Automated Cryptographic Analysis of the Pedersen Commitment Scheme

TL;DR

This paper presents a formal, mechanised verification of the Pedersen commitment scheme, establishing its security properties and extending the EasyCrypt framework to support discrete logarithm and commitment abstractions.

Contribution

It introduces a novel formal verification of Pedersen commitments and extends EasyCrypt to facilitate reasoning about discrete logarithms and commitment protocols.

Findings

Proved correctness, perfect hiding, and computational binding of Pedersen commitments.

Extended EasyCrypt framework to support discrete logarithm and commitment abstractions.

Facilitates future verification of complex cryptographic protocols.

Abstract

Aiming for strong security assurance, recently there has been an increasing interest in formal verification of cryptographic constructions. This paper presents a mechanised formal verification of the popular Pedersen commitment protocol, proving its security properties of correctness, perfect hiding, and computational binding. To formally verify the protocol, we extended the theory of EasyCrypt, a framework which allows for reasoning in the computational model, to support the discrete logarithm and an abstraction of commitment protocols. Commitments are building blocks of many cryptographic constructions, for example, verifiable secret sharing, zero-knowledge proofs, and e-voting. Our work paves the way for the verification of those more complex constructions.

Equations

$$\begin{array}{rl}\text{mbox}\text{em}(perfecthiding)& \mathrm{Pr}\left[{\mathrm{HExp}}_{\mathcal{U},\pi }\left(n\right)=1\right]=\frac{1}{2}\\ \text{mbox}\text{em}(computationalhiding)& \exists \mu \left(n\right).\mathrm{Pr}\left[{\mathrm{HExp}}_{\mathcal{U},\pi }\left(n\right)=1\right]\le \frac{1}{2}+\mu \left(n\right)\end{array}$$

$$\begin{array}{rl}\text{mbox}\text{em}(perfectbinding)& \exists \mu \left(n\right).\mathrm{Pr}\left[{\mathrm{BExp}}_{\mathcal{B},\pi }\left(n\right)=1\right]=0\\ \text{mbox}\text{em}(computationalbinding)& \exists \mu \left(n\right).\mathrm{Pr}\left[{\mathrm{BExp}}_{\mathcal{B},\pi }\left(n\right)=1\right]\le \mu \left(n\right)\end{array}$$

$$\forall \mathcal{U}.\mathrm{Pr}\left[{\mathrm{HExp}}_{\mathcal{U},\mathrm{Ped}}\left(\mathbb{G},q,g\right)=1\right]=\frac{1}{2}$$

$$\forall \mathcal{U}.\mathrm{Pr}\left[{\mathrm{HExp}}_{\mathcal{U},\mathrm{Ped}}\left(\mathbb{G},q,g\right)=1\right]=\mathrm{Pr}\left[{\mathrm{HInterm}}_{\mathcal{U},\mathrm{Ped}}\left(\mathbb{G},q,g\right)=1\right]$$

$$\forall \mathcal{U}.\mathrm{Pr}\left[{\mathrm{HInterm}}_{\mathcal{U},\mathrm{Ped}}\left(\mathbb{G},q,g\right)=1\right]=\frac{1}{2}$$

$$\forall \mathcal{B}.\exists \mu \left(n\right).\mathrm{Pr}\left[{\mathrm{BExp}}_{\mathcal{B},\mathrm{Ped}}\left(\mathbb{G},q,g\right)=1\right]\le \mu \left(n\right)$$

$$x=\frac{d-d^{\prime }}{m^{\prime }-m}.$$

$$\begin{array}{rl}\forall \mathcal{B}.\mathrm{Pr}\left[{\mathrm{BExp}}_{\mathcal{B},\mathrm{Ped}}\left(\mathbb{G},q,g\right)=1\right]& =\mathrm{Pr}\left[{\mathrm{DLog}}_{\mathcal{A}(\mathcal{B})}\left(\mathbb{G},q,g\right)=1\right]\end{array}$$

$$\forall \mathcal{B}.\exists \mu \left(n\right).\mathrm{Pr}\left[{\mathrm{BExp}}_{\mathcal{B},\mathrm{Ped}}\left(\mathbb{G},q,g\right)=1\right]\le \mu \left(n\right)$$

Full text

1 Introduction

The high and increasing volume of communication exchanged through insecure channels, e.g. the Internet, confers increasing significance on security guarantees of cryptographic protocols. However, the increasing complexity in the design of cryptographic protocols leads to more complex and long proofs, making them error-prone and difficult to check. In fact, it happened that protocols believed to be secure, even for years, were found to be vulnerable to attacks after further investigation [25, 2, 16, 34]. As a result, it is highly desirable to have tools that can formally and automatically verify cryptographic protocols. Recently, many tools have been developed based on different approaches for this purpose [27, 26, 22, 3, 9, 18]. They have been proven to be effective in verifying security properties and finding attacks.

Most of the automatic tools aiming to aid proofs for cryptographic protocols [24, 29, 15, 33, 36, 17, 6, 37, 20, 32, 28, 5, 34] work in the symbolic model, some providing computational soundness for special cases [7], while only few support the computational model [14, 12, 11, 4]. The symbolic model [19] describes the real world cryptographic protocols abstractly. Messages are literals, therefore it is difficult to model partial leakage. Cryptographic primitives are assumed to be perfect and used as black boxes, which is not realistic. The adversaries strategies are often predefined and limited to the inference rules provided, therefore the proofs are limited to case-by-case reasoning [8]. This overly simplistic way can capture errors in the logic of the design, but cannot fully describe situations in which the cryptographic primitives cannot be treated as black boxes and when the security properties are defined computationally, which is often true in cryptographic protocols and other fields of cryptography. On the contrary, the computational model is more realistic when modelling cryptographic protocols and can capture many low level details which are needed in proofs. Cryptographic primitives are secure in the sense that computationally bounded adversaries can break the security properties with only a negligible probability, if certain assumptions hold. Messages are bit strings and adversaries can be any polynomial time probabilistic Turing machine. Therefore, it allows for reasoning with probabilities and cryptographic assumptions. This allows for rigorous proofs that cannot be obtained in the symbolic model.

In this paper we focus on proving properties of commitment schemes. Commitment schemes are a cryptographic primitive that have been widely used by its own or as a building block in other protocols, for example, verifiable secret sharing, zero-knowledge proofs, and e-voting [30, 21, 35]. The high level concept behind commitment protocol is intuitively simple, a committer wants to commit to a message, while keeping it secret from a receiver until a later time when the committer reveals the message to the receiver. In this paper we prove the security properties of the popular Pedersen commitment scheme [31]. To the best of our knowledge, this is the first mechanised formalisation of this protocol.

Despite being a basic primitive in secure computation, to formalise it and have a computer generated proof is far from trivial. In the security proof generated by humans, many small gaps are left by the prover as they are easy to prove. However, for a machine the gaps can be huge and extra efforts need to be spent to let the machine complete the proof. In particular, to prove the perfect hiding property, we created a sequence of games that vary slightly to allow the machine to carry on the proof. This additional construction is totally absent from proofs in the original paper and textbooks. In addition, to prove computational binding, we constructed a discrete logarithm game to allow for reduction.

The paper is organised as the following: in Section 2 we review the related work. In Section 3, we introduce the preliminaries. We then describe the formal proofs in relation to the constructions, in Section 4. In Section 5 we conclude and discuss possible future work.

2 Related work

To avoid the limitations of symbolic model tools and capture all the properties of the cryptographic primitive, we used a tool allowing for reasoning in the computational model. Some frameworks are available to work in such a model. CryptoVerif [14] is based on concurrent probabilistic process calculus. Although it is highly automatic, it is limited to prove properties related to secrecy and authenticity. The tool gga$\infty$ [4] specialises in reasoning in the generic group model and seems promising when attackers have access to random oracles, which does not apply to our setting. Certicrypt is a fully machine-checked language-based framework built on top of the Coq proof assistant [12]. However it is no longer maintained. EasyCrypt [11] follows the same approach as CertiCrypt and supports automated proofs as well as interactive proofs that allow for interleaving both program verification and formalisation of mathematical theories. This is desirable because they are intimately intertwined when formalising cryptographic proofs, and can leave the tedious parts of proofs to machines.

Recently, a machine-checked formalisation of \textSigma-protocols to prove statements about discrete logarithms has been developed in CertiCrypt [13]. A commonality between the work in [13] and our work is that the Schnorr protocol proved in [13] is also based on the discrete logarithm assumption.

3 Background

3.1 Commitment Protocols

Commitment protocols are two-party schemes between a committer $C$ and a receiver $R$, and run in two phases. Let $M$ be the space of messages to commit to. The first phase is called commitment phase, where the party $C$ sends $R$ its commitment for a private message $m\in M$ and secretly holds an opening value. The second phase is called verification phase, where the party $C$ sends $R$ the original message $m$ along with the opening value, so that $R$ can verify that the message committed in the first phase was indeed $m$.

Commitment protocols involve three efficient algorithms: (i) $\mathcal{G}\left(1^{n}\right)$ which outputs a public value $h$, (ii) $\mathcal{C}\left(h,m\right)$ which takes as input the public value $h$ and the message $m$, and outputs $\left(c,d\right)$ where $c$ is the commitment to send in the first phase and $d$ is the opening value to be send in the second phase, and (iii) $\mathcal{V}\left(h,m,c,d\right)$ which takes as input the public value $h$, the message $m$, the commitment $c$ and the opening value $d$, and outputs true if verification succeeds or false otherwise. Let $\pi=(\mathcal{G},\mathcal{C},\mathcal{V})$ be a commitment scheme, its security properties are (i) correctness, i.e. for every message the commitment generated is valid, (ii) computational or perfect hiding, where any attacker cannot learn information from the commitment $c$ about the message $m$ with any advantage (perfect), or with a negligible advantage (computational), and (iii) computational or perfect binding, where the message $m$ is uniquely bound to $c$ (perfect) or finding another message with the same commitment has negligible probability of success (computational). We defer the formal definitions of these properties to Section 4.

3.2 Reasoning in EasyCrypt

We present a brief overview of EasyCrypt. More information about Easycrypt and the syntax of its language can be found in [10, 1]. Those who are familiar with EasyCrypt can skip the rest of this section.

EasyCrypt handles the computational model, in which adversaries are probabilistic algorithms. To capture this, we have modules that are containers of global variables and procedures. Procedures capture the idea of algorithm, and one can reason about procedures running in a memory (as an execution environment). In the computational model, one has to reason about the probability of adversaries returning some specific results. EasyCrypt captures this idea as the probability of running a procedure $M.c$ in a memory $m$ with post-condition $Q$ evaluating true, where $M$ is the module containing the procedure $c$, written as

Pr[$M.c$($\dots$) @ &$m$ : $Q$]

To express and to prove properties, in EasyCrypt we use judgements (assertions) in (i) basic higher-order logic for implemented theories, (ii) Hoare logic (HL), (iii) probabilistic Hoare logic (pHL), and (iv) probabilistic relational Hoare logic (pRHL). For the last three of them, there are concepts of pre-condition $P$ and post-condition $Q$, as well as procedures $M.c$, $M.c_{1}$, $N.c_{2}$, …, inside modules $M$, $N$, running in some memory $m$.

HL

hoare[$M.c$ : $P\Rightarrow Q$] - When $P$ is true relating to some memory $m$ and $M.c$ terminates in $m$, then after running $M.c$, $Q$ always evaluates to true in the (modified) memory.

pHL

phoare [$M.c$ : $P\Rightarrow Q$] < $r$ - When $P$ is true relating to some memory $m$ and $M.c$ terminates in $m$, then after running $M.c$, $Q$ evaluates to true in the (modified) memory with probability less than $r\in\left[0,1\right]\subset\mathbb{R}$. Other supported relations are the common relations $=$, $>$, $\geq$, and $\leq$.

pRHL

equiv[$M.c_{1}\sim N.c_{2}$ : $P\Rightarrow Q$] - When $P$ is true relating to some memory $m$ and $M.c_{1}$ and $N.c_{2}$ terminate in $m$, then after running them in two separate copies of $m$, $Q$ always evaluates to true in the corresponding memories.

In cryptography, security is usually defined by requiring certain properties to hold for all adversaries. To capture the for all quantifier, in EasyCrypt, adversaries are defined with abstract procedures, which means the adversaries can do anything without any prescribed strategies. Working with abstract procedures may require to assume their termination. In Easycrypt, the idea of termination is modelled by the keyword islossless. We can declare a procedure to be lossless using the following syntax:

islossless $M.c$

The statement is defined as a pHL judgement phoare[$M.c$ : ${\tt T}\Rightarrow{\tt T}$] = 1%r, which means the procedure M.c always returns and terminates with a probability 1 (1%r means real number 1).

All the above constructions are useful for our formalised proof. In particular, to prove the correctness we used a HL judgement, to prove perfect hiding we used both pRHL to compare the hiding experiment with an artificial experiment and a pHL to finalise the proof, and to prove computational binding we used a pHL judgement to compare the binding experiment to the discrete logarithm experiment.

4 Formal Verification of Pedersen Commitment Scheme

In this section we show how we modelled the generic commitment scheme and its security properties, the Pedersen commitment scheme and we proved its security properties of correctness, perfect hiding and computational binding.

4.1 Modelling the Scheme

The abstract commitment scheme is modelled by the following few lines, prototyping the algorithms introduced in Section 3.1:

⬇

module type CScheme = { ( Abstract commitment scheme )

proc gen() : value

proc commit(h: value, m: message) : commitment * openingkey

proc verify(h: value, m: message, c: commitment, d: openingkey) : bool

}.

The Pedersen commitment protocol runs between a committer $C$, holding a secret message $m\in\mathbb{Z}_{q}$ to commit to, and a receiver $R$ who agrees on the group $\left(\mathbb{G},q,g\right)$, where $q$ is the order of $\mathbb{G}$ and $g$ is its generator, and is defined as the following:

Commitment phase

• •

$R$ samples a value $h\in_{\mathrm{R}}\mathbb{G}$ and sends $h$ to $C$.

• •

$C$ samples an opening value $d\in_{\mathrm{R}}\mathbb{Z}_{q}$, computes the commitment $c=g^{d}h^{m}$, and sends $c$ to $R$.

Verification phase

• •

$C$ sends the pair $\left(m,d\right)$ to $R$.

• •

$R$ checks whether $g^{d}h^{m}$ matches to the previously received commitment $c$, and either accepts if they match or reject if the do not.

We model the protocol in EasyCrypt as the following:

⬇

module Ped : CScheme = { ( Implements a CScheme )

proc gen() : value = {

**var** x, h;

x =$ FDistr.dt; *(* This randomly samples an element in the field Z_q *)*

h = g^x; *(* g is globally defined from the cyclic group theory *)*

**return** h;

}

proc commit(h: value, m: message) : commitment * openingkey = {

**var** c, d;

d =$ FDistr.dt;

c = (g^d) * (h^m);

**return** (c, d);

}

proc verify(h: value, m: message, c: commitment, d: openingkey) : bool = {

**var** c';

c' = (g^d) * (h^m);

**return** (c = c');

}

}.

4.2 Formalising security properties

The security properties we want to prove are correctness, hiding and binding. The properties are captured by experiments, which are formally defined below and modelled as in Fig. 1.

Definition 1 (Correctness)

A commitment protocol $\pi$ defined by the triplet $\left(\mathcal{G},\mathcal{C},\mathcal{V}\right)$ is correct if for all messages $m\in M$ to commit, let $h=\mathcal{G}\left(1^{n}\right)$ and $(c,d)=\mathcal{C}\left(h,m\right)$, then $\mathcal{V}\left(h,m,c,d\right)=1$.

Loosely speaking, the verification done by the algorithm $\mathcal{V}$ of any message $m$ committed using the algorithm $\mathcal{C}$ will always succeed.

For hiding and binding, we have two different adversaries: (i) the unhider $\mathcal{U}$, which plays the hiding experiment and has two abstract procedures, one to choose a pair of messages, and another to guess which of the two messages corresponds to a given commitment; (ii) the binder $\mathcal{B}$, which plays the binding experiment and has only a procedure to output two different pairs (message, opening value) that bind to the same commitment.

Definition 2 (Hiding)

Let $\pi=\left(\mathcal{G},\mathcal{C},\mathcal{V}\right)$ be a commitment protocol. Then we can define the hiding properties for each polynomial time adversary $\mathcal{U}$.

[TABLE]

where $\mu\left(n\right)$ is a negligible function.

Hiding experiment. The hiding experiment $\mathrm{HExp}_{\mathcal{U},\pi}$ runs as follows:

• •

The adversary is given the output of $\mathcal{G}$ and asked to choose two messages,

• •

the experiment randomly selects one of them and calls $\mathcal{C}$ to compute its commitment,

• •

the adversary is asked to guess which one of the two messages the commitment corresponds to, and finally

• •

the experiments outputs $1$ if the guess of the adversary is correct.

A commitment protocol satisfies the hiding security property if no adversary exist such that the probability of winning the hiding experiment is (significantly) better than a blind guess. If this is true, the committer is guaranteed that no information can be inferred by the commitment itself.

Definition 3 (Binding)

Let $\pi=\left(\mathcal{G},\mathcal{C},\mathcal{V}\right)$ be a commitment protocol. Then we can define the binding properties for each polynomial time adversary $\mathcal{B}$.

[TABLE]

where $\mu\left(n\right)$ is a negligible function.

Binding experiment. The binding experiment $\mathrm{BExp}_{\mathcal{B},\pi}$ runs as follows:

• •

The adversary is given the output of $\mathcal{G}$ and asked to bind two messages to the same commitment value, then

• •

the experiment outputs $1$ if the two messages differ and the commitment is valid for both the messages, that is if both can be verified by calling $\mathcal{V}$.

A commitment protocol satisfies the binding security property if no adversary exist such that the probability of winning the binding experiment is higher than negligible. If this is true, the receiver is guaranteed that the value committed cannot be changed.

4.3 Proofs

Relating to the properties modelled in Section 4.1, the Pedersen commitment scheme security properties we have to prove are correctness, perfect hiding, and computational binding. These security properties rely on the existence of a group $\left(\mathbb{G},q,g\right)$ in which the discrete logarithm is hard to compute (discrete logarithm assumption).

Correctness. Correctness in EasyCrypt is formalised with a HL judgement: hoare[ Corr(Ped).main : ${\tt T}\Rightarrow$ res]. Its proof is straightforward. The first step is to unfolding the definition of Corr(Ped).main, which is the correctness algorithm described in Fig. 1 instantiated with Ped illustrated in Section 4.1. Then we have $c=g^{d}h^{m}$ and $c^{\prime}=g^{d}h^{m}$ which are always equal.

Perfect hiding. In the Pedersen protocol we prove the perfect hiding:

[TABLE]

In EasyCrypt, we modelled it with the following lemma:

⬇

lemma perfect_hiding: forall (U <: Unhider) &m,

islossless U.choose $\Rightarrow$ islossless U.guess $\Rightarrow$

Pr[HExp(Ped, U).main() @ &m : res] = 1%r / 2%r.

Where U <: Unhider is the adversary $\mathcal{U}$ with abstract procedures choose and guess, of which we needed to assume they terminate islossless U.choose and islossless U.guess.

Perfect hiding can be proved by comparing the hiding experiment to an intermediate experiment in which the commitment is replaced by $g^{d}$ which contains no information about $m_{b}$. The experiment is described in Fig. 2.

We prove it by first showing that for all adversaries, the probability of winning the hiding experiment is exactly the same as winning the intermediate experiment.

[TABLE]

In code,

⬇

lemma phi_hinterm (U<:Unhider) &m:

Pr[HExp(Ped,U).main() @ &m : res] = Pr[HInterm(U).main() @ &m : res].

To prove that, we unfold the two experiments in a pRHL judgement. The first experiment is automatically instantiated by EasyCrypt as follows:

The proof is done by comparing the execution of the two experiments and is based on the fact that the distribution of $h^{m_{b}}g^{d}$ is taken over $g^{d}$.

Then, we proved that for all adversaries, the probability of winning the intermediate experiment is exactly a half.

[TABLE]

In EasyCrypt, we have:

⬇

lemma hinterm_half (U<:Unhider) &m:

islossless U.choose $\Rightarrow$ islossless U.guess $\Rightarrow$

Pr[HInterm(U).main() @ &m : res] = 1%r/2%r.

Combining the two lemmas, by transitivity, we prove perfect hiding for Pedersen commitment protocol as in equation (1).

Computational binding. For the Pedersen protocol, we prove the computational binding property.

[TABLE]

where $\mu\left(n\right)$ is a negligible function. The proof is done by a reduction to the discrete logarithm assumption. In cryptography, proof by reduction usually means to show how to transform an efficient adversary that is able to break the construction into an algorithm that efficiently solves a problem that is assumed to be hard. In this proof, the problem assumed to be hard is the discrete logarithm problem [23, p. 320]. We show that if an adversary can break the binding property, then it can output $\left(m,d\right)$ and $\left(m^{\prime},d^{\prime}\right)$ such that $g^{d}h^{m}=g^{d^{\prime}}h^{m^{\prime}}$. If this is true then the discrete logarithm of $h=g^{x}$ can be computed by

[TABLE]

We capture the reduction by two modules in EasyCrypt (Fig. 3). A small technical subtlety is that since the adversary is abstractly defined, it can return $m=m^{\prime}$ with some probability. This can cause division by zero. Therefore, we check the output from the adversary to avoid it. Formally, the adversary assumed to break the binding experiment is $\mathcal{B}$ and we construct an adversary $\mathcal{A}$ to break the discrete logarithm experiment with equal probability of success:

[TABLE]

The above is captured in EasyCrypt by the lemma:

⬇

lemma computational_binding: forall (B <: Binder) &m,

Pr[BExp(Ped, B).main() @ &m : res] =

Pr[DLog(DLogAttacker(B)).main() @ &m : res].

To prove the lemma, we unfolded the experiments as much as possible, i.e. up to abstractions, in a pRHL judgement which created an equivalence of the two experiments in the sense illustrated in Section 3.2. The binding experiment is automatically unfolded to the following.

The automatic tactics could not automatically prove the lemma, as the expression $\left(d-d^{\prime}\right)/\left(m^{\prime}-m\right)$ used by the attacker $\mathcal{A}$ (modelled as DLogAttacker) in the DLog experiment was too complex to be automatically used by the prover into the binding experiments and needed to be manually guided.

Assuming that the discrete logarithm is hard, then the probability of the experiment $\mathrm{BExp}_{\mathcal{B},\mathrm{Ped}}\left(\mathbb{G},q,g\right)$ returning $1$ must be negligible. Finally,

[TABLE]

which is the definition of computational binding we gave in equation (2).

5 Conclusion and future work

In this paper, we showed how EasyCrypt can be used for formally verifying practical cryptographic primitives and automatising mechanised proofs. With a game based approach, we could construct fully mechanised proofs of the security properties of the Pedersen commitment protocol, a building block primitive for many cryptographic protocols.

Composability is a desirable property of cryptographic protocols. When designing a protocol, we often want to guarantee that the composition of the protocol does not break the required security properties. In cryptography, advanced theories like Universal Composability have been proposed. As a future work, we will investigate how to enable machine-aided proofs for composability.