In this work, we study the problem of partial key exposure. Standard cryptographic definitions and constructions do not guarantee any security even if a tiny fraction of the secret key is compromised. We show how to build cryptographic primitives, in the standard model (without random oracles), that remain secure even when an adversary is able to learn almost all of the secret key. We accomplish this by giving constructions for the All-Or-Nothing Transform (AONT), introduced by Rivest. An AONT is an efficiently computable transform Ì on strings such that: For any string Ü, given all of Ì´Üµ, one can efficiently recover Ü. There exists some threshold such that any polynomial-time adversary that (adaptively) learns all but bits of Ì´Üµ obtains no information about Ü (in a computational sense). By applying an AONT to the secret key of any cryptographic system, we can obtain security against partial key exposure. The only previous construction of an AONT with provable security was based on random oracles. The key to our approach is a new notion, which may be of independent interest, which we call an Exposure-Resilient Function (ERF) -a deterministic function whose output appears random even if almost all the bits of the input are known. We show how to construct ERF's and AONT's with nearly optimal parameters from any one-way function. We also obtain several related results about these notions.
The notion that we investigate in this work can be seen as an enhancement of exposure-resilient functions (ERFs) as defined and constructed by Canetti et al. REF .
Exposure-Resilient Functions and All-or-Nothing Transforms
EUROCRYPT
Computer Science