On the Impossibility of Tight Cryptographic Reductions

Bader, Christoph; Jager, Tibor; Li, Yong; Schäge, Sven

doi:10.1007/978-3-662-49896-5_10

Cited by 67 publications

(59 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The tightness of this security reduction is independent of the number of users and does not require key-prefixing. Other recent work proved that a tightness loss in the number of users is unavoidable for some signature schemes when reducing security in the multi-user setting to the single-user setting [2]. This result applies to adversaries who can corrupt (i.e., learn the private key of) all but one of the users.…”

Section: A Brief History Of Multi-user Schnorr Signature Security Andmentioning

confidence: 96%

Security of BLS and BGLS signatures in a multi-user setting

Lacharité

2017

Cryptogr. Commun.

View full text Add to dashboard Cite

Traditional single-user security models do not necessarily capture the power of real-world attackers. A scheme that is secure in the single-user setting may not be as secure in the multi-user setting. Inspired by the recent analysis of Schnorr signatures in the multi-user setting, we analyse Boneh-Lynn-Shacham (BLS) signatures and Boneh-GentryLynn-Shacham (BGLS) aggregate signatures in the multi-user setting. We obtain a tight reduction from the security of key-prefixed BLS in the multi-user model to normal BLS in the single-user model. We introduce a multi-user security model for general aggregate signature schemes, in contrast to the original "chosen-key" security model of BGLS that is analogous to the single-user setting of a signature scheme. We obtain a tight reduction from the security of multi-user key-prefixed BGLS to the security of multi-user key-prefixed BLS. Finally, we apply a technique of Katz and Wang to present a tight security reduction from a variant of multi-user key-prefixed BGLS to the computational co-Diffie-Hellman (co-CDH) problem. All of our results for BLS and BGLS use type III pairings.

show abstract

Section: A Brief History Of Multi-user Schnorr Signature Security Andmentioning

confidence: 96%

Security of BLS and BGLS signatures in a multi-user setting

Lacharité

2017

Cryptogr. Commun.

View full text Add to dashboard Cite

show abstract

“…Nevertheless, reductions R that are black-box with respect to A have no way of 'excluding' such unrealistic adversaries and so we feel it is not reasonable to exclude them in the definition of tightness. We remark that unrealistic adversaries are not uncommon in the meta-reduction literature [3].…”

Section: Black-box Reductionsmentioning

confidence: 99%

“…Formally, we take into account both the translation S and the relation T in runtime into account by considering the quotient of A and R(A)'s work factors, themselves defined as the quotient of time over success probability (cf. [3]). …”

Section: Black-box Reductionsmentioning

confidence: 99%

“…The idea of using a weak auxiliary security game to prove that reductions are lossy for more meaningful games was pioneered by Bader et al for public key primitives [3]. Bader et al considered as their H 1 notion a non-interactive assumption, whereas our H 1 games are highly interactive.…”

Section: Introductionmentioning

confidence: 99%

“…Unlike using pathological schemes as counterexamples, meta-reductions can easily deal with NBN reductions that depend on the construction C and scheme E: a meta-reduction M simulates an ideal adversary A against C[E] for a reduction R and then uses R to break E [3,14,19]. Then one finds the inevitable loss factor of R by bounding the advantage of M (in its interaction with R) by the advantage of the best possible adversary against E. We remark that this technique is vacuous for insecure schemes E as the resulting bound on the advantage of M is not meaningful.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Multi-key Authenticated Encryption with Corruptions: Reductions Are Lossy

Jager

Stam

Stanley-Oakes

et al. 2017

Theory of Cryptography

Self Cite

View full text Add to dashboard Cite

Abstract. We study the security of symmetric encryption schemes in settings with multiple users and realistic adversaries who can adaptively corrupt encryption keys. To avoid confinement to any particular definitional paradigm, we propose a general framework for multi-key security definitions. By appropriate settings of the parameters of the framework, we obtain multi-key variants of many of the existing single-key security notions. This framework is instrumental in establishing our main results. We show that for all single-key secure encryption schemes satisfying a minimal key uniqueness assumption and almost any instantiation of our general multi-key security notion, any reasonable reduction from the multi-key game to a standard single-key game necessarily incurs a linear loss in the number of keys. We prove this result for all three classical single-key security notions capturing confidentiality, authenticity and the combined authenticated encryption notion.

show abstract