Mind Your Coins: Fully Leakage-Resilient Signatures with Graceful Degradation

Faonio, Antonio; Nielsen, Jesper Buus; Venturi, Daniele

doi:10.1007/978-3-662-47672-7_37

Cited by 15 publications

(8 citation statements)

References 52 publications

(81 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We show how to apply EUF-RMA against SAs to the setting of subversion-resilient identification (ID) schemes. Similar applications already appeared in the literature for leakage and tamper resistance [ADW09, FHN + 12, DFMV13,NVZ14,FNV15].…”

Section: Subversion-resilient Identification Schemesmentioning

confidence: 79%

Subversion-Resilient Signature Schemes

Ateniese

Magri

Venturi

2015

Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

We provide a formal treatment of security of digital signatures against subversion attacks (SAs). Our model of subversion generalizes previous work in several directions, and is inspired by the proliferation of software attacks (e.g., malware and buffer overflow attacks), and by the recent revelations of Edward Snowden about intelligence agencies trying to surreptitiously sabotage cryptographic algorithms. The main security requirement we put forward demands that a signature scheme should remain unforgeable even in the presence of an attacker applying SAs (within a certain class of allowed attacks) in a fully-adaptive and continuous fashion. Previous notions-e.g., the notion of security against algorithmsubstitution attacks introduced by Bellare et al. (CRYPTO '14) for symmetric encryptionwere non-adaptive and non-continuous. In this vein, we show both positive and negative results for the goal of constructing subversion-resilient signature schemes. • Negative results. As our main negative result, we show that a broad class of randomized signature schemes is unavoidably insecure against SAs, even if using just a single bit of randomness. This improves upon earlier work that was only able to attack schemes with larger randomness space. When designing our new attack we consider undetectability as an explicit adversarial goal, meaning that the end-users (even the ones knowing the signing key) should not be able to detect that the signature scheme was subverted. • Positive results. We complement the above negative results by showing that signature schemes with unique signatures are subversion-resilient against all attacks that meet a basic undetectability requirement. A similar result was shown by Bellare et al. for symmetric encryption, who proved the necessity to rely on stateful schemes; in contrast unique signatures are stateless, and in fact they are among the fastest and most established digital signatures available. As our second positive result, we show how to construct subversion-resilient identification schemes from subversion-resilient signature schemes. We finally show that it is possible to devise signature schemes secure against arbitrary tampering with the computation, by making use of an un-tamperable cryptographic reverse firewall (Mironov and Stephens-Davidowitz, EUROCRYPT '15), i.e., an algorithm that "sanitizes" any signature given as input (using only public information). The firewall we design allows to successfully protect so-called re-randomizable signature schemes (which include unique signatures as special case). As an additional contribution, we extend our model to consider multiple users and show implications and separations among the various notions we introduced. While our study is mainly theoretical, due to its strong practical motivation, we believe that our results have important implications in practice and might influence the way digital signature schemes are selected or adopted in standards and protocols.

show abstract

Section: Subversion-resilient Identification Schemesmentioning

confidence: 79%

Subversion-Resilient Signature Schemes

Ateniese

Magri

Venturi

2015

Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…In Section 7 we show that cryptographic primitives which remain secure if the adversary obtains some bounded amount of leakage from the key, can naturally be protected against tampering attacks using our new notion of leaky non-malleability. Since there is a large body of work on bounded leakage-resilient cryptographic primitives, including signature schemes, symmetric and public key encryption [32,16,34,38,39,22,23], and many more, our transformation protects these primitives against any efficient space-bounded tampering attack.…”

Section: Our Contributionmentioning

confidence: 99%

Non-Malleable Codes for Space-Bounded Tampering

Faust

Hostáková

Mukherjee

et al. 2017

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Non-malleable codes-introduced by Dziembowski, Pietrzak and Wichs at ICS 2010are key-less coding schemes in which mauling attempts to an encoding of a given message, w.r.t. some class of tampering adversaries, result in a decoded value that is either identical or unrelated to the original message. Such codes are very useful for protecting arbitrary cryptographic primitives against tampering attacks against the memory. Clearly, non-malleability is hopeless if the class of tampering adversaries includes the decoding and encoding algorithm. To circumvent this obstacle, the majority of past research focused on designing non-malleable codes for various tampering classes, albeit assuming that the adversary is unable to decode. Nonetheless, in many concrete settings, this assumption is not realistic. In this paper, we explore one particular such scenario where the class of tampering adversaries naturally includes the decoding (but not the encoding) algorithm. In particular, we consider the class of adversaries that are restricted in terms of memory/space. Our main contributions can be summarized as follows: • We initiate a general study of non-malleable codes resisting space-bounded tampering. In our model, the encoding procedure requires large space, but decoding can be done in small space, and thus can be also performed by the adversary. Unfortunately, in such a setting it is impossible to achieve non-malleability in the standard sense, and we need to aim for slightly weaker security guarantees. In a nutshell, our main notion (dubbed leaky space-bounded non-malleability) ensures that this is the best the adversary can do, in that space-bounded tampering attacks can be simulated given a small amount of leakage on the encoded value.

show abstract

“…An abridged version of this paper appeared as [34], which only contains a high-level description of the signature scheme with security against noisy leakage in the nonerasure model (i.e., the scheme SS 3 from this paper). This work is the full extended version of that paper, containing new material (i.e., the schemes SS 1 , SS 2 , and SS 4 ) and significantly revised proofs.…”

Section: Conference Versionmentioning

confidence: 99%

Fully leakage-resilient signatures revisited: Graceful degradation, noisy leakage, and construction in the bounded-retrieval model

Faonio

Nielsen

Venturi

2017

Theoretical Computer Science

Self Cite

View full text Add to dashboard Cite

We construct new leakage-resilient signature schemes. Our schemes remain unforgeable against an adversary leaking arbitrary (yet bounded) information on the entire state of the signer (sometimes known as fully leakage resilience), including the random coin tosses of the signing algorithm. The main feature of our constructions is that they offer a graceful degradation of security in situations where standard existential unforgeability is impossible. This property was recently put forward by Nielsen, Venturi, and Zottarel (PKC 2014) to deal with settings in which the secret key is much larger than the size of a signature. One remarkable such case is the so-called Bounded-Retrieval Model (BRM), where one intentionally inflates the size of the secret key while keeping constant the signature size and the computational complexity of the scheme. Our main constructions have leakage rate 1 − o(1), and are proven secure in the standard model. We additionally give a construction in the BRM, relying on a random oracle. All of our schemes are described in terms of generic building blocks, but also admit efficient instantiations under fairly standard number-theoretic assumptions. Finally, we explain how to extend some of our schemes to the setting of noisy leakage, where the only restriction on the leakage functions is that the output does not decrease the min-entropy of the secret key by too much.

show abstract

Mind Your Coins: Fully Leakage-Resilient Signatures with Graceful Degradation

Cited by 15 publications

References 52 publications

Subversion-Resilient Signature Schemes

Subversion-Resilient Signature Schemes

Non-Malleable Codes for Space-Bounded Tampering

Fully leakage-resilient signatures revisited: Graceful degradation, noisy leakage, and construction in the bounded-retrieval model

Contact Info

Product

Resources

About