Tightly-Secure PAK(E)

Abstract

We present a security reduction for the PAK protocol instantiated over Gap Diffie-Hellman Groups that is tighter than previously known reductions. We discuss the implications of our results for concrete security. Our proof is the first to show that the PAK protocol can provide meaningful security guarantees for values of the parameters typical in today’s world.

Appendices

A Terminology from the Original Proof of PAK

First, we introduce the terminology from [25] that deals with adversary’s actions and partnering.

We say “in a CLIENT ACTION $\kappa$ query to $\varPi _{i}^{C}$”, to refer to “in a Send query to $\varPi _{i}^{C}$ that results in execution of CLIENT ACTION $\kappa$ procedure” and “in a SERVER ACTION $\kappa$ query to $\varPi _{j}^{S}$”, to refer to “in a Send query to $\varPi _{j}^{S}$ that results in execution of SERVER ACTION $\kappa$ procedure”. A client instance $\varPi _{i}^{C}$ is paired with a server instance $\varPi _{j}^{S}$ if there is a CLIENT ACTION 0 query to $\varPi _{i}^{C}$ with input S and output $\langle C,m \rangle$, there is a SERVER ACTION 1 query to $\varPi _{j}^{S}$ with input $\langle C,m \rangle$ and output $\langle \mu ,k \rangle$ and there is a CLIENT ACTION 1 query to $\varPi _{i}^{C}$ with input $\langle \mu ,k \rangle$. A server instance $\varPi _{j}^{S}$ is paired with client instance $\varPi _{i}^{C}$ whenever there is a CLIENT ACTION 0 query to $\varPi _{i}^{C}$ with input S and output $\langle C,m \rangle$, there is a SERVER ACTION 1 query to $\varPi _{j}^{S}$ with input $\langle C,m \rangle$ and output $\langle \mu ,k \rangle$, and if there is a SERVER ACTION 2 query to $\varPi _{j}^{S}$ with input $k'$, then there was previously a CLIENT ACTION 1 query to $\varPi _{i}^{C}$ with input $\langle \mu ,k \rangle$ and output $k'$.

Next we describe those events taken from [25] which are required in our proof of security.

• testpw($C,i,S,\pi ,l$): for some $m, \mu$ and $\gamma '$, $\mathcal {A}$ makes (i) an $H_l(C,S,m,\mu ,\sigma , \gamma ')$ query, (ii) a CLIENT ACTION 0 query to a client instance $\varPi _{i}^{C}$ with input S and output $\langle C,m \rangle$, (iii) a CLIENT ACTION 1 query to $\varPi _{i}^{C}$ with input $\langle \mu , k \rangle$ and (iv) an $H_1(\pi )$ query returning $(\gamma ')^{-1}$, where the last query is either the $H_l(\cdot )$ query or the CLIENT ACTION 1 query, $\sigma = DH(\alpha ,\mu )$, $m = \alpha \cdot (\gamma ')^{-1}$ and $l \in \{2,3,4\}$.

• testpw!($C,i,S,\pi$): for some k, a CLIENT ACTION 1 query with input $\langle \mu , k \rangle$ causes a testpw($C,i,S,\pi ,2$) event to occur, with associated value k.

• textpw($S,j,C,\pi ,l$): for some $m, \mu , \gamma '$ and k, $\mathcal {A}$ makes an $H_l(C,S,m,\mu ,\sigma , \gamma ')$ query, and previously made (i) a SERVER ACTION 1 query to a server instance $\varPi _{j}^{S}$ with input $\langle C,m \rangle$ and output $\langle \mu ,k \rangle$, and (ii) an $H_1(\pi )$ query returning $(\gamma ')^{-1}$, where $\sigma = DH (\alpha , \mu )$, $m = \alpha \cdot (\gamma ')^{-1}$ and ACCEPTABLE(m). The associated value of this event is $k, k''$ or $sk_s^j$.

• testpw!($S,j,C,\pi$): SERVER ACTION 2 query to $\varPi _{j}^{S}$ is made with input $k'$, and previously a testpw($S,j,C,\pi ,3$) event occurs with associated value $k'$.

• testpw$^*$($S,j,C,\pi$): testpw($S,j,C,\pi ,l$) event occurs for some $l\in \{2,3,4\}$.

• testpw($C,i,S,j,\pi$) : for some $l\in \{2,3,4\}$, both a testpw($C,i,S,\pi ,l$) and testpw($S,j,C,\pi ,l$) event occur, where $\varPi _{i}^{C}$ is paired with $\varPi _{j}^{S}$, and $\varPi _{j}^{S}$ is paired with $\varPi _{i}^{C}$ after its SERVER ACTION 1 query.

• testexecpw($C,i,S,j,\pi$): for some $m, \mu$ and $\gamma '$, $\mathcal {A}$ makes an $H_l(C,S,m,$ $\mu ,$ $\sigma ,$ $\gamma ')$ query, for $l\in \{2,3,4\}$, and previously made (i) an Execute(C, i, S, j) query that generates $m,\mu$, and (ii) an $H_1(\pi )$ query returning $(\gamma ')^{-1}$, where $\sigma = DH(\alpha , \mu )$ and $m=\alpha \cdot (\gamma ')^{-1}$.

• correctpw: before any Corrupt query, either a testpw!($C,i,S,\pi _C$) event occurs for some C,i and S, or a $\text {testpw}^*(S,j,C,\pi _C)$ event occurs for some S, j, and C.

• doublepwserver: before any Corrupt query, both $\text {testpw}^*(S,j,C,\pi )$ event and a $\text {testpw}^*(S,j,C,\hat{\pi })$, for some S, j, C and $\pi \ne \hat{\pi }$.

• pairedpwguess: a testpw($C,i,S,j,\pi _C$) event occurs, for some C, i, S and j.

B Hash Function Simulation

Fig. 3.

Simulation of the hash function $H_1$