Rafael Pass Cornell University Constant-round Non-malleability From Any One-way Function Joint work with Huijia (Rachel) Lin

“Interactions among mutually distrustful players” Far beyond traditional goal of concealing messages –Electronic Auctions without a trusted auctioneer Correctness: highest bidder wins Privacy: no other bids are revealed –Electronic Elections without trusted vote counter Correctness: votes are correctly counted Privacy: individual votes remain secret –And much more: Electronic payment systems, Authentication protocols, Privacy-preserving data-mining… Cryptographic Protocols Secure Multi-party Computation : “Any task that can be securely implemented using a trusted party, can be securely implemented without the trusted party” [Y82, GMW86]

The Classic Stand-Alone Model AliceBob One set of parties executing a single protocol in isolation.

On the Internet: Need Concurrent Security [DDN91,...] Many parties running many different protocol executions.

The Chess-master Problem 8am: Lose! 8pm:

Similar attack on Crypto protocols!

Man-in-the-middle Attacks Alice Bob a a b b MIM Initator ResponderResponder/Initiator Can make use of message from RIGHT in LEFT

Man-in-the-middle Attacks Alice Bob Alice: a Grrr! MIM Initator ResponderResponder/Initiator You are not Alice! Can make use of message from RIGHT in LEFT

Man-in-the-middle Attacks Alice Bob Alice: a Devil:a Bob:b Devil:b MIM Initator ResponderResponder/Initiator Can make use of message from RIGHT in LEFT

Commitment Scheme The “digital analogue” of sealed envelopes. Commitment Reveal Sender Receiver One of the most basic cryptographic tasks. natural abstraction many applications (zero-knowledge, coin-tossing, secure computation…) One way functions both sufficient and necessary [N’89, HILL’ 99]

Example: Closed Auctions C(  ) Auctioneer Bidder I Bidder II Would like to insure that bids are independent. Bidder II would have loved to set, e.g.  =  + 1. Definition of commitments does not rule this out! For most commitments, can actually create dependency. C(  ) ~ ~

Possible that v’ = v+1 Even though MIM does not know v! Receiver/Sender MIM C(v) C(v’) Sender Receiver

Non-Malleable Commitments [Dolev Dwork Naor’91] ij Receiver/Sender MIM C(v’) Sender Receiver C(v)

Non-Malleable Commitments [Dolev Dwork Naor’91] Receiver/Sender Non-malleability: if then, v’ is “independent” of v MIM C(i,v) C(j, v’) i  j Sender Receiver ij

Man-in-the-middle execution: Simulation: j i  ji  j Non-Malleable Commitments [Dolev Dwork Naor’91] ij Non-malleability: For every MIM, there exists a “simulator”, such that value committed by MIM is “indistinguishable” from value committed by simulator

Non-Malleable Commitments [Dolev Dwork Naor’91] ij Important in practice “Test-bed” for other tasks Applications to MPC

DDN: Encoding Names in Messages Initiator Responder ID = 010 For i = 1 to n: if ID i = 1 then –REAL exhange, –DUMMY exchange If ID i = 0 –DUMMY exchange –REAL exchange Iteration 1 Iteration 2 Iteration 3 IDEA: make sure that at some point a MIM needs to either: speak alone give REAL when hearing DUMMY

InitiatorResponder ID = 010 ID’ = 110 Responder/Initiator If ID  ID’, there exist iteration such that MIM gives REAL but receives DUMMY DDN: Encoding Names in Messages

Non-malleable Commitments Original Work by [DDN’91] –Based on any one-way function (OWF) –But: O(log n) rounds Main question: how many rounds do we need? With “trusted set-up” solved: 1-round, OWF: [DIO’99,DKO,CF,FF,…,DG] Without set-up: [Barak’02]: O(1)-round Subexp CRH + dense crypto: [P’04,P-Rosen’05]: O(1) rounds using CRH [Lin-P’09]: O(1)^log* n round using OWF [P-Wee’10]: O(1) using Subexp OWF [Wee’10]: O(log^* n) using OWF “Non BB”

Non-malleable Commitments Original Work by [DDN’91] –Based on any one-way function (OWF) –But: O(log n) rounds Main question: how many rounds do we need? With “trusted set-up” solved: 1-round, OWF: [DIO’99,DKO,CF,FF,…,DG] Without set-up: O(1)-round from CRH or Subexp OWF O(log^* n) from OWF

Main Theorem [Lin-P’10]: Thm: Assume one-way functions. Then there exists a O(1)- round non-malleable commitment. Note: Since commitment schemes imply OWF, we have that unconditionally that any commitments scheme can be turned into one that is O(1)-round and non-malleable. Note: As we shall see, this also weakens assumptions for O(1)-round secure multi-party computation.

The Idea: What if we could run “message scheduling in the head”? Let us focus on non-aborting and synchronizing adversaries. (never send invalid messages in left exec)

c=C(v) Com(id,v): I know v s.t. c=C(v) Or I have “seen” sequence WI-POK id = 00101

Signature Chains Consider 2 “fixed-length” signature schemes Sig 0, Sig 1 (i.e., signatures are always of length n) with keys vk 0, vk 1. Def: (s,id) is a signature-chain if for all i, s i+1 is a signature of “(i,s 0 )” using scheme id i s 0 = r s 1 = Sig 0 (0,s 0 )id 1 = 0 s 2 = Sig 0 (1,s 1 )id 2 = 0 s 3 = Sig 1 (2,s 2 )id 3 = 1 s 4 = Sig 0 (3,s 3 )id 4 = 0

Signature Games You have given vk 0, vk 1 and you have access to signing oracles Sig 0, Sig 1. Let  denote the access pattern to the oracle; –that is  i = b if in the i’th iteraction you access oracle b. Claim: If you output a signature-chain (s,id) Then, w.h.p, id is a substring of the access pattern .

c=C(v) Com(id,v): I know v s.t. c=C(v) Or I have “seen” sequence WI-POK id = vk 0 r0r0 Sign 0 (r 0 ) vk 1 r1r1 Sign 1 (r 1 )

c=C(v) Com(id,v): WI-POK id = vk 0 r0r0 Sign 0 (r 0 ) vk 1 r1r1 Sign 0 (r 1 ) I know v s.t. c=C(v) Or I know a sig-chain (s,id) w.r.t id

c=C(v) WI-POK vk 0 r0r0 Sign 0 (r 0 ) vk 1 r1r1 Sign 1 (r 1 ) c=C(v) WI-POK vk 0 r0r0 Sign 0 (r 0 ) vk 1 r1r1 Sign 1 (r 1 ) w.r.t i i = j = w.r.t j Non-malleability through dance

Dealing with Aborting Adversaries Problem 1: –MIM will notice that I ask him to sign a signature chain –Solution: Don’t. Ask him to sign commitments of sigs… Problem 2: –I might have to “rewind” many times on left to get a single signature –So if I have id = 01011, access pattern on the right is 0*1*0*1*... –Solution: Use 3 keys (0,1,2); require chain w.r.t 2id 1 2id 2 2id 3 …

Main Theorem An application Thm: Assume one-way functions. Then there exists a O(1)- round non-malleable commitment. log* vs O(1)?

Secure Multi-party Computation [Yao,GMW] A set of parties with private inputs. Wish to jointly compute a function of their inputs while preserving privacy of inputs (as much as possible) Security must be preserved even if some of the parties are malicious.

Original work of [GMW87] –Trapdoor permutations (TDP), n rounds –(e.g., voting with 1M people => 1M rounds) More Recent: “Stronger assumptions, less rounds” –[KOS] TDP, dense cryptosystems, log n rounds TDP, CRH+dense crypto with SubExp sec, O(1)-rounds, non-BB –[P04] TDP, CRH, O(1)-round, non-BB Secure Multi-party Computation [Yao,GMW] Thm: Same assumption as GMW => O(1)-round protocol

What’s Next – Concurrency for General Interaction

What’s Next – Adaptive Hardness Consider the Factoring problem: Given the product N of 2 random n-bit primes p,q, can you provide the factorization Adaptive Factoring Problem: Given the product N of 2 random n-bit primes p,q, can you provide the factorization, if you have access to an oracle that factors all other N’ that are products of equal-length primes Are these problems equivalent? Unknown!

Adaptively-hard Commitments [Canetti-Lin-P’10] Commitment scheme that remains hiding even if Adv has access to a decommitment oracle Implies Non-malleability (and more!) Thm [CLP’10] Existence of commitments implies O(n^  )- round Adaptively-hard commitments What’s Next – Adaptive Hardness

Thank You