ACHIEVING STRONG PRIVACY

9.1Ng et al’s Proposal: Wise Adversaries

Starting from the observation that the Destructive adversary in the impossibility proof of Strong privacy is already aware of the answer the genuine R interface would produce and only uses to distinguish in which world she is, Ng et al. [NSMSN ] proposed to x the model by disallowing such queries. For this sake, they introduced the notion of “wise” adversaries. A wise adversary is de ned as an adversary who does not issue oracle queries for which he “knows” the output. e main argument of [NSMSN ] is the following: if the adversary is wise, then he will never ask the interfaces about the outcome of a protocol session in which he was either passive, active, or simulating a tag if he knows the result of the instance. In this scenario, the universal adversary used by Vaudenay against Strong privacy becomes “unwise” and is thus discarded.

.

Although they claim to keep Vaudenay’s framework and de nitions, the way to prove privacy is not resolved in [NSMSN ]. Following their de nition, an adversary A making q (any) Oracle accesses is wise if no adversary can achieve the same or a smaller probability of success while making less than q Oracle calls. It turns out that wisdom is a hard notion to manipulate and di cult to prove.

Another issue is whether the notion “wise adversaries” ts in realistic scenarios. One may argue that this kind of adversary seems equivalent in terms of result but, in fact, it is not clear whywouldanadversarydenyhimselfsuchadvantage. Infact, thiscomesbacktothede nition of knowledge: what does it mean for an algorithm to know something.

9.2Our Proposal: Incorporate the Blinder into the Adversary

e solutionwe propose di ersfrom theoneproposed byNget al. and theothers described in the end of Chapter in that we do not alter the privacy game. In fact, modifying the privacy game in those previous works provoked a loss in the privacy notion captured by the model which unfortunately is not quanti ed. For instance, we can assume that an adversary defeats privacy by being able to determine if one RFID tag belongs a group of them that had prior communication with the reader. While it is possible that such statement is included in their de nitions, it is not clear from their work.

Our proposal is to make the blinder’s simulation run inside the adversary. at is, we argue that a blinder, acting for the adversary and not for the system, as Vaudenay’s de nitions suggest, should be executed by the former. Consequently, the blinder should be given all the adversary’s knowledge, and in particular her random tape that was missing from the original de nitions.

Before going into the modi cations we propose to Vaudenay’s de nitions, we dedicate the next three sections to introduce new concepts that will be proved to be later useful.

9.3Sampling Algorithms and the ISH Hypothesis

Up to this point, we never fully de ned sampling algorithms but merely treated them as algorithms implementing probability distributions. is section looks more deeply in the subject.

De nition . (Sampling Algorithm)

An e cient sampling algorithm for a probability distribution p is a polynomial-time probabilistic algorithm, in k, denoted Samp, that, on input random coins 2 f0; 1gℓ(k), with ℓ( ) being a polynomial function, outputs vector elements om X of dimension d(k), with d also being a polynomial function, that satis es

. :

.

at is, for every polynomial-time distinguisher D we require that

Pr[DReal Game(1k) ! 1] Pr[DFake Game(1k) ! 1] = negl(k)

De nition . (Inverse-Sampling Hypothesis)

e in erse sampling hypothesis is that for every probability distribution there exists an in ersesamplable algorithm.

is hypothesis states that for every sampling algorithm S1, including one-way sampling algorithms, there exists an inverse-sampling algorithm S2 that can be shown to be indistinguishable from S1. e analysis of ISH by Ishai et al. [IKOS ] shows that the existence of non-interactively extractable one-way function family ensembles, a generalization of knowledgeassumptions, and non-interactivezero-knowledge proofsystemsfor NP inthecommon referencestringmodeltogetherimplythatISHdoesnothold. Aninterestingsidee ectofthis result is that the existence of plaintext-aware encryption schemes and the validity of the ISH hypothesis are mutually exclusive. is is a direct consequence of the fact that plaintext-aware encryption schemes require knowledge extractors, by de nition (cf. De nition . ), and that non-interactive zero-knowledge proof systems for NP in the CRS model can be constructed fromanytrapdoorone-waypermutation[FLS ]. Aswewilllatermakeuseofplaintext-aware encryption schemes, we are obliged to make the assumption that ISH is wrong.

9.4Knowledge Extractors and Non-Falsiable Assumptions

e notion of knowledge and awareness for interactive Turing machines are de ned in terms of computations. at is, a machine is said to know x if it is able to compute f(x) for an arbitrarily chosen function f. Formalizing this notion has proven to be one of the most di cult tasks of theoretical computer scientists. In the end, the agreed de nition is that a Turing machine knows x if there exists another Turing machine that runs in the same complexity class as the former and takes its description along with all its inputs and outputs x. is last machine is called a knowledge extractor.

To be more concise, we give a concrete example with extractable one-way functions which were introduced by Canetti and Dakdouk [CD ]. Besides complying to the classical onewaynessproperty, suchafunctionhastobesuchthatthe“only”wayforanalgorithmtooutput an element that has a pre-image by this function is to pick an element from the domain of f

. -

knowledge extractors can only be assumed (and even independently from the assumption that one-way functions exist).

e rst assumption in the literature related to the existence of knowledge extractors is due to Damgård [Dam ] and called the Di e-Hellman Key (DHK) assumption (it has also been termed the knowledge of exponent assumption by Bellare and Palacio [BP a]). In short, this assumption states that the only mean for an adversary that is given an element W from a cyclic group in which g is a generator and wants to produce a valid Di e-Hellman tuple (W; gu; W u) is to pick u and that there exists an extractor that given the adversary’s input and randomness recovers u. Although it was used in numerous applications, it is not clear whether the assumption is true or false. Moreover, the assumption presents the particularity of being as hard to prove than to disprove and has consequently been the target of many criticism [Nao ]. at is, it is insu cient to construct a counter-example to invalidate the DHK assumption as it would be the case for classical computational assumptions such as the discrete logarithm or factoring. In fact, to prove that the assumption does not hold one would need to prove that there exists an adversary for which there is no extractor. Yet, some variants of the DHK assumption were deemed to be false [BP a]. Defenders of the assumption argue that it is proven to hold in the generic group model [Den b]. However, much like the random oracle model, some computational assumptions hold in the generic group model but fail as soon as the group is instantiated in any representation [Den ]. at said, much like the random oracle model, no “concrete” example for the separation is currently known.

e DHK assumption was later expanded to cover general subset membership problems by Birkett [Bir ]. He called that generalization the subset witness knowledge (SWK) assumption. Basedonthisassumption, hewasabletoextend(andcorrectsomepartsof )Dent’sproof

.