Defining Encryption Lecture 2 1 Roadmap 2 Roadmap First, - PowerPoint PPT Presentation

Defining Security The REAL/IDEAL Paradigm Eve shouldn’t produce any more effects than she could have in the Key/ Key/ ideal world Enc Dec IDEAL world: Message sent over a (physically) secure channel. No encryption in this world. Env 8

Defining Security The REAL/IDEAL Paradigm Eve shouldn’t produce any more effects than she could have in the Key/ Key/ ideal world Enc Dec IDEAL world: Message sent over a (physically) secure channel. No encryption in this world. REAL world: Using encryption Env 8

Defining Security The REAL/IDEAL Paradigm Eve shouldn’t produce any more effects than she could have in the Key/ Key/ ideal world Enc Dec IDEAL world: Message sent over a (physically) secure channel. No encryption in this world. REAL world: Using encryption Encryption is secure if whatever an Eve can do in the REAL world, Env an Eve’ can do in the IDEAL world 8

Defining Security The REAL/IDEAL Paradigm Key/ Key/ Enc Dec Env REAL 9

Defining Security The REAL/IDEAL Paradigm Key/ Key/ Recv Send Enc Dec Env Env REAL IDEAL 9

Defining Security The REAL/IDEAL Paradigm Key/ Key/ Recv Send Enc Dec A scheme is secure (and correct) if: Env Env REAL IDEAL 9

Defining Security The REAL/IDEAL Paradigm Key/ Key/ Recv Send Enc Dec A scheme is secure (and correct) if: ∀ Env Env REAL IDEAL 9

Defining Security The REAL/IDEAL Paradigm Key/ Key/ Recv Send Enc Dec A scheme is secure (and correct) if: ∀ ∃ s.t. Env Env REAL IDEAL 9

Defining Security The REAL/IDEAL Paradigm Key/ Key/ Recv Send Enc Dec A scheme is secure (and correct) if: ∀ ∃ s.t. ∀ Env Env REAL IDEAL 9

Defining Security The REAL/IDEAL Paradigm Key/ Key/ Recv Send Enc Dec A scheme is secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env REAL identically in IDEAL REAL and IDEAL 9

Ready to go... 10

Ready to go... REAL/IDEAL (a.k.a simulation-based) security forms the basic template for a large variety of security definitions 10

Ready to go... REAL/IDEAL (a.k.a simulation-based) security forms the basic template for a large variety of security definitions We will see three definitions of encryption 10

Ready to go... REAL/IDEAL (a.k.a simulation-based) security forms the basic template for a large variety of security definitions We will see three definitions of encryption Security of “one-time encryption” 10

Ready to go... REAL/IDEAL (a.k.a simulation-based) security forms the basic template for a large variety of security definitions We will see three definitions of encryption Security of “one-time encryption” Security of (muti-message) encryption 10

Ready to go... REAL/IDEAL (a.k.a simulation-based) security forms the basic template for a large variety of security definitions We will see three definitions of encryption Security of “one-time encryption” Security of (muti-message) encryption Security against “active attacks” 10

Ready to go... REAL/IDEAL (a.k.a simulation-based) security forms the basic template for a large variety of security definitions We will see three definitions of encryption Security of “one-time encryption” Security of (muti-message) encryption Security against “active attacks” Will also see alternate (but essentially equivalent) security definitions 10

Onetime Encryption 11

Onetime Encryption The Syntax Shared-key (Private-key) Encryption Key Generation: Randomized K ← K , uniformly randomly drawn from the key-space (or according to a key-distribution) Encryption: Deterministic Enc: M × K → C Decryption: Deterministic Dec: C × K → M 11

Onetime Encryption Perfect Secrecy 12

Onetime Encryption Perfect Secrecy For all messages m, m’ in M {Enc(m,K)} K ← KeyGen = {Enc(m’,K)} K ← KeyGen 12

Onetime Encryption Perfect Secrecy For all messages m, m’ in M K 0 1 2 3 {Enc(m,K)} K ← KeyGen = {Enc(m’,K)} K ← KeyGen M a x y y z b y x z y 12

Onetime Encryption Perfect Secrecy For all messages m, m’ in M K 0 1 2 3 {Enc(m,K)} K ← KeyGen = {Enc(m’,K)} K ← KeyGen M Distribution of ciphertext is defined by a x y y z the randomness in the key b y x z y 12

Onetime Encryption Perfect Secrecy For all messages m, m’ in M K 0 1 2 3 {Enc(m,K)} K ← KeyGen = {Enc(m’,K)} K ← KeyGen M Distribution of ciphertext is defined by a x y y z the randomness in the key b y x z y In addition, require correctness ∀ m, K, Dec( Enc(m,K), K) = m 12

Onetime Encryption Perfect Secrecy For all messages m, m’ in M K 0 1 2 3 {Enc(m,K)} K ← KeyGen = {Enc(m’,K)} K ← KeyGen M Distribution of ciphertext is defined by a x y y z the randomness in the key b y x z y In addition, require correctness ∀ m, K, Dec( Enc(m,K), K) = m E.g. One-time pad: M = K = C = {0,1} n and Enc(m,K) = m ⊕ K, Dec(c,K) = c ⊕ K 12

Onetime Encryption Perfect Secrecy For all messages m, m’ in M K 0 1 2 3 {Enc(m,K)} K ← KeyGen = {Enc(m’,K)} K ← KeyGen M Distribution of ciphertext is defined by a x y y z the randomness in the key b y x z y In addition, require correctness ∀ m, K, Dec( Enc(m,K), K) = m E.g. One-time pad: M = K = C = {0,1} n and Enc(m,K) = m ⊕ K, Dec(c,K) = c ⊕ K More generally M = K = C = G (a finite group) and Enc(m,K) = m+K, Dec(c,K) = c-K 12

Onetime Encryption SIM-Onetime Security Key/ Key/ Recv Send Enc Dec SIM-Onetime secure if: ∀ ∃ s.t. ∀ REAL=IDEAL Env Env IDEAL REAL 13

Onetime Encryption SIM-Onetime Security Class of environments which send only one message Key/ Key/ Recv Send Enc Dec SIM-Onetime secure if: ∀ ∃ s.t. ∀ REAL=IDEAL Env Env IDEAL REAL 13

Onetime Encryption Equivalent to perfect secrecy + correctness SIM-Onetime Security Class of environments which send only one message Key/ Key/ Recv Send Enc Dec SIM-Onetime secure if: ∀ ∃ s.t. ∀ REAL=IDEAL Env Env IDEAL REAL 13

Perfect Secrecy + Correctness ⇒ SIM-Onetime Security Key/ Key/ Recv Send Enc Dec Env Env IDEAL REAL 14

Perfect Secrecy + Correctness ⇒ SIM-Onetime Security Consider this Key/ Key/ simulator: Runs Recv Send Enc Dec adversary internally and lets it talk to the environment directly! Env Env IDEAL REAL 14

Perfect Secrecy + Correctness ⇒ SIM-Onetime Security Consider this Key/ Key/ simulator: Runs Recv Send Enc Dec adversary internally and lets it talk to the environment directly! Env Env IDEAL REAL 14

Perfect Secrecy + Correctness ⇒ SIM-Onetime Security Consider this Key/ Key/ simulator: Runs Recv Send Enc Dec adversary internally and lets it talk to the environment directly! Feeds it encryption of a dummy m* message Env Env IDEAL REAL 14

Perfect Secrecy + Correctness ⇒ SIM-Onetime Security Consider this Key/ Key/ simulator: Runs Recv Send Enc Dec adversary internally and lets it talk to the environment directly! Feeds it encryption of a dummy m* message Can show that REAL=IDEAL Env Env IDEAL REAL 14

Implicit Details 15

Implicit Details Random coins used by the encryption scheme is kept private within the programs of the scheme (KeyGen, Enc, Dec) 15

Implicit Details Random coins used by the encryption scheme is kept private within the programs of the scheme (KeyGen, Enc, Dec) If key is used for anything else (i.e., leaked to the environment) no more guarantees 15

Implicit Details Random coins used by the encryption scheme is kept private within the programs of the scheme (KeyGen, Enc, Dec) If key is used for anything else (i.e., leaked to the environment) no more guarantees In REAL, Eve only sees the ciphertext from Alice to Bob 15

Implicit Details Random coins used by the encryption scheme is kept private within the programs of the scheme (KeyGen, Enc, Dec) If key is used for anything else (i.e., leaked to the environment) no more guarantees In REAL, Eve only sees the ciphertext from Alice to Bob In particular no timing attacks 15

Implicit Details Random coins used by the encryption scheme is kept private within the programs of the scheme (KeyGen, Enc, Dec) If key is used for anything else (i.e., leaked to the environment) no more guarantees In REAL, Eve only sees the ciphertext from Alice to Bob In particular no timing attacks Message space is finite and known to Eve (and Eve’) 15

Implicit Details Random coins used by the encryption scheme is kept private within the programs of the scheme (KeyGen, Enc, Dec) If key is used for anything else (i.e., leaked to the environment) no more guarantees In REAL, Eve only sees the ciphertext from Alice to Bob In particular no timing attacks Message space is finite and known to Eve (and Eve’) Alternately, if message length is variable, it is given out to Eve’ in IDEAL as well 15

Implicit Details Random coins used by the encryption scheme is kept private within the programs of the scheme (KeyGen, Enc, Dec) If key is used for anything else (i.e., leaked to the environment) no more guarantees In REAL, Eve only sees the ciphertext from Alice to Bob In particular no timing attacks Message space is finite and known to Eve (and Eve’) Alternately, if message length is variable, it is given out to Eve’ in IDEAL as well Also, Eve’ allowed to learn when a message is sent 15

Onetime Encryption IND-Onetime Security 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment . 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment . 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment Experiment picks a random bit b. It also runs KeyGen to get a key K . b ← {0,1} 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment Key/ Experiment picks a random bit b. It Enc also runs KeyGen to get a key K . b ← {0,1} 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment Key/ Experiment picks a random bit b. It Enc also runs KeyGen to get a key K Adversary sends two messages m 0 , m 1 to the experiment m 0 ,m 1 . b ← {0,1} 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment Key/ Experiment picks a random bit b. It Enc also runs KeyGen to get a key K Adversary sends two messages m 0 , m 1 to the experiment Experiment replies with Enc(m b ,K) m 0 ,m 1 . b ← {0,1} 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment Key/ Experiment picks a random bit b. It Enc also runs KeyGen to get a key K Enc(m b ,K) Adversary sends two messages m 0 , m b m 1 to the experiment Experiment replies with Enc(m b ,K) m 0 ,m 1 . b ← {0,1} 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment Key/ Experiment picks a random bit b. It Enc also runs KeyGen to get a key K Enc(m b ,K) Adversary sends two messages m 0 , m b m 1 to the experiment Experiment replies with Enc(m b ,K) m 0 ,m 1 Adversary returns a guess b’ b’ . b ← {0,1} 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment Key/ Experiment picks a random bit b. It Enc also runs KeyGen to get a key K Enc(m b ,K) Adversary sends two messages m 0 , m b m 1 to the experiment Experiment replies with Enc(m b ,K) m 0 ,m 1 Adversary returns a guess b’ b’ . b ← {0,1} b’=b? 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment Key/ Experiment picks a random bit b. It Enc also runs KeyGen to get a key K Enc(m b ,K) Adversary sends two messages m 0 , m b m 1 to the experiment Experiment replies with Enc(m b ,K) m 0 ,m 1 Adversary returns a guess b’ b’ . Experiments outputs 1 iff b’=b b ← {0,1} b’=b? Yes/No 16

Onetime Encryption IND-Onetime Security IND-Onetime Experiment Key/ Experiment picks a random bit b. It Enc also runs KeyGen to get a key K Enc(m b ,K) Adversary sends two messages m 0 , m b m 1 to the experiment Experiment replies with Enc(m b ,K) m 0 ,m 1 Adversary returns a guess b’ b’ . Experiments outputs 1 iff b’=b b ← {0,1} b’=b? IND-Onetime secure if for every Yes/No adversary, Pr[b=b’] = 1/2 16

Onetime Encryption Equivalent to IND-Onetime Security perfect secrecy IND-Onetime Experiment Key/ Experiment picks a random bit b. It Enc also runs KeyGen to get a key K Enc(m b ,K) Adversary sends two messages m 0 , m b m 1 to the experiment Experiment replies with Enc(m b ,K) m 0 ,m 1 Adversary returns a guess b’ b’ . Experiments outputs 1 iff b’=b b ← {0,1} b’=b? IND-Onetime secure if for every Yes/No adversary, Pr[b=b’] = 1/2 16

Symmetric-Key Encryption The Syntax Shared-key (Private-key) Encryption Key Generation: Randomized K ← K , uniformly randomly drawn from the key-space (or according to a key-distribution) Encryption: Randomized Enc: M × K × R → C . During encryption a fresh random string will be chosen uniformly at random from R Decryption: Deterministic Dec: C × K → M 17

Symmetric-Key Encryption SIM-CPA Security Key/ Key/ Recv Send Enc Dec SIM-CPA secure if: ∀ ∃ s.t. ∀ REAL ≈ IDEAL Env Env IDEAL REAL 18

Symmetric-Key Encryption SIM-CPA Security Same as SIM-onetime security, but not restricted to environments which send only one message Key/ Key/ Recv Send Enc Dec SIM-CPA secure if: ∀ ∃ s.t. ∀ REAL ≈ IDEAL Env Env IDEAL REAL 18

Symmetric-Key Encryption SIM-CPA Security Same as SIM-onetime security, but not restricted to environments which send only one message Key/ Key/ Recv Send Enc Dec SIM-CPA secure if: ∀ ∃ s.t. ∀ REAL ≈ IDEAL Env Env Later IDEAL REAL 18