Homomorphic signatures for network coding

Let ${\displaystyle G=(V,E)}$ be a directed graph where ${\displaystyle V}$ is a set, whose elements are called vertices or nodes, and ${\displaystyle E}$ is a set of ordered pairs of vertices, called arcs, directed edges, or arrows. A source ${\displaystyle s\in V}$ wants to transmit a file ${\displaystyle D}$ to a set ${\displaystyle T\subseteq V}$ of the vertices. One chooses a vector space ${\displaystyle W/\mathbb {F} _{p}}$(say of dimension ${\displaystyle d}$), where ${\displaystyle p}$ is a prime, and views the data to be transmitted as a bunch of vectors ${\displaystyle w_{1},\ldots ,w_{k}\in W}$. The source then creates the augmented vectors ${\displaystyle v_{1},\ldots ,v_{k}}$ by setting ${\displaystyle v_{i}=(0,\ldots ,0,1,\ldots ,0,w_{i_{1}},\ldots ,w{i_{d}})}$ where ${\displaystyle w_{i_{j}}}$ is the ${\displaystyle j}$-th coordinate of the vector ${\displaystyle w_{i}}$. There are ${\displaystyle (i-1)}$ zeros before the first '1' appears in ${\displaystyle v_{i}}$. One can assume without loss of generality that the vectors ${\displaystyle v_{i}}$ are linearly independent. We denote the linear subspace (of ${\displaystyle \mathbb {F} _{p}^{k+d}}$ ) spanned by these vectors by ${\displaystyle V}$ . Each outgoing edge ${\displaystyle e\in E}$ computes a linear combination, ${\displaystyle y(e)}$, of the vectors entering the vertex ${\displaystyle v=in(e)}$ where the edge originates, that is to say

${\displaystyle y(e)=\sum _{f:\mathrm {out} (f)=v}(m_{e}(f)y(f))}$

where ${\displaystyle m_{e}(f)\in \mathbb {F} _{p}}$. We consider the source as having ${\displaystyle k}$ input edges carrying the ${\displaystyle k}$ vectors ${\displaystyle w_{i}}$. By induction, one has that the vector ${\displaystyle y(e)}$ on any edge is a linear combination ${\displaystyle y(e)=\sum _{1\leq i\leq k}(g_{i}(e)v_{i})}$ and is a vector in ${\displaystyle V}$ . The k-dimensional vector ${\displaystyle g(e)=(g_{1}(e),\ldots ,g_{k}(e))}$ is simply the first k coordinates of the vector ${\displaystyle y(e)}$. We call the matrix whose rows are the vectors ${\displaystyle g(e_{1}),\ldots ,g(e_{k})}$, where ${\displaystyle e_{i}}$ are the incoming edges for a vertex ${\displaystyle t\in T}$, the global encoding matrix for ${\displaystyle t}$ and denote it as ${\displaystyle G_{t}}$. In practice the encoding vectors are chosen at random so the matrix ${\displaystyle G_{t}}$ is invertible with high probability. Thus any receiver, on receiving ${\displaystyle y_{1},\ldots ,y_{k}}$ can find ${\displaystyle w_{1},\ldots ,w_{k}}$ by solving

${\displaystyle {\begin{bmatrix}y'\\y_{2}'\\\vdots \\y_{k}'\end{bmatrix}}=G_{t}{\begin{bmatrix}w_{1}\\w_{2}\\\vdots \\w_{k}\end{bmatrix}}}$

where the ${\displaystyle y_{i}'}$ are the vectors formed by removing the first ${\displaystyle k}$ coordinates of the vector ${\displaystyle y_{i}}$.

Each receiver, ${\displaystyle t\in T}$, gets ${\displaystyle k}$ vectors ${\displaystyle y_{1},\ldots ,y_{k}}$ which are random linear combinations of the ${\displaystyle v_{i}}$’s. In fact, if

${\displaystyle y_{i}=(\alpha _{i_{1}},\ldots ,\alpha _{i_{k}},a_{i_{1}},\ldots ,a_{i_{d}})}$

then

${\displaystyle y_{i}=\sum _{1\leq j\leq k}(\alpha _{ij}v_{j}).}$

Thus we can invert the linear transformation to find the ${\displaystyle v_{i}}$’s with high probability.

Krohn, Freedman and Mazieres proposed a theory[2] in 2004 that if we have a hash function ${\displaystyle H:V\longrightarrow G}$ such that:

• ${\displaystyle H}$ is collision resistant – it is hard to find ${\displaystyle x}$ and ${\displaystyle y}$ such that ${\displaystyle H(x)=H(y)}$;
• ${\displaystyle H}$ is a homomorphism – ${\displaystyle H(x+y)=H(x)+H(y)}$.

Then server can securely distribute ${\displaystyle H(v_{i})}$ to each receiver, and to check if

${\displaystyle y=\sum _{1\leq i\leq k}(\alpha _{i}v_{i})}$

we can check whether

${\displaystyle H(y)=\sum _{1\leq i\leq k}(\alpha _{i}H(v_{i}))}$

The problem with this method is that the server needs to transfer secure information to each of the receivers. The hash functions ${\displaystyle H}$ needs to be transmitted to all the nodes in the network through a separate secure channel.${\displaystyle H}$ is expensive to compute and secure transmission of ${\displaystyle H}$ is not economical either.

1. Establishes authentication in addition to detecting pollution.
2. No need for distributing secure hash digests.
3. Smaller bit lengths in general will suffice. Signatures of length 180 bits have as much security as 1024 bit RSA signatures.
4. Public information does not change for subsequent file transmission.

The homomorphic property of the signatures allows nodes to sign any linear combination of the incoming packets without contacting the signing authority.

The server computes ${\displaystyle \sigma (v_{i})}$ for each ${\displaystyle 1\leq i\leq k}$. Transmits ${\displaystyle v_{i},\sigma (v_{i})}$. At each edge ${\displaystyle e}$ while computing ${\displaystyle y(e)=\sum _{f\in E:\mathrm {out} (f)=\mathrm {in} (e)}(m_{e}(f)y(f))}$ also compute ${\displaystyle \sigma (y(e))=\sum _{f\in E:\mathrm {out} (f)=\mathrm {in} (e)}(m_{e}(f)\sigma (y(f)))}$ on the elliptic curve ${\displaystyle E}$.

The signature is a point on the elliptic curve with coordinates in ${\displaystyle \mathbb {F} _{q}}$. Thus the size of the signature is ${\displaystyle 2\log q}$ bits (which is some constant times ${\displaystyle log(p)}$ bits, depending on the relative size of ${\displaystyle p}$ and ${\displaystyle q}$), and this is the transmission overhead. The computation of the signature ${\displaystyle h(e)}$ at each vertex requires ${\displaystyle O(d_{in}\log p\log ^{1+\epsilon }q)}$ bit operations, where ${\displaystyle d_{in}}$ is the in-degree of the vertex ${\displaystyle in(e)}$. The verification of a signature requires ${\displaystyle O((d+k)\log ^{2+\epsilon }q)}$ bit operations.

Attacker can produce a collision under the hash function.

If given ${\displaystyle (P_{1},\ldots ,P_{r})}$ points in ${\displaystyle E[p]}$ find ${\displaystyle a=(a_{1},\ldots ,a_{r})\in \mathbb {F} _{p}^{r}}$ and ${\displaystyle b=(b_{1},\ldots ,b_{r})\in \mathbb {F} _{p}^{r}}$

such that ${\displaystyle a\not =b}$ and

${\displaystyle \sum _{1\leq i\leq r}(a_{i}P_{i})=\sum _{1\leq j\leq r}(b_{j}P_{j}).}$

Proposition: There is a polynomial time reduction from discrete log on the cyclic group of order ${\displaystyle p}$ on elliptic curves to Hash-Collision.

If ${\displaystyle r=2}$, then we get ${\displaystyle xP+yQ=uP+vQ}$. Thus ${\displaystyle (x-u)P+(y-v)Q=0}$. We claim that ${\displaystyle x\not =u}$ and ${\displaystyle y\not =v}$. Suppose that ${\displaystyle x=u}$, then we would have ${\displaystyle (y-v)Q=0}$, but ${\displaystyle Q}$ is a point of order ${\displaystyle p}$ (a prime) thus ${\displaystyle y-u\equiv 0{\bmod {p}}}$. In other words ${\displaystyle y=v}$ in ${\displaystyle \mathbb {F} _{p}}$. This contradicts the assumption that ${\displaystyle (x,y)}$ and ${\displaystyle (u,v)}$ are distinct pairs in ${\displaystyle \mathbb {F} _{2}}$. Thus we have that ${\displaystyle Q=-(x-u)(y-v)^{-1}P}$, where the inverse is taken as modulo ${\displaystyle p}$.

If we have r > 2 then we can do one of two things. Either we can take ${\displaystyle P_{1}=P}$ and ${\displaystyle P_{2}=Q}$ as before and set ${\displaystyle P_{i}=O}$ for ${\displaystyle i}$ > 2 (in this case the proof reduces to the case when ${\displaystyle r=2}$), or we can take ${\displaystyle P_{1}=r_{1}P}$ and ${\displaystyle P_{i}=r_{i}Q}$ where ${\displaystyle r_{i}}$ are chosen at random from ${\displaystyle \mathbb {F} _{p}}$. We get one equation in one unknown (the discrete log of ${\displaystyle Q}$). It is quite possible that the equation we get does not involve the unknown. However, this happens with very small probability as we argue next. Suppose the algorithm for Hash-Collision gave us that

${\displaystyle ar_{1}P+\sum _{2\leq i\leq r}(b_{i}r_{i}Q)=0.}$

Then as long as ${\displaystyle \sum _{2\leq i\leq r}b_{i}r_{i}\not \equiv 0{\bmod {p}}}$, we can solve for the discrete log of Q. But the ${\displaystyle r_{i}}$’s are unknown to the oracle for Hash-Collision and so we can interchange the order in which this process occurs. In other words, given ${\displaystyle b_{i}}$, for ${\displaystyle 2\leq i\leq r}$, not all zero, what is the probability that the ${\displaystyle r_{i}}$’s we chose satisfies ${\displaystyle \sum _{2\leq i\leq r}(b_{i}r_{i})=0}$? It is clear that the latter probability is ${\displaystyle 1 \over p}$ . Thus with high probability we can solve for the discrete log of ${\displaystyle Q}$.

We have shown that producing hash collisions in this scheme is difficult. The other method by which an adversary can foil our system is by forging a signature. This scheme for the signature is essentially the Aggregate Signature version of the Boneh-Lynn-Shacham signature scheme.[4] Here it is shown that forging a signature is at least as hard as solving the elliptic curve Diffie–Hellman problem. The only known way to solve this problem on elliptic curves is via computing discrete-logs. Thus forging a signature is at least as hard as solving the computational co-Diffie–Hellman on elliptic curves and probably as hard as computing discrete-logs.

• Network coding
• Homomorphic encryption
• Elliptic curve cryptography
• Weil pairing
• Elliptic curve Diffie–Hellman
• Elliptic curve DSA
• Digital Signature Algorithm

1. Comprehensive View of a Live Network Coding P2P System
2. Signatures for Network Coding(presentation) CISS 2006, Princeton
3. University at Buffalo Lecture Notes on Coding Theory – Dr. Atri Rudra