a590003

Multi-instance Security and Password-based Cryptography 13
main GUESS P,m
pw[1],...,pw[m]←$P
pw ′ ←$B Test,Cor
Ret ∧ m
i=1 (pw′ [i] = pw[i])
main saGUESS P,m,ρ
pw[1],...,pw[m]←$P
For i = 1 to m do
For j = 1 to ρ do
sa[i,j]←${0,1} s
pw ′ ←$B Test,Cor (sa)
Ret ∧ m
i=1 (pw′ [i] = pw[i])
proc. Test(i,pw)
If (pw = pw[i]) then Ret true
Ret ⊥
proc. Test(pw,sa)
For i = 1 to m do
For j = 1 to ρ do
If (pw,sa) = (pw[i],sa[i,j]) then
Ret (i,j)
Ret (⊥,⊥)
proc. Cor(i)
Ret pw[i]
proc. Cor(i)
Ret pw[i]
Fig.3. An adaptive password-guessing game.
the adversary’s complexity and of some simpler relevant parameters of a password
sampler are desirable. One interesting case is samplers with high minentropy.
Formally, we say that P has min-entropy µ if for all pw ′ it holds that
Pr[pw = pw ′ ] ≤ 2 −µ over the coins used in choosing pw←$P.
Theorem 6. Fix m ≥ q c ≥ 0 and a password sampler P with min-entropy
µ. Let B be a (q t ,q c )-adversary for GUESS P,m making q i queries of the form
Test(i,·) with q t = q 1 + ··· + q m . Let δ = q t /(m2 µ ) and let γ = (m − q c )/m.
Then Adv guess
P,m (B) ≤ e−m∆(γ,δ) where ∆(γ,δ) = γln( γ δ )+(1−γ)ln(1−γ 1−δ ). □
Using∆(γ,δ) ≥ 2(γ−δ) 2 ,weseethattowintheguessinggameforq c corruptions,
q t ≈ (m−q c )·2 µ Testqueriesarenecessary,andthebrute-forceattackisoptimal.
Note that the above bound is the best we expect to prove: Indeed, assume for a
moment that we restrict ourselves to adversaries that want to recover a subset
of m−q c passwords, without corruptions, and make q t /m queries Test(i,·), for
each i, which are independent from queries Test(j,·) for other j ≠ i. Then, each
individual passwordis found,independently, with probabilityatmostq t /(m·2 µ ),
and if one applies the Chernoffbound, the probabilitythat a subsetofsize m−q c
of the passwords are retrieved is upper bounded by e −m∆(γ,δ) . In our case, we
have additional challenges: Foremost, queries for each i are not independent.
Also, the number of queries may not be the same for each index i. And finally,
we allow for corruption queries.
The full proof of Theorem 6 is given in [6]. At a high level, it begins by
showing how to move to a simpler setting in which the adversary wins by recovering
a subset of the passwords without the aid of a corrupt oracle. The
resulting setting is an example of a threshold direct product game. This allows
us to apply a generalized Chernoff bound due to Panconesi and Srinivasan [31]
(see also [20]) that reduces threshold direct product games to (non-threshold)
direct product games. Finally, we apply an amplification lemma due to Maurer,
Pietrzak, and Renner [25] that yields a direct product theorem for the password
guessing game. Let us also note that using the same technique, the better
14. Multi-Instance Security