Efficient, Robust and Constant-Round Distributed RSA Key Generation

Damgård, Ivan; Mikkelsen, Gert Læssøe

doi:10.1007/978-3-642-11799-2_12

Cited by 37 publications

(32 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For a thoroughly analysis of the size of m, the reader is referred to [DM10]. An additive sharing ofã (i) over the integers may be computed based on Paillier encryption with P 0 's keys.…”

Section: B the [Dm10] Biprimality Test: The Two-party Casementioning

confidence: 99%

Efficient RSA Key Generation and Threshold Paillier in the Two-Party Setting

Hazay

Mikkelsen

Rabin³

et al. 2012

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

The problem of generating an RSA composite in a distributed manner without leaking its factorization is particularly challenging and useful in many cryptographic protocols. Our first contribution is the first non-generic fully simulatable protocol for distributively generating an RSA composite with security against malicious behavior. Our second contribution is a complete Paillier [Pai99] threshold encryption scheme in the two-party setting with security against malicious attacks. We further describe how to extend our protocols to the multiparty setting with dishonest majority.Our RSA key generation protocol is comprised of the following sub-protocols: (i) a distributed protocol for generation of an RSA composite, and (ii) a biprimality test for verifying the validity of the generated composite. Our Paillier threshold encryption scheme uses the RSA composite for the publickey and is comprised of the following sub-protocols: (i) a distributed generation of the corresponding secret-key shares and, (ii) a distributed decryption protocol for decrypting according to Paillier.

show abstract

“…For a thoroughly analysis of the size of m, the reader is referred to [DM10]. An additive sharing ofã (i) over the integers may be computed based on Paillier encryption with P 0 's keys.…”

Section: B the [Dm10] Biprimality Test: The Two-party Casementioning

confidence: 99%

Efficient RSA Key Generation and Threshold Paillier in the Two-Party Setting

Hazay

Mikkelsen

Rabin³

et al. 2012

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…A fully distributed public-key system is one where the public (and the distributed private) key are jointly generated by the same servers which end up holding the private key's shares (e.g., via a threshold secret sharing [66]). Efficient distributed key generation (DKG) protocols were put forth for both RSA [12,34,33,26] and discrete-logarithm-based systems [61,41,35,16,43].…”

Section: Introductionmentioning

confidence: 99%

Born and raised distributively: Fully distributed non-interactive adaptively-secure threshold signatures with short shares

Libert

Joye

Yung

2016

Theoretical Computer Science

View full text Add to dashboard Cite

International audienceThreshold cryptography is a fundamental distributed computational paradigm for enhancing the availability and the security of cryptographic public-key schemes. It does it by dividing private keys into n shares handed out to distinct servers. In threshold signature schemes, a set of at least t + 1 ≤ n servers is needed to produce a valid digital signature. Availability is assured by the fact that any subset of t + 1 servers can produce a signature when authorized. At the same time, the scheme should remain robust (in the fault tolerance sense) and unforgeable (cryptographically) against up to t corrupted servers; i.e., it adds quorum control to traditional cryptographic services and introduces redundancy. Originally, most practical threshold signatures have a number of demerits: They have been analyzed in a static corruption model (where the set of corrupted servers is fixed at the very beginning of the attack); they require interaction; they assume a trusted dealer in the key generation phase (so that the system is not fully distributed); or they suffer from certain overheads in terms of storage (large share sizes). In this paper, we construct practical fully distributed (the private key is born distributed), non-interactive schemes —where the servers can compute their partial signatures without communication with other servers— with adaptive security (i.e., the adversary corrupts servers dynamically based on its full view of the history of the system). Our schemes are very efficient in terms of computation, communication, and scalable storage (with private key shares of size O(1), where certain solutions incur O(n) storage costs at each server). Unlike other adaptively secure schemes, our schemes are erasure-free (reliable erasure is hard to assure and hard to administer properly in actual systems). To the best of our knowledge, such a fully distributed highly constrained scheme has been an open problem in the area. In particular, and of special interest, is the fact that Pedersen's traditional distributed key generation (DKG) protocol can be safely employed in the initial key generation phase when the system is born —although it is well-known not to ensure uniformly distributed public keys. An advantage of this is that this protocol only takes one round optimistically (in the absence of faulty player)

show abstract

“…In many cases such as privacy-preserving data-mining/statistical learning [5][6][7][8] and distributed generation of cryptographic keys [9], the desired functionality f involves mostly arithmetic operations such as addition, multiplication, division, and exponentiation over the integers and/or the finite fields. More efficient protocols for these basic operations can result in an more efficient protocol for f .…”

Section: Introductionmentioning

confidence: 99%

Efficient Secure Two-Party Exponentiation

Chow

Chung

et al. 2011

Topics in Cryptology – CT-RSA 2011

View full text Add to dashboard Cite

Abstract. We present a new framework to design secure two-party computation protocols for exponentiation over integers and over ZQ where Q is a publicly-known prime. Using our framework, we realize efficient protocols in the semi-honest setting. Assuming the base is non-zero, and the exponent is at most Q/2 for the ZQ case, our protocols consist of at most 5 rounds (each party sending 5 messages) and the total communication consists of a small constant number (≤ 18) of encrypted/encoded elements in ZQ. Without these assumptions, our protocols are still more efficient than a protocol recently proposed by Damgård et al. in TCC 2006 (24 vs. > 114 rounds, ≈ 279 +12t for an error rate of 2 −t vs. > 110 log secure multiplications, where is the bit length of the shares).Our protocols are constructed from different instantiations of our framework with different assumptions (homomorphic encryption or oblivious transfers) to achieve different advantages. Our key idea is to exploit the properties of both additive and multiplicative secret sharing. We also propose efficient transformation protocols between these sharings, which might be of independent interest.

show abstract

Efficient, Robust and Constant-Round Distributed RSA Key Generation

Abstract: Abstract. We present the first protocol for distributed RSA key generation which is constant round, secure against malicious adversaries and has a negligibly small bound on the error probability, even using only one iteration of the underlying primality test on each candidate number.

Cited by 37 publications

References 16 publications

Efficient RSA Key Generation and Threshold Paillier in the Two-Party Setting

Efficient RSA Key Generation and Threshold Paillier in the Two-Party Setting

Born and raised distributively: Fully distributed non-interactive adaptively-secure threshold signatures with short shares

Efficient Secure Two-Party Exponentiation

Contact Info

Product

Resources

About