Hyper-Encryption and Everlasting Security

• Authors: Yan Zong Ding;Michael O. Rabin
• Venue: STACS '02 Proceedings of the 19th Annual Symposium on Theoretical Aspects of Computer Science
• Year: 2002

We present substantial extensions of works [1], [2], and all previous works, on encryption in the bounded storage model introduced by Maurer in [25]. The major new result is that the sharedsecret key employed by the sender Alice and the receiver Bob can be re-used to send an exponential number of messages, against strong adaptive attacks. This essential step enhances the usability of the encryption method, and also allows strong authentication andnon-malleability described below.We give an encryption scheme that is provably secure against adaptive attacks by a computationally unbounded adversary in the bounded storage model. In the model, a sender Alice and a receiver Bob have access to a public random string 驴, and share a secret key s. Alice and Bob observe 驴 on the fly, and by use of s extract bits from which they create a one-time pad X used to encrypt M as C = X 驴 M. The size of the secret key s is |s| = k log2 |驴|, where k is a security parameter. An Adversary AD can compute andstore any function A1(驴) = 驴, subject to the bound on storage |驴| 驴 驴 驴 |驴|, 驴 C. Even if AD later gets the key s and is computationally unbounded, the encryption is provably secure. Assume that the key s is repeatedly used with successive strings 驴1, 驴2, ... to produce encryptions C1, C2, ... of messages M1, M2, ... AD computes 驴1 = A1(驴1), obtains C1, and gets to see the first message M1. Using these he computes andstores 驴2 = A1(驴2, 驴1, C1,M1), and so on. When he has stored 驴l and captured Cl, he gets the key s (but not Ml). The main result is that the encryption Cl is provably secure against this adaptive attack, where l, the number of time the secret key s is re-used, is exponentially large in the security parameter k. On this we base noninteractive protocols for authentication and non-malleability. Again, the shared secret key used in these protocols can be securely re-used an exponential number of times against adaptive attacks. The method of proof is stronger than the one in [1], [2], and yields ergodic results of independent interest. We discuss in the Introduction the feasibility of the bounded storage model, and outline a solution. Furthermore, the existence of an encryption scheme with the provable strong security properties presented here, may prompt other implementations of the bounded storage model.