Improved Constructions of PRFs Secure Against Related-Key Attacks

Abstract

Building cryptographic primitives that are secure against related-key attacks (RKAs) is a well-studied problem by practitioners and theoreticians alike. Practical implementations of block ciphers take into account RKA security to mitigate fault injection attacks. The theoretical study of RKA security was initiated by Bellare and Kohno (Eurocrypt '03). In Crypto 2010, Bellare and Cash introduce a framework for building RKA-secure pseudorandom functions (PRFs) and use this framework to construct RKA-secure PRFs based on the decision linear and DDH assumptions.We build RKA-secure PRFs by working with the Bellare-Cash framework and the LWEand DLIN-based PRFs recently constructed by Boneh, Lewi, Montgomery, and Raghunathan (Crypto '13). As a result, we achieve the first PRFs from lattices secure against an (almost) linear class of related-key functions. In addition, we note that our DLIN-based PRF (based on multilinear maps) is the first RKA-secure PRF for affine classes under the DLIN assumption, and the first RKA-secure PRF against a large class of polynomial functions under a natural generalization of the DLIN assumption. Previously, RKA security for higher-level primitives (such as signatures and IBEs) were studied in Bellare, Paterson, and Thomson (Asiacrypt '12) for affine and polynomial classes, but the question of RKA-secure PRFs for such classes remained open.Although our RKA-secure LWE-based PRF only applies to a restricted linear class, we show that by weakening the notion of RKA security, we can handle a significantly larger class of affine functions. Finally, the results of Bellare, Cash, and Miller (Asiacrypt '11) show that all of our RKA-secure PRFs can be used as building blocks for a wide variety of public-key primitives.

Efficient Public-Key Cryptography with Bounded Leakage and Tamper Resilience

“…Related-key security was first studied in the context of symmetric encryption [10,46,33,4,3]. With time a number of cryptographic primitives with security against related-key attacks have emerged, including pseudorandom functions [7,43,5,1], hash functions [34], identity-based encryption [8,12], public-key encryption [8,57,12,45], signatures [8,12,11], and more [15,54,19].…”

Cryptanalysis of the CLT13 Multilinear Map

“…Shortly after this, Coron, Lepoint, and Tibouchi [15] proposed another potential graded encoding scheme (CLT13) over integers. These graded encoding schemes expanded their applications such as general-purpose obfuscation, functional encryption, and others [1,3,5,6,22,[24][25][26]30,36,37].…”

“…Thus, the CLT13 scheme is considered as the only candidate for implementing applications that require the presumed hardness of the problems as the security basis. Such applications include key-homomorphic pseudorandom functions and a one-round group password-based authenticated key exchange [1,3,5,6,15,22,30,36]: The widespread use of the CLT13 scheme has raised concerns about its security because its presumed hardness has not been proven for standard assumptions.…”

“…Consequently, there is no direct construction of secure multilinear maps, for which any of the GDDH, SubM, DLIN, and GXDH problems are hard. 1 Several cryptographic applications are impacted,e.g., all the constructions of [3,22,30,36], GPAKE construc-tion in [1] for more than three users, one of the two constructions of password hashing in [5], and one of the key-homomorphic PRF constructions in [6].…”

Cryptanalysis of the Multilinear Map over the Integers

“…Several recent cryptographic constructions can no longer be realized. This includes all constructions from [2,23,24,37], the one-round group password authenticated key exchange construction of [1] for more than 3 users, one of the two constructions of password hashing of [3], the alternative key-homomorphic pseudo random function construction from [6], and the use of the latter in [33].…”