Amplifying Privacy in Privacy Amplification

Abstract

We study the classical problem of privacy amplification, where two parties Alice and Bob share a weak secret X of min-entropy k, and wish to agree on secret key R of length m over a public communication channel completely controlled by a computationally unbounded attacker Eve.Despite being extensively studied in the literature, the problem of designing "optimal" efficient privacy amplification protocols is still open, because there are several optimization goals. The first of them is (1) minimizing the entropy loss L = k − m (it is known that the optimal value for L = O(λ), where ε = 2 −λ is the desired security of the protocol). Other important considerations include (2) minimizing the number of communication rounds, (3) maintaining security even after the secret key is used (this is called post-application robustness), and (4) ensuring that the protocol P does not leak some "useful information" about the source X (this is called source privacy). Additionally, when dealing with a very long source X, as happens in the so-called Bounded Retrieval Model (BRM), extracting as long a key as possible is no longer the goal. Instead, the goals are (5) to touch as little of X as possible (for efficiency), and (6) to be able to run the protocol many times on the same X, extracting multiple secure keys.Achieving goals (1)-(4) (or (2)-(6) in BRM) simultaneously has remained open, and, indeed, all known protocols fail to achieve at least two of them. In this work we improve upon the current state-of-the-art, by designing a variety of new privacy amplification protocols, in several cases achieving optimal parameters for the first time. Moreover, in most cases we do it by giving relatively general transformations which convert a given protocol P into a "better" protocol P . In particular, as special cases of these transformations (applied to best known prior protocols), we achieve the following privacy amplification protocols for the first time:• 4-round (resp. 2-round) source-private protocol with optimal entropy loss L = O(λ), whenever k = Ω(λ 2 ) (resp. k > n 2 (1 − α) for some universal constant α > 0). Best previous constant round source-private protocols achieved L = Ω(λ 2 ).• 3-round post-application-robust protocols with optimal entropy loss L = O(λ), whenever k = Ω(λ 2 ) or k > n 2 (1−α) (the latter is also source-private). Best previous post-application robust protocols achieved L = Ω(λ 2 ).• The first BRM protocol capable of extracting the optimal number Θ(k/λ) of session keys, improving upon the previously best bound Θ(k/λ 2 ). (Additionally, our BRM protocol is post-application-robust, takes 2 rounds, and can be made source-private by increasing the number of rounds to 4.) *

Privacy Amplification and Nonmalleable Extractors Via Character Sums

“…In other words, we can only extract m ≈ k − n/2 bits with post-application robustness using this technique, which is not better than what can be achieved by a 1-round protocol of Dodis, Kanukurthi, Katz, Reyzin, and Smith [7]. Fortunately, as communicated to us by [1], we can easily fix the situation at the cost of adding a third round (so that Eve no longer gets R B at the end of the second round), as follows. We use the 2-round protocol above to agree on a short (namely, O(s + log n)-bit) key K for a one-time MAC.…”

Authenticated semi-quantum key distribution without entanglement

“…However, she still does not know if (K 1i , K 2i ) = (0, 0), (0, 1), or (1, 1). Given their high enough [14] min-entropy (H min (K 1 ) = H min (K 2 ) ≈ 0.84|K 1 | and H min (K) ≈ 0.92|K| ), it is possible for Alice and Bob to perform a privacy amplification protocol to obtain new uniform pre-shared keys.…”

“…The min-entropy of the key is nevertheless still high enough (H min (K) ≈ 0.92|K|) [14]. We propose, thus, that Alice and Bob update the pre-shared keys K 1 and K 2 by performing a privacy amplification on both of them when an attack is suspected or after a certain number of iterations of the protocol.…”

An efficient protocol for secure multicast key distribution in the presence of adaptive adversaries

“…Our method for proving the security leverages the security amplification technique defined over the key distribution tree (The security amplification technique benefits us starting with a weakly secure variant of some cryptographic primitive to build a strongly secure variant of the same primitive. The technique has been extensively used in the cryptography, such as collision-resistant hash functions [32], weakly verifiable puzzles [33][34][35] and encryption schemes [36]). That is, if an adversary can guess the correct value defined in the security game with a non-negligible advantage then in case that the underlying symmetric-key encryption scheme is semantically secure, either the intermediate key value k 0 of the node V 0 or the key value k 1 of the node V 1 is not uniformly distributed.…”