Public-Key Cryptography Public-Key Cryptography Lecture 9 - - PowerPoint PPT Presentation

▶
public key cryptography public key cryptography
SMART_READER_LITE
LIVE PREVIEW

Public-Key Cryptography Public-Key Cryptography Lecture 9 - - PowerPoint PPT Presentation

Sep 18, 2022 233 likes •1.26k views

Public-Key Cryptography Public-Key Cryptography Lecture 9 Public-Key Cryptography Lecture 9 CCA Security SIM-CCA Security (PKE) Recv Send PK/Enc SK/Dec Replay Filter Secure (and correct) if: s.t. output of is distributed

slide-1
SLIDE 1

Public-Key Cryptography

slide-2
SLIDE 2

Public-Key Cryptography

Lecture 9

slide-3
SLIDE 3

Public-Key Cryptography

Lecture 9 CCA Security

slide-4
SLIDE 4

Secure (and correct) if: ∀ ∃ s.t. ∀

  • utput of

is distributed identically in REAL and IDEAL

SIM-CCA Security (PKE)

PK/Enc SK/Dec

Env

Send Recv

Env REAL IDEAL Replay Filter

slide-5
SLIDE 5

CCA Secure PKE: Cramer-Shoup

slide-6
SLIDE 6

CCA Secure PKE: Cramer-Shoup

El Gamal-like: Based on DDH assumption

slide-7
SLIDE 7

CCA Secure PKE: Cramer-Shoup

El Gamal-like: Based on DDH assumption Uses a prime-order group (e.g., QRp* for safe prime p)

slide-8
SLIDE 8

CCA Secure PKE: Cramer-Shoup

El Gamal-like: Based on DDH assumption Uses a prime-order group (e.g., QRp* for safe prime p) Uses a collision-resistant hash function inside an “integrity tag”

slide-9
SLIDE 9

CCA Secure PKE: Cramer-Shoup

El Gamal-like: Based on DDH assumption Uses a prime-order group (e.g., QRp* for safe prime p) Uses a collision-resistant hash function inside an “integrity tag” Enc(M) = (C,S) C = (g1x, g2x, MYx) and S = (WZH(C))x g1, g2, Y, W, Z are part of PK Y = g1y1 g2y2, W = g1w1 g2w2, Z = g1z1 g2z2. 
 SK contains (y1,y2,w1,w2,z1,z2)

slide-10
SLIDE 10

CCA Secure PKE: Cramer-Shoup

El Gamal-like: Based on DDH assumption Uses a prime-order group (e.g., QRp* for safe prime p) Uses a collision-resistant hash function inside an “integrity tag” Enc(M) = (C,S) C = (g1x, g2x, MYx) and S = (WZH(C))x g1, g2, Y, W, Z are part of PK Y = g1y1 g2y2, W = g1w1 g2w2, Z = g1z1 g2z2. 
 SK contains (y1,y2,w1,w2,z1,z2)

Multiple SKs can explain the same PK (unlike El Gamal)

slide-11
SLIDE 11

CCA Secure PKE: Cramer-Shoup

El Gamal-like: Based on DDH assumption Uses a prime-order group (e.g., QRp* for safe prime p) Uses a collision-resistant hash function inside an “integrity tag” Enc(M) = (C,S) C = (g1x, g2x, MYx) and S = (WZH(C))x g1, g2, Y, W, Z are part of PK Y = g1y1 g2y2, W = g1w1 g2w2, Z = g1z1 g2z2. 
 SK contains (y1,y2,w1,w2,z1,z2) Trapdoor: Using SK, and (g1x,g2x) can find Yx, Wx, Zx

Multiple SKs can explain the same PK (unlike El Gamal)

slide-12
SLIDE 12

CCA Secure PKE: Cramer-Shoup

El Gamal-like: Based on DDH assumption Uses a prime-order group (e.g., QRp* for safe prime p) Uses a collision-resistant hash function inside an “integrity tag” Enc(M) = (C,S) C = (g1x, g2x, MYx) and S = (WZH(C))x g1, g2, Y, W, Z are part of PK Y = g1y1 g2y2, W = g1w1 g2w2, Z = g1z1 g2z2. 
 SK contains (y1,y2,w1,w2,z1,z2) Trapdoor: Using SK, and (g1x,g2x) can find Yx, Wx, Zx If (g1x1,g2x2), x1≠x2, then “Yx, Wx, Zx” vary with different SKs

Multiple SKs can explain the same PK (unlike El Gamal)

slide-13
SLIDE 13

CCA Secure PKE: Cramer-Shoup

El Gamal-like: Based on DDH assumption Uses a prime-order group (e.g., QRp* for safe prime p) Uses a collision-resistant hash function inside an “integrity tag” Enc(M) = (C,S) C = (g1x, g2x, MYx) and S = (WZH(C))x g1, g2, Y, W, Z are part of PK Y = g1y1 g2y2, W = g1w1 g2w2, Z = g1z1 g2z2. 
 SK contains (y1,y2,w1,w2,z1,z2) Trapdoor: Using SK, and (g1x,g2x) can find Yx, Wx, Zx If (g1x1,g2x2), x1≠x2, then “Yx, Wx, Zx” vary with different SKs Decryption: Check S (assuming x1=x2) and extract M

Multiple SKs can explain the same PK (unlike El Gamal)

slide-14
SLIDE 14

Security of CS Scheme: Proof Sketch

slide-15
SLIDE 15

Security of CS Scheme: Proof Sketch

An “invalid encryption” can be used for challenge such that

slide-16
SLIDE 16

Security of CS Scheme: Proof Sketch

An “invalid encryption” can be used for challenge such that It contains no information about the message (given just PK)

slide-17
SLIDE 17

Security of CS Scheme: Proof Sketch

An “invalid encryption” can be used for challenge such that It contains no information about the message (given just PK) Is indistinguishable from valid encryption, under DDH assumption

slide-18
SLIDE 18

Security of CS Scheme: Proof Sketch

An “invalid encryption” can be used for challenge such that It contains no information about the message (given just PK) Is indistinguishable from valid encryption, under DDH assumption

(g1,g1x1,g2, g2x2) is of the form (g,gx,gy,gxy) iff x1=x2

slide-19
SLIDE 19

Security of CS Scheme: Proof Sketch

An “invalid encryption” can be used for challenge such that It contains no information about the message (given just PK) Is indistinguishable from valid encryption, under DDH assumption But adversary could get information about the specific SK from decryption queries?

(g1,g1x1,g2, g2x2) is of the form (g,gx,gy,gxy) iff x1=x2

slide-20
SLIDE 20

Security of CS Scheme: Proof Sketch

An “invalid encryption” can be used for challenge such that It contains no information about the message (given just PK) Is indistinguishable from valid encryption, under DDH assumption But adversary could get information about the specific SK from decryption queries? By querying decryption with only valid ciphertexts, adversary gets no information about SK (beyond given by PK)

(g1,g1x1,g2, g2x2) is of the form (g,gx,gy,gxy) iff x1=x2

slide-21
SLIDE 21

Security of CS Scheme: Proof Sketch

An “invalid encryption” can be used for challenge such that It contains no information about the message (given just PK) Is indistinguishable from valid encryption, under DDH assumption But adversary could get information about the specific SK from decryption queries? By querying decryption with only valid ciphertexts, adversary gets no information about SK (beyond given by PK) Adversary can’ t create new “invalid ciphertexts” that get past the integrity check (except with negligible probability)

(g1,g1x1,g2, g2x2) is of the form (g,gx,gy,gxy) iff x1=x2

slide-22
SLIDE 22

Security of CS Scheme: Proof Sketch

An “invalid encryption” can be used for challenge such that It contains no information about the message (given just PK) Is indistinguishable from valid encryption, under DDH assumption But adversary could get information about the specific SK from decryption queries? By querying decryption with only valid ciphertexts, adversary gets no information about SK (beyond given by PK) Adversary can’ t create new “invalid ciphertexts” that get past the integrity check (except with negligible probability) Any new invalid ciphertext can fool at most a negligible fraction of the possible SKs: so the probability of adversary fooling the specific one used is negligible

(g1,g1x1,g2, g2x2) is of the form (g,gx,gy,gxy) iff x1=x2

slide-23
SLIDE 23

Security of CS Scheme: Proof Sketch

An “invalid encryption” can be used for challenge such that It contains no information about the message (given just PK) Is indistinguishable from valid encryption, under DDH assumption But adversary could get information about the specific SK from decryption queries? By querying decryption with only valid ciphertexts, adversary gets no information about SK (beyond given by PK) Adversary can’ t create new “invalid ciphertexts” that get past the integrity check (except with negligible probability) Any new invalid ciphertext can fool at most a negligible fraction of the possible SKs: so the probability of adversary fooling the specific one used is negligible Formally using “hybrid argument” (0 advantage in last hybrid)

(g1,g1x1,g2, g2x2) is of the form (g,gx,gy,gxy) iff x1=x2

slide-24
SLIDE 24

Another CCA Secure PKE: RSA-OAEP

slide-25
SLIDE 25

Another CCA Secure PKE: RSA-OAEP

RSA-OAEP

slide-26
SLIDE 26

Another CCA Secure PKE: RSA-OAEP

RSA-OAEP “Text-book RSA encryption” (i.e., fRSA, the T-OWP candidate) applied to an “encoding” of the message

slide-27
SLIDE 27

Another CCA Secure PKE: RSA-OAEP

RSA-OAEP “Text-book RSA encryption” (i.e., fRSA, the T-OWP candidate) applied to an “encoding” of the message Encoding is randomized

slide-28
SLIDE 28

Another CCA Secure PKE: RSA-OAEP

RSA-OAEP “Text-book RSA encryption” (i.e., fRSA, the T-OWP candidate) applied to an “encoding” of the message Encoding is randomized Encoding uses a hash function modeled as a “Random Oracle”

slide-29
SLIDE 29

Another CCA Secure PKE: RSA-OAEP

RSA-OAEP “Text-book RSA encryption” (i.e., fRSA, the T-OWP candidate) applied to an “encoding” of the message Encoding is randomized Encoding uses a hash function modeled as a “Random Oracle” Security in the RO Model, assuming fRSA a OWP

slide-30
SLIDE 30

Another CCA Secure PKE: RSA-OAEP

RSA-OAEP “Text-book RSA encryption” (i.e., fRSA, the T-OWP candidate) applied to an “encoding” of the message Encoding is randomized Encoding uses a hash function modeled as a “Random Oracle” Security in the RO Model, assuming fRSA a OWP Part of RSA Cryptography Standard (PKCS#1 Ver 2.1). Commonly used in SSL/TLS implementations

slide-31
SLIDE 31

Random Oracle Model

slide-32
SLIDE 32

Random Oracle Model

Random Oracle: a mythical oracle that, when initialized, picks a random function R:{0,1}*→{0,1}n(k) and when queried with x, returns R(x)

slide-33
SLIDE 33

Random Oracle Model

Random Oracle: a mythical oracle that, when initialized, picks a random function R:{0,1}*→{0,1}n(k) and when queried with x, returns R(x) All parties have access to the same RO

slide-34
SLIDE 34

Random Oracle Model

Random Oracle: a mythical oracle that, when initialized, picks a random function R:{0,1}*→{0,1}n(k) and when queried with x, returns R(x) All parties have access to the same RO In ROM, evaluating some “hash function” H would be modeled as accessing an RO

slide-35
SLIDE 35

Random Oracle Model

Random Oracle: a mythical oracle that, when initialized, picks a random function R:{0,1}*→{0,1}n(k) and when queried with x, returns R(x) All parties have access to the same RO In ROM, evaluating some “hash function” H would be modeled as accessing an RO Especially when H has “no simple structure”

slide-36
SLIDE 36

Random Oracle Model

Random Oracle: a mythical oracle that, when initialized, picks a random function R:{0,1}*→{0,1}n(k) and when queried with x, returns R(x) All parties have access to the same RO In ROM, evaluating some “hash function” H would be modeled as accessing an RO Especially when H has “no simple structure” Sometimes security definitions need to be adapted for ROM

slide-37
SLIDE 37

Random Oracle Model

Random Oracle: a mythical oracle that, when initialized, picks a random function R:{0,1}*→{0,1}n(k) and when queried with x, returns R(x) All parties have access to the same RO In ROM, evaluating some “hash function” H would be modeled as accessing an RO Especially when H has “no simple structure” Sometimes security definitions need to be adapted for ROM Regular proofs of security, once in the ROM

slide-38
SLIDE 38

Random Oracle Model

slide-39
SLIDE 39

Random Oracle Model

There is no Pseudo-RO

slide-40
SLIDE 40

Random Oracle Model

There is no Pseudo-RO Unlike PRF , RO must be locally evaluable for all parties. (think: giving out the seed of a PRF)

slide-41
SLIDE 41

Random Oracle Model

There is no Pseudo-RO Unlike PRF , RO must be locally evaluable for all parties. (think: giving out the seed of a PRF) There are schemes secure in ROM, such that for any instantiation of the RO, the scheme is insecure!

slide-42
SLIDE 42

Random Oracle Model

There is no Pseudo-RO Unlike PRF , RO must be locally evaluable for all parties. (think: giving out the seed of a PRF) There are schemes secure in ROM, such that for any instantiation of the RO, the scheme is insecure! Also natural constructs/primitives which are realizable in ROM, but not in the standard model!

slide-43
SLIDE 43

Random Oracle Model

There is no Pseudo-RO Unlike PRF , RO must be locally evaluable for all parties. (think: giving out the seed of a PRF) There are schemes secure in ROM, such that for any instantiation of the RO, the scheme is insecure! Also natural constructs/primitives which are realizable in ROM, but not in the standard model! What does a proof in ROM tell us?

slide-44
SLIDE 44

Random Oracle Model

There is no Pseudo-RO Unlike PRF , RO must be locally evaluable for all parties. (think: giving out the seed of a PRF) There are schemes secure in ROM, such that for any instantiation of the RO, the scheme is insecure! Also natural constructs/primitives which are realizable in ROM, but not in the standard model! What does a proof in ROM tell us? Secure against attacks that treat H as a blackbox (and for which H is pseudorandom)

slide-45
SLIDE 45

Hybrid Encryption

slide-46
SLIDE 46

Hybrid Encryption

PKE is far less efficient compared to SKE (even in ROM)

slide-47
SLIDE 47

Hybrid Encryption

PKE is far less efficient compared to SKE (even in ROM) SKE using Block Ciphers (e.g. AES) and MAC is very fast

slide-48
SLIDE 48

Hybrid Encryption

PKE is far less efficient compared to SKE (even in ROM) SKE using Block Ciphers (e.g. AES) and MAC is very fast RSA-OAEP uses exponentiations (Cramer-Shoup even more)

slide-49
SLIDE 49

Hybrid Encryption

PKE is far less efficient compared to SKE (even in ROM) SKE using Block Ciphers (e.g. AES) and MAC is very fast RSA-OAEP uses exponentiations (Cramer-Shoup even more) Hybrid encryption: Use (CCA secure) PKE to transfer a key (or key generation material) for the (CCA secure) SKE. Use SKE with this key for sending data

slide-50
SLIDE 50

Hybrid Encryption

PKE is far less efficient compared to SKE (even in ROM) SKE using Block Ciphers (e.g. AES) and MAC is very fast RSA-OAEP uses exponentiations (Cramer-Shoup even more) Hybrid encryption: Use (CCA secure) PKE to transfer a key (or key generation material) for the (CCA secure) SKE. Use SKE with this key for sending data Hopefully the combination remains CCA secure

slide-51
SLIDE 51

Hybrid Encryption

PKE is far less efficient compared to SKE (even in ROM) SKE using Block Ciphers (e.g. AES) and MAC is very fast RSA-OAEP uses exponentiations (Cramer-Shoup even more) Hybrid encryption: Use (CCA secure) PKE to transfer a key (or key generation material) for the (CCA secure) SKE. Use SKE with this key for sending data Hopefully the combination remains CCA secure PKE used to encrypt only a (short) key for the SKE

slide-52
SLIDE 52

Hybrid Encryption

PKE is far less efficient compared to SKE (even in ROM) SKE using Block Ciphers (e.g. AES) and MAC is very fast RSA-OAEP uses exponentiations (Cramer-Shoup even more) Hybrid encryption: Use (CCA secure) PKE to transfer a key (or key generation material) for the (CCA secure) SKE. Use SKE with this key for sending data Hopefully the combination remains CCA secure PKE used to encrypt only a (short) key for the SKE Relatively low overhead on top of the (fast) SKE encryption

slide-53
SLIDE 53

Hybrid Encryption

slide-54
SLIDE 54

Hybrid Encryption

Hybrid Encryption: KEM/DEM paradigm

slide-55
SLIDE 55

Hybrid Encryption

Hybrid Encryption: KEM/DEM paradigm Key Encapsulation Method: a public-key scheme to transfer a key

slide-56
SLIDE 56

Hybrid Encryption

Hybrid Encryption: KEM/DEM paradigm Key Encapsulation Method: a public-key scheme to transfer a key

Or to generate a key

slide-57
SLIDE 57

Hybrid Encryption

Hybrid Encryption: KEM/DEM paradigm Key Encapsulation Method: a public-key scheme to transfer a key Data Encapsulation Method: a shared-key scheme (using the key transferred using KEM)

Or to generate a key

slide-58
SLIDE 58

Hybrid Encryption

Hybrid Encryption: KEM/DEM paradigm Key Encapsulation Method: a public-key scheme to transfer a key Data Encapsulation Method: a shared-key scheme (using the key transferred using KEM) For what KEM/DEM is a hybrid encryption scheme CCA secure?

Or to generate a key

slide-59
SLIDE 59

Hybrid Encryption

Hybrid Encryption: KEM/DEM paradigm Key Encapsulation Method: a public-key scheme to transfer a key Data Encapsulation Method: a shared-key scheme (using the key transferred using KEM) For what KEM/DEM is a hybrid encryption scheme CCA secure? Works if KEM is a SIM-CCA secure PKE scheme and DEM is a SIM-CCA secure SKE scheme

Or to generate a key

slide-60
SLIDE 60

Hybrid Encryption

Hybrid Encryption: KEM/DEM paradigm Key Encapsulation Method: a public-key scheme to transfer a key Data Encapsulation Method: a shared-key scheme (using the key transferred using KEM) For what KEM/DEM is a hybrid encryption scheme CCA secure? Works if KEM is a SIM-CCA secure PKE scheme and DEM is a SIM-CCA secure SKE scheme Easy to prove using “composition” properties of the SIM definition

Or to generate a key

slide-61
SLIDE 61

Hybrid Encryption

Hybrid Encryption: KEM/DEM paradigm Key Encapsulation Method: a public-key scheme to transfer a key Data Encapsulation Method: a shared-key scheme (using the key transferred using KEM) For what KEM/DEM is a hybrid encryption scheme CCA secure? Works if KEM is a SIM-CCA secure PKE scheme and DEM is a SIM-CCA secure SKE scheme Easy to prove using “composition” properties of the SIM definition Less security sufficient: KEM used to transfer a random key; DEM uses a new key every time.

Or to generate a key

slide-62
SLIDE 62

CCA Secure PKE: DHIES

slide-63
SLIDE 63

CCA Secure PKE: DHIES

Diffie-Hellman Integrated Encryption Scheme

slide-64
SLIDE 64

CCA Secure PKE: DHIES

Diffie-Hellman Integrated Encryption Scheme Part of some standards

slide-65
SLIDE 65

CCA Secure PKE: DHIES

Diffie-Hellman Integrated Encryption Scheme Part of some standards Essentially a hybrid scheme

slide-66
SLIDE 66

CCA Secure PKE: DHIES

Diffie-Hellman Integrated Encryption Scheme Part of some standards Essentially a hybrid scheme Data Encapsulation: CPA secure SKE and MAC

slide-67
SLIDE 67

CCA Secure PKE: DHIES

Diffie-Hellman Integrated Encryption Scheme Part of some standards Essentially a hybrid scheme Data Encapsulation: CPA secure SKE and MAC Key Encapsulation: X=gx. Let K=Yx, where Y is the PK (as in El Gamal), and (KSKE,KMAC) = Hash(K) (where K=Yx=Xy)

slide-68
SLIDE 68

CCA Secure PKE: DHIES

Diffie-Hellman Integrated Encryption Scheme Part of some standards Essentially a hybrid scheme Data Encapsulation: CPA secure SKE and MAC Key Encapsulation: X=gx. Let K=Yx, where Y is the PK (as in El Gamal), and (KSKE,KMAC) = Hash(K) (where K=Yx=Xy) CCA security based on a complex (non-standard) assumption involving Hash and the group: “Oracle Diffie-Hellman Assumption”

slide-69
SLIDE 69

Another PKE Scheme: CCA Secure in RO Model

slide-70
SLIDE 70

Another PKE Scheme: CCA Secure in RO Model

Fujisaki-Okamoto Hybrid scheme

slide-71
SLIDE 71

Another PKE Scheme: CCA Secure in RO Model

Fujisaki-Okamoto Hybrid scheme KEM encrypts random x, using random coins derived as H(m,x), where m is the message and H a “random oracle”

slide-72
SLIDE 72

Another PKE Scheme: CCA Secure in RO Model

Fujisaki-Okamoto Hybrid scheme KEM encrypts random x, using random coins derived as H(m,x), where m is the message and H a “random oracle” DEM encrypts with key K = G(x), where G is another “random oracle”

slide-73
SLIDE 73

Another PKE Scheme: CCA Secure in RO Model

Fujisaki-Okamoto Hybrid scheme KEM encrypts random x, using random coins derived as H(m,x), where m is the message and H a “random oracle” DEM encrypts with key K = G(x), where G is another “random oracle” Decryption decrypts x, then m, and then checks if KEM was correct

slide-74
SLIDE 74

Another PKE Scheme: CCA Secure in RO Model

Fujisaki-Okamoto Hybrid scheme KEM encrypts random x, using random coins derived as H(m,x), where m is the message and H a “random oracle” DEM encrypts with key K = G(x), where G is another “random oracle” Decryption decrypts x, then m, and then checks if KEM was correct Very weak security sufficient for encryptions used in KEM and DEM (but only with H, G modeled as random oracles)

slide-75
SLIDE 75

Identity-Based Encryption

slide-76
SLIDE 76

In PKE, KeyGen produces a random (PK,SK) pair

Identity-Based Encryption

slide-77
SLIDE 77

In PKE, KeyGen produces a random (PK,SK) pair Can I have a “fancy public-key” (e.g., my name)?

Identity-Based Encryption

slide-78
SLIDE 78

In PKE, KeyGen produces a random (PK,SK) pair Can I have a “fancy public-key” (e.g., my name)? No! Not secure if one can pick any PK and find an SK for it!

Identity-Based Encryption

slide-79
SLIDE 79

In PKE, KeyGen produces a random (PK,SK) pair Can I have a “fancy public-key” (e.g., my name)? No! Not secure if one can pick any PK and find an SK for it! But suppose a trusted authority for key generation

Identity-Based Encryption

slide-80
SLIDE 80

In PKE, KeyGen produces a random (PK,SK) pair Can I have a “fancy public-key” (e.g., my name)? No! Not secure if one can pick any PK and find an SK for it! But suppose a trusted authority for key generation Then: Can it generate a valid (PK,SK) pair for any PK?

Identity-Based Encryption

slide-81
SLIDE 81

In PKE, KeyGen produces a random (PK,SK) pair Can I have a “fancy public-key” (e.g., my name)? No! Not secure if one can pick any PK and find an SK for it! But suppose a trusted authority for key generation Then: Can it generate a valid (PK,SK) pair for any PK? Identity-Based Encryption: a key-server (with a master secret-key) that can generate such pairs

Identity-Based Encryption

slide-82
SLIDE 82

In PKE, KeyGen produces a random (PK,SK) pair Can I have a “fancy public-key” (e.g., my name)? No! Not secure if one can pick any PK and find an SK for it! But suppose a trusted authority for key generation Then: Can it generate a valid (PK,SK) pair for any PK? Identity-Based Encryption: a key-server (with a master secret-key) that can generate such pairs Encryption will use the master public-key, and the receiver’ s “identity” (i.e., fancy public-key)

Identity-Based Encryption

slide-83
SLIDE 83

In PKE, KeyGen produces a random (PK,SK) pair Can I have a “fancy public-key” (e.g., my name)? No! Not secure if one can pick any PK and find an SK for it! But suppose a trusted authority for key generation Then: Can it generate a valid (PK,SK) pair for any PK? Identity-Based Encryption: a key-server (with a master secret-key) that can generate such pairs Encryption will use the master public-key, and the receiver’ s “identity” (i.e., fancy public-key) In PKE, sender has to retrieve PK for every party it wants to talk to (from a trusted public directory)

Identity-Based Encryption

slide-84
SLIDE 84

In PKE, KeyGen produces a random (PK,SK) pair Can I have a “fancy public-key” (e.g., my name)? No! Not secure if one can pick any PK and find an SK for it! But suppose a trusted authority for key generation Then: Can it generate a valid (PK,SK) pair for any PK? Identity-Based Encryption: a key-server (with a master secret-key) that can generate such pairs Encryption will use the master public-key, and the receiver’ s “identity” (i.e., fancy public-key) In PKE, sender has to retrieve PK for every party it wants to talk to (from a trusted public directory) In IBE, receiver has to obtain its SK from the authority

Identity-Based Encryption

slide-85
SLIDE 85

Identity-Based Encryption

slide-86
SLIDE 86

Identity-Based Encryption

Security requirement for IBE (will skip formal statement):

slide-87
SLIDE 87

Identity-Based Encryption

Security requirement for IBE (will skip formal statement): Environment/adversary decides the ID of the honest parties

slide-88
SLIDE 88

Identity-Based Encryption

Security requirement for IBE (will skip formal statement): Environment/adversary decides the ID of the honest parties Adversary can adaptively request SK for any number of IDs (which are not used for honest parties)

slide-89
SLIDE 89

Identity-Based Encryption

Security requirement for IBE (will skip formal statement): Environment/adversary decides the ID of the honest parties Adversary can adaptively request SK for any number of IDs (which are not used for honest parties) “Semantic security” for encryption with the ID of honest parties (i.e., with no access to decryption: CPA security)

slide-90
SLIDE 90

Identity-Based Encryption

Security requirement for IBE (will skip formal statement): Environment/adversary decides the ID of the honest parties Adversary can adaptively request SK for any number of IDs (which are not used for honest parties) “Semantic security” for encryption with the ID of honest parties (i.e., with no access to decryption: CPA security) IBE (even CPA-secure) can easily give CCA-secure PKE!

slide-91
SLIDE 91

Identity-Based Encryption

Security requirement for IBE (will skip formal statement): Environment/adversary decides the ID of the honest parties Adversary can adaptively request SK for any number of IDs (which are not used for honest parties) “Semantic security” for encryption with the ID of honest parties (i.e., with no access to decryption: CPA security) IBE (even CPA-secure) can easily give CCA-secure PKE! IBE: Can’ t malleate ciphertext for one ID into one for another

slide-92
SLIDE 92

Identity-Based Encryption

Security requirement for IBE (will skip formal statement): Environment/adversary decides the ID of the honest parties Adversary can adaptively request SK for any number of IDs (which are not used for honest parties) “Semantic security” for encryption with the ID of honest parties (i.e., with no access to decryption: CPA security) IBE (even CPA-secure) can easily give CCA-secure PKE! IBE: Can’ t malleate ciphertext for one ID into one for another PKEncMPK(m) = (id, C=IBEncMPK(id; m), signid(C) )

slide-93
SLIDE 93

Identity-Based Encryption

Security requirement for IBE (will skip formal statement): Environment/adversary decides the ID of the honest parties Adversary can adaptively request SK for any number of IDs (which are not used for honest parties) “Semantic security” for encryption with the ID of honest parties (i.e., with no access to decryption: CPA security) IBE (even CPA-secure) can easily give CCA-secure PKE! IBE: Can’ t malleate ciphertext for one ID into one for another PKEncMPK(m) = (id, C=IBEncMPK(id; m), signid(C) )

Digital Signature with 
 randomly generated
 id as its public-key

slide-94
SLIDE 94

Identity-Based Encryption

Security requirement for IBE (will skip formal statement): Environment/adversary decides the ID of the honest parties Adversary can adaptively request SK for any number of IDs (which are not used for honest parties) “Semantic security” for encryption with the ID of honest parties (i.e., with no access to decryption: CPA security) IBE (even CPA-secure) can easily give CCA-secure PKE! IBE: Can’ t malleate ciphertext for one ID into one for another PKEncMPK(m) = (id, C=IBEncMPK(id; m), signid(C) ) Security: can’ t create a different encryption
 with same id (signature’ s security); can’ t 
 malleate using a different id (IBE’ s security)

Digital Signature with 
 randomly generated
 id as its public-key

slide-95
SLIDE 95

Today

slide-96
SLIDE 96

Today

CCA secure PKE

slide-97
SLIDE 97

Today

CCA secure PKE Cramer-Shoup

slide-98
SLIDE 98

Today

CCA secure PKE Cramer-Shoup Hybrid Encryption: KEM/DEM

slide-99
SLIDE 99

Today

CCA secure PKE Cramer-Shoup Hybrid Encryption: KEM/DEM In Random Oracle Model: e.g. RSA-OAEP

slide-100
SLIDE 100

Today

CCA secure PKE Cramer-Shoup Hybrid Encryption: KEM/DEM In Random Oracle Model: e.g. RSA-OAEP Using Identity Based Encryption

slide-101
SLIDE 101

Today

CCA secure PKE Cramer-Shoup Hybrid Encryption: KEM/DEM In Random Oracle Model: e.g. RSA-OAEP Using Identity Based Encryption Next up: Digital Signatures