Resisting Randomness Subversion: Fast Deterministic and Hedged Public-Key Encryption in the Standard Model
نویسندگان
چکیده
This paper provides the first efficient, standard-model, fully-secure schemes for some related andchallenging forms of public-key encryption (PKE), namely deterministic and hedged PKE. These formsof PKE defend against subversion of random number generators, an end given new urgency by recentrevelations on the nature and extent of such subversion. We resolve the (recognized) technical chal-lenges in reaching these goals via a new paradigm that combines UCEs (universal computationalextractors) with LTDFs (lossy trapdoor functions). Crucially, we rely only on a weak form of UCE,namely security for statistically (rather than computationally) unpredictable sources. We then de-fine and achieve unique-ciphertext PKE as a way to defend against implementation subversion viaalgorithm-substitution attacks. 1 Department of Computer Science & Engineering, University of California San Diego, 9500 Gilman Drive, La Jolla,California 92093, USA. Email: [email protected]. URL: http://cseweb.ucsd.edu/~mihir/. Supported in part by NSFgrants CNS-1116800 and CNS-1228890.2 Department of Computer Science, University of Maryland, College Park, and Department of Computer Science,Georgetown University, 37th and O Streets, NW, Washington, DC 20057, USA. Email: [email protected]. URL:http://csiflabs.cs.ucdavis.edu/~tvhoang/. Supported in part by NSF award CNS-1223623. Part of the work wasdone while Hoang was working at UCSD and supported in part by NSF grants CNS-1116800, and CNS-1228890.
منابع مشابه
Hedged Public-Key Encryption: How to Protect against Bad Randomness
Public-key encryption schemes rely for their IND-CPA security on per-message fresh randomness. In practice, randomness may be of poor quality for a variety of reasons, leading to failure of the schemes. Expecting the systems to improve is unrealistic. What we show in this paper is that we can, instead, improve the cryptography to offset the lack of possible randomness. We provide public-key enc...
متن کاملHedging Public-Key Encryption in the Real World
Hedged PKE schemes are designed to provide useful security when the permessage randomness fails to be uniform, say, due to faulty implementations or adversarial actions. A simple and elegant theoretical approach to building such schemes works like this: Synthesize fresh random bits by hashing all of the encryption inputs, and use the resulting hash output as randomness for an underlying PKE sch...
متن کاملNonce-Based Cryptography: Retaining Security When Randomness Fails
We take nonce-based cryptography beyond symmetric encryption, developing it as a broad and practical way to mitigate damage caused by failures in randomness, whether inadvertent (bugs) or malicious (subversion). We focus on definitions and constructions for nonce-based public-key encryption and briefly treat nonce-based signatures. We introduce and construct hedged extractors as a general tool ...
متن کاملPublic-Key Encryption with Weak Randomness: Security against Strong Chosen Distribution Attacks
Chosen Distribution Attacks (CDA) were introduced by Bellare et al. (Asiacrypt ’09) to model attacks where an adversary can control the distribution of both messages and random coins used in an encryption scheme. One important restriction in their definition is that the distributions chosen by the adversary cannot depend on the public key being attacked, and they show that some restriction of t...
متن کاملSelective-Opening Security in the Presence of Randomness Failures
We initiate the study of public-key encryption (PKE) secure against selective-opening attacks (SOA) inthe presence of randomness failures, i.e., when the sender may (inadvertently) use low-quality randomness. Inthe SOA setting, an adversary can adaptively corrupt senders; this notion is natural to consider in tandemwith randomness failures since an adversary may target senders b...
متن کامل