1. BiTR: Built-in Tamper Resilience Joint work with Aggelos Kiayias (U. Connecticut) Tal Malkin (Columbia U.) Seung Geol Choi (U. Maryland)

2. Motivation Traditional cryptography –internal state: inaccessible to the adversary. In reality –Adv may access/affect the internal state –E.g., leaking, tampering Solution? –Make better hardware –Or, make better cryptography

3. In this work Focus on tampering hardware tokens In the universal composability framework

4. Modeling Tamper-Resilient Tokens in UC

5. Tamper-Proof Tokens [Katz07] Ideal functionality Create Forge ! Run …. Run

6. Tamperable Tokens Introduce new functionality Create ! Run Forge Tamper

7. Built-in Tamper Resilience (BiTR) M is -BiTR –In any environment w/ M deployed as a token, tampering gives no advantage: indistinguishable s.t.

8. Questions Are there BiTR tokens? –Yes, with affine tamperings. UC computation from tamperable tokens? –Generic UC computation from tamper-proof tokens [Katz07] –Yes, with affine tamperings.

9. Affine Tampering Adversary can apply an affine transformation on private data.

10. Schnorr Identification

11. Schnorr-token is affine BiTR

12. UC-secure Computation with Tamperable Tokens

13. Commitment Functionality m open ! m Complete for general UC computation.

14. DPG-commitment DPG: dual-mode parameter generation using hardware tokens Normal mode –Parameter is unconditionally hiding Extraction mode –The scheme becomes extractable commitment.

15. DPG-Commitment from DDH Parameter: Com(b) = Extraction Mode –DH tuple with –Trapdoor r allows extraction Normal Mode –Random tuple –Com is unconditionally hiding.

16. Realizing F mcom from tokens DPG-Parameter: (pS, pR) –S obtains pR, by running R’s token. –R obtains pS, by running S’s token. –exchange pS and pR Commit: (Com(m), dpgCom pS (m), π) –π: WI (same msg) or (pR from ext mode) Reveal: (m, π‘) –π': WI (Com(m)) or (pR: ext mode)

17. UC-security of the scheme The scheme –Commit: (Com(m), dpgCom pS (m), π) π: WI (same msg) or (pR from ext mode) –Reveal: (m, π‘) π': WI (Com(m)) or (pR: ext mode) S*: Make the pS extractable and extract m. R*: Make the pR extractable and equivocate.

18. DPG from tamperable tokens [Katz07] showed DPG-commitment –Unfortunately, the token description is not BiTR. –Our approach: Modify Katz’s scheme to be BiTR.

19. BiTR DPG

20. The protocol is affine BiTR –Similar to the case of Schnorr Compose with a BiTR signature –Okamato signature [Oka06] –In this case, the composition works.

21. Summary BiTR security –Affine BiTR protocols –UC computation from tokens tamperable w/ affin e functions In the paper – Composition of BiTR tokens – BiTR from deterministic non-malleable codes