Prio3: Align spec with revised paper #105
Merged
+140
−77
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cjpatton
force-pushed
the
cjpatton/102/bug-fix/1
branch
from
b9a89e9 to
4c49104
Compare
cjpatton
force-pushed
the
cjpatton/102/codepoints
branch
from
32ff590 to
c0ee1fd
Compare
cjpatton
force-pushed
the
cjpatton/102/bug-fix/1
branch
2 times, most recently
from
5cee6ce to
d99544a
Compare
cjpatton
force-pushed
the
cjpatton/102/bug-fix/1
branch
2 times, most recently
from
92d31b4 to
e933503
Compare
cjpatton
force-pushed
the
cjpatton/102/bug-fix/1
branch
from
e933503 to
06ec588
Compare
cjpatton
force-pushed
the
cjpatton/102/codepoints
branch
from
c0ee1fd to
d684990
Compare
cjpatton
force-pushed
the
cjpatton/102/bug-fix/1
branch
3 times, most recently
from
9b3f4ef to
c2ea50c
Compare
cjpatton
commented
Aug 16, 2022
| > TODO(issue #106) Decide if it's safe to model this construction as a random | ||
| > oracle. `PrgAes128.derive_seed()` is used for the Fiat-Shamir heuristic in | ||
| > Prio3 ({{prio3}}). A fixed-key is used for this step (the all-zero string). A | ||
| > reasoanble starting point would be to model AES as an ideal cipher. |
tgeoghegan
reviewed
Aug 16, 2022
cjpatton
changed the title
cjpatton
force-pushed
the
cjpatton/102/codepoints
branch
from
d684990 to
6da1b7a
Compare
cjpatton
force-pushed
the
cjpatton/102/bug-fix/1
branch
2 times, most recently
from
ee1a02c to
4f569cb
Compare
divergentdave
approved these changes
Aug 17, 2022
cjpatton
force-pushed
the
cjpatton/102/codepoints
branch
from
6da1b7a to
b6cf76b
Compare
cjpatton
force-pushed
the
cjpatton/102/bug-fix/1
branch
from
4f569cb to
4591bf3
Compare
cjpatton
force-pushed
the
cjpatton/102/codepoints
branch
2 times, most recently
from
bb59f30 to
87f0cc6
Compare
cjpatton
force-pushed
the
cjpatton/102/bug-fix/1
branch
from
4591bf3 to
825063f
Compare
cjpatton
force-pushed
the
cjpatton/102/codepoints
branch
from
87f0cc6 to
875da0e
Compare
cjpatton
force-pushed
the
cjpatton/102/bug-fix/1
branch
from
825063f to
6166162
Compare
A bug was found in [BBCGGI+19] that leads to an attack on the robustness of Prio3. The attack is based on an observation in Appendix A of the paper "A New Paradigm for Collision-Free Hashing: Incrementality at Reduced Cost" from Bellare and Micciancio (Eurocrypt 1997). In short, the attack allows a malicious Client to construct invalid input shares for which the Aggregators would compute a `k_joint_rand` of its choosing. This bug was patched in Section 6.2.3 of https://eprint.iacr.org/archive/2019/188/20220727:184451 as follows: Instead of XORing joint randomness shares computed by the Aggregators, `k_joint_rand` is computed by hashing the shares. This change patches the Prio3 spec in kind.
This improves syntax highlighting in vim.
cjpatton
force-pushed
the
cjpatton/102/bug-fix/1
branch
from
6166162 to
529c503
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Partially addresses #102.
A bug was found in [BBCGGI+19] that leads to an attack on the robustness
of Prio3. The attack is based on an observation in Appendix A of the
paper "A New Paradigm for Collision-Free Hashing: Incrementality at
Reduced Cost" from Bellare and Micciancio (Eurocrypt 1997). In short,
the attack allows a malicious Client to construct invalid input shares
for which the Aggregators would compute a
k_joint_randof itschoosing.
This bug was patched in Section 6.2.3 of
https://eprint.iacr.org/archive/2019/188/20220727:184451 as follows:
Instead of XORing joint randomness shares computed by the
Aggregators,
k_joint_randis computed by hashing the shares. Thischange patches the Prio3 spec in kind.