Random Oracles and Non-Uniformity

We revisit security proofs for various cryptographic primitives in the auxiliary-input randomoracle model (AI-ROM), in which an attacker A can compute arbitrary S bits of leakage about the random oracle O before attacking the system and then use additional T oracle queries to O during the attack. This model has natural applications in settings where traditional randomoracle proofs are not useful: (a) security against non-uniform attackers; (b) security against preprocessing. We obtain a number of new results about the AI-ROM: • Unruh (CRYPTO ’07) introduced the pre-sampling technique, which generically reduces security proofs in the AI-ROM to a much simpler P -bit-fixing random-oracle model (BFROM), where the attacker can arbitrarily fix the values of O on some P coordinates, but then the remaining coordinates are chosen at random. Unruh’s security loss for this transformation is √ ST/P . We improve this loss to the optimal value O(ST/P ), obtaining nearly tight bounds for a variety of indistinguishability applications in the AI-ROM. • While the basic pre-sampling technique cannot give tight bounds for unpredictability applications, we introduce a novel “multiplicative version” of pre-sampling, which allows to dramatically reduce the size of P of the pre-sampled set to P = O(ST ) and yields nearly tight security bounds for a variety of unpredictability applications in the AI-ROM. Qualitatively, it validates Unruh’s “polynomial pre-sampling conjecture”—disproved in general by Dodis et al. (EUROCRYPT ’17)—for the special case of unpredictability applications. • Using our techniques, we reprove nearly all AI-ROM bounds obtained by Dodis et al. (using a much more laborious compression technique), but we also apply it to many settings where the compression technique is either inapplicable (e.g., computational reductions) or appears intractable (e.g., Merkle-Damg̊ard hashing). • We show that for any salted Merkle-Damg̊ard hash function with m-bit output there exists a collision-finding circuit of size Θ(2) (taking salt as the input), which is significantly below the 2 birthday security conjectured against uniform attackers. • We build two compilers to generically extend the security of applications proven in the traditional ROM to the AI-ROM. One compiler simply prepends a public salt to the random oracle, showing that salting generically provably defeats preprocessing. Overall, our results make it much easier to get concrete security bounds in the AI-ROM. These bounds in turn give concrete conjectures about the security of these applications (in the standard model) against non-uniform attackers. Supported by NSF grants 1314568 and 1319051. Partially supported by gifts from VMware Labs and Google, and NSF grants 1619158, 1319051, 1314568. Supported by NSF grants CNS1314722 and CNS-1413964. Work partially done at the Simons Institute for the Theory of Computing at UC Berkeley.