Spreading Alerts Quietly and the Subgroup Escape Problem

Aleksandr Yampolskiy (Yale)Joint work with James Aspnes,

Zoë Diamadi, Kristian Gjøsteen, and René Peralta

Outline

Motivation Blind coupon mechanism Abstract group structure Instantiating the abstract group structure How to spread alerts Conclusions and open problems

Our model Message-passing network of n nodes. Two types of nodes: regular or sentinel. Sentinel nodes run Intrusion Detection Software which looks for attacker’s presence.

The attacker…

Observes all network traffic. Controls the timing and content of delivered messages.

Our goal Can sentinel nodes quickly alert all network

nodes to attacker’s presence? We want to prevent the attacker from

- fabricating false alerts

- identifying the presence or source of alert

We are attacke

d!We are attacke

d!

We are attacke

d!We are attacke

d!

Blind coupon mechanism

A blind coupon mechanism (BCM) is a PPT tuple (G, V, C, D):

Key generation G(1k): Outputs public and secret keys (PK, SK) and

two strings (d, s). Secret key defines the sets of dummy coupons

DSK and signal coupons SSK. We call (DSK SSK) valid coupons. Also, d2 DSK, s2 SSK.

Blind coupon mechanism (cont.)

Verification algorithm VPK(y) returns 1 if y is valid, 0 otherwise.

Decoding algorithm DSK(y) outputs 0 if y is a dummy coupon; 1 if it is a signal coupon.

Combining algorithm z à CPK(x, y) outputs a signal coupon iff one of the inputs is a signal coupon.

Blind coupon mechanism (cont.)Def: A BCM (G, V, C, D) is secure if

signal and dummy coupons look similar

cannot generate a signal coupon from scratch

combining algorithm is blinding

¼0 1

1Pr[ ] =

¼0 0C( , ) 0 c ¼0 1C( , ) 1 c,1 0

,1 1

Abstract group structure (U, G, D)

Special group structure yields an efficient BCM. A finite set U, a cyclic group GµU, generated by

s, and its subgroup D·G, generated by d. |G|/|D| is prime. Also, |G|/|U| and |D|/|G| are

small.

UGD

invalid

dummy

signal

GD

Hardness assumptions

Subgroup Membership Problem: given a tuple (U, G, D, d, s) and y2 G, it is hard to decide whether y2 D or y2 GnD.

Many examples: DDH, QRA, Paillier, etc.

G???¼

Hardness assumptions (cont.)

Subgroup Escape Problem: given a tuple (U, G, D, d), it is hard to find an element y2 GnD

Has not appeared in the literature before.

G G¼??? D

The BCM construction on (U, G, D)

The BCM (G, C, V, D) is as follows:

Key generation: Let PK=(U, G, d) and SK=|D|. Combining algorithm: CPK(x, y) outputs dr0◦xr1◦yr2,

where r0,r1,r22r {0,…, 22k-1} Verification algorithm: VPK(y) checks that y2G. Decoding algorithm: DSK(y) outputs 0 (dummy) if

ySK=1 and outputs 1 (signal) otherwise.

Security theorem

Theorem: If the subgroup membership problem and subgroup escape problems for (U, G, D) are hard, then our BCM is secure.

Proof idea: CPK(x, y)=dr0◦xr1◦yr2 ) it is blinding

x,y2 D ) CPK(x,y) uniform in D

x 2 G\D) xr1D uniform in G\D ) CPK(x, y) uniform in G

subgroup membership hard ) subgroup escape hard )

¼0 1

1Pr [ ] =

Security theorem (cont.)

Challenge: Find concrete (U, G, D) for which subgroup membership and subgroup escape problems are hard.

Answer: Elliptic curves over Zn, where n=pq. Bilinear groups with specific order.

Elliptic Curves over Zn

Set of (x:y:z) such that y2 z ≡ x3 + axz2 + bz3 (mod n) where gcd(4a2-27b3,n)=1.

Fact: Points of elliptic curve form an additive group E(Zn) for n=pq.

Key property of E(Zn): hard to find new group elements except by using group operation on previously known group elements.

Previously considered a nuisance [Lenstra ‘87, Demytko ‘98] rather than a useful cryptographic property [Gjøsteen ’04].

P1P2

P1 + P2

Elliptic Curves over Zn (cont.)

Challenge: Find (x:y:z) such that y2z ≡ x3 + axz2 + bz3 (mod n).

Answer: It seems hard! Choose x and solve for y: compute √mod n. Choose y and solve for x: solve cubic equation. Find x and y simultaneously: not obvious. LLL-based methods don’t seem to pose a

threat. Finding rational non-torsion points on curves

over Q seems hard.

Elliptic Curves over Zn (cont.)

Let p,q,l1,l2,l3 be primes. Using complex multiplication techniques [Lay-

Zimmer ‘94], we can find curves Ep/Fp and Eq/Fq with #Ep(Fp)=l1l2, #Eq(Fq)=l3.

Let n=pq. Then E(Zn) ¼ Ep(Fp)£Eq(Fq) with #E(Zn)=l1l2l3.

Let U be projective plane, G be E(Zn), and D·G be its subgroup of order l1l3. Let PK=(G,D,n), SK=(p,q,l1,l2,l3).

UGD

invalid

signal

dummy

Elliptic Curves over Zn (cont.)

Verification Algorithm: Given a coupon (x:y:z), it is easy to check if y2z ≡ x3+axz2+bz3 (mod n).

Subgroup Membership Problem: Hard to distinguish elements of D (order l1l3) from elements of GnD. For EP(FP), distinguishing elements of prime order from elements of

composite order is hard unless can factor #EP(FP) [Gjo05]. Computing #E(Zn) is as hard as factoring n [Kunihiro-Koyama ’98]. Thus, #Ep(Fp) is hidden.

Subgroup Escape Problem: Hard as long as adversary cannot find random group elements in G=E(Zn).

Spreading alerts with the BCM

During initial network setup, the administrator generates keys for BCM (G, C, V, D).

He gives dummy coupons to all nodes. Sentinel nodes also receive signal coupons.

1

0

0

0

0

Spreading alerts with the BCM Nodes continually broadcast coupons to their

neighbors.- Initially, everyone transmits dummy coupons. - Sentinel nodes switch to sending signal coupons

upon detecting an attacker. Attacker may tamper with messages.

0

1

$#!@1

1

0

00

Spreading alerts with the BCM Upon receiving a coupon, a node verifies that

the coupon is valid.

0

11

00

0

$#!@1V( )=0

V( )=1

V( )=1

Spreading alerts with the BCM Upon receiving a coupon, a node verifies that

the coupon is valid. If the coupon is valid, the node combines it

with its own coupon. Otherwise, the coupon is discarded.

0

1

00

1

C( , )0

1C( , )0

Security theorem

Theorem: If the BCM is secure, then so is the alert propagation mechanism.

Proof idea: Because adversary cannot distinguish between dummy and signal coupons, he cannot test their presence or absence in the network traffic. Same for coupon forgery.

Efficiency

Synchronous flooding model: All nodes receive an alert in steps, where is the diameter of the subgraph of non-faulty nodes.

Simple epidemic model: Communication graph is complete. All nodes receive an alert in O(n log n) steps.

Conclusion

Useful crypto primitive BCM (Æ-homomorphic bit commitment).

It can be used to construct an undetectable anonymous private channel.

New crypto tool? Subgroup escape assumption. Non-interactive proofs of circuit satisfiability of

length linear in the number of Æ gates. Applications to i-voting [Chaum et al. ’04].

Open problems

Can BCM with constant expansion ratio be constructed using standard assumptions?

Can we transmit multiple bits without a linear blow up in message size?

?