rixxc/masterthesis
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Overhauled the introduction to the proofs in the single-user setting

Browse Source
This commit is contained in:
Aaron Kaiser
2023-05-24 17:19:25 +02:00
parent 871dc28f24
commit 7a2f8f575d
1 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
thesis/Abschlussarbeit.tex
View File

@@ -104,13 +104,27 @@ abstract
\section{The Security of EdDSA in a Single-User Setting}
This section takes a look at the single-user security of EdDSA. This is done by showing the \cma security of EdDSA assuming the security of a special version of the DLog problem. This special version is derived from the key generation procedure. Section \ref{sec:sdlog} provides a concrete bound on the security of this version of the DLog problem, which is a result of the special key generation algorithm used by EdDSA.
This section takes a closer look at the single-user security of the EdDSA signature scheme. This is done by sowing the SUF-CMA and EUF-CMA security of EdDSA with different styles of signature parsing. The security is under the \sdlog assumption. The \sdlog assumption is a variation of the original discrete logarithm problem, which takes the key clamping during the key generation algorithm of EdDSA into account.
The proof starts by showing that the UF-NMA security of EdDSA implies \cma / EUF-CMA security of EdDSA in the Random Oracle Model. Whether EdDSA is \cma or EUF-CMA secure is decided by how the integer $S$ is decoded during the verification of the Signature. The use of strict parsing ensures \cma security while the use of lax parsing only guaranties EUF-CMA security. This will be further analyzed in the security proof. Next an intermediate game is introduced onto which the UF-NMA security of EdDSA is reduced. At last, the security of the intermediate game is reduced onto the security of a special version of the discrete logarithm problem.
The two main theorems for the single user security of $\text{EdDSA}_{\text{sp}}$ and $\text{EdDSA}_{\text{lp}}$ are:
\begin{theorem}[Security of EdDSA with strict parsing in the single-user setting]
Let $\adversary{A}$ be an adversary against the SUF-CMA security of EdDSA with strict parsing, making at most $\hashqueries$ hash queries and $\oraclequeries$ oracle queries, and $\group{G}$ a group of prime order $L$. Then,
\[ \advantage{\group{G}, \adversary{A}}{\text{SUF-CMA}}(\secparamter) \leq \advantage{\group{G}, \adversary{B}}{\sdlog}(\secparamter) + \frac{2(\hashqueries + 1)}{2^b} + \frac{\oraclequeries \hashqueries + \oraclequeries}{2^{-\log_2(\lceil \frac{2^{2b} - 1}{L} \rceil 2^{-2b})}} \]
\end{theorem}
\begin{theorem}[Security of EdDSA with lax parsing in the single-user setting]
Let $\adversary{A}$ be an adversary against the SUF-CMA security of EdDSA with lax parsing, making at most $\hashqueries$ hash queries and $\oraclequeries$ oracle queries, and $\group{G}$ a group of prime order $L$. Then,
\[ \advantage{\group{G}, \adversary{A}}{\text{EUF-CMA}}(\secparamter) \leq \advantage{\group{G}, \adversary{B}}{\sdlog}(\secparamter) + \frac{2(\hashqueries + 1)}{2^b} + \frac{\oraclequeries \hashqueries + \oraclequeries}{2^{-\log_2(\lceil \frac{2^{2b} - 1}{L} \rceil 2^{-2b})}} \]
\end{theorem}
The proof begins by showing that the UF-NMA security of EdDSA implies the SUF-CMA/EUF-CMA security of EdDSA with different types of parsing in the random oracle model. With this step, subsequent proofs can be performed without worrying about signature generation, and a unified chain of reduction can be used to prove the security of EdDSA with both parsing variants. Next, an algebraic intermediate game \igame is introduced. This intermediate game serves as a separation for proofs in the random oracle model and those in the algebraic group model. Finally, the intermediate game \igame is reduced to the special discrete logarithm variant \sdlog.
The chain of reductions can be depicted as:
\[ \sdlog \Rightarrow \igame \Rightarrow \text{UF-NMA} \Rightarrow \cma_{\text{EdDSA with strict parsing}} / \text{EUF-CMA}_{\text{EdDSA with lax parsing}} \]
\[ \sdlog \overset{\text{AGM}}{\Rightarrow} \igame \overset{\text{ROM}}{\Rightarrow} \text{UF-NMA} \overset{\text{ROM}}{\Rightarrow} \cma_{\text{EdDSA sp}} / \text{EUF-CMA}_{\text{EdDSA lp}} \]
\input{sections/security_of_eddsa/uf-nma_implies_suf-cma}
\input{sections/security_of_eddsa/gamez_implies_uf-nma}
@@ -119,7 +133,6 @@ The chain of reductions can be depicted as:
\section{The Security of EdDSA in a Multi-User Setting}
% TODO: citation: as introduced in ... (paper name or not?)
In this section the multi-user security of the EdDSA signature scheme will be analyzed. A common approach for Schnorr-like signature schemes is to show it via the Random Self-reducibility property of the canonical identification scheme as done in \cite{C:KilMasPan16}. This approach does not work with the EdDSA signature scheme, since the reduction is not able to rerandomize a public key in a way preserving the distribution of the key generation algorithm. This is due to the fact that valid public key always have to have the n-th bit set. Therefore, a similar approach to the single-user setting is used. It is not possible to reduce the \sdlog problem directly since the adversary gets multiple public keys and therefore might not provide a representation of the commitment looking like $\groupelement{R} = r_1 \groupelement{B} + r_2 \groupelement{A}$. For this reason a variant of the one-more discrete logarithm assumption (OMDL) has to be used as introduced in \cite{JC:BNPS03}.
The proof starts by showing that the MU-UF-NMA security of EdDSA implies MU-SUF-CMA security of EdDSA in the Random Oracle Model. Next an intermediate game is introduced onto which the MU-UF-NMA security of EdDSA is reduced. At last, the security of the intermediate game is reduced onto the security of the variant of the one-more discrete logarithm assumption.