Modern key distribution with ClaimChains

Transcription

1 Modern key distribution with ClaimChains A decentralized Public Key Infrastructure that supports privacy-friendly social verification NEXTLEAP Bogdan Kulynych Marios Isaakidis Carmela Troncoso George Danezis photo by lisa cee

2

3 HIGH-INTEGRITY Tamper proof Authenticity

4 DECENTRALIZATION HIGH-INTEGRITY Availability Tamper proof Censorship-resistant Authenticity Global consensus

5 Cryptocurrency chains TRANSACTIONS Powerful abstraction for identities Global namespace HEAD No mechanism for social validation All transactions are public Users need to buy coins and pay for transaction fees Resource expensive transaction x transaction x... transaction xn BLOCK HEADER pointer to previous block hash of block transactions timestamp...

6 Federated Merkle prefix tree chains Accountability Easy discovery Efficient Do not prevent equivocation Centralization Single point of failure Surveillance keybase.io CONIKS CONIKS

7 Merkle binary prefix trees Leaf nodes are ordered using a Verifiable Random Function H(child, child) i = v = valuey i = v = valuex

8 ClaimChains claimchain.github.io photo by Wendi Halet

9 ClaimChains A ClaimChain for each user/device/identity Blocks appended as needed Compromises appear as ClaimChain forks Owner selects who can read a specific claim all readers get the same content

10 ClaimChains cross-hash A ClaimChain for each user/device/identity Blocks appended as needed Compromises appear as ClaimChain forks Owner selects who can read a specific claim all readers get the same content

11 ClaimChains cross-hash A ClaimChain for each user/device/identity Blocks appended as needed Compromises appear as ClaimChain forks Owner selects who can read a specific claim all readers get the same content Propagation of key updates in cliques of user Vouch for the latest state of a friend s ClaimChain Friend introductions - Social validation Web of Trust while preserving privacy

12 Overview ClaimChains are high-integrity, authenticated data stores that can support generic claims Privacy: a capabilities mechanism for fine-grained claim-specific access control Non-equivocation: all readers of a private claim get the same view Cross-hashing enables the propagation and vouching of the latest state of linked ClaimChains Equivocation attempts a compromises produce non-repudiable cryptographic evidence ( ClaimChain forks ) Flexible in terms of deployment Efficient selective sharing of claims

13 ClaimChains block structure ClaimChain version Block index Timestamp Nonce CLAIMCHAIN METADATA Connected identities ClaimChain Public keys (pksig, pkvrf, pkdh) BLOCK MAP Merkle prefix tree with all claims and capabilities Pointers to previous blocks Signature under pksig

14 Block claim map: Adding a claim label = bob@riseup.net claim = 55b693e5

15 Block claim map: Adding a claim label = bob@riseup.net claim = 55b693e5 ) Compute claim key k = VRF ( nonce)

16 Block claim map: Adding a claim label = bob@riseup.net claim = 55b693e5 ) Compute claim key k = VRF ( nonce) 2) Calculate the index of the leaf node: i = SHA256( k lookup )

17 Block claim map: Adding a claim label = bob@riseup.net claim = 55b693e5 ) Compute claim key k = VRF ( nonce) 2) Calculate the index of the leaf node: i = SHA256( k lookup ) 3) Generate a symm. enc. key K = SHA256( k enc )

18 Block claim map: Adding a claim label = bob@riseup.net claim = 55b693e5 ) Compute claim key k = VRF ( nonce) 2) Calculate the index of the leaf node: i = SHA256( k lookup ) 3) Generate a symm. enc. key K = SHA256( k enc ) 4) Encrypt claim content C = EncK( VRFproof + 55b693e5 )

19 Block claim map: Adding a claim label = bob@riseup.net claim = 55b693e5 ) Compute claim key k = VRF ( nonce) 2) Calculate the index of the leaf node: i = SHA256( k lookup ) 3) Generate a symm. enc. key K = SHA256( k enc ) 4) Encrypt claim content C = EncK( VRFproof + 55b693e5 ) i =...

20 Block claim map: Adding a capability for to read i =...

21 Block claim map: Adding a capability for to read ) Establish DH shared secret s between i =... and

22 Block claim map: Adding a capability for to read ) Establish DH shared secret s between 2) Derive the capability lookup key i = SHA256 ( nonce s lookup ) i =... and

23 Block claim map: Adding a capability for to read ) Establish DH shared secret s between 2) Derive the capability lookup key i = SHA256 ( nonce s lookup ) 3) Derive the symm. enc. key K = SHA256( nonce s enc ) i =... and

24 Block claim map: Adding a capability for to read ) Establish DH shared secret s between and 2) Derive the capability lookup key i = SHA256 ( nonce s lookup ) 3) Derive the symm. enc. key K = SHA256( nonce s enc ) 4) Encrypt claim key VRF ( nonce) C = EncK( k ) i =...

25 Block claim map: Adding a capability for to read ) Establish DH shared secret s between and 2) Derive the capability lookup key i = SHA256 ( nonce s lookup ) 3) Derive the symm. enc. key K = SHA256( nonce s enc ) 4) Encrypt claim key VRF ( nonce) C = EncK( k ) i =... i =...

26 Block claim map: retrieving the latest update for i =... i =...

27 Block claim map: retrieving the latest update for ) Establish DH shared secret s between i =... and i =...

28 Block claim map: retrieving the latest update for ) Establish DH shared secret s between and 2) Derive the capability lookup key i = SHA256 ( nonce s lookup ) i =... i =...

29 Block claim map: retrieving the latest update for ) Establish DH shared secret s between and 2) Derive the capability lookup key i = SHA256 ( nonce s lookup ) 3) Derive the symm. enc. key K = SHA256( nonce s enc ) i =... i =...

30 Block claim map: retrieving the latest update for ) Establish DH shared secret s between and 2) Derive the capability lookup key i = SHA256 ( nonce s lookup ) 3) Derive the symm. enc. key K = SHA256( nonce s enc ) 4) Retrieve capability block and decrypt it with K Result: key for s claim i =... i =... i =...

31 Block claim map: retrieving the latest update for ) Establish DH shared secret s between and 2) Derive the capability lookup key i = SHA256 ( nonce s lookup ) 3) Derive the symm. enc. key K = SHA256( nonce s enc ) 4) Retrieve capability block and decrypt it with K i =... Result: key for s claim i =... 5) Retrieve s claim and decrypt it i =... i =...

32 Block claim map: retrieving the latest update for ) Establish DH shared secret s between and 2) Derive the capability lookup key i = SHA256 ( nonce s lookup ) 3) Derive the symm. enc. key K = SHA256( nonce s enc ) 4) Retrieve capability block and decrypt it with K i =... Result: key for s claim i =... 5) Retrieve s claim and decrypt it 6)i =Verify VRFproof... i =...

33 Resilience Field research to understand user needs Collaboration with related communities Applied research: Cryptographic games to define security and privacy properties Formally verified implementation Simulations using real world data Interoperability and plans for gradual deployment User-centric design Multidisciplinarity Open Innovation (open access and extendability)

34 Thank claimchain.github.io photo by alcidecota

35 Evaluation of scalability Claim map construction time Cumulative block storage size

36 Key propagation in a fully decentralized setting Outgoing bandwidth cost encryption status (%)

37 Merkle binary prefix trees: Proof of inclusion

38 Merkle binary prefix trees: Proof of inclusion xa2b3c) =...

39 Merkle binary prefix trees: Proof of inclusion xa2b3c) =...

40 Merkle binary prefix trees: Proof of inclusion xa2b3c) =... i = v =xa2b

41 Merkle binary prefix trees: Proof of inclusion xa2b3c) =... i = v =xa2b

42 Merkle binary prefix trees: Proof of absence

43 Merkle binary prefix trees: Proof of absence =...

44 Merkle binary prefix trees: Proof of absence =...

45 Merkle binary prefix trees: Proof of absence =... i = v =xffff

46 Merkle binary prefix trees: Proof of absence =... i = v =xffff

47 Merkle binary prefix trees: Proof of absence =... i = v =xffff