On the Communication Complexity of Key-Agreement Protocols

Iftach Haitner,Noam Mazor,Rotem Oshman,Omer Reingold,Amir Yehudayoff
DOI: https://doi.org/10.48550/arXiv.2105.01958
2021-05-06
Abstract:Key-agreement protocols whose security is proven in the random oracle model are an important alternative to protocols based on public-key cryptography. In the random oracle model, the parties and the eavesdropper have access to a shared random function (an "oracle"), but the parties are limited in the number of queries they can make to the oracle. The random oracle serves as an abstraction for black-box access to a symmetric cryptographic primitive, such as a collision resistant hash. Unfortunately, as shown by Impagliazzo and Rudich [STOC '89] and Barak and Mahmoody [Crypto '09], such protocols can only guarantee limited secrecy: the key of any $\ell$-query protocol can be revealed by an $O(\ell^2)$-query adversary. This quadratic gap between the query complexity of the honest parties and the eavesdropper matches the gap obtained by the Merkle's Puzzles protocol of Merkle [CACM '78]. In this work we tackle a new aspect of key-agreement protocols in the random oracle model: their communication complexity. In Merkle's Puzzles, to obtain secrecy against an eavesdropper that makes roughly $\ell^2$ queries, the honest parties need to exchange $\Omega(\ell)$ bits. We show that for protocols with certain natural properties, ones that Merkle's Puzzle has, such high communication is unavoidable. Specifically, this is the case if the honest parties' queries are uniformly random, or alternatively if the protocol uses non-adaptive queries and has only two rounds. Our proof for the first setting uses a novel reduction from the set-disjointness problem in two-party communication complexity. For the second setting we prove the lower bound directly, using information-theoretic arguments.
Cryptography and Security
What problem does this paper attempt to address?
The problem that this paper attempts to solve is about the communication complexity of key agreement protocols in the random oracle model. Specifically, the paper explores how many bits of information two honest parties must exchange in order to achieve security against adversaries that can make approximately \( \Theta(\ell^2) \) queries. The paper pays particular attention to protocols with certain natural properties, such as Merkle's puzzles, which include: 1. **Uniform Query Protocol**: If the queries of each participating party in the protocol are a uniformly random set, then in order to achieve non - trivial security, the communication complexity of such protocols is at least \( \Omega(\ell) \). 2. **Two - Round Non - Adaptive Protocol**: For protocols that use non - adaptive (but arbitrary) queries and have only two rounds, if non - trivial security against \( q \)-query adversaries is to be achieved, their communication complexity is at least \( \Omega(q / \ell) \). By proving these lower bounds, the paper aims to understand the minimum amount of communication required for key agreement protocols in order to achieve security in the random oracle model. This is crucial for evaluating the practical application value of such protocols, especially in modern computing architectures, where even a quadratic gap may provide sufficient security advantages. However, an excessive communication burden may limit the practical usability of the protocol, so studying these communication complexity bounds is of great significance for designing efficient and secure key agreement protocols.