Revisiting Shared Data Protection Against Key Exposure

TL;DR

This paper introduces a new security model and encryption scheme for distributed data storage that remains secure even if the encryption key is exposed, reducing overhead and providing cryptographic proofs of security.

Contribution

It defines a novel security model for key exposure resilience, proposes a new encryption-then-sharing scheme with reduced overhead, and offers cryptographic proofs within this context.

Findings

New security model for key exposure scenarios

Encryption scheme with half the overhead of existing methods

Cryptographic proofs based on blockcipher resilience assumptions

Abstract

This paper puts a new light on secure data storage inside distributed systems. Specifically, it revisits computational secret sharing in a situation where the encryption key is exposed to an attacker. It comes with several contributions: First, it defines a security model for encryption schemes, where we ask for additional resilience against exposure of the encryption key. Precisely we ask for (1) indistinguishability of plaintexts under full ciphertext knowledge, (2) indistinguishability for an adversary who learns: the encryption key, plus all but one share of the ciphertext. (2) relaxes the "all-or-nothing" property to a more realistic setting, where the ciphertext is transformed into a number of shares, such that the adversary can't access one of them. (1) asks that, unless the user's key is disclosed, noone else than the user can retrieve information about the plaintext. Second, it introduces a new computationally secure encryption-then-sharing scheme, that protects the data in the previously defined attacker model. It consists in data encryption followed by a linear transformation of the ciphertext, then its fragmentation into shares, along with secret sharing of the randomness used for encryption. The computational overhead in addition to data encryption is reduced by half with respect to state of the art. Third, it provides for the first time cryptographic proofs in this context of key exposure. It emphasizes that the security of our scheme relies only on a simple cryptanalysis resilience assumption for blockciphers in public key mode: indistinguishability from random, of the sequence of diferentials of a random value. Fourth, it provides an alternative scheme relying on the more theoretical random permutation model. It consists in encrypting with sponge functions in duplex mode then, as before, secret-sharing the randomness.

Figures

Equations

$$AON(K,P)⟶S_1,\dots ,S_n.$$

$$\bigl{[}f(K,{IV}),f(K,{IV}+1),f(K,{IV}+2),\dots\bigr{]}\;.$$

$$[BC(IV),BC(IV+1),\dots ,BC(IV+c-1)]\in (F_2^{|B|}{)}^c$$

$$C=[C_0,\dots ,C_{c-1}]\in ({\mathbf{F}}_2^{|B|}{)}^c$$

$$C^{\prime }:=C\cdot \left(\begin{array}{cccccc}[cccccc]1& 0& 0& 0& .& 0\\ 1& 1& 0& 0& .& 0\\ 0& 1& 1& 0& .& 0\\ 0& 0& 1& 1& .& 0\\ 0& 0& 0& 1& .& 0\\ .& .& .& .& .& .\\ 0& 0& 0& 0& .& 1\end{array}\right)$$

$$\overrightarrow{Dif{f}_r}:=\sigma (r)+\sigma (r+1),\sigma (r)+\sigma (r+2),\dots ,\sigma (r)+\sigma (r+c-1)$$

$$C^{\prime }:=C\cdot Ma{t}^{SSAKE}$$

$$C_i^{\prime }$$

$$C":$$

$$\overrightarrow{Diff_{IV}}+\bigl{(}P_{1}^{(b)},\dots,P_{c-1}^{(b)}\bigr{)}$$

$$\overrightarrow{Pad^{Bastion}_{(s,t,u)}}=\Bigl{(}{BC}(C_{0}+s)+{BC}(C_{0}+t)+{BC}(C_{0}+u)\,,\\ \bigl{\{}{BC}(C_{0}+u)+{BC}(C_{0}+i)\bigr{\}}_{i\in\{0,n-1\},i\notin\{s,t,u\}}\Bigr{)}$$

$$C:={IV}||\Bigl{(}\mathcal{O}_{c-1}(K||{IV})+P\Bigr{)}$$

$$\text{on input $\mathcal{L}$, return: }\bigl{[}{BC}^{2}_{\mathcal{L}}(1),{BC}^{2}_{\mathcal{L}}(2),{BC}^{2}_{\mathcal{L}}(3),\dots\bigr{]}$$

$$\widetilde{C_i}$$

$$\widetilde{C_j}$$

$$C^{\prime }=C\cdot \left(\begin{array}{ccccccc}[cc|ccccc]0& 1& 1& 1& 1& 1& 1\\ 1& 0& 1& 1& 1& 1& 1\\ 1& 1& 0& 1& 1& 1& 1\\ 1& 1& 1& 0& 1& 1& 1\\ 1& 1& 1& 1& 0& 1& 1\\ 1& 1& 1& 1& 1& 0& 1\\ 1& 1& 1& 1& 1& 1& 0\end{array}\right)$$

$$C{"}_{i\ge 3}:=C_i^{\prime }+C_2^{\prime }$$

$$C{"}_2:=C_2^{\prime }+\sum _{i\ge 3}C{"}_i$$

$$C"=C\cdot \left(\begin{array}{ccccccc}[cc|ccccc]0& 1& 1& 0& 0& 0& 0\\ 1& 0& 1& 0& 0& 0& 0\\ 1& 1& 1& 1& 1& 1& 1\\ 1& 1& 0& 1& 0& 0& 0\\ 1& 1& 0& 0& 1& 0& 0\\ 1& 1& 0& 0& 0& 1& 0\\ 1& 1& 0& 0& 0& 0& 1\end{array}\right)$$

Full text

We then introduce two novel schemes that match our —all storage places or nothing— security level of secret sharing under key exposure. The first one is based on standard block cipher encryption. The second one fits both in the random oracle model (e.g. Keccak) or in the idealized blockcipher model with twice larger key than the security parameter (e.g. an idealized AES256 would achieve 128 bits security). The first one reduces by half the amount of the processing required to be done in addition to data encryption with regard to the fastest state-of-the-art solution, whereas the second one completely eradicates additional processing. We confirm the complexity results by presenting a performance evaluation.

A non-negligible part of our contribution lies in the provided security analysis. In addition to giving security proofs for our schemes, we revisit the ones of previous work and point out structural weaknesses in a context of key exposure.

Keywords— Distributed storage security, computational secret sharing, cloud storage security, data protection, all-or-nothing encryption, confidentiality under key exposure.

1 Introduction

Ensuring confidentiality of data at rest is mostly achieved by its encryption using a symmetric cipher. However, even the strongest algorithm will protect data only as long as the key remains secret to attackers. Secure key management is the obvious countermeasure to that problem but its good implementation is not so straightforward and may very well be very costly. The problem of reinforcing data confidentiality against weak or leaked keys exists in the literature since almost three decades Rivest (1997b). Nowadays, the emergence of new powerful attackers puts this problem into a new light Karame et al. (2018).

As data are often outsourced and managed externally, key exposure origins may be manifold. First, it may be the result of bad key generation, for instance because of the use of hard-coded keys or backdoors in the key generation software Cohney et al. (2018); Karame et al. (2018). Second, the key may be revealed because of its poor management (the risk of bad key management increases in a situation where multiple users share same data and the same key). Third, with the time passing, the key length may become not sufficient anymore for always more powerful adversaries acquiring enough computational capabilities. Last but not least, an encryption key may simply be lost, stolen, or obtained as the result of bribery or coercion.

A classical way of reinforcing encrypted data confidentiality and protecting it against key exposure consists in encrypting the data in such a way that an adversary obtains no information unless she has the totality of the ciphertext, plus a secret encryption key: this property is denoted as all-or-nothing (AON). Key exposure resilient secret sharing schemes can thus be derived from schemes with this property. However, we observe that former all-or-nothing works (as the classical Rivest’s or Desai’s schemes Rivest (1997b)) are not efficient because they require two rounds of encryption: the first one to achieve the all-or-nothing property, and the other one to encrypt. Also, a more recent work Karame et al. (2018) gets rid of this twice-encryption requirement, at the cost of a linear post-processing of the encrypted file. But it appears that its security proofs are based on the assumption that an adversary could not distinguish between a piece of a ciphertext —of which she chose the plaintext— and pure randomness. We will detail that this assumption is not holding in the mainstream encryption schemes that the paper Karame et al. (2018) uses, such as blockciphers in counter mode. Thus, we are left with an important question:

How can we efficiently protect encrypted data against key exposure, since we believe that the risk of key exposure is impossible to completely eradicate ?

By efficiently we mean with no additional encryption layer. We discuss the general technical challenges raised by this problem throughout our paper: in §4.3, at the end of 4.5, in §4.7 and in §6.2. The good news is that distributed storage provides us with an additional security ingredient - data fragmentation and dispersal - enabling us to address the key exposure threat. On the other hand, it seemed to us that all the previous schemes address an over constraining security model, where the adversary selects all the ciphertext blocks that she wants to see (up to a certain quantity). Guided by a practical secure storage purpose, we think that the relevant parameter is instead the number of shares containers or storage sites that an adversary is able to access to. Therefore, another question: In a threat model where an adversary fully accesses a certain number of storage sites, can we achieve the same security level as the existing AON schemes with more efficiency?

As will become clear, we are facing a tradeoff. Either we could follow the approach of Bastion Karame et al. (2018) and use mainstream encryption, then fix the issue of non-pseudorandomness by an additional post-processing. Or we could strive to design encryption schemes that directly have a pseudorandom behavior under key exposure:

Can we find efficient encryption schemes where any large fraction of the ciphertext looks pseudo-random even in a situation of key exposure? And for mainstream encryption, how far can we reduce the necessary post-processing overhead to achieve this goal?

We address the second question by revisiting the security model for encrypted data protection against key exposure in a distributed environment such as cloud composed of several storage sites or multi-cloud with independent storage providers. Instead of taking the previous AON threat model (described in Karame et al. (2018)) in which an adversary is able to compromise a given number of any ciphertext blocks, we present a new model taking as parameter the number of compromised servers or sites. Such a change is motivated by the fact that an adversary able to compromise one ciphertext block in a given storage site has necessarily been able to acquire enough access rights to also be able to compromise other data stored in the same site by the same user, containing the said compromised ciphertext blocks. In particular, we match the same security level as the recently introduced CAKE Karame et al. (2018) model, in our context where the adversary accesses full shares.

This re-adjustment of the security model allows us to propose new secret sharing schemes with the all-or-nothing property that are faster than the state-of-the-art propositions. First, we introduce a scheme based on classical symmetric encryption with a block cipher in the counter mode. It reduces by half the complexity of the post-processing when compared with the fastest relevant work, which is Bastion’s scheme Karame et al. (2018). We show then how to totally get rid of the post-processing by switching to a scheme based on less mainstream encryption with random oracles. We give two efficient instantiations of it: from ideal blockciphers with twice larger keys (e.g. AES256 would provide a security parameter of 128), and from ideal sponge functions (e.g. Keccak). The price to pay for our new schemes improvements is a slight storage overhead, of $n-1$ times the keysize (of e.g. 128 bits, for an overall 128 bits level of security), where $n$ is the number of storage sites.

Apart from complexity and performance improvements, the main contribution of this work is a deep security analysis of the computational secret sharing schemes in a situation of key exposure. We revisit the previously proposed security proof of Karame et al. (2018) and single out a sufficient hypothesis under which its security is guaranteed. At the same time, we evidence that the classical proof structure for indistinguishability of plaintext encryptions, which proceeds by reduction to a distinguisher between an implemented keyed function and an idealized one, breaks down in presence of key leakage. This thus motivates the completely different approach in our proofs, which crucially rely on the fact that an idealized blockcipher with leaked key, still behaves as an ideal permutation. To match this ideal behavior in practice, it is important that the leaked key should have been chosen sufficiently at random in the first place. The proof of our alternative scheme in the random oracle model is actually much simpler, and provides a more efficient scheme.

In conclusion, our work comes as both two scalable and fast secret sharing schemes, and a complement to key management recommendations provided, for instance, by the NIST Barker (2016).

Detailed outline In Section 2 we present basic definitions, data structures, and notations used all along this paper. In Section 3, we present related works from the domains of secret sharing and all-or-nothing encryption as well as point out their limitations. In Section 4, we introduce a new security model (denoted as SAKE) and show that, under our storage site-by-storage site threat model, it is as secure as the more constraining one introduced recently in Karame et al. (2018). We finally highlight the main technical challenges of one-round encryption under key exposure, which to our knowledge we are the first ones to properly address. In Section 5, we illustrate the relevance of our approach by describing a new scheme (denoted as ${SSAKE}$) providing protection against key exposure that reduces the complexity of the post-encryption processing by half with regard to the state-of-the-art fastest scheme. In Section 6, we do not only present its security proof but also revisit the security analysis of a recent relevant scheme. As an alternative to our ${SSAKE}$ scheme, in Section 7, we introduce a scheme (denoted as $ROSSake$) that totally gets rid off the additional post-processing overhead, and describe both an instantiation using blockciphers, and also implement it with Keccak. Before concluding in Section 9 , Section 8 focuses on comparisons between our two new proposals and the state-of-the art techniques in terms of complexity, memory occupation, and verification of security properties. Complexity results are confirmed by performance evaluation.

2 Basic Definitions and Notations

We identify the following definitions and basic data structures that mostly correspond to classical concepts concerning block cipher encryption and computational secret sharing scheme. Our main unit of length is a block, which is a sequence of bits of size ${|B|}$, where ${|B|}$ is our security parameter. All secret keys $K$, headers, initialization vectors ${IV}$ etc. will be of length one block, such as the inputs/outputs $P_{i}$/$C_{i}$ of the blockciphers ${BC}$ that we will consider111Notwithstanding, our blockcipher instantiation of $ROSSake$ will use a blockcipher with two-blocks-long key $\mathcal{L}:=(K||{IV})$, where $K$ is the actual one-block-long key of our final scheme. But the blockcipher itself will still process with one-block long inputs and outputs $P_{i}$ and $C_{i}$: e.g. AES256, which processes 128 bits blocks.. Thus, a block is necessarily small, compared to shares (see Dworkin (2001) and below) which can be much bigger (we focus on large data protection as perfect secret sharing instead of symmetric encryption can be applied for small data, solving the problem of key exposure). We note $+$ or $\oplus$ the XOR operation between two blocks, which is the sum of binary vectors in $\{0,1\}^{|B|}=\mathbf{F}_{2}^{|B|}$. We will sometimes add a block with a number $i$ (typically the counter of CTR mode). By this abuse of notation, we simply mean the binary writing of the number $i$, seen as a vector in $\mathbf{F}_{2}^{|B|}$.

• •

Plaintext $P$: the data to be protected, $P$ is a sequence of $|P|$ bits and (in the context of block cipher encryption) of blocklength $c-1$ blocks $P_{i}$, where $i$ vary from $1$ to $c-1$. 222In Karame et al. (2018), indices are from $1$ to $m$ ($c=m+1$).

• •

Secret $K$, $IV$, and $r$: We distinguish three secret values. A secret key $K$ of size ${|K|}:={|B|}$ of one block, which will be never stored within the data and given only to the persons entitled to read the data (this will be abstracted out in our model). By contrast, the two other secret quantities $r$ or ${IV}$ (corresponding to a pseudorandom header/nonce or to an initialization vector) are stored in the storage sites, but in a secret-shared manner: they are ”mixed within the shares”.

• •

Ciphertext $C=Enc(P,K)=(C_{i})_{i}$: plaintext encrypted with a randomized keyed encryption scheme $Enc$. $C$ has a total bitsize of $|C|$ bits. If encryption was done using a blockcipher, then $C$ is a sequence of $c$ blocks. Indices of the $C_{i}$ vary from [math] to $c-1$. 333In Karame et al. (2018), they are noted $y^{\prime}_{1}$ to $y^{\prime}_{m+1=n}$, where $n$ denotes the number of blocks.

• •

Transformed ciphertext $C^{\prime}=(C^{\prime}_{i})_{i}$: in case when a linear transform is applied to the ciphertext $C$, the $C^{\prime}$ notation is used to distinguish between the ciphertext and the ciphertext after the transformation. 444In our ${SSAKE}$ scheme, indices of the $C^{\prime}_{i}$ vary from $1$ to $c-1$. Whereas in Karame et al. (2018) they are noted $y_{1}$ to $y_{m+1=n}$. In our $ROSSake$ scheme the transformed ciphertext $C^{\prime}$ just consists in the ciphertext $C$ where the initialization vector has been removed. Moreover, when compared to Karame et al. (2018), we reverted the primes between the $C$ and the transformed $C^{\prime}$; our $C^{\prime}$ is one block smaller; and our $C$ are of length $c$ instead of $n$ (the letter $n$ being reserved for the number of shares).

• •

Fragment $F_{i}$ for $i=1\dots,n$: we partition the transformed ciphertext into fragments $F_{i}$. For simplicity, if the transformed ciphertext is composed of $c-1$ blocks (or $|C|$ bits), then each $F_{i}$ is a group of $\frac{c-1}{n}$ consecutive blocks (or $\frac{|C|}{n}$ bits). We assume for convenience that $c-1$ and $|C|$ are divisible by the number of shares $n$.

• •

Share $S_{i}$ for $i=1\dots,n$: the shares are by definition all, and only all, what is stored in the storage sites. They typically consist in the above fragments, plus a share of some secret quantity ${IV}$. In any case, the shares never contain (to be precised) the secret key $K$. 555In Karame et al. (2018) shares are equal to the fragments.

• •

”All-or-nothing transform” $AON(K,P)$: randomized transformation mapping the plaintext $P$ into a set of $n$ shares $S_{1},\ldots,S_{n}$. It possibly uses a secret key $K$ as additional input. It also always uses a random input ${IV}$, that we do not make explicit in the input variables. It uses a public symmetric encryption scheme $Enc$ as an underlying mechanism. In our new security model, ”all-or-nothing” should be understood as ”all storage sites/shares”.

• •

Random oracle (RO): a function \mathcal{O}:\bigr{(}\mathbf{F}_{2}^{2{|B|}}\bigl{)}\longrightarrow\bigl{(}\mathbf{F}_{2}^{|B|}\bigr{)}^{\infty} of arbitrarily long output, and taking as input small seeds (for example two blocks: $\mathcal{O}(K||{IV})$). We note $\mathcal{O}_{c-1}$ for the oracle with output truncated to $c-1$ blocks. A key property of random oracles that we will use is that, when fixing the first input block $K$, the function $\mathcal{O}(K||\ast)$ is still a random oracle, this time of one-block input, moreover independent from all the other oracles $\mathcal{O}(K^{\prime}||\ast)$.

• •

Ideal keyed blockcipher ${BC}$: a symmetric encryption function that maps blocks to blocks.

Detailed definition of a random oracle $\mathcal{O}$ We refer to the definition presented in (Katz and Lindell, 2014, §13). When queried on a new input, $\mathcal{O}$ outputs a string of independent uniformly distributed bits, and when queried on a previously queried input, $\mathcal{O}$ returns the same output. We will use the fact that a RO satisfies in particular the strictly weaker property of being a pseudorandom generator —also known as (idealized) seeded pseudorandom number generator (PRNG) (Katz and Lindell, 2014, Definition 3.15). See 4.7 for a discussion of why the random-looking property of the output of a pseudorandom generator is in general not preserved when part of the seed is leaked, while the random-looking property of the output of a random oracle $\mathcal{O}$ is preserved even if part of the seed is leaked. This is the main technical subtlety of this paper, and the reason why we pay much care in security analyses under key exposure.

Keyed pseudorandom function/permutation (PRF/PRP) We refer to (Katz and Lindell, 2014, Definitions 3.24 & 3.26). A PRF $f$ is a function: $f:\mathbf{F}_{2}^{{|B|}}\times\mathbf{F}_{2}^{{|B|}}\longrightarrow\mathbf{F}_{2}^{{|B|}}$, such that when the first input component $K$ is chosen at random and fixed once for all, then the output of $f(K,{IV})$ on several randomly chosen secret ${IV}$ is indistinguishable from independent uniform random blocks.

Definitions of ideal keyed blockcipher and ideal random permutation Shannon’s perfect blockcipher model is an oracle ${BC}:\mathbf{F}_{2}^{|B|}\times\mathbf{F}_{2}^{|B|}\rightarrow\mathbf{F}_{2}^{|B|}$ such that, on every query with a new key $K$ (the first input component), it outputs a fresh new random permutation oracle ${BC}_{K}:\mathbf{F}_{2}^{|B|}\rightarrow\mathbf{F}_{2}^{|B|}$ Black et al. (2002). In turn, let us recall informally that a random permutation oracle (as assumed by the random permutation model: RPM) is a tuple of functions $\sigma,\sigma^{-1}:\mathbf{F}_{2}^{|B|}\rightarrow\mathbf{F}_{2}^{|B|}$ operating on blocks and inverse of each other. They have the following ideal behavior: on every input to $\sigma$ \bigl{\{}not queried to $\sigma$ nor output by $\sigma^{-1}$ before\bigr{\}}, then $\sigma$ outputs a value chosen uniformly at random among all values \bigl{\{}not output by $\sigma$ nor input to $\sigma^{-1}$ before\bigr{\}}; and the inverse oracle $\sigma^{-1}$ behaves accordingly in the other direction. These three ideal primitives (ideal BC, RO, and RPM) were recently proven to be equivalent to each other. 666Ideal BC is efficiently instantiable from RPM Lampe and Seurin (2013) and also from RO Holenstein et al. (2011). Finally, a RO with arbitrary long variable input and output can itself be instantiated from a sponge function calling an ideal random permutation Bertoni et al. (2008).

Chosen plaintexts indistinguishability ind1 and ind-CPA, polynomial adversary and negligible functions We consider an adversary $\mathcal{A}$ who can make a total number of queries which we note $M$. Let us define a negligible function as any fixed polynomial in ${|B|}$, $c$, and $M$ divided by $2^{{|B|}}$. Implicitely, this means that our adversary is polynomial. Thus what we will call a ”negligible event” should be understood as something which occurs with probability equal to a negligible function. Likewise, when we say that the adversary has ”negligible advantage” in a game, we mean that she wins it $50\%$ of the time, plus or minus a negligible percentage. With respect to these conventions, an encryption scheme with plaintexts indistinguishability under queries with one-shot keys —a.k.a. ind1— is defined in (Katz and Lindell, 2014, Definition 3.9). Indistinguishability under multiple queries with the same key, which we simply note ”ind-CPA”, is defined in (Katz and Lindell, 2014, Definition 3.22).

3 Related Work

This section presents an overview of methods reinforcing confidentiality by dispersing data over different storage sites.

Perfect secret sharing (PSS) Perfect secret sharing Blakley (1979); Shamir (1979) with threshold $m-1$ transforms data into a set of $n$ shares, $m$ of which are needed for data reconstruction. Strictly less than $m$ shares provide no information whatsoever about the initial data, so the information is protected against adversaries unable to collect the required threshold of $m$ shares. Shamir’s perfect secret sharing scheme (PSS) Blakley (1979); Shamir (1979) is information theoretically secure. This unconditional security comes at the cost of a $n$-fold increase in the volume of the data to be stored as each of the shares is of the size of the data itself.

Computational secret sharing (CSS) In it’s vanilla version, Krawczyk’s Secret Sharing Made Short Krawczyk (1994) consists in encrypting the plaintext, then dividing the ciphertext into $n$ fragments. Each storage site receives a ”share”, consisting in one fragment plus a share of the encryption key under a PSS with threshold $m-1$. In (Krawczyk, 1994, Theorem 3) this scheme is proven to be a secret sharing scheme with threshold $n-1$, under computational assumptions. As we detail later in §4.3, Krawczyk’s CSS breaks down under key exposure.

All-or-nothing encryption (AON) An all-or-nothing (AON) encryption makes the ciphertext decryptable only when complete. This security property can be achieved using a pre- or post-processing of encrypted data denoted as an all-or-nothing transform (AONT). A detailed overview of AON schemes can be found in Qiu et al. (2019).

For space constraint we defer to Appendix C the detail of Rivest’s AONT scheme, Boyko & Desai’s AONT schemes and formalization of what an AONT is. Although the definitions differ, one can roughly understand it is an efficiently invertible transformation such that, given two chosen plaintexts, an adversary knowing all but one blocks of their transforms, cannot distinguish between them. The transformation is composed of two encryption rounds using two different keys, only one of them will ne exposed.

Stinson Stinson (2001) formalized a linear all-or-nothing transform as an invertible matrix $Mat$ of size $n\times n$, that maps an ”unknown” input vector $X$ of length $x$ to a ”partially known” output vector $Y$, such that for each index $i$, and every missing coordinate $j$, an attacker who manages to learn all coordinates of $Y$ but $y_{j}$ will learn no more information on $x_{i}$ than what she knew a priori. However, we would like to emphasize that the standalone property of a linear AONT is not enough to obtain a cryptosystem. Indeed, as emphasized by Boyko in Boyko (1999) 777”However, the linear constructions of Stinson would definitely not be secure in that model, since it is easy to come up with linear relations among the elements of $X$ by looking at just a few elements of $\varphi(X)$ (in fact, since $\varphi(X)$ is linear and deterministic, every output of $\varphi(X)$ gives a linear relation on elements of $X$.”, an attacker may still learn correlations between unknown coordinates $x_{i}$, potentially ruining the ind-CPA security property of the ciphertext.

Recently introduced, Bastion scheme Karame et al. (2018) builds on a variant of Stinson’s linear AONT. The plaintext is first encrypted, then the ciphertext is transformed using a square matrix $Mat^{Bastion}$ such that: (i) all diagonal elements are set to 0, and (ii) remaining off-diagonal elements are set to 1.

As a result, each block of the ciphertext is XOR-ed with all other ciphertext blocks. The transformed ciphertext is then claimed to be protected against key exposure and all but two ciphertext blocks exposed (one more block than in the case of Stinson’s AONT). The advantage of Bastion’s approach is that they require only a single encryption round and thus is much faster than the Rivest’s initial proposal (see Figure 3).

4 Encryption under Key Exposure: Why a New Model?

We motivate in §4.1 our alteration of existing security models in order to address resiliency of shared data under key exposure, that we present in §4.2: $n$-Shares Access under Key Exposure, that takes as parameter $n$ the number of shares (=storage sites) instead of the amount of compromised blocks. Then in §4.3 we explain why previous schemes, such as Krawczyk’s SSMS, break down under this scenario of key exposure. We give $n$-$\mathrm{SAKE}$ a more formal definition in 4.4, that we relate to the classical ind-CPA security. In §4.5, we give a soft overview of the challenges to overcome to achieve efficient $n$-SAKE schemes, and discuss previous schemes achieving SAKE security. In 4.6 we compare SAKE to CAKE, and emphasize that they are equivalent against an adversary corrupting all but one storage sites. Finally in 4.7 we nail down the main technical subtlety that will make the difference between encryptions which are directly SAKE, and those which are not (and thus which will require extra post-processing).

4.1 Motivations

The state-of-the-art security model relevant for evaluating the security of a computational secret sharing scheme under key exposure was introduced in Karame et al. (2018) and is denoted as Ciphertext Access under Key Exposure (CAKE). A scheme is denoted to be $(c-\lambda)$ CAKE secure when it resists an attacker able to access any $(c-\lambda)$ blocks of the dispersed ciphertext as well as the encryption key. This model, inspired by all-or-nothing encryption, still does not take into account the fact that, once transformed, the ciphertext will be cut into $n$ shares containing a fraction of e.g. $\frac{c}{n}$ blocks each888We have different notations than (Karame et al., 2018, §3.1).. These shares will be then distributed over $n$ different storage sites or servers, preferably belonging to independent storage providers. Thus, the power given to the adversary to obtain any ciphertext blocks that she wants may be overkill in this context. The actual difficulty for an attacker lies in looking for and acquiring the totality of these dispersed shares, which is equivalent to compromising all the storage sites. Indeed, once an attacker compromises a storage site, she will be most probably able to acquire all the blocks of the share $S_{i}$ stored at this site  999A rare exception to this scenario would be in the case of a memory leak attack..

Motivated by the observation described above, we propose a relaxed security model, in which we want to protect the data shares against an attacker able to compromise all but one of the storage sites. This alteration in perspective allows us to design faster secret sharing schemes without in practice compromising on security.

4.2 Shares Access under Key Exposure: $n$-SAKE

We introduce now our threat model that addresses a scenario where data $P$ is transformed into $n$ shares $AON(K,P)=S_{i}$, $i=1,\ldots,n$ and these shares are then dispersed over $n$ storage sites. In this model, we can have two types of attackers. The first type of attackers (1) will be able to compromise all the storage sites and gather all the shares but will not be able to access the symmetric encryption key $K$. They are typically honest-but-curious cloud providers who would have access to all the shares. The second type of attacker (2) will be able to obtain the key, e.g. due to bad key management, but will not be able to compromise the totality of the storage sites.

We now formulate two security properties that characterize a scheme resisting the presented threat model:

Security property (1) - classical ind-CPA property: In the scenario where the adversary possesses all the shares but has no information about the key, we ask for the classical indistinguishability under Chosen Plaintext Attack (ind-CPA) as defined for instance in (Katz and Lindell, 2014, p. 74). 2. 2.

Security property (2) - ind-CPA property of all-but-one shares under key exposure: In the scenario where the attacker could get the key and get to all but one of the storage sites, we ask for the indistinguishability under chosen plaintext attack and under key exposure of the $n-1$ shares in possession of the attacker.

4.3 Comments on the $n$-SAKE definition

Property (1) is easy to match since it suffices to encrypt data using any scheme having the ind-CPA property before transforming them into shares and, most importantly , not to hide the encryption key within the shares. Indeed, if the key is secret shared and the key shares are attached or appended to the data shares, as in the case of Krawczyk’s SSMS in its original form, an attacker getting the shares will automatically get the encryption key. Similarly, in the case of Rivest’s or Desai’s AONT, the key can be recovered once the ciphertext is complete. So in all these schemes (1) doesn’t hold.

By contrast, property (2) will be much harder to achieve. Let us give a taste of why. Let us consider the Krawczyk’s CSS scheme where the data owner doesn’t ”mix” at all the encryption key within the shares, but instead keeps it for himself (and for the other persons accredited). Let us note $Enc$ the baseline encryption scheme used in Krawczyk’s and $K$ the secret key. Let us suppose informally that $Enc$ operates as a stream cipher, so that, given the key, the first blocks of the ciphertext can be decrypted into the first blocks of the plaintext. Now consider an adversary who manages to obtain this key $K$, and who chooses two plaintexts of same length which differ in their initial block. Then, this adversary can distinguish between these plaintexts as soon as she is given the share containing the initial blocks of the ciphertexts.

Notice that we guarantee nothing against an adversary who has access to all the shares and to the decryption key $K$. On the contrary, we ask for the plaintext to be efficiently reconstructible from these two ingredients. Additional means of protecting the plaintext are outside the scope of this paper.

4.4 Formal definition of $n$-SAKE security

We consider a public randomized keyed invertible transformation ”$AON$” that maps a plaintext $P$ to $n$ bit strings, that we call ”shares”:

[TABLE]

and such that the inverse is efficiently computable given all the shares and the key $K$. We don’t explicitly note here the random component of the input: ${IV}\in\{0,1\}^{|B|}$ of $AON$ used during the transform (e.g. the Initialization Vector in block cipher encryption, or the sponge header Bertoni et al. (2012) - at this point, we do not specify the encryption details). We say that $AON(\ast,\ast)$ is a $n$-$\mathrm{SAKE}$ transformation if and only if:

(1) The following encryption scheme is ind-CPA secure: select once for all a secret key $K$ at random, then on every plaintext $P$, output all the shares $AON(K,P)$.

(2) We now give a formal definition of the $n$-SAKE property (2) based on the classical ind-CPA game. Let us fix an encryption key $K$ that will be used by the ”$AON$” transform and that will be supposed from now on known to the adversary (as we want to deal with the case of a key leakage).

The polynomial adversary $\mathcal{A}$ has access at any time ($\mathcal{A}$ is said ”adaptive”) to an oracle which performs the encryption scheme $Enc$ applied inside of ”$AON$” (and its inverse $Enc^{-1}$) on any (or ciphertext) of $\mathcal{A}$’s choice. It also performs $AON$ (or its inverse) on any plaintext (or set of $n$ shares) of $\mathcal{A}$’s choice.

Here is the $n$-SAKE security game (2) between $\mathcal{A}$ and $\mathcal{O}$, that defines the ind-CPA security in the context of key exposure.

$\mathcal{A}$ outputs to $\mathcal{O}$ a pair of plaintexts $P^{0}$ and $P^{1}$ of the same length. 2. 2.

$\mathcal{O}$ chooses randomly a bit $b\in{0,1}$. 3. 3.

$\mathcal{O}$ performs the randomized transformation $AON(K,P^{b})$ that gives $n$ shares $S^{(b)}_{1},\ldots,S^{(b)}_{n}$. 4. 4.

$\mathcal{A}$ adaptively queries $n-1$ indices of shares and $\mathcal{O}$ gives them to her. 5. 5.

$\mathcal{A}$ outputs to $\mathcal{O}$ a bit $b^{\prime}$. 6. 6.

The output of the experiment is defined to be $1$ if $b=b^{\prime}$ and [math] otherwise. In the former case, we say that $\mathcal{A}$ succeeds.

If the adversary has no non-negligible advantage in this game, with respect to the length of one block ${|B|}$ as security parameter, then we say that the transformation $AON$ fulfills the property (2) of $n$-SAKE.

A careful reader will notice that if shares are badly chosen in some scheme, then this scheme cannot satisfy our (2) security requirement of $n$-$\mathrm{SAKE}$ (e.g. if a share is always empty, or two shares always equal, then an adversary can recover everything from $n-1$ shares). In this paper we care about designing schemes that are $n$-$\mathrm{SAKE}$, not schemes that are not.

4.5 How to design more efficient schemes?

As regards the random parameter ${IV}$, although it is classically put as a header of the ciphertext in classical ind-CPA encryption schemes, we just stressed in 4.3 that the security property (2) completely breaks down if the adversary recovers this random parameter. Indeed, she could then decipher the beginning of the ciphertext with this ${IV}$. So in particular, we have to hide it in a manner that any $n-1$ shares give no information about it.

Note that all previous all-or-nothing schemes are based on the same pattern: perform a first transform ”AONT”, which is an encryption where the encryption key is hidden within the ciphertext (in a more size-efficient way than in Krawczyk’s SSMS). Then encrypt a second time, this time with a key $K$ that is kept by the user. In particular, Rivest’s, Boyko’s and Desai’s AON verify the $n$-$\mathrm{SAKE}$ property with respect to the second key. In the Bastion Karame et al. (2018) scheme, as in our schemes, the Initialization Vector/random nonce ${IV}$ used during the encryption plays the role of the ”first key” ${IV}$ that is hidden within the ciphertext (Bastion) or shares (us). The real challenge in designing efficient schemes matching this double security objective (1) and (2), is to prevent attacks such as in §4.3. But just hiding the ${IV}$ within the shares is not enough, since parts of ciphertexts can be distinguished if the encryption has bad randomness properties under key exposure: see §6.2. This is why we will still need a (small) post-processing of the ciphertext in ${SSAKE}$.

4.6 Difference with the CAKE model

We point out here some remarks about the differences between the CAKE definition from Karame et al. (2018) and SAKE security properties. We discuss as well different possibilities concerning the size of the shares and their impact on the security of a secret sharing scheme.

The SAKE security property is clearly inspired by the $(c-\lambda)$ CAKE property. We formulate therefore the two following correspondences between the two properties:

Remark 1**.**

**From CAKE to SAKE:

To make it simple: consider a $(c-2)$-CAKE scheme, such as the one of Karame et al. (2018), which outputs a ciphertext of length $c$. Then in the highly typical cases where $n\leq 2c$, splitting this ciphertext into $n$ shares of size at least two blocks each yields a $n$-SAKE scheme101010In full generality: a $(c-\lambda)$ CAKE secure scheme is SAKE secure if the sum of blocks in any subsets of its $n-1$ shares does not exceed $(c-\lambda)$..**

Remark 2**.**

**From SAKE to CAKE:

A $n$-SAKE secure scheme is $(c-\lambda^{\prime})$ CAKE secure where $\lambda^{\prime}$ denotes the minimum of all possible sums of combinations of $n-1$ of the shares. To make it simple: in the highly typical cases where $n\leq c$, then a $n$-SAKE scheme is only $n-1$-CAKE. Indeed, if a CAKE adversary chooses $n$ ciphertext blocks in $n$ distinct shares, then SAKE doesn’t guarantee anything.**

For the sake of simplicity, we will define all shares in our schemes as having the same size. This definition could be modified in order to fit a non-uniform distribution of ciphertext among the shares. This would include cases like having two shares where one share contains $c-1$ blocks of the ciphertext and the other just one block (that could be useful for instance when wanting to have a large outsourced fragment of data in the cloud and one small fragment kept at the user’s device).

In a multi-cloud storage scenario $n$ is rather small Bessani et al. (2013) due to the burden coming with the subscription to a new storage provider. In a case where data is dispersed over multiple servers, $n$ is rarely greater than 20-30 Resch and Plank (2011).

4.7 Nailing down the main technical difficulties

Let us consider a keyed permutation $f(\ast,\ast)$, which is at least a PRP as in §2 (or refer to (Katz and Lindell, 2014, Definition 3.24)), or even which satisfies the stronger notion of an ideal blockcipher. Then consider the following classical ”counter-mode” strings generator: fix a secret key $K$ once for all, then on every query, sample ${IV}\in\mathbf{F}_{2}^{|B|}$ at random then output:

[TABLE]

These outputs are indistinguishable from uniform independent random bit strings. Said otherwise, construction (2) is a pseudorandom generator in the sense of (Katz and Lindell, 2014, Definition 3.24).

On the other hand, if the $K$ is leaked to the adversary, then this is false (see Appendix A for a detailed explanation). In §6.2 we explain how a previous scheme felt into this safety trap along its proof under key exposure. Notice that a similar breakdown occurs if (2) is replaced by the classical ”chained-based” (CBC) mode of operation and, worse, this is then the case even if $f$ is just a PRF (not a PRP anymore).

We will fix this problem with post-processing of the output in §5-§6, whereas in §7 we will fix it with the following trick: if we replace the construction (2) using a random oracle $\mathcal{O}$ as follows: ${IV}\rightarrow\mathcal{O}(K||{IV})$, then it is true that this string generator remains pseudorandom even when $K$ is leaked to the adversary. We will use this crucially in the proof of Main Theorem 2. Interestingly, we show in 7.3 that the construction (2) switched upside down [${IV}$ becomes the secret key and $K$ the variable random input] is secure under leakage of the secret ${IV}$, when assuming an ideal random behavior (ideal blockcipher model) on $f(\ast,\ast)$.

5 SSAKE: fast block-cipher based CSS protecting against key exposure

We introduce a new computational secret sharing scheme denoted as ${SSAKE}$ : Secret Sharing Against Key Exposure. In the next section we will prove that it satisfies the previously introduced $SAKE$ security notion:

Main Theorem 1**.**

In the ideal blockcipher model, the scheme ${SSAKE}$ satisfies $n$-$\mathrm{SAKE}$ security with respect to the key parameter $K$ used for the blockcipher encryption.

The advantage of this scheme is that it is versatile because it uses a standard blockcipher in the CTR mode as the encryption scheme inside the transformation ${SSAKE}$ (for instance the standard AES), so that the transformation can be applied on already encrypted data. The transformation ${SSAKE}$ is composed of four steps:

Encryption of the plaintext into a ciphertext using a blockcipher (like AES) in the CTR mode. 2. 2.

Transformation of the ciphertext using a linear transform creating dependencies between the blocks. 3. 3.

Splitting the transformed ciphertext into $n$ fragments $F_{i}$ composed of consecutive blocks. 4. 4.

Applying a perfect secret sharing scheme to the initialization vector ${IV}$ used during the encryption to produce $n$ shares ${IV}_{i}$, and attaching these shares to the fragments: an output share $S_{i}$ is then the concatenation of the transformed ciphertext fragments $F_{i}$ and the IV’s share ${IV}_{i}$.

We consider a keyed blockcipher ${BC}$, which is a publicly known keyed function operating on blocks of size ${|B|}$ bits and which outputs ${|B|}$ bits (when designing the scheme we think of the most common symmetric encryption block cipher AES with blocks of 128 bits). Here, the secret key of the blockcipher is of size ${|K|}={|B|}$ one block.

The ${SSAKE}$ algorithm starts with plaintext $P=P_{1},\ldots,P_{c-1}$ encryption using the ${BC}$ in Counter Mode $CTR$ (we chose this mode instead of CBC for parallelizability, and simplicity of Proposition 1). This results in a ciphertext $C=C_{0},\ldots,C_{c-1}$, composed of $c$ blocks. For the sake of completeness, let us just remind that such encryption consists to one-time pad the vector $[0||P]\in(\mathbf{F}_{2}^{{|B|}})^{c}$ ($P$ concatenated with zero block appended) with the following vector (which is not pseudorandom: see the explanation Section 4.5, as well as §6.2 and Appendix A):

[TABLE]

generated from a ”seed” block ${IV}\in\mathbf{F}_{2}^{|B|}$ sampled at random. The output of this operation is the ciphertext 111111We ask for the first block of ciphertext to be $C_{0}={BC}({IV})$, in order to be in the setting of Hypothesis 1. We could instead have stuck with the classical choice $C_{0}:={IV}$, and modified Proposition 1 accordingly.

[TABLE]

of $c=({c-1})+1$ blocks.

A noninvertible linear transform is then applied to the ciphertext $C$ transforming it into $C^{\prime}$ of length $c-1$: each ciphertext block $i$, $i\geq 2$, is XOR-ed with its predecessor $C^{\prime}_{i}:=C_{i}+C_{i-1}$. Aditionally, the initialization vector block ${IV}$ is split using a perfect secret sharing scheme (PSS) with adversary threshold $n-1$ into $n$ shares ${IV}_{1},\ldots,{IV}_{n}$: for example, an additive secret sharing. So the original ciphertext $C$ can be recovered from both $C^{\prime}$ and the shared ${IV}$.

The linear transformation of the $C$ into $C^{\prime}$ can be shown as right multiplication by the following noninvertible binary matrix $Mat^{SSAKE}$ of size $(c-1)\times c$:

[TABLE]

Transformed ciphertext $C^{\prime}$ is split into $n$ fragments. This can be done in various ways. The simplest way is to just create the fragments from large chunks of consecutive $\frac{c-1}{n}$ blocks. Consecutive blocks can be also dispersed over different fragments - this would reveal less information to an attacker that somehow managed to obtain the $IV$ but has no knowledge about the plaintext.

For reconstruction: recover ${IV}$ from all the shares, then, for someone who knows the key $K$, deduce $C_{0}={BC}_{K}({IV})$, then deduce the $C_{i}$ sequentially, then decipher them: $C_{i}-{BC}_{K}({IV}+i)$.

6 Security Analysis of the ${SSAKE}$ scheme (and of previous work)

We first prove in §6.1 that ${SSAKE}$ achieves $n$-SAKE security, then in §6.2 we revisit the security proofs of Karame et al. (2018) and highlight —one more time— the technical issues raised by the setting of key exposure and finally single out in §6.3 a sufficient hypothesis under which the scheme of Karame et al. (2018) is secure.

6.1 Proof of Main Theorem 1

(1) ${SSAKE}$ is trivially ind-CPA for an adversary who ignores the secret key $K$ and is given all the shares. Indeed, the shares are the result of a public transformation (the linear transform-then-sharing) whose sole input is the ciphertext $C$. But this ciphertext $C$ itself is the plaintext encrypted with the classical counter-mode blockcipher encryption scheme with secret key $K$. Thus any two ciphertexts $C$, and thus any two transforms of them with a public transformation, are well-known to be indistinguishable under chosen plaintext attacks (see e.g. (Katz and Lindell, 2014, Theorem 3.30)).

The proof of (2) is based on the following indistinguishability property:

6.1.1 Main technical result

We place ourselves in the ideal permutation model (RPM) recalled in §2.

Proposition 1** (Uniformity of differentials of a random value in the RPM).**

Let $\sigma$ be a public fixed ideal random permutation of size $B$, $c>0$ a fixed public integer and $\overrightarrow{\Delta}=1,2,\dots,c$ be a fixed sequence of numbers, then consider the following procedure executed by an oracle $\mathcal{O}$: generate $r\leftarrow\{0,1\}^{{|B|}}$ uniformly at random, then output:

[TABLE]

Then the output of this procedure is indistinguishable from the output of a generator of random strings of length $c-1$ blocks, for a polynomial adversary having access to the public resource $\sigma$, with respect to the security parameter ${|B|}$.

The core idea of the proof is the following: the classical padding vector of the counter mode of encryption $[\sigma(r+1),\dots,\sigma(r+c-1)]$ is not safe when $\sigma^{-1}$ is made accessible to the adversary (=key exposure), since then she can invert any $\sigma(r+i)$ by querying and recover the initialization vector $r$ to distinguish a padding vector from pure randomness. So what we do in $\overrightarrow{Diff_{r}}$ is that we translate this vector by a random block $v\in\mathbf{F}_{2}^{|B|}$. The issue is that we sample this random $v$ by querying $\sigma$ on$\dots$ $r$. But recall that $\sigma$ behaves as a random oracle (modulo avoiding collisions), thus, as long as $r$ was not queried before (nor its inverse), then $\sigma$ does output a value $v:=\sigma(r)$ uniformly at random, so this doesn’t give any advantage to the adversary.

Proof.

We consider a cascade of games, where the view of adversary $\mathcal{A}$ is the same between two consecutive games up to negligible events. The first game Game1 is where $\mathcal{A}$ faces a true random string generator, whereas the last one Game6 is the actual $\overrightarrow{Diff_{r}}$ oracle. Let us say that, in each game, our bounded adversary $\mathcal{A}$ makes a total of $M$ queries to $\sigma$ and $\sigma^{-1}$, and of $M$ queries to the challenging oracle $\mathcal{O}$.

Game1 On each query to the challenging oracle $\mathcal{O}$, say the $j$-th query, $\mathcal{O}$ sends to $\mathcal{A}$ a sequence of blocks $\lambda^{j}_{1},\dots,\lambda^{j}_{c-1}$ sampled uniformly at random.

Game2 On each query to the challenging oracle $\mathcal{O}$, say the $j$-th query, $\mathcal{O}$ generates a sequence of random blocks $\lambda^{j}_{0},\lambda^{j}_{1},\dots,\lambda^{j}_{c-1}$ and returns to $\mathcal{A}$ the sequence $\lambda^{j}_{0}+\lambda^{j}_{1},\dots,\lambda^{j}_{0}+\lambda^{j}_{c-1}$. The view of $\mathcal{A}$ is the same as in the previous game.

Game3 The challenging oracle $\mathcal{O}$ has the same behavior as in the previous game, but the permutation oracle $(\sigma,\sigma^{-1})$ becomes ”lazy”: it doesn’t check anymore for collisions between two outputs of different inputs, so outputs uniformly at random when queried on a new input. Such a collision event happens in the game with probability $M/2^{|B|}$, so is negligible.

Game4 The challenging oracle $\mathcal{O}$ has the same behavior as in the previous game, but it sometimes ”crashes”, i.e. returns no answer. Namely, on each query, in addition to sampling the values $\lambda^{j}_{0},\lambda^{j}_{1},\dots,\lambda^{j}_{c-1}$, $\mathcal{O}$ also samples ”for herself” a random block $r^{j}$ and crashes if: either one of the elements in the sequence $r^{j},\dots,r^{j}+c-1$ (i) was already queried by the adversary to $\sigma$, or (i’) overlaps with a previously sampled sequence; or, if one of the elements in the sequence $\lambda^{j}_{0},\lambda^{j}_{1},\dots,\lambda^{j}_{c-1}$ (ii) was already queried by the adversary to $\sigma^{-1}$, or (ii’) overlaps with a previously sampled sequence. It is straightforward that (i) and (i’) happen with probabilities $cM/2^{|B|}$, resp. roughly $2cM/2^{|B|}$ (see (Katz and Lindell, 2014, pf of Thm 3.30) for thinner birthday paradox estimations) because the $r^{j}$ are not related in any manner with the outputs given to the adversary. On the other hand, one can actually see that (ii) and (ii’) also happen with probabilities $cM/2^{|B|}$ resp. roughly $2cM/2^{|B|}$, because the set of ”bad” values $\lambda^{j}_{1},\dots,\lambda^{j}_{c-1}$ are translated by a uniform random $\lambda^{j}_{0}$ before being given to the adversary, thus the possible sets of ”bad” values are equidistributed from the point of view of the adversary. This is the core idea of the proof.

Game5 The challenging oracle $\mathcal{O}$ has the same behavior as in the previous game except that, this time, the values $\lambda^{j}_{i}$ are sampled by querying the uniform $\sigma$ oracle: $\lambda^{j}_{i}:=\sigma(r^{j}+i)$. The values $\lambda^{j}_{i}$ are thus still sampled uniformly at random, since, outside of ”crash” events, they were not queried before to $\sigma$ (neither by $\mathcal{O}$ nor $\mathcal{A}$). Thus, the view of the adversary is the same as in the previous game.

Game6 Finally, the permutation oracle $\sigma$ checks again for collisions, thus its outputs are not completely uniform anymore, introducing a negligible difference of views for the adversary compared to the previous game. ∎

6.1.2 End of the proof of Main theorem 1

(2), let us consider an adversary $\mathcal{A}$ who is given the key $K$. Let us consider the SAKE game of §4.4: $\mathcal{A}$ chooses two plaintexts $P^{(b)}$ $b=0,1$, and is given $n-1$ shares under ${SSAKE}$ of one of them. Her view consists in $n-1$ shares of the ${IV}:={IV}^{b}$ and $n-1$ fragments of $C^{\prime}:=C^{\prime}{}^{b}$. First, one can reason as if $\mathcal{A}$ did not receive the $n-1$ shares of ${IV}$ under the PSS121212Because these $n-1$ shares are indistinguishable from $n-1$ uniformly distributed random values, as can be seen e.g. from Shamir’s scheme or an additive secret-sharing scheme. One can also see this more formally, since a PSS is universally composable (see (Cramer et al., 2015, chap 4)) so can be formally replaced in any protocol by a black box that gives no information to an adversary accessing up to $n-1$ shares..

Then, consider a more advantageous Game2 where the $\mathcal{A}$ is given all of

[TABLE]

Since she has strictly more information in this game, her guessing advantage is bigger.

Consider finally Game3, where the adversary is instead given $C"$, obtained from $C^{\prime}$ with the following successive operations (that one can also see as arising from elementary columns operations on $Mat^{SSAKE}$):

[TABLE]

Where it is clear that, since the operations are reversible, the adversary in Game3 can recover the view of adversary in Game2 so has larger (actually equal) advantage. But with the notations of Proposition 1, an adversary in Game3 receives exactly

[TABLE]

so whatever the value of the bit $b$, she has negligible advantage in distinguishing what she receives from random, by Proposition 1. So she can’t a fortiori distinguish between the two possibilities.

6.2 Revisiting the security analysis of previous works and the issue of pseudorandomness under key exposure

The proof in Karame et al. (2018), follows the template of the proof of ind-CPA security for CTR mode, as done e.g. (Katz and Lindell, 2014, theorem 3.32). It considers the ind-CPA CAKE game as defined in (Karame et al., 2018, §3.2), where $\mathcal{A}$ knows the key and plays against an oracle $\mathcal{O}$ which uses a blockcipher ${BC}$ with this fixed key. Then it shows that, if such an adversary could win the ind-CPA CAKE game with non negligible advantage, then it could distinguish between the actual ”pseudorandom” permutation ${BC}$ and a truly random one, just as in (Katz and Lindell, 2014, p91). Then it concludes a contradiction, and thus the adversary couldn’t win the CAKE game.

Although this strategy works in (Katz and Lindell, 2014, theorem 3.32)131313”Intuitively, such a “gap” (if present) would enable us to distinguish the pseudorandom function from a truly random function. Formally, we prove this via reduction.”, the problem here is that there is no contradiction anymore in this context of key exposure. Indeed, our adversary perfectly knows the permutation ${BC}$, because she knows the key $K$. So she can trivially distinguish it from a truly random one. So this doesn’t disprove anything about the adversary’s ability to win the CAKE game. This is why in our proof of Main Theorem 1 we needed to choose a completely different strategy and crucially relied on the RPM assumption for the ${BC}_{K}$ with fixed public key $K$.

The proof in Karame et al. (2018) relies on the statement that the output of the CTR is pseudorandom. However, this statement is false. On the face of it, it has actually no precise meaning141414As Katz-Lindell notice under their (Katz and Lindell, 2014, definition 3.25), ”it is meaningless to say that ${BC}$ is pseudo-random if the key is known”.. But the problem is actually deeper: to exemplify it, we show in Appendix A that, when the key of the blockcipher in counter mode is known, then the output is not random-looking even if the adversary doesn’t know the counter. We also sketched this problem in the idea of proof of Proposition 1. Random-lookingness is broken even from the point of view of an adversary who knows only any two output blocks of CTR. The same argument holds for any two consecutive output blocks of CBC.

6.3 Minimal sufficient hypotheses for Bastion’s security

As we just saw, public knowledge of the inverse ${BC}^{-1}$ makes the output of CTR appear nonrandom. Nevertheless, we prove in Appendix B the following Proposition 2, which states that the security of Bastion holds under a certain pseudorandomness hypothesis.

Unlike the notations of Karame et al. (2018), we keep our indices of ciphertext blocks $C_{i}$ which run from [math] to $c-1$, in particular we stick to our more traditional convention that $C_{0}$ is the initialization vector (instead of $y[n]$ in loc. cit.). We also keep our convention where $C^{\prime}=C\cdot Mat^{Bastion}$ is the transformed ciphertext.

Proposition 2** (Under the following hypothesis, Bastion satisfies $(c-2)$ CAKE security).**

Sample once for all a key $K$ which will be used in the blockcipher ${BC}$ and give it to the adversary $\mathcal{A}$, so that she has access to ${BC}$ and ${BC}^{-1}$ with this key. Then, on every query of the adversary, sample a (secret) initialization vector $C_{0}$ uniformly at random, and for all possible tuples $(s,t)$ of distinct indices chosen by the adversary151515The two columns that $\mathcal{A}$ cannot see, which makes $\frac{c(c+1)}{2}$ possibilities depending on her choice in $(0,\dots,c-1)$, output to her the following. Choose arbitrarily an index161616The pivot column: $u=2$ in the $7\times 7$ example in the proof of Appendix B. $u$ distinct from $s,t$, that we give to $\mathcal{A}$, then output to $\mathcal{A}$ the vector in $({\mathbf{F}_{2}}^{{|B|}})^{c-2}$ defined by:

[TABLE]

(where one should read, instead of ${BC}(C_{0}+0)$, just $C_{0}$). Then Bastion’s security is guaranteed if the adversary cannot distinguish this output from a random bit string of the same size.

7 Key exposure resistance with no overhead on top of encryption

We first borrow in §7.1 a very simple ind-CPA encryption scheme based on random oracles from the paper Bertoni et al. (2012). Then we tweak it for our purpose of secret sharing under key exposure in §7.2, where we prove that the resulting scheme is SAKE secure. We describe an instantiation with blockciphers of two-blocks-long keys (such as AES256 for a security parameter of 128) in §7.3, and finally describe in 7.4 the instantiation which we implemented with Keccak, along with the choice of consistent security parameters.

7.1 Baseline encryption

We consider the most elementary case of the encryption scheme $\mathcal{RO}_{WRAP}$ defined in (Bertoni et al., 2012, §2). 171717Technically we revisit the ideal vanilla case of their construction, which they call $\mathcal{RO}_{WRAP}$ in (Bertoni et al., 2012, §2), under the simplest setting, where we consider just one single secret body $B:=P$. Let us recall for the interested reader that this scheme is then tweaked into authenticated Duplex mode: see their (Bertoni et al., 2012, Lemma 6), with equivalent indistinguishability, then instantiated with an ideal sponge. Recall from §2 that we consider a public random oracle \mathcal{O}:\bigr{(}\mathbf{F}_{2}^{2{|B|}}\bigl{)}\longrightarrow\bigl{(}\mathbf{F}_{2}^{|B|}\bigr{)}^{\infty}, and note $\mathcal{O}_{c-1}$ when restricting to the first $c-1$ output blocks.

Definition 1** ($\mathcal{RO}_{WRAP}$).**

Sample once for all a secret key $K$ uniformly at random. Then, on input $P$ of length $c-1$, sample a header ${IV}$ uniformly at random and output the ”one-time-padding”:

[TABLE]

Proposition 1**.**

$\mathcal{RO}_{WRAP}$* is an ind-CPA secure encryption scheme with secret key $K$.*

This actually follows from (Katz and Lindell, 2014, Theorem 3.26) because the function $(K,{IV})\longrightarrow\mathcal{O}_{c-1}(K||{IV})$ is in particular a pseudorandom function with respect to key $K$ and input ${IV}$.

7.2 ROSSake scheme

Our scheme ROSSake is described in the following figure. Although the fragments could be chosen completely arbitrarily, as long as they don’t overlap and form a partition of the ciphertext, for simplicity we will assume as in §2 that $c-1$ is divisible by $n$, and that the fragments $F_{i}$ are formed by gathering $(c-1)/n$ consecutive blocks.

Main Theorem 2**.**

Protocol $ROSSake$ is a $n-\mathrm{SAKE}$ scheme with respect to the secret key $K$.

Proof.

(1) Let us consider an adversary who ignores the key $K$ but has all shares. Then ind-CPA of the scheme follows from Proposition 1. (2) Let us consider an adversary who knows the key $K$ and who plays the ind-CPA game of requirement (2) for $n$-SAKE security. On every query to the challenge oracle on two plaintexts $P^{b}$, $b=0,1$, the adversary obtains $n-1$ shares of one of the chosen plaintexts $P^{b}$ generated by $ROSSake$ with the same key $K$. [Throughout the game, the adversary can also query $ROSSake$ on any plaintext she wants.] By the property of information theoretical secret sharing, the $n-1$ shares ${IV}_{i}^{b}$ given to the adversary are indistinguishable from random strings independent from all the rest of the experiment, so she can ignore them and concentrate on the $n-1$ fragments $F_{i}^{b}$ that she receives. To make the argument clearer, let us give more power to the adversary and also give to her the last missing fragment $F_{i}^{b}$ but not the corresponding missing share ${IV}_{i}^{b}$ of the ${IV}^{b}$ (otherwise she could reconstruct the secret).

The core idea of the proof is that, in this context where the key $K$ is exposed, the publicly know function $\mathcal{O}_{c-1}(K||\ast):\,{IV}\,\longrightarrow\,\mathcal{O}(K||{IV})$ is again a random oracle with respect to input ${IV}$ (for the reader who is not convinced, we refer to the overkill domain-separation argument for random oracles done in (Coron et al., 2005, §5)).

So, from the point of view of this more powerful adversary, the ind-CPA game (2) of the definition of $n$-SAKE with multiple queries on the same public key $K$, consists exactly in the following one-query encryption game ”ind1” with the following encryption challenger oracle. The oracle selects a random oracle $\mathcal{O}_{c-1}(K||\ast)$ once for all and gives it to the adversary. Then, on every query $P^{b}$, $b=0,1$ from the adversary, the challenge oracle selects a bit $b$, samples a new secret ${IV}^{b}$ uniformly at random (which plays the role of a secret key in an ind1 game!) then returns to the adversary the ciphertext: $\mathcal{O}_{c-1}(K||{IV}^{b})+P^{b}$. But in particular, the function $\mathcal{O}_{c-1}(K||\ast)$ is a pseudorandom generator in the sense of (Katz and Lindell, 2014, Definition 3.15)181818As we notice in §4.7, this core argument completely breaks down in general if we replace the random oracle $\mathcal{O}(\ast||\ast)$ by the weaker notion of a mere pseudorandom function $f(\ast,\ast)$. , so that we fall back in the scheme of (Katz and Lindell, 2014, Theorem 17), which is proven (stronger than) ind1. Thus the adversary has negligible advantage in the game. ∎

7.3 Can we instantiate this scheme from AES ?

A convenient way to build a random oracle with input of constant size, two blocks in our use-case, consists morally in switching upside-down the construction of equation (2) [see the comments at the end of §4.7]. 191919This construction is suggested by the NIST: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf Let us formalize this in the ideal blockcipher model.

Proposition 2**.**

Consider an ideal blockcipher ${BC}^{2}$. Let us consider a fixed public counter, e.g. $1,2,3,\dots$. Then the following function is a random oracle with input size the keysize $|\mathcal{L}|$ of ${BC}^{2}$:

[TABLE]

Importantly, for our purpose we thus use an ideal blockcipher ${BC}^{2}$ with key $\mathcal{L}$ of size two blocks: twice larger than the key $K$ of the final $ROSSake$ scheme obtained. Thus the exponent $2$, to differentiate it from the ${BC}$ of the previous ${SSAKE}$ scheme of keysize one block.

Proof.

The proposition results from the definition of an ideal blockcipher. Indeed for each new input $\mathcal{L}$, then a fresh new random permutation oracle ${BC}^{2}_{\mathcal{L}}$ is created, so that the outputs on ${BC}^{2}_{\mathcal{L}}$ when queried on the counter $1,2,\dots$ are uniform and independent from the outputs of previously queried oracles ${BC}^{2}_{\mathcal{L}^{\prime}}$ with other keys ${\mathcal{L}^{\prime}}$. ∎

We hid under the carpet that the distribution of outputs is not totally uniform, since the permutation oracle ${BC}^{2}_{\mathcal{L}}$ avoids collisions (e.g. will select the output of $10$ outside of the previous outputs of $1,2,\dots,9$). But this bias, of order of magnitude $c/2^{|B|}$ is by definition negligible. For example if the oracle of Proposition 2 were used in place of the construction (2) to produce random-looking strings, then this bias would gives no more than a negligible advantage to an adversary that makes a number of queries negligible compared to $2^{|B|}$. A formal argument for this detail can be found along the lines of the proof of the PRF/PRP Lemma, see e.g. (Maurer et al., 2004, §7).

In conclusion, for our purpose in the case where the security parameter is one block of size 128 bits, then AES256 has indeed key of size two blocks (256), thus by the previous proposition it does the job in the ideal blockcipher model .

7.4 Our instantiation with Keccak

Assuming the existence of a fixed random permutation $\sigma$, the authors of Keccak could prove the existence of a random oracle of arbitrary input and output size in Bertoni et al. (2008) (adopted for SHA3). From it they could build an encryption scheme ”SpongeWrap” which satisfies a pseudorandomness property. Namely, (Bertoni et al., 2012, Theorem 1) can be read in the light of (Katz and Lindell, 2014, Definition 3.28) as stating that, under the RPM, then SpongeWrap is indistinguishable from very large keyed pseudorandom permutation (from its input domain onto its image).

For mere privacy (not authentication) concerns, the security parameters of Bertoni et al. (2012) are ${|K|}$ the length of the key and $c$ the ”capacity” of the sponge ($c$ is not the ciphertext’s size in Bertoni et al. (2012)!). The first formula of (Bertoni et al., 2012, Theorem 1) then states that for an adversary allowed to do a negligible number of queries (noted here $N$ and $q$) with respect to $2^{c}$ and $2^{|K|}$, then the distinguishing advantage is essentially in $\max(2^{-c},2^{-{|K|}})$. For the sake of comparison with the schemes Bastion and ${SSAKE}$ that we instantiated with AES128, we thus took security parameters $|{IV}|={|K|}=c=128$ (and bit rate $r=1600-c$) for Keccak in our simulations in 8.2. We set the number of rounds of the permutation $f$ to $24$, as recommended by the guidelines202020Note on Keccak parameters and usage, NIST hash forum, 2010.

In conclusion: Keccak might seem overkill to instantiate a random oracle with constant small input size, but it is our preferred choice since it gave as good performances than blockciphers, plus the Duplex mode also enables an authentication of the ciphertext with no additional round of encryption, which is interesting for integrity/robustness issues of secret sharing.

8 Comparison with Relevant Works

In Table  1 we compare SSAKE and $ROSSake$ schemes with relevant works in terms of complexity, memory size, with regard to their compliance with our security properties. After commenting Table 1 and detailing how the selected schemes were implemented, we present their experimental throughput in Figure 3.

8.1 Complexity and storage

We compare the ${SSAKE}$ and $ROSSake$ schemes in terms of complexity with relevant works: Krawczyk’s SSMS, Rivest’s and Desai’s AONT and AON, Bastion. The CTR encryption is used as a baseline. The important difference between the new generation of schemes protecting against key exposure and former algorithms is the number of encryption rounds. SSAKE, $ROSSake$, and Bastion use only one single encryption round while Rivest’s and Desai’s AON apply two or more rounds.

Note that, Krawczyk’s SSMS and Desai’s AONT use a single round but do not protect against key exposure: see §4.3 for a discussion. Whereas Rivest’s and Desai’s AON are CAKE, but require two encryption rounds: see §4.5. Finally see §4.6 for how a $c-2$ CAKE scheme is $n$-SAKE for free, provided $n\leq 2c$, which explains our last $\mathrm{SAKE}$ column. See also §4.6 for the direction $n$-SAKE to $n-1$ CAKE, which explains the $n-1$ CAKE entries for our schemes.

Both Bastion and SSAKE use a linear transform post-processing on top of encryption. The difference is that SSAKE transform uses twice less XOR than the Bastion’s one. Bastion scheme applies a linear transform over the encrypted data requiring $2c$ XORs. ${SSAKE}$ applies only a linear transform (one pass of XORs) over the ciphertext and an additive PSS over the ${IV}$ (that has a negligible impact: $n$ xors, on the scheme performance when $c$ is large).

$ROSSake$ does not require to apply a transform over the whole ciphertext. It needs only $n$ XORs more in addition to data encryption, which is negligible as $n$ is no more than 20-30 (when shares are distributed over multiple servers inside a data center, in a multi-cloud scenario it would be no more than 4).

The schemes of Rivest’s, Desai’s and Karame et al. (2018) produce a total stored data (= all the shares) of a size equal to the ciphertext’s $|C|$. Whereas the schemes SSMS, ${SSAKE}$, and $ROSSake$ require an additional storage space of $n$ or $n-1$ additional blocks (=secret sharing of the key in SSMS or of the ${IV}$ in our scheme), which is a constant with regard to the size of the original data. Therefore, this overhead is negligible for large files.

8.2 Performance evaluation

Relevant algorithms were implemented using the same programming style in JAVA with JDK 1.8 on DELL Latitude E6540, X64-based PC running on Intel® CoreTM i7-4800MQ CPU @ 2.70 GHz with 8 GB RAM, under Windows 7. Standard $javax.crypto$ library was used and the official Keccak implementation was used for Lake Keyak 212121https://keccak.team/keyak.html to instantiate $ROSSake$: we refer to §7.4 for our choices of consistent security parameters. A random data sample was used for each measurement and each presented result is an average of 30 measurements. AES-CTR-128 was used as the algorithm for symmetric encryption. AES-NI was enabled. Results are somewhat consistent with those presented in Karame et al. (2018) when taking into account the difference between AES and AES-NI (a factor of 3 in performance was observed in our implementations) as well as differences between hardware platforms.

As shown in the Figure 3$,{SSAKE}$ is the fastest among schemes protecting encrypted data against key exposure based on mainstream symmetric encryption with AES. Protection against key leakage is achieved with an overhead of only 7% against a simple data encryption. The second fastest scheme with this respect, Bastion, results in an overhead of around 19% in comparison to data encryption. Our scheme $ROSSake$, implemented with the less conventional Keccak-based encryption, turns out to be the fastest of all $\mathrm{SAKE}$ schemes.

9 Conclusions

In this paper we revisited computational secret sharing aiming at (1) protecting data against an adversary possessing all the shares but not the encryption key, (2) protecting data against an adversary possessing the encryption key and all but one share, and at the same time (3) respecting performance, storage occupation, and scalability requirements. We introduced a new security model inspired by the CAKE model and adapted to take into account the dispersion of shares in a distributed environment. The privacy threat under key exposure is defined in terms of the number of revealed shares and not, as so far in the all-or-nothing literature, the number of revealed ciphertext blocks. We presented a versatile computational secret sharing scheme - ${SSAKE}$ - that verifies both security properties (1) and (2) of this new model. Complexity and empirical evaluations show that it performs faster than the fastest known relevant scheme - Bastion - since the linear overhead is reduced by half, achieving the point (3) above. We provided a detailed security analysis of not only the presented scheme but also of previous relevant work. We finally presented and implemented an alternative random-oracle based scheme —that can be instantiated with blockciphers (such as AES256 for a security parameter of 128) or e.g. with Keccak— which requires no processing overhead on top of encryption and turned out to be the fastest of all.

Acknowledgements

We would like to thank prof. Srdjan Capkun for inviting us to a seminar at ETH Zurich and for a helpful discussion on the topic. We thank Marc Stevens, Mohamed Tahar Hammi and Han Qiu for very fruitful discussions. We would also like to thank the journalist Ingrid Fadelli for inviting us to do an interview for TechXplore222222https://techxplore.com/news/2019-02-circular-all-or-nothing-approach-key-exposure.html. The second author was (partially) funded by ANR under Grant ANR-15-CE39-0013-01 “manta”. Some of the results in this paper were presented in December 2018 at a seminar at LINCS Paris.

Appendix A Non-pseudorandomness of any two fragments of CTR output when the key is public

Here we bound ourselves to look at the output of CTR from the point of view of an adversary who has only two ciphertext blocks and the encryption key, and show that it is not pseudo-random.

Consider an adversary $\mathcal{A}$ who chooses a plaintext $P=[P_{1},\dots,P_{c-1}]$ and whose goal is to distinguish between CTR encryption and a random string generator. To make the challenge more difficult, suppose that the adversary is given only two output blocks, of indices $i$ and $j$ (if one of them is zero, then the game is even easier). Call $\widetilde{C_{i}}$ and $\widetilde{C_{j}}$ the output blocks given by the challenging oracle $\mathcal{O}$ to $\mathcal{A}$. If $\widetilde{C_{i}}$ and $\widetilde{C_{j}}$ are actual outputs of CTR, then we have that there exists a certain $C_{0}$ such that

[TABLE]

The winning strategy of $\mathcal{A}$ is now clear: compute ${BC}^{-1}(\widetilde{C_{i}}-P_{i})-{BC}^{-1}(\widetilde{C_{i}}-P_{i})$ and compare with $i-j$: if equal then return ”CTR”, otherwise return ”random”.

Appendix B Proof of Proposition 2

Let us recall the matrix of the linear transform of Bastion, here for a transformed $C^{\prime}$ of size $c=7$:

[TABLE]

The last $c-2$ columns are separated from the two first to illustrate the view of an adversary who would always asks to see $C^{\prime}_{\mathcal{A}}=(C^{\prime}_{2},\dots,C^{\prime}_{c-1})$ during the CAKE game. Performing elementary columns operations inside the $c-2$ columns of the adversary, like in the proof of ${SSAKE}$ (§6.1):

[TABLE]

we obtain the adversary’s view on the right of the vertical separator:

[TABLE]

which is the equivalent to the former, from the point of view of an adversary seeing only the last $(c-2)$ columns: $C"_{\mathcal{A}}=(C"_{2},\dots,C"_{c-1})$. (Let us repeat the argument of §6.1: from this new view one can deduce the former one, so the guessing advantage of the adversary is larger —actually: equal— than with the previous view). As in §6.1, $C"_{\mathcal{A}}$ is equal to a value known to the adversary (deduced from $[0,P^{(0)}]$ or $[0,P^{(1)}]$ by transforming them according to the previous matrix), plus $\overrightarrow{Pad^{Bastion}_{(1,2,3)}}$, which is assumed indistinguishable from a random uniform vector. Finally, we must loop over all the possible $(c-2)$ uples of columns among $n$ that $\mathcal{A}$ chooses to see. So we end up with asking for the $c(c+1)/2$ distinct indistinguishability assumptions of vectors $\overrightarrow{Pad^{Bastion}_{(s,t,u)}}$, as formulated in Proposition 2.

Appendix C More on AONT’s

Rivest’s Rivest [1997a] introduced the first known AONT, which is meant to be a pre-processing step applied before data encryption. During this AONT, input data is encrypted into ciphertext $C$ using a first random key $K_{1}$. A hash of the encrypted data is then computed, XOR-ed with $K_{1}$, and appended as the last block of the ciphertext $C_{c}=Hash(C)+K_{1}$. After such data transform, it is not possible to obtain the right hash, and consequently the encryption key, without possessing the whole ciphertext. However, an attacker knowing $K_{1}$ can obviously decrypt a fragment of the ciphertext in her possession. Therefore, Rivest suggests to re-encrypt the transformed data one more time with a different encryption key $K_{2}$. The data will be then protect against the exposure of the first $K_{1}$ or second key $K_{2}$ (but not both of them) unless the whole ciphertext is revealed.

Later, Boyko formalized the all-or-nothing transform [Boyko, 1999, Definition 2]. The numerous subsequent variants of AONT are encompassed by the following loose definition: it consists of a randomized map $AONT$, which maps an input $X$ of fixed size $x$ bits to an output $Y$ of fixed size $y$ bits and such that a polynomial adversary $\mathcal{A}$ has negligible advantage in the following indistinguishability game, where ${L}$ is a set of missing bit positions in $Y$. ”Negligible” is to be understood with respect to the security parameters: length of a certain symmetric key $k_{s}$ (underlying to $AONT$) and number of missing bits $|{L}|$.

• •

$\mathcal{A}$ has access to $AONT$ and is given ${L}$ (or possibly adaptively chooses ${L}$). She outputs two plaintexts $X_{0}$ and $X_{1}$.

• •

$\mathcal{A}$ is given ${AONT(X_{b})}$, with bit positions $L$ missing, and $b\in\{0,1\}$ is a random index unknown to the adversary.

• •

To win the game, $\mathcal{A}$ has to successfully guess the value of $b$.