ParaDiSE: Efficient Threshold Authenticated Encryption in Fully Malicious Model

Abstract

Threshold cryptographic algorithms achieve robustness against key and access compromise by distributing secret keys among multiple entities. Most prior work focuses on threshold public-key primitives, despite extensive use of authenticated encryption in practice. Though the latter can be deployed in a threshold manner using multi-party computation (MPC), doing so incurs a high communication cost. In contrast, dedicated constructions of threshold authenticated encryption algorithms can achieve high performance. However to date, few such algorithms are known, most notably DiSE (distributed symmetric encryption) by Agrawal et al. (ACM CCS 2018). To achieve threshold authenticated encryption (TAE), prior work does not suffice, due to shortcomings in definitions, analysis, and design, allowing for potentially insecure schemes, an undesirable similarity between encryption and decryption, and insufficient understanding of the impact of parameters due to lack of concrete analysis. In response, we revisit the problem of designing secure and efficient TAE schemes. (1) We give new TAE security definitions in the fully malicious setting addressing the aforementioned concerns. (2) We construct efficient schemes satisfying our definitions and perform concrete and more modular security analyses. (3) We conduct an extensive performance evaluation of our constructions, against prior ones.

S. Agrawal, W. Dai and A. Luykx—Work done while at Visa Research.

Appendices

Appendix

A Performance Experiments

We implement our protocols $\textsf{TAE1}$ of Fig. 2 and $\textsf{TAE}3$ of Fig. ?? and report on their performance. All performance results are obtained on a single laptop with an Intel i7 9th Gen (9740H) CPU and 16GB of RAM. Network communication was routed over local host with a theoretical bandwidth of 10Gbps and a measured latency of 0.1 milliseconds. Each party is run on a single thread.

Table 1 contains the results of two experiments. 1) peak encryptions per second each scheme can perform. In particular, 32 byte messages are repeatedly encrypted in an asynchronous manner, where a single party repeatedly initiates 10 batches of 128 encryptions which are processed concurrently. 2) latency of one encryption by running multiple encryptions one at a time in a sequential manner. We report the average time required to perform a single encryption.

We compare with the less secure DiSE schemes [11]. In particular, DiSE was proven secure in an arguably weaker model and does not provide a way to distinguish if the initiating party is performing an decryption or encryption query. We consider the pure symmetric-key based DiSE protocol DiSE1 which utilizes an AES/PRF based DPRF. Like our $\textsf{TAE1}$ Protocol, DiSE1 does not guarantee that a ciphertext output by encryption is “well formed” if some of the parties behave maliciously. We also consider the DDH-key based DiSE protocol DiSE2 which utilizes ZK-proofs to ensure the correctness of any ciphertext output by the encryption procedure.

Our protocols are very competitive given the added security guarantees. Our symmetric-key based protocol $\textsf{TAE1}$ achieves a throughput of 778 thousand encryptions per second for $n=3,t=2$ while our public-key based protocol $\textsf{TAE}3$ achieves 346 encryptions per second. This is approximately 0.7 times the throughput of the weaker DiSE protocol. We observe a similar relative performance for other parameter choices when t is close to n or 2. The largest differences occurs for our $\textsf{TAE1}$ protocol when n is large and $t\approx n/2$. This results in the largest relative communication overhead compared to DiSE1 due to their protocol achieving O(t) communication while ours achieves $O{n\atopwithdelims ()t}$ which is maximized for $t=n/2$.

With respect to encryption latency our protocols perform similarly well. Both $\textsf{TAE1}$ and DiSE1 achieve a latency of 0.1 milliseconds for $n=3,t=2$ which is effectively the network latency of just sending the messages. For the public-key based protocol we again observe that the DiSE2 protocol achieves times 0.7 times improvement in latency compared to our $\textsf{TAE}3$ protocol. This added overhead consists of performing the additional threshold signature.

We argue that the presented performance evaluation shows that our protocols achieve highly practical performance. In particular, the majority of the practical applications of threshold authenticated encryption only require relatively small n, e.g. $n\in \{3,4,5\}$. For this range of parameters both of our protocols are highly competitive with the DiSE protocols while providing stronger security guarantees. Our schemes also preserve the property that the network communication overhead is independent of the length of the message being encryption. This property is not enjoyed by generic MPC based approaches, e.g. [37].