Decisional Diffie-Hellman Problem (DDH)

Course Business • Homework 3 Due Now • Homework 4 Released • Professor Blocki is travelling, but will be back next week 1 Cryptography CS 555 Week 11: • Discrete Log/DDH • Applications of DDH • Factoring Algorithms, Discrete Log Attacks + NIST Recommendations for Concrete Security Parameters Readings: Katz and Lindell Chapter 8.4 & Chapter 9 Fall 2017 2 Recap: Cyclic Group • = = 0, 1, 2, … (g is generator) • If = then for each h and each integer 0 we have = ∈ ≥ ℎ ℎ Fact 1: Let p be a prime then is a cyclic group of order p-1. ∗ Fact 2: Number of generatorsℤ g s.t. of = is ∗ −1 Example (generator): p=7, g=5 ℤ −1 <2>={1,5,4,6,2,3} 3 Recap: Cyclic Group • = = 0, 1, 2, … (g is generator) • If = then for each h and each integer 0 we have = ∈ ≥ ℎ ℎ Fact 1: Let p be a prime then is a cyclic group of order p-1. Fact 2: Number of generators g∗ s.t. of = is ℤ ∗ −1 Proof: Suppose that = and let h = then ℤ −1 = , , ( ), ∗ ( ), … ℤ Recall: 0 2 1 :−1 03 = {0, −…1, 1} if and only if gcd(i,p-1)=1. ℎ − ≥ − 4 Recap Diffie-Hellman Problems Computational Diffie-Hellman Problem (CDH) • Attacker is given h1 = and h2 = . • Attackers goal is to find 1 = h1 = h22 • CDH Assumption: For all PPT1∈2 A there is2 a negligible∈1 function negl such that A succeeds with probability at most negl(n). Decisional Diffie-Hellman Problem (DDH) • Let z0 = and let z1 = , where x1,x2 and r are random • Attacker is given12 , and (for a random bit b) • Attackers goal is to guess1 2 b • DDH Assumption: For all PPT A there is a negligible function negl such that A succeeds with probability at most ½ + negl(n). 5 Can we find a cyclic group where DDH holds? • Example 1: where p is a random n-bit prime. • CDH is believed∗ to be hard • DDH is *not*ℤ hard (You will prove this in homework 4 ) • Theorem: p=rq+1 be a random n-bit prime where q is a large - bit prime then the set of rth residues modulo p is a cyclic subgroup of order q. Then = [ ] is a cyclic subgroup of of order q. ∗ ∗ • Remark 1: DDH is believedℎ to hold forℎ ∈ suchℤ a group ℤ • Remark 2: It is easy to generate uniformly random elements of • Remark 3: Any element (besides 1) is a generator of 6 Can we find a cyclic group where DDH holds? • Theorem: p=rq+1 be a random n-bit prime where q is a large -bit prime then the set of rth residues modulo p is a cyclic subgroup of order q. Then =[ ] is a cyclic subgroup of of order q. • Closure: = ∗ ∗ • Inverse of ℎ is ℎ ∈ ℤ ℤ ℎ ℎ • Size = [ −1 ] = = [ ] = [ ] ℎ ℎ ∈ ℎ ℎ ℎ ℎ ℎ Remark: Two known attacks on Discrete Log Problem for (Section 9.2). • First runs in time = 2 / / • Second runs in time 2 2 3 2 3 log 7 Can we find a cyclic group where DDH holds? Remark: Two known attacks (Section 9.2). • First runs in time = 2 / / • Second runs in time 2 2 , where n is bit length of p 3 2 3 log Goal: Set and n to balance attacks = log / 3 2 3 How to sample p=rq+1? • First sample a random -bit prime q and • Repeatedly check if rq+1 is prime for a random n- bit value r 8 More groups where DDH holds? Elliptic Curves Example: Let p be a prime (p > 3) and let A, B be constants. Consider the equation 2 = 3 + + And let = , 2 = 3 + + 2 ℤ ∈ ℤ ∪ Note: is defined to be an additive identity , + = , What is 1, 1 + 2, 2 ? 9 Elliptic Curve Example , (x3,y3) , The line passing through , , and has the equation = 1 + 1 Where the slope −1 2 = 1 2 (x ,-y )= , + , − 3 3 − 10 Elliptic Curve Example , (x3,y3) , Formally, let 1 2 = 1 − 2 Be the slope. −Then the line passing through , and , has the equation , + , (x3,-y3)= = 1 + 1 2 = [ ] 3 1 2 − 2 1 + 1 = [ + ] 3 3 3 1 1 = + + 11 − − − − 12 Elliptic Curve Example • No third point R on the line intersects our elliptic curve. • Thus, + = 13 Summary: Elliptic Curves Elliptic Curves Example: Let p be a prime (p > 3) and let A, B be constants. Consider the equation 2 = 3 + + And let = , 2 = 3 + + 2 ℤ ∈ ℤ ∪ Fact: defines an abelian group • For appropriate curves the DDH assumption is believed to hold ℤ • If you make up your own curve there is a good chance it is broken… • NIST has a list of recommendations 14 Week 11: Topic 1: Discrete Logarithm Applications Diffie-Hellman Key Exchange Collision Resistant Hash Functions Password Authenticated Key Exchange 15 Diffie-Hellman Key Exchange 1. Alice picks and sends to Bob 2. Bob picks and sends to Alice 3. Alice and Bob can both compute = , 16 Key-Exchange Experiment , : • Two parties run to exchange secret messages (with Πsecurity parameter 1n). • Let trans be a transcript which contains all messages sent and let k be the secret key output by eachΠ party. • Let b be a random bit and let kb = k if b=0; otherwise kb is sampled uniformly at random. • Attacker A is given trans and kb (passive attacker). • Attacker outputs b’ ( , =1 if and only if b=b’) Π Security of against an eavesdropping attacker: For all PPT A there is a negligible function negl such that Π Pr , =½ + n . Π 17 Diffie-Hellman Key-Exchange is Secure Theorem: If the decisional Diffie-Hellman problem is hard relative to group generator then the Diffie-Hellman key-exchange protocol is secure in the presence of a (passive) eavesdropper (*). (*) Assuming keys are chosen uniformly at random from theΠ cyclic group Protocol 1. Alice picks and sends to Bob Π 2. Bob picks and sends to Alice 3. Alice and Bob can both compute = , 18 Diffie-Hellman Assumptions Computational Diffie-Hellman Problem (CDH) • Attacker is given h1 = and h2 = . • Attackers goal is to find 1 = h1 = h22 • CDH Assumption: For all PPT1∈2 A there is2 a negligible∈1 function negl upper bounding the probability that A succeeds Decisional Diffie-Hellman Problem (DDH) • Let z0 = and let z1 = , where x1,x2 and r are random • Attacker is given12 , and (for a random bit b) • Attackers goal is to guess1 2 b • DDH Assumption: For all PPT A there is a negligible function negl such that A succeeds with probability at most ½ + negl(n). 19 Diffie-Hellman Key Exchange 1. Alice picks and sends to Bob 2. Bob picks and sends to Alice 3. Alice and Bob can both compute , = Intuition: Decisional Diffie-Hellman assumption implies that a passive attacker who observes and still cannot distinguish between , = and a random group element . Remark: Modified protocol sets , = . You will prove that this protocol is secure under the weaker CDH assumption in homework 4. 20 Diffie-Hellman Key-Exchange is Secure Theorem: If the decisional Diffie-Hellman problem is hard relative to group generator then the Diffie-Hellman key-exchange protocol is secure in the presence of an eavesdropper (*). Proof: Π Pr , = 1 =½Pr , = 1| = 1+ ½Pr , = 1| = 0 Π =½Pr , , , , , = 1 +½Pr , , , , , = 1 Π Π =½+½ Pr , , , , , = 1 Pr , , , , , = 1 . ½ + ½ negl(n) (by DDH) (*) Assuming keys are chosen uniformly at random− from the cyclic group ≤ 21 Diffie-Hellman Key Exchange 1. Alice picks and sends to Bob 2. Bob picks and sends to Alice 3. Alice and Bob can both compute = , Intuition: Decisional Diffie-Hellman assumption implies that a passive attacker who observes and still cannot distinguish between , = and a random group element . Remark : The protocol is vulnerable against active attackers who can tamper with messages. 22 Man in the Middle Attack (MITM) 23 Man in the Middle Attack (MITM) 1. Alice picks and sends to Bob • Mallory intercepts , picks and sends to Bob instead 2. Bob picks and sends to Alice 1. Mallory intercepts , picks and sends to Alice instead 3. Eve computes and 퐸 ′ 1. Alice computes secret퐸 key (shared with Eve not Bob) 2. Bob computes (shared with퐸 Eve not Alice) 4. Mallory forwards messages between Alice and Bob (tampering with the messages if desired) 5. Neither Alice nor Bob can detect the attack 24 Discrete Log Experiment DLogA,G(n) 1. Run 1 to obtain a cyclic group of order q (with = ) and a generator g such that < g >= . 2. Select h uniformly at random. 3. Attacker A is given , q, g, h and outputs integer x. ∈ 4. Attacker wins (DLog (n)=1) if and only if gx=h. A,G We say that the discrete log problem is hard relative to generator if (negligible) s. t Pr DLogA,n = 1 ( ) ∀ ∃ ≤ 25 Collision Resistant Hash Functions (CRHFs) • Recall: not known how to build CRHFs from OWFs • Can build collision resistant hash functions from Discrete Logarithm Assumption • Let 1 output , , where is a cyclic group of order and g is a generator of the group. • Suppose that discrete log problem is hard relative to generator . (negligible) s. t Pr DLogA,n = 1 ( ) ∀ ∃ ≤ 26 Collision Resistant Hash Functions • Let 1 output , , where is a cyclic group of order and g is a generator of the group. Collision Resistant Hash Function (Gen,H ): • 1 1. , , 1 2. Select random h 3. Output s =← , , , ← , = , • ℎ (where, ) Claim : (Gen,H) is collision1 2 resistant if the discrete log assumption holds for 1 2 ℎ 1 2 ∈ ℤ 27 Collision Resistant Hash Functions • , = (where, , ) Claim : (Gen,H) is collision1 2 resistant 1 2 ℎ 1 2 ∈ ℤ Proof: Suppose we find a collision , = , then we have = which implies 1 2 1 2 1 2 1 2 = Use extended ℎ GCD toℎ find 2−2 mod1−1 q then ℎ = −=1 −21− 2 −1 Which means that2− 2 2−2 1− 1 is2 −the2 discrete log of h.

Load more