How to Securely Outsource Cryptographic Computations

We address the problem of using untrusted (potentially malicious) cryptographic helpers. We provide a formal security definition for

securely outsourcing

computations from a computationally limited device to an untrusted helper. In our model, the adversarial environment writes the software for the helper, but then does not have direct communication with it once the device starts relying on it. In addition to security, we also provide a framework for quantifying the

efficiency

and

checkability

of an outsourcing implementation. We present two practical outsource-secure schemes. Specifically, we show how to securely outsource modular exponentiation, which presents the computational bottleneck in most public-key cryptography on computationally limited devices. Without outsourcing, a device would need

O

(

n

) modular multiplications to carry out modular exponentiation for

n

-bit exponents. The load reduces to

O

(log

2

n

) for any exponentiation-based scheme where the honest device may use two untrusted exponentiation programs; we highlight the Cramer-Shoup cryptosystem [13] and Schnorr signatures [28] as examples. With a relaxed notion of security, we achieve the same load reduction for a new CCA2-secure encryption scheme using only one untrusted Cramer-Shoup encryption program.