Privately Outsourcing Exponentiation to a Single Server: Cryptanalysis and Optimal Constructions

Abstract

We address the problem of speeding up group computations in cryptography using a single untrusted computational resource. We analyze the security of two efficient protocols for securely outsourcing (multi-)exponentiations. We show that the schemes do not achieve the claimed security guarantees and we present practical polynomial-time attacks on the delegation protocols which allow the untrusted helper to recover part (or the whole) of the device's secret inputs. We then provide simple constructions for outsourcing group exponentiations in different settings (e.g. public/secret, fixed/variable bases and public/secret exponents). Finally, we prove that our attacks are unavoidable if one wants to use a single untrusted computational resource and to limit the computational cost of the limited device to a constant number of (generic) group operations. In particular, we show that our constructions are actually optimal in terms of operations in the underlying group.

On Multi-Scalar Multiplication Algorithms for Register-Constrained Environments

“…To reduce the number of point additions, all possible values for w-bit pairs should be pre-computed and stored in Step 1 of Algorithm Shamir's trick in Figure 1. Certainly, the wide scanning approach [20][21][22][23][24][25], including the m-ary method and the sliding window method, always combines with the coding approach, such as the NAF representation and the JSF representation, in practice. However, the approach requires a large number of extra registers to store all possible values for w-bit pairs, even with a moderate w. Finally, some works [26,27] are dedicated to presenting the parallel algorithms for the multi-scalar multiplication, because the chip manufacturers are increasing the number of cores inside the processors.…”