We remark that the Bellare-Rivest protocol for translucent cryptography [J.
Cryptology (1999) 12: 117-139] can not truly enable the government to decrypt
partial encrypted communications

Cao, Zhengjun

Liu, Lihua

English

arXiv

We remark that the Bellare-Rivest protocol for translucent cryptography [J. Cryptology (1999) 12: 117-139] can not truly enable the government to decrypt partial encrypted communications

Zhengjun Cao

Lihua Liu

Cryptology ePrint Archive

A Note on the Bellare-Rivest Protocol forTranslucent CryptographyZhengjun Cao1, Lihua Liu2,∗AbstractWe remark that the Bellare-Rivest protocol for translucent cryptography [J. Cryptology(1999) 12: 117-139] can not truly enable the government to decrypt partial encrypted commu-nications.Keywords. Translucent cryptography, individual privacy, oblivious transfer, ElGamal en-cryption.1 IntroductionThe primitive of translucent cryptography introduced by Bellare and Rivest [2] is viewed as analternative to the controversial key-escrow techniques. It aims to achieve an appropriate balancebetween individual privacy and government access to communications. The main idea behind theirprotocol for the primitive can be described as follows.Suppose that Bob’s public key is pkB and Larry’s public parameters are V1, · · · , Vt, where therole of Larry is played by the government. Among these V1, · · · , Vt, only one is the good parameterfor Larry, i.e., he knows the relevant trapdoor. But nobody knows which is the good parameterexcept Larry himself. When Alice wants to send a session key s to Bob, which shall be used forthe later symmetric encryption, she randomly picks a parameter Vi ∈ {V1, · · · , Vt} and a secretexponent k and sends {gk, sykB; sVik, i}, where g is the generator of the ElGamal cryptosystem andyB is Bob’s public key. If Vi is just the good parameter, then Larry shall successfully recover s.Otherwise, Larry fails to recover it.The Bellare-Rivest protocol is based on noninteractive fractional oblivious transfer and uses justone ElGamal encryption. In the scenario, Larry plays the role of receiver. But we find the OT modelis not appropriate to this situation because: 1) the transferred messages is not recognizable for thereceiver, 2) the sender is not willing to disclose some messages to the receiver. Moreover, there isshort of a mechanism for ElGamal encryption to force the sender to invoke any Vi ∈ {V1, · · · , Vt}.That means the sender can chose an index i, a secret exponent k and a random element V̂ and1Department of Mathematics, Shanghai University, Shanghai, China. 2Department of Mathematics, ShanghaiMaritime University, Shanghai, China. ∗ liulh@shmtu.edu.cn1generate the malformed ciphertext {gk, sykB; sV̂ k, i}. In such case, Bob can successfully recoverthe session key s, but Larry can not recover it. Thus the Bellare-Rivest protocol for translucentcryptography can not truly enable government to decrypt partial encrypted communications.2 Description of the Bellare-Rivest protocolThe implementation of translucent cryptography based on noninteractive oblivious transfer willnot incur any “extra flows”. When Alice wishes to communicate with Bob, her only transmissionis to Bob. If the government wants to know something about what Alice is saying to Bob, it mustwiretap their communications, and then it will be able to decrypt a fraction of the messages itpicks up.Global setup. The ACLU (American Civil Liberties Union) picks a large global prime ρ (say atleast 1024 bits in length), a generator g of the multiplicative group Z∗ρ and a value U such that noone knows the discrete logarithm logg(U) of U , modulo ρ.Publication of Larry’s public parameters. Larry picks a secret exponent xL ∈ Zρ−1 and a randomindex ` ∈ {1, · · · , t}, and computes V` = gxL mod ρ, Vj = V`U j−` mod ρ, j = 1, · · · , t. Noticethat V` is the only one good key for Larry. Only Larry knows its secret index `. Any one can verifythat whether V1, · · · , Vt are well-formed by checking Vj/V1 = U j−1 mod ρ, where j ∈ {2, · · · , t}.Encryption. Suppose that Bob’s public key is yB = gxB mod ρ, for some secret exponentxB ∈ Zρ−1. When Alice wants to send a session key s to Bob, she picks a random exponentk ∈ Zρ−1 and Vi ∈ {V1, · · · , Vt}, and sends the ciphertext {c1, c2; c3, i} = {gk, sykB; sV ki , i}.Decryption for Bob. Bob computes s = c2/cxB1 mod ρ.Decryption for Larry. If Vi is the good key for Larry, he computes s = c3/cxL1 mod ρ.3 Remarks on the Bellare-Rivest protocolFrom the practical point of view, the Bellare-Rivest Protocol has some drawbacks.(1) Reveal of good key. It is easy to find that Larry’s security relies on the fact that Alice doesnot know his secret index `; if she did, she could encrypt using only the other keys, and Larry wouldnever be able to recover the session key s. Suppose that Larry needs to use the wiretap informationas evidence in a court case. The plaintexts are then revealed, and, by their examination, Alice candetermine which of her messages were decrypted. This tells her what Larry’s secret index is.Bellare and Rivest [2] suggest that Larry have many public keys, with different keys usedin different programs or devices at different times. Clearly, this will incur heavy cost for keymanagement. This drawback renders the protocol unrealistic.(2) Malformed ciphertext attack. In order to enable Larry (the government) to decrypt partialencrypted communications, Alice must follow the translucent cryptography protocol properly. IfAlice generates the ciphertext as {gk, sykB; sV̂ k, i} for some random element V̂ /∈ {V1, · · · , Vt} and2i 6= `, then Larry can not find her trick. Even if i = `, Larry can not recover the session key s.Bellare and Rivest [2] suggest that Larry’s key should be digitally signed under some globalpublic key which is embedded in a commercially available crypto-box. Note that Larry’s key cannotbe embedded in the box because they may need to be changed now and then. Regretfully, they didnot specify the method to force Alice to invoke Larry’s key. In fact, it is impossible for ElGamalcryptosystem to check the ciphertext {gk, sykB; sV ki , i} is well formed, i.e., Vi is indeed invoked andincluded in the third component. In short, the attack discounts greatly the importance of theprotocol.4 Misused noninteractive fractional oblivious transferThe oblivious transfer primitive is due to Rabin [4]. It has been formalized and extended byEven et al. [3]. We pint out that in most reasonable applications of OT, the transferred messagesmust be recognizable for the receiver, or the sender is willing to disclose some messages to thereceiver. The property has been explicitly specified in the earlier works. We refer to the followingdescriptions.In Ref.[4], Rabin explained that:Bob and Alice each have a secret, SB and SA, respectively, which they wish toexchange. For example, SB may be the password to a file that Alice wants to access(we shall refer to this file as Alice’s file), and SA the password to Bob’s file. To excludethe possibility of randomizing on the possible digits of the password, we assume that ifan incorrect password is used then the file is erased, and that Bob and Alice want toguarantee that this will not happen to their respective files.In Ref.[3], Even, Goldreich and Lempel stressed that:The notion of a “recognizable secret message” plays an important role in our def-inition of OT. A message is said to be a recognizable secret if, although the receivercannot compute it, he can authenticate it once he receives it.The notion of a recognizable secret message is evidently relevant to the study ofcryptographic protocols, in which the sender is reluctant to send the message while thereceiver wishes to get it. In such protocols, it makes no sense to consider the transfer ofmessages that are either not secret (to the receiver) or not recognizable (by the receiver).In symmetric case, such as exchanging secrets, signing contracts, both two participators caneasily verify the correctness of the received messages. In unsymmetric case, such as a databasemanager plays the role of the sender and a client plays the role of the receiver, it is usual that thesender is willing to disclose some messages to the receiver.It claims that the Bellare-Rivest protocol is based on noninteractive oblivious transfer, whichis due to Bellare and Micali [1]. We here stress that the transferred session key s in their protocol3is not recognizable (by the government). Besides, the sender (Alice) is reluctant to reveal s to thegovernment (Larry). Thus, the primitive of OT is not appropriate to this case. Frankly speaking,the essential technique used in the Bellare-Rivest protocol is to mix some padding parameters withthe Larry’s true parameter (he knows the relevant trapdoor) such that others can not decide whichparameter is his true public key.5 ConclusionThe Bellare-Rivest protocol for translucent cryptography seems impossible to implement al-though interesting. We hope this note is helpful to clarify some misunderstandings about nonin-teractive oblivious transfer as well as OT itself.References[1] Bellare M. and Micali S.: Non-interactive oblivious transfer and applications. CRYPTO 89, pages 547-559. Lecture Notes in Computer Science, volume 435. Springer-Verlag, Berlin (1990)[2] Bellare M., Rivest R.: Translucent Cryptography An Alternative to Key Escrow, and Its Implementationvia Fractional Oblivious Transfer. J. Cryptology (1999) 12: 117-139. Springer-Verlag, Berlin (1999)[3] Even S., Goldreich O., Lempel A.: A randomized protocol for signing contracts. Commun. ACM 28(6),637-647 (1985)[4] Rabin, M.: How to exchange secrets by oblivious transfer. Technical Report TR-81, Aiken ComputationLaboratory, Harvard University (1981)4

A Note on the Bellare-Rivest Protocol for Translucent Cryptography

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive