On Everlasting Security in the Hybrid Bounded Storage Model
On Everlasting Security in the Hybrid Bounded Storage Model
复制标题
论混合有界存储模型中的永久安全
DOI：
--
复制
发表时间：
2006
期刊：
影响因子：
--
通讯作者：
M. Naor
中科院分区：
文献类型：
--
作者：
Danny Harnik;M. Naor
有界存储模型（BSM）限制对手的存储空间，而不是其运行时间。它利用长度为r的长随机字符串R的公共传输，并且依赖于窃听者不可能存储所有该字符串的假设。该模型下的加密方案具有持久安全的特性。简而言之，这意味着即使对手最终获得更多的存储空间或获得可能使用的（原始）密钥的知识，加密的消息仍然是安全的。然而，如果诚实方事先不分享任何私人信息，那么实现永久安全性需要诚实方提供高存储容量（存储Ω（√r）;如[9]所示）。我们考虑的想法是一个混合有界存储模型的窃听者的计算限制，直到R的传输已经结束。例如，诚实的各方是否可以运行一个计算安全的密钥协商协议，以便为BSM商定一个共享的私钥，从而以低内存需求实现永久的安全性？研究了混合有界存储模型永久安全的可能性和不可能性。我们首先正式定义模型和这个模型的永久安全性。我们证明了两种定义的等价性：不确定性和语义安全性。消极的一面。我们表明，永久的安全性与低存储要求不能实现的黑盒减少混合BSM。这进一步表明了实现低存储永久安全性的难度，增加了这种性质的先前结果[9，15]。另一方面，我们展示了模型的两个增强，允许低存储永久的安全性。第一种是通过向模型中添加随机预言，而第二种是将对手的可访问性限制在广播字符串R上。最后，我们表明，在这两个修改后的模型中，也存在有界存储不经意传输协议与低存储要求。
The bounded storage model (BSM) bounds the storage space of an adversary rather than its running time. It utilizes the public transmission of a long random string R of length r, and relies on the assumption that an eavesdropper cannot possibly store all of this string. Encryption schemes in this model achieve the appealing property of everlasting security. In short, this means that an encrypted message remains secure even if the adversary eventually gains more storage or gains knowledge of (original) secret keys that may have been used. However, if the honest parties do not share any private information in advance, then achieving everlasting security requires high storage capacity from the honest parties (storage of Ω(√r); as shown in [9]). We consider the idea of a hybrid bounded storage model were computational limitations on the eavesdropper are assumed up until the time that the transmission of R has ended. For example, can the honest parties run a computationally secure key agreement protocol in order to agree on a shared private key for the BSM, and thus achieve everlasting security with low memory requirements? We study the possibility and impossibility of everlasting security in the hybrid bounded storage model. We start by formally defining the model and everlasting security for this model. We show the equivalence of two flavors of definitions: indistinguishability of encryptions and semantic security. On the negative side. we show that everlasting security with low storage requirements cannot be achieved by black-box reductions in the hybrid BSM. This serves a.s a further indication to the hardness of achieving low storage everlasting security, adding to previous results of this nature [9,15]. On the other hand, we show two augmentations of the model that allow for low storage everlasting security. The first is by adding a random oracle to the model, while the second bounds the accessibility of the adversary to the broadcast string R. Finally, we show that in these two modified models, there also exist bounded storage oblivious transfer protocols with low storage requirements.