DOCSLIB.ORG

New Notions of Secrecy and User Generated Randomness in Cryptography

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
New Notions of Secrecy and User Generated Randomness in Cryptography University of Calgary PRISM: University of Calgary's Digital Repository Graduate Studies The Vault: Electronic Theses and Dissertations 2014-09-30 New Notions of Secrecy and User Generated Randomness in Cryptography Alimomeni, Mohsen Alimomeni, M. (2014). New Notions of Secrecy and User Generated Randomness in Cryptography (Unpublished doctoral thesis). University of Calgary, Calgary, AB. doi:10.11575/PRISM/27097 http://hdl.handle.net/11023/1874 doctoral thesis University of Calgary graduate students retain copyright ownership and moral rights for their thesis. You may use this material in any way that is permitted by the Copyright Act or through licensing that has been assigned to the document. For uses that are not allowable under copyright legislation or licensing, you are required to seek permission. Downloaded from PRISM: https://prism.ucalgary.ca UNIVERSITY OF CALGARY New Notions of Secrecy and User Generated Randomness in Cryptography by Mohsen Alimomeni A THESIS SUBMITTED TO THE FACULTY OF GRADUATE STUDIES IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF DOCTOR OF PHILOSOPHY DEPARTMENT OF COMPUTER SCIENCE CALGARY, ALBERTA SEPTEMBER, 2014 c Mohsen Alimomeni 2014 Abstract Randomness plays a central role in computer science, in particular cryptography. Almost all cryptographic primitives depend crucially on randomness because randomness and unpre- dictability in secret keys provides the means for security. Usually one assumes that perfect randomness, a sequence of independently and uniformly distributed bits, are accessible to algorithms. This is a strong assumption. Physical sources of randomness are neither uniformly random, nor produce necessarily independent bits. Therefore, the aim of this thesis is to start from a realistic model of randomness, investigate notions of secrecy and their randomness requirements and finally find practical methods for generation of randomness that matches the requirements of cryptographic primitives. We consider a model of random source where the source output follows one distribution from a set of possible distributions, each with the property that the maximum probability of symbols is bounded and can not be arbitrarily close to 1. This model does not assume independence or uniformity of the output symbols, and is considered to be a realistic model of randomness. From this point, the thesis can be divided into two main parts: In the first part, considering various notions of information theoretic secrecy, a fundamental problem is to find the properties of randomness needed to achieve security in these notions. Traditional cryptographic protocols simply assume perfect randomness and build on this assumption. We explore the results that show secrecy can not be based on imperfect random- ness that is not uniform or independent. Thus a line of work attempts to relax notions of secrecy in such a way that they can be constructed with non-perfect sources, and possibly require smaller key sizes. Yet they should match real life applications. An important work in this context is entropic security where the key size could be smaller than the message depending on message distribution. Inspired by this, we propose two relaxed notions of secrecy that are motivated by practical applications. In the first notion, motivated by an i application in biometrics authentication, we propose guessing secrecy where the probability of guessing the message for a computational unbounded adversary with the best strategy remains the same when a ciphertext is given or when it is not. We compare the randomness requirements of guessing secrecy with stronger notions and show that in some cases such as key length, the requirements are the same. For key distribution however, we found a family of distributions that provide guessing secrecy but not perfect secrecy. In the second notion, we investigate randomness requirements of multiple message encryption. Considering a natural extension of secrecy definition to multiple messages, we show that independent keys are needed to encrypt each message. We then propose a relaxed notion in which the security of last message is more important than past messages, although the leakage of past messages is bounded using entropic security. By this assumption, we achieve smaller key length compared to -indistinguishability, and comparable to key length for entropic security. This notion has applications such as location privacy. In the second part of the thesis, since secrecy crucially depends on perfect randomness, we investigate how perfect randomness can be practically generated, specifically from human game-play. Unlike many random number generators that assume independent or uniform random bits in the random source, we base our work on the realistic model of randomness. Our main observation is that human game-play has an element of randomness coming from the errors in their game-play which is the main entertaining factor of the game. We also observed that this game-play can distinguish among a group of people if the right features are collected from the game-play. We incrementally changed our game design until the distinguishability among a small population is maximized, and then run the experiments required to show the viability of this approach over a larger population. This approach can also provide a hard to delegate authentication property where a human could not emulate the behavior of another human even given statistical information about their game-play. Acknowledgments My research and this thesis would not have been possible without the help and support of kind people around me; my supervisor, committee members, friends, family and my wife. First and foremost I wish to express my deepest appreciation to my supervisor, Reihaneh Safavi-Naini, for her continuous support during my PhD study and research. Your patience in reading the drafts of my work over and over helped me learn a lot from your comments and views on topics discussed in this thesis. The joy and enthusiasm you have for research was contagious and motivational for me. My sincere thanks goes to my supervisor committee, Philipp Woelfel and Payman Mohassel who helped me during different stages of my research in UofC. I would like to thank my examiners Keith Martin and Christoph Simon for the comments and suggestions that improved this work. I gratefully acknowledge the funding sources that made my Ph.D. work possible. The funding was provided as scholarship, teaching and research assistantships I received from department of computer science in UofC and Alberta Innovates Technology Future (AITF) . I would like to thank many friends that made our life happier during our stay in Calgary. Specifically I appreciate Johnson family for their kind hospitality. I enjoyed my time in Calgary with my close friends and their family for the gatherings and trips we had together. Thank you all my nice friends. I would also like to thank my parents, brothers and sister. They were always supporting me and encouraging me with their best wishes. Nobody could have stood by me through the good and bad times of more than 4 years of my study better than my wife. In occasions when I was very busy with paper deadlines, she tolerated a monotonous life, yet cheered me up to motivate me work better. I am indebted to you Narges Mashayekhi. iii Table of Contents Abstract .........................................i Acknowledgments ................................... iii Table of Contents . iv List of Tables . viii List of Figures . ix List of Symbols . .x 1 Introduction . .1 1.1 Formal model of randomness . .2 1.2 Randomness for secrecy . .3 1.2.1 Guessing secrecy . .6 1.2.2 Correlated keys for multiple messages . .7 1.3 Generating random numbers, and applications . .8 1.3.1 TRG from human game-play: Using video games . .9 1.3.2 TRG from human game-play: Game theoretic approach . .9 1.3.3 User generated randomness for authentication . .9 1.4 Other contributions . 10 1.4.1 Review, partial results, and comparison of secrecy primitives . 10 1.4.2 Location based storage . 10 1.5 Subsequent works . 11 1.6 Thesis structure . 11 1.6.1 Theorems and proofs . 12 2 Preliminaries and Basics . 13 2.1 Probability theory . 13 2.2 Information theoretic measures . 14 2.3 Information theoretic security . 20 2.3.1 Computational versus information theoretic model . 21 2.4 Secrecy . 22 2.4.1 Secret sharing . 26 2.5 Concluding remarks . 28 3 Randomness requirement of secrecy . 29 3.1 Modeling random sources . 29 3.2 Dealing with weak random sources in cryptography . 32 3.2.1 Local versus public versus shared randomness . 34 3.3 Paradigm 1: Randomness extraction . 34 3.3.1 Deterministic extractors . 35 3.3.2 Seeded Extractors . 36 3.4 Paradigm 2: Constructions using imperfect randomness . 38 3.4.1 Randomness requirements for perfect secrecy . 39 3.4.2 Relaxation of perfect secrecy . 41 3.4.3 Comparison of perfect secrecy relaxations . 42 3.4.4 Randomness requirements of indistinguishability . 43 3.4.5 Secrecy with weak random sources . 45 iv 3.4.6 t-source admit randomized encryption . 48 3.4.7 One-time pad is universal for deterministic encryption . 49 3.5 Randomness requirement for secret sharing . 52 3.6 Authentication sources . 58 3.6.1 Authentication with t-sources . 60 3.7 Comparison of random sources . 61 3.8 Concluding remarks . 62 4 Guessing secrecy . 64 4.1 Introduction . 64 4.1.1 Motivation . 65 4.1.2 Related work . 66 4.1.3 Our contribution . 67 4.2 Secrecy based on guessing probability . 68 4.3 Requirements on the key size . 70 4.4 Requirements on the key distribution . 75 4.4.1 Guessing secrecy with imperfect randomness . 78 4.4.2 Relation with perfect secrecy . 80 4.5 Applications . 81 4.6 Bounds on conditional min-entropy . 82 4.7 Concluding remarks . 85 5 Information Theoretic Security of Sequential High Entropy Messages . 86 5.1 Introduction . 86 5.1.1 Our contribution .
Load more

Recommended publications
  • True Random Number Generators Secure in a Changing Environment
    True Random Number Generators Secure in a Changing Environment Boaz Barak, Ronen Shaltiel, and Eran Tromer Department of Computer Science and Applied Mathematics Weizmann Institute of Science , Rehovot, ISRAEL Email: {boaz,ronens,tromer}@wisdom.weizmann.ac.il Abstract. A true random number generator (TRNG) usually consists of two components: an “unpredictable” source with high entropy, and a randomness extractor — a function which, when applied to the source, produces a result that is statistically close to the uniform distribution. When the output of a TRNG is used for cryptographic needs, it is pru- dent to assume that an adversary may have some (limited) influence on the distribution of the high-entropy source. In this work: 1. We define a mathematical model for the adversary’s influence on the source. 2. We show a simple and efficient randomness extractor and prove that it works for all sources of sufficiently high-entropy, even if individual bits in the source are correlated. 3. Security is guaranteed even if an adversary has (bounded) influence on the source. Our approach is based on a related notion of “randomness extraction” which emerged in complexity theory. We stress that the statistical ran- domness of our extractor’s output is proven, and is not based on any unproven assumptions, such as the security of cryptographic hash func- tions. A sample implementation of our extractor and additional details can be found at a dedicated web page [Web]. 1 Introduction 1.1 General setting It is well known that randomness is essential for cryptography. Cryptographic schemes are usually designed under the assumption of availability of an endless stream of unbiased and uncorrelated random bits.
    [Show full text]
  • Extracting Randomness from Extractor-Dependent Sources
    Extracting Randomness from Extractor-Dependent Sources Yevgeniy Dodi Vinod Vaikuntanathan NYU MIT Daniel Wichs Northeastern University and NTT Research Inc. February 19, 2020 Abstract We revisit the well-studied problem of extracting nearly uniform randomness from an arbi- trary source of sufficient min-entropy. Strong seeded extractors solve this problem by relying on a public random seed, which is unknown to the source. Here, we consider a setting where the seed is reused over time and the source may depend on prior calls to the extractor with the same seed. Can we still extract nearly uniform randomness? In more detail, we assume the seed is chosen randomly, but the source can make arbitrary oracle queries to the extractor with the given seed before outputting a sample. We require that the sample has entropy and differs from any of the previously queried values. The extracted output should look uniform even to a distinguisher that gets the seed. We consider two variants of the problem, depending on whether the source only outputs the sample, or whether it can also output some correlated public auxiliary information that preserves the sample’s entropy. Our results are: Without Auxiliary Information: We show that every pseudo-random function (PRF) with a sufficiently high security level is a good extractor in this setting, even if the distin- guisher is computationally unbounded. We further show that the source necessarily needs to be computationally bounded and that such extractors imply one-way functions. With Auxiliary Information: We construct secure extractors in this setting, as long as both the source and the distinguisher are computationally bounded.
    [Show full text]
  • Key Derivation and Randomness Extraction
    Key Derivation and Randomness Extraction Olivier Chevassut1, Pierre-Alain Fouque2, Pierrick Gaudry3, and David Pointcheval2 1 Lawrence Berkeley National Lab. – Berkeley, CA, USA – [email protected] 2 CNRS-Ecole´ normale sup´erieure – Paris, France – {Pierre-Alain.Fouque,David.Pointcheval}@ens.fr 3 CNRS-Ecole´ polytechnique – Palaiseau, France – [email protected] Abstract. Key derivation refers to the process by which an agreed upon large random number, often named master secret, is used to derive keys to encrypt and authenticate data. Practitioners and standard- ization bodies have usually used the random oracle model to get key material from a Diffie-Hellman key exchange. However, proofs in the standard model require randomness extractors to formally extract the entropy of the random master secret into a seed prior to derive other keys. This paper first deals with the protocol Σ0, in which the key derivation phase is (deliberately) omitted, and security inaccuracies in the analysis and design of the Internet Key Exchange (IKE version 1) protocol, corrected in IKEv2. They do not endanger the practical use of IKEv1, since the security could be proved, at least, in the random oracle model. However, in the standard model, there is not yet any formal global security proof, but just separated analyses which do not fit together well. The first simplification is common in the theoretical security analysis of several key exchange protocols, whereas the key derivation phase is a crucial step for theoretical reasons, but also practical purpose, and requires careful analysis. The second problem is a gap between the recent theoretical analysis of HMAC as a good randomness extractor (functions keyed with public but random elements) and its practical use in IKEv1 (the key may not be totally random, because of the lack of clear authentication of the nonces).
    [Show full text]
  • Human Assisted Randomness Generation Using Video Games
    Human Assisted Randomness Generation Using Video Games Mohsen Alimomeni, Reihaneh Safavi-Naini University of Calgary, Department of Computer Science malimome,[email protected] January 19, 2014 Abstract Random number generators have direct applications in information security, online gaming, gambling, and computer science in general. True random number generators need an entropy source which is a physical source with inherent uncertainty, to ensure unpredictability of the output. In this paper we propose a new indirect approach to collecting entropy using human errors in the game play of a user against a computer. We argue that these errors are due to a large set of factors and provide a good source of randomness. To show the viability of this proposal, we design and implement a game, conduct a user study in which we collect user input in the game, and extract randomness from it. We measure the rate and the quality of the resulting randomness that clearly show effectiveness of the approach. Our work opens a new direction for construction of entropy sources that can be incorporated into a large class of video games. 1 Introduction Randomness has a central role in computer science and in particular information security. Security of cryptographic algorithms and protocols relies on keys that must be random. Random coins used in randomized encryption and authentication algorithms and values such as nonces in protocols, must be unpredictable. In all these cases, unpredictability of random values is crucial for security proofs. There are also applications such as online games, gambling applications and lotteries in which unpredictability is a critical requirement.
    [Show full text]
  • Good Quantum Codes with Low-Weight Stabilizers Sergey Bravyi, IBM Watson Research Center Tuesday, January 21, 2014, ** 2:00 Pm, This Week Only ** 107 Annenberg
    Good quantum codes with low-weight stabilizers Sergey Bravyi, IBM Watson Research Center Tuesday, January 21, 2014, ** 2:00 pm, this week only ** 107 Annenberg Quantum codes with low-weight stabilizers known as LDPC codes have been actively studied recently due to their potential applications in fault-tolerant quantum computing. However, all families of quantum LDPC codes known to this date suffer from a poor distance scaling limited by the square-root of the code length. This is in a sharp contrast with the classical case where good families of LDPC codes are known that combine constant encoding rate and linear distance. In this talk I will describe the first family of good quantum codes with low-weight stabilizers. The new codes have a constant encoding rate, linear distance, and stabilizers acting on at most square root of n qubits, where n is the code length. For comparison, all previously known families of good quantum codes have stabilizers of linear weight. The proof combines two techniques: randomized constructions of good quantum codes and the homological product operation from algebraic topology. We conjecture that similar methods can produce good stabilizer codes with stabilizer weight n^a for any a>0. Finally, we apply the homological product to construct new small codes with low-weight stabilizers. This is a joint work with Matthew Hastings Preprint: arXiv:1311.0885 Quantum Information, Entanglement, and Many-body Physics Fernando Brandao, University College London Tuesday, January 28, 2014, 4:00 p.m. 114 East Bridge Quantum information science has been developed in the past twenty years with an eye on future technologies, such as quantum computers and quantum cryptography.
    [Show full text]
  • Cryptographic Extraction and Key Derivation: the HKDF Scheme
    Cryptographic Extraction and Key Derivation: The HKDF Scheme Hugo Krawczyk∗ Abstract In spite of the central role of key derivation functions (KDF) in applied cryptography, there has been little formal work addressing the design and analysis of general multi-purpose KDFs. In practice, most KDFs (including those widely standardized) follow ad-hoc approaches that treat cryptographic hash functions as perfectly random functions. In this paper we close some gaps between theory and practice by contributing to the study and engineering of KDFs in several ways. We provide detailed rationale for the design of KDFs based on the extract-then-expand approach; we present the first general and rigorous definition of KDFs and their security which we base on the notion of computational extractors; we specify a concrete fully practical KDF based on the HMAC construction; and we provide an analysis of this construction based on the extraction and pseudorandom properties of HMAC. The resultant KDF design can support a large variety of KDF applications under suitable assumptions on the underlying hash function; particular attention and effort is devoted to minimizing these assumptions as much as possible for each usage scenario. Beyond the theoretical interest in modeling KDFs, this work is intended to address two important and timely needs of cryptographic applications: (i) providing a single hash-based KDF design that can be standardized for use in multiple and diverse applications, and (ii) providing a conservative, yet efficient, design that exercises much care in the way it utilizes a cryptographic hash function. (The HMAC-based scheme presented here, named HKDF, is being standardized by the IETF.) ∗IBM T.J.
    [Show full text]
  • Quantum-Proof Extractors: Optimal up to Constant Factors
    Quantum-Proof Extractors: Optimal up to Constant Factors Kai-Min Chung∗ Gil Cohen† Thomas Vidick‡ Xiaodi Wu§ Abstract We give the first construction of a family of quantum-proof extractors that has optimal seed length dependence O(log(n/ǫ)) on the input length n and error ǫ. Our extractors support any α min-entropy k = Ω(log n + log1+ (1/ǫ)) and extract m = (1 α)k bits that are ǫ-close to uniform, for any desired constant α > 0. Previous constructions had− a quadratically worse seed length or were restricted to very large input min-entropy or very few output bits. Our result is based on a generic reduction showing that any strong classical condenser is au- tomatically quantum-proof, with comparable parameters. The existence of such a reduction for extractors is a long-standing open question; here we give an affirmative answer for condensers. Once this reduction is established, to obtain our quantum-proof extractors one only needs to con- sider high entropy sources. We construct quantum-proof extractors with the desired parameters for such sources by extending a classical approach to extractor construction, based on the use of block-sources and sampling, to the quantum setting. Our extractors can be used to obtain improved protocols for device-independent randomness expansion and for privacy amplification. 1 Introduction A randomness extractor is a deterministic procedure that extracts almost uniform random bits from a weak source of randomness using a seed, a short uniform random string, as a catalyst. Originally introduced as tools for derandomization [36], extractors have found uses and surprising connections in many areas such as pseudorandomness [35, 50], complexity theory [17, 45, 31], cryptography [5, 14], and combinatorics [1, 8, 7] to name a few.
    [Show full text]
  • Generating Random Numbers with Minimal Assumptions
    Physical Randomness Extractors: Generating Random Numbers with Minimal Assumptions Kai-Min Chung∗ Yaoyun Shi† Xiaodi Wu‡ March 9, 2015 Abstract How to generate provably true randomness with minimal assumptions? This question is im- portant not only for the efficiency and the security of information processing, but also for understanding how extremely unpredictable events are possible in Nature. All current solutions require special structures in the initial source of randomness, or a certain independence relation among two or more sources. Both types of assumptions are impossible to test and difficult to guarantee in practice. Here we show how this fundamental limit can be circumvented by extrac- tors that base security on the validity of physical laws and extract randomness from untrusted quantum devices. In conjunction with the recent work of Miller and Shi (arXiv:1402:0489), our physical randomness extractor uses just a single and general weak source, produces an arbi- trarily long and near-uniform output, with a close-to-optimal error, secure against all-powerful quantum adversaries, and tolerating a constant level of implementation imprecision. The source necessarily needs to be unpredictable to the devices, but otherwise can even be known to the adversary. Our central technical contribution, the Equivalence Lemma, provides a general principle for proving composition security of untrusted-device protocols. It implies that unbounded ran- domness expansion can be achieved simply by cross-feeding any two expansion protocols. In particular, such an unbounded expansion can be made robust, which is known for the first time. Another significant implication is, it enables the secure randomness generation and key distribution using public randomness, such as that broadcast by NIST’s Randomness Beacon.
    [Show full text]
  • Quantum Noise Extraction from the Interference of Laser Pulses in Optical Quantum Random Number Generator
    Quantum noise extraction from the interference of laser pulses in optical quantum random number generator ROMAN SHAKHOVOY1,2*, DENIS SYCH1,2,3, VIOLETTA SHAROGLAZOVA1,2,4, ALEXANDER UDALTSOV1,2, ALEKSEY FEDOROV1,2,5, AND YURY KUROCHKIN1,2,6 1Russian Quantum Center, 45 Skolkovskoye shosse, Moscow, Russian Federation 2QRate, 100 Novaya str., Skolkovo, Russian Federation 3P.N. Lebedev Physical Institute, Russian Academy of Sciences, 53 Leninsky prosp., Moscow, Russian Federation 4Skolkovo Institute of Science and Technology, Bolshoy Boulevard 30, bld. 1, Moscow, Russian Federation 5Moscow Institute of Physics and Technology, 9 Institutskiy per., Dolgoprudny, Russian Federation 6NTI Center for Quantum Communications, National University of Science and Technology MISiS, 4 Leninsky prospekt, Moscow, Russian Federation *[email protected] Abstract: We propose a method for quantum noise extraction from the interference of laser pulses with random phase. Our technique is based on the calculation of a parameter, which we called the quantum reduction factor, and which allows determining the contributions of quantum and classical noises in the assumption that classical fluctuations exhibit Gaussian distribution. To the best of our knowledge, the concept of the quantum reduction factor is introduced for the first time. We use such an approach to implement the post-processing-free optical quantum random number generator with the random bit generation rate of 2 Gbps. 1. Introduction Numerous quantum random number generators (QRNGs) based on various quantum effects have been demonstrated over the last two decades [1]. Among them, QRNGs employing different phenomena of quantum optics seem to be very convenient, relatively cheap, and, what is more important nowadays, could provide high random bit generation rates.
    [Show full text]
  • Leftover Hash Lemma and Its Applications
    Leftover Hash Lemma and its Applications rkm0959 (Gyumin Roh) October 18th Outline Introduction and Motivation Bunch of Terminology The Leftover Hash Lemma Application 1: Random Number Generation Application 2: Quantum Key Distribution Application 3: Learning With Errors Further Works References Table of Contents Introduction and Motivation Bunch of Terminology The Leftover Hash Lemma Application 1: Random Number Generation Application 2: Quantum Key Distribution Application 3: Learning With Errors Further Works References I Suppose I have a secret bit string of length 8, b1b2b3 ··· b8. I It doesn’t serve real meaning, just for password purposes. I You do somehow know that b1 6= b2, b2 = b3, b4 = 1. I You want to find my bit string by brute-force. I How many possibilities do you need to check? Introduction I Let’s begin with a simple puzzle :) I How many possibilities do you need to check? Introduction I Let’s begin with a simple puzzle :) I Suppose I have a secret bit string of length 8, b1b2b3 ··· b8. I It doesn’t serve real meaning, just for password purposes. I You do somehow know that b1 6= b2, b2 = b3, b4 = 1. I You want to find my bit string by brute-force. Introduction I Let’s begin with a simple puzzle :) I Suppose I have a secret bit string of length 8, b1b2b3 ··· b8. I It doesn’t serve real meaning, just for password purposes. I You do somehow know that b1 6= b2, b2 = b3, b4 = 1. I You want to find my bit string by brute-force.
    [Show full text]
  • Randomness Extraction and Key Derivation Using the CBC, Cascade and HMAC Modes⋆
    Randomness Extraction and Key Derivation Using the CBC, Cascade and HMAC Modes⋆ Yevgeniy Dodis1, Rosario Gennaro2, Johan H˚astad3, Hugo Krawczyk4, and Tal Rabin2 1 New York University. E:mail: [email protected] 2 IBM Research. E-mail: {rosario,talr}@watson.ibm.com 3 Royal Institute, Sweden. E-mail: [email protected] 4 Technion, Israel, and IBM Research. E-mail: [email protected] Abstract. We study the suitability of common pseudorandomness modes associated with cryptographic hash functions and block ciphers (CBC- MAC, Cascade and HMAC) for the task of “randomness extraction”, namely, the derivation of keying material from semi-secret and/or semi- random sources. Important applications for such extractors include the derivation of strong cryptographic keys from non-uniform sources of ran- domness (for example, to extract a seed for a pseudorandom generator from a weak source of physical or digital noise), and the derivation of pseudorandom keys from a Diffie-Hellman value. Extractors are closely related in their applications to pseudorandom functions and thus it is attractive to (re)use the common pseudoran- dom modes as randomness extractors. Yet, the crucial difference between pseudorandom generation and randomness extraction is that the former uses random secret keys while the latter uses random but known keys. We show that under a variety of assumptions on the underlying primitives (block ciphers and compression functions), ranging from ideal random- ness assumptions to realistic universal-hashing properties, these modes induce good extractors. Hence, these schemes represent a more practical alternative to combinatorial extractors (that are seldom used in prac- tice), and a better-analyzed alternative to the common practice of using SHA-1 or MD5 (as a single un-keyed function) for randomness extraction.
    [Show full text]
  • Seedless Fruit Is the Sweetest: Random Number Generation, Revisited
    Seedless Fruit is the Sweetest: Random Number Generation, Revisited Sandro Coretti∗ Yevgeniy Dodis† Harish Karthikeyan‡ New York University New York University New York University [email protected] [email protected] [email protected] Stefano Tessaro§ University of Washington [email protected] March 25, 2019 Abstract The need for high-quality randomness in cryptography makes random-number generation one of its most fundamental tasks. A recent important line of work (initiated by Dodis et al., CCS '13) focuses on the notion of robustness for pseudorandom number generators (PRNGs) with inputs. These are primitives that use various sources to accumulate sufficient entropy into a state, from which pseudorandom bits are extracted. Robustness ensures that PRNGs remain secure even under state compromise and adversarial control of entropy sources. However, the achievability of robustness inherently depends on a seed, or, alternatively, on an ideal primitive (e.g., a random oracle), independent of the source of entropy. Both assumptions are problematic: seed generation requires randomness to start with, and it is arguable whether the seed or the ideal primitive can be kept independent of the source. This paper resolves this dilemma by putting forward new notions of robustness which enable both (1) seedless PRNGs and (2) primitive-dependent adversarial sources of entropy. To bypass obvious impossibility results, we make a realistic compromise by requiring that the source pro- duce sufficient entropy even given its evaluations of the underlying primitive. We also provide natural, practical, and provably secure constructions based on hash-function designs from com- pression functions, block ciphers, and permutations. Our constructions can be instantiated with minimal changes to industry-standard hash functions SHA-2 and SHA-3, or HMAC (as used for the key derivation function HKDF), and can be downgraded to (online) seedless randomness extractors, which are of independent interest.
    [Show full text]