We should share our secrets

Transcription

1 We should share our secrets Shamir secret sharing: how it works and how to implement it Daan Sprenkels Radboud University Nijmegen 28 December 2017 Daan Sprenkels We should share our secrets 28 December / 35

2 Who am I? Student at Radboud University Nijmegen Bachelor in Chemistry Currently studying Cyber Security On a regular day I implement elliptic curve crypto 1 The others: Peter Schwabe 2 (@cryptojedi) Sean Moss-Pultz 3 (@moskovich) 1 The meaning of crypto is cryptography, not cryptocurrency! 2 Radboud University 3 Bitmark Inc. ( Daan Sprenkels We should share our secrets 28 December / 35

3 Daan Sprenkels We should share our secrets 28 December / 35

4 Don t roll your own crypto Daan Sprenkels We should share our secrets 28 December / 35

5 Don t roll your own crypto and also don t implement your own crypto Daan Sprenkels We should share our secrets 28 December / 35

6 Outline Part I: Crypto theory What is secret sharing? How does it work? Part II: Crypto implementation How to encode our values Solving integrity Side channel resistance Performance and bitslicing Daan Sprenkels We should share our secrets 28 December / 35

7 Outline Daan Sprenkels We should share our secrets 28 December / 35

8 Part I: crypto theory Daan Sprenkels We should share our secrets 28 December / 35

9 Problem statement How to backup your secrets (wallet keys, passwords, etc.)? Daan Sprenkels We should share our secrets 28 December / 35

10 Problem statement How to backup your secrets (wallet keys, passwords, etc.)? Need to trust a single entity Daan Sprenkels We should share our secrets 28 December / 35

11 Problem statement How to backup your secrets (wallet keys, passwords, etc.)? Need to trust a single entity How to split up our trust? Daan Sprenkels We should share our secrets 28 December / 35

12 Solving our problem 1. Cut my key into pieces Secret message m = A B C. Distribute A, B, C. Daan Sprenkels We should share our secrets 28 December / 35

13 Solving our problem 1. Cut my key into pieces Secret message m = A B C. Distribute A, B, C. Bad security! Daan Sprenkels We should share our secrets 28 December / 35

14 Solving our problem 1. Cut my key into pieces Secret message m = A B C. Distribute A, B, C. Bad security! 2. Use one-time-pad construction? Generate random A, B Choose C = m A B. Daan Sprenkels We should share our secrets 28 December / 35

15 Solving our problem 1. Cut my key into pieces Secret message m = A B C. Distribute A, B, C. Bad security! 2. Use one-time-pad construction? Generate random A, B Choose C = m A B. Restore by computing m = A B C Daan Sprenkels We should share our secrets 28 December / 35

16 Solving our problem 1. Cut my key into pieces Secret message m = A B C. Distribute A, B, C. Bad security! 2. Use one-time-pad construction? Generate random A, B Choose C = m A B. Restore by computing m = A B C = A B (m A B) Daan Sprenkels We should share our secrets 28 December / 35

17 Solving our problem 1. Cut my key into pieces Secret message m = A B C. Distribute A, B, C. Bad security! 2. Use one-time-pad construction? Generate random A, B Choose C = m A B. Restore by computing m = A B C = A B (m A B) Daan Sprenkels We should share our secrets 28 December / 35

18 Solving our problem 1. Cut my key into pieces Secret message m = A B C. Distribute A, B, C. Bad security! 2. Use one-time-pad construction? Generate random A, B Choose C = m A B. Restore by computing m = A B C = m Daan Sprenkels We should share our secrets 28 December / 35

19 Solving our problem 1. Cut my key into pieces Secret message m = A B C. Distribute A, B, C. Bad security! 2. Use one-time-pad construction? Generate random A, B Choose C = m A B. Restore by computing m = A B C = m Needs all pieces to restore the secret Daan Sprenkels We should share our secrets 28 December / 35

20 A better solution Shamir secret sharing Published almost 40 years ago by Adi Shamir Threshold scheme (n, k) Provably secure Daan Sprenkels We should share our secrets 28 December / 35

21 A better solution Shamir secret sharing Published almost 40 years ago by Adi Shamir Threshold scheme (n, k) Provably secure Information-theoretically secure Daan Sprenkels We should share our secrets 28 December / 35

22 Example with (n, k) = (5, 4) m Daan Sprenkels We should share our secrets 28 December / 35

23 Example with (n, k) = (5, 4) s 3 s 2 m s 1 s 4 s 5 Daan Sprenkels We should share our secrets 28 December / 35

24 Example with (n, k) = (5, 4) s 2 s 3 m s 1 s 4 s5 Daan Sprenkels We should share our secrets 28 December / 35

25 Example with (n, k) = (5, 4) s 2 s 3 s 1 s 4 s5 Daan Sprenkels We should share our secrets 28 December / 35

26 Example with (n, k) = (5, 4) s 2 s 1 s 4 s 5 Daan Sprenkels We should share our secrets 28 December / 35

27 Example with (n, k) = (5, 4) m Daan Sprenkels We should share our secrets 28 December / 35

28 How does the math work? Given parameters (n, k) and message m: Construct a polynomial of degree k 1: With coefficients a i randomly generated. p(x) = a k 1 x k a 1 x + m (1) Daan Sprenkels We should share our secrets 28 December / 35

29 How does the math work? Given parameters (n, k) and message m: Construct a polynomial of degree k 1: With coefficients a i randomly generated. Evaluate n points on the polynomial to get shares s i : p(x) = a k 1 x k a 1 x + m (1) s 1 = (1, p(1)) s 2 = (2, p(2)). s n = (n, p(n)) Daan Sprenkels We should share our secrets 28 December / 35

30 How does the math work? Find p(x) = a k 1 x k a 1 x + m such that all s i are on p(x). Solve for m: a k 1 x k a 1 x 1 + m = y 1 a k 1 x k a 1 x 2 + m = y 2 a k 1 x k a 1 x 3 + m = y 3... a k 1 x k 1 k a 1 x k + m = y k Daan Sprenkels We should share our secrets 28 December / 35

31 How does the math work? Find p(x) = a k 1 x k a 1 x + m such that all s i are on p(x). Solve for m: a k 1 x k a 1 x 1 + m = y 1 a k 1 x k a 1 x 2 + m = y 2 a k 1 x k a 1 x 3 + m = y 3... a k 1 x k 1 k a 1 x k + m = y k Use Lagrange interpolation for solving Daan Sprenkels We should share our secrets 28 December / 35

32 Daan Sprenkels We should share our secrets 28 December / 35

33 Daan Sprenkels We should share our secrets 28 December / 35

34 Daan Sprenkels We should share our secrets 28 December / 35

35 Daan Sprenkels We should share our secrets 28 December / 35

36 Daan Sprenkels We should share our secrets 28 December / 35

37 Daan Sprenkels We should share our secrets 28 December / 35

38 Example: combining shares s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: a 2 x a 1x 1 + m = y 1 a 2 x a 1x 2 + m = y 2 a 2 x a 1x 3 + m = y 3 Daan Sprenkels We should share our secrets 28 December / 35

39 Example: combining shares s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: 1 2 a 2 + a 1 + m = a 2 + 4a 1 + m = a 2 + 2a 1 + m = 8 Daan Sprenkels We should share our secrets 28 December / 35

40 Example: combining shares s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: 1 2 a 2 + a 1 + m = a 2 + 4a 1 + m = a 2 + 2a 1 + m = 8 m = 42 Daan Sprenkels We should share our secrets 28 December / 35

41 All good? Daan Sprenkels We should share our secrets 28 December / 35

42 All good? Information-theoretically secure Daan Sprenkels We should share our secrets 28 December / 35

43 All good? Information-theoretically secure for confidentiality Not really secure for integrity Daan Sprenkels We should share our secrets 28 December / 35

44 Daan Sprenkels We should share our secrets 28 December / 35

45 Daan Sprenkels We should share our secrets 28 December / 35

46 Daan Sprenkels We should share our secrets 28 December / 35

47 Daan Sprenkels We should share our secrets 28 December / 35

48 Daan Sprenkels We should share our secrets 28 December / 35

49 Daan Sprenkels We should share our secrets 28 December / 35

50 Solving integrity Solutions: Randomize x-values Only share random secrets Daan Sprenkels We should share our secrets 28 December / 35

51 Part II: implementation Daan Sprenkels We should share our secrets 28 December / 35

52 Requirements Bitmark Inc. asks us for a Shamir secret sharing library. Secure for integrity ( 128 bits) Side channel resistant (timing, cache-timing) Portable to any platform Daan Sprenkels We should share our secrets 28 December / 35

53 Requirements Bitmark Inc. asks us for a Shamir secret sharing library. Secure for integrity ( 128 bits) Side channel resistant (timing, cache-timing) Portable to any platform Existing libraries: ssss gfshare Daan Sprenkels We should share our secrets 28 December / 35

54 Requirements Bitmark Inc. asks us for a Shamir secret sharing library. Secure for integrity ( 128 bits) Side channel resistant (timing, cache-timing) Portable to any platform Existing libraries: ssss gfshare Both do not meet our requirements Daan Sprenkels We should share our secrets 28 December / 35

55 Implementation challenges On to implement it ourselves How to encode our values? 2. How to fix our integrity problem? 3. How to prevent side channels? 4. How to make it fast? Daan Sprenkels We should share our secrets 28 December / 35

56 1. How to encode our values? Options: Integers modulo large prime? Other finite field? 1 For the maths people, we are using F 2[x]/(x 8 + x 4 + x 3 + x + 1) Daan Sprenkels We should share our secrets 28 December / 35

57 1. How to encode our values? Options: Integers modulo large prime? Other finite field? Piece up the secret in bytes and map them to F 2 8 (note 1 ) Fast arithmetic Can secret-share every byte independently 1 For the maths people, we are using F 2[x]/(x 8 + x 4 + x 3 + x + 1) Daan Sprenkels We should share our secrets 28 December / 35

58 2. Solving integrity Use hybrid encryption: Daan Sprenkels We should share our secrets 28 December / 35

59 2. Solving integrity Use hybrid encryption: Daan Sprenkels We should share our secrets 28 December / 35

60 3. How to prevent side channel attacks? Rules to protect against side channels 2 : 1. No branching (if, &&,, etc.) 2 In software! Hardware implementations are a whole other story. Daan Sprenkels We should share our secrets 28 December / 35

61 3. How to prevent side channel attacks? Rules to protect against side channels 2 : 1. No branching (if, &&,, etc.) 2. No secret-dependent lookups (y = table[key[i]];) 2 In software! Hardware implementations are a whole other story. Daan Sprenkels We should share our secrets 28 December / 35

62 3. How to prevent side channel attacks? Rules to protect against side channels 2 : 1. No branching (if, &&,, etc.) 2. No secret-dependent lookups (y = table[key[i]];) 3. No variable-time instructions (div, mul [2], etc.) 2 In software! Hardware implementations are a whole other story. Daan Sprenkels We should share our secrets 28 December / 35

63 4. Performance throug bitslicing Daan Sprenkels We should share our secrets 28 December / 35

64 4. Performance throug bitslicing Working in bytes need only 8 registers per byte Implement algorithm in logic circuits Daan Sprenkels We should share our secrets 28 December / 35

65 4. Performance throug bitslicing Example: Adding two bytes in parallel A B C in S C out Daan Sprenkels We should share our secrets 28 December / 35

66 4. Performance throug bitslicing Working in bytes need only 8 registers per byte Implement algorithm in logic circuits 32-bit platform? 32x parallel computation Daan Sprenkels We should share our secrets 28 December / 35

67 4. Performance throug bitslicing Working in bytes need only 8 registers per byte Implement algorithm in logic circuits 32-bit platform? 32x parallel computation = performance :) Daan Sprenkels We should share our secrets 28 December / 35

68 4. Performance throug bitslicing Working in bytes need only 8 registers per byte Implement algorithm in logic circuits 32-bit platform? 32x parallel computation = performance :) Scales to 64-bit, avx{,2,512}, etc. :) Daan Sprenkels We should share our secrets 28 December / 35

69 Overview secret salsa20/poly1305 encrypt 01d64c7f311c077de13a0c9dbd8a243cc884e7fc3e7554 random key ciphertext 028dbd7641a538a5c99b5c4007fad2f8174a97703c (n,k) bitslice evaluate polynomial unbitslice 03a2499f2f6a f70df3bc501b927e d49a3f2f8ea7b020ac6fa313c8 0509b0d834faa8ae00064dd40e518e3a Daan Sprenkels We should share our secrets 28 December / 35

70 Overview secret salsa20/poly1305 decrypt key unbitslice Lagrange interpolation bitslice ciphertext 01d64c7f311c077de13a0c9dbd8a243cc884e7fc3e dbd7641a538a5c99b5c4007fad2f8174a97703c 03a2499f2f6a f70df3bc501b927e d49a3f2f8ea7b020ac6fa313c8 0509b0d834faa8ae00064dd40e518e3a Daan Sprenkels We should share our secrets 28 December / 35

71 Implementation performance Measuring wall clock time 3 with (n, k) = (5, 4) language create combine Tight C loop 9.6µs 12µs Go bindings 11µs 15µs Rust bindings 8.8µs 5.4µs 3 Wall clock time, best of three on my crappy laptop Daan Sprenkels We should share our secrets 28 December / 35

72 Implementation performance Measuring wall clock time 3 with (n, k) = (5, 4) language create combine Tight C loop 9.6µs 12µs Go bindings 11µs 15µs Rust bindings 8.8µs 5.4µs Conclusion: I.e. roughly calls per second. 3 Wall clock time, best of three on my crappy laptop Daan Sprenkels We should share our secrets 28 December / 35

73 Stuff that can go wrong Possible mistakes: Assuming integrity Timing attacks Bad randomness Daan Sprenkels We should share our secrets 28 December / 35

74 Ethics Daan Sprenkels We should share our secrets 28 December / 35

75 Ethics Can our software be used with malicious intent? Daan Sprenkels We should share our secrets 28 December / 35

76 Demo Daan Sprenkels We should share our secrets 28 December / 35

77 Don t implement your own crypto Daan Sprenkels We should share our secrets 28 December / 35

78 Acknowledgements Ed Schouten Ken Swenson Pol van Aubel Thijs Miedema Cartoons on frame 9 authored by Randall Monroe Daan Sprenkels We should share our secrets 28 December / 35

79 Thank you! Slides can be found at sss project is at Extra reading: Find me through PGP key: 951D 6F6E C19E 5D87 1A61 A7F C075 FFD5 68CD Daan Sprenkels We should share our secrets 28 December / 35

80 References 64-ia-32-architectures-optimization-manual.pdf (Jun 2016) (2017) (2017) (2017) Pedersen, T.P., et al.: Non-interactive and information-theoretic secure verifiable secret sharing. In: Crypto. vol. 91, pp Springer (1991) Poettering, B.: Shamir Secret Sharing Scheme. (2006) Shamir, A.: How to share a secret. Commun. ACM 22(11), (Nov 1979), Silverstone, D.: gfshare. (2006) Daan Sprenkels We should share our secrets 28 December / 35

81 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: a 2 x1 2 + a 1x 1 + m = y 1 a 2 x2 2 + a 1x 2 + m = y 2 a 2 x3 2 + a 1x 3 + m = y 3 Daan Sprenkels We should share our secrets 28 December / 35

82 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: 1 2 a 2 + a 1 + m = a 2 + 4a 1 + m = a 2 + 2a 1 + m = 8 Daan Sprenkels We should share our secrets 28 December / 35

83 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: a 2 + a 1 + m = 21 16a 2 + 4a 1 + m = 6 4a 2 + 2a 1 + m = 8 Daan Sprenkels We should share our secrets 28 December / 35

84 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: 4a 2 + 4a 1 + 4m = 84 16a 2 + 4a 1 + m = 6 4a 2 + 2a 1 + m = 8 Daan Sprenkels We should share our secrets 28 December / 35

85 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: 2a 1 + 3m = 76 16a 2 + 4a 1 + m = 6 4a 2 + 2a 1 + m = 8 Daan Sprenkels We should share our secrets 28 December / 35

86 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: 2a 1 + 3m = 76 16a 2 + 4a 1 + m = 6 16a 2 + 8a 1 + 4m = 32 Daan Sprenkels We should share our secrets 28 December / 35

87 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: 2a 1 + 3m = 76 16a 2 + 4a 1 + m = 6 4a 1 + 3m = 26 Daan Sprenkels We should share our secrets 28 December / 35

88 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: 2a 1 + 3m = 76 4a 1 + 3m = 26 Daan Sprenkels We should share our secrets 28 December / 35

89 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: 4a 1 + 6m = 152 4a 1 + 3m = 26 Daan Sprenkels We should share our secrets 28 December / 35

90 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: 3m = 126 4a 1 + 3m = 26 Daan Sprenkels We should share our secrets 28 December / 35

91 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solve for m: 3m = 126 Daan Sprenkels We should share our secrets 28 December / 35

92 Example: combining shares (computation) s 1 = (1, 21), s 3 = (4, 6), s 4 = (2, 8) Solved for m: m = 42 Daan Sprenkels We should share our secrets 28 December / 35

93 Lagrange interpolation Given shares s 1,..., s k = (x 1, y 1 ),..., (x k, y k ). Use Lagrange interpolation to get m. l i (x) = j i x x j x i x j = (x x 1) (x i x 1 ) (x x k) (x i x k ) (2) L(x) = k y i l i (x) = y 1 l 1 (x) y k l k (x) (3) i=0 Daan Sprenkels We should share our secrets 28 December / 35

94 Lagrange interpolation Given shares s 1,..., s k = (x 1, y 1 ),..., (x k, y k ). Use Lagrange interpolation to get m. l i (x) = j i x x j x i x j = (x x 1) (x i x 1 ) (x x k) (x i x k ) (2) m = L(0) = k y i l i (0) = y 1 l 1 (0) y k l k (0) (3) i=0 Daan Sprenkels We should share our secrets 28 December / 35

95 Lagrange interpolation Given shares s 1,..., s k = (x 1, y 1 ),..., (x k, y k ). Use Lagrange interpolation to get m. l i (0) = j i 0 x j x i x j = (0 x 1) (x i x 1 ) (0 x k) (x i x k ) (2) m = L(0) = k y i l i (0) = y 1 l 1 (0) y k l k (0) (3) i=0 Daan Sprenkels We should share our secrets 28 December / 35

96 Lagrange interpolation Given shares s 1,..., s k = (x 1, y 1 ),..., (x k, y k ). Use Lagrange interpolation to get m. l i = j i x j x i x j = ( x 1) (x i x 1 ) ( x k ) (x i x k ) (2) m = k y i l i = y 1 l y k l k (3) i=0 Daan Sprenkels We should share our secrets 28 December / 35