Security of Encryption Security of Encryption Perfect secrecy - - PowerPoint PPT Presentation

▶
security of encryption security of encryption
SMART_READER_LITE
LIVE PREVIEW

Security of Encryption Security of Encryption Perfect secrecy - - PowerPoint PPT Presentation

Aug 26, 2022 231 likes •1.36k views

Defining Encryption (ctd.) Lecture 3 CPA/CCA security Computational Indistinguishability Pseudo-randomness, One-Way Functions Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too strong (though too

slide-1
SLIDE 1

Defining Encryption (ctd.)

Lecture 3 CPA/CCA security Computational Indistinguishability
 Pseudo-randomness, One-Way Functions

slide-2
SLIDE 2

Security of Encryption

slide-3
SLIDE 3

Security of Encryption

Perfect secrecy (IND-Onetime security) is too strong (though too weak in some other respects...)

slide-4
SLIDE 4

Security of Encryption

Perfect secrecy (IND-Onetime security) is too strong (though too weak in some other respects...) Necessitates keys as long as the messages

slide-5
SLIDE 5

Security of Encryption

Perfect secrecy (IND-Onetime security) is too strong (though too weak in some other respects...) Necessitates keys as long as the messages Relax the requirement by restricting to computationally bounded adversaries (and environments)

slide-6
SLIDE 6

Security of Encryption

Perfect secrecy (IND-Onetime security) is too strong (though too weak in some other respects...) Necessitates keys as long as the messages Relax the requirement by restricting to computationally bounded adversaries (and environments) Coming up: Formalizing notions of “computational” security (as

  • pposed to perfect/statistical security)
slide-7
SLIDE 7

Security of Encryption

Perfect secrecy (IND-Onetime security) is too strong (though too weak in some other respects...) Necessitates keys as long as the messages Relax the requirement by restricting to computationally bounded adversaries (and environments) Coming up: Formalizing notions of “computational” security (as

  • pposed to perfect/statistical security)

Then, security definitions used for encryption of multiple messages

slide-8
SLIDE 8

Shared-key (Private-key) Encryption Key Generation: Randomized K ← K , uniformly randomly drawn from the key-space (or according to a key-distribution) Encryption: Randomized Enc: M ×K ×R →C. During encryption a fresh random string will be chosen uniformly at random from R Decryption: Deterministic Dec: C ×K → M

The Syntax

Symmetric-Key Encryption

slide-9
SLIDE 9

SIM-CPA secure if: ∀ ∃ s.t. ∀

Key/Enc Key/Dec

Env

Send Recv

Env REAL IDEAL

SIM-CPA Security

REAL ≈ IDEAL

Symmetric-Key Encryption

slide-10
SLIDE 10

SIM-CPA secure if: ∀ ∃ s.t. ∀

Key/Enc Key/Dec

Env

Send Recv

Env REAL IDEAL

SIM-CPA Security

Same as SIM-onetime security, but not restricted to environments which send only one message

REAL ≈ IDEAL

Symmetric-Key Encryption

slide-11
SLIDE 11

SIM-CPA secure if: ∀ ∃ s.t. ∀

Key/Enc Key/Dec

Env

Send Recv

Env REAL IDEAL

SIM-CPA Security

Same as SIM-onetime security, but not restricted to environments which send only one message

REAL ≈ IDEAL

Symmetric-Key Encryption

Later

slide-12
SLIDE 12

IND-CPA Security

Symmetric-Key Encryption

slide-13
SLIDE 13

Experiment picks a random bit b. It also runs KeyGen to get a key K

Key/Enc

b←{0,1}

IND-CPA Security

Symmetric-Key Encryption

slide-14
SLIDE 14

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants

Key/Enc

b←{0,1}

IND-CPA Security

Symmetric-Key Encryption

slide-15
SLIDE 15

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment

Key/Enc

b←{0,1} m0,m1

IND-CPA Security

Symmetric-Key Encryption

slide-16
SLIDE 16

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary

Key/Enc

b←{0,1} m0,m1 mb Enc(mb,K)

IND-CPA Security

Symmetric-Key Encryption

slide-17
SLIDE 17

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary

Key/Enc

b←{0,1} m0,m1 mb Enc(mb,K)

IND-CPA Security

Symmetric-Key Encryption

slide-18
SLIDE 18

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’

Key/Enc

b←{0,1} m0,m1 mb Enc(mb,K) b’

IND-CPA Security

Symmetric-Key Encryption

slide-19
SLIDE 19

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’ Experiment outputs 1 iff b’=b

Key/Enc

b←{0,1} b’=b? m0,m1 mb Enc(mb,K) b’ Yes/No

IND-CPA Security

Symmetric-Key Encryption

slide-20
SLIDE 20

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’ Experiment outputs 1 iff b’=b IND-CPA secure if for all “feasible” adversaries Pr[b’=b] ≈ 1/2

Key/Enc

b←{0,1} b’=b? m0,m1 mb Enc(mb,K) b’ Yes/No

IND-CPA Security

Symmetric-Key Encryption

slide-21
SLIDE 21

b

Experiment picks a random bit b. It also runs KeyGen to get a key K For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’ Experiment outputs 1 iff b’=b IND-CPA secure if for all “feasible” adversaries Pr[b’=b] ≈ 1/2

Key/Enc

b←{0,1} b’=b? m0,m1 mb Enc(mb,K) b’ Yes/No

IND-CPA Security

Symmetric-Key Encryption

IND-CPA + ~correctness equivalent to SIM-CPA

slide-22
SLIDE 22

SIM-CCA secure if: ∀ ∃ s.t. ∀

Key/Enc Key/Dec

Env

Send Recv

Env REAL IDEAL

SIM-CCA Security

Symmetric-Key Encryption

REAL ≈ IDEAL

slide-23
SLIDE 23

SIM-CCA secure if: ∀ ∃ s.t. ∀

Key/Enc Key/Dec

Env

Send Recv

Env REAL IDEAL

SIM-CCA Security

Symmetric-Key Encryption

An active adversary can inject its own ciphertexts into the channel and get them “decrypted”

REAL ≈ IDEAL

slide-24
SLIDE 24

SIM-CCA secure if: ∀ ∃ s.t. ∀

Key/Enc Key/Dec

Env

Send Recv

Env REAL IDEAL

SIM-CCA Security

Symmetric-Key Encryption

An active adversary can inject its own ciphertexts into the channel and get them “decrypted”

REAL ≈ IDEAL

slide-25
SLIDE 25

SIM-CCA secure if: ∀ ∃ s.t. ∀

Key/Enc Key/Dec

Env

Send Recv

Env REAL IDEAL Replay Filter

SIM-CCA Security

Symmetric-Key Encryption

An active adversary can inject its own ciphertexts into the channel and get them “decrypted”

REAL ≈ IDEAL

slide-26
SLIDE 26

Experiment picks b←{0,1} and K←KeyGen For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’ Experiments outputs 1 iff b’=b IND-CCA secure if for all feasible adversaries Pr[b’=b] ≈ 1/2

b

Key/Enc

b←{0,1} b’=b? m0,m1 mb b’ Yes/No Enc(mb,K)

IND-CCA Security

Symmetric-Key Encryption

slide-27
SLIDE 27

Experiment picks b←{0,1} and K←KeyGen For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’ Experiments outputs 1 iff b’=b IND-CCA secure if for all feasible adversaries Pr[b’=b] ≈ 1/2

b

Key/Enc

b←{0,1} b’=b? m0,m1 mb b’ Yes/No

Adv gets (guarded) access to DecK oracle

Enc(mb,K)

Key/Dec

IND-CCA Security

Symmetric-Key Encryption

slide-28
SLIDE 28

Experiment picks b←{0,1} and K←KeyGen For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’ Experiments outputs 1 iff b’=b IND-CCA secure if for all feasible adversaries Pr[b’=b] ≈ 1/2

b

Key/Enc

b←{0,1} b’=b? m0,m1 mb b’ Yes/No

Adv gets (guarded) access to DecK oracle

Enc(mb,K)

Key/Dec

No challenge ciphertext answered

IND-CCA Security

Symmetric-Key Encryption

slide-29
SLIDE 29

Experiment picks b←{0,1} and K←KeyGen For as long as Adversary wants Adv sends two messages m0, m1 to the experiment Expt returns Enc(mb,K) to the adversary Adversary returns a guess b’ Experiments outputs 1 iff b’=b IND-CCA secure if for all feasible adversaries Pr[b’=b] ≈ 1/2

b

Key/Enc

b←{0,1} b’=b? m0,m1 mb b’ Yes/No

Adv gets (guarded) access to DecK oracle

Enc(mb,K)

Key/Dec

No challenge ciphertext answered

IND-CCA Security

Symmetric-Key Encryption

IND-CCA + ~correctness equivalent to SIM-CCA

slide-30
SLIDE 30

Definitions Summary

slide-31
SLIDE 31

Definitions Summary

Security definitions:

slide-32
SLIDE 32

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness

slide-33
SLIDE 33

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness SIM-CPA = IND-CPA + ~correctness: allows using the same key for multiple messages

slide-34
SLIDE 34

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness SIM-CPA = IND-CPA + ~correctness: allows using the same key for multiple messages SIM-CCA = IND-CCA + ~correctness: allows active attacks

slide-35
SLIDE 35

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness SIM-CPA = IND-CPA + ~correctness: allows using the same key for multiple messages SIM-CCA = IND-CCA + ~correctness: allows active attacks Next

slide-36
SLIDE 36

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness SIM-CPA = IND-CPA + ~correctness: allows using the same key for multiple messages SIM-CCA = IND-CCA + ~correctness: allows active attacks Next For multi-message schemes we relaxed the “perfect” simulation requirement

slide-37
SLIDE 37

Definitions Summary

Security definitions: SIM-Onetime = IND-Onetime/Perfect Secrecy + correctness SIM-CPA = IND-CPA + ~correctness: allows using the same key for multiple messages SIM-CCA = IND-CCA + ~correctness: allows active attacks Next For multi-message schemes we relaxed the “perfect” simulation requirement But what is ≈ ?

slide-38
SLIDE 38

Feasible Computation

slide-39
SLIDE 39

Feasible Computation

In analyzing complexity of algorithms: Rate at which computational complexity grows with input size e.g. Can do sorting in O(n log n)

slide-40
SLIDE 40

Feasible Computation

In analyzing complexity of algorithms: Rate at which computational complexity grows with input size e.g. Can do sorting in O(n log n) Only the rough rate considered Exact time depends on the technology

slide-41
SLIDE 41

Feasible Computation

In analyzing complexity of algorithms: Rate at which computational complexity grows with input size e.g. Can do sorting in O(n log n) Only the rough rate considered Exact time depends on the technology How much more computation will be needed as the instances of the problem get larger. (Do we scale well?)

slide-42
SLIDE 42

Feasible Computation

In analyzing complexity of algorithms: Rate at which computational complexity grows with input size e.g. Can do sorting in O(n log n) Only the rough rate considered Exact time depends on the technology How much more computation will be needed as the instances of the problem get larger. (Do we scale well?)

slide-43
SLIDE 43

Feasible Computation

In analyzing complexity of algorithms: Rate at which computational complexity grows with input size e.g. Can do sorting in O(n log n) Only the rough rate considered Exact time depends on the technology How much more computation will be needed as the instances of the problem get larger. (Do we scale well?) “Polynomial time” (O(n), O(n2), O(n3), ...) considered feasible

slide-44
SLIDE 44

Infeasible Computation

slide-45
SLIDE 45

Infeasible Computation

“Super-Polynomial time” considered infeasible

slide-46
SLIDE 46

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n)

slide-47
SLIDE 47

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n) i.e., as n grows, quickly becomes “infeasibly large”

slide-48
SLIDE 48

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n) i.e., as n grows, quickly becomes “infeasibly large” Can we make breaking security infeasible for Eve?

slide-49
SLIDE 49

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n) i.e., as n grows, quickly becomes “infeasibly large” Can we make breaking security infeasible for Eve? What is n (that can grow)?

slide-50
SLIDE 50

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n) i.e., as n grows, quickly becomes “infeasibly large” Can we make breaking security infeasible for Eve? What is n (that can grow)? Message size?

slide-51
SLIDE 51

Infeasible Computation

“Super-Polynomial time” considered infeasible e.g. 2n, 2√n, nlog(n) i.e., as n grows, quickly becomes “infeasibly large” Can we make breaking security infeasible for Eve? What is n (that can grow)? Message size? We need security even if sending only one bit!

slide-52
SLIDE 52

Security Parameter

slide-53
SLIDE 53

Security Parameter

A parameter that is part of the encryption scheme

slide-54
SLIDE 54

Security Parameter

A parameter that is part of the encryption scheme Not related to message size

slide-55
SLIDE 55

Security Parameter

A parameter that is part of the encryption scheme Not related to message size A knob that can be used to set the security level

slide-56
SLIDE 56

Security Parameter

A parameter that is part of the encryption scheme Not related to message size A knob that can be used to set the security level Will denote by k

slide-57
SLIDE 57

Security Parameter

A parameter that is part of the encryption scheme Not related to message size A knob that can be used to set the security level Will denote by k Security guarantees are given asymptotically as a function of the security parameter

slide-58
SLIDE 58

Interpreting Asymptotics

slide-59
SLIDE 59

Advantage

Interpreting Asymptotics

S e c u r i t y p a r a m e t e r Time

slide-60
SLIDE 60

Advantage

Interpreting Asymptotics

S e c u r i t y p a r a m e t e r If adversary runs for less than this long T h e n i t s a d v a n t a g e i s n

  • m
  • r

e t h a n t h i s Time

slide-61
SLIDE 61

Advantage

Interpreting Asymptotics

S e c u r i t y p a r a m e t e r Time to tolerate If adversary runs for less than this long T h e n i t s a d v a n t a g e i s n

  • m
  • r

e t h a n t h i s Time

slide-62
SLIDE 62

Advantage

Interpreting Asymptotics

S e c u r i t y p a r a m e t e r Time to tolerate Admissible advantage If adversary runs for less than this long T h e n i t s a d v a n t a g e i s n

  • m
  • r

e t h a n t h i s Time

slide-63
SLIDE 63

Advantage

Interpreting Asymptotics

S e c u r i t y p a r a m e t e r Time to tolerate Admissible advantage If adversary runs for less than this long T h e n i t s a d v a n t a g e i s n

  • m
  • r

e t h a n t h i s set k here Time

slide-64
SLIDE 64

Feasible and Negligible

slide-65
SLIDE 65

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k

slide-66
SLIDE 66

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT)

slide-67
SLIDE 67

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT) It is better that we allow Eve high polynomial times too (we’ll typically allow Eve some super-polynomial time)

slide-68
SLIDE 68

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT) It is better that we allow Eve high polynomial times too (we’ll typically allow Eve some super-polynomial time) But algorithms for Alice/Bob better be very efficient

slide-69
SLIDE 69

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT) It is better that we allow Eve high polynomial times too (we’ll typically allow Eve some super-polynomial time) But algorithms for Alice/Bob better be very efficient Eve could be non-uniform: a different strategy for each k

slide-70
SLIDE 70

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT) It is better that we allow Eve high polynomial times too (we’ll typically allow Eve some super-polynomial time) But algorithms for Alice/Bob better be very efficient Eve could be non-uniform: a different strategy for each k Such an Eve should have only a “negligible” advantage (or, should cause at most a “negligible” difference in the behavior of the environment in the SIM definition)

slide-71
SLIDE 71

Feasible and Negligible

We want to tolerate Eves who have a running time bounded by some polynomial in k Eve could toss coins: Probabilistic Polynomial-Time (PPT) It is better that we allow Eve high polynomial times too (we’ll typically allow Eve some super-polynomial time) But algorithms for Alice/Bob better be very efficient Eve could be non-uniform: a different strategy for each k Such an Eve should have only a “negligible” advantage (or, should cause at most a “negligible” difference in the behavior of the environment in the SIM definition) What is negligible?

slide-72
SLIDE 72

Negligibly Small

slide-73
SLIDE 73

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast”

slide-74
SLIDE 74

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k)

slide-75
SLIDE 75

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k) i.e., faster than 1/poly(k) for every polynomial

slide-76
SLIDE 76

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k) i.e., faster than 1/poly(k) for every polynomial e.g.: 2-k, 2-√k, k-(log k).

slide-77
SLIDE 77

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k) i.e., faster than 1/poly(k) for every polynomial e.g.: 2-k, 2-√k, k-(log k). Formally: T negligible if ∀c>0 ∃k0 ∀k>k0 T(k) < 1/kc

slide-78
SLIDE 78

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k) i.e., faster than 1/poly(k) for every polynomial e.g.: 2-k, 2-√k, k-(log k). Formally: T negligible if ∀c>0 ∃k0 ∀k>k0 T(k) < 1/kc So that negl(k) × poly(k) = negl’(k)

slide-79
SLIDE 79

Negligibly Small

A negligible quantity: As we turn the knob the quantity should “decrease extremely fast” Negligible: decreases as 1/superpoly(k) i.e., faster than 1/poly(k) for every polynomial e.g.: 2-k, 2-√k, k-(log k). Formally: T negligible if ∀c>0 ∃k0 ∀k>k0 T(k) < 1/kc So that negl(k) × poly(k) = negl’(k) Needed, because Eve can often increase advantage polynomially by spending that much more time/by seeing that many more messages

slide-80
SLIDE 80

SIM-CPA secure if: ∀ PPT ∃ PPT s.t. ∀ PPT

Key/Enc Key/Dec

Env

Send Recv

Env REAL IDEAL

SIM-CPA Security

REAL ≈ IDEAL

Symmetric-Key Encryption

slide-81
SLIDE 81

SIM-CPA secure if: ∀ PPT ∃ PPT s.t. ∀ PPT

Key/Enc Key/Dec

Env

Send Recv

Env REAL IDEAL

SIM-CPA Security

REAL ≈ IDEAL

Symmetric-Key Encryption

| Pr[REAL=0] - Pr[IDEAL=0] | is negligible

slide-82
SLIDE 82

Constructing SKE schemes

slide-83
SLIDE 83

Constructing SKE schemes

Basic idea: extensible pseudo-random one-time pads (kept compressed in the key)

slide-84
SLIDE 84

Constructing SKE schemes

Basic idea: extensible pseudo-random one-time pads (kept compressed in the key) (Will also need a mechanism to ensure that the same piece of the one-time pad is not used more than once)

slide-85
SLIDE 85

Constructing SKE schemes

Basic idea: extensible pseudo-random one-time pads (kept compressed in the key) (Will also need a mechanism to ensure that the same piece of the one-time pad is not used more than once) Approach used in practice today: complex functions which are conjectured to have the requisite pseudo-randomness properties (stream-ciphers, block-ciphers)

slide-86
SLIDE 86

Constructing SKE schemes

Basic idea: extensible pseudo-random one-time pads (kept compressed in the key) (Will also need a mechanism to ensure that the same piece of the one-time pad is not used more than once) Approach used in practice today: complex functions which are conjectured to have the requisite pseudo-randomness properties (stream-ciphers, block-ciphers) Theoretical Constructions: Security relies on certain computational hardness assumptions related to simple functions

slide-87
SLIDE 87

Constructing SKE schemes

Basic idea: extensible pseudo-random one-time pads (kept compressed in the key) (Will also need a mechanism to ensure that the same piece of the one-time pad is not used more than once) Approach used in practice today: complex functions which are conjectured to have the requisite pseudo-randomness properties (stream-ciphers, block-ciphers) Theoretical Constructions: Security relies on certain computational hardness assumptions related to simple functions Coming up: One-Way Functions, Hardcore predicates, PRG, ...

slide-88
SLIDE 88

Pseudorandomness Generator (PRG)

slide-89
SLIDE 89

Expand a short random seed to a “random-looking” string

Pseudorandomness Generator (PRG)

slide-90
SLIDE 90

Expand a short random seed to a “random-looking” string So that we can build “stream ciphers” (to encrypt a stream

  • f data, using just one short shared key)

Pseudorandomness Generator (PRG)

slide-91
SLIDE 91

Expand a short random seed to a “random-looking” string So that we can build “stream ciphers” (to encrypt a stream

  • f data, using just one short shared key)

PRG with fixed stretch: Gk: {0,1}k → {0,1}n(k), n(k) > k

Pseudorandomness Generator (PRG)

slide-92
SLIDE 92

Expand a short random seed to a “random-looking” string So that we can build “stream ciphers” (to encrypt a stream

  • f data, using just one short shared key)

PRG with fixed stretch: Gk: {0,1}k → {0,1}n(k), n(k) > k Random-looking:

Pseudorandomness Generator (PRG)

slide-93
SLIDE 93

Expand a short random seed to a “random-looking” string So that we can build “stream ciphers” (to encrypt a stream

  • f data, using just one short shared key)

PRG with fixed stretch: Gk: {0,1}k → {0,1}n(k), n(k) > k Random-looking: Next-Bit Unpredictability: PPT adversary can’ t predict ith bit

  • f a sample from its first (i-1) bits (for every i ∈ {0,1,...,n-1})

Pseudorandomness Generator (PRG)

slide-94
SLIDE 94

Expand a short random seed to a “random-looking” string So that we can build “stream ciphers” (to encrypt a stream

  • f data, using just one short shared key)

PRG with fixed stretch: Gk: {0,1}k → {0,1}n(k), n(k) > k Random-looking: Next-Bit Unpredictability: PPT adversary can’ t predict ith bit

  • f a sample from its first (i-1) bits (for every i ∈ {0,1,...,n-1})

A “more correct” definition:

Pseudorandomness Generator (PRG)

slide-95
SLIDE 95

Expand a short random seed to a “random-looking” string So that we can build “stream ciphers” (to encrypt a stream

  • f data, using just one short shared key)

PRG with fixed stretch: Gk: {0,1}k → {0,1}n(k), n(k) > k Random-looking: Next-Bit Unpredictability: PPT adversary can’ t predict ith bit

  • f a sample from its first (i-1) bits (for every i ∈ {0,1,...,n-1})

A “more correct” definition: PPT adversary can’ t distinguish between a sample from {Gk(x)}x←{0,1}k and one from {0,1}n(k)

Pseudorandomness Generator (PRG)

slide-96
SLIDE 96

Expand a short random seed to a “random-looking” string So that we can build “stream ciphers” (to encrypt a stream

  • f data, using just one short shared key)

PRG with fixed stretch: Gk: {0,1}k → {0,1}n(k), n(k) > k Random-looking: Next-Bit Unpredictability: PPT adversary can’ t predict ith bit

  • f a sample from its first (i-1) bits (for every i ∈ {0,1,...,n-1})

A “more correct” definition: PPT adversary can’ t distinguish between a sample from {Gk(x)}x←{0,1}k and one from {0,1}n(k)

Pseudorandomness Generator (PRG)

| Pry←PRG[A(y)=0] - Pry←rand[A(y)=0] | is negligible for all PPT A

slide-97
SLIDE 97

Expand a short random seed to a “random-looking” string So that we can build “stream ciphers” (to encrypt a stream

  • f data, using just one short shared key)

PRG with fixed stretch: Gk: {0,1}k → {0,1}n(k), n(k) > k Random-looking: Next-Bit Unpredictability: PPT adversary can’ t predict ith bit

  • f a sample from its first (i-1) bits (for every i ∈ {0,1,...,n-1})

A “more correct” definition: PPT adversary can’ t distinguish between a sample from {Gk(x)}x←{0,1}k and one from {0,1}n(k) Turns out they are equivalent!

Pseudorandomness Generator (PRG)

| Pry←PRG[A(y)=0] - Pry←rand[A(y)=0] | is negligible for all PPT A

slide-98
SLIDE 98

One-Way Function, Hardcore Predicate

slide-99
SLIDE 99

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if

slide-100
SLIDE 100

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if f is polynomial time computable

slide-101
SLIDE 101

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if f is polynomial time computable For all (non-uniform) PPT adversary, probability

  • f success in the “OWF experiment” is negligible
slide-102
SLIDE 102

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if f is polynomial time computable For all (non-uniform) PPT adversary, probability

  • f success in the “OWF experiment” is negligible

x←{0,1}k f(x)

slide-103
SLIDE 103

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if f is polynomial time computable For all (non-uniform) PPT adversary, probability

  • f success in the “OWF experiment” is negligible

x←{0,1}k f(x’)=f(x)? f(x) x’ Yes/No

slide-104
SLIDE 104

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if f is polynomial time computable For all (non-uniform) PPT adversary, probability

  • f success in the “OWF experiment” is negligible

But x may not be completely hidden by f(x)

x←{0,1}k f(x’)=f(x)? f(x) x’ Yes/No

slide-105
SLIDE 105

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if f is polynomial time computable For all (non-uniform) PPT adversary, probability

  • f success in the “OWF experiment” is negligible

But x may not be completely hidden by f(x) B is a hardcore predicate of a OWF f if

x←{0,1}k f(x’)=f(x)? f(x) x’ Yes/No

slide-106
SLIDE 106

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if f is polynomial time computable For all (non-uniform) PPT adversary, probability

  • f success in the “OWF experiment” is negligible

But x may not be completely hidden by f(x) B is a hardcore predicate of a OWF f if B is polynomial time computable

x←{0,1}k f(x’)=f(x)? f(x) x’ Yes/No

slide-107
SLIDE 107

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if f is polynomial time computable For all (non-uniform) PPT adversary, probability

  • f success in the “OWF experiment” is negligible

But x may not be completely hidden by f(x) B is a hardcore predicate of a OWF f if B is polynomial time computable For all (non-uniform) PPT adversary, advantage in the Hardcore-predicate experiment is negligible

x←{0,1}k f(x’)=f(x)? f(x) x’ Yes/No

slide-108
SLIDE 108

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if f is polynomial time computable For all (non-uniform) PPT adversary, probability

  • f success in the “OWF experiment” is negligible

But x may not be completely hidden by f(x) B is a hardcore predicate of a OWF f if B is polynomial time computable For all (non-uniform) PPT adversary, advantage in the Hardcore-predicate experiment is negligible

x←{0,1}k f(x’)=f(x)? f(x) x’ Yes/No x←{0,1}k f(x)

slide-109
SLIDE 109

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if f is polynomial time computable For all (non-uniform) PPT adversary, probability

  • f success in the “OWF experiment” is negligible

But x may not be completely hidden by f(x) B is a hardcore predicate of a OWF f if B is polynomial time computable For all (non-uniform) PPT adversary, advantage in the Hardcore-predicate experiment is negligible

x←{0,1}k f(x’)=f(x)? f(x) x’ Yes/No x←{0,1}k b’ = B(x)? f(x) b’ Yes/No

slide-110
SLIDE 110

One-Way Function, Hardcore Predicate

fk: {0,1}k → {0,1}n(k) is a one-way function (OWF) if f is polynomial time computable For all (non-uniform) PPT adversary, probability

  • f success in the “OWF experiment” is negligible

But x may not be completely hidden by f(x) B is a hardcore predicate of a OWF f if B is polynomial time computable For all (non-uniform) PPT adversary, advantage in the Hardcore-predicate experiment is negligible B(x) remains “completely” hidden, given f(x)

x←{0,1}k f(x’)=f(x)? f(x) x’ Yes/No x←{0,1}k b’ = B(x)? f(x) b’ Yes/No

slide-111
SLIDE 111

Next

slide-112
SLIDE 112

Next

Candidate OWFs

slide-113
SLIDE 113

Next

Candidate OWFs Using OWF/Hardcore-predicates to build PRG and (CPA-secure) SKE