Bloom Filter Encryption and Applications to Efficient Forward-Secret 0-RTT Key Exchange

Authors

David Derler, Tibor Jager, Daniel Slamanig, Christoph Striecks

Abstract

Forward secrecy is considered an essential design goal of modern key establishment (KE) protocols, such as TLS 1.3, for example. Furthermore, efficiency considerations such as zero round-trip time (0-RTT), where a client is able to send cryptographically protected payload data with the very first KE message, are motivated by the practical demand for secure low-latency communication.
For a long time, it was unclear whether protocols that simultaneously achieve 0-RTT and full forward secrecy exist. Only recently, the first forward-secure 0-RTT protocol was described by Günther et al. (EUROCRYPT 2017). It is based on Puncturable Encryption. Unfortunately, their scheme is completely impractical, since one puncturing operation takes between 30 seconds and several minutes for reasonable security and deployment parameters, such that this solution is only a first feasibility result, but not efficient enough to be deployed in practice.
Forward security is achieved by "puncturing'' the secret key after each decryption operation, such that a given ciphertext can only be decrypted once (cf. also Green and Miers, S&P 2015).
In this paper, we introduce a new primitive that we term Bloom Filter Encryption (BFE), which is derived from the probabilistic Bloom filter data structure.
We describe different constructions of BFE schemes, and show how these yield new puncturable encryption mechanisms with extremely efficient puncturing. Most importantly, a puncturing operation only involves a small number of very efficient computations, plus the deletion of certain parts of the secret key, which outperforms previous constructions by orders of magnitude. This gives rise to the first forward-secure 0-RTT protocols that are efficient enough to be deployed in practice. We, however, believe that BFE will find applications beyond forward-secure 0-RTT protocols.

Venue

EUROCRYPT 2018 (https://eurocrypt.iacr.org/2018/)

Place and Date

Tel Aviv, Israel, April 29-May 3, 2018

[Download]