David Evans CS588: Security and Privacy University of Virginia Computer Science Lecture 15: From Here to Oblivion

31 Oct 2001University of Virginia CS 5882 Menu Oblivious Transfer Zero-Knowledge Proofs (Not “No Knowledge Proofs”)

31 Oct 2001University of Virginia CS 5883 Oblivious Transfer Joe Kilian’s story: “Suppose your netmail is being censored by Captain Yossarian. Whenever you send a message, he censors each bit of the message with probability ½, replacing each censored bit by some reversed character. Well versed in such concepts as redundancy, this is no real problem to you. The question is, can it actually be turned around and used to your advantage?”

31 Oct 2001University of Virginia CS 5884 Oblivious Transfer Before: –Alice knows secret b –Bob knows nothing After: –Either: ½ probability: Bob knows b ½ probability: Bob knows nothing –Alice doesn’t know if Bob knows b

31 Oct 2001University of Virginia CS 5885 Is this useful? Fair Coin Toss: Pick R1, R2, b H (R1 || R2 || b), R1 AliceBob Guess g g Bob wins if g = b b, R2 Does this really (information theoretically) work?

31 Oct 2001University of Virginia CS 5886 Coin Toss with Capt. Yossarian Alice picks b 1, b 2, …, b n such that b = b 1  b 2  …  b n Sends out b 1, b 2, …, b n over ½ censored channel Bob receives half of the b i ’s (and doesn’t know anything about the others) Bob guesses g and sends it to Alice

31 Oct 2001University of Virginia CS 5887 Oblivious Coin Toss Pick b = b 1  b 2  …  b n AliceBob Guess g g Bob wins if g = b “You Lose” b 1, b 2, …, b n b 1, X, X, b 4, b 5, …, b n-1, X

31 Oct 2001University of Virginia CS 5888 Better Oblivious Coin Toss Pick b = b 1  b 2  …  b n AliceBob Guess g g Bob wins if g = b b 1, b 2, …, b n b 1, X, X, b 4, b 5, …, b n-1, X b 1, b 2, …, b n Checks the b i s he knows match Calculates b = b 1  b 2  …  b n Yossarian’s channel Is this secure?

31 Oct 2001University of Virginia CS 5889 Oblivious Transfer Can we approximate oblivious transfer without Capt. Yossarian?

31 Oct 2001University of Virginia CS Public-Key Oblivious Transfer Alice Generates 2 public-private key pairs: (KU1, KR1) (KU2, KR2) Bob KU1, KU2 Generates symmetric key K E KU1 (K) or E KU2 (K) Picks either KU1 or KU2. K1 = E KR1 (E KU? (K)) = K or meaningless bits K2 = E KR2 (E KU? (K)) = K or meaningless bits

31 Oct 2001University of Virginia CS Alice Generates 2 public-private key pairs: (KU1, KR1) (KU2, KR2) Bob KU1, KU2 Generates symmetric key K E KU1 (K) or E KU2 (K) Picks either KU1 or KU2. K1 = E KR1 (E KU? (K)) = K or meaningless bits K2 = E KR2 (E KU? (K)) = K or meaningless bits E K1 (b 1 ), E K2 (b 2 ) If Bob used KU1 : D K (E K1 (b 1 )) = b 1 D K (E K2 (b 2 )) = Meaningless

31 Oct 2001University of Virginia CS 58812

31 Oct 2001University of Virginia CS Trick or Treat Protocols

31 Oct 2001University of Virginia CS “Trick or Treat” Protocols Trick-or-Treater must convince victim that she poses a credible threat Need to prove you know a trick, without revealing what it is (otherwise you don’t need to give the treat)! Technical literature calls them Zero- Knowledge “Proofs”

31 Oct 2001University of Virginia CS Cave Protocol Quisquater and Guillou, CRYPTO ’ Victim (Verifier) stands at 1 Trick-or-Treater enters cave and walks to either 3 or 4 Victim moves to 2 Victim yells to Tricker to come out either left or right Repeat n times Tricker must know magic word to open door. Magic word door

31 Oct 2001University of Virginia CS If there’s no cave? 1.Trick-or-Treater uses constructs a problem that only someone who knows the magic word could solve. 2.Trick-or-Treater commits the solution (using a bit commitment protocol) 3.Victim picks part of the solution for Trick-or- Treater to reveal 4.Trick-or-Treater reveals part of the problem, enough to be hard to do without knowing whole solution, but not enough to help victim learn anything. 5.Repeat n times.

31 Oct 2001University of Virginia CS Graph Coloring Given a graph, pick colors of the vertices so that no connected vertices have the same color: Adapted from Steven Rudich’s slides.

31 Oct 2001University of Virginia CS Coloring How can you prove you know how to 3-color G?

31 Oct 2001University of Virginia CS How many 3-Colorings do you know? If (Y, R, Y, R, B, Y, B, R) is a valid 3-coloring, so is (R, Y, R, Y, B, R, B, Y) and(B, Y, B, Y, R, B, R, Y)

31 Oct 2001University of Virginia CS How many 3-Colorings do you know? Can permute color names in any order: 3! = 6

31 Oct 2001University of Virginia CS Zero- Knowledge “Proof” Trick-or-Treater randomly picks one of the 6 colorings Uses bit commitment to commit to the coloring – sends Victim H (R 11 || R 12 || C 1 ), R 11 H (R 21 || R 22 || C 2 ), R 21 … H (R 81 || R 82 || C 2 ), R

31 Oct 2001University of Virginia CS Zero-Knowledge “Proof” Victim picks two random connected nodes, j and k Asks Trick-or-Treater to reveal colors of those nodes Trick-or-Treater sends: C j, R j 2,C k, R k 2 Victim verifies C j and C k are different colors, and checks the hashes

31 Oct 2001University of Virginia CS Proof? If Trick-or-Treater does not know a coloring, there are two connected nodes that have the same color If Victim picks randomly, chances are 1/d (number of edges) that he will pick that edge Repeat k times, but each time the Trick-or- Treater uses a random color mapping (from the 3! possible permutations) Probability cheating Trick-or-Treater is not caught: (1 – 1/d) k

31 Oct 2001University of Virginia CS How many repetitions? (1 – 1/d) k If k = dm p = (1 – 1/d) dm = (1 – 1/d) * (1 – 1/d) … * (1 – 1/d) ln (p) = ln (1 – 1/d) + ln (1 – 1/d) + … + ln (1 – 1/d) = dm ln (1 – 1/d) You may (or may not) recall from the Birthday Paradox proof: –For 0 < x < 1:ln (1 – x)  x So, ln (p) < dm (1/d) < m p < (1/e) m

31 Oct 2001University of Virginia CS Will Tricker Get the Treat? p < e m k = dm For p <.01, we need m = 5 (1/e) 5 = How big is d ? In example, 8 (way too small – anyone can color the graph!) If P  NP, graph coloring takes time O(e d ) d around 25 becomes intractable Need md = 125 trials.

31 Oct 2001University of Virginia CS Does the Victim Learn Anything? No – victim could already easily color two connecting vertices differently Since the Tricker uses a different color mapping permutation (unknown to Victim), knowing the two vertex colors doesn’t help Committing to the colors of all vertices is what makes it convincing

31 Oct 2001University of Virginia CS A Faster Approach 1.Trick-or-Treater uses her secret and random number to transform original problem into an isomorphic hard problem. 2.Trick-or-Treater commits the solution (using a bit commitment protocol) 3.Trick-or-Treater reveals new problem. 4.Victim asks Trick-or-Treater to either: a)Prove new problem is isomorphic to old one b)Show the solution to the new problem 5.Repeat n times.

31 Oct 2001University of Virginia CS Making an isomorphic hard problem Requirements: –Can’t use solution to new problem to solve old problem (without knowing mapping) –Can’t easily solve new problem –Can show that old problem and new problem are equivalent Hmmm...any theory experts?

31 Oct 2001University of Virginia CS Graph Isomoprhism Given two graphs, G 1 = and G2 = is there a mapping between V 1 and V 2 such that G 1 and G 2 are identical? This is an NP-complete problem: –Its hard to find the mapping. –Given mapping, easy to check it is correct.

31 Oct 2001University of Virginia CS Using Graph Isomorphism Trick-or-Treater constructs a graph to represent the magic word: –Vertices are letters –Chooses edges as necessary –Hamiltonian cycle is magic word (path that goes through each vertex exactly once) –Finding a Hamiltonian cycle is NP- complete

31 Oct 2001University of Virginia CS Trick or Treat Trick-or-Treater wants to show Victim she knows a Hamiltion Cycle in graph G Trick-or-Treater constructs H, a random permutation of G –If she knows a Hamiltonian Cycle for G, it is easy to find on for H Shows Victim H, but not the cycle Victim asks for either: –Map showing G and H are isomorphic –Hamiltonian cycle for H Repeat n times (different H each time) –Each iteration catches cheater with 50% probability!

31 Oct 2001University of Virginia CS Can we perform zero-knowledge proofs for other problems? Yes! Any NP problem can be transformed into any NP-complete problem (either graph coloring or Hamiltonian cycle)

31 Oct 2001University of Virginia CS Variation: Oblivious Circuit Evaluation Alice wants to find a Hamiltonian Cycle of G. Bob has a quantum computer that can find Hamiltonian Cycles fast Bob is willing to compute for Alice, but Alice does not trust Bob to know G. Can Alice get Bob to find a Hamiltonian Cycle in G for her, without revealing G to Bob?

31 Oct 2001University of Virginia CS Oblivious Circuit Evaluation Alice Generates H an isomorphism of G Bob H Finds a cycle in H Cycle in H Maps to cycle in G Andrew Yao got the Turing Award for something like this (and lots of other contributions) last year!

31 Oct 2001University of Virginia CS Charge Keep cracking on your projects! Ask your trick-or-treaters for Hamiltonian cycles and graph isomorphisms (and keep the candy for yourself) Monday: Laura Brown, guest lecture