陷门求逆群Controlled Algebras and GII.ppt

Controlled Algebras and GII’s Ronald L. Rivest MIT CSAIL IPAM Workshop October 9, 2006 Outline Controlled algebras Trapdoor discrete log groups Black box pseudo-free groups Groups with infeasible inverses Transitive signatures Trapdoor pairings Algebra ( S1 , S2 , op1 , op2, …, opn ) Algebra is set(s) with operation(s). Abstract algebra is mathematical object. Instantiation is computational object: Each element of set has one or more representations. Each operation has associated computational procedure. Controlled Algebra ( S , op1 , op2, op3, op4, …, opn ) F F I T T Control computation of each operation: F (feasible or public: public poly-time algorithm) I (infeasible: no poly-time alg. exists) T (trapdoor: polytime only with trapdoor information) Which controlled algebras can we make? Controlled Groups Group operations: Identity: produces identity element e Generator(s): produces generator(s) Sample: produces random element Multiply: group operation Invert: given x , compute x-1 Equal: test equality of elements Canonical: give canonical rep of element Discrete log, root, DDH, CDH, hash, … Each separately controlled… Analogy: gene expression One of the marvelous features of the way DNA works is that the semantics of the gene (i.e., what protein is made) is decoupled from the control of its expression. Semantics and control may evolve separately. Example: Trapdoor DL groups (See Dent and Galbraith 2006) Generator g: public, generates G = g Multiplication (group opn): public Discrete logarithm: trapdoor Applications: key agreement, encryption. (Publish group description as public key…) Trapdoor DL groups Open problem to construct practical trapdoor DL groups. Paillier cryptosystem comes close. Dent Galbraith also propose pairing-based approach; large tables required. Black box group Controlled group related to notion of black box group (group operation efficient; others, such as discrete log, m