Continuous Non-malleable Key Derivation and its Application to Related-Key Security

• Main Authors: QIN, Baodong, LIU, Shenli, YUEN, Tsz Hon, DENG, Robert H., CHEN, Kefei
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2015
• Subjects: Related-key attacks; Non-malleable key derivation; One-time lossy filter; Computer Sciences; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/2886; https://ink.library.smu.edu.sg/context/sis_research/article/3886/viewcontent/Qin2015_Chapter_ContinuousNon_malleableKey_pv.pdf
• Institution: Singapore Management University

Related-Key Attacks (RKAs) allow an adversary to observe the outcomes of a cryptographic primitive under not only its original secret key e.g., s, but also a sequence of modified keys ϕ(s), where ϕ is specified by the adversary from a class Φ of so-called Related-Key Derivation (RKD) functions. This paper extends the notion of non-malleable Key Derivation Functions (nm-KDFs), introduced by Faust et al. (EUROCRYPT’14), to continuous nm-KDFs. Continuous nm-KDFs have the ability to protect against any a-priori unbounded number of RKA queries, instead of just a single time tampering attack as in the definition of nm-KDFs. Informally, our continuous non-malleability captures the scenario where the adversary can tamper with the original secret key repeatedly and adaptively. We present a novel construction of continuous nm-KDF for any polynomials of bounded degree over a finite field. Essentially, our result can be extended to richer RKD function classes possessing properties of high output entropy and input-output collision resistance. The technical tool employed in the construction is the one-time lossy filter (Qin et al. ASIACRYPT’13) which can be efficiently obtained under standard assumptions, e.g., DDH and DCR. We propose a framework for constructing Φ-RKA-secure IBE, PKE and signature schemes, using a continuous nm-KDF for the same Φ-class of RKD functions. Applying our construction of continuous nm-KDF to this framework, we obtain the first RKA-secure IBE, PKE and signature schemes for a class of polynomial RKD functions of bounded degree under standard assumptions. While previous constructions for the same class of RKD functions all rely on non-standard assumptions, e.g., d-extended DBDH assumption.