Unifying Kleptographic Attacks

Abstract

We present two simple backdoors that can be implemented into Maurer’s unified zero-knowledge protocol [22]. Thus, we show that a high level abstraction can replace individual backdoors embedded into protocols for proving knowledge of a discrete logarithm (e.g. the Schnorr and Girault protocols), protocols for proving knowledge of an $e^{th}$-root (e.g. the Fiat-Shamir and Guillou-Quisquater protocols), protocols for proving knowledge of a discrete logarithm representation (e.g. the Okamoto protocol) and protocols for proving knowledge of an $e^{th}$-root representation.

A Additional Preliminaries

Definition 6

(Computational Diffie-Hellman -cdh). Let $\mathbb D$ be a cyclic group of order q, d a generator of $\mathbb D$ and let A be a probabilistic polynomial-time algorithm (PPT algorithm) that returns an element from $\mathbb D$. We define the advantage

If ${ADV}_{\mathbb D, d}^{\textsc {cdh}}(A)$ is negligible for any PPT algorithm A, we say that the Computational Diffie-Hellman problem is hard in $\mathbb D$.

Definition 7

(Decisional Diffie-Hellman -ddh). Let $\mathbb D$ be a cyclic group of order q, g a generator of $\mathbb D$. Let A be a PPT algorithm which returns 1 on input $(d^x, d^y, d^z)$ if $d^{xy} = d^z$. We define the advantage

If ${ADV}_{\mathbb D, d}^{\textsc {ddh}}(A)$ is negligible for any PPT algorithm A, we say that the Decisional Diffie-Hellman problem is hard in $\mathbb D$.

Definition 8

(Entropy Smoothing -es). Let $\mathbb D$ be a cyclic group of order q, $\mathcal {K}$ the key space and $\mathcal {H} = \{h_i\}_{i\in \mathcal {K}}$ a family of keyed hash functions, where each $h_i$ maps $\mathbb D$ to $\mathbb E$, where $\mathbb E$ is a group. Let A be a PPT algorithm which returns 1 on input (i, y) if $y = h_i(z)$, where z is chosen at random from $\mathbb D$. Also, let We define the advantage

If ${ADV}_{\mathcal {H}}^{\textsc {es}}(A)$ is negligible for any PPT algorithm A, we say that $\mathcal {H}$ is Entropy Smoothing.

Remark 7

In [13], the authors prove that the CBC-MAC, HMAC and Merkle-Damgård constructions satisfy the above definition, as long as the underlying primitives satisfy some security properties.