Smooth Projective Hashing and Two-Message Oblivious Transfer
Smooth Projective Hashing and Two-Message Oblivious Transfer
复制标题
DOI：
10.1007/s00145-010-9092-8
复制
发表时间：
2005-05
影响因子：
3
通讯作者：
S. Halevi;Y. Kalai
中科院分区：
文献类型：
--
作者：
S. Halevi;Y. Kalai
我们使用Cramer和Shoup的光滑投影哈希概念的修改，提出了构建双消息无关系传输协议的一般框架（《密码学进展- eurocrypt ' 02》，《计算机科学讲义》，vol. 2332, pp. 45-64，施普林格，柏林，2002）。该框架是Naor和Pinkas （SODA ' 01，第448-457页，ACM， 2001年，纽约）和Aiello等人（密码学进展- eurocrypt ' 01，计算机科学讲义，第2045卷，第119-135页，施普林格，柏林，2001年）的双消息无关传输协议的抽象，其安全性基于decision Diffie-Hellman假设。特别地，我们给出了两个新的无关传输协议。其中一个的安全性基于二次残差假设，另一个的安全性基于十次残差假设。与光滑投影哈希的其他应用相比，在我们的上下文中，我们还必须处理恶意选择的参数，这带来了新的技术困难。我们还改进了先前基于因式分解的光滑泛散列的构造，因为我们的构造不要求底层RSA模是安全素数的乘积。（这适用于基于二次残差假设的方案以及基于次残差假设的方案。）事实上，我们观察到安全素数要求对于许多先前的结构是不必要的。特别是，由于kramer - shoup， Gennaro-Lindell和Camenisch-Shoup的基于因式的CCA安全加密方案即使底层RSA模不是安全素数的乘积也保持安全。
We present a general framework for constructing two-message oblivious transfer protocols using a modification of Cramer and Shoup’s notion of smooth projective hashing (Advances in Cryptology—EUROCRYPT’02, Lecture Notes in Computer Science, vol. 2332, pp. 45–64, Springer, Berlin, 2002). This framework is an abstraction of the two-message oblivious transfer protocols of Naor and Pinkas (SODA’01, pp. 448–457, ACM, New York, 2001) and Aiello et al. (Advances in Cryptology—EUROCRYPT’01, Lecture Notes in Computer Science, vol. 2045, pp. 119–135, Springer, Berlin, 2001), whose security is based on the Decisional Diffie–Hellman Assumption. In particular, we give two new oblivious transfer protocols. The security of one is based on the Quadratic Residuosity Assumption, and the security of the other is based on theNth Residuosity Assumption. Compared to other applications of smooth projective hashing, in our context we must deal also with maliciously chosen parameters, which raises new technical difficulties.We also improve on prior constructions of factoring-based smooth universal hashing, in that our constructionsdo not require that the underlying RSA modulus is a product of safe primes. (This holds for the schemes based on the Quadratic Residuosity Assumption as well as the ones based on theNth Residuosity Assumption.) In fact, we observe that the safe-prime requirement is unnecessary for many prior constructions. In particular, the factoring-based CCA secure encryption schemes due to Cramer–Shoup, Gennaro–Lindell, and Camenisch–Shoup remain secure even if the underlying RSA modulus is not a product of safe primes.