TENSIONES YCONFLICTOS
V. 2 UN ESCOLLO INSALVABLE: LA CUESTIÓN RELIGIOSA.
Definition 3.2 (Trapdoor Permutation) A function f : {0, 1}∗ → {0, 1}∗ with an associ ated trapdoor information td ∈ {0, 1}κ, κ ∈
N is a trapdoor permutation if all of the following holds:
One-way permutation. If td is kept secret then f has the same properties as a one-way per mutation from Definition 3.1.
Easy to invert with a trapdoor. There exists a PPT algorithm that for all x ∈ {0, 1}∗ on
input td and y = f(x) outputs x. ♦
Note that the easy inversion with the trapdoor does not contradict the function’s one-wayness, because the trapdoor is not part of the function’s output and is therefore not part of A’s input. Obviously, any trapdoor permutation is also a one-way permutation. On the other hand, not every one-way permutation can be associated with a trapdoor. Therefore, the assumption on the existence of trapdoor permutations is strictly stronger than on the existence of one way functions. As we will see, existence of trapdoor permutations is likely to be the weakest assumption needed to construct secure group signatures, unlike ordinary signatures that can be constructed from one-way functions. Although existence of trapdoor permutations is an unproven assumption, a well-known candidate for a trapdoor permutation is the permutation used by the RSA cryptosystem (cf. Section 3.2.1).
3.2.
Number-Theoretic
Hardness
Assumptions
While general assumptions are helpful to assess security of cryptographic schemes from the theoretical point of view many practical cryptographic constructions require assumptions based on number-theory. In this section we give an overview of three number-theoretic settings that have been used in the design of modern group signature schemes. These include the RSA
setting, the DL setting, and the setting of bilinear maps, which can be seen as a special case of the DL setting with richer algebraic properties. In our description we will assume that the reader is familiar with basic number-theoretic concepts used in cryptography that can be found, for example, in the book of Shoup [171].
3.2.1.
Assumptions in the RSA Setting
The RSA setting is based on an algorithm RSAGen that on input a security parameter 1κ, κ ∈ N outputs a tuple of integers (N, p, q) such that N = pq is of length κ, and p, q are prime numbers. N is called RSA modulus. Moreover, if p, q are safe primes, i.e. p = 2p ' + 1 and
' ' '
q = 2q + 1 with p and q being primes as well, then the RSA modulus N is called safe. It is widely assumed that factoring N, that is computing its prime factors p and q, is hard if these factors are sufficiently large. The RSA setting admits further hardness assumptions that we will use in our description of group signatures and introduce in the following.
Definition 3.3 (Strong RSA Assumption (SRSA)) Let RSAGen be an algorithm that out puts (N, p, q) with N being a (safe) RSA modulus and let G = (g) denote a cyclic subgroup of ZN∗ of order Q with length |Q| = κ. The Strong RSA (SRSA) assumption says that for all PPT algorithms A the following advantage function is negligible in κ:
AdvSRSA (N, p, q) ← RSAGen(1
κ), z ∈R
G, u ∈ G, e ∈ Z>1
RSAGen,A(κ) = Pr (u, e) ← A(N, g, z) : ue= z (mod N) .
♦
A frequent choice for G in the context of group signatures is the group of quadratic residues
modulo N, denoted QR(N). This group of order p 'q ' is generated by an element g ∈ ZN. An appropriate generator g can be chosen by picking a ∈ Z∗N such that gcd(a ± 1, N) = 1, in which case g = a2 mod N. Security of several group signatures, where the QR(N) group is used, relies further on the following assumption.
Definition 3.4 (Decision Diffie-Hellman (DDH) Assumption in QR(N)) Let RSAGen
be an algorithm that outputs (N, p, q) with N being a (safe) RSA modulus and let QR(N) = (g) denote the group of quadratic residues modulo N of order p 'q ' of length κ. The Decision
Diffie-Hellman(DDH)assumption in QR(N) says that for all PPT algorithms A the following
advantage function is negligible in κ:
(N, p, q) ← RSAGen(1κ), x, y, z ∈R Zplql, 1
AdvDDHRSAGen,A(κ) = Pr : b = b∗ − . g0 = gxy, g1 = gz, b ∈R {0, 1}, b∗ ← A(N, g, gx, gy, gb) 2
♦
The DDH assumption in QR(N) groups is a special type of the more general DDH assump tion, which can be defined over cyclic groups G of prime order (cf. Definition 3.6). Interestingly, in QR(N) groups the DDH assumption is assumed to hold, irrespective of whether the factors p and q of the RSA modulus N are known or not.
3.2.2.
Assumptions in the DL Setting
The Discrete Logarithm (DL) setting is based on an algorithm GenG that on input a security parameter 1κ, κ ∈
N outputs the description of a cyclic group (G, g, Q) where g is the generator and the order Q is prime and of length κ. The DL setting admits the following hardness assumptions that we will refer to in the constructions of group signature schemes.
Definition 3.5 (Discrete Logarithm (DL) Assumption) Let GenG be an algorithm that outputs the description of a cyclic group (G, g, Q) with Q prime and |Q| = κ. The Discrete Logarithm(DL) assumption says that for all PPT algorithms A the following advantage function is negligible in κ: (G, g, Q) ← GenG(1κ), h ∈ R G, x ∈ ZQ AdvDLGenG,A(κ) = Pr : x . x ← A(G, g, Q, h) g = h ♦
A popular example of a suitable group, often used in cryptographic schemes, is a subgroup G ⊂ ZP of a prime order Q|P − 1 where P is also prime.
Furthermore, the DDH assumption introduced for QR(N) groups in the previous section (cf. Definition 3.4) can be generalized to cyclic groups of prime order. For example, IND-CPA security of the well-known ElGamal encryption scheme [88] relies on the DDH assumption.
Definition 3.6 (Decision Diffie-Hellman (DDH) Assumption in Groups of Prime Order)
Let GenG be an algorithm that outputs the description of a cyclic group (G, g, Q) with Q prime and |Q| = κ. The Decision Diffie-Hellman (DDH) assumption in G says that for all PPT algorithms A the following advantage function is negligible in κ:
(G, g, Q) ← GenG(1κ), x, y, z ∈R ZQ, 1
AdvDDHGenG,A(κ) = Pr : b = b∗ − .
g0 = gxy, g1 = gz, b ∈R {0, 1}, b∗ ← A(g, gx, gy, gb) 2
♦
3.2.3.
Assumptions in the Setting of Bilinear Maps
The cryptographic setting of bilinear maps, also known as pairings serves as a basis for many modern group signature schemes as it provides richer algebraic structure in comparison to the DL and RSA settings. The setting of bilinear maps is based on an algorithm GenBG that on input a security parameter 1κ, κ ∈
N outputs the description of two cyclic groups (G1, g1, Q) and (G2, g2, Q) of prime order Q of length κ and respective generators g1 and g2 with an associated bilinear map e : G1 × G2 → GT where GT is another cyclic group (called target group) of order Q. The corresponding groups G1 and G2 are called bilinear if they satisfy the following definition.
Definition 3.7 (Bilinear Groups) Let GenBGbe an algorithm that outputs the description of two cyclic groups G1 = (g1) and G2 = (g2) of prime order Q with |Q| = κ, where possibly
G1 = G2, and the description of e : G1×G2 → GT with GT being another cyclic group of prime order Q. The group pair (G1, G2) is called bilinear if the following holds:
1. Efficiency: The bilinear map e : G1× G2 → GT can be computed in polynomial-time. a
2. Bilinearity: For all u ∈ G1, v ∈ G2 and a, b ∈ ZQ: e(u , vb) = e(u, v)ab. 3. Non-degeneracy: e(g1, g2) = 1.
There can further exist an efficiently computable homomorphism ψ from G2 to G1 with ψ(g2) =
g1. ♦
Depending on the choice of the input groups (G1, G2) and existence of the homomorphism ψ, the associated pairing e : G1× G2 → GT can be classified as follows (see also Galbraith, Paterson, and Smart [95]).
Definition 3.8 (Bilinear Maps: Classification) Let (G1, G2) be bilinear groups and e : G1 × G2 → GT the associated bilinear map according to Definition 3.7.
Type-1. e is of Type-1 if G1 = G2.
Type-2. e is of Type-2 if G1 = G2 and there exists an efficiently computable homomorphism ψ : G2 → G1.
Type-3. e is of Type-3 if G1 = G2 and there exists no efficiently computable homomorphism ψ : G2 → G1.
♦
In general, different pairing types may admit different hardness assumptions and result in more or less efficient implementations. For example, the DDH assumption does not hold in Type-1 pairings. Indeed, if G1 = G2 and the corresponding generator is g then for a given problem instance (g, gx, gy, g
b) one can easily distinguish the corresponding bit b by testing whether e(gx, gy) = e(g
b, g). In Type-2 pairings the DDH assumption is assumed to hold only in the input group G1, whereas in Type-3 pairings the DDH assumption is assumed to hold in both input groups G1 and G2. From the efficiency point of view, Type-3 pairings admit the most efficient implementations, considering both bandwidth and computation costs.
In the following we focus on some number-theoretic hardness assumptions, frequently used in the design of group signatures. We start with the q-Strong Diffie-Hellman (q-SDH) assumption, which was introduced by Boneh and Boyen [35]. It is one of the most popular assumptions used to prove security of various signature and group signature schemes.
Definition 3.9 (q-Strong Diffie-Hellman (q-SDH) Assumption) Let GenBGbe an algo rithm that outputs a pair of bilinear groups G1 = (g1) and G2 = (g2) of prime order Q with |Q| = κ, and the associated bilinear map e : G1 × G2 → GT. The q-Strong Diffie-Hellman
(q-SDH) assumption in (G1, G2) with q ∈ N says that for all PPT algorithms A the following advantage function is negligible in κ:
γ ∈RZQ 1
Advq−SDH γ+x
GenBG,A(κ) = Pr γ (γ2) (γq) : x ∈
ZQ∗, g = g . (g, x) ← A(g1, g2, g 2, g2 , . . . , g2 ) 1
♦
The following Decision Linear (DLIN) assumption was introduced by Boneh, Boyen, and Shacham [36]. It serves as a basis of the Linear Encryption scheme, which can be seen as an analog of the ElGamal encryption scheme in bilinear groups, most frequently in Type-1 pairings, where the original DDH problem is not necessarily hard. We define the DLIN assumption in the setting of bilinear maps, where it is traditionally used. However, we note that DLIN assumption can also be formulated in the standard DL setting using the corresponding algorithm GenG.
Definition 3.10 (Decision Linear (DLIN) Assumption) Let G = (g) be one of the bilin ear groups of prime order Q with |Q| = κ output by an algorithm GenBG, and u, v, and h be arbitrary generators of G. The Decision Linear (DLIN) assumption in G says that for all PPT algorithms A the following advantage function is negligible in κ:
AdvDLIN u, v, h ∈RG, α, β, γ ∈RZQ, h0 = h α+β, h 1 = hγ 1 Pr : b = b∗ − . GenBG,A(κ) = b ∈ R {0, 1}, b∗ ← A(u, v, h, uα, vβ, hb) 2 ♦
It can be shown that an algorithm breaking the DLIN Assumption in Gcan be used to solve the DDH problem in G while the converse is believed to be false.
The following Decision Bilinear Diffie-Hellman (DBDH) assumption was introduced by Boneh and Boyen [34].
Definition 3.11 (Decision Bilinear Diffie-Hellman (DBDH) Assumption) Let G = (g) be one of the bilinear groups of prime order Q with |Q| = κ output by an algorithm GenBG. The
Decision Bilinear Diffie-Hellman (DBDH) assumption in G says that for all PPT algorithms A the following advantage function is negligible in κ:
AdvDBDH a, b, c, d ∈R ZQ, h0 = e(g, g) abc, h 1 = e(g, g)d 1 GenBG,A(κ) = Pr b : b = b ∗ − . a b ∈R{0, 1}, b∗ ← A(g, g , g , gc, hb) 2 ♦
The following LRSW assumption was introduced by Lysyanskaya et al. [135]. The LRSW assumption is defined for general prime order groups G, however, we will use it mostly in the context of bilinear groups with G being one of the input groups (i.e. G1 or G2). Additionally, we mention the asymmetric version of the LRSW assumption, which explicitly takes inputs from both input groups G1 and G2.
Definition 3.12 (LRSW Assumption) Let G = (g) be a group of prime order Q with |Q| = κ and X, Y ∈ G with X = gx and Y = gy. Let O
X,Y(·) be an oracle that, on input a value m ∈ ZQ, outputs a triple (a, ay, ax+mxy) for a randomly chosen a ∈
G.
The LRSW assumption in G says that for all PPT algorithms A the following advantage function (where Q is the set of queries A poses to OX,Y(·)) is negligible in κ:
AdvLRSW x ∈R ZQ, y ∈RZQ, X = g x, Y = gy m ∈ Q, m ∈ ZQ, m = 0 (κ) = Pr : . A (m, a, b, c) ← AOX,Y (·)(Q, y x+mxy G, g, X, Y ) a ∈ G, b = a , c = a
The asymmetric version of the LRSW assumption employs two different groups G1 = (g1) and G2 = (g2), both of prime order Q with |Q| = κ, such that a ∈ G1, whereas X, Y ∈ G2. ♦
The following SDLP assumption was introduced by Bichsel et al. [31].
Definition 3.13 (SDLP Assumption) Let G1 = (g1), G2 = (g2) be bilinear groups of prime order Q with |Q| = κ with the associated bilinear map e.
The SDLP assumption in (G1, G2) says that for all PPT algorithms A the following advantage function is negligible in κ:
AdvSDLPA (κ) = Pr µ ∈RZQ, µ ∗ ← A(Q, G1, G2, g1, g2, e, g1µ, g2µ) : µ = µ∗ .
♦