Key Agreement from Close Secrets over Unsecured Channels

Kanukurthi, Bhavana; Reyzin, Leonid

doi:10.1007/978-3-642-01001-9_12

Cited by 57 publications

(77 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Such an algorithm is called a computational fuzzy conductor. See [KR09] for the definition of a fuzzy conductor. To the best of our knowledge, a computational fuzzy conductor has not been defined in the literature, the natural definition is to replace the pseudorandomness condition in Definition 2.5 with a HILL entropy requirement.…”

Section: Avoiding Sketch Entropy Upper Boundsmentioning

confidence: 99%

Computational Fuzzy Extractors

Fuller

Meng

Reyzin

2013

Advances in Cryptology - ASIACRYPT 2013

Self Cite

View full text Add to dashboard Cite

Fuzzy extractors derive strong keys from noisy sources. Their security is defined informationtheoretically, which limits the length of the derived key, sometimes making it too short to be useful. We ask whether it is possible to obtain longer keys by considering computational security, and show the following.• Negative Result: Noise tolerance in fuzzy extractors is usually achieved using an information reconciliation component called a "secure sketch." The security of this component, which directly affects the length of the resulting key, is subject to lower bounds from coding theory. We show that, even when defined computationally, secure sketches are still subject to lower bounds from coding theory. Specifically, we consider two computational relaxations of the information-theoretic security requirement of secure sketches, using conditional HILL entropy and unpredictability entropy. For both cases we show that computational secure sketches cannot outperform the best information-theoretic secure sketches in the case of high-entropy Hamming metric sources.• Positive Result: We show that the negative result can be overcome by analyzing computational fuzzy extractors directly. Namely, we show how to build a computational fuzzy extractor whose output key length equals the entropy of the source (this is impossible in the information-theoretic setting). Our construction is based on the hardness of the Learning with Errors (LWE) problem, and is secure when the noisy source is uniform or symbol-fixing (that is, each dimension is either uniform or fixed). As part of the security proof, we show a result of independent interest, namely that the decision version of LWE is secure even when a small number of dimensions has no error.

show abstract

Section: Avoiding Sketch Entropy Upper Boundsmentioning

confidence: 99%

Computational Fuzzy Extractors

Fuller

Meng

Reyzin

2013

Advances in Cryptology - ASIACRYPT 2013

Self Cite

View full text Add to dashboard Cite

show abstract

“…This work proved the theoretical feasibility of perfect pairwise secrets (assuming Alice is connected to Eve through an idealized channel). This triggered a significant body of theoretical work [22,23,29,24,25,26,16], which also addressed the scenario of multiple terminals [9]. More recently, researchers have started to propose concrete, implementable protocols for creating pairwise shared secrets in wireless networks.…”

Section: Related Workmentioning

confidence: 99%

Creating secrets out of erasures

Argyraki

Diggavi

Duarte

et al. 2013

Proceedings of the 19th Annual International Conference on Mobile Computing &Amp; Networking - MobiCom '13

View full text Add to dashboard Cite

Current security systems often rely on the adversary's computational limitations. Wireless networks offer the opportunity for a different, complementary kind of security, which relies on the adversary's limited network presence (i.e., that the adversary cannot be located at many different points in the network at the same time). We present a system that leverages this opportunity to enable n wireless nodes to create a shared secret S, in a way that an eavesdropper, Eve, obtains very little information on S. Our system consists of two steps: (1) The nodes transmit packets following a special pattern, such that Eve learns very little about a given fraction of the transmitted packets. This is achieved through a combination of beam forming (from many different sources) and wiretap codes. (2) The nodes participate in a protocol that reshuffles the information known to each node, such that the nodes end up sharing a secret that Eve knows very little about. Our protocol is easily implementable in existing wireless devices and scales well with the number of nodes; these properties are achieved through a combination of public feedback, broadcasting, and network coding. We evaluate our system through a 5-node testbed. We demonstrate that a group of wireless nodes can generate thousands of new shared secret bits per second, with their secrecy being independent of the adversary's computational capabilities.

show abstract

“…The case where Alice and Bob share highly-correlated, but possibly unequal keys-the "fuzzy" case-is addressed in [RW04] and improved upon by Kanukurthi and Reyzin [KR09], but also covered by [DW09] and [CKOR10].…”

Section: Related Workmentioning

confidence: 99%

Secure Authentication from a Weak Key, without Leaking Information

Bouman

Fehr

2011

Advances in Cryptology – EUROCRYPT 2011

View full text Add to dashboard Cite

We study the problem of authentication based on a weak key in the informationtheoretic setting. A key is weak if its min-entropy is an arbitrary small fraction of its bit length. This problem has recently received considerable attention, with different solutions optimizing different parameters. We study the problem in an extended setting, where the weak key is a one-time session key that is derived from a public source of randomness with the help of a (potentially also weak) long-term key. Our goal now is to authenticate a message by means of the weak session key in such a way that (nearly) no information on the long-term key is leaked. Ensuring privacy of the long-term key is vital for the long-term key to be re-usable. Previous work has not considered such a privacy issue, and previous solutions do not seem to satisfy this requirement.We propose a new four-round protocol for message authentication. The session key that is used to perform authentication is allowed to be weak. Given a secure look-ahead extractor, we prove that our protocol satisfies security against an active adversary and long-term-key privacy, which means that the protocol avoids significant information leakage about the long-term key. For the setting where the adversary's side information about the session key is classical, we can use an existing construction for a secure look-ahead extractor. For the general case, in which this side information is a quantum state, we were not able to show the existence of a secure look-ahead extractor, and leave this as an open problem.NJB is supported by an NWO Open Competition grant.

show abstract

Key Agreement from Close Secrets over Unsecured Channels

Cited by 57 publications

References 25 publications

Computational Fuzzy Extractors

Computational Fuzzy Extractors

Creating secrets out of erasures

Secure Authentication from a Weak Key, without Leaking Information

Contact Info

Product

Resources

About