Subversion-Resilient Public Key Encryption with Practical Watchdogs

Bemmann, Pascal; Chen, Rongmao; Jager, Tibor

doi:10.1007/978-3-030-75245-3_23

Cited by 8 publications

(3 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Lastly, we note that none of the theoretical approaches are fully satisfying, requiring strong or impractical assumptions. Indeed, it is telling that there are no implementations of subversion-resilient primitives to date, although some recent work seems promising in this regard [16,21]. The best defence seems to be the unglamorous task of minimising risk by implementing a variety of control mechanisms across the whole infrastructure, in a process of security management.…”

Section: Discussionmentioning

confidence: 99%

“…Aviram et al [7] consider combining (potentially maliciously chosen) keys for Post-Quantum protocols such as TLS. Bemman, Chen and Jager [16] show how to construct a subversion-resilient KEM, using a variant of a combiner and a subversion resilient randomness generator. Their construction considers Russell et al's watchdog from a practical perspective, meaning an offline watchdog that runs in linear time.…”

Section: Further Workmentioning

confidence: 99%

“…If however R accepts, then R i concludes that a KRA attack is in operation, and that it (R i ) is supposed to leak key material. 16 Observing that R i just recovered the originally encrypted message m, we let R i either deliver that message, or we let it return ⊥, i.e. indicate decryption failure.…”

Section: Active Attackmentioning

confidence: 99%

See 2 more Smart Citations

Algorithm substitution attacks against receivers

Armour

Poettering

2022

Int. J. Inf. Secur.

View full text Add to dashboard Cite

This work describes a class of Algorithm Substitution Attack (ASA) generically targeting the receiver of a communication between two parties. Our work provides a unified framework that applies to any scheme where a secret key is held by the receiver; in particular, message authentication schemes (MACs), authenticated encryption (AEAD) and public key encryption (PKE). Our unified framework brings together prior work targeting MAC schemes (FSE’19) and AEAD schemes (IMACC’19); we extend prior work by showing that public key encryption may also be targeted. ASAs were initially introduced by Bellare, Paterson and Rogaway in light of revelations concerning mass surveillance, as a novel attack class against the confidentiality of encryption schemes. Such an attack replaces one or more of the regular scheme algorithms with a subverted version that aims to reveal information to an adversary (engaged in mass surveillance), while remaining undetected by users. Previous work looking at ASAs against encryption schemes can be divided into two groups. ASAs against PKE schemes target key generation by creating subverted public keys that allow an adversary to recover the secret key. ASAs against symmetric encryption target the encryption algorithm and leak information through a subliminal channel in the ciphertexts. We present a new class of attack that targets the decryption algorithm of an encryption scheme for symmetric encryption and public key encryption, or the verification algorithm for an authentication scheme. We present a generic framework for subverting a cryptographic scheme between a sender and receiver, and show how a decryption oracle allows a subverter to create a subliminal channel which can be used to leak secret keys. We then show that the generic framework can be applied to authenticated encryption with associated data, message authentication schemes, public key encryption and KEM/DEM constructions. We consider practical considerations and specific conditions that apply for particular schemes, strengthening the generic approach. Furthermore, we show how the hybrid subversion of key generation and decryption algorithms can be used to amplify the effectiveness of our decryption attack. We argue that this attack represents an attractive opportunity for a mass surveillance adversary. Our work serves to refine the ASA model and contributes to a series of papers that raises awareness and understanding about what is possible with ASAs.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Further Workmentioning

confidence: 99%

See 1 more Smart Citation

Algorithm substitution attacks against receivers

Armour

Poettering

2022

Int. J. Inf. Secur.

View full text Add to dashboard Cite

show abstract

Reverse Firewalls for Adaptively Secure MPC Without Setup

Chakraborty¹,

Ganesh²,

Pancholi³

et al. 2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Reverse firewalls were introduced at Eurocrypt 2015 by Miro-nov and Stephens-Davidowitz, as a method for protecting cryptographic protocols against attacks on the devices of the honest parties. In a nutshell: a reverse firewall is placed outside of a device and its goal is to "sanitize" the messages sent by it, in such a way that a malicious device cannot leak its secrets to the outside world. It is typically assumed that the cryptographic devices are attacked in a "functionality-preserving way" (i.e. informally speaking, the functionality of the protocol remains unchanged under this attacks). In their paper, Mironov and Stephens-Davidowitz construct a protocol for passively-secure two-party computations with firewalls, leaving extension of this result to stronger models as an open question.In this paper, we address this problem by constructing a protocol for secure computation with firewalls that has two main advantages over the original protocol from Eurocrypt 2015. Firstly, it is a multiparty computation protocol (i.e. it works for an arbitrary number n of the parties, and not just for 2). Secondly, it is secure in much stronger corruption settings, namely in the actively corruption model. More precisely: we consider an adversary that can fully corrupt up to n − 1 parties, while the remaining parties are corrupt in a functionality-preserving way. Our core techniques are: malleable commitments and malleable non-interactive zero-knowledge, which in particular allow us to create a novel protocol for multiparty augmented cointossing into the well with reverse firewalls (that is based on a protocol of Lindell from Crypto 2001).

show abstract