Proactive RSA

The notion of \proactive security" of basic primitives and cryptosystems that are distributed amongst various servers, was introduced in order to tolerate a very strong \mobile adversary." This adversary may corrupt all participants throughout the lifetime of the system in a non-monotonic fashion (i.e. recoveries are possible) but the adversary is unable to corrupt too many participants during any short time period OstrovskyYung]. The notion assures increased security and availability of the cryptographic primitive. We present a proactive RSA system in which a threshold of servers applies the RSA signature (or decryption) function in a distributed manner; RSA is perhaps the most important trapdoor function in use. Employing new combinatorial and elementary number theoretic techniques, our protocol enables the dynamic updating of the servers (which hold the RSA key distributively); it is secure even when a linear number of the servers are corrupted during any time period (linear redundancy); it eeciently \self-maintains" the security of the function and its messages (ciphertexts or signatures); and it enables continuous availability, namely, correct function application using the shared key is possible at any time. We present an eecient way in which l servers can share an RSA private function so that, given 0 < < < 1: Proactive (Dynamic) Robustness: A gateway G can combine information from any set of l (honest) servers to deduce the RSA signature for any authorized message at any period. Proactive Security (against mobile adversary): Our protocol is secure against a polynomial time adversary who controls the gateway G and time-variant sets of up to minfl(1 ?); lg servers, and can obtain the shares of up to l servers (including those that it corrupts). Uniform Boundedness: The share-size is always bounded by the size of an RSA private key (i.e., logarithmically in N). We also present special practical instances based on designs; some of these instances were recently implemented as part of a highly secure application testbed at Sandia National Laboratories. A major technical diiculty in \proactivizing" RSA was the fact that the servers have to update the \distributed representation" of an RSA key, while not learning the order of the group from which keys are drawn (in order not to compromise the RSA security).