We study the complexity of secure computation in the tamper-proof hardware token model. Our main focus is on non-interactive unconditional two-party computation using bit-OT to-kens, but we also study computational security with stateless tokens that have more complex functionality. Our results can be summarized as follows: • We show that there exists a class of functions such that the number of bit-OT tokens required to securely implement them is at least the size of the sender’s input. The same applies for receiver’s input size (with a different class of functionalities). • We investigate the existence of non-adaptive protocols in the hardware token model. In a non-adaptive protocol, the queries to the tokens are fixed in advance as against an adaptive protocol in which the queries can depend on the answers from the previously queried tokens. In this work, we show that the existence of non-adaptive protocols in the hardware token model imply efficient (decomposable) randomized encodings. Since, efficient decomposable randomized encodings are believed to not exist for all efficient functions, this result can be interpreted as an evidence to the impossibility of non-adaptive protocols for efficiently
We study the complexity of secure computation in the tamper-proof hardware token model. Our main focus is on non-interactive unconditional two-party computation using bit-OT to-kens, but we also study computational security with stateless tokens that have more complex functionality. Our results can be summarized as follows: • We show that there exists a class of functions such that the number of bit-OT tokens required to securely implement them is at least the size of the sender’s input. The same applies for receiver’s input size (with a different class of functionalities). • We investigate the existence of non-adaptive protocols in the hardware token model. In a non-adaptive protocol, the queries to the tokens are fixed in advance as against an adaptive protocol in which the queries can depend on the answers from the previously queried tokens. In this work, we show that the existence of non-adaptive protocols in the hardware token model imply efficient (decomposable) randomized encodings. Since, efficient decomposable randomized encodings are believed to not exist for all efficient functions, this result can be interpreted as an evidence to the impossibility of non-adaptive protocols for efficiently
A number of works have investigated using tamper-proof hardware tokens as tools to achieve a variety of cryptographic tasks. In particular, Goldreich and Ostrovsky considered the goal of software protection via oblivious RAM. Goldwasser, Kalai, and Rothblum introduced the concept of one-time programs: in a one-time program, an honest sender sends a set of simple hardware tokens to a (potentially malicious) receiver. The hardware tokens allow the receiver to execute a secret program specified by the sender’s tokens exactly once (or, more generally, up to a fixed t times). A recent line of work initiated by Katz examined the problem of achieving UC-secure computation using hardware tokens. Motivated by the goal of unifying and strengthening these previous notions, we consider the general question of basing secure computation on hardware tokens. We show that the following tasks, which cannot be realized in the “plain ” model, become feasible if the parties are allowed to generate and exchange tamper-proof hardware tokens. • Unconditional non-interactive secure computation. We show that by exchanging simple stateful hardware tokens, any functionality can be realized with unconditional security against malicious parties. In the case of two-party functionalities f(x, y) which take their inputs from a sender and a receiver and deliver
Secure computation in the presence of tamper-proof hardware tokens is proven under the assumption that the holder of the token is only given black-box access to the functionality of the token. Starting with the work of Goldreich and Ostrovsky [GO96], a long series of works studied tamper-proof hardware for realizing two-party functionalities in a variety of settings. In this work we focus our attention on two important complexity measures of stateless token-based secure computation: round complexity and hardness assumptions and present the following results in the two-party setting: • A round optimal generic secure protocol in the plain model assuming one-way functions, where the tokens are created by a single party. • A round optimal generic UC secure protocol assuming one-way functions. Our constructions are proven in the real/ideal paradigm with security in the presence of static malicious adversaries. As a side contribution, we identify a flaw in one of the feasibility results regarding UC secure protocols in the tamper proof model proved in the work of Goyal, Ishai, Sahai, Venkatesan and Wadia (TCC 2010) and correct history by attributing the work of Choi, Katz, Schroöder, Yerukhimovic and Zhou (TCC 2014) to establishing the (same) feasibility result.
Recent results have shown the usefulness of tamper-proof hardware tokens as a setup assumption for building UC-secure two-party computation protocols, thus providing broad security guarantees and allowing the use of such protocols as buildings blocks in the modular design of complex cryptography protocols. All these works have in common that they assume the tokens to be completely isolated from their creator, but this is a strong assumption. In this work we investigate the feasibility of cryptographic protocols in the setting where the isolation of the hardware token is weakened. We consider two cases: (1) the token can relay messages to its creator, or (2) the creator can send messages to the token after it is sent to the receiver. We provide a detailed characterization for both settings, presenting both impossibilities and information-theoretically secure solutions.
We prove two classes of lower bounds on the communication complexity of information-theoretically secure multiparty computation. The first lower bound applies to perfect passive secure multiparty computation in the standard model with n = 2t+1 parties of which t are corrupted. We show a lower bound that applies to secure evaluation of any function, assuming that each party can choose to learn or not learn the output. Specifically, we show that there is a function H^* such that for any protocol that evaluates y_i = b_i ⋅ f(x₁,...,x_n) with perfect passive security (where b_i is a private boolean input), the total communication must be at least 1/2 ∑_{i = 1}ⁿ H_f^*(x_i) bits of information. The second lower bound applies to the perfect maliciously secure setting with n = 3t+1 parties. We show that for any n and all large enough S, there exists a reactive functionality F_S taking an S-bit string as input (and with short output) such that any protocol implementing F_S with perfect malicious security must communicate Ω(nS) bits. Since the functionalities we study can be implemented with linear size circuits, the result can equivalently be stated as follows: for any n and all large enough g ∈ ℕ there exists a reactive functionality F_C doing computation specified by a Boolean circuit C with g gates, where any perfectly secure protocol implementing F_C must communicate Ω(n g) bits. The results easily extends to constructing similar functionalities defined over any fixed finite field. Using known techniques, we also show an upper bound that matches the lower bound up to a constant factor (existing upper bounds are a factor lg n off for Boolean circuits). Both results also extend to the case where the threshold t is suboptimal. Namely if n = kt+s the bound is weakened by a factor O(s), which corresponds to known optimizations via packed secret-sharing.
Abstract. The assumption of the availability of tamper-proof hardware tokens has been used extensively in the design of cryptographic primitives. For example, Katz (Eurocrypt 2007) suggests them as an alternative to other setup assumptions, towards achieving general UC-secure multi-party computation. On the other hand, a lot of recent research has focused on protecting security of various cryptographic primitives against physical attacks such as leakage and tampering. In this paper we put forward the notion of Built-in Tamper Resilience (BiTR) for cryptographic protocols, capturing the idea that the protocol that is encapsulated in a hardware token is designed in such a way so that tampering gives no advantage to an adversary. Our definition is within the UC model, and can be viewed as unifying and extending several prior related works. We provide a composition theorem for BiTR security of protocols, impossibility results, as well as several BiTR constructions for specific cryptographic protocols or tampering function classes. In particular, we achieve general UC-secure computation based on a hardware token that may be susceptible to affine tampering attacks. We also prove that two existing identification and signature schemes (by Schnorr and Okamoto, respecitively) are already BiTR against affine attacks (without requiring any modification or endcoding). We next observe that non-malleable codes can be used as state encodings to achieve the BiTR property, and show new positive results for deterministic non-malleable encodings for various classes of tampering functions. 1
Achieving information-theoretically secure key exchange between two parties requires some “hardware set-up”, like the possibility to transmit quantum bits. An alternative approach, which recently emerged in the crypto community, is to use tamper-resistant hardware tokens in protocols. However, such tokens need to be transmitted physically between parties, opening up the possibility to attack the actual transfer of the token, possibly in combination with attacks on the digital protocol. We discuss such interception attacks on cryptographic protocols which rely on trustworthy hardware like one-time memory tokens (Goldwasser et al., Crypto 2008). In such attacks the adversary can mount man-in-the-middle attacks and access, or even substitute, transmitted tokens. We show that many of the existing token-based protocols are vulnerable against this kind of attack, which typically lies outside of the previously considered security models. We also give a positive result for protocols remaining secure against such attacks. We present a very efficient protocol for password-based authenticated key exchange based on the weak model of one-time memory tokens. Our protocol only requires four moves, very basic operations, and the sender to send ℓ tokens in the first step for passwords of length ℓ. At the same time we achieve information-theoretic security in Canetti's universal composition framework (FOCS 2001) against adaptive adversaries (assuming reliable erasure), even if the tokens are not guaranteed to be transferred securely, i.e., even if the adversary can read or substitute transmitted tokens.