Public-seed Pseudorandom Permutations - … Pseudorandom Permutations Pratik Soni Stefano Tessaro UC...

Public-seed Pseudorandom Permutations

Pratik Soni Stefano Tessaro

UC Santa Barbara UC Santa Barbara

EUROCRYPT 2017

Cryptographic schemes often built from generic building blocks

Typically: Block ciphers, hash/compression functions!

𝐾 ⊕ 𝑖𝑝𝑎𝑑 || 𝑀

𝐾 ⊕ 𝑜𝑝𝑎𝑑

hash function (e.g., SHA-3)

𝐸𝐾

𝐼𝑉

𝐸𝐾

𝑀ℓ

block cipher (e.g., AES)

Cryptographic schemes often built from generic building blocks

Typically: Block ciphers, hash/compression functions!

Is there a universal and simple building block for efficient symmetric cryptography?

𝐾 ⊕ 𝑖𝑝𝑎𝑑 || 𝑀

𝐾 ⊕ 𝑜𝑝𝑎𝑑

hash function (e.g., SHA-3)

𝐸𝐾

𝐼𝑉

𝐸𝐾

𝑀ℓ

block cipher (e.g., AES)

Recent trend: Start from seedless permutation

Sponge paradigm

Here: 𝜋 is an efficiently computable and invertible one-to-one function

Sponge paradigm

Permutations

“… it would be nice, now, if permutations can be called

the Swiss Army Knife [of cryptography]” — Joan Daemen, Passwords^12

Hashing Garbling

PRNGs Authenticated Encryption

MACs KDFs

Typical instantiations

Ad-hoc construction

e.g., in KECCAK, NORX, …

Designed to withstand cryptanalysis

Fixed-key block ciphers

Ad-hoc construction

e.g., 𝜋 ∶ 𝑥 → AES(0128, 𝑥) 𝐴𝐸𝑆

Fixed-key block ciphers

Ad-hoc construction

e.g., 𝜋 ∶ 𝑥 → AES(0128, 𝑥)

Faster, no re-keying costs!

𝐴𝐸𝑆

Faster Hash functions [RS08], fast garbling [BHKR13]

Permutations assumptions

Permutations are great in practice, but what about theory?

Goal: Standard-model reduction: “If 𝜋 satisfies 𝑋 then 𝐶[𝜋] satisfies 𝑌.”

𝑆0 0

𝜋 𝜋 𝜋

e.g., 𝐶 = KECCAK;

𝑌 = Anything non-trivial

𝑋 = ? ? ?

𝑆0 0

𝜋 𝜋 𝜋

e.g., 𝐶 = KECCAK;

𝑌 = Anything non-trivial

𝑋 = ? ? ?

Common approach: Use random permutation (RP) model

𝜋 is random + adversary given oracle access to 𝜋 and 𝜋−1

Observation: No standard-model proofs known for permutation-based constructions!

𝑆0 0

𝜋 𝜋 𝜋

But: random permutations do not exist [CGH98]

RP model proofs only yield security for generic attacks

Quite different state of affairs than for hash functions:

Hash functions

ideal model

random oracle

Hash functions

ideal model standard model

random oracle CRHF, OWFs, UOWHFs,

CI, UCEs…

Hash functions

Permutations

random oracle

CRHF, OWFs, UOWHFs, CI, UCEs…

Hash functions

Permutations

random oracle

CRHF, OWFs, UOWHFs, CI, UCEs…

What cryptographic hardness can we expect from a permutation? No one-wayness, no compression, no pseudorandomness …

This work, in a nutshell

First plausible and useful standard-model security assumption for permutations.

“Public-seed Pseudorandom Permutations” (psPRPs)

We address two main questions:

Can we get psPRPs at all?

Are psPRPs useful?

inspired by the UCE framework [BHK13]

Are psPRPs useful?

inspired by the UCE framework [BHK13]

Are psPRPs useful?

Yes! Yes!

psPRPs have many applications

Deterministic & Hedged PKE

Immunizing backdoored PRGs

CCA-secure Enc. (CCA)

Hardcore functions (HC)

KDM-secure symmetric key Enc. (KDM)

Point function Obfuscation (PFOB)

Efficient garbling from fixed-key block-ciphers

Message-locked Encryption (MLE) 𝒑𝒔𝑷𝑹𝑷

Message-locked Encryption (MLE) 𝒑𝒔𝑷𝑹𝑷 𝑼𝑪𝑬

Sponges

Feistel

Roadmap

1.Definitions

2.Constructions & Applications

3.Conclusions

Co-related input hash

Functions (CIH)

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1) 𝜋 ∶ 0,1 𝑛 → 0,1 𝑛

We consider seeded permutations

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

𝐺𝑒𝑛 𝑥 𝜋𝑠 𝑥

𝜋 ∶ 0,1 𝑛 → 0,1 𝑛

𝜋𝑠 1𝜆 𝑠

Seed generation

𝑦 𝜋𝑠−1 𝑦 𝜋𝑠

Forward evaluation

Backward evaluation

Efficient (poly-time) algorithms

(2) ∀𝑥 ∶ 𝜋𝑠−1 𝜋𝑠 𝑥 = 𝑥

(1) 𝜋𝑠 ∶ 0,1 𝑛 → 0,1 𝑛

We consider seeded permutations

Traditional security notion if seed is secret: Pseudorandom Permutation

𝑠 ← Gen(1𝜆)

𝜋s / 𝜋𝑠−1

𝜌 ← Perms(𝑛)

𝜌/𝜌−1 ≈

𝑠 ← Gen(1𝜆)

𝜌/𝜌−1 ≈

𝑠 ← Gen(1𝜆)

𝜌/𝜌−1 ≈

Stage 1: • Oracle access • Secret seed

Stage 2: • Learns seed • No oracle access

𝑠 ← Gen(1𝜆)

𝜌/𝜌−1 ≈

Stage 1: • Oracle access • Secret seed

Stage 2: • Learns seed • No oracle access

Limited information

UCE security

𝐻 = (𝐺𝑒𝑛, ℎ)

Bellare Hoang Keelveedhi

𝑓 ← Funcs(𝑚, 𝑛) 𝑓

𝑠 ← Gen(1𝜆)

ℎ𝑠

UCE security

𝑆 source

𝑠 ← Gen(1𝜆)

ℎ𝑠

UCE security

𝑆 source

𝑠 ← Gen(1𝜆)

ℎ𝑠

UCE security

𝑆 source

distinguisher

𝑠 ← Gen(1𝜆)

ℎ𝑠

UCE security

𝑆 source

distinguisher

𝑠 ← Gen(1𝜆)

ℎ𝑠

UCE security

𝑆 source

distinguisher

𝑠 ← Gen(1𝜆)

ℎ𝑠

UCE security

𝑆 source

distinguisher

𝑠 ← Gen(1𝜆)

psPRP security

𝝅𝒔/𝝅𝒔−𝟏 𝝆 ← 𝐏𝐞𝐫𝐦𝐬(𝒏)

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

𝝆/𝝆−𝟏

Makes forward and backward queries!

𝑠 ← Gen(1𝜆)

psPRP security

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

𝝆/𝝆−𝟏

𝑠 ← Gen(1𝜆)

psPRP security

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

𝝆/𝝆−𝟏

𝐷 0/1

𝑠 ← Gen(1𝜆)

psPRP security

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

𝝆/𝝆−𝟏

𝑃 is 𝑝𝑠𝑃𝑅𝑃-secure if ∀ PPT 𝑆, 𝐷 , left and right are indistinguishable.

𝐷 0/1

𝑠 ← Gen(1𝜆)

psPRP security

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

𝝆/𝝆−𝟏

𝑃 is 𝑝𝑠𝑃𝑅𝑃-secure if ∀ PPT 𝑆, 𝐷 , left and right are indistinguishable.

𝐷 0/1

𝑠 ← Gen(1𝜆)

psPRP security

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

𝝆/𝝆−𝟏

𝑃 is 𝑝𝑠𝑃𝑅𝑃-secure if ∀ PPT 𝑆, 𝐷 , …

𝑠 ← Gen(1𝜆)

𝜋𝑠/𝜋𝑠−1 𝜌 ← Perms(𝑛) 𝜌/𝜌−1

(+, 0𝑛) (+, 0𝑛)

𝑠 ← Gen(1𝜆)

(+, 0𝑛) (+, 0𝑛)

𝑠 ← Gen(1𝜆)

𝑦 𝑦

(+, 0𝑛) (+, 0𝑛)

𝑠 ← Gen(1𝜆)

𝐿 = 𝑦

𝑦 𝑦

(+, 0𝑛) (+, 0𝑛)

𝑠 ← Gen(1𝜆)

𝐿 = 𝑦

Outputs 1 iff 𝑦 = 𝜋𝑠 0𝑛

(+, 0𝑛) (+, 0𝑛)

𝑠 ← Gen(1𝜆)

𝐿 = 𝑦

1 with prob. 1

(+, 0𝑛) (+, 0𝑛)

𝑠 ← Gen(1𝜆)

𝐿 = 𝑦

with prob. 1

with prob. 1/2𝑛

(+, 0𝑛) (+, 0𝑛)

𝑠 ← Gen(1𝜆)

𝐿 = 𝑦

with prob. 1

with prob. 1/2𝑛

𝑝𝑠𝑃𝑅𝑃-security is impossible against all sources!

Sources need to be restricted

all sources

𝑃 = (Gen, 𝜋, 𝜋−1)

all sources

𝑃 = (Gen, 𝜋, 𝜋−1)

𝑃 is 𝑝𝑠𝑃𝑅𝑃[𝒮]-secure if ∀ 𝑆 ∈ 𝒮 and ∀ PPT

𝐷, left and right are indistinguishable.

all sources

𝑃 = (Gen, 𝜋, 𝜋−1)

𝐷 0/1

𝑠 ← Gen(1𝜆) 𝜋𝑠/𝜋𝑠

−1 𝜌 ← Perms(𝑛) 𝜌/𝜌−1

sources

This talk – unpredictable and reset-secure sources

sources

𝒮𝑠𝑢𝑝 unpredictable

sources

𝒮𝑠𝑟𝑠 𝒮𝑠𝑢𝑝 unpredictable

reset-secure

sources

reset-secure

Both restrictions model that 𝐷 cannot predict the queries made by the sources!

sources

reset-secure

𝒮𝑠𝑢𝑝 ⊆ 𝒮𝑠𝑟𝑠

sources

reset-secure

𝒮𝑠𝑢𝑝 ⊆ 𝒮𝑠𝑟𝑠 𝑝𝑠𝑃𝑅𝑃 𝒮𝑠𝑟𝑠 is a stronger

assumption than 𝑝𝑠𝑃𝑅𝑃 𝒮𝑠𝑢𝑝 ⟹

Source restrictions – unpredictability

𝑆 𝜌/𝜌−1

(𝜎, 𝑥𝑖)

𝜎 ∈ {+,−}

𝑆 𝜌/𝜌−1

(𝜎, 𝑥𝑖)

𝑄 ← 𝑄 ∪ { 𝜎, 𝑥𝑖 , (𝜎 , 𝑦𝑖)}

𝜎 ∈ {+,−}

𝑆 𝜌/𝜌−1

(𝜎, 𝑥𝑖)

𝑦𝑖

𝑄 ← 𝑄 ∪ { 𝜎, 𝑥𝑖 , (𝜎 , 𝑦𝑖)}

𝜎 ∈ {+,−}

𝑆 𝜌/𝜌−1

(𝜎, 𝑥𝑖)

𝑦𝑖

𝑄 ← 𝑄 ∪ { 𝜎, 𝑥𝑖 , (𝜎 , 𝑦𝑖)}

𝜎 ∈ {+,−}

𝑆 𝜌/𝜌−1

(𝜎, 𝑥𝑖)

𝑦𝑖

𝑄′

𝑄 ← 𝑄 ∪ { 𝜎, 𝑥𝑖 , (𝜎 , 𝑦𝑖)}

Pr [ 𝑄′ ∩ 𝑄 ≠ 𝜙] = negl(𝜆)

𝜎 ∈ {+,−}

It should be hard for 𝐴 to predict any of 𝑆’s queries or its inverse

𝑆 𝜌/𝜌−1

(𝜎, 𝑥𝑖)

𝑦𝑖

𝑄′

𝑄 ← 𝑄 ∪ { 𝜎, 𝑥𝑖 , (𝜎 , 𝑦𝑖)}

Pr [ 𝑄′ ∩ 𝑄 ≠ 𝜙] = negl(𝜆)

𝒮𝑠𝑢𝑝: 𝐴 is computationally unbounded

𝒮𝑐𝑢𝑝: 𝐴 is PPT

𝜎 ∈ {+,−}

𝑆 𝜌/𝜌−1

(𝜎, 𝑥𝑖)

𝑦𝑖

𝑄′

𝑄 ← 𝑄 ∪ { 𝜎, 𝑥𝑖 , (𝜎 , 𝑦𝑖)}

Pr [ 𝑄′ ∩ 𝑄 ≠ 𝜙] = negl(𝜆)

𝒮𝑠𝑢𝑝: 𝐴 is computationally unbounded

𝒮𝑐𝑢𝑝: 𝐴 is PPT 𝑝𝑠𝑃𝑅𝑃[𝒮𝑐𝑢𝑝] impossible if iO

exists [BFM14]

𝜎 ∈ {+,−}

Source restrictions – reset-security

𝑆 𝜌/𝜌−1

𝜌/𝜌−1

𝑆 𝜌/𝜌−1

𝜌/𝜌−1

𝑆 𝜌/𝜌−1

𝜌/𝜌−1

𝑆 𝜌/𝜌−1

𝜌1/𝜌1−1

𝜌 ← Perms(𝑛) 𝜌 ← Perms(𝑛)

𝜌1 ← Perms(𝑛)

𝑆 𝜌/𝜌−1

𝜌/𝜌−1

𝑆 𝜌/𝜌−1

𝜌1/𝜌1−1

𝒮𝑠𝑟𝑠: 𝑅 is computationally unbounded

𝒮𝑐𝑟𝑠: 𝑅 is PPT

𝑆 𝜌/𝜌−1

𝜌/𝜌−1

𝑆 𝜌/𝜌−1

𝜌1/𝜌1−1

𝒮𝑠𝑟𝑠: 𝑅 is computationally unbounded

𝒮𝑐𝑟𝑠: 𝑅 is PPT

𝑆 𝜌/𝜌−1

𝜌/𝜌−1

𝑆 𝜌/𝜌−1

𝜌1/𝜌1−1

𝒮𝑐𝑢𝑝 ⊆ 𝒮𝑐𝑟𝑠

𝑝𝑠𝑃𝑅𝑃[𝒮𝑠𝑟𝑠]

𝑝𝑠𝑃𝑅𝑃[𝒮𝑠𝑢𝑝]

𝑝𝑠𝑃𝑅𝑃[𝒮𝑠𝑟𝑠]

𝑝𝑠𝑃𝑅𝑃[𝒮𝑠𝑢𝑝]

Central assumption in UCE theory

Roadmap

1.Definitions

3.Conclusions

Functions (CIH)

Are psPRPs useful?

Functions (CIH)

Are psPRPs useful?

Constructions from UCEs

Heuristic Instantiations

Functions (CIH)

Are psPRPs useful?

Constructions of UCEs

Direct applications Garbling from fixed-key

block ciphers

Functions (CIH)

Are psPRPs useful?

block ciphers

Functions (CIH)

Are psPRPs useful?

block ciphers

Functions (CIH)

Are psPRPs useful?

block ciphers

Common denominator: A new, restricted notion of indifferentiability!

Functions (CIH)

Are psPRPs useful?

block ciphers

Common denominator: A new, restricted notion of indifferentiability! CP-sequential

indifferentiability

𝑅𝑃

𝜌/𝜌−1

𝑅𝑂

𝑓 ← Funcs(∗, 𝑛)

Indifferentiability[MRH04]

𝐴 𝐴

𝑅𝑃

𝜌/𝜌−1

𝑅𝑂

𝐴 𝐴

? 𝑅𝑃

𝜌/𝜌−1

𝑅𝑂

𝐴 𝐴

𝑆𝑖𝑚 𝑅𝑃

𝜌/𝜌−1

𝑅𝑂

𝐴 𝐴 ≈

𝑆𝑖𝑚

𝑅𝑃

𝜌/𝜌−1

𝑅𝑂

𝐴1 𝐶

𝑠𝑡

𝑆𝑖𝑚

CP-sequential indifferentiability

𝑅𝑃

𝜌/𝜌−1

𝑅𝑂

𝐴1 𝐶

𝑠𝑡

𝑆𝑖𝑚

𝐶 𝑅𝑃 ∼𝑐𝑝𝑖 𝑅𝑂 ⇔ ∃ PPT 𝑆𝑖𝑚 ∀ PPT (𝐴1, 𝐴2):

left and right are indistinguishable.

𝑅𝑃

𝜌/𝜌−1

𝑅𝑂

Remarks:

𝐴1 𝐶

𝑠𝑡

𝑆𝑖𝑚

𝑅𝑃

𝜌/𝜌−1

𝑅𝑂

1. Full indifferentiability ⟹ CP-seq indiff.

2. Reverse ordering: seq. indifferentiability [MPS12]

Remarks:

𝐴1 𝐶

𝑠𝑡

𝑆𝑖𝑚

𝑅𝑃

𝜌/𝜌−1

𝑅𝑂

From psPRPs to UCEs

Theorem:

From psPRPs to UCEs

𝐶 𝑅𝑃 ∼cpi 𝑅𝑂

Theorem:

𝑅𝑃

𝜌/𝜌−1

From psPRPs to UCEs

𝐶 𝑅𝑃 ∼cpi 𝑅𝑂 +

𝑃 𝑝𝑠𝑃𝑅𝑃[𝒮𝑠𝑟𝑠]-secure

Theorem:

𝑅𝑃

𝜌/𝜌−1

From psPRPs to UCEs

𝐶 𝑅𝑃 ∼cpi 𝑅𝑂 ⟹ +

𝑃 𝑝𝑠𝑃𝑅𝑃[𝒮𝑠𝑟𝑠]-secure 𝐶[𝑃]

Theorem:

𝑅𝑃

𝜌/𝜌−1

𝜋𝑠/𝜋𝑠−1

From psPRPs to UCEs

𝑃 𝑝𝑠𝑃𝑅𝑃[𝒮𝑠𝑟𝑠]-secure 𝑈𝐶𝐸[𝒮𝑠𝑟𝑠]-secure. 𝐶[𝑃]

Theorem:

𝑅𝑃

𝜌/𝜌−1

From psPRPs to UCEs

Similar result proved in [BHK14], but: • Need full indifferentiability • Only stated for UCE domain extension

Theorem:

𝑅𝑃

𝜌/𝜌−1

From psPRPs to UCEs

Similar result proved in [BHK14], but: • Need full indifferentiability • Only stated for UCE domain extension

Theorem:

𝑅𝑃

𝜌/𝜌−1

Corollary: Every perm-based indiff. hash-function transforms a psPRP into a UCE!

From psPRPs to UCEs – Sponges

𝑦 ∈ {0,1}𝑟

𝑀 ∈ {0,1}∗

𝑆0 𝑟

n − 𝑟

𝜌 𝜌

𝑀1 𝑀2 𝑀𝑙

𝑦 ∈ {0,1}𝑟

Theorem [BDVP08]: Sponge[𝑅𝑃] ∼cpi 𝑅𝑂.

𝑀 ∈ {0,1}∗

𝑆0 𝑟

n − 𝑟

𝜌 𝜌

𝑦 ∈ {0,1}𝑟

𝑀 ∈ {0,1}∗

𝑆0 𝑟

n − 𝑟

𝜌 𝜌

𝜋𝑠 𝜋𝑠 𝜋𝑠

𝑦 ∈ {0,1}𝑟

Corollary: 𝑃 𝑝𝑠𝑃𝑅𝑃 𝒮𝑠𝑟𝑠 -secure ⟹ Sponge[𝑃] 𝑈𝐶𝐸 𝒮𝑠𝑟𝑠 -secure.

𝑀 ∈ {0,1}∗

𝑆0 𝑟

n − 𝑟

𝜌 𝜌

𝑦 ∈ {0,1}𝑟

Corollary: 𝑃 𝑝𝑠𝑃𝑅𝑃 𝒮𝑠𝑟𝑠 -secure ⟹ Sponge[𝑃] 𝑈𝐶𝐸 𝒮𝑠𝑟𝑠 -secure.

𝑀 ∈ {0,1}∗

𝑆0 𝑟

n − 𝑟

𝜌 𝜌

Validates the Sponge paradigm for UCE applications!

CP-sequentially indiff. constructions that are not fully indiff.?

From psPRPs to UCEs – Chop CP-sequentially indiff. constructions that are not fully indiff.?

From psPRPs to UCEs – Chop

𝑥 ∈ {0,1}𝑛 𝜌

𝑥 ∈ {0,1}𝑛 𝜌 𝑛 𝑛

𝑥 ∈ {0,1}𝑛

truncates 𝑛-bits to 𝑟-bits

𝜌 𝑛 𝑛 𝑟

𝑥 ∈ {0,1}𝑛 𝑦 ∈ {0,1}𝑟

𝜌 𝑛 𝑛 𝑟

Theorem: Chop[𝑅𝑃] ∼cpi 𝑅𝐹 when 𝑛 − 𝑟 ∈ 𝜔(log 𝜆).

𝑥 ∈ {0,1}𝑛 𝑦 ∈ {0,1}𝑟

𝜌 𝑛 𝑛 𝑟

Chop 𝑅𝑃 is not indifferentiable

𝑥 ∈ {0,1}𝑛 𝑦 ∈ {0,1}𝑟

𝜌 𝑛 𝑛 𝑟

𝑥 ∈ {0,1}𝑛 𝑦 ∈ {0,1}𝑟

𝜌 𝜋𝑠 𝑛 𝑛 𝑟

Corollary: 𝑃 𝑝𝑠𝑃𝑅𝑃 𝒮𝑠𝑟𝑠 -secure ⟹ Chop[𝑃] 𝑈𝐶𝐸[𝒮𝑠𝑟𝑠]-secure.

𝑥 ∈ {0,1}𝑛 𝑦 ∈ {0,1}𝑟

𝑈𝐶𝐸 𝒮𝑠𝑢𝑝 𝑝𝑠𝑃𝑅𝑃 𝒮𝑠𝑢𝑝

𝑥 ∈ {0,1}𝑛 𝑦 ∈ {0,1}𝑟

𝑈𝐶𝐸 𝒮𝑠𝑢𝑝 𝑝𝑠𝑃𝑅𝑃 𝒮𝑠𝑢𝑝

𝑥 ∈ {0,1}𝑛 𝑦 ∈ {0,1}𝑟

From Chop 𝑃 to VIL UCE: Domain extension techniques [BHK14]

psPRPs from UCEs Theorem:

psPRPs from UCEs

≈ 𝐴1 𝐶

𝑠𝑡

𝑏′

𝑠𝑡

𝑆𝑖𝑚

𝑏′

𝑅𝑂

𝑅𝑃

𝐶 𝑅𝑂 ∼cpi 𝑅𝑃

Theorem:

psPRPs from UCEs

≈ 𝐴1 𝐶

𝑠𝑡

𝑏′

𝑠𝑡

𝑆𝑖𝑚

𝑏′

𝑅𝑂

𝑅𝑃

𝐶 𝑅𝑂 ∼cpi 𝑅𝑃 ⟹ +

𝐻 𝑈𝐶𝐸[𝒮𝑠𝑟𝑠]-secure 𝐶 𝐻 𝑝𝑠𝑃𝑅𝑃[𝒮𝑠𝑟𝑠]-secure.

Theorem:

psPRPs from UCEs

≈ 𝐴1 𝐶

𝑠𝑡

𝑏′

𝑠𝑡

𝑆𝑖𝑚

𝑏′

𝑅𝑂

𝑅𝑃

Corollary: Every hash-function-based indiff. permutation transforms a UCE into a psPRP.

𝐶 𝑅𝑂 ∼cpi 𝑅𝑃 ⟹ +

𝐻 𝑈𝐶𝐸[𝒮𝑠𝑟𝑠]-secure 𝐶 𝐻 𝑝𝑠𝑃𝑅𝑃[𝒮𝑠𝑟𝑠]-secure.

Theorem:

From UCEs to psPRPs – Feistel

𝑓1 𝑓2 𝑓3 𝑓4 𝑓5

𝑋1 𝑋2 𝑋3 𝑋4 𝑋5 𝑋6

𝑋0 𝑋5

𝑌 ∈ {0,1}2𝑛

𝜓5[𝒇]

𝑋 ∈ {0,1}2𝑛

impossible

[CPS08]

[HKT11] [DS16] [DSKT16]

#rounds for indifferentiability

𝑓1 𝑓2 𝑓3 𝑓4 𝑓5

𝑋1 𝑋2 𝑋3 𝑋4 𝑋5 𝑋6

𝑋0 𝑋5

𝑌 ∈ {0,1}2𝑛

𝜓5[𝒇]

𝑋 ∈ {0,1}2𝑛

impossible

[CPS08]

[HKT11] [DS16] [DSKT16]

#rounds for indifferentiability

𝑓1 𝑓2 𝑓3 𝑓4 𝑓5

𝑋1 𝑋2 𝑋3 𝑋4 𝑋5 𝑋6

𝑋0 𝑋5

𝑌 ∈ {0,1}2𝑛

𝜓5[𝒇]

𝑋 ∈ {0,1}2𝑛

psPRPs exist in the standard model if UCEs exist!!!

Can we reduce the round-complexity of Feistel for UCE to psPRP transformation?

[HKT11] [DS16] [DSKT16]

#rounds for CP-sequential indifferentiability

Theorem: 5-round Feistel (𝜓5[𝒇]) ∼cpi 𝑅𝑃.

[HKT11] [DS16] [DSKT16]

This work!!!

Corollary: 𝑯 𝑈𝐶𝐸 𝒮𝑠𝑟𝑠 -secure ⟹ 𝜓5[𝑯] 𝑝𝑠𝑃𝑅𝑃[𝒮𝑠𝑟𝑠]-secure.

Theorem: 5-round Feistel (𝜓5[𝒇]) ∼cpi 𝑅𝑃.

[HKT11] [DS16] [DSKT16]

This work!!!

5-round proof is technically involved

Our 5-round Sim:

• Relies on chain completion techniques

• Heavily exploits query ordering

• Very different chain-completion strategy from previous works, no recursion needed

𝑓1 𝑓2 𝑓3 𝑓4 𝑓5

𝑋1 𝑋2 𝑋3 𝑋4 𝑋5 𝑋6

𝑋0 𝑋5 Set

uniform Set

uniform

forceVal forceVal

detect detect

5-round proof is technically involved

Our 5-round Sim:

impossible

[LR88]

[HKT11] [DS16] [DSKT16]

#rounds of Feistel for psPRP-security

This work!!! Open: Do 4-rounds suffice?

• Relies on chain completion techniques

• Heavily exploits query ordering

• Very different chain-completion strategy from previous works, no recursion needed

𝑓1 𝑓2 𝑓3 𝑓4 𝑓5

𝑋1 𝑋2 𝑋3 𝑋4 𝑋5 𝑋6

𝑋0 𝑋5 Set

uniform Set

uniform

forceVal forceVal

detect detect

𝑠 ← {0,1}𝑘

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

From Block-ciphers e.g. AES

𝐺𝑒𝑛:

𝑠 ← {0,1}𝑘

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

psPRP 𝒮𝑠𝑟𝑠 -secure

Ideal-Cipher model

𝐺𝑒𝑛:

𝑠 ← {0,1}𝑘

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

𝑠 ← {0,1}𝑘

From Permutations e.g. the Keccak permutation

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

Ideal-Cipher model

𝐺𝑒𝑛:

𝑠 ← {0,1}𝑘

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

psPRP 𝒮𝑠𝑢𝑝 -secure 𝜋

𝑠 ← {0,1}𝑘

From Permutations e.g. the Keccak permutation

𝑃 = (𝐺𝑒𝑛, 𝜋, 𝜋−1)

Ideal-Cipher model

RP model

𝐺𝑒𝑛:

Fast Garbling from psPRPs

Garbled And

𝐸 0𝑛, 𝐾10 ⊕ 𝐾10 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾01 ⊕ 𝐾01 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾11 ⊕ 𝐾11 ⊕ 𝑥𝑔1

𝐸 0𝑛, 𝐾00 ⊕ 𝐾00 ⊕ 𝑥𝑔0

𝑥𝑎0, 𝑥𝑎

1 𝑥𝑔0, 𝑥𝑔

1 And 𝑥𝑏

0, 𝑥𝑏1

Fast Garbling from psPRPs Fast garbling from [BHKR13]

Garbled And

𝐸 0𝑛, 𝐾10 ⊕ 𝐾10 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾01 ⊕ 𝐾01 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾11 ⊕ 𝐾11 ⊕ 𝑥𝑔1

𝐸 0𝑛, 𝐾00 ⊕ 𝐾00 ⊕ 𝑥𝑔0

𝑥𝑎0, 𝑥𝑎

1 And 𝑥𝑏

0, 𝑥𝑏1

• Only calls fixed-key block cipher

𝑥 → 𝐸(0𝑘 , 𝑥)

• Very fast – no key-schedule

Garbled And

𝐸 0𝑛, 𝐾10 ⊕ 𝐾10 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾01 ⊕ 𝐾01 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾11 ⊕ 𝐾11 ⊕ 𝑥𝑔1

𝐸 0𝑛, 𝐾00 ⊕ 𝐾00 ⊕ 𝑥𝑔0

𝑥𝑎0, 𝑥𝑎

1 And 𝑥𝑏

0, 𝑥𝑏1

𝑥 → 𝐸(0𝑘 , 𝑥)

• Proof in RP model

Garbled And

𝐸 0𝑛, 𝐾10 ⊕ 𝐾10 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾01 ⊕ 𝐾01 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾11 ⊕ 𝐾11 ⊕ 𝑥𝑔1

𝐸 0𝑛, 𝐾00 ⊕ 𝐾00 ⊕ 𝑥𝑔0

𝑥𝑎0, 𝑥𝑎

1 And 𝑥𝑏

0, 𝑥𝑏1

This work: Replace 𝐸 0𝑘 , 𝑥 by 𝜋𝑠 for a random seed

generated upon garbling.

Fast garbling from [BHKR13]

𝑥 → 𝐸(0𝑘 , 𝑥)

Garbled And

𝐸 0𝑛, 𝐾10 ⊕ 𝐾10 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾01 ⊕ 𝐾01 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾11 ⊕ 𝐾11 ⊕ 𝑥𝑔1

𝐸 0𝑛, 𝐾00 ⊕ 𝐾00 ⊕ 𝑥𝑔0

𝑥𝑎0, 𝑥𝑎

1 And 𝑥𝑏

0, 𝑥𝑏1

This work: Replace 𝐸 0𝑘 , 𝑥 by 𝜋𝑠 for a random seed

generated upon garbling.

Fast garbling from [BHKR13]

𝑥 → 𝐸(0𝑘 , 𝑥)

Theorem: Secure garbling when 𝜋𝒔 is 𝑝𝑠𝑃𝑅𝑃[𝒮𝑠𝑢𝑝].

Garbled And

𝐸 0𝑛, 𝐾10 ⊕ 𝐾10 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾01 ⊕ 𝐾01 ⊕ 𝑥𝑔0

𝐸 0𝑛, 𝐾11 ⊕ 𝐾11 ⊕ 𝑥𝑔1

𝐸 0𝑛, 𝐾00 ⊕ 𝐾00 ⊕ 𝑥𝑔0

𝑥𝑎0, 𝑥𝑎

1 And 𝑥𝑏

0, 𝑥𝑏1

Roadmap

1.Definitions

3.Conclusions

Functions (CIH)

Conclusion

psPRPs

Conclusion

First standard model assumptions on permutations

psPRPs

Constructions

Conclusion

psPRPs

Constructions

Conclusion

Applications psPRPs

Many open questions…

• More applications: psPRP-based PRNGs, authenticated encryption?

• More efficient constructions: Round complexity of Feistel for psPRPs?

psPRPs:

Public-seed Pseudorandomness - general paradigm:

• Applications of public-seed Ideal Ciphers?

psPRPs:

• Simpler assumptions on permutations?

psPRPs:

Beyond psPRPs:

psPRPs:

Beyond psPRPs:

Is SHA-3 a CRHF under any non-trivial assumption?

psPRPs:

Beyond psPRPs:

Is SHA-3 a CRHF under any non-trivial assumption?

Thank you!

Public-seed Pseudorandom Permutations - … Pseudorandom Permutations Pratik Soni Stefano Tessaro UC...

Documents

Pseudorandom Generators: A Primer

Permutations and Combinations. Objectives: apply fundamental counting principle compute permutations compute combinations distinguish permutations

Pseudorandom Number Generation QiuliangTang Revision

Pseudorandom Number Generators

Pseudorandom Generators

Fast Splittable Pseudorandom Number Generatorsgee.cs.oswego.edu/dl/papers/oopsla14.pdf · Fast Splittable Pseudorandom Number Generators ... pseudorandom, random number generator,

Pseudorandom Generators for Combinatorial Shapes

Permutations & Combinations

Publicly Evaluable Pseudorandom Functions and Their ...pdfs.semanticscholar.org/d893/a4182fe876893891e3ce017e901958dae3f0.pdfPublicly Evaluable Pseudorandom Functions and Their Applications

Pseudorandom Functions and Permutations Provably Secure ... · Contents 1 Introduction 1 2 Basic deﬁnitions 4 3 General Construction of RKA-PRFs and RKA-PRPs 5 3.1 Key-Malleability

Pseudorandom bits for polynomials - ccs.neu.edu

Scrambled Linear Pseudorandom Number Generators

Public-seed Pseudorandom Permutations · KDM-secure symmetric key Enc. (KDM) Point function Obfuscation (PFOB) Message-locked 𝒑𝒔𝑷𝑹𝑷 ... is -secure if ∀ PPT , , left

Better Pseudorandom Generators from Milder Pseudorandom

Backdoors in Pseudorandom Number Generators: · PDF fileBackdoors in Pseudorandom Number Generators: Possibility and Impossibility ... of this NIST-standardised pseudorandom generator

How to Construct Pseudorandom Permutations from …cs276/fa20/notes/Luby... · 2021. 3. 26. · SIAM J. COMPUT. Vol. 17, No. 2, April 1988 (C) 1988 Society for Industrial and Applied

How to Generate Pseudorandom Permutations Over Other

Pseudorandom Generators from Invariance Principles

15.1 Permutations

Delegatable Pseudorandom Functions and Applications