Forgery Attacks
If we put aside the possible misbehaviour of the service provider and the lottery organization, the main threat concerns a malicious player willing to forge a false (non-paying) winning lottery ticket. Such an adversary can be modeled as a MOVA forger whose goal is to forge valid tickets and especially, the winning ones. Therefore, this kind of attack seems to lie between an existentially forgery and universal forgery attacks in terms of difficulty. While an adversary is not ensured to forge a valid (even non-winning) ticket by succeeding in an existential forgery attack, this one does not strictly need to succeed in a universal forgery attack in order to forge the ticket with the highest winnings, since he may have several identifiers at disposal. This leads us to consider the following adversarial game.
Gamelot-cma. Let M be the message space of all possible ticket orders and F be the
forger. First, F receives the lottery’s MOVA public key KS
p which was generated by (KS
p, KsS) ← SetupS(1k). Then, the game is composed of two phases called Pre-Draw
phase and Post-Draw phase respectively.
1. Pre-Draw phase. F has access to a signing oracle Sign, a verification oracle Ver restricted to the message-signature pairs (m, σ) such that m was queried
to Sign, and possibly the random oracles (such as GenS in the MOVA case).
7. Applications of the MOVA Scheme
2. Post-Draw phase. A subset Mw ⊆ M composed of Nw different messages
is picked uniformly at random and is given to F. The forger F does not have access to the oracles Sign and Ver anymore. At the end, F outputs a messsage- signature pair (m∗, σ∗) and wins the game if m∗ ∈ M
w, the pair is valid, and
if m∗ has not been queried to the oracle Sign.
The success probability of F in the above game is denoted by Succlot-cma
F .
Note that the Pre-Draw phase corresponds to the period of time before the drawing. At this moment, the adversary does not know which tickets have an interesting winnings. After the drawing, the adversary does not have access to the signature verifications and cannot buy any tickets for this drawing. Provided that the lottery organization refreshes the MOVA pair of keys for each drawing, this corresponds for the adversary to have no access to the oracles Sign and Ver anymore, as modeled in the Post-Draw phase.
Below, we exhibit a reduction between the above game and the GHI problem us- ing some similar simulation techniques which have been employed in Theorem 4.4.1 to show that MOVA resists existential forgery attacks.
Theorem 7.2.3. Let S = {(Xkey1, Ykey1), . . . , (XkeyLkey, YkeyLkey)} and Ntot de-
note the cardinality of M. Set pw := Nw/Ntot. Let qS be an integer satisfying
qS· pw ≥ 1. Assume that the signer’s public key is valid and GenS is a random ora-
cle. Consider the Lsig-S-GHI problem with the same parameters as for the MOVA scheme, i.e., G = Xgroup, H = Ygroup. Assume that for any solver B with a given complexity, we have
SuccLsig-S-GHIB ≤ ε.
Then, any forger F with similar complexity using qS signing queries wins the lottery
game under a chosen-message attack with a probability
Succlot-cmaF ≤ à q S X i=0 ¡N w i ¢¡N tot−Nw qS−i ¢ ¡Ntot qS ¢ · (1 − q)i !−1 · ε q, with q = 1/(pw + qSpw).
Proof. From a forger F who wins in the lottery game, we construct a simulator B which solves the Lsig-S-GHI problem. As usual, B needs to simulate the lottery game environment of F (different oracles) in order to use F towards solving the GHIP challenge. First, the simulator B receives the GHIP challenge x1, . . . , xLsig. He picks Nw different messages uniformly at random in M and build the set Mw.
Then, B runs the forger and simulates the queries to the random oracle GenS, qS
queries to the signing oracle Sign and qV queries to the oracle Ver. We can assume
that all messages sent to Sign resp. Ver were previously queried to GenS (since
7.2. SMS Lottery
the oracle Sign resp. Ver has to make such queries anyway). Additionally, we can assume that the forged pair outputted by F has been queried to GenS. B simulates the oracles GenS, Sign, and Ver in the Pre-Draw phase as follows.
GenS. As usual, the random oracle GenS is simulated by maintaining a list of the queries with corresponding answers. A fresh query m is simulated as follows. If m 6∈ Mw, B generates a type-1 answer. Otherwise, a type-1 answer is
generated with probability 1 − q and a type-2 answer with probability q. We recall that type-1 answers are of the form
Xsigi := dri+
Lkey X
j=1
ai,jXkeyj for i = 1, . . . , Lsig,
while type-2 answers are of the form Xsigi := dri+ xi+
Lkey X
j=1
ai,jXkeyj for i = 1, . . . , Lsig.
For each message, B keeps the coefficients ai,j’s and ri’s and answer type in
memory.
Sign. For a message m, if the answer to the GenS query of m was of type-1, then
B answers Ysigi := PLkeyj=1 ai,jYkeyj for i = 1, . . . , Lsig. Otherwise, it aborts
the simulation. The simulator adds a tag in the stored message m to specify that m was queried to Sign and stores the signature σ as well.
Ver. For any message-signature pair (m, σ) queried to Ver, B first checks whether
m was previously submitted to Sign. If this is not the case, B answers the
tag “ticket not registered”. Otherwise, the simulator checks whether σ is valid or not and simulates the appropriate protocol accordingly as in Theo- rem 4.4.1.
In the Post-Draw phase, B releases Mw to F. Then, the simulator only needs to
simulate the oracle GenS. This can be done perfectly and exactly as in the Pre-Draw phase. At the end, F outputs a pair (m∗, σ∗).
It remains to compute the probability for B to have simulated correctly and to solve the GHIP instance. First, we note that the oracles are perfectly simulated except when a type-2 query is sent to the signing oracle. Hence, the probability that B simulates Sign correctly is given by
γ(q) := qS X i=0 ¡N w i ¢¡N tot−Nw qS−i ¢ ¡Ntot qS ¢ · (1 − q)i, — 153 —
7. Applications of the MOVA Scheme
where Ntot is the cardinality of M and Nw the cardinality of Mw. The proof can be
concluded by remarking that the probability for a successful F to have a simulated GenS answer of m∗of type-2 is equal to q. A heuristic argument leads us to consider
q = 1/(pw + qSpw) to maximize the expression q · γ(q).
In what follows, we briefly explain how we can approximate γ(q) and how the choice for q in the above theorem has been made. The main reason we get a probabil- ity in a so complicated form, comes from the fact that picking qS different messages
in M uniformly at random and counting the number of messages in Mw does not
formally lead to a binomial distribution. This leads to a hypergeometric distribution
of the form ¡ Nw i ¢¡Ntot−Nw qS−i ¢ ¡N tot qS ¢ .
However, it is well known that if Ntot is much larger than qS, the hypergeometric
distribution is very close to a binomial distribution. In this case, probabilities for the different messages to lie in Mw can be seen as independent. Thus,
γ(q) ≈ (1 − q · pw)qS,
where pw := Nw/Ntot. We set γ0(q) := (1 − q · pw)qS. By differentiating the function
q · γ0(q), we derive that choosing
q := 1
pw+ qSpw
leads to a maximized value of the function q · γ0(q). This value can be bounded as follows 1 pw+ qSpw µ 1 − 1 1 + qS ¶qS ≥ 1 e(qS+ 1)pw ,
where e denotes the natural logarithm base. Note that both terms are very close when qS is large. This shows that
Succlot-cma
F ≈ e(qS+ 1)pw· ε (7.1)
for qS reasonably large but enough smaller than Ntot. Additional Threats
Here, we would like to discuss some other threats related to this lottery scenario. They are of less interest for this thesis since they are not related with the different parameters of the MOVA scheme. For this reason, we are not going to make a detailed and exhaustive treatment. The interested reader will find more details in Oswald Master’s thesis [121].
7.2. SMS Lottery
Invalid Signatures Released by the Lottery Organization. A major risk for the players comes from the possible release of invalid MOVA signatures by the lottery organization. In practice, the verification interface is likely to be used only by a small number of skeptical players. On the one hand, this verification interface should prevent from players claiming after the drawing to have received an invalid ticket and that the lottery organization cheated. In short, the responsibility for verifying the ticket authenticity is shifted to the player. On the other hand, this verification interface should also prevent the lottery to generate invalid tickets. Namely, before the drawing the value of a ticket is very small and the incentive for the lottery to cheat at this point is quite low. Since the lottery take risks to be detected by some players and have its credibility and reputation affected, it is unlikely that the lottery is going to cheat for a very small amount of money.
In addition to the tickets verification by the player, one can possibly imagine that the service provider is involved in checking the authenticity of the tickets. Since its reputation may also be affected by some complains, this one may decide to proceed in some ticket verifications. What is more, the service provider has the infrastructure at disposal for easily getting access to signature verifications. Namely, the provider certainly communicates with the lottery using computers through a classical network. To summarize, a verification of tickets by the service provider should not be a constraining task. The verification can also be done at the end of each day or just before the drawing using a batch verification of the MOVA scheme.
Non-Cooperation by the Lottery in the Verification Protocol. The mali- cious behaviour of the lottery organization presented above, can be thwarted pro- vided that this one cooperates for the verification protocol. However, the lottery organization may claim that this ticket order was not registered in its database in order to avoid a verification. To prevent from such a behaviour, the players should be given a procedure allowing them to provide evidence that they previously made a ticket order. One could imagine that in case of non-cooperation by the lottery, the player can contact the service provider which stores all the communications related to the lottery game in order to get a certification that he really submitted this ticket order. In this way, the lottery should not be able to refuse a valid verification request provided that the service provider does not collude with the lottery organization ma- liciously. Again, since the ticket value at this time is quite small, the interest for the lottery or the service provider to cheat is very limited. Moreover, by doing so both entities take risk to create a damage to their image. Finally, we suggest that the above procedure should not be totally free of charge in case the player made an unjustified request in order to prevent from possible abuses by players.
7. Applications of the MOVA Scheme
Privacy of the Players. Identity of players and especially the “lucky” ones should be kept secret by the lottery organization. Here, all data are transmitted through the communication channels of the service provider. So, it is very important that these communications remain confidential and some legal means are required to prevent the service provider from misusing information. For instance, the service provider could try to sell some knowledge about big winners.