[论文解读] Breaking One-Round Key-Agreement Protocols in the Random

Oracle Model, Miroslava Sotáková|arXiv (Cornell University)|Jan 1, 2008

Cryptography and Data Security参考文献 2被引用 2

一句话总结

本文在随机预言机模型中证明，一个窃听者（Eve）可以通过对预言机发起 O(n²) 次查询来破解单轮密钥协商协议——具体而言是Merkle的谜题，从而确立了破解此类协议所需查询次数的紧致上界。该结果在单轮设置下确认了长期猜想的二次方安全界，独立验证了Barak和Mahmoody-Ghidary近期在多轮设置下的结果。

ABSTRACT

In this work we deal with one-round key-agreement protocols, called Merkle’s Puzzles, in the random oracle model, where the players Alice and Bob are allowed to query a random permutation oracle n times. We prove that Eve can always break the protocol by querying the oracle O(n 2 ) times. The long-time unproven optimality of the quadratic bound in the fully general, multi-round scenario has been proven recently by Barak and MahmoodyGhidary. The results in this paper have been found independently of their work. In this work we prove the tight upper-bound on the number of queries needed to break a keyagreement protocol in the random oracle model. The key-agreement protocol called Merkle’s puzzles, developed by Merkle in 1974 a published in 1978 [3] is one of the earliest example of public-key encryption. Following the protocol, two parties can agree on a secret-key by exchanging messages, assuming that they share no secrets beforehand. Informally, Alice creates a message for Bob in the following way - she constructs a large number of puzzles of moderate difficulty, each of them being possible to solve with Bob’s computational resources. All of them are in the form of an encrypted message with an unknown key that is short enough to allow the brute force attack. After receiving the message from Alice, Bob chooses one puzzle uniformly at random and solves it. The solution contains an identifier and a key. Bob encrypts the identifier with the key, and announces it back to Alice. The solution of the puzzle solved by Bob becomes Alice’s and Bob’s secret-key. Since the puzzle’s identifier is sent to Alice as a message encrypted with a key that is unknown to Eve, the eavesdropper’s best strategy to attack the key-agreement protocol is to solve as many puzzles as possible. To achieve constant probability of success, she has to solve a constant fraction of them, which might require much more computational power than Alice and Bob have. In a similar way we construct a key-agreement protocol in the random oracle scenario, where the computational difficulty of key-agreement is expressed by the number of oracle queries that

研究动机与目标

• 在随机预言机模型中，建立破解单轮密钥协商协议所需预言机查询次数的最紧致上界。
• 解决长期悬而未决的开放问题：在完全通用的多轮设置下，二次方查询界是否最优，重点聚焦于单轮情形。
• 提供一个自包含的证明，独立于近期的多轮结果，证明破解Merkle谜题的 O(n²) 查询复杂度的最优性。
• 形式化并分析随机预言机模型下Merkle谜题的安全性，明确协议在何种计算假设下仍保持安全。

提出的方法

• 将密钥协商协议建模为单轮交互：Alice 向 Bob 发送 n 个谜题，每个谜题需要一次预言机查询才能破解。
• 假设预言机为随机置换，通过攻击者必须进行的查询次数来定义协议的安全性。
• 分析 Eve 的最优策略：破解常数比例的谜题以实现常数成功概率，这在期望下需要 O(n²) 次查询。
• 利用概率分析证明，任何策略都无法在少于 Ω(n²) 次查询内破解协议，从而确立上界的紧致性。
• 利用谜题系统的结构特性，证明即使采用自适应查询策略，查询次数仍被限制在 O(n²) 之内。
• 将结果与先前工作（特别是 Barak 和 Mahmoody-Ghidary 的多轮证明）进行比较，强调本工作在单轮设置下的独立性与相关性。

实验结果

研究问题

• RQ1 能否在单轮随机预言机模型中，将破解Merkle谜题的 O(n²) 查询界证明为紧致上界？
• RQ2 是否存在一种策略，使窃听者在随机预言机模型中以少于 O(n²) 次查询破解协议？
• RQ3 在查询复杂度方面，单轮密钥协商模型与多轮模型相比有何差异？
• RQ4 攻击者为实现常数成功概率而破解协议，所需的最少预言机查询次数是多少？
• RQ5 随机预言机模型是否能够对单轮密钥协商协议的安全性提供紧致刻画？

主要发现

• 本文确立了在随机预言机模型中，窃听者可通过 O(n²) 次预言机查询破解Merkle谜题，且该界为最优。
• O(n²) 查询界是紧致的，即不存在能显著减少查询次数的策略。
• 该结果在单轮设置下确认了二次方安全界，独立验证了Barak和Mahmoody-Ghidary近期在多轮设置下的结果。
• 分析表明，即使采用自适应查询策略，所需查询次数仍渐近为 O(n²)。
• 证明表明，为实现常数成功概率，必须破解常数比例的谜题，而这需要 O(n²) 次查询。
• 本工作提供了单轮模型下安全界的一个自包含且形式化的证明，为理解密钥协商协议的基础理论做出了贡献。