Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
A
Access structures for isogenies
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Wiki
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Releases
Package registry
Container registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Service Desk
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
GitLab community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
Muth, Philipp
Access structures for isogenies
Commits
3b1cdd90
Commit
3b1cdd90
authored
Sep 8, 2022
by
Philipp Muth
Browse files
Options
Downloads
Patches
Plain Diff
slides until key exchange done
parent
d02e79d7
Branches
Branches containing commit
No related tags found
No related merge requests found
Changes
3
Show whitespace changes
Inline
Side-by-side
Showing
3 changed files
ACNS/presentation/key_exchange.tex
+65
-0
65 additions, 0 deletions
ACNS/presentation/key_exchange.tex
ACNS/presentation/motivation.tex
+26
-2
26 additions, 2 deletions
ACNS/presentation/motivation.tex
ACNS/presentation/preamble.tex
+3
-3
3 additions, 3 deletions
ACNS/presentation/preamble.tex
with
94 additions
and
5 deletions
ACNS/presentation/key_exchange.tex
+
65
−
0
View file @
3b1cdd90
...
...
@@ -13,3 +13,68 @@
where
\(
E
_
1
=
\left
[
f
\paren
*
0
\right
]
E
_
0
\)
and
\(
s
_
i
=
f
\paren
*
i
\)
for
\(
i
=
1
,
\ldots
, n
\)
.
\end{definition}
\end{frame}
\begin{frame}
\frametitle
{
Key Generation
}
\begin{pchstack}
[center]
\procedure
[space = auto]
{$
\keygen\paren
*
S
$}{
\sk
\sample
\ZZ
_
p
\\
\pk
\gets
\left
[\sk\right]
E
_
0
\\
\set
{
s
_
1,
\ldots
, s
_
n
}
\gets
\SH
.
\share\paren*
s
\\
\pcfor
i =1 ,
\ldots
, n
\\
%\set{s_{i1,\ldots, s_{in}}} \gets \SH.\share\paren*{s_i}\\
f
_
i
\sample
\ZZ
_
p
\left
[X\right]
_{
\leq
k-1
}
\colon
f
_
i
\paren
0 = s
_
i
\\
\pcendfor\\
\text
{
publish
}
\pk\\
\pcfor
i =1 ,
\ldots
, n
\\
\text
{
send
}
\set
{
s
_
i ,f
_
i,
\set
{
f
_{
j
}
\paren*
i
}_{
j = 1,
\ldots
, n
}}
\text
{
to
}
P
_
i
\\
\pcendfor
}
\end{pchstack}
\end{frame}
\begin{frame}
\frametitle
{
Encapsulation
}
\begin{pchstack}
[center]
\procedure
{$
\encaps\paren
*
{
\pk
}$}{
b
\sample
\mathcal
G
\\
\key
\gets
b
\ast
\pk\\
c
\gets
b
\ast
E
_
0
\\
\pcreturn
\left
(
\key
,c
\right
)
}
\end{pchstack}
\end{frame}
\begin{frame}
[allowframebreaks]
\frametitle
{
A Shareholder
\(
P
_
i
\)
's Turn in the Decapsulation Protocol
}
Let
\(
S
^
\ast
\)
be a superauthorised set of shareholders executing the decapsulation protocol.
\begin{enumerate}
\item
Ascertain
\(
E
^{
k
-
1
}
\in
\mathcal
E
\)
, where
\(
E
^{
k
-
1
}\)
is previous shareholder's output.
\item
Sample
\(
R
_
k
\sample
\mathcal
E
\)
, compute
\(
R
_
k'
\gets
\left
[
L
_{
i,S
^
\ast
}
s
_
i
\right
]
R
_
k
\)
.
\item
Compute and publish
\begin{align*}
\left
(
\pi
^
k,
\set
{
\pi
^
k
_
j
}_{
P
_
j
\in
S
^
\ast
}
\right
)
&
\gets
\mathsf
{
PVP
}
.P
\paren*
{
i,f
_
i,S
^
\ast
,
\left
(
\left
(R
_
k,R
_
k'
\right
),
\left
(f
_
i
\paren
j
\right
)
_{
P
_
j
\in
S
^
\ast
}
\right
)
}
,
\\
E
^
k
&
\gets
\left
[L_{i,S^\ast}s_i\right]
E
^{
k-1
}
,
\\
zk
&
\gets
\mathsf
{
ZK
}
.P
\paren*
{
\left
(R
_
k,R
_
k'
\right
),
\left
(E
^{
k-1
}
, E
^
k
\right
), L
_{
i,S
^
\ast
}
s
_
i
}
.
\end{align*}
\item
All other participants
\(
P
_
j
\in
S
^
\ast
\)
verify
\begin{align*}
\mathsf
{
PVP
}
.V
&
\paren*
{
i, j,S
^
\ast
,f
_
i
\paren
j,
\left
(
\pi
^
k,
\pi
^
k
_
j
\right
)
}
,
\\
\mathsf
{
PVP
}
.V
&
\paren*
{
i,0,S
^
\ast
,
\left
(R
_
k,R
_
k'
\right
),
\left
(
\pi
^
k,
\pi
_
0
^
k
\right
)
}
,
\\
\mathsf
{
ZK
}
.V
&
\paren*
{
\left
(R
_
k,R
_
k'
\right
),
\left
(E
^{
k-1
}
,E
^
k
\right
), zk
}
.
\end{align*}
\item
If irregularities occur and more than half the participants convict
\(
P
_
i
\)
, the protocol is started over without
\(
P
_
i
\)
.
\item
Decapsulation terminates with the last shareholder's output
\(
E
^{
\#
S
^
\ast
}\)
as result.
\end{enumerate}
\end{frame}
\begin{frame}
\frametitle
{
Features of our Protocol
}
\begin{itemize}
\item
IND-CPA, i.e., the encapsulated key cannot be distinguished from the ciphertext, assuming the hardness of the GAIP
\item
Simulatable (as was
\cite
{
FeoM20
}
)
\item
Actively Secure, i.e., a misbehaving shareholder can be detected, if the PVP and ZK proof are sound
\end{itemize}
\end{frame}
This diff is collapsed.
Click to expand it.
ACNS/presentation/motivation.tex
+
26
−
2
View file @
3b1cdd90
\section
{
Motivation
}
\begin{frame}
\begin{frame}
[allowframebreaks]
\frametitle
{
Where are we?
}
\begin{block}
{
Hard Homogeneous Spaces
}
A hard homogeneous space
\(
\left
(
\mathcal
E,
\mathcal
G
\right
)
\)
is
...
...
@@ -11,7 +11,7 @@
\end{itemize}
\end{block}
\pause
%
\pause
\begin{block}
{
Properties of
\(
\ast
\)}
\begin{itemize}
\item
Compatibility:
\(
\forall
g,g'
\in
\mathcal
G ~
\forall
E
\in
\mathcal
E
\colon
g
\ast
\left
(
g'
\ast
E
\right
)
=
\left
(
g
\odot
g'
\right
)
E
\)
...
...
@@ -19,6 +19,30 @@
\item
Transitivity:
\(
\forall
E,E'
\in
\mathcal
E ~
\exists
!
g
\in
\mathcal
G
\colon
g
\ast
E
=
E'
\)
\end{itemize}
\end{block}
%\end{frame}
%\begin{frame}
\begin{block}
{
Notation
}
For arbitrary
\(
E
\in\mathcal
E
\)
,
\(
g
\in\mathcal
G
\)
with prime order
\(
p
\vert
\#\mathcal
G
\)
and
\(
s
\in
\Z
_
p
\)
, we denote
\[
\left
[
s
\right
]
E :
=
g
^
s
\ast
E.
\]
\end{block}
\begin{remark}
For
\(
s,s'
\in
\Z
_
p
\)
and
\(
E
\in\mathcal
E
\)
, we have
\[
[
s
]
\left
(
\left
[
s'
\right
]
E
\right
)
=
\left
[
s
+
s'
\right
]
E.
\]
\end{remark}
\begin{block}
{
The Group Action Inverse Problem
}
Given two elements
\(
E,E'
\in
\mathcal
E
\)
, find
\(
g
\in
\mathcal
G
\)
with
\[
g
\ast
E
=
E'.
\]
\end{block}
\end{frame}
\begin{frame}
\frametitle
{
Secret Sharing Schemes
}
\begin{definition}
[Superauthorises Sets]
\end{definition}
\end{frame}
\begin{frame}
...
...
This diff is collapsed.
Click to expand it.
ACNS/presentation/preamble.tex
+
3
−
3
View file @
3b1cdd90
...
...
@@ -27,7 +27,7 @@
%\usepackage{algorithm}
%\usepackage{algpseudocode}
%\usepackage{algorithmicx}
\usepackage
[advantage,adversary,keys,logic,mm,notions,operators,probability,sets]
{
cryptocode
}
\usepackage
[advantage,adversary,
asymptotics,ff,
keys,logic,mm,notions,operators,
primitives,
probability,sets]
{
cryptocode
}
%\usepackage[top=3cm, bottom=3cm, left=3cm, right=3cm]{geometry}
\usepackage
{
verbatim
}
...
...
@@ -84,7 +84,7 @@
%\newtheorem{defin}[thm]{Definition}
%\newtheorem{thm+def}{Theorem and Definition}
%\newtheorem{exm}[thm]{Example}
%
\newtheorem*{
b
em}{Remark}
\newtheorem*
{
r
em
ark
}{
Remark
}
%\newtheorem{problem}{Problem}
\numberwithin
{
equation
}{
section
}
...
...
@@ -106,7 +106,7 @@
\DeclareMathOperator
{
\im
}{
Im
}
%\DeclareMathOperator\pr{Pr}
%\renewcommand{\qedsymbol}{$\blacksquare$}
\DeclareMathOperator\SH
{
S
H
}
\DeclareMathOperator\SH
{
\mathcal
S
}
\DeclareMathOperator\shaho
{
sh
}
\newcommand\add
{
\mathsf
{
Add
}}
\newcommand\share
{
\mathsf
{
Share
}}
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment