Tools for Symmetric Key Provable Security Mridul Nandi Indian - PowerPoint PPT Presentation

Probability in Cryptography Two Tools: H-Coefficient and χ 2 Some Constructions and Applications Tools for Symmetric Key Provable Security Mridul Nandi Indian Statistical Institute, Kolkata ASK Workshop, Changsha 10 Dec. 2017 1 / 72

Probability in Cryptography Two Tools: H-Coefficient and χ 2 Some Constructions and Applications Outline of the talk 1 Probability in Cryptography Well Known Distribution in Cryptography Some Metrics on Probability Distributions Two Tools: H-Coefficient and χ 2 2 H-Coefficient Technique Mirror theory χ 2 Method 3 Some Constructions and Applications Encrypted Davies-Meyer (EDM) Construction Truncation Construction Sum of Permutations Construction 2 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Outline of the talk 1 Probability in Cryptography Well Known Distribution in Cryptography Some Metrics on Probability Distributions 2 Two Tools: H-Coefficient and χ 2 H-Coefficient Technique Mirror theory χ 2 Method 3 Some Constructions and Applications Encrypted Davies-Meyer (EDM) Construction Truncation Construction Sum of Permutations Construction 3 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Outline of the talk 1 Probability in Cryptography Well Known Distribution in Cryptography Some Metrics on Probability Distributions Two Tools: H-Coefficient and χ 2 2 H-Coefficient Technique Mirror theory χ 2 Method 3 Some Constructions and Applications Encrypted Davies-Meyer (EDM) Construction Truncation Construction Sum of Permutations Construction 4 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Notations for Probability 1 X ← Ω: X is a random variable with sample space Ω. 2 Pr X denotes the probability function of X . 3 For an event E ⊆ Ω we denote the probability of the event E realized by X as Pr X ( E ) or Pr( X ∈ E ) 4 Pr X ( E | F ) is the conditional probability defined only when Pr X ( F ) is positive and it is defined as Pr X ( E ∩ F ) / Pr X ( F ) . 5 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Notations for Probability 1 x t := ( x 1 , . . . , x t ) for any positive t . X t := ( X 1 , . . . , X t ) ← Ω = Ω 1 × · · · × Ω t is also called joint random variable. 2 We denote Pr( X i = x i | X i − 1 = x i − 1 ) as Pr X ( x i | x i − 1 ). 3 Let X ← Ω, f : Ω → R then � Ex ( f ( X )) = f ( x ) Pr X ( x ) . x ∈ Ω 4 If X is a real valued random variable Var ( X ) = E (( X − Ex ( X )) 2 ) . 6 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Notations for Probability 1 x t := ( x 1 , . . . , x t ) for any positive t . X t := ( X 1 , . . . , X t ) ← Ω = Ω 1 × · · · × Ω t is also called joint random variable. 2 We denote Pr( X i = x i | X i − 1 = x i − 1 ) as Pr X ( x i | x i − 1 ). 3 Let X ← Ω, f : Ω → R then � Ex ( f ( X )) = f ( x ) Pr X ( x ) . x ∈ Ω 4 If X is a real valued random variable Var ( X ) = E (( X − Ex ( X )) 2 ) . 7 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications With and Without Replacement Sample 1 Examples . In statistics with replacement (WR) and without replacement sample (WOR) sampling are very popular. 2 U := ( U 1 , . . . , U t ) ← wr S says that U ← $ S t . So we specify Pr U completely as Pr U ( x t ) = |S| − t . 3 WOR sample V := ( V 1 , . . . , V t ) ← wor S is specified through conditional probability as Pr V ( x i | x i − 1 ) = 1 |S|− i +1 , for all distinct x 1 , . . . , x i ∈ S . 8 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications With and Without Replacement Sample 1 Examples . In statistics with replacement (WR) and without replacement sample (WOR) sampling are very popular. 2 U := ( U 1 , . . . , U t ) ← wr S says that U ← $ S t . So we specify Pr U completely as Pr U ( x t ) = |S| − t . 3 WOR sample V := ( V 1 , . . . , V t ) ← wor S is specified through conditional probability as Pr V ( x i | x i − 1 ) = 1 |S|− i +1 , for all distinct x 1 , . . . , x i ∈ S . 9 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Why do we study WR and WOR in Cryptography? 1 Let f ← $ Func ( D, R ) (random function). Then, for any distinct x 1 , . . . , x q ∈ D , ( f ( x 1 ) , . . . , f ( x q )) ← wr R. 2 If π ← $ Perm ( R ) (random permutation - we use it for block cipher or permutation in the ideal model) then ( π ( x 1 ) , . . . , π ( x q )) ← wor R. 3 The both results are true even if x i ’s are some functions of y i − 1 where y j = f ( x j ) (or y j = π ( x j )). This happens for adaptive adversary interacting with f or π . 10 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Why do we study WR and WOR in Cryptography? 1 Let f ← $ Func ( D, R ) (random function). Then, for any distinct x 1 , . . . , x q ∈ D , ( f ( x 1 ) , . . . , f ( x q )) ← wr R. 2 If π ← $ Perm ( R ) (random permutation - we use it for block cipher or permutation in the ideal model) then ( π ( x 1 ) , . . . , π ( x q )) ← wor R. 3 The both results are true even if x i ’s are some functions of y i − 1 where y j = f ( x j ) (or y j = π ( x j )). This happens for adaptive adversary interacting with f or π . 11 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Why do we study WR and WOR in Cryptography? 1 Let f ← $ Func ( D, R ) (random function). Then, for any distinct x 1 , . . . , x q ∈ D , ( f ( x 1 ) , . . . , f ( x q )) ← wr R. 2 If π ← $ Perm ( R ) (random permutation - we use it for block cipher or permutation in the ideal model) then ( π ( x 1 ) , . . . , π ( x q )) ← wor R. 3 The both results are true even if x i ’s are some functions of y i − 1 where y j = f ( x j ) (or y j = π ( x j )). This happens for adaptive adversary interacting with f or π . 12 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Why do we study WR and WOR in Cryptography? 1 In cryptography blockcipher modeled to be pseudorandom permutation. 2 This means (using hybrid argument) that we can replace random permutation instead of a blockcipher. 3 Consider the XOR construction: E K ( x � 0) ⊕ E K ( x � 1). 4 If we replace blockcipher by random permutation, te output distribution of the XOR construction is same as X t where X 1 = V 1 ⊕ V 2 , . . . , X t = V 2 t − 1 ⊕ V 2 t and ( V 1 , . . . , V t ) ← wor { 0 , 1 } n . 13 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Why do we study WR and WOR in Cryptography? 1 In cryptography blockcipher modeled to be pseudorandom permutation. 2 This means (using hybrid argument) that we can replace random permutation instead of a blockcipher. 3 Consider the XOR construction: E K ( x � 0) ⊕ E K ( x � 1). 4 If we replace blockcipher by random permutation, te output distribution of the XOR construction is same as X t where X 1 = V 1 ⊕ V 2 , . . . , X t = V 2 t − 1 ⊕ V 2 t and ( V 1 , . . . , V t ) ← wor { 0 , 1 } n . 14 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Outline of the talk 1 Probability in Cryptography Well Known Distribution in Cryptography Some Metrics on Probability Distributions Two Tools: H-Coefficient and χ 2 2 H-Coefficient Technique Mirror theory χ 2 Method 3 Some Constructions and Applications Encrypted Davies-Meyer (EDM) Construction Truncation Construction Sum of Permutations Construction 15 / 72

Probability in Cryptography Well Known Distribution in Cryptography Two Tools: H-Coefficient and χ 2 Some Metrics on Probability Distributions Some Constructions and Applications Total variation Definition Total variation (or statistical distance) is a metric on the set of probability functions over Ω. � P 0 − P 1 � = 1 � | P 0 ( x ) − P 1 ( x ) | . 2 x ∈ Ω 16 / 72