论文学习笔记 Diogenes: Lightweight Scalable RSA Modulus Generation with a Dishonest Majority

Introduction

What is an RSA Modulus? Answer：N=pq

这里引入一个新的概念Biprime，若N为biprime则其为两个素数的乘积
Biprime - product of exactly two primes

RSA History

1. 1977 - RSA Public-Key Encryption
2. 1999 - Paillier Public-Key Encryption
3. 2001 - CRS for UC setting
4. 2018 - Verifiable Delay Functions (VDF)

(1)The properties of VDF

(2)VDF Construction
1996 - Rivest-Shamir-Wagner timelock puzzle
$$y=g^{2^T}modN$$
2018 - VDF constructions by Pietrzak, Wesolowski

Scheme

Goal

1、参与者交互选取一个biprime N。
2、1024 parties + (n-1) active security
步骤1: 设计安全的协议以对抗被动敌手
步骤2:扩展到对抗活跃敌手

Step 1: Scalable Passive Protocol

Boneh-Franklin Framework[BF97]

1. 参与者随机选取 $p_i,q_i$
2. 参与者协作计算$N={\sum }_i{p}_i\cdot {\sum }_i{q}_i$
3. 检验$N$是否为两个素数的乘积

Overview of techniques

Approach

1. Sieve first
2. construct later[CCD+20]

下面为2020年Crypto上论文Multiparty Generation of an RSA Modulus中阐述预筛选方法来源（证明？），主要涉及中国剩余定理。若感兴趣可查看相关论文。

下面为2020年Crypto上论文Multiparty Generation of an RSA Modulus中阐述中国剩余定理与用户选取数求和的相关等式，也是Diogenes: Lightweight Scalable RSA Modulus Generation with a Dishonest Majority中最后构造活跃协议的产生$N$的方法来源（证明），主要涉及中国剩余定理和乘法三元组技术（Mutiplication triple technique）。

Threshold Homomorphic Encryption

1. Distributed key generation
   Public key: $PK$ Secret keys: $s{k}_1,\dots ,s{k}_n$
2. Encryption
   $En{c}_{PK}(m)$
3. Distributed decryption
   $m=De{c}_{s{k}_1}(c)+\cdots +De{c}_{s{k}_n}(c)$
4. Addition under encryption
   $En{c}_{PK}(m_1)+En{c}_{PK}(m_2)=En{c}_{PK}(m_1+m_2)$
5. Scalar multiplication under encryption
   $a\cdot En{c}_{PK}(m)=En{c}_{PK}(a\cdot m)$

Generation process

[BF97]’s Distributed Biprimality Test

Please refer to Overview of techniques —BI-PRIMALITY TEST.

Step 2: Security against Active Adversaries

Beaver’s triple

Given a random triple [a], [b], [c], each party $P_i$ inputs $[x{]}_i$ and $[y{]}_i$. Finally, $P_i$ can obtain $[xy{]}_i$, where $xy$=${\sum }_i{x}_i{\sum }_i{y}_i$.
More details are described as follows.

PROTOCOL ${\Pi }_{(RSA-ML)}$

1. Notations
2. Triples generation
3. Pre-sieving
4. CRT reconstruction
5. Candidate generation=Deconstruct+ Triple technique in pre-sieving+ CRT reconstruction
6. Jacobi test(normal)GCD test=Triple technique in pre-sieving +GCD test(normal)
7. Certification (in triple technique) and Σ-protocol(in Jacobi test)
8. Output phase

Pre-sieving

CRT reconstruction

Candidate generation—Deconstruct

Σ-protocol

Summary

1. Key Setup Generate threshold keys
2. Generate Candidates Sample pre-approved primes
3. Compute Products Use TAHE to compute candidates
4. Biprimality test BF biprimality test
5. Certification Ligero ZK + Sigma