A physical unclonable function (PUF), like a fingerprint, exploits manufacturing randomness to endow each physical item with a unique identifier. One primary PUF application is the secure derivation of volatile cryptographic keys using a fuzzy extractor (FE) comprising: 1) a secure sketch and 2) an entropy extractor. Although the entropy extractor can be lightweight, the overhead of the secure sketch responsible for correcting naturally noisy PUF responses is usually high. We observe that, in general, response unreliability with respect to an enrolled reference measurement increases with increasing differences between the in-the-field PUF operating condition and the operating condition used in evaluating the enrolled reference response. For the first time, we exploit such an inadvertent but important observation. In contrast to the conventional single reference response enrollment, we propose enrolling multiple reference responses (MRRs) subject to the same challenge but under multiple distinct operating conditions. The critical observation here is that one of the reference operating conditions is likely to be closer to the operating condition of the field deployed PUF, thus resulting in minimizing the expected unreliability when compared to the single reference under the nominal condition. As a consequence, MRR greatly reduces the demand for the expected number of erroneous bits requiring correction and, subsequently, achieves a significant reduction in the error correction overhead. The significant implementation efficiency gains from the proposed MRR method are demonstrated from software implementations of FEs on batteryless resource constraint computational radio frequency identification devices, where realistic PUF data are collected from intrinsic static random access memory PUFs.
A reverse fuzzy extractor is beneficial in reducing the implementation overhead of a PUF key generator on a resource limited token. Mutual authentication based on RFE is firstly proposed by Van Herrewege @cite_21 , later improved by Maes @cite_39 . In Fig. , it depicts the RFE-based mutual authentication protocol in @cite_39 . Notably, the gray shaded secure key @math Hash ( @math ) in Fig. is not explicitly utilized in @cite_39 , instead @math itself is treated as a shared key between the server and the token. Here, instead of using the response @math that might not be uniformly distributed---not having full bit entropy---we adopt the hash function Hash() to extract key sk with full bit-entropy.
@cite_21 @cite_39
2140805804 2097079400 2146813141 2620403523
We study the question of basing symmetric key cryptography on weak secrets. In this setting, Alice and Bob share an n-bit secret W, which might not be uniformly random, but the adversary has at least k bits of uncertainty about it (formalized using conditional min-entropy). Since standard symmetric-key primitives require uniformly random secret keys, we would like to construct an authenticated key agreement protocol in which Alice and Bob use W to agree on a nearly uniform key R, by communicating over a public channel controlled by an active adversary Eve. We study this question in the information theoretic setting where the attacker is computationally unbounded. We show that single-round (i.e. one message) protocols do not work when k ≤ n 2, and require poor parameters even when n 2 On the other hand, for arbitrary values of k, we design a communication efficient two-round (challenge-response) protocol extracting nearly k random bits. This dramatically improves the previous construction of Renner and Wolf [32], which requires Θ(λ + log(n)) rounds where λ is the security parameter. Our solution takes a new approach by studying and constructing "non-malleable" seeded randomness extractors -- if an attacker sees a random seed X and comes up with an arbitrarily related seed X', then we bound the relationship between R= Ext(W;X) and R' = Ext(W;X'). We also extend our two-round key agreement protocol to the "fuzzy" setting, where Alice and Bob share "close" (but not equal) secrets WA and WB, and to the Bounded Retrieval Model (BRM) where the size of the secret W is huge. We consider information-theoretic key agreement between two parties sharing somewhat different versions of a secret w that has relatively little entropy. Such key agreement, also known as information reconciliation and privacy amplification over unsecured channels, was shown to be theoretically feasible by Renner and Wolf (Eurocrypt 2004), although no protocol that runs in polynomial time was described. We propose a protocol that is not only polynomial-time, but actually practical, requiring only a few seconds on consumer-grade computers. Our protocol can be seen as an interactive version of robust fuzzy extractors (, Crypto 2006). While robust fuzzy extractors, due to their noninteractive nature, require w to have entropy at least half its length, we have no such constraint. In fact, unlike in prior solutions, in our solution the entropy loss is essentially unrelated to the length or the entropy of w , and depends only on the security parameter. We provide formal definitions and efficient secure techniques for turning noisy information into keys usable for any cryptographic application, and, in particular, reliably and securely authenticating biometric data. Our techniques apply not just to biometric information, but to any keying material that, unlike traditional cryptographic keys, is (1) not reproducible precisely and (2) not distributed uniformly. We propose two primitives: a fuzzy extractor reliably extracts nearly uniform randomness @math from its input; the extraction is error-tolerant in the sense that @math will be the same even if the input changes, as long as it remains reasonably close to the original. Thus, @math can be used as a key in a cryptographic application. A secure sketch produces public information about its input @math that does not reveal @math and yet allows exact recovery of @math given another value that is close to @math . Thus, it can be used to reliably reproduce error-prone biometric inputs without incurring the security risk inherent in storing them. We define the primitives to be both formally secure and versatile, generalizing much prior work. In addition, we provide nearly optimal constructions of both primitives for various measures of “closeness” of input data, such as Hamming distance, edit distance, and set difference. We propose a multi-user Symmetric Searchable Encryption (SSE) scheme based on the single-user Oblivious Cross Tags (OXT) protocol (, CRYPTO 2013). The scheme allows any user to perform a search query by interacting with the server and any ( -1 ) ‘helping’ users, and preserves the privacy of database content against the server even assuming leakage of up to ( -1 ) users’ keys to the server (for a threshold parameter ( )), while hiding the query from the ( -1 ) ‘helping users’. To achieve the latter query privacy property, we design a new distributed key-homomorphic pseudorandom function (PRF) that hides the PRF input (search keyword) from the ‘helping’ key share holders. By distributing the utilized keys among the users, the need of constant online presence of the data owner to provide services to the users is eliminated, while providing resilience against user key exposure.