Onetime Encryption Perfect Secrecy Perfect secrecy : m, m M K 0 - - PowerPoint PPT Presentation

▶
onetime encryption
SMART_READER_LITE
LIVE PREVIEW

Onetime Encryption Perfect Secrecy Perfect secrecy : m, m M K 0 - - PowerPoint PPT Presentation

Oct 13, 2023 460 likes •1.46k views

Defining Encryption (ctd.) Lecture 3 SIM & IND security Beyond One-Time: CPA security Computational Indistinguishability Recall Onetime Encryption Perfect Secrecy Perfect secrecy : m, m M K 0 1 2 3 M {Enc(m,K)} K KeyGen

slide-1
SLIDE 1

Defining Encryption (ctd.)

Lecture 3 SIM & IND security Beyond One-Time: CPA security Computational Indistinguishability

slide-2
SLIDE 2

Perfect Secrecy

1 2 3 a x y y z b y x z y M K

Onetime Encryption

Perfect secrecy: ∀ m, m’ ∈ M {Enc(m,K)}K←KeyGen = {Enc(m’,K)}K←KeyGen Distribution of the ciphertext is defined
 by the randomness in the key In addition, require correctness ∀ m, K, Dec( Enc(m,K), K) = m E.g. One-time pad: M = K = C = {0,1}n and Enc(m,K) = m⊕K, Dec(c,K) = c⊕K More generally M = K = C = G (a finite group) and Enc(m,K) = m+K, Dec(c,K) = c-K Distribution of the ciphertext

Assuming K uniformly drawn from K Pr[ Enc(a,K)=x ] = ¼, 
 Pr[ Enc(a,K)=y ] = ½, 
 Pr[ Enc(a,K)=z ] = ¼ ______________
 Same for Enc(b,K).

Recall

slide-3
SLIDE 3

SIM-Onetime secure if: ∀ ∃ s.t. ∀

Key/ Enc Key/ Dec

Env

Send Recv

Env REAL IDEAL

Class of environments which send only one message

SIM-Onetime Security

Onetime Encryption

IDEAL=REAL

Recall

slide-4
SLIDE 4

SIM-Onetime secure if: ∀ ∃ s.t. ∀

Key/ Enc Key/ Dec

Env

Send Recv

Env REAL IDEAL

Class of environments which send only one message

SIM-Onetime Security

Onetime Encryption

IDEAL=REAL

Equivalent to perfect secrecy + correctness

Recall

slide-5
SLIDE 5

IND-Onetime Security

Onetime Encryption

slide-6
SLIDE 6

IND-Onetime Experiment

IND-Onetime Security

Onetime Encryption

slide-7
SLIDE 7

IND-Onetime Experiment

.

IND-Onetime Security

Onetime Encryption

slide-8
SLIDE 8

IND-Onetime Experiment

.

IND-Onetime Security

Onetime Encryption

slide-9
SLIDE 9

IND-Onetime Experiment Experiment picks a random bit b. It also runs KeyGen to get a key K

.

b←{0,1}

IND-Onetime Security

Onetime Encryption

slide-10
SLIDE 10

IND-Onetime Experiment Experiment picks a random bit b. It also runs KeyGen to get a key K

Key/ Enc

.

b←{0,1}

IND-Onetime Security

Onetime Encryption

slide-11
SLIDE 11

IND-Onetime Experiment Experiment picks a random bit b. It also runs KeyGen to get a key K Adversary sends two messages m0, m1 to the experiment

Key/ Enc

.

b←{0,1} m0,m1

IND-Onetime Security

Onetime Encryption

slide-12
SLIDE 12

IND-Onetime Experiment Experiment picks a random bit b. It also runs KeyGen to get a key K Adversary sends two messages m0, m1 to the experiment Experiment replies with Enc(mb,K)

Key/ Enc

.

b←{0,1} m0,m1

IND-Onetime Security

Onetime Encryption

slide-13
SLIDE 13

IND-Onetime Experiment Experiment picks a random bit b. It also runs KeyGen to get a key K Adversary sends two messages m0, m1 to the experiment Experiment replies with Enc(mb,K)

Key/ Enc

.

b←{0,1} m0,m1 mb Enc(mb,K)

IND-Onetime Security

Onetime Encryption

slide-14
SLIDE 14

IND-Onetime Experiment Experiment picks a random bit b. It also runs KeyGen to get a key K Adversary sends two messages m0, m1 to the experiment Experiment replies with Enc(mb,K) Adversary returns a guess b’

Key/ Enc

.

b←{0,1} m0,m1 mb Enc(mb,K) b’

IND-Onetime Security

Onetime Encryption

slide-15
SLIDE 15

IND-Onetime Experiment Experiment picks a random bit b. It also runs KeyGen to get a key K Adversary sends two messages m0, m1 to the experiment Experiment replies with Enc(mb,K) Adversary returns a guess b’

Key/ Enc

.

b←{0,1} b’=b? m0,m1 mb Enc(mb,K) b’

IND-Onetime Security

Onetime Encryption

slide-16
SLIDE 16

IND-Onetime Experiment Experiment picks a random bit b. It also runs KeyGen to get a key K Adversary sends two messages m0, m1 to the experiment Experiment replies with Enc(mb,K) Adversary returns a guess b’ Experiments outputs 1 iff b’=b

Key/ Enc

.

b←{0,1} b’=b? m0,m1 mb Enc(mb,K) b’ Yes/No

IND-Onetime Security

Onetime Encryption

slide-17
SLIDE 17

IND-Onetime Experiment Experiment picks a random bit b. It also runs KeyGen to get a key K Adversary sends two messages m0, m1 to the experiment Experiment replies with Enc(mb,K) Adversary returns a guess b’ Experiments outputs 1 iff b’=b IND-Onetime secure if for every adversary, Pr[b’=b] = 1/2

Key/ Enc

.

b←{0,1} b’=b? m0,m1 mb Enc(mb,K) b’ Yes/No

IND-Onetime Security

Onetime Encryption

slide-18
SLIDE 18

IND-Onetime Experiment Experiment picks a random bit b. It also runs KeyGen to get a key K Adversary sends two messages m0, m1 to the experiment Experiment replies with Enc(mb,K) Adversary returns a guess b’ Experiments outputs 1 iff b’=b IND-Onetime secure if for every adversary, Pr[b’=b] = 1/2

Key/ Enc

.

b←{0,1} b’=b? m0,m1 mb Enc(mb,K) b’ Yes/No Equivalent to perfect secrecy

IND-Onetime Security

Onetime Encryption

slide-19
SLIDE 19

Perspective on Definitions

slide-20
SLIDE 20

Perspective on Definitions

“Technical” vs. “Convincing”

slide-21
SLIDE 21

Perspective on Definitions

“Technical” vs. “Convincing” For simple scenarios technical definitions could be convincing

slide-22
SLIDE 22

Perspective on Definitions

“Technical” vs. “Convincing” For simple scenarios technical definitions could be convincing e.g. Perfect Secrecy

slide-23
SLIDE 23

Perspective on Definitions

“Technical” vs. “Convincing” For simple scenarios technical definitions could be convincing e.g. Perfect Secrecy IND- definitions tend to be technical: more low-level details, but may not make the big picture clear. Could have “weaknesses”

slide-24
SLIDE 24

Perspective on Definitions

“Technical” vs. “Convincing” For simple scenarios technical definitions could be convincing e.g. Perfect Secrecy IND- definitions tend to be technical: more low-level details, but may not make the big picture clear. Could have “weaknesses” SIM- definitions give the big picture, but may not give details of what is involved in satisfying it. Could be “too strong”

slide-25
SLIDE 25

Perspective on Definitions

“Technical” vs. “Convincing” For simple scenarios technical definitions could be convincing e.g. Perfect Secrecy IND- definitions tend to be technical: more low-level details, but may not make the big picture clear. Could have “weaknesses” SIM- definitions give the big picture, but may not give details of what is involved in satisfying it. Could be “too strong” Best of both worlds when they are equivalent: use IND- definition while say, proving security of a construction; use SIM- definition when low-level details are not important

slide-26
SLIDE 26

Security of Encryption

slide-27
SLIDE 27

Security of Encryption

Perfect secrecy is too strong for multiple messages (though too weak in some other respects...)

slide-28
SLIDE 28

Security of Encryption

Perfect secrecy is too strong for multiple messages (though too weak in some other respects...) Requires keys as long as the messages

slide-29
SLIDE 29

Security of Encryption

Perfect secrecy is too strong for multiple messages (though too weak in some other respects...) Requires keys as long as the messages Relax the requirement by restricting to computationally bounded adversaries (and environments)

slide-30
SLIDE 30

Security of Encryption

Perfect secrecy is too strong for multiple messages (though too weak in some other respects...) Requires keys as long as the messages Relax the requirement by restricting to computationally bounded adversaries (and environments) Coming up: Formalizing notions of “computational” security (as

  • pposed to perfect/statistical security)
slide-31
SLIDE 31

Security of Encryption

Perfect secrecy is too strong for multiple messages (though too weak in some other respects...) Requires keys as long as the messages Relax the requirement by restricting to computationally bounded adversaries (and environments) Coming up: Formalizing notions of “computational” security (as

  • pposed to perfect/statistical security)

Then, security definitions used for encryption of multiple messages

slide-32
SLIDE 32

Shared-key (Private-key) Encryption Key Generation: Randomized K ← K , uniformly randomly drawn from the key-space (or according to a key-distribution) Encryption: Randomized Enc: M ×K ×R →C. During encryption a fresh random string will be chosen uniformly at random from R Decryption: Deterministic Dec: C ×K → M

The Syntax

Symmetric-Key Encryption

slide-33
SLIDE 33

SIM-CPA secure if: ∀ ∃ s.t. ∀

Key/ Enc Key/ Dec

Env

Send Recv

Env REAL IDEAL

SIM-CPA Security

IDEAL ≈ REAL

Symmetric-Key Encryption

slide-34
SLIDE 34

SIM-CPA secure if: ∀ ∃ s.t. ∀

Key/ Enc Key/ Dec

Env

Send Recv

Env REAL IDEAL

SIM-CPA Security

Same as SIM-onetime security, but not restricted to environments which send only one message. All entities “efficient. ”

IDEAL ≈ REAL

Symmetric-Key Encryption

slide-35
SLIDE 35

SIM-CPA secure if: ∀ ∃ s.t. ∀

Key/ Enc Key/ Dec

Env

Send Recv

Env REAL IDEAL

SIM-CPA Security

Same as SIM-onetime security, but not restricted to environments which send only one message. All entities “efficient. ”

IDEAL ≈ REAL

Symmetric-Key Encryption

Later

slide-36
SLIDE 36

IND-CPA Security

Symmetric-Key Encryption

slide-37
SLIDE 37

Experiment picks a random bit b. It also runs KeyGen to get a key K

Key/ Enc

b←{0,1}

IND-CPA Security

Symmetric-Key Encryption

slide-38
SLIDE 38

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants

Key/ Enc

b←{0,1}

IND-CPA Security

Symmetric-Key Encryption

slide-39
SLIDE 39

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment

Key/ Enc

b←{0,1} m0,m1

IND-CPA Security

Symmetric-Key Encryption

slide-40
SLIDE 40

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary

Key/ Enc

b←{0,1} m0,m1 mb Enc(mb,K)

IND-CPA Security

Symmetric-Key Encryption

slide-41
SLIDE 41

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary

Key/ Enc

b←{0,1} m0,m1 mb Enc(mb,K)

IND-CPA Security

Symmetric-Key Encryption

slide-42
SLIDE 42

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’

Key/ Enc

b←{0,1} m0,m1 mb Enc(mb,K) b’

IND-CPA Security

Symmetric-Key Encryption

slide-43
SLIDE 43

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’ Experiment outputs 1 iff b’=b

Key/ Enc

b←{0,1} b’=b? m0,m1 mb Enc(mb,K) b’ Yes/No

IND-CPA Security

Symmetric-Key Encryption

slide-44
SLIDE 44

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’ Experiment outputs 1 iff b’=b IND-CPA secure if for all “efficient” adversaries Pr[b’=b] ≈ 1/2

Key/ Enc

b←{0,1} b’=b? m0,m1 mb Enc(mb,K) b’ Yes/No

IND-CPA Security

Symmetric-Key Encryption

slide-45
SLIDE 45

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’ Experiment outputs 1 iff b’=b IND-CPA secure if for all “efficient” adversaries Pr[b’=b] ≈ 1/2

Key/ Enc

b←{0,1} b’=b? m0,m1 mb Enc(mb,K) b’ Yes/No

IND-CPA Security

Symmetric-Key Encryption

IND-CPA + ~correctness equivalent to SIM-CPA

slide-46
SLIDE 46

Definitions Summary

slide-47
SLIDE 47

Definitions Summary

Security definitions:

slide-48
SLIDE 48

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness

slide-49
SLIDE 49

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness SIM-CPA = IND-CPA + ~correctness: allows using the same key for multiple messages

slide-50
SLIDE 50

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness SIM-CPA = IND-CPA + ~correctness: allows using the same key for multiple messages Later: SIM-CCA = IND-CCA + ~correctness: allows active attacks

slide-51
SLIDE 51

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness SIM-CPA = IND-CPA + ~correctness: allows using the same key for multiple messages Later: SIM-CCA = IND-CCA + ~correctness: allows active attacks Next

slide-52
SLIDE 52

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness SIM-CPA = IND-CPA + ~correctness: allows using the same key for multiple messages Later: SIM-CCA = IND-CCA + ~correctness: allows active attacks Next For multi-message schemes we relaxed the “perfect” simulation requirement

slide-53
SLIDE 53

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness SIM-CPA = IND-CPA + ~correctness: allows using the same key for multiple messages Later: SIM-CCA = IND-CCA + ~correctness: allows active attacks Next For multi-message schemes we relaxed the “perfect” simulation requirement But what is ≈ ?

slide-54
SLIDE 54

Feasible Computation

slide-55
SLIDE 55

Feasible Computation

In analyzing complexity of algorithms: Rate at which computational complexity grows with input size e.g. Can do sorting in O(n log n)

slide-56
SLIDE 56

Feasible Computation

In analyzing complexity of algorithms: Rate at which computational complexity grows with input size e.g. Can do sorting in O(n log n) Only the rough rate considered Exact time depends on the technology

slide-57
SLIDE 57

Feasible Computation

In analyzing complexity of algorithms: Rate at which computational complexity grows with input size e.g. Can do sorting in O(n log n) Only the rough rate considered Exact time depends on the technology How much more computation will be needed as the instances of the problem get larger. (Do we scale well?)

slide-58
SLIDE 58

Feasible Computation

In analyzing complexity of algorithms: Rate at which computational complexity grows with input size e.g. Can do sorting in O(n log n) Only the rough rate considered Exact time depends on the technology How much more computation will be needed as the instances of the problem get larger. (Do we scale well?)

Log Poly Exp

slide-59
SLIDE 59

Feasible Computation

In analyzing complexity of algorithms: Rate at which computational complexity grows with input size e.g. Can do sorting in O(n log n) Only the rough rate considered Exact time depends on the technology How much more computation will be needed as the instances of the problem get larger. (Do we scale well?) “Polynomial time” (O(n), O(n2), O(n3), ...) considered feasible

Log Poly Exp

slide-60
SLIDE 60

Infeasible Computation

slide-61
SLIDE 61

Infeasible Computation

“Super-Polynomial time” considered infeasible

slide-62
SLIDE 62

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n)

slide-63
SLIDE 63

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n) i.e., as n grows, quickly becomes “infeasibly large”

slide-64
SLIDE 64

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n) i.e., as n grows, quickly becomes “infeasibly large” Can we make breaking security infeasible for Eve?

slide-65
SLIDE 65

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n) i.e., as n grows, quickly becomes “infeasibly large” Can we make breaking security infeasible for Eve? What is n (that can grow)?

slide-66
SLIDE 66

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n) i.e., as n grows, quickly becomes “infeasibly large” Can we make breaking security infeasible for Eve? What is n (that can grow)? Message size?

slide-67
SLIDE 67

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n) i.e., as n grows, quickly becomes “infeasibly large” Can we make breaking security infeasible for Eve? What is n (that can grow)? Message size? We need security even if sending only one bit!

slide-68
SLIDE 68

Security Parameter

slide-69
SLIDE 69

Security Parameter

A parameter that is part of the encryption scheme

slide-70
SLIDE 70

Security Parameter

A parameter that is part of the encryption scheme Not related to message size

slide-71
SLIDE 71

Security Parameter

A parameter that is part of the encryption scheme Not related to message size A knob that can be used to set the security level

slide-72
SLIDE 72

Security Parameter

A parameter that is part of the encryption scheme Not related to message size A knob that can be used to set the security level Will denote by k

slide-73
SLIDE 73

Security Parameter

A parameter that is part of the encryption scheme Not related to message size A knob that can be used to set the security level Will denote by k Security guarantees are given asymptotically as a function of the security parameter

slide-74
SLIDE 74

Interpreting Asymptotics

slide-75
SLIDE 75

Advantage

Interpreting Asymptotics

S e c u r i t y p a r a m e t e r Time steps

slide-76
SLIDE 76

Advantage

Interpreting Asymptotics

S e c u r i t y p a r a m e t e r If adversary runs for less than this long T h e n i t s a d v a n t a g e i s n

  • m
  • r

e t h a n t h i s Time steps

slide-77
SLIDE 77

Advantage

Interpreting Asymptotics

S e c u r i t y p a r a m e t e r Time to tolerate If adversary runs for less than this long T h e n i t s a d v a n t a g e i s n

  • m
  • r

e t h a n t h i s Time steps

slide-78
SLIDE 78

Advantage

Interpreting Asymptotics

S e c u r i t y p a r a m e t e r Time to tolerate Admissible advantage If adversary runs for less than this long T h e n i t s a d v a n t a g e i s n

  • m
  • r

e t h a n t h i s Time steps

slide-79
SLIDE 79

Advantage

Interpreting Asymptotics

S e c u r i t y p a r a m e t e r Time to tolerate Admissible advantage If adversary runs for less than this long T h e n i t s a d v a n t a g e i s n

  • m
  • r

e t h a n t h i s set k here Time steps

slide-80
SLIDE 80

Feasible and Negligible

slide-81
SLIDE 81

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k

slide-82
SLIDE 82

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT)

slide-83
SLIDE 83

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT) It is better that we allow Eve high polynomial times too (we’ll typically tolerate some super-polynomial time for Eve)

slide-84
SLIDE 84

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT) It is better that we allow Eve high polynomial times too (we’ll typically tolerate some super-polynomial time for Eve) But algorithms for Alice/Bob better be very efficient

slide-85
SLIDE 85

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT) It is better that we allow Eve high polynomial times too (we’ll typically tolerate some super-polynomial time for Eve) But algorithms for Alice/Bob better be very efficient Eve could be non-uniform: a different strategy for each k

slide-86
SLIDE 86

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT) It is better that we allow Eve high polynomial times too (we’ll typically tolerate some super-polynomial time for Eve) But algorithms for Alice/Bob better be very efficient Eve could be non-uniform: a different strategy for each k Such an Eve should have only a “negligible” advantage (or, should cause at most a “negligible” difference in the behavior of the environment in the SIM definition)

slide-87
SLIDE 87

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT) It is better that we allow Eve high polynomial times too (we’ll typically tolerate some super-polynomial time for Eve) But algorithms for Alice/Bob better be very efficient Eve could be non-uniform: a different strategy for each k Such an Eve should have only a “negligible” advantage (or, should cause at most a “negligible” difference in the behavior of the environment in the SIM definition) What is negligible?

slide-88
SLIDE 88

Negligibly Small

slide-89
SLIDE 89

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast”

slide-90
SLIDE 90

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k)

slide-91
SLIDE 91

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k) i.e., faster than 1/poly(k) for every polynomial

slide-92
SLIDE 92

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k) i.e., faster than 1/poly(k) for every polynomial e.g.: 2-k, 2-√k, k-(log k).

slide-93
SLIDE 93

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k) i.e., faster than 1/poly(k) for every polynomial e.g.: 2-k, 2-√k, k-(log k). Formally: T negligible if ∀c>0 ∃k0 ∀k>k0 T(k) < 1/kc

slide-94
SLIDE 94

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k) i.e., faster than 1/poly(k) for every polynomial e.g.: 2-k, 2-√k, k-(log k). Formally: T negligible if ∀c>0 ∃k0 ∀k>k0 T(k) < 1/kc So that negl(k) ⨉ poly(k) = negl’(k)

slide-95
SLIDE 95

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k) i.e., faster than 1/poly(k) for every polynomial e.g.: 2-k, 2-√k, k-(log k). Formally: T negligible if ∀c>0 ∃k0 ∀k>k0 T(k) < 1/kc So that negl(k) ⨉ poly(k) = negl’(k) Needed, because Eve can often increase advantage polynomially by spending that much more time/by seeing that many more messages

slide-96
SLIDE 96

SIM-CPA secure if: ∀ PPT ∃ PPT s.t. ∀ PPT

Key/ Enc Key/ Dec

Env

Send Recv

Env REAL IDEAL

SIM-CPA Security

IDEAL ≈ REAL

Symmetric-Key Encryption

slide-97
SLIDE 97

SIM-CPA secure if: ∀ PPT ∃ PPT s.t. ∀ PPT

Key/ Enc Key/ Dec

Env

Send Recv

Env REAL IDEAL

SIM-CPA Security

IDEAL ≈ REAL

Symmetric-Key Encryption

| Pr[IDEAL=0] - Pr[REAL=0] | is negligible

slide-98
SLIDE 98

Next

Constructing (CPA-secure) SKE schemes Pseudorandomness Generator (PRG) One-Way Functions (& OW Permutations) OWP → PRG → (CPA-secure) SKE