Cryptology ePrint Archive: Report 2012/196

Multi-Instance Security and its Application to Password-Based Cryptography

Mihir Bellare and Thomas Ristenpart and Stefano Tessaro

Abstract: This paper develops a theory of multi-instance (mi) security and applies it to provide the first proof-based support for the classical practice of salting in password-based cryptography. Mi-security comes into play in settings (like password-based cryptography) where it is computationally feasible to compromise a single instance, and provides a second line of defense, aiming to ensure (in the case of passwords, via salting) that the effort to compromise all of some large number $m$ of instances grows linearly with m. The first challenge is definitions, where we suggest LORX-security as a good metric for mi security of encryption and support this claim by showing it implies other natural metrics, illustrating in the process that even lifting simple results from the si setting to the mi one calls for new techniques. Next we provide a composition-based framework to transfer standard single-instance (si) security to mi-security with the aid of a key-derivation function. Analyzing password-based KDFs from the PKCS#5 standard to show that they meet our indifferentiability-style mi-security definition for KDFs, we are able to conclude with the first proof that per password salts amplify mi-security as hoped in practice. We believe that mi-security is of interest in other domains and that this work provides the foundation for its further theoretical development and practical application.

Category / Keywords: secret-key cryptography / Passwords, security amplification, indifferentiability, random oracles

Publication Info: Preliminary version in CRYPTO 2012. This is the full version.

Date: received 11 Apr 2012, last revised 11 Dec 2012

Contact author: mihir at eng ucsd edu

Available formats: Postscript (PS) | Compressed Postscript (PS.GZ) | PDF | BibTeX Citation

Version: 20121211:203211 (All versions of this report)

Discussion forum: Show discussion | Start new discussion