rixxc/masterthesis
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add N parameter to multi user games

Browse Source
This commit is contained in:
Aaron Kaiser
2023-07-13 11:18:07 +02:00
parent 8d6f37310c
commit 432581423f
9 changed files with 80 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
thesis/sections/mu_security_of_eddsa/mu-gamez_implies_mu-uf-nma.tex
View File

@@ -1,13 +1,13 @@
\subsection{MU-\igame $\overset{\text{ROM}}{\Rightarrow}$ MU-EUF-NMA}
\subsection{$N$-MU-\igame $\overset{\text{ROM}}{\Rightarrow}$ $N$-MU-EUF-NMA}
This section shows that MU-\igame implies MU-EUF-NMA security of the EdDSA signature scheme using the Random Oracle Model. The section starts by first providing an intuition of the proof followed by the detailed security proof.
This section shows that $N$-MU-\igame implies $N$-MU-EUF-NMA security of the EdDSA signature scheme using the Random Oracle Model. The section starts by first providing an intuition of the proof followed by the detailed security proof.
\paragraph{\underline{Introducing MU-\igame}} This game follows closely the definition of the \igame game. It again replaces the random oracle with the \ioracle oracle. The only difference to the \igame game is that the adversary gets access to $N$ public keys. The adversary again has to output a valid result for any commitment challenge pair generated by the \ioracle oracle for any of the public keys. The MU-\igame game is depicted in figure \ref{game:mu-igame}.
\paragraph{\underline{Introducing $N$-MU-\igame}} This game follows closely the definition of the \igame game. It again replaces the random oracle with the \ioracle oracle. The only difference to the \igame game is that the adversary gets access to $N$ public keys. The adversary again has to output a valid result for any commitment challenge pair generated by the \ioracle oracle for any of the public keys. The $N$-MU-\igame game is depicted in figure \ref{game:mu-igame}.
\begin{definition}[MU-\igame]
Let $n$ and $N$ be positive integers. For an adversary $\adversary{A}$, receiving $N$ public keys as input, we define its advantage in the MU-\igame as following:
\begin{definition}[$N$-MU-\igame]
Let $n$ and $N$ be positive integers. For an adversary $\adversary{A}$, receiving $N$ public keys as input, we define its advantage in the $N$-MU-\igame as following:
\[ \advantage{\adversary{A}}{\text{$N$-MU-\igame}}(\secparamter) \assign | \Pr[\text{MU-\igame}^{\adversary{A}} \Rightarrow 1] |. \]
\[ \advantage{\adversary{A}}{\text{$N$-MU-\igame}}(\secparamter) \assign | \Pr[\text{$N$-MU-\igame}^{\adversary{A}} \Rightarrow 1] |. \]
\end{definition}
\begin{figure}[h]
@@ -36,12 +36,12 @@ This section shows that MU-\igame implies MU-EUF-NMA security of the EdDSA signa
\begin{theorem}
\label{theorem:adv_mu-igame}
Let $\adversary{A}$ be an adversary against MU-\igame. Then,
Let $\adversary{A}$ be an adversary against $N$-MU-\igame. Then,
\[ \advantage{\adversary{A}}{\text{MU-EUF-NMA}}(\secparamter) = \advantage{\adversary{B}}{\text{MU-\igame}}(\secparamter). \]
\[ \advantage{\adversary{A}}{\text{$N$-MU-EUF-NMA}}(\secparamter) = \advantage{\adversary{B}}{\text{$N$-MU-\igame}}(\secparamter). \]
\end{theorem}
\paragraph{\underline{Proof Overview}} Like the single-user setting the adversary has to query the random oracle to get the hash value $H(\encoded{R}|\encoded{A_i}|m)$. Again the programmability of the random oracle can be used to embed the challenge from \ioracle oracle into the answer of the random oracle. By embedding the challenge from the \ioracle oracle answer into the answer of the random oracle, a valid forgery of the signature also becomes a valid solution for the MU-\igame game.
\paragraph{\underline{Proof Overview}} Like the single-user setting the adversary has to query the random oracle to get the hash value $H(\encoded{R}|\encoded{A_i}|m)$. Again the programmability of the random oracle can be used to embed the challenge from \ioracle oracle into the answer of the random oracle. By embedding the challenge from the \ioracle oracle answer into the answer of the random oracle, a valid forgery of the signature also becomes a valid solution for the $N$-MU-\igame game.
\paragraph{\underline{Formal Proof}}
@@ -72,16 +72,16 @@ This section shows that MU-\igame implies MU-EUF-NMA security of the EdDSA signa
\end{figure}
\begin{proof}
\item Now it is argued that the \ioracle oracle can be used to simulate the hash function in a way that the answer of the MU-EUF-NMA adversary can be used as an valid solution for the MU-\igame challenger.
\item Now it is argued that the \ioracle oracle can be used to simulate the hash function in a way that the answer of the $N$-MU-EUF-NMA adversary can be used as an valid solution for the $N$-MU-\igame challenger.
\item Let $G_0$ be defined in figure \ref{fig:mu-igame_implies_mu-uf-nma}. Then $G_0$ is the same as MU-EUF-NMA with EdDSA. By definition,
\item Let $G_0$ be defined in figure \ref{fig:mu-igame_implies_mu-uf-nma}. Then $G_0$ is the same as $N$-MU-EUF-NMA with EdDSA. By definition,
\[ \advantage{\text{EdDSA}, \adversary{A}}{\text{MU-EUF-NMA}}(\secparamter) = \Pr[\text{MU-EUF-NMA}^{\adversary{A}} \Rightarrow 1 ] = \Pr[G_0^{\adversary{A}} \Rightarrow 1]. \]
\[ \advantage{\text{EdDSA}, \adversary{A}}{\text{$N$-MU-EUF-NMA}}(\secparamter) = \Pr[\text{$N$-MU-EUF-NMA}^{\adversary{A}} \Rightarrow 1 ] = \Pr[G_0^{\adversary{A}} \Rightarrow 1]. \]
\item $G_0$ is well-prepared to show that there exists an adversary $\adversary{B}$ satisfying
\begin{align}
\Pr[G_0^{\adversary{A}} \Rightarrow 1] = \advantage{\group{G}, \adversary{B}}{\text{MU-\igame}}(\secparamter). \label{eq:adv_mu-igame}
\Pr[G_0^{\adversary{A}} \Rightarrow 1] = \advantage{\group{G}, \adversary{B}}{\text{$N$-MU-\igame}}(\secparamter). \label{eq:adv_mu-igame}
\end{align}
\begin{figure}[h]
@@ -108,7 +108,7 @@ This section shows that MU-\igame implies MU-EUF-NMA security of the EdDSA signa
\label{fig:adversary_mu-igame}
\end{figure}
\item To proof (\ref{eq:adv_mu-igame}), we define an adversary $\adversary{B}$ attacking MU-\igame that simulates $\adversary{A}$'s view in $G_0$. Adversary $\adversary{B}$ formally defined in figure \ref{fig:adversary_mu-igame} is run in the \igame game and adversary $\adversary{B}$ simulates the random oracle $H$ for the adversary $\adversary{A}$. $H$ is perfectly simulated because the \ioracle oracle also outputs a uniformly random 2b-bit bitstring. For this reason, $H$ returns a uniformly random 2b-bit bitstring for all queries, as expected.
\item To proof (\ref{eq:adv_mu-igame}), we define an adversary $\adversary{B}$ attacking $N$-MU-\igame that simulates $\adversary{A}$'s view in $G_0$. Adversary $\adversary{B}$ formally defined in figure \ref{fig:adversary_mu-igame} is run in the \igame game and adversary $\adversary{B}$ simulates the random oracle $H$ for the adversary $\adversary{A}$. $H$ is perfectly simulated because the \ioracle oracle also outputs a uniformly random 2b-bit bitstring. For this reason, $H$ returns a uniformly random 2b-bit bitstring for all queries, as expected.
Finally, consider $\adversary{A}$'s output $(\m^*, \signature^* \assign (\encoded{R}, S))$. It is known that:
@@ -119,7 +119,7 @@ This section shows that MU-\igame implies MU-EUF-NMA security of the EdDSA signa
\groupelement{R}' &= 2^c S \groupelement{B} - 2^c \ioracle(\groupelement{R}') \groupelement{A_i}
\end{align*}
Therefore, $S$ is a valid solution for the MU-\igame game.
Therefore, $S$ is a valid solution for the $N$-MU-\igame game.
\item This proves theorem \ref{theorem:adv_mu-igame}.
\end{proof}

42
thesis/sections/mu_security_of_eddsa/mu-uf-nma_implies_mu-suf-cma.tex
View File

@@ -1,15 +1,15 @@
\subsection{MU-EUF-NMA $\overset{\text{ROM}}{\Rightarrow}$ $\text{MU-SUF-CMA}_{\text{EdDSA sp}}$}
\subsection{$N$-MU-EUF-NMA $\overset{\text{ROM}}{\Rightarrow}$ $\text{$N$-MU-SUF-CMA}_{\text{EdDSA sp}}$}
This section shows that the MU-EUF-NMA security of the EdDSA signature scheme implies the MU-SUF-CMA security of the EdDSA signature scheme using the random oracle model. The section starts with providing an intuition of the proof, followed by the detailed security proof.
This section shows that the $N$-MU-EUF-NMA security of the EdDSA signature scheme implies the $N$-MU-SUF-CMA security of the EdDSA signature scheme using the random oracle model. The section starts with providing an intuition of the proof, followed by the detailed security proof.
\begin{theorem}
\label{theorem:adv_mu-uf-nma}
Let $n$ and $N$ be positive integer and $\adversary{A}$ an adversary against MU-SUF-CMA, receiving $N$ public keys and making at most $\hashqueries$ hash queries and $\oraclequeries$ oracle queries. Then,
Let $n$ and $N$ be positive integer and $\adversary{A}$ an adversary against $N$-MU-SUF-CMA, receiving $N$ public keys and making at most $\hashqueries$ hash queries and $\oraclequeries$ oracle queries. Then,
\[ \advantage{\adversary{A}}{\text{MU-\cma}}(\secparamter) \leq \advantage{\adversary{B}}{\text{MU-EUF-NMA}}(\secparamter) + \frac{\oraclequeries \hashqueries \lceil \frac{2^{2b} - 1}{L} \rceil}{2^{2b}}. \]
\[ \advantage{\adversary{A}}{\text{$N$-MU-\cma}}(\secparamter) \leq \advantage{\adversary{B}}{\text{$N$-MU-EUF-NMA}}(\secparamter) + \frac{\oraclequeries \hashqueries \lceil \frac{2^{2b} - 1}{L} \rceil}{2^{2b}}. \]
\end{theorem}
\paragraph{\underline{Proof Overview}} This proof closely follows the proof in section \ref{proof:uf-nma_implies_suf-cma}. The only difference of both security notions is the absence of the \Osign oracle in MU-EUF-NMA. For this reason, the reduction must simulate the \Osign oracle without the knowledge of the private keys. This is achieved by generating a valid and well-distributed tuple of commitment, challenge, and response using the \simalg procedure, introduced in section \ref{proof:uf-nma_implies_suf-cma}, and then programming the random oracle to output that challenge for the corresponding input. The different games are shown in figure \ref{fig:mu-uf-nma_implies_mu-suf-cma_games}.
\paragraph{\underline{Proof Overview}} This proof closely follows the proof in section \ref{proof:uf-nma_implies_suf-cma}. The only difference of both security notions is the absence of the \Osign oracle in $N$-MU-EUF-NMA. For this reason, the reduction must simulate the \Osign oracle without the knowledge of the private keys. This is achieved by generating a valid and well-distributed tuple of commitment, challenge, and response using the \simalg procedure, introduced in section \ref{proof:uf-nma_implies_suf-cma}, and then programming the random oracle to output that challenge for the corresponding input. The different games are shown in figure \ref{fig:mu-uf-nma_implies_mu-suf-cma_games}.
\paragraph{\underline{Formal Proof}}
@@ -83,11 +83,11 @@ This section shows that the MU-EUF-NMA security of the EdDSA signature scheme im
\end{figure}
\begin{proof}
\item Now the original MU-SUF-CMA game is manipulated in a way that makes it possible to simulate signatures without the knowledge of the secret key. During each of the game-hops the probability for an adversary to detect this change is upper bounded.
\item Now the original $N$-MU-SUF-CMA game is manipulated in a way that makes it possible to simulate signatures without the knowledge of the secret key. During each of the game-hops the probability for an adversary to detect this change is upper bounded.
\item \paragraph{\underline{$G_0:$}} Let $G_0$ be defined in figure \ref{fig:mu-uf-nma_implies_mu-suf-cma_games} by excluding all boxes except the black one. $G_0$ is the MU-SUF-CMA for EdDSA. By definition,
\item \paragraph{\underline{$G_0:$}} Let $G_0$ be defined in figure \ref{fig:mu-uf-nma_implies_mu-suf-cma_games} by excluding all boxes except the black one. $G_0$ is the $N$-MU-SUF-CMA for EdDSA. By definition,
\[ \advantage{\text{EdDSA},\adversary{A}}{\text{MU-}\cma}(\secparamter) = \Pr[\text{\text{MU-}\cma}^{\adversary{A}} \Rightarrow 1] = \Pr[G_0^{\adversary{A}} \Rightarrow 1]. \]
\[ \advantage{\text{EdDSA},\adversary{A}}{\text{$N$-MU-}\cma}(\secparamter) = \Pr[\text{\text{$N$-MU-}\cma}^{\adversary{A}} \Rightarrow 1] = \Pr[G_0^{\adversary{A}} \Rightarrow 1]. \]
\item \paragraph{\underline{$G_1:$}} $G_1$ now is defined by replacing the black box with the blue one. This change inlines the call to the hash function and introduces a bad flag, which is set if the hash value is already set. The bad flag being set represents cases where the adversary already queried the random oracle for the challenge used for that signature and therefore the random oracle cannot be programmed. This results in the challenger not being able to produce a valid signature. This change is only conceptual, as it does not alter the behavior of the oracle. Therefore,
@@ -104,7 +104,7 @@ This section shows that the MU-EUF-NMA security of the EdDSA signature scheme im
\item Finally, Game $G_3$ is well prepared to show that there exists an adversary $\adversary{B}$ satisfying
\begin{align}
\Pr[G_3^{\adversary{A}} \Rightarrow 1] = \advantage{\adversary{B}}{\text{MU-EUF-NMA}}(\secparamter). \label{eq:adv_mu-uf-nma}
\Pr[G_3^{\adversary{A}} \Rightarrow 1] = \advantage{\adversary{B}}{\text{$N$-MU-EUF-NMA}}(\secparamter). \label{eq:adv_mu-uf-nma}
\end{align}
\begin{figure}[h]
@@ -136,11 +136,11 @@ This section shows that the MU-EUF-NMA security of the EdDSA signature scheme im
\State \Return $\sum[m]$
\end{algorithmic}
\hrule
\caption{Adversary $\adversary{B}$ breaking $\text{MU-EUF-NMA}$}
\caption{Adversary $\adversary{B}$ breaking $\text{$N$-MU-EUF-NMA}$}
\label{fig:adversaryb_mu-uf-nma}
\end{figure}
To prove (\ref{eq:adv_mu-uf-nma}), we define an adversary $\adversary{B}$ attacking $\text{MU-EUF-NMA}$ that simulates $\adversary{A}$'s view in $G_2$. Adversary $\adversary{B}$ formally defined in figure \ref{fig:adversaryb_mu-uf-nma} is run in the $\text{MU-EUF-NMA}$ game and adversary $\adversary{B}$ simulates \Osign for adversary $\adversary{A}$. \Osign is simulated perfectly.
To prove (\ref{eq:adv_mu-uf-nma}), we define an adversary $\adversary{B}$ attacking $\text{$N$-MU-EUF-NMA}$ that simulates $\adversary{A}$'s view in $G_2$. Adversary $\adversary{B}$ formally defined in figure \ref{fig:adversaryb_mu-uf-nma} is run in the $\text{$N$-MU-EUF-NMA}$ game and adversary $\adversary{B}$ simulates \Osign for adversary $\adversary{A}$. \Osign is simulated perfectly.
Finally, consider $\adversary{A}$ output $(\m^*, \signature^* \assign (\encoded{R^*}, S^*))$. Every valid signature outputted by adversary $\adversary{A}$ has to fulfill the following equation for one public key $\groupelement{A_i}$: $2^c S \groupelement{B} = 2^c R + 2^c H'(\encoded{R}|\encoded{A_i}|m) \groupelement{A_i}$. Again there is only one valid encoded $S$ for each $\groupelement{R}$, $m$, $\groupelement{A_i}$ tuple that satisfies the verification equation. For the signature to be a valid forgery it must not be outputted by the \Osign oracle for this specific $m^*$ and $\groupelement{A_i}$. No new valid signature can be generated from a valid one by just changing the $S$ value. This means that either $\groupelement{R}$, $m$ or $\groupelement{A_i}$ have to be changed to generate a new valid signature from an already valid signature. Since all these parameters are part of the hash query to generate the challenge the resulting hash value has to be forwarded from the $H$ hash oracle provided to the adversary $\adversary{B}$. For this reason $H'(\encoded{R^*}|\encoded{A_i}|m^*) = H(\encoded{R^*}|\encoded{A_i}|m^*)$. Hence,
@@ -149,22 +149,22 @@ This section shows that the MU-EUF-NMA security of the EdDSA signature scheme im
\Leftrightarrow 2^c S^* \groupelement{B} &= 2^c \groupelement{R^*} + 2^c H(\encoded{R^*}|\encoded{A_i}|m^*) \groupelement{A_i}
\end{align*}
Since the public keys and the results of the hash queries are forwarded from the MU-EUF-NMA challenger the forged signature from $\adversary{A}$ in the MU-\cma game is also a valid forgery for the MU-EUF-NMA challenger.
Since the public keys and the results of the hash queries are forwarded from the $N$-MU-EUF-NMA challenger the forged signature from $\adversary{A}$ in the $N$-MU-\cma game is also a valid forgery for the $N$-MU-EUF-NMA challenger.
\item In the main procedure the adversary $\adversary{B}$ simply calls adversary $\adversary{A}$ and outputs its forged signature. To simulate the hash function $\adversary{B}$ simply forwards the queries to adversary $\adversary{A}$ and to a signature $\adversary{B}$ obtains the pair of commitment, challenge, and solution from the \simalg procedure, which is just samples two values and calculates the last one using a simple equation, and then programs its random oracle. Therefore, the runtime of adversary $\adversary{B}$ is roughly the same as the runtime of adversary $\adversary{A}$.
\item This proves theorem \ref{theorem:adv_mu-uf-nma}.
\end{proof}
\subsection{MU-EUF-NMA $\overset{\text{ROM}}{\Rightarrow}$ $\text{MU-EUF-CMA}_{\text{EdDSA lp}}$}
\subsection{$N$-MU-EUF-NMA $\overset{\text{ROM}}{\Rightarrow}$ $\text{$N$-MU-EUF-CMA}_{\text{EdDSA lp}}$}
This section shows that MU-EUF-NMA security of EdDSA implies the MU-EUF-CMA security of EdDSA with lax parsing used in the random oracle model. This proof is very similar to the proof MU-SUF-CMA proof of EdDSA with strict parsing. The modification to the games are the same as in the proof above with the only modifications being in the win condition, which is $\exists j \in \{1,2,...,N\}: \verify(\groupelement{A_j}, \m^*) \wedge (\groupelement{A_j}, \m^*) \notin \pset{Q}$. For this reason this proof starts at showing the existence of an adversary $\adversary{B}$ breaking MU-EUF-NMA security. Similar to the proof in the single-user setting, the SUF-CMA security of EdDSA with lax parsing cannot be shown, as there are multiple valid encodings of $S$ for one signature. This way the adversary would be able to generate a new valid signature from an obtained one by simply choosing a different encoding of $S$. This would result in the output of $H'(\encoded{R^*}|\encoded{A}|m^*)$ being programmed by the reduction itself and therefore the signature not being valid for the EUF-NMA challenger.
This section shows that $N$-MU-EUF-NMA security of EdDSA implies the $N$-MU-EUF-CMA security of EdDSA with lax parsing used in the random oracle model. This proof is very similar to the proof $N$-MU-SUF-CMA proof of EdDSA with strict parsing. The modification to the games are the same as in the proof above with the only modifications being in the win condition, which is $\exists j \in \{1,2,...,N\}: \verify(\groupelement{A_j}, \m^*) \wedge (\groupelement{A_j}, \m^*) \notin \pset{Q}$. For this reason this proof starts at showing the existence of an adversary $\adversary{B}$ breaking $N$-MU-EUF-NMA security. Similar to the proof in the single-user setting, the SUF-CMA security of EdDSA with lax parsing cannot be shown, as there are multiple valid encodings of $S$ for one signature. This way the adversary would be able to generate a new valid signature from an obtained one by simply choosing a different encoding of $S$. This would result in the output of $H'(\encoded{R^*}|\encoded{A}|m^*)$ being programmed by the reduction itself and therefore the signature not being valid for the EUF-NMA challenger.
\begin{theorem}
\label{theorem:adv2_mu-uf-nma}
Let $n$ and $N$ be positive integers and $\adversary{A}$ an adversary against MU-EUF-CMA, receiving $N$ public keys and making at most $\hashqueries$ hash queries and $\oraclequeries$ oracle queries. Then,
Let $n$ and $N$ be positive integers and $\adversary{A}$ an adversary against $N$-MU-EUF-CMA, receiving $N$ public keys and making at most $\hashqueries$ hash queries and $\oraclequeries$ oracle queries. Then,
\[ \advantage{\adversary{A}}{\text{MU-EUF-CMA}}(\secparamter) \leq \advantage{\adversary{B}}{\text{MU-EUF-NMA}}(\secparamter) + \frac{\oraclequeries \hashqueries \lceil \frac{2^{2b} - 1}{L} \rceil}{2^{2b}}. \]
\[ \advantage{\adversary{A}}{\text{$N$-MU-EUF-CMA}}(\secparamter) \leq \advantage{\adversary{B}}{\text{$N$-MU-EUF-NMA}}(\secparamter) + \frac{\oraclequeries \hashqueries \lceil \frac{2^{2b} - 1}{L} \rceil}{2^{2b}}. \]
\end{theorem}
\paragraph{\underline{Formal Proof}}
@@ -172,7 +172,7 @@ This section shows that MU-EUF-NMA security of EdDSA implies the MU-EUF-CMA secu
\begin{proof}
\item
\begin{align}
\Pr[G_3^{\adversary{A}} \Rightarrow 1] = \advantage{\adversary{B}}{\text{MU-EUF-NMA}}(\secparamter). \label{eq:adv2_mu-uf-nma}
\Pr[G_3^{\adversary{A}} \Rightarrow 1] = \advantage{\adversary{B}}{\text{$N$-MU-EUF-NMA}}(\secparamter). \label{eq:adv2_mu-uf-nma}
\end{align}
\begin{figure}[h]
@@ -204,20 +204,20 @@ This section shows that MU-EUF-NMA security of EdDSA implies the MU-EUF-CMA secu
\State \Return $\sum[m]$
\end{algorithmic}
\hrule
\caption{Adversary $\adversary{B}$ breaking $\text{MU-EUF-NMA}$}
\caption{Adversary $\adversary{B}$ breaking $\text{$N$-MU-EUF-NMA}$}
\label{fig:adversary_b_mu-uf-nma}
\end{figure}
To prove (\ref{eq:adv2_mu-uf-nma}), we define an adversary $\adversary{B}$ attacking MU-EUF-NMA that simulates $\adversary{A}$'s view on $G_3$. Adversary $\adversary{B}$, formally defined in figure \ref{fig:adversary_b_mu-uf-nma}, is run in the MU-EUF-NMA game and simulates \Osign for adversary $\adversary{A}$. \Osign is simulated perfectly.
To prove (\ref{eq:adv2_mu-uf-nma}), we define an adversary $\adversary{B}$ attacking $N$-MU-EUF-NMA that simulates $\adversary{A}$'s view on $G_3$. Adversary $\adversary{B}$, formally defined in figure \ref{fig:adversary_b_mu-uf-nma}, is run in the $N$-MU-EUF-NMA game and simulates \Osign for adversary $\adversary{A}$. \Osign is simulated perfectly.
Finally, consider $\adversary{A}$ output $(\m^*, \signature^* \assign (\encoded{R^*}, S^*))$. Every valid signature outputted by adversary $\adversary{A}$ has to fulfill the following equation for one public key $\groupelement{A_i}$: $2^c S \groupelement{B} = 2^c R + 2^c H'(\encoded{R}|\encoded{A_i}|m) \groupelement{A_i}$. Like in the single-user setting the adversary can create a new valid signature from an already valid one by choosing a different bitstring representation of the $S$ value that maps to the same $S \pmod L$. Since we are in the MU-EUF-CMA setting the adversary has to forge a signature for a message $m^*$ and public key $A_i$ to which it has not queried a signature before. For this reason, the output of $H'(\encoded{R^*}|\encoded{A_i}|m^*)$ has not been set by the adversary $\adversary{B}$, but was forwarded from the $H$ hash oracle provided by the MU-EUF-NMA challenger. For this reason $H'(\encoded{R^*}|\encoded{A_i}|m^*) = H(\encoded{R^*}|\encoded{A_i}|m^*)$. Therefore,
Finally, consider $\adversary{A}$ output $(\m^*, \signature^* \assign (\encoded{R^*}, S^*))$. Every valid signature outputted by adversary $\adversary{A}$ has to fulfill the following equation for one public key $\groupelement{A_i}$: $2^c S \groupelement{B} = 2^c R + 2^c H'(\encoded{R}|\encoded{A_i}|m) \groupelement{A_i}$. Like in the single-user setting the adversary can create a new valid signature from an already valid one by choosing a different bitstring representation of the $S$ value that maps to the same $S \pmod L$. Since we are in the $N$-MU-EUF-CMA setting the adversary has to forge a signature for a message $m^*$ and public key $A_i$ to which it has not queried a signature before. For this reason, the output of $H'(\encoded{R^*}|\encoded{A_i}|m^*)$ has not been set by the adversary $\adversary{B}$, but was forwarded from the $H$ hash oracle provided by the $N$-MU-EUF-NMA challenger. For this reason $H'(\encoded{R^*}|\encoded{A_i}|m^*) = H(\encoded{R^*}|\encoded{A_i}|m^*)$. Therefore,
\begin{align*}
2^c S^* \groupelement{B} &= 2^c \groupelement{R^*} + 2^c H'(\encoded{R^*}|\encoded{A_i}|m^*) \groupelement{A_i}\\
\Leftrightarrow 2^c S^* \groupelement{B} &= 2^c \groupelement{R^*} + 2^c H(\encoded{R^*}|\encoded{A_i}|m^*) \groupelement{A_i}.
\end{align*}
This shows that the forged signature from adversary $\adversary{A}$ is also a valid forged signature for the MU-EUF-NMA challenger.
This shows that the forged signature from adversary $\adversary{A}$ is also a valid forged signature for the $N$-MU-EUF-NMA challenger.
\item Since the adversary $\adversary{B}$ is the same as in the proof above, its runtime is roughly the same as the runtime of adversary $\adversary{A}$, for the same reason.

28
thesis/sections/mu_security_of_eddsa/omdl'_implies_mu-gamez.tex
View File

@@ -1,8 +1,8 @@
\subsection{\somdl $\overset{\text{AGM}}{\Rightarrow}$ MU-\igame}
\subsection{\somdl $\overset{\text{AGM}}{\Rightarrow}$ $N$-MU-\igame}
This section shows that \somdl implies MU-\igame using the algebraic group model. The section starts by introducing a special variant of the one-more discrete logarithm problem followed by an intuition of the proof and at last giving a detailed security proof. The reduction cannot be directly performed using the \sdlog assumption, since the representation of the commitment contains more than one group element with unknown discrete logarithm, because the adversary against MU-\igame receives multiple public keys as input. Therefore, a new assumption, based on the one-more discrete logarithm assumption, has to be introduced.
This section shows that \somdl implies $N$-MU-\igame using the algebraic group model. The section starts by introducing a special variant of the one-more discrete logarithm problem followed by an intuition of the proof and at last giving a detailed security proof. The reduction cannot be directly performed using the \sdlog assumption, since the representation of the commitment contains more than one group element with unknown discrete logarithm, because the adversary against $N$-MU-\igame receives multiple public keys as input. Therefore, a new assumption, based on the one-more discrete logarithm assumption, has to be introduced.
\paragraph{\underline{Introducing \somdl}} Similar to \sdlog, which is a variant of the discrete logarithm problem the \somdl is a variant of the one-more discrete logarithm problem, which represents the special distribution of secret keys resulting from the key generation algorithm of the EdDSA signature scheme. The only differences to the original one-more discrete logarithm game as introduced in \cite{JC:BNPS03} are that the secret scalars are chosen from the set $\{2^{n-1}, 2^{n-1} + 2^c, ..., 2^{n} - 2^c\}$ which represents all valid secret scalars regarding the key generation algorithm and that the adversary is only able to query $N-1$ discrete logarithms of the challenge group elements at once. This modification makes the assumption weaker than the original one-more discrete logarithm assumption. A lower bound on the hardness of the \somdl problem is further analyzed in section \ref{sec:somdl}. The \somdl game is illustrated in figure \ref{fig:somdl}.
\paragraph{\underline{Introducing \somdl}} Similar to \sdlog, which is a variant of the discrete logarithm problem the \somdl is a variant of the one-more discrete logarithm problem, which represents the special distribution of secret keys resulting from the key generation algorithm of the EdDSA signature scheme. The only differences to the original one-more discrete logarithm game as introduced in \cite{JC:BNPS03} are that the secret scalars are chosen from the set $\{2^{n-1}, 2^{n-1} + 2^c, ..., 2^{n} - 2^c\}$ which represents all valid secret scalars regarding the key generation algorithm and that the adversary is only able to query $N-1$ discrete logarithms of the challenge group elements at once. This modification makes the assumption weaker than the original one-more discrete logarithm assumption. Since the resulting game is similar to the $N$-discrete logarithm problem with an additinal \textit{Reveal} query, it is called \somdl. A lower bound on the hardness of the \somdl problem is further analyzed in section \ref{sec:somdl}. The \somdl game is illustrated in figure \ref{fig:somdl}.
\begin{definition}[\somdl]
\label{def:somdl}
@@ -20,12 +20,12 @@ This section shows that \somdl implies MU-\igame using the algebraic group model
\State \textbf{for} $i \in \{1,2,...,N\}$
\State \quad $a_i \randomsample \{ 2^{n-1}, 2^{n-1} + 2^c, ..., 2^{n} - 2^c \}$
\State \quad $\groupelement{A_i} \assign a_i \groupelement{B}$
\State $(a'_1, a'_2, ..., a'_N) \randomassign \adversary{A}^{DL(\inp)}(\groupelement{A_1}, \groupelement{A_2}, ..., \groupelement{A_N})$
\State $(a'_1, a'_2, ..., a'_N) \randomassign \adversary{A}^{Reveal(\inp)}(\groupelement{A_1}, \groupelement{A_2}, ..., \groupelement{A_N})$
\State \Return $(a_1, a_2, ..., a_N) \test (a'_1, a'_2, ..., a'_N)$
\end{algorithmic}
\vspace{2mm}
\begin{algorithmic}
\Statex \underline{\oracle $DL(j \in \{1,2,...,N\})$}
\Statex \underline{\oracle $Reveal(j \in \{1,2,...,N\})$}
\Comment{max. one query}
\vspace{1mm}
\State \Return $\{a_i|i \in \{1,2,...,N\}\backslash \{j\}\}$
@@ -40,10 +40,10 @@ This section shows that \somdl implies MU-\igame using the algebraic group model
\label{theorem:adv_omdl'}
Let $\adversary{A}$ be an adversary against \igame with $\group{G}$ being a cyclic group of prime order $L$, receiving $N$ public keys and making at most $\oraclequeries$ oracle queries. Then
\[ \advantage{\group{G},\adversary{A}}{\text{MU-\igame}}(\secparamter) \leq \advantage{\group{G},\adversary{B}}{\somdl}(\secparamter) + \frac{\oraclequeries N \lceil \frac{2^{2b} - 1}{L} \rceil}{2^{2b}}. \]
\[ \advantage{\group{G},\adversary{A}}{\text{$N$-MU-\igame}}(\secparamter) \leq \advantage{\group{G},\adversary{B}}{\somdl}(\secparamter) + \frac{\oraclequeries N \lceil \frac{2^{2b} - 1}{L} \rceil}{2^{2b}}. \]
\end{theorem}
\paragraph{\underline{Proof Overview}} In the multi-user setting the adversary gets access to not only the generator $\groupelement{B}$ and one public key $\groupelement{A}$ but rather a set of public keys $\groupelement{A_1}$ to $\groupelement{A_N}$. For this reason, the representation of a group element, the adversary has to provide, looks the following: $\groupelement{R} = r_1 \groupelement{B} + r_2 \groupelement{A_1} + ... + r_{N+1} \groupelement{A_N}$. Since there are multiple group elements with unknown discrete logarithms it is not possible to directly calculate the discrete logarithm of one of the public keys given a valid forgery of a signature. Upon receiving a valid solution the \textit{DL} oracle can be used to get the discrete logarithm of all the public keys except the one for which the solution is valid. This way it is again possible to construct a representation looking like $\groupelement{R} = r_1 \groupelement{B} + r_2 \groupelement{A_i}$. Then it is again possible to calculate the discrete logarithm of $\groupelement{A_i}$ and win the \somdl game.
\paragraph{\underline{Proof Overview}} In the multi-user setting the adversary gets access to not only the generator $\groupelement{B}$ and one public key $\groupelement{A}$ but rather a set of public keys $\groupelement{A_1}$ to $\groupelement{A_N}$. For this reason, the representation of a group element, the adversary has to provide, looks the following: $\groupelement{R} = r_1 \groupelement{B} + r_2 \groupelement{A_1} + ... + r_{N+1} \groupelement{A_N}$. Since there are multiple group elements with unknown discrete logarithms it is not possible to directly calculate the discrete logarithm of one of the public keys given a valid forgery of a signature. Upon receiving a valid solution the \textit{Reveal} oracle can be used to get the discrete logarithm of all the public keys except the one for which the solution is valid. This way it is again possible to construct a representation looking like $\groupelement{R} = r_1 \groupelement{B} + r_2 \groupelement{A_i}$. Then it is again possible to calculate the discrete logarithm of $\groupelement{A_i}$ and win the \somdl game.
\paragraph{\underline{Formal Proof}}
@@ -84,9 +84,9 @@ This section shows that \somdl implies MU-\igame using the algebraic group model
\begin{proof}
\item Now the individual game-hops are analyzed and the probability, that an adversary can distinguish between two games, is upper bounded.
\item \paragraph{\underline{$G_0$:}} Let $G_0$ be defined in figure \ref{fig:omdl'_implies_mu-igame} by excluding all boxes. Clearly, $G_0$ is the MU-\igame. By definition,
\item \paragraph{\underline{$G_0$:}} Let $G_0$ be defined in figure \ref{fig:omdl'_implies_mu-igame} by excluding all boxes. Clearly, $G_0$ is the $N$-MU-\igame. By definition,
\[ \advantage{\group{G},\adversary{A}}{\text{MU-\igame}}(\secparamter) = \Pr[\text{MU-\igame}^{\adversary{A}} \Rightarrow 1] = \Pr[G_0^{\adversary{A}} \Rightarrow 1]. \]
\[ \advantage{\group{G},\adversary{A}}{\text{$N$-MU-\igame}}(\secparamter) = \Pr[\text{$N$-MU-\igame}^{\adversary{A}} \Rightarrow 1] = \Pr[G_0^{\adversary{A}} \Rightarrow 1]. \]
\item \paragraph{\underline{$G_1$:}} $G_1$ is defined by including the if condition in the blue box, which sets a bad flag if the randomly chosen value $\ch$ fulfills $2^c \ch \equiv - r_i \pmod L$ for any $i \in \{2,3,...,N+1\}$. This represents challenges $\ch$ to which the solution might not be usable to break the discrete logarithm of one of the public keys, due to $(r_i + 2^c \ch)$ not being invertible in $\field{L}$. Since only the bad flag is introduced this change does not influence the behavior of the game and is therefore only conceptual.
@@ -107,13 +107,13 @@ This section shows that \somdl implies MU-\igame using the algebraic group model
\large
\vspace{1mm}
\begin{algorithmic}
\Statex \underline{\textbf{Adversary} $\adversary{B}^{\textit{DL}(\inp)}(\groupelement{A_1}, \groupelement{A_2}, ..., \groupelement{A_N})$}
\Statex \underline{\textbf{Adversary} $\adversary{B}^{\textit{Reveal}(\inp)}(\groupelement{A_1}, \groupelement{A_2}, ..., \groupelement{A_N})$}
\State $s^* \randomassign \adversary{A}^{\ioracle(\inp)}(\groupelement{A_1}, \groupelement{A_2}, ..., \groupelement{A_N})$
\State \textbf{If} $\nexists (\agmgroupelement{R^*}{r^*}, \ch^*) \in Q, i \in \{1,2,...,N\}: \groupelement{R^*} = 2^c s^* \groupelement{B} - 2^c \ch^* \groupelement{A_i}$ \textbf{then}
\State \quad $abort$
\State Let $\groupelement{R^*} = r^*_1 \groupelement{B} + r^*_2 \groupelement{A_1} + ... + r^*_{N+1} \groupelement{A_N}$
\State $r_b \assign r_1$
\State $(a_1, ..., a_{i-1}, a_{i+1}, ..., a_N) \randomassign DL(i)$
\State $(a_1, ..., a_{i-1}, a_{i+1}, ..., a_N) \randomassign \textit{Reveal}(i)$
\State \textbf{for} $j \in \{1,2,...,N\} \backslash \{i\}$
\State \quad $r_b \assign r_b + r_{j+1} a_j$
\Comment{$\groupelement{A_j} = a_j \groupelement{B}$}
@@ -140,7 +140,7 @@ This section shows that \somdl implies MU-\igame using the algebraic group model
To prove (\ref{eq:adv_omdl'}), we define an adversary $\adversary{B}$ attacking \somdl that simulates $\adversary{A}$'s view in $G_2$. Adversary $\adversary{B}$ formally defined in figure \ref{fig:adversary_omdl'} is run in the \somdl game and adversary $\adversary{B}$ simulates \ioracle for adversary $\adversary{A}$. \ioracle is simulated perfectly.
Finally, consider $\adversary{A}$'s output $s^*$. It is known that $\groupelement{R^*} = 2^c s^* \groupelement{B} - 2^c \ch^* \groupelement{A_i}$ for one of the public keys and one tuple $(R^*, \ch^*)$ generated by the \ioracle oracle. Using the \textit{DL} oracle we can get the discrete logarithms of all public keys but the one, for which $s^*$ is a valid solution in the MU-\igame game. Together with the representation of $R^*$, provided during the \ioracle oracle call, and the discrete logarithms of the public keys we are able to generate a representation of $R^*$, which looks like $\groupelement{R^*} = r_b \groupelement{B} + r_i \groupelement{A_i}$. By equating both equations we get:
Finally, consider $\adversary{A}$'s output $s^*$. It is known that $\groupelement{R^*} = 2^c s^* \groupelement{B} - 2^c \ch^* \groupelement{A_i}$ for one of the public keys and one tuple $(R^*, \ch^*)$ generated by the \ioracle oracle. Using the \textit{Reveal} oracle we can get the discrete logarithms of all public keys but the one, for which $s^*$ is a valid solution in the $N$-MU-\igame game. Together with the representation of $R^*$, provided during the \ioracle oracle call, and the discrete logarithms of the public keys we are able to generate a representation of $R^*$, which looks like $\groupelement{R^*} = r_b \groupelement{B} + r_i \groupelement{A_i}$. By equating both equations we get:
\begin{align*}
r_b \groupelement{B} + r_i \groupelement{A_i} &= 2^c s^* \groupelement{B} - 2^c \ch^* \groupelement{A_i} \\
@@ -148,9 +148,9 @@ This section shows that \somdl implies MU-\igame using the algebraic group model
\Leftrightarrow \groupelement{A} &= (2^c s^* - r_b)(r_i + 2^c \ch^*)^{-1} \groupelement{B}
\end{align*}
Assuming that $r_i + 2^c \ch^*$ is invertible in $\field{L}$ (i.e., not equal to 0), which is ensured by the abort in $G_2$ for all $i$, both equations can be used to calculate the discrete logarithm of $A_i$. Together with the discrete logarithms of the other public keys, which were obtained by the \textit{DL} oracle, the adversary $\adversary{B}$ is able to craft a valid solution for the \somdl challenger.
Assuming that $r_i + 2^c \ch^*$ is invertible in $\field{L}$ (i.e., not equal to 0), which is ensured by the abort in $G_2$ for all $i$, both equations can be used to calculate the discrete logarithm of $A_i$. Together with the discrete logarithms of the other public keys, which were obtained by the \textit{Reveal} oracle, the adversary $\adversary{B}$ is able to craft a valid solution for the \somdl challenger.
\item The runtime of adversary $\adversary{B}$ is roughly the same as the runtime of adversary $\adversary{A}$. In the main procedure the adversary $\adversary{B}$ calls adversary $\adversary{A}$, queries the DL oracle and performs some simple calculations to obtain the discrete logarithm of all public keys. In the \ioracle the adversary simply samples a 2b bitstring uniformly at random.
\item The runtime of adversary $\adversary{B}$ is roughly the same as the runtime of adversary $\adversary{A}$. In the main procedure the adversary $\adversary{B}$ calls adversary $\adversary{A}$, queries the \textit{Reveal} oracle and performs some simple calculations to obtain the discrete logarithm of all public keys. In the \ioracle the adversary simply samples a 2b bitstring uniformly at random.
\item This proves theorem \ref{theorem:adv_omdl'}.
\end{proof}

1
thesis/sections/mu_security_of_eddsa/sections/mu_security_of_eddsa/mu-gamez_implies_mu-uf-nma.tex
View File

@@ -1 +0,0 @@
\section{MU-\igame $\Rightarrow$ MU-EUF-NMA}