私人儲存空間之可否認加密機制

Deniable Encryption Scheme for Private Storage

范宜安(I-An Fan)

指導教授 ： 雷欽隆

國立臺灣大學/電機資訊學院/電機工程學研究所/碩士(2012年)

https://doi.org/10.6342/NTU.2012.02908

摘要

現在資料所可能受到的威脅中，有一種是權力者使用法律或相關規定迫使使用者交出其金鑰或加密內容，可否認性加密機制即為此而生。可否認性加密機制在不同的使用場合有不同的考量與組合，在多人傳輸上有各方的否認性問題，在私人儲存上不能儲存太多金鑰。
另一點要考量的是合理的解釋，可否認性機制的一個主要用途是用於說服，使自己在特定場合獲得有利的證據，而用於解釋的證據分為兩類，一類事先準備，另一類事後補足即可，本文使用事先準備的方式運作。
在就連機制原理都被知道的狀況下也能達到可否認性是重要的，本文利用「至少有一個解釋，而解釋的個數可以無上限」的方式達到此目標。
本機制主要分成兩個階段，其一使用線性祕密分享機制將要加密的原文包裝成多維空間的點坐標，並湊齊一定數量的點製成密文平面，另一個階段將數個不同的檔案編號包裝成各自的標簽。在給入不同的金鑰會從標簽看到不同的檔案編號，藉此不同密文的檔案編號各自組合回該金鑰視點所看得到的原文。在可否認性機制上依然受到資訊理論的極限所限制，兩個階段分別達成不同的目標。第一階段主要負責打散資訊，使得所有的檔案都具有一定的解釋力，並維持著資訊理論的極限，達成高填充率(單一密文中所代表的資訊量)，第二階段主要負責達成可否認性的特質，也為了達成此特質，此部分填充率會表現較差，但此階段所承載之資訊量較低，整體的填充率表現會傾向第一階段所表現出的結果。
由於本機制是利用於私人儲存空間上，此機制附帶了一般的資料結構操作，使此機制能夠動態使用。

關鍵字

可否認性加密機制 ； 線性祕密分享機制 ； 私人儲存

並列摘要

There are many types of threat to the data, one is the authority forces the user to give out the key or encrypted contents, and deniable encryption (DE) is designed for this. DE has different design for different scene. In multi-party connection, there’s problem for the deniability for every party. In private storage scheme, there’s problem for constant-size key.
Another problem to consider is reasonable explanation, DE is used mainly for convince someone, to make the specific situation advantageous. There are two types of proof for explanation, plan-ahead and ad-hoc. The former one needs to prepare fake data in advance, and the latter one made fake data at the time of coercion. In our scheme, we use the plan-ahead type.
It is important to achieve deniability even all the scheme is known for adversary. In our scheme, we use “There is at least one explanation, but there is no limit for explain” to achieve deniability.
There are two phases in our scheme, the first we pack the plaintext into coordinates in multi-dimension space, and use Linear Secret Sharing Scheme (LSSS) method to pack points into cipher plane. Another phase we pack the indices of data into a tag. While giving different keys, the tag will show different indices. Using different indices and combine the cipher planes with those indices would solve different plaintext. The DE is still limited by information theory. The first phase is for scramble the proof to make every file explainable, and maintain the limit by information theory to get high filling rate (the amount of information stored in unit ciphertext). The second phase achieves deniability, this makes this stage getting bad filling rate. Compared with the first phase, the second phase has lower amount of information, therefore, the total filling rate would be closed to the first phase.
This scheme is used for private storage, to make this storage to operate dynamically, we attach several data structure operations.

並列關鍵字

Deniable encryption ； Linear secret sharing scheme ； Private storage

參考文獻

[4] A. Shamir, “How to share a secret,” Communications of the ACM, v.22 n.11, p.612-613, Nov. 1979.

[13] X. Zhou, H. Pang, K. Tan, “Hiding Data Accesses in Steganographic File System,” Proceedings of the 20th International Conference on Data Engineering, pp. 572, March 30-April 02, 2004.

[20] D. Walton, “Plausible deniability and evasion of burden of proof,” Argumentation , vol. 10, pp. 47-58, 1996.

[1] R. Cramer, I. Damgard, and U. Maurer, “General secure multi-party computation from any linear secret-sharing scheme,” Proceedings of the 19th international conference on Theory and application of cryptographic techniques, May 14-18, 2000, Bruges, Belgium.

[2] J. L. Massey, “Minimal codewords and secret sharing,” In 6th Joint Swedish-Russian Workshop On Information Theory, pp. 276-279, 1993.