.

Basic scheme

Setup.

SetM = {0, 1}n and C = G∗ × {0, 1}n.

Basic scheme

Setup.

SetM = {0, 1}n and C = G∗ × {0, 1}n.

params = 〈p, G, GT , t̂, P, Ppub, H1, H2〉.

The master-key is s ∈ Z∗p.

Basic scheme

Extract.

Given ID ∈ {0, 1}∗, compute QID = H1(ID) ∈ G∗.

Set dID = sQID ∈ G∗.

Basic scheme

Extract.

Encrypt. To encrypt M ∈ {0, 1}n under the public key ID

Compute QID = H1(ID) ∈ G∗2.

Choose r ← Z∗p

Set C = 〈rP, M ⊕H2(grID

)〉 where gID = t̂(Ppub, QID) ∈ GT .

Basic scheme

Extract.

Choose r ← Z∗p

Decrypt.

C = 〈U, V 〉 ∈ C

Compute V ⊕H2(t̂(U, dID)) = M.

Basic scheme

Extract.

Choose r ← Z∗p

Decrypt.

C = 〈U, V 〉 ∈ C

Compute V ⊕H2(t̂(U, dID)) = M.

t̂(U, dID) = t̂(rP, sQID) = t̂(P, QID)sr = t̂(Ppub, QID)r = grID

Full scheme

FullIdent is obtained by applying Fujisaki-Okamotoconversion from Crypto’99 to BasicIdent

Full scheme

FO conversion If we denote by Epk(M, r) the encryption of M

using randomness r under public key pk

Full scheme

(M) = 〈Epk(σ,H3(σ,M)), H4(σ)⊕M〉

where σ ← {0, 1}n.

Full scheme

(M) = 〈Epk(σ,H3(σ,M)), H4(σ)⊕M〉

where σ ← {0, 1}n.

This adds n bits to the resulting ciphertext

Full scheme (ii)

Setup.

Choose H1 : {0, 1}∗ → G∗, H2 : GT → {0, 1}n,

H3 : {0, 1}n × {0, 1}n → Z∗p, H4 : {0, 1}n → {0, 1}n.

SetM = {0, 1}n and C = G∗ × {0, 1}n × {0, 1}n.

params = 〈p, G, GT , t̂, P, Ppub, H1, H2,H3, H4〉.

The master-key is s ∈ Z∗p.

Full scheme (iii)

Extract.

Just as before, dID = sH1(ID) ∈ G∗.

Full scheme (iii)

Extract.

Compute QID = H1(ID) ∈ G∗.

Choose σ ← {0, 1}n

Set C = 〈rP, σ ⊕H2(grID

, M ⊕H4(σ))〉 where

gID = t̂(Ppub, QID) ∈ GT , and r = H3(σ, M).

Full scheme (iii)

Extract.

Compute QID = H1(ID) ∈ G∗.

Choose σ ← {0, 1}n

Set C = 〈rP, σ ⊕H2(grID

, M ⊕H4(σ))〉 where

gID = t̂(Ppub, QID) ∈ GT , and r = H3(σ, M).

Decrypt.

C = 〈U, V, W 〉 ∈ C

Compute V ⊕H2(t̂(U, dID)) = M and W ⊕H4(σ) = M.

Set r = H3(σ, M). Check that U = rP. If not reject.Identity based cryptography – p. 17/25

Security result

Theorem Let A an IND-ID-CCA adversary running in time t andwith advantage ε against FullIdent making at most qE privatekey extraction queries, qD decryption queries and qH hashqueries. Then there is an algorithm B running in timeroughly t that has advantage at least ε

against BDH

problem in G.

Security result

Theorem Let A an IND-ID-CCA adversary running in time t andwith advantage ε against FullIdent making at most qE privatekey extraction queries, qD decryption queries and qH hashqueries. Then there is an algorithm B running in timeroughly t that has advantage at least ε

against BDH

problem in G.

Waters IBE scheme in the standardmodel

Waters scheme

Setup.

Choose s← Z∗p.

Choose P2 ← G, and set P1 = sP ∈ G∗.

Waters scheme

Setup.

Choose s← Z∗p.

Choose Q′ ← G∗ and a random n-length vector U = (Qi) with

Qi ← G∗.

Waters scheme

Setup.

Choose s← Z∗p.

Qi ← G∗.

SetM = GT , C = GT ×G∗ ×G

∗ and ID = {0, 1}n.

Waters scheme

Setup.

Choose s← Z∗p.

Qi ← G∗.

SetM = GT , C = GT ×G∗ ×G

∗ and ID = {0, 1}n.

params = 〈p, G, GT , t̂, P, P1, P2, Q′, U〉.

The master-key is sP2.

Waters scheme (ii)

Extract.

Let IDi denote the i-th bit of ID and V ⊂ {0, . . . , n} the set of i

st IDi = 1.

Choose r ← Z∗p.

(Q′∏

Waters scheme (ii)

Extract.

Let IDi denote the i-th bit of ID and V ⊂ {0, . . . , n} the set of i

st IDi = 1.

Choose r ← Z∗p.

(Q′∏

Encrypt. To encrypt M ∈ GT under the public key ID

Choose x← Z∗p.

Set C =

(t̂(P1, P2)

xM, xP,

(Q′∏

Waters scheme (iii)

Decryption. Let C = (C1, C2, C3) a valid encryption under ID.

Decrypt C using dID = (d1, d2) as C1

t̂(d2, C3)

t̂(d1, C2)

Waters scheme (iii)

t̂(d2, C3)

t̂(d1, C2)

Let dID =(sP2

(Q′∏

i∈V Qi

)r, rP

Waters scheme (iii)

t̂(d2, C3)

t̂(d1, C2)

Let dID =(sP2

(Q′∏

i∈V Qi

)r, rP

C =(t̂(P1, P2)

xM, xP,(Q′∏

i∈V Qi

)x), then

Waters scheme (iii)

t̂(d2, C3)

t̂(d1, C2)

Let dID =(sP2

(Q′∏

i∈V Qi

)r, rP

C =(t̂(P1, P2)

xM, xP,(Q′∏

i∈V Qi

)x), then

t̂(d2, C3)

t̂(d1, C2)= (t̂(P1, P2)

xM)t̂(rP,

(Q′∏

i∈V Qi

t̂(sP2

(Q′∏

i∈V Qi

)r, xP )

Waters scheme (iii)

t̂(d2, C3)

t̂(d1, C2)

Let dID =(sP2

(Q′∏

i∈V Qi

)r, rP

C =(t̂(P1, P2)

xM, xP,(Q′∏

i∈V Qi

)x), then

t̂(d2, C3)

t̂(d1, C2)= (t̂(P1, P2)

xM)t̂(rP,

(Q′∏

i∈V Qi

t̂(sP2

(Q′∏

i∈V Qi

)r, xP )

(t̂(P1, P2)xM)

t̂(P,(Q′∏

i∈V Qi

t̂(P1, P2)xt̂((Q′∏

i∈V Qi

)rx, P )

Security result

Theorem Let A an IND-ID-CPA adversary running in time t andwith advantage ε making at most qE private key extractionqueries and qD decryption queries. Then there is analgorithm B running in time roughlyt +O(qEnε−2 ln(ε−1) ln(qEn)) that has advantage at least

ε32nqE

against BDDH problem in G.

Security result

Theorem Let A an IND-ID-CPA adversary running in time t andwith advantage ε making at most qE private key extractionqueries and qD decryption queries. Then there is analgorithm B running in time roughlyt +O(qEnε−2 ln(ε−1) ln(qEn)) that has advantage at least

ε32nqE

against BDDH problem in G.

Decision Bilinear Diffie-Hellman (DBDH) Problem on G. GivenP, aP, bP, cP ← G as input, and T ← GT ,; output yes ifT = t̂(P, P )abc and no otherwise.

Some applications of IBE schemes

IBE schemes imply secure signature schemes

Access control

Delegation of decryption keys

Strong-key insulated encryption

Access control

and many more... take a look at Cryptology ePrintArchive http://eprint.iacr.org

Access control

and many more... take a look at Cryptology ePrintArchive http://eprint.iacr.org

It is fair to say that identity/pairing based cryptography iscurrently the most active research area in cryptology

Drawbacks & Open Problems

dID must be sent over a secure channel

The system is inherently escrowedCertificate Based encryption (Gentry)Certificate-Less PKC (Al-Riyami&Paterson)

(Mostly) Suitable for small environments

Security reductions are inefficient

Few schemes proven secure without the ROM

Drawbacks & Open Problems

dID must be sent over a secure channel

The system is inherently escrowedCertificate Based encryption (Gentry)Certificate-Less PKC (Al-Riyami&Paterson)

(Mostly) Suitable for small environments

Security reductions are inefficient

Few schemes proven secure without the ROM

The slides of this talk are available athttp://www.cs.ru.nl/∼dgalindo

Security of Systems Department of Computer Science Radboud

Documents

Transcript of Security of Systems Department of Computer Science Radboud

Cosmic Ray measurements with LORA - ASTRON · master computer at CS002 300m LOFAR LORA LOFAR Radboud Air Shower Array. LOFAR Radboud Air Shower Array Detectors are plastic scintillators

Software Security Static Analysis aka Source code … Security Static Analysis aka Source code analysis Erik Poll Digital Security group Radboud University Nijmegen

Mifare Classic Troubles Peter van Rossum Digital Security Radboud University Nijmegen.

1 An Overview of Computer Security computer security.

PDF hosted at the Radboud Repository of the Radboud ... › ... › 106973 › 106973.pdf · PDF hosted at the Radboud Repository of the Radboud University Nijmegen ... Center, GGZ

Computer Security Computer Security as a principle; Computer Security in UNIX for specific; Conclusion.

Computer & Network Security : Information security

PDF hosted at the Radboud Repository of the Radboud University … · Fitrianie et al. A Multimodal Human-Computer Interaction Framework for Research into Crisis Management Proceedings

Security analysis of the IRMA app using SPARTA and fuzzing · Bachelor thesis Computer Science Radboud University Security analysis of the IRMA app using SPARTA and fuzzing Author:

The Java Modeling Language JML Erik Poll Digital Security Radboud University Nijmegen.

Erik Poll Digital Security Radboud University, Nijmegen ...

Twentieth Annual Computer Security Computer … · ADVANCE PROGRAM 20th Annual Computer Security Applications Conference Presented by Applied Computer Security Associates Twentieth

1 Smartcards & RFID Erik Poll Digital Security Radboud University Nijmegen.

Computer security 101 computer security 101 Eric Pancer Computer Security Response Team

DEFINITION OF COMPUTER SECURITY - smkstict cd blog · 40 COMPUTER SECURITY LESSON 16 COMPUTER SECURITY DEFINITION OF COMPUTER SECURITY Computer security means protecting our computer

Economics of network security - Radboud Universiteit

COMPUTER SECURITY NATIONAL COMPUTER SECURITY CENTER · atda 234 7 21 csc-zepl-83/006 computer security ,.enter national computer security center final evaluation report of computer

Lab Computer T3610 Test results - Radboud Universiteit

Computer Security 1 Keeping your computer safe. Computer Security 1 Computer Security 1 includes two lessons: Lesson 1: An overview of computer security.

Computer Crime - Computer Security Techniques