Tight Time-Space Tradeoffs for the Decisional Diffie-Hellman Problem
Pages 1739 - 1749
Abstract
In the (preprocessing) Decisional Diffie-Hellman (DDH) problem, we are given a cyclic group G with a generator g and a prime order N, and want to prepare some advice of S, such that we can efficiently distinguish (gx,gy,gxy) from (gx,gy,gz) in time T for uniformly and independently chosen x,y,z from [N]. This is a central cryptographic problem whose computational hardness underpins many widely deployed schemes such as the Diffie–Hellman key exchange protocol.
We prove that any generic preprocessing DDH algorithm (operating in any cyclic group) achieves advantage at most O(ST2/N). This bound matches the best known attack up to poly-log factors, and confirms that DDH is as secure as the (seemingly harder) discrete logarithm problem against preprocessing attacks. Our result resolves an open question by Corrigan-Gibbs and Kogan (EUROCRYPT 2018), which proved optimal bounds for many variants of discrete logarithm problems except DDH (with an O(√ST2/N) bound).
We obtain our results by adopting and refining the approach by Gravin, Guo, Kwok, Lu (SODA 2021) and by Yun (EUROCRYPT 2015). Along the way, we significantly simplified and extended above techniques which may be of independent interests. The highlights of our techniques are following:
1. We obtain a simpler reduction from decisional problems against S-bit advice to their S-wise XOR lemmas against zero-advice, recovering the reduction by Gravin, Guo, Kwok and Lu (SODA 2021).
2. We show how to reduce generic hardness of decisional problems to their variants in the simpler hyperplane model proposed by Yun (EUROCRYPT 2015). This is the first work analyzing a decisional problem in Yun’s model, answering an open problem proposed by Auerbach, Hoffman, and Pascual-Perez (TCC 2023).
3. We prove an S-wise XOR lemma of DDH in Yun’s model. As a corollary, we obtain the generic hardness of the S-XOR DDH problem.
References
[1]
Akshima, David Cash, Andrew Drucker, and Hoeteck Wee. 2020. Time-Space Tradeofs and Short Collisions in Merkle-Damgård Hash Functions. In CRYPTO. https://doi.org/10.1007/978-3-030-56784-2_6
[2]
Akshima, Xiaoqi Duan, Siyao Guo, and Qipeng Liu. 2023. On Time-Space Lower Bounds for Finding Short Collisions in Sponge Hash Functions. In TCC. https: //doi.org/10.1007/978-3-031-48621-0_9
[3]
Akshima, Siyao Guo, and Qipeng Liu. 2022. Time-Space Lower Bounds for Finding Collisions in Merkle-Damgård Hash Functions. In CRYPTO. https: //doi.org/10.1007/978-3-031-15982-4_7
[4]
Benedikt Auerbach, Charlotte Hofmann, and Guillermo Pascual-Perez. 2023. Generic-Group Lower Bounds via Reductions Between Geometric-Search Problems: With and Without Preprocessing. In TCC. https://doi.org/10.1007/978-3-031-48621-0_11
[5]
James Bartusek, Fermi Ma, and Mark Zhandry. 2019. The Distinction Between Fixed and Random Generators in Group-Based Assumptions. In CRYPTO. https: //doi.org/10.1007/978-3-030-26951-7_27
[6]
Daniel J. Bernstein and Tanja Lange. 2013. Non-uniform cracks in the concrete: the power of free precomputation. In ASIACRYPT. https://doi.org/10.1007/978-3-642-42045-0_17
[7]
Dror Chawin, Iftach Haitner, and Noam Mazor. 2020. Lower Bounds on the Time/Memory Tradeof of Function Inversion. In TCC. https://doi.org/10.1007/ 978-3-030-64381-2_11
[8]
Kai-Min Chung, Siyao Guo, Qipeng Liu, and Luowen Qian. 2020. Tight Quantum Time-Space Tradeofs for Function Inversion. In FOCS. https://doi.org/10.1109/ FOCS46700. 2020.00068
[9]
Sandro Coretti, Yevgeniy Dodis, and Siyao Guo. 2018. Non-Uniform Bounds in the Random-Permutation, Ideal-Cipher, and Generic-Group Models. In CRYPTO. https://doi.org/10.1007/978-3-319-96884-1_23
[10]
Sandro Coretti, Yevgeniy Dodis, Siyao Guo, and John P. Steinberger. 2018. Random Oracles and Non-uniformity. In EUROCRYPT. https://doi.org/10.1007/978-3-319-78381-9_9
[11]
Henry Corrigan-Gibbs and Dmitry Kogan. 2018. The Discrete-Logarithm Problem with Preprocessing. In EUROCRYPT. https://doi.org/10.1007/978-3-319-78375-8_14
[12]
Henry Corrigan-Gibbs and Dmitry Kogan. 2019. The Function-Inversion Problem: Barriers and Opportunities. In TCC. https://doi.org/10.1007/978-3-030-36030-6_16
[13]
Anindya De, Luca Trevisan, and Madhur Tulsiani. 2010. Time Space Tradeofs for Attacks against One-Way Functions and PRGs. In CRYPTO. https://doi.org/ 10.1007/978-3-642-14623-7_35
[14]
Whitfield Difie and Martin E. Hellman. 1976. New directions in cryptography. IEEE Transactions on Information Theory 22, 6 ( 1976 ), 644-654. https://doi.org/ 10.1109/TIT. 1976.1055638
[15]
Yevgeniy Dodis, Siyao Guo, and Jonathan Katz. 2017. Fixing Cracks in the Concrete: Random Oracles with Auxiliary Input, Revisited. In EUROCRYPT. https: //doi.org/10.1007/978-3-319-56614-6_16
[16]
Pierre-Alain Fouque, Antoine Joux, and Chrysanthi Mavromati. 2014. Multi-user Collisions: Applications to Discrete Logarithm, Even-Mansour and PRINCE. In ASIACRYPT. https://doi.org/10.1007/978-3-662-45611-8_22
[17]
Cody Freitag, Ashrujit Ghoshal, and Ilan Komargodski. 2022. Time-Space Tradeofs for Sponge Hashing: Attacks and Limitations for Short Collisions. In CRYPTO. https://doi.org/10.1007/978-3-031-15982-4_5
[18]
Cody Freitag, Ashrujit Ghoshal, and Ilan Komargodski. 2023. Optimal Security for Keyed Hash Functions: Avoiding Time-Space Tradeofs for Finding Collisions. In EUROCRYPT. https://doi.org/10.1007/978-3-031-30634-1_15
[19]
Ashrujit Ghoshal and Ilan Komargodski. 2022. On Time-Space Tradeofs for Bounded-Length Collisions in Merkle-Damgård Hashing. In CRYPTO. https: //doi.org/10.1007/978-3-031-15982-4_6
[20]
Alexander Golovnev, Siyao Guo, Spencer Peters, and Noah Stephens-Davidowitz. 2023. Revisiting Time-Space Tradeofs for Function Inversion. In CRYPTO. https: //doi.org/10.1007/978-3-031-38545-2_15
[21]
Nick Gravin, Siyao Guo, Tsz Chiu Kwok, and Pinyan Lu. 2021. Concentration bounds for almost k-wise independence with applications to non-uniform security. In SODA. https://doi.org/10.1137/1.9781611976465.143
[22]
Russell Impagliazzo. 2011. Relativized Separations of Worst-Case and AverageCase Complexities for NP. In CCC. https://doi.org/10.1109/CCC. 2011.34
[23]
Fabian Kuhn and René Struik. 2001. Random Walks Revisited: Extensions of Pollard's Rho Algorithm for Computing Multiple Discrete Logarithms. In SAC. https://doi.org/10.1007/3-540-45537-X_17
[24]
Hyung Tae Lee, Jung Hee Cheon, and Jin Hong. 2011. Accelerating ID-based encryption based on trapdoor DL using pre-computation. Cryptology ePrint Archive ( 2011 ).
[25]
Joseph P Mihalcik. 2010. An analysis of algorithms for solving discrete logarithms in fixed groups. Ph. D. Dissertation. Citeseer.
[26]
J. T. Schwartz. 1980. Fast Probabilistic Algorithms for Verification of Polynomial Identities. J. ACM 27, 4 ( 1980 ), 701-717. https://doi.org/10.1145/322217.322225
[27]
Victor Shoup. 1997. Lower Bounds for Discrete Logarithms and Related Problems. In EUROCRYPT. https://doi.org/10.1007/3-540-69053-0_18
[28]
Dominique Unruh. 2007. Random Oracles and Auxiliary Input. In CRYPTO. https://doi.org/10.1007/978-3-540-74143-5_12
[29]
Aaram Yun. 2015. Generic Hardness of the Multiple Discrete Logarithm Problem. In EUROCRYPT. https://doi.org/10.1007/978-3-662-46803-6_27
[30]
R. Zippel. 1979. Probabilistic algorithms for sparse polynomials. In EUROSAM. https://doi.org/10.1007/3-540-09519-5_73
Index Terms
- Tight Time-Space Tradeoffs for the Decisional Diffie-Hellman Problem
Recommendations
Public-key encryption scheme with selective opening chosen-ciphertext security based on the Decisional Diffie-Hellman assumption
Chosen-ciphertext security has been well-accepted as a standard security notion for public-key encryption. But in a multi-user surrounding, it may not be sufficient, because the adversary may corrupt some users to obtain the random coins as well as the ...
A note on chosen-basis decisional diffie-hellman assumptions
FC'06: Proceedings of the 10th international conference on Financial Cryptography and Data SecurityThis note discusses two Decisional Diffie-Hellman assumption variants introduced by Abdalla and Pointcheval at Financial Cryptography' 05. Those authors introduce two new problems and associated assumptions called the Chosen-Basis Decisional Diffie-...
The Twin Diffie–Hellman Problem and Applications
We propose a new computational problem called the twin Diffie–Hellman problem. This problem is closely related to the usual (computational) Diffie–Hellman problem and can be used in many of the same cryptographic constructions that are based on the ...
Comments
Information & Contributors
Information
Published In
June 2024
2049 pages
ISBN:9798400703836
DOI:10.1145/3618260
- General Chairs:
- Bojan Mohar,
- Igor Shinkar,
- Program Chair:
- Ryan O'Donnell
Copyright © 2024 Copyright is held by the owner/author(s). Publication rights licensed to ACM.
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].
Sponsors
Publisher
Association for Computing Machinery
New York, NY, United States
Publication History
Published: 11 June 2024
Check for updates
Author Tags
Qualifiers
- Research-article
Funding Sources
- National Natural Science Foundation of China
Conference
STOC '24
Sponsor:
Acceptance Rates
Overall Acceptance Rate 1,469 of 4,586 submissions, 32%
Contributors
Other Metrics
Bibliometrics & Citations
Bibliometrics
Article Metrics
- 0Total Citations
- 122Total Downloads
- Downloads (Last 12 months)122
- Downloads (Last 6 weeks)50
Reflects downloads up to 09 Aug 2024
Other Metrics
Citations
View Options
Get Access
Login options
Check if you have access through your login credentials or your institution to get full access on this article.
Sign in