CAREER: Exposure-Resilient Cryptography

摘要：抗曝光密码学涉及到密钥暴露和一般信息泄露的重要问题。这些信息的曝光对在现实生活中使用密码学构成了最严重和最常见的威胁之一。例如，密码学计算(解密、签名生成等)通常在相对不安全的设备(例如，移动设备或连接到互联网的主机)上执行，该设备不能被信任来维护私钥的保密。因此，抗曝光密码学的目标是设计出在各种密码场景中限制(甚至完全消除)这种曝光的负面后果的解决方案。特别地，研究了各种密钥演化方案的设计和部分密钥暴露问题，密钥随时间演化的范式涉及更新一个人的密钥，使得在给定时间段(S)的密钥泄露在最小程度上折衷于其他时间段的安全性。研究人员检查了两个这样的模型。前向安全方案在本地更新密钥，并试图在当前密钥暴露时保护所有过去时间段的安全。相比之下，双向安全方案使用安全的密钥更新，但保护过去和未来的非暴露时间段。在这两种模型中，公开信息(例如公钥)不受秘密密钥演化的影响。部分密钥暴露的问题涉及大多数(但不是所有)秘密信息已被泄露的情况。在这个背景下研究的主要问题是，如何存储或表示有价值的秘密信息，使得几乎完全暴露其表示仍然保证实际嵌入的秘密的保密性？

Abstract:Exposure-Resilient Cryptography concerns the important problem of keyexposure and general information leakage. Exposure of suchinformation poses one of the most serious and common threats toemploying cryptography in real life. For example, cryptographiccomputations (decryption, signature generation, etc.) are oftenperformed on a relatively insecure device (e.g., a mobile device or anInternet-connected host) which cannot be trusted to maintain secrecyof the private key. Thus, the goal of Exposure-Resilient Cryptographyis to design solutions that will limit (or even completely eliminate)the negative consequences of such an exposure in various cryptographicscenarios. In particular, this research concentrates on the design ofvarious key evolving schemes and the problem of partial key exposure.The paradigm of secret key evolution over time invloves updating one'ssecret key such that key leakage at given period(s) compromises thesecurity of other periods to the minimal extent possible. Theinvestigators examine two such models. Forward-secure schemes updatesecret key locally, and seek to protect the security of all the pastperiods when the current key is exposed. In contrast,bidirectionally-secure schemes use secure key updates, but protectall non-exposed periods: both in the past and in the future. Ineither model, the public information (e.g., public keys) are notaffected by the secret key evolution. The problem of partial keyexposure concerns the scenario where most but not all secretinformation has been leaked. The main question studied in this settingis how can valuable secret information be stored or represented insuch a way that almost complete exposure of its representation stillguarantees the secrecy of the actual, embedded secret?