Multi-user (mu) security considers large-scale attackers that, given access to a number of cryptosystem instances, attempt to compromise at least one of them. We initiate the study of mu security of the so-called GGM tree that stems from the pseudorandom generator to pseudorandom function transformation of Goldreich, Goldwasser, and Micali, with a goal to provide references for its recently popularized use in applied cryptography. We propose a generalized model for GGM trees and analyze its mu prefix-constrained pseudorandom function security in the random oracle model. Our model allows to derive concrete bounds and improvements for various protocols, and we showcase on the Bitcoin-Improvement-Proposal standard Bip32 hierarchical wallets and function secret sharing protocols. In both scenarios, we propose improvements with better performance and concrete security bounds at the same time. Compared with the state-of-the-art designs, our SHACAL3- and Keccak-p-based Bip32 variants reduce the communication cost of MPC-based implementations by 73.3% to 93.8%, whereas our AES-based function secret sharing substantially improves mu security while reducing computations by 50%.
1 Introduction
GGM Tree.Pseudorandom Functions (PRFs) and Pseudorandom Generators (PRGs) are fundamental building blocks of virtually all cryptosystems. The PRG-to-PRF transformation of Goldreich et al. [31], dubbed GGM tree, was originally proposed to show the theoretical feasibility of constructing PRFs from any one-way function. Interestingly, subsequent works exhibited various “beyond-PRF” security for the GGM tree. Importantly for us, Boneh and Waters [11] and Boyle et al. [18] showed a Constrained Pseudorandom Function (CPRF) based on GGM tree with prefix predicates, meaning that it allows to delegate “constrained” keys that can only be used to evaluate the GGM PRF on a subset of inputs with certain prefixes. This can also be used as a Puncturable Pseudorandom Function (PPRF), the “dual” of CPRFs. These features have motivated extensive practical uses of the GGM: as a CPRF in delegatable computations [36] and functional signatures [18], as a hierarchical access mechanism in the \(\mathsf {Bip32}\) Hierarchical Deterministic Wallets (HDWs), as a PPRF in Function Secret Sharing (FSS) protocols [16, 17]), and as part of the construction of a private PPRF in Pseudorandom Correlation Generator (PCG) [13, 15] that supports more sophisticated applications including (RAM-based) secure multi-party computation [27, 48] and zero-knowledge proofs [4, 24].
Multi-User Security. The classical (constrained/puncturable) PRF security of a function family \(\mathsf {F}\) concerns the behavior of \(\mathsf {F} (K,\cdot)\) under a (fixed) secret key K, which is now known as the Single-User (su) setting. Due to the pervasive uses, a large number of GGM tree instances using the same specification and independently chosen keys become available from different entities across the Internet. For example, the Exodus Platform is based on \(\mathsf {Bip32}\) and has millions of active users [28]. This effectively creates millions of independently keyed “ \(\mathsf {Bip32}\) key trees” or generalized GGM trees. As another example, to compute stable marriage (as in the work of Doener et al. [26]), a Two-Party Computation (2PC) protocol (like GMW) needs to evaluate \(2^{38}\) AND gates using \(2^{39}\) OT executions. Using the state-of-the-art PCG-based OT protocol [52], which needs 1,295 GGM trees to generate \(10^7\) OTs, this requires executing FSS and instantiating GGM for \(\approx 2^{26}\) times. By these, once different users have conducted such computations \(2^{14}\) times, the total number of GGM instances approaches \(2^{40}\) .
It could be sufficient to corrupt just one of the numerous instances: the breach of any of the \(\mathsf {Bip32}\) users already incurs severe loss of funds, and the breach of any of the trees in 2PC already breaks necessary (pseudo)randomness in the protocol. This challenges security in the Multi-User (mu) setting, in which for a parameter u representing the maximal number of users, there are u independently chosen secret keys \(K_1,\ldots ,K_u\) , and the adversary succeeds as long as it compromises at least one out of u instances \(\mathsf {F} (K_1,\cdot),\ldots ,\mathsf {F} (K_u,\cdot)\) of the target \(\mathsf {F}\) .
The \(\mathrm{mu}\) setting was first formalized in public-key cryptography [6]. Asymptotically, it is equivalent to \(\mathrm{su}\) security: a scheme with \(\kappa\) bits \(\mathrm{su}\) security trivially ensures \(\kappa -\log _2 u\) bits \(\mathrm{mu}\) security by a standard hybrid argument. However, as discussed, u can be large in practice, and the \(\log _2 u\) bits degradation has incurred serious concerns [7, 32] and even practical Bitcoin cracking projects [39]. Formally exploring the relation between concrete bounds and various parameters (including u) is technically challenging, as made evident in recent works regarding public-key [6, 8, 37] and symmetric-key schemes [5, 7, 12, 32], and results have explicitly influenced real-world designs [7, 8].
Despite the raised \(\mathrm{mu}\) challenge, formal \(\mathrm{mu}\) CPRF or PPRF security treatments of GGM remain missing, and this undermines security of applications. As discussed, trivial bounds are seldom satisfactory. Recall the example of 2PC using 128-bit keys: the trivial bound indicates 88-bit security1 and falls far below the expected 128 bits. For \(\mathsf {Bip32}\) , recent work [21] proved 111-bit \(\mathrm{su}\) security, by which the trivial bound indicates 91-bit \(\mathrm{mu}\) security as long as \(2^{20}\) \(\mathsf {Bip32}\) users are available.
Facing the difficulty in providing dedicated \(\mathrm{mu}\) security proofs for each application, we seek for unified treatments with full proofs of non-trivial \(\mathrm{mu}\) bounds, to provide a systematic reference for their practical deployments (which is the ultimate goal of cryptography).
1.1 Our Contribution
We provide generalized \(\mathrm{mu}\) security definitions, a unified model of the GGM tree, and concrete \(\mathrm{mu}\) security proofs. Improved tree schemes with non-trivial, proven \(\mathrm{mu}\) bounds can be easily derived from our model, and we showcase on \(\mathsf {Bip32}\) and recent FSS protocols. We elaborate on these contributions in the following.
1.1.1 Generalized GGM Tree and Its \(\mathrm{mu}\) Security.
To unify the models in various settings, we extend both the CPRF security definition and the GGM scheme. Regarding the former, we start with the fully adaptive CPRF security notion of Hofheinz et al. [34] and extend it along two axes to reach a \(\mathrm{mu}\) leakage CPRF security definition in the simulation paradigm:
(i)
\(\text{Multi-user}\) : The ( \(\mathrm{su}\) ) CPRF security definition of Hofheinz et al. [34] allows the adversary to adaptively acquire constrained keys and function values, and requires the function value \(\mathsf {F} (K,x)\) to be pseudorandom for any x that has never been constrained. Our natural \(\mathrm{mu}\) extension considers u secret user keys \(K_1,\ldots ,K_u\) , and requires the function values \(\mathsf {F} (K_i,x),\mathsf {F} (K_j,x^{\prime })\) to be pseudorandom and independent for any two involved user keys \(K_i,K_j\) , and for x unconstrained w.r.t. \(K_i\) and \(x^{\prime }\) unconstrained w.r.t. \(K_j\) .
(ii)
Protocol-level leakages: In some applications, such as the \(\mathsf {Bip32}\) , the (secret) intermediate values of the \(\mathsf {F}\) evaluations are used to derive public information and incur protocol-level leakages. To formalize these settings, we augment the real world with a (context-dependent) leakage oracle \(\mathsf {L}\) outputting leakages of the corresponding intermediate values upon every query, and the ideal world with a leakage simulator \(\mathsf {S}\) outputting faked leakages. The detailed leakages depend on the concrete context, and we refer to Section 4.1 for an example.
Regarding the scheme, we propose a generalized model for GGM trees. Our model is built upon a public cryptographic primitive \(\mathbf {Prim}\) (that can be accessed by the adversary), uses \(\kappa\) -bit internal secrets, and allows for multiple branches. To reflect influences of public parameters, every \(\mathbf {Prim}\) -call in the tree has an additional input that we informally called label. Modeling \(\mathbf {Prim}\) as either a Fixed-Input-Length Random Oracle (FIL RO) \(\mathbf {H}\) (to justify instantiating \(\mathbf {Prim}\) with cryptographic hash functions) or a Davies-Meyer construction \(\mathsf {DM} ^\mathbf {E} (L,x) = \mathbf {E} (L,x)\oplus x\) based on an ideal cipher \(\mathbf {E}\) (to justify instantiating \(\mathbf {Prim}\) with block ciphers), we analyze the generalized tree w.r.t. our \(\mathrm{mu}\) leakage CPRF security definition. We prove \(\kappa - \log _2 C\) bits \(\mathrm{mu}\) CPRF security, where C is a parameter depending on the probability among distinct “label” inputs of the internal \(\mathbf {Prim}\) calls across all the users. When all “labels” are the same, security becomes (inferior) \(\kappa - \log _2 D\) bits, where D, called effective data complexity, is the total number of \(\mathbf {Prim}\) -calls internally made by the u tree instances and is related to the number of adversarial queries to the trees. When collisions among “labels” are unlikely, security becomes nearly optimal \(\approx \kappa\) bits. Moreover, the leakage of certain intermediate values are indistinguishable from random “simulated leakages,” indicating that protocols can extract (a limited amount of) pseudorandom bits from the intermediate values in the tree and use them in arbitrary.
The random oracle based trees can be instantiated with truncated \({\rm K}{\rm\small{ECCAK-}}p\) permutations of \(\mathsf {SHA3}\) [20], whereas the results on Davies-Meyer-based trees enable instantiations using the compression function of \(\mathsf {SHA512}\) or the \(\mathsf {AES}\) in Davies-Meyer mode. Note that even if \(\mathbf {E}\) is ideal, the Davies-Meyer construction \(\mathsf {DM} ^\mathbf {E}\) cannot be modeled as a random oracle [25], and we thus have to appeal for a dedicated analysis, and the proved bounds differ by a factor of 2.
Although our security definition, model, and provable bounds appear complicated, our analyses complete a large step of proofs for a wide range of GGM tree variants and shed light on the influences of parameters. To derive bounds for concrete designs, designers just need to fill in the parameters and make some additional counting for the aforementioned C and D. We believe this could help characterize \(\text{state-of-the-art}\) designs and provide building blocks for the coming NIST standardization [45]. We will showcase on two applications.
We remark that our bounds are proven in the ideal (function or cipher) model and should be taken as a heuristic insurance for their practical instantiations. This theoretical caveat is shared by similar works [1, 21, 22]. However, the use of an ideal model appears necessary to characterize how local computation (approximated by the number of ideal primitive queries) affects security in the \(\mathrm{mu}\) setting [7, 12, 32]. Meanwhile, as noted in the work of Shrimpton and Terashima [49], standard model proofs fail to yield “realistic” \(\mathrm{mu}\) security bounds for many symmetric schemes with rekeying [12, 32] (which is extensively used in \(\mathsf {Bip32}\) ).2
Puncturable Pseudorandom Functions. We take a natural step further and consider generalized GGM as a PPRF [11, 17, 36]. This is a PRF \(\mathsf {F}\) such that given an input x and a key K, one can generate a punctured key, denoted \(K\lbrace x\rbrace\) , which allows evaluating \(\mathsf {F}\) at every point except forx, and does not reveal any information about the function value \(\mathsf {F} (K,x)\) . The notion was subsequently extended to allow for puncturing multiple inputs [35]. This functionality is the “dual” of CPRFs. In this respect, we extend PPRFs to the mu and leakage setting, and establish mu leakage PPRF security for generalized GGM using the aforementioned CPRF results.
1.1.2 Multi-User Security of \(\mathsf {Bip32}\) and Improvements.
The \(\mathsf {Bip32}\) HDW specifies a GGM tree based approach to derive a collection of digital signature keys organized under an access hierarchy [44]. We refer to Figure 1 for an overview and Section 6.1 for more details. Prior works on such HDWs typically focused on enhancing functionalities or achieving new security notions (see Section 1.2). Despite the importance for practical assurance, (a) the hierarchical security of \(\mathsf {Bip32}\) was never formally proved, and (b) the concrete bounds were never characterized even in the \(\mathrm{su}\) setting (modulo a concurrent work [21]: see Section 1.2).
Fig. 1.
Fig. 1. The key tree in default configuration of \(\mathsf {Bip32}\) . Due to space, we omit some nodes. S is the seed of the HDW instance, and “Bitcoin seed” is the 96-bit literal string. The values \(\mathsf {wsk} _{\bot },\mathsf {wsk} _{0},\ldots\) are wallet secret keys of \(\mathsf {Bip32}\) and will be formalized in Sections 6.2 and 6.3. The dashed box in the corner shows the internal computations of the function \(\mathsf {CKDpriv}\) (which will be formally defined in Figure 6). The functions \(\mathsf {lf}\) and \(\mathsf {of}\) will be defined in Equations (25) and (26).
Along a parallel though related axis regarding efficiency, the HMAC-SHA512-based \(\mathsf {Bip32}\) standard [44] consumes a huge number of AND gates and is costly when implemented in the MPC setting (for distributed key management), and improvements were mentioned by Lindell [40] as an open problem. Although some ideas appear obvious (e.g., using more efficient hashing instead of HMAC-SHA512), the soundness is unclear due to the lack of formalism and justification.
To address the gap, we consider \(\mathrm{mu}\) hierarchical unforgeability and \(\mathrm{mu}\) hierarchical unlinkability of \(\mathsf {Bip32}\) : the former guarantees that the collaboration of several “accounts” cannot forge transactions for the other “accounts” (and are thus unable to spend their money), whereas the latter ensures that in the view of several “accounts,” the public signature keys derived by the other “accounts” are pseudorandom and independent. Then, using our leakage CPRF security of the random oracle based trees, we prove that with u users, \(\mathsf {Bip32}\) achieves (roughly) \(\min \lbrace 247, 256 - \log _2 u \rbrace\) bits \(\mathrm{mu}\) hierarchical unlinkability security and \(\min \lbrace 247, 256 - \log _2 u, f(q_S) \rbrace\) bits \(\mathrm{mu}\) hierarchical unforgeability security, where \(f(q_S)\) is the \(\mathrm{mu}\) security of the underlying signature scheme for \(q_S\) the number of adversarial signing queries. By these, the concrete (even \(\mathrm{mu}\) ) unlinkability bounds of the whole \(\mathsf {Bip32}\) system is mostly close to the expectation of its designers (256 bits), and the degradation with u is limited. The concrete unforgeability bounds, however, depend on the \(\mathrm{mu}\) security of the signature, and this is unavoidable. This emphasizes the importance of carefully choosing the signature. Additionally, the relation with CPRFs provide cryptographic insights on HDWs including \(\mathsf {Bip32}\) .
Our formal analysis opens the way to improving \(\mathsf {Bip32}\) tree using \(\mathsf {SHACAL3}\) , the compression function underlying \(\mathsf {SHA512}\) , and \({{\rm K}{\rm\small{ECCAK-}}p} [800,11]\) , a cryptographic permutation from the \(\mathsf {SHA3}\) family. Our proposals reduce the number of AND gates by 73.3% to 93.8% compared with the standard \(\mathsf {Bip32}\) , and are promising in the context of threshold cryptography and side-channel protections. To demonstrate, we benchmark MPC implementations of our proposals and the standard \(\mathsf {Bip32}\) , with results in Table 1 indicating expected improvements.
Table 1.
Scheme
# AND
Time \((\mathsf {ms})\)
Comm. \((\mathsf {KB})\)
Unlink. Sec. (bit)
Note
\(\mathsf {Bip32} ^{\mathsf {HMAC}}\)
944,628
87
29,790
\(\min \lbrace 247 , s - \log _2 u \rbrace\)
Standard
\(\mathsf {Bip32} ^{\mathsf {SHACAL3}}\)
245,172
33
7,937
\(\min \lbrace 246 , s - \log _2 u \rbrace\)
Reliability
\(\mathsf {Bip32} ^{{\mathsf {kp800}}}\)
49,908
19
1,835
\(\min \lbrace 247 , s - \log _2 u \rbrace\)
High perform.
Table 1. Performance of \(\mathsf {Bip32}\) Instantiations
# AND represents the number of involved AND gates and roughly match theoretical results on four \(\mathbf {Prim}\) executions. They deliver similar \(\mathrm{mu}\) security: see Sections 6.5 and 6.6.
1.1.3 Multi-User Security of Trees in FSS and Improvements.
FSS is a cryptographic primitive where the client can secretly share a function f to \(f_1\) and \(f_2\) such that each of the function does not reveal the parameters of f. Two servers holding \(f_i\) and x can locally evaluate \(f_i(x),\) and the scheme ensures that \(f(x) = f_1(x)\oplus f_2(x)\) . When f is a point function, such construction can be easily used for private information retrieval. Furthermore, the splitting of function f can be performed in a 2PC protocol and thus eliminates the need of a client.
As mentioned earlier, most such applications require a private PPRF, which is built upon a GGM tree. In detail, in PCG, a client (which could be simulated by MPC) samples a key of a PPRF, which is essentially the root of a GGM tree, and then sends the key/root to one of the party. The other party chooses a leaf (in an oblivious manner) and obtains the punctured key enabling evaluating all but that leaf. A popular way to instantiate the GGM tree is to define the length-doubling PRG as \(s \mapsto \mathsf {AES} _{fk}(s)\oplus s\Vert \mathsf {AES} _{fk}(s\oplus 1)\oplus s\oplus 1\) (denoted as \(\mathsf {FBTr}\) ), where \(\mathsf {AES} _{fk}\) is the \(\mathsf {AES}\) using fixed, publicly known keys fk. However, security characterizations are lacking even in the \(\mathrm{su}\) setting, leaving gaps in both concrete bounds and design references.
We bridge both gaps. First, regarding security of the aforementioned scheme \(\mathsf {FBTr}\) , we formally prove (roughly tight) concrete \(\mathrm{mu}\) PPRF security of \(128 - \log _2 d - \log _2u\) bits, where d is the depth of the tree. These, as discussed, suffer from the (notable) \(\log _2u\) bit degradation.
Next, we show how to improve. First, to overcome the \(\log _2u\) degradation, we propose to use random \(\mathsf {IV}\) as the fixed \(\mathsf {AES}\) key in every FSS protocol instance, and this improves the \(\mathrm{mu}\) security to \(128 - \log _2 d - 2\) bits, which is a good bound since d is typically small in practice. Second, we propose multi-branch generalizations, offering a promising tradeoff with the same \(\mathrm{mu}\) security—that is, it saves 50% computations at the expense of 50% larger puncturable keys.
Although our analysis does not cover the full FSS, it indicates that the trees exhibit no practical security issues. We leave the full characterization for future work.
1.2 Related Work
Regarding CPRFs/PPRFs, a series of works overcame standard model challenges (which is complementary to our goal of providing practical reference) and greatly advanced the theory [10, 29, 34, 35].
Regarding HDW, Alkadri et al. [1] and Das et al. [22] appear to be the first to formalize security of deterministic wallets as unforgeability and unlinkability. Concurrently to ours, they extended their treatment to \(\mathsf {Bip32}\) [21]. The hierarchical unforgeability definition of those authors is stronger than ours, as it requires unforgeability of signatures even if the parent chain codes are leaked. This models the settings of “hot wallet breach” and granting chain codes to auditors. Due to this, they have to resort to rerandomizable signatures and related-key properties of \(\mathsf {ECDSA}\) . In contrast, our unforgeability definition assumes parent chain codes secret. Thus, our bounds do not cover the “audit” use case [44, Use cases]. Moreover, our analysis does not distinguish “hardened” and “non-hardened” derivations (since parent chain codes are always secret). Our model mostly covers security against a subset of malicious offices in an enterprise. However, our treatments provided non-trivial mu security bounds. Thanks to the fine-grained analysis using multi-collisions, our \(\mathrm{mu}\) unlinkability bound is much better than that of Das et al. [21, Theorem A.1]. In all, our analysis of \(\mathsf {Bip32}\) offers another complementary viewpoint. More importantly, our main focus in the generalized GGM tree construction and its results, with \(\mathsf {Bip32}\) a mere application.
Luzio et al. [42] provided a systematic study of HDW and a new design \(\mathsf {Arcula}\) . Their work emphasized more on offering a new proposal with richer functions than characterizing security of existing schemes (i.e., \(\mathsf {Bip32}\) ). In comparison, we emphasize more on schemes already used “in the wild.” For a survey of earlier works [2, 43, 50], we refer to the work of Das et al. [22, Section 1.3].
1.3 Organization
We establish notations and models in Section 2. Our extensions of CPRF and PPRF notions are also presented in Section 2. Then, we formally define our general GGM tree model in Section 3 and prove the \(\mathrm{mu}\) leakage CPRF security in Section 4. The \(\mathrm{mu}\) leakage PPRF security is established in Section 5. We finally demonstrate applications to \(\mathsf {Bip32}\) and FSS in Sections 6 and 7, respectively.
2 Preliminaries
Denote by \([i]_{m}\) the m-bit binary encoding of the non-negative integer i, and by \(\bot\) the empty string. Given an n-bit string x and \(a\le n\) , denote by \(\mathsf {left} _a(x)\) (respectively, \(\mathsf {right} _a(x)\) ) the a leftmost (respectively, rightmost) bits of x.
To describe \(\mathsf {Bip32}\) wallets in Sections 3 and 6, denote by \(\mathbb {G}\) the group of the elliptic curve in use and G its primitive element. Denote by \(\mathbb {Z} _{|\mathbb {G} |}^+\) the set \(\lbrace 1,\ldots ,|\mathbb {G} |-1\rbrace\) . The function \(\mathsf {int} (X)\) interprets a 256-bit string X as a 256-bit number. The function \(\mathsf {ser} _P(sk\cdot G)=\mathsf {ser} _P(pk)\) serializes the coordinate \(pk = (e_x,e_y)\) as a bit string in the SEC1’s compressed form—that is, \(\mathsf {ser} _P(e_x,e_y) = [2]_8 \Vert [e_x]_{256}\) when \(e_y = 0 \mod {2}\) , whereas \(\mathsf {ser} _P(e_x,e_y) = [3]_8 \Vert [e_x]_{256}\) when \(e_y = 1 \mod {2}\) .
Signature Schemes. Due to \(\mathsf {Bip32}\) , we need the definition and security of digital signature schemes.
Definition 2.1 (Signature Scheme).
A signature scheme \({\mathsf {Sig}} =({\mathsf {KGen}},{\mathsf {Sign}},{\mathsf {Vrfy}})\) is a triple of algorithms. The randomized key generation algorithm \(\mathsf {KGen}\) takes as input public parameters \(\mathsf {pp}\) and returns a pair \((pk, sk) \in \mathcal {K}_{\mathsf {sign}}\) of public and secret keys. The randomized signing algorithm \({\mathsf {Sign}}\) takes as input a secret key sk and a message m and returns a signature \(\sigma\) . The deterministic verification algorithm \(\mathsf {Vrfy}\) takes as input a public key pk, a signature \(\sigma\) , and a message m. It returns 1 (accept) or 0 (reject). We require correctness—that is, \(\forall (pk,sk)\leftarrow {\mathsf {KGen}} ({\mathsf {pp}})~\forall m:{\mathsf {Vrfy}} (pk,{\mathsf {Sign}} (sk,m),m)=1.\)
We will reduce the security of the \(\mathsf {Bip32}\) wallet to the standard existential unforgeability under chosen message attacks ( \(\mathsf {UFCMA}\) ) security of the signatures in the mu setting. For this, we adopt the formalism of Bernstein [8].
A (digital) signature scheme \({\mathsf {Sig}} =({\mathsf {KGen}}\) , \({\mathsf {Sign}}\) , \({\mathsf {Vrfy}})\) is \((u,q_S,t,\varepsilon)\) - \(\mathsf {muUFCMA}\) secure, if for any adversary \(\mathfrak {A}\) making \(q_S\) queries to \({\mathsf {Sign}} (sk_1,\cdot),\ldots ,{\mathsf {Sign}} (sk_u,\cdot)\) and running in time t, it holds \({\Pr } [\mathfrak {A} ^{{\mathsf {Sign}} (sk_1,\cdot),\ldots ,{\mathsf {Sign}} (sk_u,\cdot)}\) \((pk_1,\ldots ,pk_u)\text{ forges}] \le \varepsilon\) , where the event “forges” means \(\mathfrak {A}\) outputs a pair \((m^*,\sigma ^*)\) such that \({\mathsf {Vrfy}} (pk_i,m^*,\sigma ^*)=1\) for some \(i\in \lbrace 1,\ldots ,u \rbrace\) and \(\mathfrak {A}\) never queried \({\mathsf {Sign}} (sk_{i^{\prime }},m^*)\) for any \(i^{\prime }\) with \(sk_{i^{\prime }} = sk_i\) .
A naive hybrid argument establishes \(\kappa -\log _2 u\) \(\mathsf {muUFCMA}\) security from \(\kappa\) bit \(\mathsf {UFCMA}\) security. For the Schnorr and BLS schemes, this mu security loss can be overcame in the random oracle model [37, 38]—for example, using 256-bit secret keys, the \(\mathsf {muUFCMA}\) security of Schnorr is of 128 bits according to Kiltz et al. [37]—or by using the key-prefixing technique [8, 38].
CPRF and Its mu Security. Our formalism of CPRFs basically follows [11, 18, 36], which is as follows.
With key space \(\mathcal {K}\) , domain \(\mathcal {X}\) , and range \(\mathcal {Y}\) , a constrained pseudorandom function for a set system \(\mathbb {S} \subseteq 2^{\mathcal {X}}\) is a keyed function \(\mathsf {F}\) with an additional constrained key space \(\mathcal {K} _c\) and four probabilistic polynomial-time algorithms \((\mathsf {F}.\mathsf {KGen},\mathsf {F}.\mathsf {Ev},\mathsf {F}.\mathsf {Co},\mathsf {F}.\mathsf {SubCo},\mathsf {F}.\mathsf {CEv})\) :
•
the key generation algorithm \(\mathsf {F}.\mathsf {KGen}\) returns \(K =(\mathsf {k},{\mathsf {pp}}) \in \mathcal {K}\) , where \(\mathsf {k}\) is the ordinary secret master key and \(\mathsf {pp}\) is the public parameter;
•
the (ordinary) evaluation algorithm \(\mathsf {F}.\mathsf {Ev} (K,x)\) (always) outputs \(\mathsf {F} (K,x)\) for the inputs \(K \in \mathcal {K}\) and \(x \in \mathcal {X}\) ;
•
the constraining algorithm \(\mathsf {F}.\mathsf {Co} (K,\mathcal {S})\) outputs a constrained key \(K \lbrace \mathcal {S} \rbrace \in \mathcal {K} _c\) on input a key \(K \in \mathcal {K}\) and a set \(\mathcal {S} \in \mathbb {S}\) ;
•
the constrained evaluation algorithm \(\mathsf {F}.\mathsf {CEv} (K \lbrace \mathcal {S} \rbrace ,x)\) : on inputs \(K \lbrace \mathcal {S} \rbrace\) and x where \(K \lbrace \mathcal {S} \rbrace\) constrains all points in \(\mathcal {S}\) , outputs \(\mathsf {F} (K,x)\) if \(x\in \mathcal {S}\) , and \(\bot\) otherwise.
We will focus on CPRFs built upon a public ideal primitive \(\mathbf {Prim}\) and write \(\mathsf {F} ^{\mathbf {Prim}}\) to highlight. For a CPRF \(\mathsf {F} ^{\mathbf {Prim}}\) , we follow the work of Hofheinz et al. [34] and formalize the adversarial goal as distinguishing the real-world oracles \((\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Co},\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Ev},\mathbf {Prim})\) from the ideal-world oracles \((\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Co},\mathsf {R},\mathbf {Prim})\) for a random function \(\mathsf {R}\) . We extend it with multiple users and leakages, in the concrete security paradigm. Before the formal presentation, we first elaborate on the new ingredients.
Multi-User. Let u be the maximal number of users.3 In the \(\mathrm{mu}\) setting, the adversarial goal becomes distinguishing the real world \((\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Co} (K _1,\cdot)\) , \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Ev} (K _1,\cdot),\ldots ,\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Co} (K _u,\cdot)\) , \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Ev} (K _u,\cdot))\) and the ideal world \((\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Co} (K _1,\cdot),\mathsf {R} (1,\cdot)\) \(, \ldots ,\) \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Co} (K _u,\cdot),\mathsf {R} (u,\cdot))\) for u independent random keys \(\mathbf {K} = (K _1,\ldots ,K _u)=((\mathsf {k} _1,{\mathsf {pp}} _1),\ldots ,(\mathsf {k} _u,{\mathsf {pp}} _u))\) , where \(\mathsf {R} (1,\cdot),\ldots ,\) \(\mathsf {R} (u,\cdot)\) instantiate u independent random functions. To simplify notations, we will use a single oracle \(\mathsf {muEv}_\mathbf {K} (i,\cdot)\) for the functionality of \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Ev} (K _i,\cdot)\) , and a single \(\mathsf {muCo}_\mathbf {K} (i,\cdot)\) for \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Co} (K _i,\cdot)\) .
Protocol-Level Leakages. As mentioned previously, to capture the cases where (secret) intermediate values become public information, we augment the real-world oracles \(\mathsf {muEv}_\mathbf {K}\) and \(\mathsf {muCo}_\mathbf {K}\) with a leakage oracle \(\mathsf {L}\) . Every time the distinguisher issues a query to either \(\mathsf {muEv}_\mathbf {K}\) or \(\mathsf {muCo}_\mathbf {K}\) , besides the ordinary response, it obtains leakages due to the corresponding internal computations from \(\mathsf {L}\) . To highlight, we use the notations \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}}\) and \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}}\) for these “leaky oracles.”
For the ideal world oracles \(\mathsf {muCo}_\mathbf {K}\) and \(\mathsf {R}\) to produce consistent outputs, we augment them with a leakage simulator \(\mathsf {S}\) and obtain the “leaky ideal oracles” \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}}\) and \(\mathsf {R} ^{\mathsf {S}}\) . Every time the distinguisher issues a query, it obtains both ordinary responses and leakages produced by \(\mathsf {S}\) . This enables formalizing indistinguishability of the leaky real and ideal worlds, with \(\mathsf {L}\) and \(\mathsf {S}\) being parameters. The detailed definitions of \(\mathsf {L}\) and \(\mathsf {S}\) depend on the concrete applications and security requirements, and we refer to Section 4.1 for an example.
Although our simulation-based definition seems quite strong, we have provided positive results (Theorems 4.1 and 4.2) with explicit simulators, and our simulators simply output random leakages, indicating pseudorandomness of (leaked) intermediate values. This is in contrast with simulatability of side-channel leakages, the achievability of which remains open [41].
Effective Data Complexity. Concrete security of a cryptosystem is qualified by the attack advantage regarding adversaries with data and time complexities. In the ideal model, time complexity is typically captured by \({T},\) the number of queries to the ideal function \(\mathbf {Prim}\) . Data complexity shall reflect the amount of information gained from the oracles \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}}\) and \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}}\) , which is a complicated function of the true number of adversarial queries. To remedy, we follow the work of Dodis et al. [25] and introduce effective data complexityD, which is the total number of queries to \(\mathbf {Prim}\) internally made by \(\mathsf {F} ^{\mathbf {Prim}}\) during the interaction. As will be seen in Sections 6 and 7, it is easy to count D for concrete applications. The output of every internal \(\mathbf {Prim}\) query, including the ordinary output and the corresponding leakage, will be a part of the information collected by the distinguisher. Therefore, effective data complexity does measure the amount of information gained from \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}}\) and \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}}\) .
Formal Definition. With the preceding, our formal definition is as follows.
The keyed function \(\mathsf {F} ^{\mathbf {Prim}}\) is a \((u, {T}, D, \varepsilon)\) - \((\mathsf {L},\mathsf {S})\) -CPRF, if for any distinguisher \(\mathfrak {D}\) making \({T}\) queries to \(\mathbf {Prim}\) and having effective data complexity D, we have
where the probability is taken over the u user keys \(\mathbf {K} =(K _1,\ldots ,K _u)\) with \(K _i \leftarrow \mathsf {KGen}\) , over \(\mathfrak {D}\) ’s random tape and the ideal primitive \(\mathbf {Prim}\) , and where
(i)
\(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}} (i,\mathcal {S})\) : for \(1\le i\le u\) , outputs the constrained key \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Co} (K _i,\mathcal {S})\) and the corresponding information leakage \(\mathsf {L} (K _i,\mathcal {S})\) for the i-th user;
(ii)
\(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}} (i,x)\) : for \(1\le i\le u\) , outputs \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Ev} (K _i,x)\) and the corresponding information leakage \(\mathsf {L} (K _i,x)\) for the i-th user;
(iii)
\(\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}} (i,\mathcal {S})\) : for \(1\le i\le u\) , outputs the constrained key \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Co} (K_i,\mathcal {S})\) and the corresponding simulated leakage \(\mathsf {S} (i,\mathcal {S})\) for the i-th user4;
(iv)
\(\mathsf {R} ^{\mathsf {S}} (i,x)\) : for \(1\le i\le u\) , outputs \(y \xleftarrow {\$}\mathcal {Y}\) for every new pair of inputs \((i,x)\) and the corresponding simulated leakage \(\mathsf {S} (i,x)\) .
\(\mathfrak {D}\) is not allowed to makes a constraining query \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}} (i,\mathcal {S})\) and an evaluation query \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}} (i,x)\) with \(x \in \mathcal {S}\) , in any order, since this leads to trivial win.
The classical CPRF security notion can be recovered by eliminating the leakages \(\mathsf {L}\) and \(\mathsf {S}\) .
PPRF and Its mu Security. Depending on its structure, a PPRF scheme may impose certain relations among the multiple punctured inputs. To capture this, we follow Definition 2.3 and define PPRF for set systems.
With key space \(\mathcal {K}\) , domain \(\mathcal {X}\) , and range \(\mathcal {Y}\) , a puncturable pseudorandom function for a set system \(\mathbb {S} \subseteq 2^{\mathcal {X}}\) is a keyed function \(\mathsf {F}\) with an additional punctured key space \(\mathcal {K} _p\) and four probabilistic polynomial-time algorithms \((\mathsf {F}.\mathsf {KGen},\mathsf {F}.\mathsf {Ev},\mathsf {F}.\mathsf {Pu},\mathsf {F}.\mathsf {PEv})\) :
•
the key generation algorithm \(\mathsf {F}.\mathsf {KGen}\) returns \(K =(\mathsf {k},{\mathsf {pp}}) \in \mathcal {K}\) , where \(\mathsf {k}\) is the ordinary secret master key and \(\mathsf {pp}\) is the public parameter;
•
the evaluation algorithm \(\mathsf {F}.\mathsf {Ev} (K,x)\) outputs \(\mathsf {F} (K,x)\) for the inputs \(K \in \mathcal {K}\) and \(x \in \mathcal {X}\) ;
•
the puncturing algorithm \(\mathsf {F}.\mathsf {Pu} (K,\mathcal {S})\) outputs a punctured key \(K\lbrace \mathcal {S} \rbrace \in \mathcal {K} _p\) on input a key \(K\in \mathcal {K}\) and a set \(\mathcal {S} \in \mathbb {S}\) ;
•
the punctured evaluation algorithm \(\mathsf {F}.\mathsf {PEv} (K\lbrace \mathcal {S} \rbrace ,x)\) : on inputs \(K\lbrace \mathcal {S} \rbrace\) and x where \(K\lbrace \mathcal {S} \rbrace\) punctures all points in \(\mathcal {S}\) , outputs \(\mathsf {F} (K,x)\) if \(x\notin \mathcal {S}\) and \(\bot\) otherwise.
For a secure PPRF \(\mathsf {F} ^{\mathbf {Prim}}\) , \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Ev} (K,x)\) shall be pseudorandom for any \(x \in \mathcal {S}\) , even if the punctured key \(K\lbrace \mathcal {S} \rbrace\) has been given. This is just the dual of a restricted form of CPRF. For a formal definition in the \(\mathrm{mu}\) setting, we borrow the ingredients from our Definition 2.4.
\(\mathsf {F} ^{\mathbf {Prim}}\) is a \((u, {T}, D, \varepsilon)\) - \((\mathsf {L},\mathsf {S})\) -PPRF, if for any distinguisher \(\mathfrak {D}\) making \({T}\) queries to \(\mathbf {Prim}\) and having effective data complexity D, we have
where the probability is taken over the u user keys \(\mathbf {K} =(K _1,\ldots ,K _u)\) , with \(K _i \leftarrow \mathsf {KGen}\) , over \(\mathfrak {D}\) ’s random tape and the ideal primitive \(\mathbf {Prim}\) , and where
(i)
\(\mathsf {muPu}_\mathbf {K} ^{\mathsf {L}} (i,\mathcal {S})\) : for \(1\le i\le u\) , outputs the punctured key \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Pu} (K_i,\mathcal {S})\) and the corresponding information leakage \(\mathsf {L} (K_i,\mathcal {S})\) for the i-th user;
(ii)
\(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}} (i,x)\) : for \(1\le i\le u\) , outputs \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Ev} (K_i,x)\) and the leakage \(\mathsf {L} (K_i,x)\) for the i-th user;
(iii)
\(\mathsf {muPu}_\mathbf {K} ^{\mathsf {S}} (i,\mathcal {S})\) : for \(1\le i\le u\) , outputs the punctured key \(\mathsf {F} ^{\mathbf {Prim}}.\mathsf {Pu} (K_i,\mathcal {S})\) and the corresponding simulated leakage \(\mathsf {S} (i,\mathcal {S})\) for the i-th user;
(iv)
\(\mathsf {R} ^{\mathsf {S}} (i,x)\) : for \(1\le i\le u\) , outputs \(y \xleftarrow {\$}\mathcal {Y}\) and simulated leakage \(\mathsf {S} (i,x)\) for every new pair \((i,x)\) .
The following two restrictions are imposed on the distinguisher’s queries:
(a)
\(\mathfrak {D}\) is not allowed to make a puncture query \(\mathsf {muPu}_\mathbf {K} ^{\mathsf {L}} (i,\mathcal {S})\) if a previous evaluation query \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}} (i,x)\) with \(x \notin \mathcal {S}\) is made;
(b)
\(\mathfrak {D}\) is not allowed to make two distinct puncturing queries \(\mathsf {muPu}_\mathbf {K} ^{\mathsf {L}} (i,\mathcal {S})\) and \(\mathsf {muPu}_\mathbf {K} ^{\mathsf {L}} (i^{\prime },\mathcal {S}^{\prime })\) with \(i=i^{\prime }\) . Namely, each user is punctured (at most) once.
Restriction (a) is necessary to prevent trivial wins (i.e., query both \(\mathsf {muPu}_\mathbf {K} ^{\mathsf {L}} (i,\mathcal {S})\) and \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}} (i,x)\) with \(x \notin \mathcal {S}\) to check if the latter matches the result computed from the former). Restriction (b) stems from the nature of PPRFs: note that as the interaction proceeds, the number of \(\mathsf {F}.\mathsf {Ev} (K,x)\) that can be computed by \(\mathfrak {D}\) cannot decrease. Thus, if \(\mathfrak {D}\) makes two puncturing queries \(\mathsf {muPu}_\mathbf {K} ^{\mathsf {L}} (i,\mathcal {S})\) and \(\mathsf {muPu}_\mathbf {K} ^{\mathsf {L}} (i,\mathcal {S}^{\prime })\) to the same i-th user/instance, then the later query \(\mathcal {S}^{\prime }\) has to be a subset of \(\mathcal {S}\) , and otherwise the later puncturing request cannot succeed. But it is odd for \(\mathfrak {D}\) to make such two puncturing queries. Therefore, we simply forbid \(\mathfrak {D}\) puncturing the same user/instance twice.
H-Coefficient Method. We use the H-coefficient method of Patarin [46] to prove security of the trees and provide a quick overview here. Our presentation borrows heavily from that of Chen and Steinberger [19]. Fix a distinguisher \(\mathfrak {D}\) that makes at most q queries to its oracles. As in the security definition presented earlier, \(\mathfrak {D}\) ’s aim is to distinguish between two worlds: a “real world” and an “ideal world.” Assume without loss of generality that \(\mathfrak {D}\) is deterministic. The execution of \(\mathfrak {D}\) defines a transcript that includes the sequence of queries and answers received from its oracles; \(\mathfrak {D}\) ’s output is a deterministic function of its transcript. Thus, if \(T_{\mathrm{re}},T_{\mathrm{id}}\) denote the probability distributions on transcripts induced by the real and ideal worlds, respectively, then \(\mathfrak {D}\) ’s distinguishing advantage is upper bounded by the statistical distance \(\mathsf {SD} (T_{\mathrm{re}},T_{\mathrm{id}}):=\frac{1}{2}\sum _{\mathcal {Q}}|\Pr [T_{\mathrm{re}}=\mathcal {Q} ]-\Pr [T_{\mathrm{id}}=\mathcal {Q} ]|\) , with the sum taken over all possible transcripts \(\mathcal {Q}\) .
Let \(\Theta\) denote the set of all transcripts that can be generated by \(\mathfrak {D}\) in either world. We look for a partition of \(\Theta\) into two sets \(\Theta _{\mathrm{good}}\) and \(\Theta _{\mathrm{bad}}\) of “good” and “bad” transcripts, respectively, along with a constant \(\varepsilon _1\in [0, 1)\) such that
Before presenting our model in Section 3.2, we first serve intuitions in Section 3.1 to ease understanding.
3.1 Intuitions
Example 1.
The classical GGM tree uses a length-doubling PRG \(G: \lbrace 0,1\rbrace ^{n} \rightarrow \lbrace 0,1\rbrace ^{2n}\) . Thus, every G invocation expands an n-bit intermediate value s into two children, and this constitutes a binary tree. An instantiation of [33] defines \(G ^{\mathsf {AES} _{fk}}(s) := \mathsf {DM} ^\mathsf {AES} (fk,s) \Vert \mathsf {DM} ^\mathsf {AES} (fk,s \oplus [1]_{128})\) with \(n=128\) , where \(\mathsf {DM} ^\mathsf {AES} (x,y) :=\mathsf {AES} _{x}(y)\oplus y\) and \(\mathsf {AES} _{fk}\) is the \(\mathsf {AES}\) using a fixed, publicly known keys fk (however, distinct high-level protocols may use distinct fk). The security of \(G ^{\mathsf {AES} _{fk}}\) is only justifiable by assuming \(\mathsf {AES}\) is an ideal cipher. A natural extension is to increase “parallelization degree”—that is, mapping s to \(\theta n\) bits \(\mathsf {DM} ^\mathsf {AES} (fk,s) \Vert \cdots \Vert \mathsf {DM} ^\mathsf {AES} (fk,s\oplus [\theta -1]_{128})\) for some integer \(\theta \ge 3\) . If we view \(\mathsf {AES}\) as a public primitive, then every internal secret s is involved in \(\theta \ge 2\) distinct primitive calls.
Example 2.
The \(\mathsf {Bip32}\) wallet defines a more sophisticated approach to generate a collection of keys organized in a key tree [44]. The tree has multiple branches. The 256-bit “ \(\text{chain codes}\) ” in Mediawiki [44] (the value \(ch_p\) in the dashed box in Figure 1) essentially constitute the internal secret states of the tree. For each such state, the key tree makes \(\theta \le 2^{32}\) calls to HMAC-SHA512 (henceforth abbreviated as \(\mathsf {HMAC}\) ) to derive \(\theta\) children. Every \(\mathsf {HMAC}\) -call has additional complicated inputs, including an index j and a signature key. A half of the \(\mathsf {HMAC}\) -output (the I values in Figure 1) will be used to derive the child signature (private and public) key, meaning that it may not be perfectly secret anymore. The default key tree recommended in Mediawiki [44] has depth 3, as shown in Figure 1. If we replace \(\mathsf {HMAC}\) by a general double-input function \(\mathbf {Prim}\) that accept two inputs of \(\nu\) and \(\lambda\) bits, then the obtained key tree is depicted in Figure 1.
Summary. Inspired by the preceding examples, we would like to have a unified model compatible with flexible choices as follows.
First, we build our model \(\mathsf {GGGM} ^{\mathbf {Prim}}\) on a public primitive \(\mathbf {Prim}\) functioning as the sub-tree derivation function. In many scenarios, the output size of \(\mathsf {AES}\) may be insufficient (since it may limit the security bound), and “larger” primitives such as \(\mathsf {SHA512}\) and \(\mathsf {SHA3}\) may be preferred. In this respect, our results should address both the case that \(\mathbf {Prim}\) is a keyed random oracle (i.e., a function that maps each (key,message) pair to an independent and uniform point [25]), and the case that \(\mathbf {Prim}\) is the the aforementioned Davies-Meyer mode of an ideal cipher.
Second, to increase design choices, we prefer that all parameters are flexible, including the size n of the node in the tree, the size \(\kappa\) of the secret which can be viewed as security parameter and “parallelization degree” \(\theta\) . Moreover, when the output size of \(\mathbf {Prim}\) is long, a single \(\mathbf {Prim}\) invocation may give rise to multiple child nodes, and we denote by w the number of such children.
Finally, to somewhat separate distinct \(\mathbf {Prim}\) invocations, one may inject “labels” into the inputs to \(\mathbf {Prim}\) ; one may also “disturb” the node input by, for example, xoring constants, as the aforementioned use of s and \(s \oplus [1]_{128}\) in the two parallel calls [33]. We model these ideas as two input mappings \(\mathsf {sf}\) and \(\mathsf {lf}\) . We will elaborate on the details in the next section.
3.2 Our General Tree Model
By the preceding intuitions, our general model \(\mathsf {GGGM} ^{\mathbf {Prim}}\) is built upon a public primitive \(\mathbf {Prim}:\lbrace 0,1\rbrace ^{\nu } \times \lbrace 0,1\rbrace ^{\lambda } \mapsto \lbrace 0,1\rbrace ^{wn}\) functioning as the sub-tree derivation function and is formally described in Figure 2. Also see Figure 3 for depiction.
Fig. 2.
Fig. 2. CPRF based on the generalized GGM tree \(\mathsf {GGGM} ^{\mathbf {Prim}}[\kappa ,n,\nu ,\theta ,w,d,\mathsf {sf},\mathsf {lf} ]\) . For simplicity, below we omit the suffix \([\kappa ,\ldots ,\mathsf {lf} ]\) .
Fig. 3.
Fig. 3. Derivation calls relevant to a single node \(\mathsf {Nd} (p)\) in the tree \(\mathsf {GGGM} ^{\mathbf {Prim}}\) .
In \(\mathsf {GGGM} ^{\mathbf {Prim}}\) , every node represents a string of n bits. Every “internal” node is involved in \(\theta\) calls to \(\mathbf {Prim}\) , and every \(\mathbf {Prim}\) -call gives rise to w new n-bit node values. Hence, the tree is \(w\theta\) -branched. Inspired by Mediawiki [44], we refer to positions in a tree using “paths” of the form \(p=i_1/i_2/.../i_j\) , referring to a node at depth j. A node value at “position” \(p=i_1/i_2/.../i_j\) is denoted as \(\mathsf {Nd} (p)\) , and \(\mathsf {Nd} (\bot) = \mathsf {k}\) denotes the root. By this, when the depth of the tree is d, the domain of \(\mathsf {GGGM} ^\mathbf {Prim}.\mathsf {Ev}\) is \(\mathcal {X} = \lbrace i_1/i_2/.../i_d\rbrace _{i_\ell \in \lbrace 0,\ldots ,w\theta -1\rbrace \text{ for } \ell =1,\ldots ,d }\) . We further define the following:
•
\(\mathcal {P}^*:=\lbrace \bot \rbrace \cup \lbrace i_1/i_2/.../i_{d^{\prime }}\rbrace _{d^{\prime }\in \lbrace 1,\ldots ,d-1\rbrace ,i_\ell \in \lbrace 0,\ldots ,w\theta -1\rbrace \text{ for } \ell =1,\ldots ,d^{\prime } }\) denoting the set of “incomplete” paths in such trees;
•
\(\mathcal {P}:= \mathcal {X} \cup \mathcal {P}^*\) denoting the set of all valid paths in such trees;
•
for any two paths \(p,p^{\prime }\in \mathcal {P}\) , pis prefix of \(p^{\prime }\) , if \(p = p^{\prime }\) , or if there exist \(i_1^{\prime },\ldots ,i_\ell ^{\prime }\) such that \(p^{\prime }=p/i_1^{\prime }/.../i_\ell ^{\prime }\) .
Correspondingly, the prefix set system is
\begin{align} \mathbb {S} _{\mathsf {pre},\mathsf {GGGM}} = \big \lbrace \mathcal {S} _{p^*,\mathsf {GGGM}}: p^* \in \mathcal {P} \big \rbrace , \text{ with } \mathcal {S} _{p^*,\mathsf {GGGM}} = \big \lbrace p \in \mathcal {X}: p^* \text{ is prefix of } p \big \rbrace . \end{align}
(3)
Since every set \(\mathcal {S} _{p^*,\mathsf {GGGM}} \in \mathbb {S} _{\mathsf {pre},\mathsf {GGGM}}\) has an associated path \(p^*\) , in Figure 2 we adopt the formalism of \(\mathsf {GGGM} ^{\mathbf {Prim}}.\mathsf {CEv}\) taking a path \(p^*\) as the second input.
For a node value \(z = \mathsf {Nd} (p)\) , \(p \in \mathcal {P}^*\) , and an index \(j \in \lbrace 0,1,\ldots ,\theta - 1\rbrace\) , the j-th derivation call of \(\mathsf {Nd} (p)\) is \(\mathbf {Prim} (\mathsf {lf} _{p,j} (\mathsf {left} _{n-\kappa }(z) , {\mathsf {pp}}), \mathsf {sf} _{p,j} (\mathsf {right} _{\kappa }(z)))\) (as shown in \(\mathsf {StepDown}\) , Figure 2), where the two input map functions \(\mathsf {sf}\) and \(\mathsf {lf}\) are as follows:
•
The labeling function \(\mathsf {lf} _{p,j} (\mathsf {left} _{n-\kappa }(z) , {\mathsf {pp}})\) maps the leftmost \(n-\kappa\) bits of a node value z and the public parameter \(\mathsf {pp}\) to the \(\nu\) -bit 1st input for \(\mathbf {Prim}\) . Subsequently, we call this \(\nu\) -bit value the label of the derivation call.
•
The seeding function \(\mathsf {sf} _{p,j} (\mathsf {right} _{\kappa }(z))\) is injective and maps the right most \(\kappa\) bits of a node value z to the \(\lambda\) -bit 2nd input for \(\mathbf {Prim}\) . In some sense, \(\mathsf {sf} _{p,j} (\mathsf {right} _{\kappa }(z))\) serves as the “secret seed” of the sub-tree, and \(\kappa\) is security parameter of the tree.
The output of the \(\mathbf {Prim}\) -call \(I = \mathbf {Prim} (\mathsf {lf} _{p,j} (\mathsf {left} _{n-\kappa }(z) , {\mathsf {pp}}), \mathsf {sf} _{p,j} (\mathsf {right} _{\kappa }(z)))\) does not immediately give rise to children nodes. Instead, an outputting function \(\mathsf {of} (z, \mathsf {left} _{n}(\mathsf {right} _{bn}(I)))\) maps the parent node \(\mathsf {Nd} (p)\) and the b-th chunk \(\mathsf {left} _{n}(\mathsf {right} _{bn}(I))\) to the child node \(\mathsf {Nd} (p/b)\) .
For the input functions, we require that \(j\ne j^{\prime }\Rightarrow (\mathsf {lf} _{p,j} (\mathsf {left} _{n-\kappa }(z) , {\mathsf {pp}})\) , \(\mathsf {sf} _{p,j} (\mathsf {right} _{\kappa }(z))) \ne (\mathsf {lf} _{p,j^{\prime }} (\mathsf {left} _{n-\kappa }(z) , {\mathsf {pp}})\) , \(\mathsf {sf} _{p,j^{\prime }} (\mathsf {right} _{\kappa }(z)))\) for any \(p\in \mathcal {P}^*\) —that is, distinct \(\mathbf {Prim}\) -calls using the same node value \(z \in \lbrace 0,1\rbrace ^n\) are necessarily on distinct inputs. For the outputting function, we limit our discussion to seeded bijections—that is, \(\mathsf {of} (z, \cdot)\) is a bijection on \(\lbrace 0,1\rbrace ^n\) for any \(z \in \lbrace 0,1\rbrace ^n\) . This means \(\mathsf {of}\) has an inverse \(\mathsf {of} ^{-1}\) such that \(\mathsf {of} ^{-1}(z, \mathsf {of} (z,I)) = I\) for any \(z,I \in \lbrace 0,1\rbrace ^n\) .
The complexity of our model is worthy, and it has covered the intuitive examples. We refer to Sections 6 and 7 for details.
4 \(\text{Multi-user}\) LEAKAGE CPRF SECURITY OF \(\mathsf {GGGM}\) TREES
For clarity, in Section 4.1 we first cast our general formalism in Section 2 into the concrete setting of \(\mathsf {GGGM} ^{\mathbf {Prim}}\) . We also elaborate on the information leakages to be considered in this work, as well as useful structural properties. With these preparations, we consider \(\mathsf {GGGM} ^{\mathbf {Prim}}\) with \(\mathbf {Prim}\) being an FIL RO \(\mathbf {H}\) in Section 4.2, then the case of \(\mathbf {Prim}\) being the Davies-Meyer construction \(\mathsf {DM} ^\mathbf {E}\) for an ideal cipher \(\mathbf {E}\) in Section 4.3.
4.1 Concrete Settings
4.1.1 The Oracles and Leakage Simulator.
We assume the leakage oracle \(\mathsf {L}\) in \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}}\) and \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}}\) leaks the leftmost bits \(\mathsf {left} _{n-\kappa }(z)\) for every intermediate node \(z \in \lbrace 0,1\rbrace ^n\) appeared during the computations. In detail, note that by our convention, a query to the evaluation oracle \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}}\) is of the form \((i_0,p)\) , \(p=i_1/i_2/.../i_d\) . In the real world, \(\mathsf {muEv}_\mathbf {K}\) will return \(\mathsf {Nd} (i_0,p)\) the n-bit node value at the end of the path p in the \(i_0\) -th tree. As the corresponding leakages, we assume that \(\mathsf {L} (K_{i_0},p)\) will provide d additional values of \(n-\kappa\) bits—that is,
To wit, after issuing a query to \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}}\) , \(\mathfrak {D}\) obtains \(n+d(n-\kappa)\) bits information.
Similarly, a query to the constraining oracle \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}}\) is of the form \((i_0,p^*)\) , \(p^*=i_1^*/.../i_{d^{\prime }}^*\) (see Figure 2), which may be incomplete (i.e., \(d^{\prime } \le d\) ), and \(\mathsf {muCo}_\mathbf {K}\) will return the n-bit node value \(\mathsf {Nd} (i_0,p^*)\) . As the leakages, we assume that \(\mathsf {L} (K_{i_0},p^*)\) provides \(d^{\prime }\) values \(\mathsf {left} _{n-\kappa }(\mathsf {Nd} (i_0,\bot))\) , \(\mathsf {left} _{n-\kappa }(\mathsf {Nd} (i_0,i_1^*)),\ldots ,\) \(\mathsf {left} _{n-\kappa }(\mathsf {Nd} (i_0,i_1^*/.../i_{d^{\prime }-1}^*))\) , which resembles the evaluation queries. This means a single query to \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}} (i_0,i_1^*/.../i_{d^{\prime }}^*)\) gives rise to \(n+d^{\prime }(n-\kappa)\) bits.
As in Definition 2.4, the ideal oracle \(\mathsf {R}\) returns an n-bit random value that is of the same size as \(\mathsf {Nd} (i_0,p)\) , and we consider a simulator \(\mathsf {S}\) that simply outputs random simulated leakages. Formally, \(\mathsf {S}\) is described in Figure 4. Consequently, \(\mathfrak {D}\) obtains the same amount of random bits (i.e., \(n+d^{\prime }(n-\kappa)\) bits) as in the real world. We stress that although our security definition is simulation based, our leakage simulator never “hijacks” adversarial random oracle queries. Therefore, our subsequent results only need non-programmable random oracles.
Fig. 4.
Fig. 4. Leakage simulator \(\mathsf {S}\) for Theorems 4.1, 4.2, and 5.1.
4.1.2 Query Restrictions.
Besides the query restriction imposed in Definition 2.4, we additionally assume that the distinguisher \(\mathfrak {D}\) never makes redundant queries. Clearly, this cannot decrease attack advantage. For \(\mathsf {GGGM} ^{\mathbf {Prim}}\) , these indicate the following:
(a)
\(\mathfrak {D}\) never queries both \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}} (i_0,p)\) and \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}} (i_0,p^*)\) such that \(p^*\) is prefix of p (otherwise \(p \in \mathcal {S} _{p^*,\mathsf {GGGM}}\) ).
(b)
\(\mathfrak {D}\) never makes distinct queries \((i_0,p^*),(i_0,p^{**})\) to \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}}\) such that \(p^*\) is prefix of \(p^{**}\) (otherwise \((i_0,p^{**})\) is redundant).
4.1.3 Brother Paths.
Given a path \(p = i_1/.../i_{d^{\prime }-1}/i_{d^{\prime }} \in \mathcal {P}\) , we define a set \(\mathcal {B}\mathsf {r} (p)=\lbrace p_1,p_2,\ldots ,p_w\rbrace\) of w paths, where for \(1 \le \ell \le w\) ,
These w nodes \(\mathsf {Nd} (i_0,p_1),\ldots ,\mathsf {Nd} (i_0,p_w)\) are attributed to the same wn-bit output of a single call to \(\mathbf {Prim}\) in the \(i_0\) -th tree. We thus call them brother paths (of p). This notion will be used in subsequent analyses.
4.1.4 Concentration of Labels.
In the random oracle model, distinct labels separate corresponding \(\mathbf {Prim}\) -calls. To formalize, consider the following sampling process. Given D distinct pairs \(\mathcal {I} = \lbrace (i_0^{(\ell)}, p^{(\ell)}) \in \lbrace 1,\ldots ,u \rbrace \times \mathcal {P} \rbrace _{ \ell = 1,\ldots ,D}\) ,
(1)
we invoke \(\mathsf {KGen}\) for u times to have u public parameters \({\mathbf {P}} =({\mathsf {pp}} _1,\ldots ,{\mathsf {pp}} _{u})\) ;
(2)
we follow the strategy of \(\mathsf {S}\) and sample D strings of \(n-\kappa\) bits with replacement and define the list \(\mathcal {L} = \lbrace (i_0^{(1)},p^{(1)},r^{(1)}),\ldots ,(i_0^{(D)},p^{(D)},r^{(D)}) \rbrace\) .
Based on \(\mathcal {L}\) , we define a quantity for the maximal frequency of a certain label value—that is,
We denote this sampling process by \({\mathbf {P}} \leftarrow \mathsf {KGen}, \mathcal {L} \leftarrow \mathsf {S}\) . Note that the quantity reflects a property across multiple users in the ideal world. A trivial upper bound is \(\mu (\mathcal {L}) \le D\) (see Section 4.2). As will be seen in Theorems 4.1 through 5.1, the smaller \(\mu (\mathcal {L})\) , the better concrete security. A promising choice is to define \(\mu (\mathcal {L})\) to be a (pseudo)random variable, as will be treated in Theorems 4.1 through 5.1. For example, one can choose a random initialization vector \(\mathsf {IV}\) for every \(\mathsf {GGGM} ^{\mathbf {Prim}}\) instances/users and define \(\mathsf {lf} _{p,j}(r,{\mathsf {pp}}) := \cdot \Vert \mathsf {IV}\) . This limits collisions between labels in distinct \(\mathsf {GGGM} ^{\mathbf {Prim}}\) instances and decreases \(\mu (\mathcal {L})\) . This approach will be used to improve FSS (see Section 7). As will be seen, a more sophisticated approach is to extract a part of the intermediate values as pseudorandom bits and “embed” them in the images of \(\mathsf {lf} _{p,j}(r,{\mathsf {pp}})\) . This approach is used in \(\mathsf {Bip32}\) key tree (see Section 6).
4.2 Random Oracle Based Trees
In detail, we consider defining \(\mathbf {Prim} (x,y) := \mathbf {H} (x \Vert y)\) for an FIL RO \(\mathbf {H}:\lbrace 0,1\rbrace ^{\nu + \omega }\mapsto \lbrace 0,1\rbrace ^{wn}\) . Obviously, this is equivalent with \(\mathbf {Prim} (x,y) := \mathbf {KH} (x, y)\) for a keyed FIL RO \(\mathbf {KH}: \lbrace 0,1\rbrace ^{\nu } \times \lbrace 0,1\rbrace ^{\lambda } \mapsto \lbrace 0,1\rbrace ^{wn}\) . Our main result is as follows.
Theorem 4.1.
Assume using the simulator \(\mathsf {S}\) defined in Figure 4, and
(i)
\(\mathbf {H}:\lbrace 0,1\rbrace ^{\nu + \omega }\mapsto \lbrace 0,1\rbrace ^{wn}\) is modeled as a random oracle, and
(ii)
\(\mathsf {L}\) leaks \(\mathsf {left} _{n-\kappa }(\mathsf {Nd} (i_0,p^*))\) for every intermediate node \(\mathsf {Nd} (i_0,p^*)\) (see Section 4.1), and
(iii)
there exist quantities C and \(\varepsilon _{\mu }\) such that
Then, \(\mathsf {GGGM} ^\mathbf {H}\) is a \((u, {T}, D, \varepsilon)\) - \((\mathsf {L},\mathsf {S})\) -CPRF for set system \(\mathbb {S} _{\mathsf {pre},\mathsf {GGGM}}\) of Equation (3), where
Interpretation. The “leakages” and its simulator can be eliminated from Theorem 4.1 by setting \(\kappa = n\) . Therefore, the result implies the classical CPRF security of \(\mathsf {GGGM} ^{\mathbf {H}}\) .
If \({\mathsf {pp}} _{1},\ldots ,{\mathsf {pp}} _{u}\) are picked according to some distribution, then \(\mu (\mathcal {L})\) remains a random variable. An example is \(\mathsf {FMTr} ^{\mathsf {DM} ^\mathsf {AES}}\) in Section 7. If \({\mathsf {pp}} _{1},\ldots ,{\mathsf {pp}} _{u}\) are not random, then \(\mu (\mathcal {L})\) will be fixed by the design of the \(\mathsf {GGGM} ^{\mathbf {H}}\) instance. In particular, when \(\mathsf {lf}\) is a constant function, we could (only) appeal for the trivial upper bound \(C = D\) . In this case, \(\varepsilon _{\mu } = 0\) , and the obtained bound \(DT/2^\kappa + D^2/2^\kappa\) indicates the \(\kappa - \log _2D\) bits security mentioned in Section 1.
The leaked intermediate values are indistinguishable with the random simulated leakages. This means protocols can extract \(n - \kappa\) pseudorandom bits from every n-bit intermediate value in \(\mathsf {GGGM} ^{\mathbf {H}}\) for arbitrary uses, as if these bits are “leaked” (to everyone including the adversaries). Indeed, \(\mathsf {Bip32}\) does use these \(n - \kappa\) bits to derive signature keys: see Figure 1 or Section 6.
In the ideal world \(\mathfrak {D} ^{\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {H}}\) , the outputs of the oracle \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}}\) (i.e., the constrained keys) depend on the secret keys \(\mathsf {k} _1,\ldots ,\mathsf {k} _u\) . This complicates the H-coefficient-based analysis. To remedy, we introduce a random constraining oracle \(\mathsf {\$Cons}^{\mathsf {S}}\) , which accepts queries of the same form \((i_0,p^*)\) as \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}}\) (and \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}}\) ), but \(\mathsf {\$Cons}\) returns true random n-bit strings as the constrained key \(\mathsf {Nd} (i_0,p^*)\) (while \(\mathsf {S}\) returns random leakages as before). This means for a query \((i_0,i_1^*/.../i_{d^{\prime }}^*)\) , the random constraining oracle \(\mathsf {\$Cons}^{\mathsf {S}}\) returns in total \(n+d^{\prime }(n-\kappa)\) random bits. We take \((\mathsf {\$Cons}^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {H})\) as an intermediate world. In this vein, when interacting with \((\mathsf {\$Cons}^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {H})\) , the information gained by \(\mathfrak {D}\) is completely independent of any CPRF key, easing the analysis.
We then proceed with two steps: first we prove indistinguishability of the real and the intermediate worlds, then we prove indistinguishability of the intermediate and the ideal worlds.
For this step, we view the real \((\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}},\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}},\mathbf {H})\) as the real world, and the intermediate world \((\mathsf {\$Cons}^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {H})\) as the ideal world. We prove the following bound using the H-coefficient method:
Transcripts. Since we are in the random oracle model and aim at statistical indistinguishability, we could, without loss of generality [46], consider a deterministic distinguisher \(\mathfrak {D}\) interacting with the three oracles as reflected in Definition 2.4. To summarize the information gained by \(\mathfrak {D}\) in a clear form, we introduce two list \(\mathcal {Q} _\mathbf {H}\) and \(\mathcal {Q} _\mathsf {Nd}\) . The list \(\mathcal {Q} _\mathbf {H} = \lbrace (x^{(1)}, y^{(1)}), \ldots \rbrace\) records \(\mathfrak {D}\) ’s queries/answers to/from \(\mathbf {H}\) , with \((x, y) \in \mathcal {Q} _\mathbf {H}\) meaning \(\mathbf {H} (x)=y\) . The list \(\mathcal {Q} _\mathsf {Nd} = \lbrace (i_0^{(1)},p^{(1)},z^{(1)},b^{(1)}),\ldots \rbrace\) records the values in the tree obtained by \(\mathfrak {D}\) via either the “standard” responses or the leakages. Every tuple \((i_0,p,z,b) \in \mathcal {Q} _\mathsf {Nd}\) is such that \(p \in \mathcal {P}\) , and
•
\(z \in \lbrace 0,1\rbrace ^{n-\kappa }\) when \(b = 0\) , meaning that z is a leaked intermediate value;
•
\(z \in \lbrace 0,1\rbrace ^n\) when \(b = 1\) , meaning that z is either a constrained key or an output of \(\mathsf {muEv}_\mathbf {K}\) .
To simplify our proof language, we follow earlier work [32, 33] and reveal a number of internal secrets to \(\mathfrak {D}\) at the end of the interaction. In detail, we will reveal the \(\kappa\) -bit internal seeds to \(\mathfrak {D}\) and add them to the transcript \(\mathcal {Q} _\mathsf {Nd}\) . In this respect, note that in the real world \((\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}},\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}},\mathbf {H})\) , for every resulted tuple \((i_0,p,z,b) \in \mathcal {Q} _\mathsf {Nd}\) , the corresponding node value \(\mathsf {Nd} (i_0,p)\) necessarily appeared during processing the queries. Moreover, \(z = \mathsf {Nd} (i_0,p)\) when \(b = 1\) , and \(z = \mathsf {left} _{n - \kappa }(\mathsf {Nd} (i_0,p))\) when \(b = 0\) . We will thus reveal the “missing” \(\kappa\) bits \(z_R = \mathsf {right} _{\kappa }(\mathsf {Nd} (i_0,p))\) to \(\mathfrak {D}\) and add them to \(\mathcal {Q} _\mathsf {Nd}\) . Since \(\mathsf {k} _{i_0} = \mathsf {Nd} (i_0, \bot)\) , this means the u user keys \(\mathsf {k} _1,\ldots ,\mathsf {k} _{u}\) are also completely given. In the ideal world, we reveal and add random “dummy” bits to the transcript. We also append to the transcript u public parameters \({\mathbf {P}} =({\mathsf {pp}} _1,\ldots ,{\mathsf {pp}} _{u})\) that are sampled according to the same distribution as the real world. By this, we obtain an extended list \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}} = \lbrace (i_0^{(1)},p^{(1)},z^{(1)},b^{(1)}),\ldots \rbrace\) , among which \((i_0^{(1)},p^{(1)}),(i_0^{(2)},p^{(2)}),\ldots\) are exactly the same as those in \(\mathcal {Q} _\mathsf {Nd}\) , whereas \(z^{(1)},z^{(2)},\ldots\) are all “full” n-bit strings regardless of the values of \(b^{(1)},b^{(2)},\ldots\) In all, we define
as a transcript. It is without loss of generality to provide these additional values, since the distinguisher is free to ignore them. In the following, we first define the set \(\Theta _{\mathrm{bad}}\) of bad transcripts and then analyze good transcripts.
Internal Evaluation List \(\mathcal {Q} _{\mathbf {H}}^{\mathrm{x}}\) . Regarding \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) , we make crucial observations as follows. For any \((i_0,p,z,b) \in \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) , \(p = i_1/.../i_{d^{\prime }}\) with \(d^{\prime } \ge 1\) , we have the following:
•
It holds \((i_0^{\circ }, p^{\circ }, \mathsf {Nd} (p^{\circ }), \star) \in \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) for every prefix \(p^{\circ }\) of p, since \(\mathsf {Nd} (i_0^{\circ }, p^{\circ })\) indeed appeared during computing \(\mathsf {Nd} (i_0, p) = z\) .
•
It holds \((i_0, p^{\prime }, \mathsf {Nd} (p^{\prime }), \star) \in \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) for every brother path \(p^{\prime } \in \mathcal {B}\mathsf {r} (p)\) of p. To see this, note that for any path \(p \in \mathcal {P}\) , \((i_0, p, \mathsf {Nd} (p), \star) \notin \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) only if the corresponding value \(\mathsf {Nd} (i_0, p)\) is never computed during the interaction. The only possibility is that there exists a constraining query \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}} (i_0, p^*)\) such that \(p^*\) is a prefix of p, and this forbids querying \((i_0,p)\) due to the query restrictions mentioned in Section 4.1.2. This essentially implies \(\mathsf {Nd} (i_0,p^{\prime })\) is never computed for any \(p^{\prime } \in \mathcal {B}\mathsf {r} (p)\) . By this, \((i_0, p, \mathsf {Nd} (i_0,p), \star) \notin \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}} ~\Leftrightarrow ~ \forall p^{\prime }\in \mathcal {B}\mathsf {r} (p): (i_0, p^{\prime }, \mathsf {Nd} (i_0,p^{\prime }), \star) \notin \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) , and thus the claim.
By these, consider any \((i_0,p,z,\star) \in \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) with \(p = i_1/.../i_{d^{\prime }-1}/i_{d^{\prime }}\) , \(1 \le d^{\prime } \le d\) . Let \(p^* = i_1/.../i_{d^{\prime }-1}\) , \(j^* = \lfloor \frac{ i_{d^{\prime }} }{ w } \rfloor\) , and let \(p_\ell = i_1/.../i_{d^{\prime }-1}/ w j^* + \ell - 1\) ( \(1 \le \ell \le w\) ). Then \(\mathcal {Q} _{\mathbf {H}}^{\mathrm{x}}\) includes the “internal evaluation tuple” \((i_0,p^*,j^*,x^*,y^*)\) , where (recall from Section 3.2 that \(\mathsf {of} (z,\cdot)\) is bijective)
By the preceding two observations, all the mentioned node values can be found in \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) , and \(x^*\) , \(y^*\) are thus well defined. The additional fields \(p^*\) and \(j^*\) will significantly simplify proof languages. It can be seen that the set \(\mathcal {Q} _{\mathbf {H}}^{\mathrm{x}}\) records all the internal random oracle evaluations that appeared during the real-world interaction, and \(|\mathcal {Q} _{\mathbf {H}}^{\mathrm{x}} | = D\) is the aforementioned effective data complexity of \(\mathfrak {D}\) . Indeed, this constitutes its motivation.
Bad Transcripts. A transcript \(\mathcal {Q} =(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}},\mathcal {Q} _\mathbf {H})\) is bad, if any of the following conditions is fulfilled:
•
(B-1) \(\mu \ge C\) .
•
(B-2) There exist a tuple \((i_0^*,p^*,j^*,x^*,y^*)\in \mathcal {Q} _{\mathbf {H}}^{\mathrm{x}}\) and a pair \((x,y)\in \mathcal {Q} _\mathbf {H}\) such that \(x^* = x\) .
•
(B-3) There are distinct tuples \((i_0^*,p^*,j^*,x^*,y^*),(i_0^{**},p^{**},j^{**},x^{**},y^{**})\in \mathcal {Q} _{\mathbf {H}}^{\mathrm{x}}\) such that \(x^*=x^{**}\) .
The first condition captures that the “labels” of the internal calls are too concentrated. The second condition addresses the case where an internal random oracle evaluation in a \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}}\) / \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}}\) query collide with an adversarial offline random oracle query, whereas the third condition addresses the case where distinct \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}}\) / \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}}\) queries issue the same internal random oracle evaluation.
First, \(\Pr [\text{(B-1)} ] \le \varepsilon _{\mu }\) immediately follows from Equation (5), since leakages in \(\mathfrak {D} ^{\mathsf {\$Cons}^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {H}}\) are purely random. For (B-2), consider each choice of \(((x,y),(i_0^*,p^*, j^*,x^*,y^*))\in \mathcal {Q} _\mathbf {H} \times \mathcal {Q} _{\mathbf {H}}^{\mathrm{x}}\) . By the definition of \(\mathcal {Q} _{\mathbf {H}}^{\mathrm{x}}\) , \(x=x^*\) means \(x = \mathsf {lf} _{ p^*,j^* } (\mathsf {left} _{n-\kappa }(z^*) , {\mathsf {pp}} _{i_0^*}) \Vert \mathsf {sf} _{ p^*, j^* } (\mathsf {right} _{\kappa }(z^*))\) for \((i_0^*,p^*,z^*,\star) \in \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) . Since the seed \(\mathsf {right} _{\kappa }(z^*)\) is uniform in \(\lbrace 0,1\rbrace ^{\kappa }\) in the ideal world (it is the random “dummy” value appended to \(\mathcal {Q}\) ), and since \(\mathsf {sf} _{p^*,j^*} (\cdot)\) is injective, the probability to have \(\mathsf {sf} _{p^*,j^*} ({\mathsf {right} _{\kappa }}(z^*)) = \mathsf {right} _{\lambda } (x)\) is \(1/2^{\kappa }\) .
Now, the condition \(x=x^*\) is fulfilled only if \(\mathsf {left} _{\nu }(x)=\mathsf {lf} _{p^*,j^*} ({\mathsf {left} _{n-\kappa }}(z^*) , {\mathsf {pp}} _{i_0^*})\) . By this, for any \(t\in \lbrace 0,1\rbrace ^{ \nu }\) , we define \(\mathcal {Q} _\mathbf {H} [ t ]:=\lbrace s\in \lbrace 0,1\rbrace ^\lambda :(t \Vert s,\star)\in \mathcal {Q} _\mathbf {H} \rbrace\) . Then, the probability that (B-2) is fulfilled w.r.t. the preceding tuple \((i_0^*,p^*,j^*,x^*,y^*)\) is \(| \mathcal {Q} _\mathbf {H} [ \mathsf {lf} _{p^*,j^*} ({\mathsf {left} _{n-\kappa }}(z^*) , {\mathsf {pp}} _{i_0^*}) ] | / 2^{\kappa }\) . By the preceding and our definition Equation (4),
Ratio of Probabilities of Good Transcripts. One key insight of the H-coefficient method is that for any \(\mathcal {Q} \in \Theta _{\mathrm{good}}\) , the probability ratio \(\Pr [T_{\mathrm{re}}=\mathcal {Q} ]/\Pr [T_{\mathrm{id}}=\mathcal {Q} ]\) is equal to the ratio between the probability that the real-world oracles are consistent with \(\mathcal {Q}\) and the probability that the ideal-world oracles are consistent with \(\mathcal {Q}\) . Now, for any attainable transcript \(\mathcal {Q} =(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}},\mathcal {Q} _\mathbf {H},{\mathbf {P}})\) , the probability that the ideal-world transcript is consistent with \(\mathcal {Q}\) is always exactly
This is so since in \(\mathfrak {D} ^{\mathsf {\$Cons}^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {H}}\) ,
(i)
the probability that a random oracle with wn-bit outputs is consistent with the \({T}\) queries in \(\mathcal {Q} _\mathbf {H}\) is exactly \(1/2^{{T} wn}\) ;
(ii)
the probability that the random node values equal those in \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) is \(1/2^{|\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}} |n}\) (note that these nodes include the u secret keys \(\mathsf {k} _1,\ldots ,\mathsf {k} _u\) since \(\mathsf {Nd} (i_0,\bot)=\mathsf {k} _{i_0}\) );
(iii)
the probability that the public parameter vector \(\mathbf {P}\) is produced by \(\mathsf {KGen}\) is \({\Pr }[ {\mathbf {P}} \leftarrow \mathsf {KGen} ]\) .
Bounding the distinguishing advantage of \(\mathfrak {D}\) thus reduces to bounding the probability that the real world is consistent with transcripts \(\mathcal {Q} \in \Theta _{\mathrm{good}}\) .
Let \(\mathbf {H} \vdash \mathcal {Q} _\mathbf {H}\) denote the event that a function \(\mathbf {H}\) is consistent with the queries/answers in \(\mathcal {Q} _\mathbf {H}\) —that is, that \(\mathbf {H} (x)=y\) for all \((x, y) \in \mathcal {Q} _\mathbf {H}\) . Since, in the real world, the information in \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) is completely determined by \(\mathbf {H}\) and the user keys \(\mathbf {K} =(K_1,\ldots ,K_{u})\) , we can also write \((\mathbf {H}, \mathbf {K}) \vdash \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) to denote the event that the function \(\mathbf {H}\) and keys \(\mathbf {K}\) are consistent with the queries/answers in \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) . For a (good) transcript \(\mathcal {Q} =(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}},\mathcal {Q} _\mathbf {H},{\mathbf {P}})\) , the probability that the real world is consistent with \(\mathcal {Q}\) is exactly
(using independence of \(\mathbf {K}\) and \(\mathbf {H}\) ). We have \(\Pr [\mathbf {H} \vdash \mathcal {Q} _\mathbf {H} ] = 1/2^{{T} wn}\) exactly as before. The crux of the proof thus reduces to bounding \(\Pr [ (\mathbf {H}, \mathbf {K}) \vdash \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}} \mid \mathbf {H} \vdash \mathcal {Q} _\mathbf {H} ]\) . For this, note that in the real world, the list \(\mathcal {Q} _{\mathbf {H}}^{\mathrm{x}}\) essentially summarizes all the random oracle queries internally issued by \(\mathsf {GGGM} ^{\mathbf {H}}\) for producing the transcript \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) . Therefore,
We further show that the latter probability concerns with \(\mathbf {H}\) satisfying “new” and distinct equations. Let \(\mathcal {Q} _{\mathbf {H}}^{\mathrm{x}} =((i_0^{(1)},p^{(1)},j^{(1)},x^{(1)},y^{(1)}),\ldots ,(i_0^{(D)},p^{(D)},j^{(D)},x^{(D)},y^{(D)}))\) in arbitrary order. The probability can be expressed as
Fix some \(\ell\) . Since the transcript is good, there is no query of the form \((x^{(\ell)}, \star)\) in \(\mathcal {Q} _\mathbf {H}\) (since (B-2) does not occur), nor is \(\mathbf {H} (x^{(\ell)})\) determined by the fact that \(\mathbf {H} (x^{(\ell ^{\prime })})=y^{(\ell ^{\prime })}\) for all \(\ell ^{\prime }\lt \ell\) (since (B-3) does not occur). Thus, we have
it holds \((i_0,p/jw,\mathsf {of} (\mathsf {Nd} (i_0,p), \overline{z_1}),\star),\ldots ,(i_0,p/jw+w-1, \mathsf {of} (\mathsf {Nd} (i_0,p), \overline{z_w}), \star)\in \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) . However, it can be seen that for every set of w triples \((i_0,p_1,z_1,\star),\ldots ,(i_0,p_w,z_w,\star)\in \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) such that \(p_1=p^*/j^*w\) , \(p_1,\ldots ,p_w \in \mathcal {B}\mathsf {r} (p_1)\) , the n-bit values \(\mathsf {Nd} (i_0,p^*)=z^*\) and \(z_1,\ldots ,z_w\) correspond to a unique tuple \((i_0,p^*,j^*,x^*,y^*)\in \mathcal {Q} _{\mathbf {H}}^{\mathrm{x}}\) with \(y^* = \mathsf {of} ^{-1}(z^*, z_1) \Vert \cdots \Vert \mathsf {of} ^{-1}(z^*, z_w)\) . By this, there is a one-to-one correspondence between sets of w tuples in \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) with associated paths being brothers and tuples in \(\mathcal {Q} _{\mathbf {H}}^{\mathrm{x}}\) , and thus
So the probability that the real world is consistent with the transcript is the same as Equation (10). This means Equation (9), the probability of obtaining bad transcripts, constitutes the gap between the real world \((\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}},\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}},\mathbf {H})\) and the intermediate world \((\mathsf {\$Cons}^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {H})\) .
For this, we view \((\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}}\) , \(\mathsf {R} ^{\mathsf {S}}, \mathbf {H})\) as the real world and \((\mathsf {\$Cons}^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {H})\) as the ideal, and prove the following bound:
Essentially, this step requires establishing pseudorandomness of the constrained keys, which follows the same idea as the first step with a number of changes. In detail, we employ four list \(\mathcal {Q} _\mathbf {H},\mathcal {Q} _\mathsf {S},\mathcal {Q} _\mathsf {Nd}\) , and \(\mathcal {Q}_R\) to keep the information gained by \(\mathfrak {D}\) . The RO-query list \(\mathcal {Q} _\mathbf {H}\) is just the same as before. The list \(\mathcal {Q} _\mathsf {S} = \lbrace (i_0^{(1)},p^{(1)},r^{(1)}),\ldots \rbrace\) records all the leakages returned by \(\mathsf {S}\) , where \(i_0^{(\ell)} \in \lbrace 1,\ldots u \rbrace\) , \(p^{(\ell)} \in \mathcal {P}^*\) , and \(r^{(\ell)} \in \lbrace 0,1\rbrace ^{n - \kappa }\) indicates that at the position \(p^{(\ell)}\) in the \(i_0^{(1)}\) -th tree, the leakage block returned by \(\mathsf {S}\) is \(r^{(\ell)}\) . The list \(\mathcal {Q} _\mathsf {Nd}\) is modified such that \(\mathcal {Q} _\mathsf {Nd} = \lbrace (i_0^{(1)},p^{(1)},z^{(1)}),\ldots \rbrace\) records the queries and responses of \(\mathsf {\$Cons}\) / \(\mathsf {muCo}_\mathbf {K}\) . Namely, the \(\ell\) -th tuple \((i_0^{(\ell)},p^{(\ell)},z^{(\ell)}) \in \mathcal {Q} _\mathsf {Nd}\) indicates that \(\mathfrak {D}\) made a query \((i_0^{(\ell)},p^{(\ell)})\) to \(\mathsf {\$Cons}\) / \(\mathsf {muCo}_\mathbf {K}\) and the n-bit “standard” response is \(z^{(\ell)}\) . Finally, \(\mathcal {Q}_R = \lbrace (i_0^{(1)},p^{(1)},z^{(1)}),\ldots \rbrace\) records the queries and responses of \(\mathsf {R}\) , where \((i_0^{(\ell)},p^{(\ell)},z^{(\ell)}) \in \mathcal {Q} _\mathsf {Nd}\) indicates that \(\mathfrak {D}\) made a query \((i_0^{(\ell)},p^{(\ell)})\) to \(\mathsf {R} ^{\mathsf {S}}\) and the n-bit (random) response of \(\mathsf {R}\) is \(z^{(\ell)}\) .
We also reveal the internal values corresponding to \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}}\) ’s evaluations to \(\mathfrak {D}\) at the end of the interaction to extend \(\mathcal {Q} _\mathsf {Nd}\) , but the strategy differs from the previous step (Section 4.2.2). In detail, note that every tuple \((i_0,p,z) \in \mathcal {Q} _\mathsf {Nd}\) indicates \(\mathfrak {D}\) making a query \((i_0,p)\) to \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}}\) , and for every \(p^{\prime }\) that is prefix of p, the corresponding node value \(z^{\prime }=\mathsf {Nd} (i_0,p^{\prime })\) necessarily appeared during processing the query. We thus reveal all such node values \(z^{\prime }=\mathsf {Nd} (i_0,p^{\prime })\) to \(\mathfrak {D}\) and add the corresponding triple \((i_0,p^{\prime },z^{\prime })\) to \(\mathcal {Q} _\mathsf {Nd}\) . We also reveal all the u secret keys \(\mathsf {k} _1,\ldots ,\mathsf {k} _{u}\) and add the corresponding triple \((i_0,\bot ,\mathsf {k} _{i_0})\) to \(\mathcal {Q} _\mathsf {Nd}\) . In the ideal world, we reveal random “dummy” n-bit blocks \(z^{\prime } \xleftarrow {\$}\lbrace 0,1\rbrace ^n\) to \(\mathfrak {D}\) and add \((i_0,p^{\prime },z^{\prime })\) to \(\mathcal {Q} _\mathsf {Nd}\) correspondingly. By this, we obtain an extended list \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}} = \lbrace (i_0^{(1)},p^{(1)},z^{(1)}),\ldots \rbrace\) , among which \((i_0^{(1)},p^{(1)}),(i_0^{(2)},p^{(2)}),\ldots\) represents the positions to the nodes in \(\mathcal {Q} _\mathsf {Nd}\) , whereas \(z^{(1)},z^{(2)},\ldots\) are all “full” n-bit strings that are either “real” intermediate values (in the real world) or random “dummy” blocks (in the ideal world). Finally, we also sample u public parameters \(\mathbf {P}\) in the ideal world. In all, we define
as a transcript. Clearly, \(| \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}} | \le D\) . The real-world probability \({\Pr }[ T_{\mathrm{re}} = \mathcal {Q} ]\) is then written as
where \(\mathsf {S} \vdash \mathcal {Q} _\mathsf {S}\) denotes the event that the random leakages returned by \(\mathsf {S}\) are consistent with those in \(\mathcal {Q} _\mathsf {S}\) , \(\mathsf {R} \vdash \mathcal {Q}_R\) denotes \(\mathsf {R} (i_0,p) = z\) for every \((i_0,p,z) \in \mathcal {Q}_R\) , and \((\mathbf {H}, \mathbf {K}) \vdash \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) denotes the event that values generated by the oracle \(\mathsf {muCo}_{\mathbf {K}}\) (using \(\mathbf {H}\) ) are consistent with the records in \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) . The preceding expansion is possible since \(\mathsf {S}\) , \(\mathsf {R}\) , and \((\mathbf {H}, \mathbf {K})\) are independent. Similarly,
and the problem thus reduces to bounding \(\Pr [ (\mathbf {H}, \mathbf {K}) \vdash \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}} \mid \mathbf {H} \vdash \mathcal {Q} _\mathbf {H} ]\) . Subsequent analyses thus simply follow the same line as the first step. The definition of bad transcripts is the same as the first step, resulting in \(\Pr [T_{\mathrm{id}}\in \Theta _{\mathrm{bad}}]\le \varepsilon _{\mu } + \frac{C \cdot ({T} + D) }{2^{\kappa }}\) . For a good transcript \(\mathcal {Q} =(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}},\mathcal {Q}_R,\mathcal {Q} _\mathsf {S},\mathcal {Q} _\mathbf {H},{\mathbf {P}})\) , following the same line as the previous step, it can be shown that
The preceding established Equation (12). Gathering Equations (7) and (12) yields Equation (6) and completes the proof.
4.3 Davies-Meyer-Based Trees
Using a block cipher \(\mathbf {E}: \lbrace 0,1\rbrace ^{\nu } \times \lbrace 0,1\rbrace ^{wn} \mapsto \lbrace 0,1\rbrace ^{wn}\) , the Davies-Meyer-based derivation function is defined by \(\mathbf {Prim} (x,y) := \mathsf {DM} ^\mathbf {E} (x,y) =\mathbf {E} (x,y)\oplus y\) (therefore, \(\lambda = wn\) ). This setting is interesting when we are to instantiate the tree using (fixed-key) block ciphers in their Davies-Meyer modes.
Security of this model crucially relies on the feeding forward in Davies-Meyer—that is, feeding the \(\kappa\) -bit secret \(\mathsf {right} _{\kappa }(z)\) forward. However, a bad outputting function \(\mathsf {of}\) may cancel these bits. In this respect, we additionally require that the outputting function \(\mathsf {of}\) only relies on the leftmost \(n-\kappa\) bits of its seed—that is, \(\mathsf {of} (z, I) = \mathsf {of} (\mathsf {left} _{n - \kappa }(z), I)\) for any inputs \(z, I \in \lbrace 0,1\rbrace ^n\) . Our formal results regarding \(\mathsf {GGGM} ^{\mathsf {DM} ^\mathbf {E}}\) will emphasize on this additional restriction.
Theorem 4.2.
Assume using the simulator \(\mathsf {S}\) defined in Figure 4, and
(i)
\(\mathbf {E}:\lbrace 0,1\rbrace ^\nu \times \lbrace 0,1\rbrace ^{wn}\mapsto \lbrace 0,1\rbrace ^{wn}\) is modeled as an ideal cipher;
(ii)
\(\mathsf {of}: \lbrace 0,1\rbrace ^n \times \lbrace 0,1\rbrace ^n \rightarrow \lbrace 0,1\rbrace ^n\) is such that \(\mathsf {of} (z,I) = \mathsf {of} (\mathsf {left} _{n-\kappa }(z), I)\) for any \(z,I \in \lbrace 0,1\rbrace ^n\) ;
(iii)
\(\mathsf {L}\) leaks \(\mathsf {left} _{n-\kappa }(\mathsf {Nd} (i_0,p^*))\) for every intermediate node \(\mathsf {Nd} (i_0,p^*)\) ;
(iv)
there exist quantities C and \(\varepsilon _{\mu }\) such that
Then, \(\mathsf {GGGM} ^{\mathsf {DM} ^\mathbf {E}}\) is a \((u, {T}, D, \varepsilon)\) - \((\mathsf {L},\mathsf {S})\) -CPRF for the set system \(\mathbb {S} _{\mathsf {pre},\mathsf {GGGM}}\) of Equation (3), where
View \((\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}},\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}},\mathbf {E})\) as the real world and \((\mathsf {\$Cons}^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {E})\) as the ideal world. We prove the following bound:
The setting is similar to that studied in Section 4.2, except that the random oracle \(\mathbf {H}\) is replaced with an ideal cipher \(\mathbf {E}: \lbrace 0,1\rbrace ^\nu \times \lbrace 0,1\rbrace ^{wn} \mapsto \lbrace 0,1\rbrace ^{wn}\) that can be queried in both forward and backward directions, with \(wn = \lambda\) . By this, the transcript of \(\mathfrak {D}\) ’s interaction consists of \(\mathcal {Q} _\mathsf {Nd}\) and \(\mathcal {Q} _\mathbf {E}\) , where \(\mathcal {Q}_\mathbf {E} = \lbrace (L_1, x_1, y_1), \ldots \rbrace\) records \(\mathfrak {D}\) ’s queries/answers to/from \(\mathbf {E}\) (with \((L, x, y) \in \mathcal {Q}_\mathbf {E}\) meaning \(\mathbf {E} (L,x)=y\) ), whereas the transcript \(\mathcal {Q} _\mathsf {Nd} = \lbrace (i_0^{(1)},p^{(1)},z^{(1)},b^{(1)}),\ldots \rbrace\) , \(i_0^{(\ell)} \in \lbrace 1,\ldots ,u \rbrace\) , \(p^{(\ell)}\in \mathcal {P}\) , \(z^{(\ell)}\in \lbrace 0,1\rbrace ^n \cup \lbrace 0,1\rbrace ^{n-\kappa }\) , \(b^{(\ell)} \in \lbrace 0,1\rbrace\) , is just similar to Section 4.2. We also append the \(\kappa\) bit internal secrets to \(\mathcal {Q} _\mathsf {Nd}\) to have the extended list \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) as in Section 4.2, and concentrate on \(\mathcal {Q} =(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}},\mathcal {Q} _\mathbf {E},{\mathbf {P}})\) with \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}} =((i_0^{(1)},p^{(1)},z^{(1)},b^{(1)}),\ldots)\) , \(i_0^{(\ell)} \in \lbrace 1,\ldots ,u \rbrace\) , \(p^{(\ell)}\in \mathcal {P}\) , \(z^{(\ell)}\in \lbrace 0,1\rbrace ^n\) , \(b^{(\ell)} \in \lbrace 0,1\rbrace\) . Denote by \(\mathbf {E} \vdash \mathcal {Q} _\mathbf {E}\) the event that a block cipher \(\mathbf {E}\) is consistent with the queries/answers in \(\mathcal {Q} _\mathbf {E}\) (i.e., that \(\mathbf {E} (L,x)=y\) for all \((L, x, y) \in \mathcal {Q} _\mathbf {E}\) ). Then the probability of \(\mathbf {E} \vdash \mathcal {Q} _\mathbf {E}\) for an ideal cipher \(\mathbf {E}\) (with wn-bit blocks and \(\nu\) -bit keys) is exactly \((\prod _{L\in \lbrace 0,1\rbrace ^\nu }(2^{wn})_{T_L})^{-1}\) , where for integers \(1\le b\le a\) , we set \((a)_b=a\cdot (a-1)\cdots (a-b+1)\) with \((a)_0=1\) by convention, and \(T_L\) is the number of tuples of the form \((L,\star ,\star)\) in \(\mathcal {Q} _\mathbf {E}\) (thus, \(\sum _{L\in \lbrace 0,1\rbrace ^\nu }T_L={T}\) ). Therefore, for any attainable transcript \(\mathcal {Q} =(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}},\mathcal {Q} _\mathbf {E},{\mathbf {P}})\) , the probability that the ideal world is consistent with \(\mathcal {Q}\) is
For the real world, we also write \((\mathbf {E}, \mathbf {K}) \vdash \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) to denote the event that the cipher \(\mathbf {E}\) and keys \(\mathbf {K}\) are consistent with the values in \(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) . Similarly to Section 4.2, the real-world probability is exactly
and the problem also reduces to bounding \(\Pr [ (\mathbf {E}, \mathbf {K}) \vdash \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}} \mid \mathbf {E} \vdash \mathcal {Q} _\mathbf {E} ]\) .
Internal Evaluation List \(\mathcal {Q} _{\mathbf {E}}^{\mathrm{x}}\) . As in Section 4.2, we will show that, conditioned on \(\mathbf {E} \vdash \mathcal {Q} _\mathbf {E}\) , the event \((\mathbf {E}, \mathbf {K}) \vdash \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) is equivalent to \(\mathbf {E}\) satisfying a series of new and distinct equations. The conditions for bad transcripts are essentially defined to ensure these equations. We start by explicitly constructing the list \(\mathcal {Q} _{\mathbf {E}}^{\mathrm{x}}\) of such equations. For this, consider any \((i_0,p,z,\star) \in \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) with \(p = p^*/i_{d^{\prime }} \ne \bot\) . Let \(j^* = \lfloor \frac{ i_{d^{\prime }} }{ w } \rfloor\) and \(p_\ell = p^*/ (w j^* + \ell - 1)\) ( \(1 \le \ell \le w\) ). Then the extended list \(\mathcal {Q} _{\mathbf {E}}^{\mathrm{x}}\) includes an “internal evaluation tuple” \((i_0,p^*, j^*, L^*,x^*,y^*)\) , where ( \(z^* = \mathsf {Nd} (i_0,p^*)\) ):
Bad Transcripts. An extended transcript \(\mathcal {Q} =(\mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}},\mathcal {Q} _\mathbf {E},{\mathbf {P}})\) is bad, if any of the following conditions is fulfilled:
•
(B-1) \(\mu \ge C\) .
•
(B-2) There exist a pair of tuples \(((L,x,y),(i_0^*,p^*,j^*,L^*,x^*,y^*))\in \mathcal {Q} _\mathbf {E} \times \mathcal {Q} _{\mathbf {E}}^{\mathrm{x}}\) such that \((L,x)=(L^*,x^*)\) , or \((L,y)=(L^*,y^*)\) .
•
(B-3) There exist distinct \((i_0^*,p^*,j^*,L^*,x^*,y^*),(i_0^{**},p^{**},j^{**},L^{**},x^{**},y^{**})\in \mathcal {Q} _{\mathbf {E}}^{\mathrm{x}}\) with \((L^*,x^*)=(L^{**},x^{**})\) or \((L^*,y^*)=(L^{**},y^{**})\) .
The bound \(\Pr [\text{(B-1)} ] \le \varepsilon _{\mu }\) also follows from Equation (16) straightforwardly. For (B-2), consider each choice of \(((L,x,y),(i_0^*,p^*,j^*,L^*,x^*,y^*))\in \mathcal {Q} _\mathbf {E} \times \mathcal {Q} _{\mathbf {E}}^{\mathrm{x}}\) . By the fact that \({\mathsf {right} _\kappa }(z^*)\) is uniform in \(\lbrace 0,1\rbrace ^\kappa\) for \((i_0^*,p^*,z^*,\star) \in \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}\) , and that \(\mathsf {sf} _{p^*,j^*} (\star)\) is injective, the probability to have \(x=x^*\) is \(1/2^\kappa\) .
where \(p_\ell ^*=p^*/ (w j^* + \ell - 1)\) ( \(1 \le \ell \le w\) ) and \(r^* = \mathsf {left} _{n-\kappa } (\mathsf {Nd} (i_0^*,p^*))\) . In the ideal world, \({\mathsf {right} _{\kappa }}(\mathsf {Nd} (i_0^*,p^*))\) is uniform, and is independent from \(\mathsf {left} _{n-\kappa } (\mathsf {Nd} (i_0^*,p^*))\) , \(\mathsf {Nd} (i_0^*,p_1), \ldots ,\) \(\mathsf {Nd} (i_0^*,p^*)\) (since \(\mathsf {right} _{\kappa }(\mathsf {Nd} (i_0^*,p^*))\) is the random “dummy” value sampled at the end of the ideal-world interaction). By this and by the injectivity of \(\mathsf {sf} _{p^*, j^*} (\star)\) , the probability to have \(y=y^*\) is \(1/2^{\kappa }\) .
Finally, note that \(L = \mathsf {lf} _{p^*,j^*} ({\mathsf {left} _{n-\kappa }}(\mathsf {Nd} (i_0^*,p^*)) , {\mathsf {pp}} _{i_0^*})\) is necessary for both \((L,x)=(L^*,x^*)\) and \((L,y)=(L^*,y^*)\) . By this, for any \(L\in \lbrace 0,1\rbrace ^{\nu }\) , we define
Then, the condition (B-2) is equivalent with \(\exists (i_0^*,p^*,j^*,L^*,x^*,y^*)\in \mathcal {Q} _{\mathbf {E}}^{\mathrm{x}}: x^* \in \mathcal {Q} _\mathbf {E} ^+[L^*] ~\vee ~ y^* \in \mathcal {Q} _\mathbf {E} ^-[L^*]\) , the probability of which is
For (B-3), consider each pair \((i_0^*,p^*,j^*,L^*,x^*,y^*),(i_0^{**},p^{**},j^{**},L^{**},x^{**},y^{**})\in \mathcal {Q} _{\mathbf {E}}^{\mathrm{x}}\) . Due to our restriction on \(\mathsf {sf}\) and \(\mathsf {lf}\) , if \((i_0^*,p^*) = (i_0^{**},p^{**}),\) then ( \(j^* \ne j^{**}\) and) \(x^* \ne x^{**}\) . Thus, we could focus on the case \(p^* \ne p^{**}\) , meaning that the probability to have \(\mathsf {sf} _{p^*,j^*} (\mathsf {right} _{\kappa } (\mathsf {Nd} (i_0^*,p^*))) = \mathsf {sf} _{p^{**},j^{**}} (\mathsf {right} _{\kappa } (\mathsf {Nd} (i_0^{**},p^{**})))\) is \(1/2^{\kappa }\) since both \(\mathsf {Nd} (i_0^*,p^*)\) and \(\mathsf {Nd} (i_0^{**},p^{**})\) are independent and uniform. On the other side, the equality \(y^* = y^{**}\) translates into
where \(p_\ell ^*=p^*/ (w j^* + \ell - 1)\) ( \(1 \le \ell \le w\) ), \(r^* = \mathsf {left} _{n-\kappa } (\mathsf {Nd} (i_0^*,p^*))\) , \(p_\ell ^{**}=p^{**}/ (w j^{**} + \ell - 1)\) ( \(1 \le \ell \le w\) ) and \(r^{**} = \mathsf {left} _{n-\kappa } (\mathsf {Nd} (i_0^{**},p^{**}))\) . In the ideal world, \({\mathsf {right} _{\kappa }}(\mathsf {Nd} (i_0^*,p^*))\) and \({\mathsf {right} _{\kappa }}(\mathsf {Nd} (i_0^{**},p^{**}))\) are uniform and independent. By the injectivity of \(\mathsf {sf}\) , the probability to have \(y^* = y^{**}\) is \(1/2^{\kappa }\) .
Last, \((L^*,x^*)=(L^{**},x^{**})\) and \((L^*,y^*)=(L^{**},y^{**})\) hold only if \(\mathsf {lf} _{p^*,j^*} (\mathsf {left} _{n - \kappa }(\mathsf {Nd} (i_0^*,p^*)) , {\mathsf {pp}} _{i_0^*}) = \mathsf {lf} _{p^{**},j^{**}} (\mathsf {left} _{n - \kappa }(\mathsf {Nd} (i_0^{**},p^{**})) , {\mathsf {pp}} _{i_0^{**}})\) . Meanwhile, by our definition Equation (4) and by \(\lnot \text{(B-1)}\) , for each pair \((p^*,j^*)\) , the number of pairs \((p^{**},j^{**})\) satisfying \(\mathsf {left} _{n - \kappa }(\mathsf {Nd} (i_0^*,p^*)) = \mathsf {left} _{n - \kappa }(\mathsf {Nd} (i_0^{**},p^{**}))\) cannot exceed C. By these, the probability \({\Pr }[ \text{(B-3)} \mid \lnot \text{(B-1)} ]\) is bounded by
Fix some \(\ell\) . Since the transcript is good, there is no query of the form \((L^{(\ell)},x^{(\ell)}, \star)\) in \(\mathcal {Q} _\mathbf {E}\) (since (B-2) does not occur), nor is \(\mathbf {E} (L^{(\ell)},x^{(\ell)})\) determined by the fact that \(\mathbf {E} (L^{(\ell ^{\prime })},x^{(\ell ^{\prime })})=y^{(\ell ^{\prime })}\) for all \(\ell ^{\prime }\lt \ell\) (since (B-3) does not occur). Similarly by symmetry, there is no query of the form \((L^{(\ell)}, \star , y^{(\ell)})\) in \(\mathcal {Q} _\mathbf {E}\) (since (B-2) does not occur), nor is \(\mathbf {E} ^{-1}(L^{(\ell)},y^{(\ell)})\) determined by the fact that \(\mathbf {E} (L^{(\ell ^{\prime })},y^{(\ell ^{\prime })})=x^{(\ell ^{\prime })}\) for all \(\ell ^{\prime }\lt \ell\) (since (B-3) does not occur). Thus, we have
for all \(\ell\) . Finally, it also holds \(|\mathcal {Q} _{\mathbf {E}}^{\mathrm{x}} |= | \lbrace (i_0,p,z,b) \in \mathcal {Q} _\mathsf {Nd} ^{\mathsf {X}}: p \ne \bot \rbrace | / w,\) which resembles Section 4.2. By the preceding,
For this step, we view \((\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {E})\) as the real world and \((\mathsf {\$Cons}^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {E})\) as the ideal world. The core step is to establish pseudorandomness of the constrained keys, which combines the ideas of Sections 4.2.3 and 4.3.1. In all, the bound remains.
Gathering Equations (18) and (23) yields Equation (17) and completes the proof.
5 \(\text{Multi-user}\) LEAKAGE PPRF SECURITY OF \(\mathsf {GGGM}\) TREES
Although it was believed obvious, we first formally describe the puncturing algorithm \(\mathsf {Pu}\) of \(\mathsf {GGGM} ^\mathbf {Prim}\) in Figure 5 for completeness. This specification would also be used in the subsequent proof of Theorem 5.1.
Fig. 5.
Fig. 5. The \(\mathsf {Pu}\) algorithm corresponding to \(\mathsf {GGGM} ^{\mathbf {Prim}}[\kappa ,n,\nu ,\theta ,w,d,\mathsf {sf},\mathsf {lf} ]\) .
The leakage assumption and simulator \(\mathsf {S}\) are roughly the same as Section 4.1 and Figure 4. With these, the leakage PPRF security of \(\mathsf {GGGM}\) is as follows.
Theorem 5.1.
Assume using the simulator \(\mathsf {S}\) defined in Figure 4, and that there exist quantities C and \(\varepsilon _{\mu }\) such that \({\Pr }_{ {\mathbf {P}} \leftarrow \mathsf {KGen}, \mathcal {L} \leftarrow \mathsf {S} } [ \mu (\mathcal {L}) \gt C ] \le \varepsilon _{\mu }\) . Then, we have the following:
•
The tree \(\mathsf {GGGM} ^\mathbf {H}\) built upon a random oracle \(\mathbf {H}:\lbrace 0,1\rbrace ^{\nu + \omega }\mapsto \lbrace 0,1\rbrace ^{wn}\) is a \((u, {T}, D, \varepsilon)\) - \((\mathsf {L},\mathsf {S})\) -PPRF, where \(\varepsilon = 2\varepsilon _{\mu } + \frac{2C \cdot ({T} +D) }{2^{\kappa }}\) ;
•
With the additional restriction that \(\mathsf {of}: \lbrace 0,1\rbrace ^n \times \lbrace 0,1\rbrace ^n \rightarrow \lbrace 0,1\rbrace ^n\) is such that \(\mathsf {of} (z,I) = \mathsf {of} (\mathsf {left} _{n-\kappa }(z), I)\) for any \(z,I \in \lbrace 0,1\rbrace ^n\) , the tree \(\mathsf {GGGM} ^{\mathsf {DM} ^\mathbf {E}}\) built upon an ideal cipher \(\mathbf {E}:\lbrace 0,1\rbrace ^\nu \times \lbrace 0,1\rbrace ^{wn}\mapsto \lbrace 0,1\rbrace ^{wn}\) is a \((u, {T}, D, \varepsilon)\) - \((\mathsf {L},\mathsf {S})\) -PPRF, where \(\varepsilon = 2\varepsilon _{\mu } + \frac{4C \cdot ({T} + D) }{ 2^{\kappa } }\) .
Proof.
A distinguisher \(\mathfrak {D}_1\) against the PPRF security of \(\mathsf {GGGM} ^{\mathbf {Prim}}\) can be transformed to a distinguisher \(\mathfrak {D}_2\) against the CPRF security of \(\mathsf {GGGM} ^{\mathbf {Prim}}\) . Indeed, \(\mathfrak {D}_2\) runs \(\mathfrak {D}_1\) and simulates the \(\mathsf {muPu}_\mathbf {K} ^{\mathsf {L}}\) oracle for \(\mathfrak {D}_1\) using its \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}}\) oracle, as shown in Figure 5 (the algorithm \(\mathsf {Pu} (K,\mathcal {S})\) calls \(\mathsf {StepDown} (K,p^*)\) , but as shown in Figure 2, this internal procedure functions the same as \(\mathsf {Co} (K,p^*)\) ). It is easy to see \(\mathfrak {D}_2\) ’s effective data complexity D and query complexity T are the same as \(\mathfrak {D}_1\) . The bounds thus follow Theorems 4.1 and 4.2.□
6 Improving HDWs
We first review the HDW: its basic ideas in Section 6.1, its formalism in Section 6.2, and specification of \(\mathsf {Bip32}\) in Section 6.3. Then, in Section 6.4, we introduce \(\mathrm{mu}\) security definitions for HDWs; in Section 6.5, we establish \(\mathrm{mu}\) security for \(\mathsf {Bip32}\) using Theorem 4.1. Finally, we present improvements in Section 6.6.
6.1 Hierarchical Deterministic Wallets
Briefly, a wallet in blockchain consists of a pair of secret and public keys for a digital signature scheme. To transfer assets, the user signs transactions (i.e., messages) with its secret key, with the digital identity named “address” of the receiver (e.g., the receiver’s public key) embedded in the transactions. A deterministic wallet derives a sequence of session key pairs from a single master key and uses distinct public session keys as multiple identities for receiving, to achieve anonymity and limit the damage of (session) key exposure.
An HDW goes one step further and derives a collection of signing keys from a master and organizes them under an access hierarchy, where each element represents a group of users and each user has its associated keys. Users staying higher in the hierarchy must be able to derive the keys of users on lower levels and to further sign transactions on their behalf. Users on lower levels, however, should not be able to escalate their privileges along the hierarchy, not even when colluding with others. This hierarchical access control exactly fits into the manager(s)-departments architecture of large-scale enterprises. It also eases wallet delegation and auditing, which turns out to be crucial for e-commerce and decentralized finance.
Clearly, secret signing keys are central in wallets. To achieve decentralized key managements, a promising approach is to use threshold signatures [23, 40]. In a threshold signature, the secret signing key is divided into shares held by multiple parties. A threshold number (i.e., a subset) of these parties can follow the protocol (typically the TSS protocol [3]) to collaboratively sign cryptocurrency transaction. The protocol is fully decentralized, and the collapse of fewer parties/shares will not incur loss of funding. See the work of Aumasson et al. [3] for a survey.
Decentralized key managements for HDW, however, require dividing the master key into shares and computing the signing key shares from the master key shares without combining any one. Thus, multiple parties holding the master key shares have to evaluate the hierarchical key derivations in MPC. Probably, the best approach is to garble the key derivation functions. The bottleneck is communication overhead, which is mainly determined by the number of AND gates in key derivations. The default \(\mathsf {Bip32}\) configuration consumes four HMAC-SHA512 executions with nearly 1 million AND gates to derive a concrete signing key from the wallet seed (see Figure 1). This incurs a heavy communication cost and prohibits the use, especially for mobile users. Although some ideas to remedy appear obvious, the soundness is unclear due to the lack of formalism and justification.
6.2 Formalism of Public-Underivable HDW
Luzio et al. [42] introduced a model for HDW. Their formalism particularly emphasizes public derivability—that is, the ability of generating all public keys of the wallet without relying on any secret information. As they discussed [42, Section 7], public derivability somewhat contradicts the privacy notion (transaction) unlinkability. However, \(\mathsf {Bip32}\) [44, Security] indeed insisted on unlinkability rather than public derivability (see Section 6.4 for elaboration). \(\mathsf {Bip32}\) tries to achieve unlinkability-like notion by using secret “chain codes,” which essentially disables public derivability. Auditing was intended to be carried out by granting certain secret “chain codes” to the auditor. With these considerations, we henceforth refer to the formalism of Luzio et al. [42, Section 5] as public-derivable HDW and resort to a natural relaxation (pub-underivable) HDW.5
Despite disabling public derivability, our formalism of HDW still follows [42]. Concretely, let \(\mathcal {G} = (\mathcal {V},\mathcal {E})\) be a Directed Acyclic Graph (DAG) representing the access hierarchy of the HDW, where
(i)
\(\mathcal {V} = \lbrace v_{\bot },v_{p_1},v_{p_2},v_{p_3}... \rbrace\) is the set of vertexes, where \(v_{\bot }\) has indegree 0 (meaning that \(v_{\bot }\) has the highest privilege in the hierarchy defined by \(\mathcal {G}\) ).
(ii)
\(\mathcal {E}\) is the set of edges, and elements in \(\mathcal {E}\) are of the form \((v_{p} \xrightarrow { i_j } v_{p/i_j})\) indicating an edge from \(v_{p}\) to \(v_{p/i_j}\) (of lower privilege) with label \(i_j\) . To ease understanding and highlight the concrete hierarchy in \(\mathcal {G}\) , we use the path notation system of Section 3.2 for subscripts. This means a vertex \(v_{i_1/i_2/.../i_d}\) is in \(\mathcal {V}\) if and only if the d edges \((v_{\bot } \xrightarrow { i_1 } v_{i_1}), (v_{i_1} \xrightarrow { i_2 } v_{i_1/i_2}) \ldots , (v_{i_1/i_2/.../i_{d-1}} \xrightarrow { i_d } v_{i_1/i_2/.../i_d})\) are all in \(\mathcal {E}\) .
We define the set of descendants \(\mathcal {D}\mathsf {esc} (\mathcal {G}, v_p)\) of node \(v_p\) to be the set of nodes \(v_{p^{\prime }}\) such that there exists a direct path from \(v_p\) to \(v_{p^{\prime }}\) in \(\mathcal {G}\) . By our notations, this means there exists \(p^* \in \mathcal {P}^*\) such that \(p^{\prime } = p/p^*\) .
With these, a (public-underivable) HDW \(\mathsf {Wal} = (\mathsf {Setup},\mathsf {DPub},\mathsf {DPriv},{\mathsf {Sign}},{\mathsf {Vrfy}})\) , defined over seed space \(\mathcal {S}\) and message space \(\mathcal {M}\) , is defined in the following way:
•
\(\mathsf {Setup} (\mathcal {G},S)\) : The deterministic setup algorithm (a.k.a. master key generation due to Das et al. [22]) takes as input an initial seed \(S \in \mathcal {S}\) and a DAG \(\mathcal {G}\) that has a unique node with indegree 0, and returns the keys \((\mathsf {wsk} _{\bot },\mathsf {wpk} _{\bot })\) of the node \(v_{\bot } \in \mathcal {V}\) with indegree 0 (with the highest privileges). \((\mathsf {wsk} _{\bot },\mathsf {wpk} _{\bot })\) are also viewed as the master wallet secret and public keys of the HDW.
•
\(\mathsf {DPub} (\mathcal {G}, \mathsf {wpk} _p, v_p, v_{p^{\prime }})\) : The delegated deterministic public derivation algorithm takes as input the wallet public key \(\mathsf {wpk} _p\) associated to node \(v_p \in \mathcal {V}\) and a target node \(v_{p^{\prime }} \in \mathcal {D}\mathsf {esc} (\mathcal {G}, v_p)\) , and outputs the wallet public key \(\mathsf {wpk} _{p^{\prime }}\) of \(v_p\) . This functionality fits into the “audit” use case of Mediawiki [44, Use cases].
•
\(\mathsf {DPriv} (\mathcal {G}, \mathsf {wsk} _p, v_p, v_{p^{\prime }})\) : The deterministic private derivation algorithm takes as input the wallet secret key \(\mathsf {wsk} _p\) associated to node \(v_p \in \mathcal {V}\) and a target node \(v_{p^{\prime }} \in \mathcal {D}\mathsf {esc} (\mathcal {G}, v_p)\) , and outputs the wallet secret key \(\mathsf {wsk} _{p^{\prime }}\) of \(v_{p^{\prime }}\) .
•
\({\mathsf {WSign}} (\mathsf {wsk} _p,m)\) : The randomized signing algorithm takes as input a message \(m \in \mathcal {M}\) and a wallet secret key \(\mathsf {wsk} _p\) , and outputs a signature \(\sigma\) .
•
\({\mathsf {WVrfy}} (pk, m, \sigma)\) : The deterministic verification algorithm takes as input a signature public key pk, a message m, and a signature \(\sigma\) . It outputs 1 (accept) or 0 (reject).
An HDW is correct if any user \(v_p\) (that holds the wallet secret key \(\mathsf {wsk} _p\) ) can derive the private and public keys \(\mathsf {wsk} _{p^{\prime }}\) and \(\mathsf {wpk} _{p^{\prime }}\) of any of its descendants \(v_{p^{\prime }} \in \mathcal {D}\mathsf {esc} (\mathcal {G}, v_p)\) and create a valid signature on behalf of \(v_{p^{\prime }}\) (i.e., that passes the verification process against the public key \(pk_{p^{\prime }}\) obtained through public key derivation). We omit the formalism.
6.3 \(\mathsf {Bip32}\) HDW and the Underlying \(\mathsf {GGGM}\) Instance
The Bitcoin Improvement Proposal \(\mathsf {Bip32}\) [44] uses a double-input function \(\mathbf {Prim}: \lbrace 0,1\rbrace ^{512} \times \lbrace 0,1\rbrace ^{256} \mapsto \lbrace 0,1\rbrace ^{512}\) . In Figure 6, we provide a description of \(\mathsf {Bip32}\) following the formalism in Section 6.2. Briefly speaking,
Fig. 6.
Fig. 6. Specification of \(\mathsf {Bip32}\) HDW following the formalism of Section 6.2.
(i)
During \(\mathsf {Setup} (\mathcal {G}, S)\) , the wallet first invokes \(\mathbf {Prim}\) with the seed S to derive master keys \((ch_{\bot },sk_{\bot },pk_{\bot })\) that are intended to be held by the enterprise, where \((sk_{\bot },pk_{\bot })\) are the signature secret and public key and mch is an additional secret called \(\text{chain code}\) . Essentially, the \(\text{chain code}\) functions as secret seeds of pseudorandom primitives. As shown in Figure 1, \(\mathsf {wsk} _{\bot } = (sk_{\bot },ch_{\bot })\) and \(\mathsf {wpk} _{\bot } = (pk_{\bot },ch_{\bot })\) are viewed as the extended private and public keys of the enterprise.
(ii)
Given the extended secret key \(\mathsf {wsk} _p = (sk_p,ch_p)\) of a node \(v_{p}\) , the \(\mathsf {CKDpriv}\) algorithm derives the extended secret key \(\mathsf {wsk} _{p/i} = (sk_{p/i},ch_{p/i})\) of a child node \(v_{p/i}\) via invoking \(\mathbf {Prim}\) once and calculating a modular addition.
(iii)
Given the extended public key \(\mathsf {wpk} _p = (pk_p,ch_p)\) of a node \(v_{p}\) , the \(\mathsf {CKDpub}\) algorithm derives the extended public key \(\mathsf {wpk} _{p/i} = (pk_{p/i},ch_{p/i})\) of a child node \(v_{p/i}\) , thanks to the homomorphism property between the secret key and public key space.
Note that by the specification, a node \(v_p\) specified by \(\mathcal {G}\) may still have \(\mathsf {wsk} _p = \bot\) , although the probability is extremely low. A default configuration for an enterprise with several offices is recommended in Mediawiki [44]. The default key tree is essentially a \(\mathsf {GGGM}\) tree with depth \(d=3\) , as illustrated in Figure 1.
As discussed in Section 3.1, the key tree of \(\mathsf {Bip32}\) is actually a major motivation of our model. Actually, the definition and analysis of \(\mathsf {Bip32}\) can be based on an instance of \(\mathsf {GGGM}\) that (roughly) takes the 512-bit strings \(z_p = [sk_{p}]_{256} \Vert ch_{p}\) as nodes (with \(\text{chain code}\) \(ch_{p}\) functioning as the secrets). In detail, consider the \(\mathsf {GGGM}\) instance with parameters as follows:
Depth d equals the length of the longest (directed) path in \(\mathbf {G}\) . In this vein, a (directed) path \(v_{\bot } \xrightarrow { i_1 } v_{i_1} \xrightarrow { i_2 } ... \xrightarrow { i_{d^{\prime }} } v_{i_1/.../i_{d^{\prime }}}\) in \(\mathcal {G}\) identifies a path \(p^* = i_1/.../i_{d^{\prime }}\) in this tree.
•
The root node \(\mathsf {Nd} (\bot) = \mathbf {Prim} (S , \text{``Bitcoin seed''})\) .
•
For a node value \(z \in \lbrace 0,1\rbrace ^{512}\) and \((p,j) \in (\lbrace \bot \rbrace \cup \lbrace i_1/i_2/.../i_{d^{\prime }}\rbrace _{d^{\prime }\in \lbrace 1,\ldots ,d-1\rbrace }) \times \lbrace 0,\ldots ,2^{32}-1\rbrace\) , let \(r = \mathsf {left} _{256}(z)\) , then the seeding, labeling, and outputting functions are as follows:
The preceding \(\mathsf {GGGM}\) instance is not exactly the same as a \(\mathsf {Bip32}\) key tree: it may contain nodes \(z \in \lbrace 0,1\rbrace ^{512}\) such that \(\mathsf {int} (\mathsf {left} _{256}(z)) \notin \mathbb {Z} _{|\mathbb {G} |}^+\) cannot be interpreted as a “correct” signature private key (and \(\mathsf {lf}\) computes differently from \(\mathsf {Bip32}\) key tree), whereas the \(\mathsf {Bip32}\) key tree discards such “unparsable” values. But the gap is limited, as will be reflected in the subsequent reduction in Section 6.5. In all, the algorithm \(\mathsf {DPriv} (\mathcal {G}, \mathsf {wsk} _p, v_p, v_{p^{\prime }})\) in Figure 6 can be redefined based on the \(\mathsf {Co}\) algorithm of the preceding \(\mathsf {GGGM}\) instance. In particular, when the “starting” node \(v_\bot\) is the root node, the key can be derived via querying the constraining oracle of \(\mathsf {F}\) . This will be the core idea of our reduction in Section 6.5.
6.4 Multi-User Security Definitions for HDW
We follow the hierarchical unforgeability notion of Luzio et al. [42], which allows an attacker to corrupt an arbitrary number of users (and their descendants) in the hierarchy, and challenges the attacker to forge a signature on behalf of an uncorrupted node. The ability of corruption is formalized by the oracle \(\mathsf {Crupt}\) in Figure 7, which also models multiple nodes colluding and sharing their secrets. In the following, we extend it into the \(\mathrm{mu}\) setting. We also consider that the case wallet is built upon a public ideal function \(\mathbf {Prim}\) and write \(\mathsf {Wal} ^{\mathbf {Prim}}\) to highlight. Another parameter that helps characterizing adversarial power is the maximal number of allowed sessions. Concretely, let \(\mathbf {G} = (\mathcal {G} _{1},\ldots ,\mathcal {G} _{u})\) be a sequence of DAGs that defines the configurations for the u wallet users, and let \(\mathcal {G} _{i_0} = (\mathcal {V} _{i_0},\mathcal {E} _{i_0})\) for \(i_0=1,\ldots ,u\) . Then, the maximal number of allowed sessions is defined as \(V(\mathbf {G}):= \sum _{i_0=1}^{u} |\mathcal {V} _{i_0}|\) . In other words, the DAGs limit the total number of derived keys in the system.
Fig. 7.
Fig. 7. \(\text{Multi-user}\) \(\mathsf {HEUF}\) security game \(\mathsf {Game}_{ \mathsf {Wal} ^{\mathbf {Prim}}, \mathfrak {A}}^{ \mathsf {muHEUF}} (\mathbf {G})\) . The invoked \(\mathsf {Setup}\) , \(\mathsf {DPub}\) , \(\mathsf {DPriv}\) , \(\mathsf {WSign}\) , and \(\mathsf {WVrfy}\) belongs to the wallet \(\mathsf {Wal} ^{\mathbf {Prim}}\) .
An HDW scheme \(\mathsf {Wal} ^\mathbf {Prim}\) is \((u,q_C,q_D,q_S,{T},D,t,\varepsilon)\) -mu hierarchically existentially unforgeable, if for every sequence of u DAGs \(\mathbf {G} =(\mathcal {G} _1,\ldots ,\mathcal {G} _u)\) such that \(V(\mathbf {G}) \le D\) and any adversary \(\mathfrak {A}\) making \(q_C\) queries to the \(\mathsf {Crupt}\) oracle, \(q_D\) queries to the \(\mathsf {PKReq}\) oracle, \(q_S\) queries to the signing oracle \(\mathsf {muWSign}\) , and T queries to the ideal primitive \(\mathbf {Prim}\) , it holds
where the experiment \(\mathsf {Game}_{ \mathsf {Wal} ^{\mathbf {Prim}}, \mathfrak {A}}^{ \mathsf {muHEUF}} (\mathbf {G})\) is defined in Figure 7.
Luzio et al. [42] mentioned hierarchical unlinkability without a detailed formalism. This notion intends to capture that there is no “non-trivial” relation between distinct child public keys of the same node. We formalize this idea in the \(\mathrm{mu}\) setting, allowing an attacker to corrupt an arbitrary number of users/sessions in the hierarchy, and challenging it to distinguish public signature keys of uncorrupted nodes from random points. This is formalized by the oracle \({\mathsf {PKReq}}\) in Figure 8, which returns the true requested public signature key when \(b=1\) , and random public key when \(b=0\) . These two definitions essentially capture desired security in the intended use case “Per-office balances” in Mediawiki [44].
An HDW scheme \(\mathsf {Wal} ^\mathbf {Prim}\) is \((u,q_C,q_D,q_S,{T},D,t,\varepsilon)\) -mu hierarchically unlinkable, if for every sequence of u DAGs \(\mathbf {G} =(\mathcal {G} _1,\ldots ,\mathcal {G} _u)\) such that \(V(\mathbf {G}) \le D\) and any adversary \(\mathfrak {A}\) making \(q_C\) queries to the \(\mathsf {Crupt}\) oracle, \(q_D\) queries to the oracle \(\mathsf {PKReq}\) , \(q_S\) queries to the signing oracle \(\mathsf {muWSign}\) , and T queries to the ideal primitive \(\mathbf {Prim}\) , it holds
where the experiment \(\mathsf {Game} _{ \mathsf {Wal} ^\mathbf {Prim}, \mathfrak {A}, b}^{ \mathsf {muHULk}} (\mathbf {G})\) is defined in Figure 8.
6.5 Multi-User Security of \(\mathsf {Bip32}\)
For simplicity and clearness, we assume using parameters close to the 256-bit elliptic curve \(\mathsf {secp256k1}\) recommended in Mediawiki [44]. In the standard \(\mathsf {Bip32}\) , the double-input function \(\mathbf {Prim}\) is instantiated by \(\mathsf {HMAC}\) —that is, \(\mathbf {Prim} (x,y) := \mathsf {HMAC} (y,x)\) (using y as the key of \(\mathsf {HMAC}\) ). We note that the first input x is not always secret in \(\mathsf {Bip32}\) . By Dodis et al. [25, Theorem 4.4], with such parameters, \(\mathsf {HMAC}\) instantiates a keyed FIL RO. Therefore, this section considers \(\mathbf {Prim} (x,y) = \mathbf {KH} (x,y)\) for a keyed RO \(\mathbf {KH}:\lbrace 0,1\rbrace ^{512} \times \lbrace 0,1\rbrace ^{256} \mapsto \lbrace 0,1\rbrace ^{512}\) , and our results are formally stated as follows.
Theorem 6.3.
The \(\mathsf {Bip32} ^{\mathbf {KH}}\) HDW built upon a keyed random oracle \(\mathbf {KH}:\lbrace 0,1\rbrace ^{512} \times \lbrace 0,1\rbrace ^{256} \mapsto \lbrace 0,1\rbrace ^{512}\) is \((u,q_C,q_D,q_S,{T},D,t,\varepsilon)\) -mu hierarchically existentially unforgeable, where (assuming \(D \le |\mathbb {G} |/2\) )
When the 256-bit elliptic curse domain parameters recommended by Certicom Research [47, Section 2.4] is used, it can be checked that \(D \times (1 - \frac{ |\mathbb {G} | - 1 }{ 2^{256} }) \le D/2^{127}\) (as claimed in Mediawiki [44]) and \(|\mathbb {G} |/2 \approx 2^{255}\) .
As mentioned, with the parameters in \(\mathsf {Bip32}\) , \(\mathsf {HMAC}\) instantiates a keyed FIL RO \(\mathbf {KH}:\lbrace 0,1\rbrace ^{512} \times \lbrace 0,1\rbrace ^{256} \mapsto \lbrace 0,1\rbrace ^{512}\) with 256-bit security [25, Theorem 4.4]. Thus, this is not the bottleneck. Otherwise, Equation (27) indicates computational security of \(\min \lbrace 247 , s - \log _2 u \rbrace\) bits, as long as the total number D of active \(\mathsf {Bip32}\) sessions across the world does not exceed \(\min \lbrace 2^s / u, |\mathbb {G} |/2 , 2^{127} \rbrace\) , whereas Equation (28) indicates computational security of \(\min \lbrace 247,s - \log _2 u, f(q_S) \rbrace\) bits, as long as the signature scheme delivers \(f(q_S)\) bit \(\mathsf {muUFCMA}\) security (Definition 2.2). Importantly, this means the amount of computations needed for attacks does not decrease as the number D of “active sessions” increases.
Consider the case of \(s \ge 256\) . In the \(\mathrm{su}\) setting (i.e., \(u =1\) ), the amount of computations needed to break unlinkability with a notable success probability is \(2^{247}\) . The \(\log _2 u\) bit loss in the mu setting is inevitable, as it matches the effort for guessing one out of s-bit seeds \(S_1,\ldots ,S_{u}\) . Fortunately, u reflects the number of “enterprises” using \(\mathsf {Bip32}\) excluding their sub-accounts and would not be too large.
However, the \(\mathrm{mu}\) security loss due to the signature scheme has to be seriously addressed, as it straightforwardly determines the concrete unforgeability security even in the \(\mathrm{su}\) setting. Any signature with sufficient \(\mathrm{mu}\) security could be employed: see Section 2. For example, using 256-bit secret keys, the \(\mathrm{mu}\) security of Schnorr is of 128 bits [37], giving rise to \(\min \lbrace 247,s - \log _2 u, 128\rbrace\) bits computational security. We are not aware of \(\mathsf {ECDSA}\) variants with good \(\mathrm{mu}\) bounds, which is a natural open problem.
In the rest of this section, we are devoted to proving the unlinkability and unforgeability claims in turn.
6.5.1 Unlinkability.
Consider any adversary \(\mathfrak {A}_1\) against the \(\mathsf {muHULk}\) security of \(\mathsf {Bip32} ^{\mathbf {KH}}\) . By construction, the security game \(\mathsf {G} _1 = \mathsf {Game} _{ \mathsf {Wal} ^\mathbf {KH}, \mathfrak {A}_1, 0 }^{ \mathsf {muHULk}} (\mathbf {G})\) first invokes \(\mathsf {Setup} (\mathcal {G} _{i_0},S_{i_0})\) for \(i_0=1,\ldots ,u\) , which derives the u master keys or root nodes \(\mathsf {Nd} (1,\bot) = \mathsf {wsk} _{\bot }^{(1)} = \mathbf {KH} (S_1 ,\) \(\text{``Bitcoin seed''}), \ldots , \mathsf {Nd} (u,\bot) = \mathsf {wsk} _{\bot }^{(u)} = \mathbf {KH} (S_u, \text{``Bitcoin seed''})\) for the u instances. Similarly for the game \(\mathsf {G} _1^* = \mathsf {Game} _{ \mathsf {Wal} ^\mathbf {KH}, \mathfrak {A}_1, 1 }^{ \mathsf {muHULk}} (\mathbf {G})\) . We first replace these nodes by uniform and independent strings. After this, we construct an adversary \(\mathfrak {A}_2\) that simulates the \(\mathsf {muHULk}\) security game using the CPRF oracles in front of \(\mathfrak {A}_1\) . The advantage of \(\mathfrak {A}_1\) is then bounded by Theorem 4.1. We describe the two steps in the subsequent two paragraphs in turn.
The Initial Derivation. We start by replacing the u 512-bit root nodes \(\mathsf {Nd} (1,\bot),\ldots ,\mathsf {Nd} (u,\bot)\) by u 512-bit independent and uniform strings, and obtain an intermediate game \(\mathsf {G} _2\) . The gap between \(\mathsf {G} _1\) and \(\mathsf {G} _2\) is at most \(u ({T} + D) / 2^s + u ^2/2^{s+1}\) —that is, the \(\mathrm{mu}\) PRF security of \(\mathbf {KH} (S , \text{``Bitcoin seed''})\) (viewing S as the secret key):
(i)
The u master key derivation calls \(\mathsf {Nd} (i_0,\bot) = \mathbf {KH} (S_{i_0} , \text{``Bitcoin seed''})\) , \(i_0 = 1,\ldots ,u\) , are fresh and produce u random strings \(\mathsf {Nd} (1,\bot),\ldots ,\mathsf {Nd} (u,\bot)\) , as long as none of the u arguments \((S_1 , \text{``Bitcoin seed''}),\ldots ,\) \((S_{u} , \text{``Bitcoin seed''})\) collides with the other queries to \(\mathbf {KH}\) in this system. Here “other queries” include queries made by both \(\mathfrak {A}_1\) and the subsequent derivations in the \(\mathsf {Bip32}\) instances. The number of the former type is at most T, whereas the number of the latter type does not exceed \(V(\mathbf {G}) \le D\) . Therefore, the probability of this type of collision event is at most \(u (T+D)/2^s\) ;
(ii)
The u outputs \(\mathsf {Nd} (1,\bot),\ldots ,\mathsf {Nd} (u,\bot)\) are independent if and only if the u seeds \(S_1,\ldots ,S_u\) are collision free. This probability is at most \({u \choose 2} \times \frac{1}{2^s} \le u ^2/2^{s+1}\) .
Similarly, we obtain an intermediate game \(\mathsf {G} _2^*\) from \(\mathsf {G} _1^* = \mathsf {Game} _{ \mathsf {Wal} ^\mathbf {KH}, \mathfrak {A}_1, 1 }^{ \mathsf {muHULk}} (\mathbf {G})\) via replacing the u 512-bit root nodes by random, with a gap at most \(u ({T} + D) / 2^s + u ^2/2^{s+1}\) .
\(\mathsf {G} _2\) Versus \(\mathsf {G} _2^*\) Using Theorem 4.1. For the remaining argument, \(\mathfrak {A}_2\) runs \(\mathfrak {A}_1\) and simulates the oracles as follows, and outputs \(\mathfrak {A}_1\) ’s decision bit at the end:
•
Upon \(\mathfrak {A}_1\) querying \({\mathsf {Crupt}} (i_0,v_{i_1/.../i_{d^{\prime }}}^{(i_0)})\) , \(\mathfrak {A}_2\) queries \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}} (i_0 , i_1/.../i_{d^{\prime }})\) to have the constrained key \(\mathsf {Nd} (i_0 , i_1/.../i_{d^{\prime }})\) and the leakages \(\mathsf {left} _{256}(\mathsf {Nd} (i_0,\bot)),\ldots ,\) \(\mathsf {left} _{256}(\mathsf {Nd} (i_0,i_1/.../i_{d^{\prime }}))\) . \(\mathfrak {A}_2\) returns \(\bot\) to \(\mathfrak {A}_1\) , if any of the \(d^{\prime } + 1\) 256-bit integers \(\mathsf {int} (\mathsf {left} _{256}(\mathsf {Nd} (i_0,\bot))) ,\ldots , \mathsf {int} (\mathsf {left} _{256}(\mathsf {Nd} (i_0,i_1/.../i_{d^{\prime }})))\) is not in \(\mathbb {Z} _{|\mathbb {G} |}^+\) (recall from Section 6.3 that this is consistent with the actual \(\mathsf {Bip32}\) specification). Otherwise, \(\mathfrak {A}_2\) sets \(sk_{i_1/.../i_{d^{\prime }}}^{(i_0)}\) \(\leftarrow\) \(\mathsf {int} (\mathsf {left} _{256} (\mathsf {Nd} (i_0 , i_1/.../i_{d^{\prime }})))\) , \(ch_{i_1/.../i_{d^{\prime }}}^{(i_0)} \leftarrow \mathsf {right} _{256} (\mathsf {Nd} (i_0 , i_1/.../i_{d^{\prime }}))\) , and passes \(\mathsf {wsk} _{i_1/.../i_{d^{\prime }}}^{(i_0)} = (sk_{i_1/.../i_{d^{\prime }}}^{(i_0)} , ch_{i_1/.../i_{d^{\prime }}}^{(i_0)})\) to \(\mathfrak {A}_1\) .
•
Upon \(\mathfrak {A}_1\) querying \({\mathsf {muWSign}} (i_0, m, v_{i_1/.../i_{d^{\prime }}}^{(i_0)})\) , \(\mathfrak {A}_2\) queries \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}} (i_0 , i_1/.../i_{d^{\prime }})\) for the constrained key \(\mathsf {Nd} (i_0 , i_1/.../i_{d^{\prime }})\) and the leakages \(\mathsf {left} _{256}(\mathsf {Nd} (i_0,\bot)),\ldots ,\) \(\mathsf {left} _{256}(\mathsf {Nd} (i_0,i_1/.../i_{d^{\prime }}))\) . If any of these \(d^{\prime } + 1\) integers \(\mathsf {int} (\mathsf {left} _{256}(\mathsf {Nd} (i_0,\bot))) ,\ldots ,\) \(\mathsf {int} (\mathsf {left} _{256}(\mathsf {Nd} (i_0,i_1/.../i_{d^{\prime }})))\) is not in \(\mathbb {Z} _{|\mathbb {G} |}^+\) and then \(\mathfrak {A}_2\) returns \(\bot\) to \(\mathfrak {A}_1\) . Otherwise, \(\mathfrak {A}_2\) computes the \(\text{chain code}\) \(ch_{i_1/.../i_{d^{\prime }}}^{(i_0)} \leftarrow \mathsf {right} _{256} (\mathsf {Nd} (i_0 , i_1/.../i_{d^{\prime }}))\) and the secret signing key \(sk_{i_1/.../i_{d^{\prime }}}^{(i_0)} \leftarrow \mathsf {int} (\mathsf {left} _{256} (\mathsf {Nd} (i_0 , i_1/.../i_{d^{\prime }})))\) and returns \({\mathsf {WSign}} ((sk_{i_1/.../i_{d^{\prime }}}^{(i_0)},ch_{i_1/.../i_{d^{\prime }}}^{(i_0)}), m)\) to \(\mathfrak {A}_1\) .
•
Upon \(\mathfrak {A}_1\) querying \({\mathsf {PKReq}} (i_0,v_{i_1/.../i_{d^{\prime }}}^{(i_0)})\) , \(\mathfrak {A}_2\) pinpoints the longest path in \(\mathcal {G} _{i_0}\) that contains the node \(v_j^{(i_0)}\) . Formally, \(\mathfrak {A}_2\) pinpoints \(v_0^{(i_0)} \xrightarrow { i_1 } v_{i_1}^{(i_0)} \xrightarrow { i_2 } ... \xrightarrow { i_{d^{\prime }} } v_{i_1/.../i_{d^{\prime }}}^{(i_0)} \xrightarrow { i_{d^{\prime } + 1} } ... \xrightarrow { i_{d} } v_{i_1/.../i_{d}}^{(i_0)}\) such that the outdegree of \(v_{i_1/.../i_{d}}^{(i_0)}\) is zero. \(\mathfrak {A}_1\) then queries \(\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}} (i_0 , i_1/.../i_{d})\) 6 to have \(\mathsf {left} _{256}(\mathsf {Nd} (i_0,i_1/.../i_d))\) and the leakages \(\mathsf {left} _{256}(\mathsf {Nd} (i_0,\bot)),\ldots ,\) \(\mathsf {left} _{256}(\mathsf {Nd} (i_0,i_1/.../i_{d^{\prime }})),\ldots\) Again, if any of the \(d^{\prime } + 1\) integers \(\mathsf {int} (\mathsf {left} _{256}(\mathsf {Nd} (i_0,\bot))) ,\ldots , \mathsf {int} (\mathsf {left} _{256}(\mathsf {Nd} (i_0,i_1/.../i_{d^{\prime }})))\) is not in \(\mathbb {Z} _{|\mathbb {G} |}^+\) , then \(\mathfrak {A}_2\) returns \(\bot\) to \(\mathfrak {A}_1\) . Otherwise, \(\mathfrak {A}_2\) computes \(sk_{i_1/.../i_{d^{\prime }}}^{(i_0)} \leftarrow \mathsf {int} (\mathsf {left} _{256}(\mathsf {Nd} (i_0,i_1/.../i_{d^{\prime }})))\) and \(pk_{i_1/.../i_{d^{\prime }}}^{(i_0)} \leftarrow sk_{i_1/.../i_{d^{\prime }}}^{(i_0)} \cdot G\) and returns \(pk_{i_1/.../i_{d^{\prime }}}^{(i_0)}\) to \(\mathfrak {A}_1\) .
•
Upon \(\mathfrak {A}_1\) querying \(\mathbf {KH}\) , \(\mathfrak {A}_2\) simply relays the query and response.
When \(\mathfrak {A}_2\) is interacting with the real world \((\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}},\mathsf {muEv}_\mathbf {K} ^{\mathsf {L}},\mathbf {KH})\) , \(\mathfrak {A}_1\) is playing with the game \(\mathsf {G} _2\) : the actions are exactly the same, despite the gap between the \(\mathsf {GGGM}\) instance and the \(\mathsf {Bip32}\) key tree.
However, when \(\mathfrak {A}_2\) is interacting with the ideal \((\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {KH})\) , a public key \(pk_{i_1/.../i_{d^{\prime }}}^{(i_0)}\) returned by \(\mathfrak {A}_2\) due to \(\mathfrak {A}_1\) querying \({\mathsf {PKReq}} (i_0,v_{i_1/.../i_{d^{\prime }}}^{(i_0)})\) query is computed via \(pk_{i_1/.../i_{d^{\prime }}}^{(i_0)} \leftarrow \mathsf {int} (r_{i_1/.../i_{d^{\prime }}}^{(i_0)}) \cdot G\) , where \(r_{i_1/.../i_{d^{\prime }}}^{(i_0)} \xleftarrow {\$}\lbrace 0,1\rbrace ^{256}\) is a block of simulated leakage (it corresponds to \(\mathsf {left} _{256}(\mathsf {Nd} (i_0,i_1/.../i_{d^{\prime }}))\) in the real world). This resembles the game \(\mathsf {G} _2^*\) , except that \(\mathfrak {A}_2\) may respond \(\mathfrak {A}_1\) with \(\bot\) . Denote this event by “ \(\mathfrak {A}_2 ^{\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {KH}} \text{ returns } \bot\) ”. Then, as long as this event does not occur, the computed key \(pk_{i_1/.../i_{d^{\prime }}}^{(i_0)}\) is uniformly distributed in \(\mathbb {G}\) . Moreover, the key computed due to any other query \({\mathsf {PKReq}} (i_0^{\prime },v_{i_1^{\prime }/.../i_{d^{\prime \prime }}^{\prime }}^{(i_0^{\prime })})\) has \(pk_{i_1^{\prime }/.../i_{d^{\prime \prime }}^{\prime }}^{(i_0^{\prime })} \leftarrow \mathsf {int} (r_{i_1^{\prime }/.../i_{d^{\prime \prime }}^{\prime }}^{(i_0^{\prime })}) \cdot G\) and \(r_{i_1^{\prime }/.../i_{d^{\prime \prime }}^{\prime }}^{(i_0^{\prime })}\) is independent from \(r_{i_1/.../i_{d^{\prime }}}^{(i_0)}\) . Therefore, as long as the event “ \(\mathfrak {A}_2 ^{\mathsf {muCo}_\mathbf {K} ^{\mathsf {S}},\mathsf {R} ^{\mathsf {S}},\mathbf {KH}} \text{ returns } \bot\) ” does not occur, \(\mathfrak {A}_2\) perfectly emulates the game \(\mathsf {G} _2^*\) in front of \(\mathfrak {A}_1\) —that is,
Concrete Bounds. It remains to calculate the concrete bounds. Regardless of the adversarial strategy, it can be seen the effective data complexity cannot exceed \(V(\mathbf {G}) \le D\) . For the quantity C, using the uniformness of the private/public keys (in the ideal world) and a multi-collision argument (we defer the details to the next paragraph), when \(C = 256 = 2^8\) and \(D \le |\mathbb {G} |/2\) (so that \(2D/ |\mathbb {G} | \le 1\) ), it can be shown that \({\Pr } [ \mu (\mathcal {I}) \ge C ] \le D/2|\mathbb {G} |\) . Then, using Theorem 4.1, we obtain
Gathering this with the gaps between \(\mathsf {G} _1\) , \(\mathsf {G} _2\) , \(\mathsf {G} _1^*,\) and \(\mathsf {G} _2^*\) (which is \(2 \times (u ({T} + D) / 2^s + u ^2/2^{s+1})\) ) yields Equation (27).
Proof of \({\Pr } [ \mu (\mathcal {I}) \ge C ] \le D/2|\mathbb {G} |\) . For the quantity \(\mu (\mathcal {L})\) , we will rely on the uniformness of the private/public keys. In detail, consider any \((i_0,p,j)\ne (i_0^{\prime },p^{\prime },j^{\prime })\) . Then,
•
Case 1: \(0 \le j \lt 2^{31}\) , whereas \(2^{31} \le j^{\prime } \lt 2^{32}\) . Then it is impossible to have \(\mathsf {lf} _{p,j} (\mathsf {left} _{256}(\mathsf {Nd} (i_0,p)) , {\mathsf {pp}} _{i_0}) = \mathsf {lf} _{p^{\prime },j^{\prime }} (\mathsf {left} _{256}(\mathsf {Nd} (i_0^{\prime },p^{\prime })) , {\mathsf {pp}} _{i_0^{\prime }})\) , since the former has leftmost byte \([0]_8\) while the latter has \([2]_8\) or \([3]_8\) .
Case 3: \(0 \le j,j^{\prime } \lt 2^{31}\) . Then \(\mathsf {lf} _{p,j} (\mathsf {left} _{256}(\mathsf {Nd} (i_0,p)) , {\mathsf {pp}} _{i_0}) \ne \mathsf {lf} _{p^{\prime },j^{\prime }} (\mathsf {left} _{256}(\mathsf {Nd} (i_0^{\prime },p^{\prime })) , {\mathsf {pp}} _{i_0^{\prime }})\) holds with probability at most \({\Pr }[ sk,sk^{\prime }\xleftarrow {\$}\mathbb {Z} _{|\mathbb {G} |}: sk = sk^{\prime } ] = 1/|\mathbb {G} |\) .
•
Case 4: \(2^{31} \le j,j^{\prime } \lt 2^{32}\) . Then \(\mathsf {lf} _{p,j} (\mathsf {left} _{256}(\mathsf {Nd} (i_0,p)) , {\mathsf {pp}} _{i_0}) \ne \mathsf {lf} _{p^{\prime },j^{\prime }} (\mathsf {left} _{256}(\mathsf {Nd} (i_0^{\prime },p^{\prime })) , {\mathsf {pp}} _{i_0^{\prime }})\) holds with probability at most \({\Pr }[ pk,pk^{\prime } \xleftarrow {\$}\mathbb {G}: \mathsf {ser} _P(pk) = \mathsf {ser} _P(pk^{\prime }) ]\) . The map \(\mathsf {ser} _P : \mathbb {G} \mapsto \lbrace 0,1\rbrace ^{264}\) is bijective, and thus the probability is \(1/|\mathbb {G} |\) .
By the preceding, in any case, the probability to have \(\mathsf {lf} _{p,j} (\mathsf {left} _{256}(\mathsf {Nd} (i_0,p)) , {\mathsf {pp}} _{i_0}) = \mathsf {lf} _{p^{\prime },j^{\prime }} (\mathsf {left} _{256}(\mathsf {Nd} (i_0^{\prime },p^{\prime })) , {\mathsf {pp}} _{i_0^{\prime }})\) does not exceed \(1/|\mathbb {G} |\) . Thus, for any integer \(C \ge 2\) ,
For \(C = 256\) , using \(|\mathbb {G} | \lt 2^{256}\) in our context and as long as \(D \le |\mathbb {G} |/2\) (so that \(2D/ |\mathbb {G} | \le 1\) ), it further holds
Let \(\mathsf {G} _1 = \mathsf {Game} _{ \mathsf {Wal} ^{\mathbf {KH}}, \mathfrak {A}_1}^{ \mathsf {muHEUF}} (\mathbf {G})\) be the real hierarchical unforgeability game. We modify \(\mathsf {G} _1\) by replacing the oracles \(\mathsf {PKReq}\) and \(\mathsf {muWSign}\) with the oracles \(\mathsf {PKReq}\) and \(\mathsf {muWSign}\) with \(b=0\) in Figure 8. Denote by \(\mathsf {G} _2\) the obtained modified game. It is easy to see that the gap between \(\mathsf {G} _1\) and \(\mathsf {G} _2\) is the already established unlinkability bound—that is,
Signing keys generated in the game \(\mathsf {G} _2\) are independent and uniformly distributed. Thus, the forgery probability \({\Pr }[\mathsf {G} _2 = 1]\) is bounded by the mu existential unforgeability security of the signature in use (see Definition 2.2). Informally, consider an adversary \(\mathfrak {A}_2\) having access to \(q_S\) signing oracles of the signature instantiated with \(q_S\) independent secret keys, and it makes \(q_S\) signing queries and runs in time \(O(t_{\mathfrak {A}_1})\) and succeeds as long as it forges for any of the \(q_S\) keys. If the signature is \((q_S, q_S, O(t + D), \varepsilon _\mathsf {muUFCMA})\) - \(\mathrm{mu}\) unforgeable, then the success probability of \(\mathfrak {A}_2\) is bounded by \(\varepsilon _\mathsf {muUFCMA}\) . These establish the bound in Equation (28).
6.6 Improving \(\mathbf {Prim}\) for \(\mathsf {Bip32}\) , and Performance of MPC Implementations
Since the security of \(\mathsf {Bip32}\) (variants) simply follow from our results on \(\mathsf {GGGM}\) , sound improvements addressing the question of Lindell [40] become clear. In detail, the initial seed S is of \(128\le s\le 512\) bits. The string “Bitcoin seed” is of 96 bits. However, as the security of the entire system cannot exceed 256 bits due to the limitation \(\kappa =256\) —and in fact, practical uses typically adopt \(s = 256\) —we focus on the case \(128\le s\le 256\) , and pad the seed S to \(S \Vert [0]_{296 - s}\) (i.e., of 296 bits). With these considerations, we describe our \(\mathsf {Bip32}\) variants using a general function \(\mathbf {Prim}: \lbrace 0,1\rbrace ^{296} \times \lbrace 0,1\rbrace ^{256} \rightarrow \lbrace 0,1\rbrace ^{256}\) :
(i)
The \(\mathsf {HMAC}\) -call in \(\mathsf {Setup} (\mathcal {G}, S)\) is replaced by \(I_{\bot } \leftarrow \mathbf {Prim} (S , \text{``Bitcoin seed''})\) .
(ii)
The \(\mathsf {HMAC}\) -calls in \({\mathsf {CKDpriv}} (\mathsf {wsk}, i)\) are replaced by \(I \leftarrow \mathbf {Prim} ([0]_8\Vert [sk]_{256}\Vert [i]_{32} , ch)\) and \(I \leftarrow \mathbf {Prim} (\mathsf {ser} _P(pk)\Vert [i]_{32} , ch)\) correspondingly.
(iii)
The \(\mathsf {HMAC}\) -call in \({\mathsf {CKDpub}} (\mathsf {wpk}, i)\) is replaced by \(I \leftarrow \mathbf {Prim} (\mathsf {ser} _P(pk)\Vert [i]_{32} , ch)\) .
We then propose two instantiations of \(\mathbf {Prim}\) with less AND gates as follows:
•
SHACAL instantiation \(\mathsf {Bip32} ^\mathsf {SHACAL3}\) : Define the function \(\mathbf {Prim} (x, y):=\mathsf {SHACAL3} (x, y \Vert [0]_{256}) \oplus (y \Vert [0]_{256})\) —that is, using a single call to \(\mathsf {SHACAL3}: \lbrace 0,1\rbrace ^{1024} \times \lbrace 0,1\rbrace ^{512} \mapsto \lbrace 0,1\rbrace ^{512}\) , the block cipher underlying \(\mathsf {SHA512}\) . The reliability is essentially the same as \(\mathsf {Bip32} ^{\mathsf {HMAC}}\) , since the two wallets rely on the same assumption (i.e., the security of \(\mathsf {SHACAL3}\) ).
•
Fast instantiation \(\mathsf {Bip32} ^{{\mathsf {kp800}}}\) : Define \(\mathbf {Prim} (x, y):=\mathsf {Trunc} _{288}({{\rm K}{\rm\small{ECCAK-}}p} [800,11](x \Vert y \Vert\) \([0]_{248}))\) —that is, using a call to the permutation \({{\rm K}{\rm\small{ECCAK-}}p} [800,11]\) , which is a member of the \({\rm K}{\rm\small{ECCAK-}}p\) permutation family [9] with number of rounds halved (this follows the \(\mathsf {SHA3}\) designers, and its still has security margin of six rounds [9]). To shorten notations, we abbreviate \({{\rm K}{\rm\small{ECCAK-}}p} [800,11]\) as \(\mathsf {kp800}\) .
The security analysis of \(\mathsf {Bip32} ^{{\mathsf {kp800}}}\) just follows \(\mathsf {Bip32} ^\mathbf {KH}\) in Section 6.5, since truncating \({{\rm K}{\rm\small{ECCAK-}}p} [800,11]\) also yields an FIL RO with 248-bit security [20, Theorem 1]. By these, \(\mathsf {Bip32} ^{{\mathsf {kp800}}}\) achieves \(\min \lbrace 247 , s - \log _2 u \rbrace\) bits unlinkability and \(\min \lbrace 247 , s - \log _2 u, f(q_S) \rbrace\) unforgeability (as long as we model the permutation \(\mathsf {kp800}\) as a public random 800-bit permutation). However, analysis of \(\mathsf {Bip32} ^{\mathsf {SHACAL3}}\) follows \(\mathsf {Bip32} ^\mathbf {KH}\) , except that the terms in Equation (29) are replaced with terms from Theorem 4.2. According to Theorems 4.1 and 4.2, the concrete bounds differ by only a factor of 2. Thus, \(\mathsf {Bip32} ^{\mathsf {SHACAL3}}\) achieves \(\min \lbrace 246 , s - \log _2 u \rbrace\) bits unlinkability and \(\min \lbrace 246 , s - \log _2 u, f(q_S) \rbrace\) unforgeability. Concrete \(\mathrm{mu}\) security of the two improved instantiations are thus comparable with the original \(\mathsf {Bip32}\) standard.
We benchmark the two-party protocols based on garbled circuits that securely compute various instantiations of \(\mathsf {Bip32}\) . Our implementations focus on the (most widely deployed) default configuration of the key tree [44] (see Figure 1). In particular, we consider the process of deriving the shares of a session key \(sk_{i_1/i_2/i_3}\) from the shares of the seed S. As discussed and as shown in Figure 1, this consists of four \(\mathbf {Prim}\) executions (in the MPC manner). We use EMP-Toolkit [51] as the backend of our implementations and choose the \(\text{state-of-the-art}\) garbling schemes with semi-honest security. Our experiments are performed in a virtual machine with an Intel Core i5-1038NG7 CPU at 2.0 GHZ with localhost communication, and the performance is reported in Table 1. By the results, \(\mathsf {Bip32} ^{\mathsf {SHACAL3}}\) achieves much better performance while retaining the same reliability as \(\mathsf {Bip32} ^{\mathsf {HMAC}}\) , whereas \(\mathsf {Bip32} ^{{\mathsf {kp800}}}\) achieves the best performance with a moderate security margin.
7 Improving FSS
The State of the Art. The FSS of point functions [30] crucially relies on GGM trees functioning as PPRFs. The closest provably secure construction [33] instantiates the classical GGM with the length-doubling PRG \(G ^{\mathsf {AES} _{fk}}(s) := \mathsf {AES} _{fk}(s)\oplus s\Vert \mathsf {AES} _{fk}(s\oplus [1]_{128})\oplus s\oplus [1]_{128}\) , where \(\mathsf {AES} _{fk}\) is the \(\mathsf {AES}\) using a fixed, publicly known key fk (as discussed in Section 3.1). To characterize its concrete \(\mathrm{mu}\) security, we model \(\mathsf {AES}\) as an ideal cipher \(\mathbf {E}:\lbrace 0,1\rbrace ^{wn}\times \lbrace 0,1\rbrace ^{wn} \mapsto \lbrace 0,1\rbrace ^{wn}\) . Then, this \(\text{state-of-the-art}\) \(\mathsf {FBTr} ^{\mathsf {DM} ^\mathsf {AES}}\) (i.e., FSS’s Binary Tree) is an instance of \(\mathsf {GGGM} ^{\mathsf {DM} ^\mathbf {E}}\) given in Section 4.3, with \(\mathbf {Prim} (x,y):=\mathsf {AES} _{x}(y) \oplus y\) and parameters as follows:
•
Node size equals the security parameter \(n = \kappa = 128\) . Note that in our model, this means there is no “leakage” at all, and we are essentially in the classical PPRF setting.
•
\(\theta =2\) , and \(w=1\) (i.e., branch number \(w\theta =2\) , and output size \(wn = n = 128\) ).
•
\(\mathsf {sf} _{p,j} (\mathsf {right} _{\kappa }(z)) = \mathsf {sf} _{p,j} (z) = z \oplus [j]_{128}\) (which is indeed injective).
•
\({\mathsf {pp}} = fk,\) which is a fixed constant, and \(\mathsf {lf} _{p,j} (\bot , {\mathsf {pp}}) = fk\) (i.e., labels do not depend on \(p,j\) at all). The restriction \(j\ne j^{\prime }\Rightarrow (\mathsf {lf} _{p,j} (\bot , {\mathsf {pp}}) , \mathsf {sf} _{p,j} (z)) \ne (\mathsf {lf} _{p,j^{\prime }} (\bot , {\mathsf {pp}}) , \mathsf {sf} _{p,j^{\prime }} (z))\) holds since \(\mathsf {sf} _{p,j} (z) = z \oplus [j]_{128} \ne z \oplus [j^{\prime }]_{128} = \mathsf {sf} _{p,j^{\prime }} (z)\) .
•
For any \(z , I \in \lbrace 0,1\rbrace ^{128}\) , \(\mathsf {of} (z,I) = I\) . This satisfies restriction (ii) (i.e., \(\mathsf {of} (z,I) = \mathsf {of} (\mathsf {left} _{128-128}(z),I) = I\) ).
•
Depth \(d={\log }_{2}N_{\text{leaf}}\) , where \(N_{\text{leaf}}\) is the desired number of leaves.
FSS uses an \(\mathsf {FBTr} ^{\mathsf {DM} ^\mathsf {AES}}\) instance as a PPRF: see Definition 2.5. In detail, assume that the MPC system executes u FSS instances using independent keys \(K_1,\ldots ,K_{u}\) . For \(i_0 = 1,\ldots ,u\) , the \(i_0\) -th FSS instance generates a punctuated key \(K_{i_0}\lbrace p_{i_0}\rbrace\) for a single punctured point \(p_{i_0} \in \lbrace 0,1\rbrace ^{d}\) —that is, an entity holding the punctured key \(K_{i_0}\lbrace p_{i_0}\rbrace\) is able to evaluate exactly \(|\mathcal {X} | - 1\) functions values, except for \(\mathsf {FBTr} ^{\mathsf {DM} ^\mathsf {AES}}.\mathsf {Ev} (K_{i_0} , p_{i_0})\) . The \(i_0\) -th punctured key \(K_{i_0}\lbrace p_{i_0} \rbrace\) can be written in 128d bits. The effective data complexity is \(2u d\) , since (it is easy to count) the number of \(\mathsf {AES}\) calls in each tree is exactly 2d.
It remains to determine the quantity C. Unfortunately, the label \(\mathsf {lf} _{p,j} (\bot , {\mathsf {pp}}) = fk\) is a constant, and we can only expect \(C = 2u d\) and \(\varepsilon _\mu = {\Pr } [ \mu (\mathcal {L}) \gt C ] = 0\) . Injecting all the preceding parameters into Theorem 4.2, we conclude that \(\mathsf {FBTr} ^{\mathsf {DM} ^\mathsf {AES}}\) is a \((u, {T}, D, \varepsilon)\) -PPRF with effective data complexity \(D = 2u d\) and
\begin{align} \varepsilon \le \frac{ 8 u d {T} + 16(u d)^2 }{ 2^{128} } . \end{align}
(30)
As a concrete example, consider the 2PC discussed in Section 1: assuming \(N_{\text{2pc}} = 2^{14}\) 2PC protocol instances and each protocol instantiating \(N_{\text{tr}} = 2^{26}\) FSS or \(\mathsf {FBTr} ^{\mathsf {DM} ^\mathsf {AES}}\) tree instances with depth \(d \le 16\) . Then, \(u = N_{\text{2pc}} \times N_{\text{tr}} = 2^{40}\) and \(8u d = 2^{47}\) , indicating security up to \({T} \approx 2^{128} / 2^{47} = 2^{81}\) \(\mathsf {AES}\) “queries” or computations (i.e., a theoretical degradation up to 36.7%). Such computations are hardly infeasible.
Improving \(\mathrm{mu}\) Security and Flexibility. We first address the \(\mathrm{mu}\) security degradation, which mainly requires to overcome the factor \(u = N_{\text{2pc}} \cdot N_{\text{tr}}\) due to the numerous instances. Following Section 6.6, we define the public parameter \({\mathsf {pp}}:= \mathsf {IV}\) for \(\mathsf {IV} \xleftarrow {\$}\lbrace 0,1\rbrace ^{128}\) that is picked at uniform during the setup of every FSS instance, and propose to use \(\mathsf {AES} _{\mathsf {IV}}\) instead of \(\mathsf {AES} _{fk}\) . Then, labels \(\mathsf {lf} _{\star ,\star } (\bot , {\mathsf {pp}} _{i_0}) =\mathsf {IV} _{i_0}\) and \(\mathsf {lf} _{\star ,\star } (\bot , {\mathsf {pp}} _{i_0^{\prime }}) = \mathsf {IV} _{i_0^{\prime }}\) in distinct trees collide only if \(\mathsf {IV} _{i_0}=\mathsf {IV} _{i_0^{\prime }}\) . Thus, for any threshold \(t \ge 2\) , if there is no t-collision \(\mathsf {IV} _{i_0^{(1)}}=\cdots =\mathsf {IV} _{i_0^{(t)}}\) among the u trees, then the number of tree instances with their \(\mathsf {IV} \text{s}\) equaling a certain value is at most \(t-1\) . As all \(\mathsf {IV} \text{s}\) are uniform and independent, the probability to have a t-collision is \({u \choose t} / 2^{ 128(t- 1) } \le \frac{ u ^t}{ t! \cdot 2^{ 128(t- 1) } }\) .
Then, observing that increasing branches trades punctured key size for computations and improves flexibility, we propose to “naturally” increase the “parallelization degree” of \(\mathsf {FBTr} ^{\mathsf {DM} ^\mathsf {AES}}\) to \(\theta \ge 3\) —that is, using large-expansion PRG \(G (s)=\mathsf {AES} _{\mathsf {IV}}(s)\oplus s \Vert \mathsf {AES} _{\mathsf {IV}}(s\oplus [1]_{128})\oplus s\oplus [1]_{128} \Vert \cdots \Vert \mathsf {AES} _{\mathsf {IV}}(s\oplus [\theta -1]_{128})\oplus s\oplus [\theta -1]_{128}\) . We denote this by \(\mathsf {FMTr} ^{\mathsf {DM} ^\mathsf {AES}}\) , meaning FSS’s Multi-branch Tree:
•
The depth decreases to \(d={\log }_{\theta }N_{\text{leaf}}\) .
•
The punctured key for a single tree has \(128 (\theta -1) {\log }_{\theta }N_{\text{leaf}} + 128\) bits (including the 128-bit \({\mathsf {pp}} = \mathsf {IV}\) ).
•
The effective data complexity \(D = u \theta {\log }_{\theta }N_{\text{leaf}}\) .
By the preceding, for \(C = (t-1)\theta {\log }_{\theta }N_{\text{leaf}}\) , \({\Pr } [ \mu (\mathcal {L}) \gt C ] \le \frac{ u ^t}{ t! \cdot 2^{ 128(t-1) } }\) , meaning that \(\mathsf {FMTr} ^{\mathsf {DM} ^\mathsf {AES}}\) is a \((u, {T}, D, \varepsilon)\) -PPRF, with
Equation (31) holds for any threshold t. Since the parameters \(u, T, N_{\text{leaf}}\) are incomparable, it is difficult to conclude on optimizing t. But certain choices already yield satisfactory bounds. For example, with \(t = 5\) , Equation (31) becomes
indicating security up to \(T \approx 2^{112}\) computations and \(u \approx 2^{103}\) users.
More concretely, when \(\theta =2\) , Equation (32) indicates security up to \(\approx 2^{128} / 2^{9} = 2^{119}\) computations (which is nearly optimal for \(\kappa = 128\) ) and running the FSS protocol \(u \le 2^{103}\) times. The additional computation compared to the state-of-the-art FSS protocol is the mere generation of a 128-bit (pseudo)random \(\mathsf {IV}\) , which is negligible. The punctured key is \(128 \cdot {\log }_{2}N_{\text{leaf}} + 128\) bits. Setting \(\theta\) to 4, Equation (32) indicates the same security, whereas the computation cost for each input is reduced by 50% due to the halved depth at the expense of a 50% blow-up in the punctured key size. We list the parameters in Table 2 for clarity.
\(\mathsf {FMTr} ^{\mathsf {DM} ^\mathsf {AES}}\) with \(\theta =2\)
\(N_{\text{leaf}}\)
3.5
\(3.5N_{\text{leaf}}\)
\(16\log _2 N_{\text{leaf}}\)
119
\(\mathsf {FMTr} ^{\mathsf {DM} ^\mathsf {AES}}\) with \(\theta =4\)
\(N_{\text{leaf}}/3\)
7
\(2.3N_{\text{leaf}}\)
\(24\log _2 N_{\text{leaf}}\)
119
Table 2. Comparison with Prior Works
The execution time is benchmarked on an AWS machine of type m5.large. \(N_{\text{leaf}}\) represents the number of leaves in the generated FSS trees. For clearness, the \(\mathrm{mu}\) security column demonstrates numerical results for the specific case \(N_{\text{leaf}} =2^{16}\) and \(u = N_{\text{2pc}} \times N_{\text{tr}} = 2^{40}\) trees.
In Table 2, we compare the performance of our protocol against the state of the art. \(\mathsf {FMTr} ^{\mathsf {DM} ^\mathsf {AES}}\) with \(\theta =2\) has the same overhead as \(\mathsf {FBTr} ^{\mathsf {DM} ^\mathsf {AES}}\) , whereas \(\mathsf {FMTr} ^{\mathsf {DM} ^\mathsf {AES}}\) with \(\theta =4\) incurs a \(50\%\) increase in seed size (and communication) but 1.5 times computation. In major applications such as MPC based on preprocessed correlation [14], the communication overhead due to the GGM punctuated key is less than 10%. Thus, using \(\mathsf {FMTr} ^{\mathsf {DM} ^\mathsf {AES}}\) with \(\theta =4\) accelerates computations much with only insignificant communication overheads.
Acknowledgments
We thank the anonymous reviewers for their insightful suggestions.
Footnotes
1
This is tight: since each key guess falls in the \(2^{40}\) keys with probability \(2^{40}/2^{128}\) , with \(2^{88}\) computations or key guesses we can succeed to “hit” one of the \(2^{40}\) keys with probability \(\approx 1\) .
2
However, we believe that assuming \(\mathbf {Prim}\) is a weak PRF, inferior leakage security bounds can be proven. This is an interesting open question.
3
This is equivalent to the alternative definitions allowing adaptively adding new instances [5, 7].
4
This work focuses on the setting where \(\mathsf {S}\) does not have access to the \(\mathbf {Prim}\) oracle, which suffices for producing random leakages.
5
Concurrently to us, Das et al. [21] also proposed a model for HDW.
6
\(\mathfrak {A}_2\) cannot simply query \(\mathsf {muCo}_\mathbf {K} ^{\mathsf {L}} (i_0 , i_1/.../i_{d^{\prime }})\) , and otherwise it cannot react to \(\mathfrak {A}_1\) querying \({\mathsf {PKReq}} (i_0,v_{i_1/.../i_{d^{\prime }}/.../i_{d}}^{(i_0)})\) later.
References
[1]
Nabil Alkeilani Alkadri, Poulami Das, Andreas Erwig, Sebastian Faust, Juliane Krämer, Siavash Riahi, and Patrick Struck. 2020. Deterministic wallets in a quantum world. In Proceedings of the ACM Conference on Computer and Communications Security (CCS’20). ACM, New York, NY, 1017–1031.
Myrto Arapinis, Andriana Gkaniatsou, Dimitris Karakostas, and Aggelos Kiayias. 2019. A formal treatment of hardware wallets. In Financial Cryptography and Data Security. Lecture Notes in Computer Science, Vol. 11598. Springer, 426–445.
Jean-Philippe Aumasson, Adrian Hamelink, and Omer Shlomovits. 2020. A Survey of ECDSA Threshold Signing. Report 2020/1390. Cryptology ePrint Archive. https://eprint.iacr.org/2020/1390.
Carsten Baum, Alex J. Malozemoff, Marc B. Rosen, and Peter Scholl. 2021. Mac’n’Cheese: Zero-knowledge proofs for boolean and arithmetic circuits with nested disjunctions. In Advances in Cryptology—CRYPTO 2021. Lecture Notes in Computer Science, Vol. 12828. Springer, 92–122.
Mihir Bellare, Daniel J. Bernstein, and Stefano Tessaro. 2016. Hash-function based PRFs: AMAC and its multi-user security. In Advances in Cryptology—EUROCRYPT 2016. Lecture Notes in Computer Science, Vol. 9665. Springer, 566–595.
Mihir Bellare, Alexandra Boldyreva, and Silvio Micali. 2000. Public-key encryption in a multi-user setting: Security proofs and improvements. In Advances in Cryptology—EUROCRYPT 2000. Lecture Notes in Computer Science, Vol. 1807. Springer, 259–274.
Mihir Bellare and Björn Tackmann. 2016. The multi-user security of authenticated encryption: AES-GCM in TLS 1.3. In Advances in Cryptology—CRYPTO 2016. Lecture Notes in Computer Science, Vol. 9814. Springer, 247–276.
Guido Bertoni, Joan Daemen, Michaël Peeters, Gilles Van Assche, and Ronny Van Keer. 2017. Team Keccak. Retrieved April 20, 2023 from https://keccak.team/third_party.html.
Dan Boneh, Kevin Lewi, and David J. Wu. 2017. Constraining pseudorandom functions privately. In Public-Key Cryptography—PKC 2017. Lecture Notes in Computer Science, Vol. 10175. Springer, 494–524.
Dan Boneh and Brent Waters. 2013. Constrained pseudorandom functions and their applications. In Advances in Cryptology—ASIACRYPT 2013. Lecture Notes in Computer Science, Vol. 8270. Springer, 280–300.
Elette Boyle, Geoffroy Couteau, Niv Gilboa, and Yuval Ishai. 2018. Compressing vector OLE. In Proceedings of the ACM Conference on Computer and Communications Security (CCS’18). ACM, New York, NY, 896–912.
Elette Boyle, Geoffroy Couteau, Niv Gilboa, Yuval Ishai, Lisa Kohl, Peter Rindal, and Peter Scholl. 2019. Efficient two-round OT extension and silent non-interactive secure computation. In Proceedings of the ACM Conference on Computer and Communications Security (CCS’19). ACM, New York, NY, 291–308.
Elette Boyle, Geoffroy Couteau, Niv Gilboa, Yuval Ishai, Lisa Kohl, and Peter Scholl. 2019. Efficient pseudorandom correlation generators: Silent OT extension and more. In Advances in Cryptology—CRYPTO 2019. Lecture Notes in Computer Science, Vol. 11694. Springer, 489–518.
Elette Boyle, Niv Gilboa, and Yuval Ishai. 2015. Function secret sharing. In Advances in Cryptology—EUROCRYPT 2015. Lecture Notes in Computer Science, Vol. 9057. Springer, 337–367.
Elette Boyle, Niv Gilboa, and Yuval Ishai. 2016. Function secret sharing: Improvements and extensions. In Proceedings of the ACM Conference on Computer and Communications Security (CCS’16). ACM, New York, NY, 1292–1303.
Shan Chen and John P. Steinberger. 2014. Tight security bounds for key-alternating ciphers. In Advances in Cryptology—EUROCRYPT 2014. Lecture Notes in Computer Science, Vol. 8441. Springer, 327–350.
Wonseok Choi, ByeongHak Lee, and Jooyoung Lee. 2019. Indifferentiability of truncated random permutations. In Advances in Cryptology—ASIACRYPT 2019. Lecture Notes in Computer Science, Vol. 11921. Springer, 175–195.
Poulami Das, Andreas Erwig, Sebastian Faust, Julian Loss, and Siavash Riahi. 2021. The exact security of BIP32 wallets. In Proceedings of the ACM Conference on Computer and Communications Security (CCS’21). ACM, New York, NY.
Poulami Das, Sebastian Faust, and Julian Loss. 2019. A formal treatment of deterministic wallets. In Proceedings of the ACM Conference on Computer and Communications Security (CCS’19). ACM, New York, NY, 651–668.
Yvo Desmedt. 1988. Society and group oriented cryptography: A new concept. In Advances in Cryptology—CRYPTO’87. Lecture Notes in Computer Science, Vol. 293. Springer, 120–127.
Samuel Dittmer, Yuval Ishai, and Rafail Ostrovsky. 2021. Line-point zero knowledge and its applications. In Proceedings of the 2nd Conference on Information-Theoretic Cryptography (ITC’21).
Yevgeniy Dodis, Thomas Ristenpart, John P. Steinberger, and Stefano Tessaro. 2012. To hash or not to hash again? (In)Differentiability results for \(H^2\) and HMAC. In Advances in Cryptology—CRYPTO 2012. Lecture Notes in Computer Science, Vol. 7417. Springer, 348–366.
Jack Doerner, David Evans, and Abhi Shelat. 2016. Secure stable matching at scale. In Proceedings of the ACM Conference on Computer and Communications Security (CCS’16). ACM, New York, NY, 1602–1613.
Jack Doerner and Abhi Shelat. 2017. Scaling ORAM for secure computation. In Proceedings of the ACM Conference on Computer and Communications Security (CCS’17). ACM, New York, NY, 523–535.
Georg Fuchsbauer, Momchil Konstantinov, Krzysztof Pietrzak, and Vanishree Rao. 2014. Adaptive security of constrained PRFs. In Advances in Cryptology—ASIACRYPT 2014. Lecture Notes in Computer Science, Vol. 8874. Springer, 82–101.
Niv Gilboa and Yuval Ishai. 2014. Distributed point functions and their applications. In Advances in Cryptology—EUROCRYPT 2014. Lecture Notes in Computer Science, Vol. 8441. Springer, 640–658.
Chun Guo, Jonathan Katz, Xiao Wang, Chenkai Weng, and Yu Yu. 2020. Better concrete security for half-gates garbling (in the multi-instance setting). In Advances in Cryptology—CRYPTO 2020. Lecture Notes in Computer Science, Vol. 12171. Springer, 793–822.
Chun Guo, Jonathan Katz, Xiao Wang, and Yu Yu. 2020. Efficient and secure multiparty computation from fixed-key block ciphers. In Proceedings of the 2020 IEEE Symposium on Security and Privacy. IEEE, Los Alamitos, CA, 825–841.
Dennis Hofheinz, Akshay Kamath, Venkata Koppula, and Brent Waters. 2019. Adaptively secure constrained pseudorandom functions. In Financial Cryptology and Data Security. Lecture Notes in Computer Science, Vol. 11598. Springer, 357–376.
Susan Hohenberger, Venkata Koppula, and Brent Waters. 2015. Adaptively secure puncturable pseudorandom functions in the standard model. In Advances in Cryptology—ASIACRYPT 2015. Lecture Notes in Computer Science, Vol. 9452. Springer, 79–102.
Aggelos Kiayias, Stavros Papadopoulos, Nikos Triandopoulos, and Thomas Zacharias. 2013. Delegatable pseudorandom functions and applications. In Proceedings of the ACM Conference on Computer and Communications Security (CCS’13). ACM, New York, NY, 669–684.
Eike Kiltz, Daniel Masny, and Jiaxin Pan. 2016. Optimal security proofs for signatures from identification schemes. In Advances in Cryptology—CRYPTO 2016. Lecture Notes in Computer Science, Vol. 9815. Springer, 33–61.
Jake Longo, Daniel P. Martin, Elisabeth Oswald, Daniel Page, Martijn Stam, and Michael Tunstall. 2014. Simulatable leakage: Analysis, pitfalls, and new constructions. In Advances in Cryptology—ASIACRYPT 2014. Lecture Notes in Computer Science, Vol. 8873. Springer, 223–242.
Adriano Di Luzio, Danilo Francati, and Giuseppe Ateniese. 2020. Arcula: A secure hierarchical deterministic wallet for multi-asset blockchains. In Cryptology and Network Security. Lecture Notes in Computer Science, Vol. 12579. Springer, 323–343.
Antonio Marcedone, Rafael Pass, and Abhi Shelat. 2019. Minimizing trust in hardware wallets with two factor signatures. In Financial Cryptography and Data Security. Lecture Notes in Computer Science, Vol. 11598. Springer, 407–425.
Jacques Patarin. 2009. The “Coefficients H” technique. In Selected Areas in Cryptography. Lecture Notes in Computer Science, Vol. 5381. Springer, 328–345.
Phillipp Schoppmann, Adrià Gascón, Leonie Reichert, and Mariana Raykova. 2019. Distributed vector-OLE: Improved constructions and implementation. In Proceedings of the ACM Conference on Computer and Communications Security (CCS’19). ACM, New York, NY, 1055–1072.
Thomas Shrimpton and R. Seth Terashima. 2016. Salvaging weak security bounds for blockcipher-based constructions. In Advances in Cryptology—ASIACRYPT 2016. Lecture Notes in Computer Science, Vol. 10031. Springer, 429–454.
Mathieu Turuani, Thomas Voegtlin, and Michaël Rusinowitch. 2016. Automated verification of Electrum wallet. In Financial Cryptography and Data Security. Lecture Notes in Computer Science, Vol. 9604. Springer, 27–42.
Xiao Wang, Alex J. Malozemoff, and Jonathan Katz. 2016. EMP-Toolkit: Efficient MultiParty Computation Toolkit. Retrieved April 20, 2023 from https://github.com/emp-toolkit.
Kang Yang, Chenkai Weng, Xiao Lan, Jiang Zhang, and Xiao Wang. 2020. Ferret: Fast extension for correlated OT with small communication. In Proceedings of the ACM Conference on Computer and Communications Security (CCS’20). ACM, New York, NY, 1607–1626.
Convertible authenticated encryption (CAE) schemes allow a signer to produce an authenticated ciphertext such that only a designated recipient can decrypt it and verify the recovered signature. The conversion property further enables the designated ...
In this paper, we first show a DDH Lemma, which states that a multi-variable version of the decisional Diffie---Hellman problem is hard under the standard DDH assumption, where the group size is not necessarily known. Our proof, based on a self-...
In this paper we propose a very efficient and provably secure proxy signature scheme with implicit certificate (called ''certificateless proxy signature scheme''), where a receiver does not have to verify a certificate before verifying a signed message, ...
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].