CAREER: Strengthening Cryptography by Reducing Assumptions about the Adversary

加密安全模型是根据对手的能力来定义的，包括计算限制和允许他访问系统的权限。 然后，以明确、严格和可量化的方式（通常依赖于某些计算难度假设），针对此类对手证明协议的安全性。 然而，传统模型通常是不够的，特别是考虑到当今密码学的广泛使用。由于我们无法先验地预测对手可以做的所有事情，因此尽可能减少对手能力的假设非常重要。在这里，我们建议扩展传统的密码学基础，以抵御更强大、更现实的对手的攻击。特别是，我们挑战了对手无法访问合法方密钥的经典假设。 对于以下类型的攻击，我们将研究最强大的现有模型，设计新模型，开发协议，并探索可能实现的极限：选择密文攻击：我们可以通过任何仅满足标准语义安全的方案来实现 CCA 安全吗？公钥加密的不同安全概念之间有什么关系？篡改攻击：当对手可以篡改密钥时，我们能否实现各种加密应用的安全性？通过故障攻击？ 密钥暴露攻击：当对手可以获得密钥时，我们能否实现安全？如何设计和实例化具有最佳安全性和效率的密钥演进方案，以限制密钥暴露造成的损害？我们将在上述领域寻求积极和消极的结果，以便更好地理解相关影响和要求，并获得最佳解决方案。

Cryptographic security models are defined in terms of the capabilities of the adversary, including computational limitations and what access he is allowed to the system. The security of protocols is then proven with respect to such adversaries, in a well-defined, rigorous and quantifiable way (typically relying on some computational hardness assumption). However, traditional models are often not adequate, especially in light of the widespread use of cryptography today. Since we cannot predict everything the adversary can do a priori, it is important to reduce the assumptions about the adversary's (in)capabilities as much as possible. Here, we propose to expand the traditional cryptographic foundations so as to withstand attacks by stronger, more realistic adversaries. In particular, we challenge the classical assumption that the adversary has no access whatsoever to the legitimate parties' secret keys. We will study the strongest existing models, design new models, develop protocols, and explore the limits of what is possible to achieve, for the following types of attacks: Chosen ciphertext attack: can we achieve CCA security from any scheme satisfying only standard semantic security? What are the relations among the different notions of security for public key encryption? Tampering attacks: can we achieve security for various cryptographic applications when the adversary can tamper with the secret key, e.g. through fault attacks? Key exposure attacks: can we achieve security when the adversary can obtain the secret key? how to design and instantiate key evolving schemeswith optimal security and efficiency to limit damage caused by key exposure? We will seek both positive and negative results in the above areas, in order to better understand the relevant implications and requirements, and to obtain optimal solutions.