An official website of the United States government
We model and analyze the Signal end-to-end messaging protocol within the UC framework. In particular: - We formulate an ideal functionality that captures end-to-end secure messaging, in a setting with PKI and an untrusted server, against an adversary that has full control over the network and can adaptively and momentarily compromise parties at any time and obtain their entire internal states. In particular our analysis captures the forward secrecy and recovery-of-security properties of Signal and the conditions under which they break. - We model the main components of the Signal architecture (PKI and long-term keys, the backbone continuous-key-exchange or "asymmetric ratchet," epoch-level symmetric ratchets, authenticated encryption) as individual ideal functionalities that are realized and analyzed separately and then composed using the UC and Global-State UC theorems. - We show how the ideal functionalities representing these components can be realized using standard cryptographic primitives under minimal hardness assumptions. Our modeling introduces additional innovations that enable arguing about the security of Signal irrespective of the underlying communication medium, as well as secure composition of dynamically generated modules that share state. These features, together with the basic modularity of the UC framework, will hopefully facilitate the use of both Signal-as-a-whole and its individual components within cryptographic applications. Two other features of our modeling are the treatment of fully adaptive corruptions, and making minimal use of random oracle abstractions. In particular, we show how to realize continuous key exchange in the plain model, while preserving security against adaptive corruptions.
more »
« less
Universal Composition with Global Subroutines: Capturing Global Setup within plain UC
The Global and Externalized UC frameworks [Canetti-Dodis-Pass-Walfish, TCC 07] extend the plain UC framework to additionally handle protocols that use a "global setup", namely a mechanism that is also used by entities outside the protocol. These frameworks have broad applicability: Examples include public-key infrastructures, common reference strings, shared synchronization mechanisms, global blockchains, or even abstractions such as the random oracle. However, the need to work in a specialized framework has been a source of confusion, incompatibility, and an impediment to broader use. We show how security in the presence of a global setup can be captured within the plain UC framework, thus significantly simplifying the treatment. This is done as follows: - We extend UC-emulation to the case where both the emulating protocol π and the emulated protocol ϕ make subroutine calls to protocol γ that is accessible also outside π and ϕ. As usual, this notion considers only a single instance of ϕ or π (alongside γ). - We extend the UC theorem to hold even with respect to the new notion of UC emulation. That is, we show that if π UC-emulates ϕ in the presence of γ, then ρϕ→π UC-emulates ρ for any protocol ρ, even when ρ uses γ directly, and in addition calls many instances of ϕ, all of which use the same instance of γ. We prove this extension using the existing UC theorem as a black box, thus further simplifying the treatment. We also exemplify how our treatment can be used to streamline, within the plain UC model, proofs of security of systems that involve global set-up, thus providing greater simplicity and flexibility.
more »
« less
- PAR ID:
- 10299513
- Date Published:
- Journal Name:
- Theory of Cryptography Conference
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
ABSTRACT Observing 3D magnetic fields, including orientation and strength, within the interstellar medium is vital but notoriously difficult. However, recent advances in our understanding of anisotropic magnetohydrodynamic (MHD) turbulence demonstrate that MHD turbulence and 3D magnetic fields leave their imprints on the intensity features of spectroscopic observations. Leveraging these theoretical frameworks, we propose a novel Convolutional Neural Network (CNN) model to extract this embedded information, enabling the probe of 3D magnetic fields. This model examines the plane-of-the-sky magnetic field orientation (ϕ), the magnetic field’s inclination angle (γ) relative to the line-of-sight, and the total magnetization level (M$$_{\rm A}^{-1}$$) of the cloud. We train the model using synthetic emission lines of 13CO (J = 1–0) and C18O (J = 1–0), generated from 3D MHD simulations that span conditions from sub-Alfvénic to super-Alfvénic molecular clouds. Our tests confirm that the CNN model effectively reconstructs the 3D magnetic field topology and magnetization. The median uncertainties are under 5° for both ϕ and γ, and less than 0.2 for MA in sub-Alfvénic conditions (MA ≈ 0.5). In super-Alfvénic scenarios (MA ≈ 2.0), they are under 15° for ϕ and γ, and 1.5 for MA. We applied this trained CNN model to the L1478 molecular cloud. Results show a strong agreement between the CNN-predicted magnetic field orientation and that derived from Planck 353 GHz polarization. The CNN approach enabled us to construct the 3D magnetic field map for L1478, revealing a global inclination angle of ≈76° and a global MA of ≈1.07.more » « less
-
We develop the notion of a Kleinian Sphere Packing, a generalization of“crystallographic” (Apollonian-like) sphere packings defined in [A. Kontorovich and K. Nakamura,Geometry and arithmetic of crystallographic sphere packings,Proc. Natl. Acad. Sci. USA 116 2019, 2, 436–441].Unlike crystallographic packings, Kleinian packings exist in all dimensions, as do “superintegral” such.We extend the Arithmeticity Theorem to Kleinian packings, that is, the superintegral ones come from ℚ-arithmetic lattices of simplest type.The same holds for more general objects we call Kleinian Bugs, in which the spheres need not be disjoint but can meet with dihedral angles π/m for finitely many m. We settle two questions from Kontorovich and Nakamura (2019): (i) that the Arithmeticity Theorem is in general false over number fields, and (ii)that integral packings only arise from non-uniform lattices.more » « less
-
Secure function computation has been thoroughly studied and optimized in the past decades. We extend techniques used for secure computation to simulate arbitrary protocols involving a mediator. The key feature of our notion of simulation is that it is bidirectional: not only does the simulation produce only outputs that could happen in the original protocol, but the simulation produces all such outputs. In asynchronous systems there are also new subtleties that arise because the scheduler can influence the output. Thus, these requirements cannot be achieved by the standard notion of secure computation. We provide a construction that is secure if n > 4t, where t is the number of malicious agents, which is provably the best possible. We also show that our construction is secure in the universal composability model and that it satisfies additional security properties even if 3t < n \le 4t.more » « less
-
Chung, KM; Sasaki, Y (Ed.)We witness an increase in applications like cryptocurrency wallets, which involve users issuing signatures using private keys. To protect these keys from loss or compromise, users commonly outsource them to a custodial server. This creates a new point of failure, because compromise of such a server leaks the user’s key, and if user authentication is implemented with a password then this password becomes open to an offline dictionary attack (ODA). A better solution is to secret-share the key among a set of servers, possibly including user’s own device(s), and implement password authentication and signature computation using threshold cryptography. We propose a notion of augmented password-protected threshold signature (aptSIG) scheme which captures the best possible security level for this setting. Using standard threshold cryptography techniques, i.e. threshold password authentication and threshold signatures, one can guarantee that compromising up to t out of n servers reveals no information on either the key or the password. However, we extend this with a novel property, that compromising even all n servers also does not leak any information, except via an unavoidable ODA attack, which reveals the key only if the attacker guesses the password. We define aptSIG in the Universally Composable (UC) framework and show that it can be constructed very efficiently, using a black-box composition of any UC threshold signature [13] and a UC augmented Password-Protected Secret Sharing (aPPSS), which we define as an extension of prior notion of PPSS [30]. As concrete instantiations we obtain secure aptSIG schemes for ECDSA (in the case of t=n-1) and BLS signatures with very small overhead over the respective threshold signature. Finally, we note that both the notion and our generic solution for augmented password-protected threshold signatures can be generalized to password-protecting MPC for any keyed functions.more » « less
- Free Publicly Accessible Full Text
-
Accepted Manuscript1.0
- Conference Paper:
- The DOI is not currently available.
