Embed Size (px)
Citation preview
Plan
1. Information-theoretic cryptography
2. Introduction to cryptography based on the computational assumptions
3. Provable security
4. Pseudorandom generators
The scenario from the previous lecture
Eve
Alice Bob
Shannon’s theorem perfect secrecy is possible only if the key is as long as the plaintext
In real-life it is completely impractical
What to do?
Idea: limit the power of the adversary.
How?
Classical (computationally-secure) cryptography: bound his computational power.
Alternative options exists(but are not very practical)
Quantum cryptographyStephen Wiesner (1970s), Charles H. Bennett and Gilles Brassard (1984)
quantum link
Eve
Alice Bob
Quantum indeterminacy: quantum states cannot be measured without disturbing the original state.
Hence Eve cannot read the bits in an unnoticeable way.
Quantum cryptographyAdvantage:
security is based on the laws of quantum physics
Disadvantage:needs a dedicated equipment.
Practicality?
Currently: successful transmissions for distances of length around 150 km.Commercial products are available.
Warning:Quantum cryptography should not be confused with quantum computing.
A satellite scenario
Eve
Alice Bob
000110100111010010011010111001110111111010011101010101010010010100111100001001111111100010101001000101010010001010010100101011010101001010010101
A third party (a satellite) is broadcasting random bits.
Does it help?No...
(Shannon’s theorem of course also holds in this case.)
Ueli Maurer (1993): noisy channel.
1 0 1 0 1 0 0 1 1 0 1 0 0 1 0 1 0 1 0 1 0 0 1 1 0 1 0 0 1 0
1 0 1 0 1 0 0 1 1 0 1 0 0 1 0
1 0 1 0 1 0 0 1 1 0 1 0 0 1 0
0 0 1 0 0 0 0 1 1 0 0 0 0 1 1 1 0 1 1 1 0 0 1 1 0 1 0 0 0 1
1 0 1 1 1 0 0 1 1 0 1 0 0 0 0
Assumption: the data that the adversary receives is noisy.(The data that Alice and Bob receive may be even more noisy.)
some bits get flipped(because of the noise)
Bounded-Storage ModelAnother idea: bound the size of adversary’s memory
000110100111010010011010111001110111111010011101010101010010010100111100001001111111100010101001000101010010001010010100101011010101001010010101
too large to fit in Eve’s memory
Real (computationally-secure) cryptography starts here:
Eve is computationally-bounded
But what does it mean?
Ideas:
1. She has can use at most 1000 Intel Core 2 Extreme X6800 Dual Core Processors
for at most 100 years...
2. She can buy equipment worth 1 million euro and use it for 30 years...
it’s hard to reasonformally about it
A better idea”The adversary has access to a Turing Machine that can make at most
1030 steps.”
More generally, we could have definitions of a type:
“a system X is (t,ε)-secure if every Turing Machine
that operates in time t
can break it with probability at most ε.”
This would be quite precise, but...
We would need to specify exactly what we mean by a “Turing Machine”:
• how many tapes it has?• how does it access these tapes (maybe a “random access memory”
is a more realistic model..)• ...
Moreover, this approach often leads to ugly formulas...
What to do?“(t,ε)-security”
Idea:
• t steps of a Turing Machine = “efficient computation”
• ε – a value “very close to zero”.
How to formalize it?
Use the asymptotics!
Efficiently computable?“polynomial-time computable
on a Turing Machine”“efficiently computable” =
that is: running in timeO(nc) (for some c)
Here we assume that the Turing Machines are the right model for the real-life computation.
Not true if a quantum computer is built...
Very small?
“very small” =
“negligible”=
approaches 0 faster than the inverse of any polynomial
Formally:
Negligible or not?
yes
yes
yes
no
no
yes
Security parameter
The terms “negligible” and “polynomial” make sense only if X (and the adversary) take an additional input n called
a security parameter.
In other words: we consider an infinite sequence X(1),X(2),...
of schemes.
Typically, we will say that a scheme X is secure ifApolynomial-time
Turing Machine M
P (M breaks the scheme X) is negligible
ExampleConsider the authentication scheme from the last week:
Nice properties of these notions• A sum of two polynomials is a polynomial:
poly + poly = poly
• A product of two polynomials is a polynomial:poly * poly = poly
• A sum of two negligible functions is a negligible function:negl + negl = negl
Moreover:
• A negligible function multiplied by a polynomial is negligiblenegl * poly = negl
A new definition of an encryption scheme
Is this the right approach?
Advantages
1. All types of Turing Machines are “equivalent” up to a “polynomial reduction”.
Therefore we do need to specify the details of the model.
2. The formulas get much simpler.
Disadvantage
Asymptotic results don’t tell us anything about security of the concrete systems.
However
Usually one can prove formally an asymptotic result and then argue informally that “the constants are reasonable”
(and can be calculated if one really wants).
Provable security
We want to construct schemes that are provably secure.
But...
• why do we want to do it?• how to define it?• and is it possible to achieve it?
Provable security – the motivation
In many areas of computer science formal proofs are not essential.
For example, instead of proving that an algorithm is efficient, we can just simulate it on a
“typical input”.
In cryptography it’s not true, because
there cannot exist an experimental proof that a scheme is secure.
Why?
Because a notion of a“typical adversary”
does not make sense.
How did we define the perfect secrecy?
Experiment (m – a message)1. the key k is chosen randomly2. message m is encrypted using k:
c := Enck(m)3. c is given to the adversary
Idea 1The adversary should not be able to compute k.
Idea 2The adversary should not be able to compute m.
Idea 3The adversary should not be able to compute any information about m.
Idea 4The adversary should not be able to compute any additional information about m.
makes more sense
IdeaThe adversary should not be able to compute any additional information about m.
A
m0,m1
P(C = c | M = m0) = P(C = c | M = m1)
A
c
P(Enc(K,M) = c | M = m0) = P(Enc(K,M) = c | M = m1)
Towards the definition of computational secrecy...
P(Enc(K,m0) = c | M = m0) = P(Enc(K,m1) = c | M = m1)
P(C = c) = P(C = c | M=m)
P(Enc(K,m0) = c) = P(Enc(K,m1) = c)A
m c
A
A
m0,m1
A
c
A
m0,m1
A
c
A
m0,m1
A
c
Indistinguishability
P(Enc(K,m0) = c) = P(Enc(K,m1) = c)
A
m0,m1
A
c
In other words: the distributions of Enc(K,m0) = Enc(K,m1) are identical
IDEAchange it to:
are indistinguishable by a polynomial time adversary
A game
adversary(polynomial-time Turing machine) oracle
chooses m0,m1 such that|m0|=|m1|
m0,m1 1. selects k := G(1n)2. chooses a random b = 0,13. calculates
c := Enc(k,mb)
(Gen,Enc,Dec) – an encryption scheme
chas to guess b
Security definition:We say that (Gen,Enc,Dec) has indistinguishable encryptions if any polynomial time adversary guesses b correctly with probability at most 0.5 + ε(n), where ε is negligible.
security parameter1n
Alternative name: semantially-secure (sometimes we will say: “is computationally-secure”, if the context is clear)
Testing the definition
1. Suppose the adversary can compute k from some Enc(k,m). Can he win the game?
2. Suppose the adversary can compute some bit of m from Enc(k,m). Can he win the game?
YES!
YES!
Is it possible to prove security?(Gen,Enc,Dec) -- an encryption scheme.For simplicity suppose that:
1. for a security parameter n the key is of length n.2. Enc is deterministic
Consider the following language:
Q: What if L is polynomial-time decidable?
A: Then the scheme is broken (exercise)
On the other hand: L is in NP. (k is the NP-witness)
So, if P = NP, then any semantically-secure encryption is broken.
Is it really true?
“If P=NP, then the semantically-secure encryption is broken”
Is it 100% true?
Not really...
This is because even if P=NP we do not know what are the constants.
Maybe P=NP in a very “inefficient way”...
In any case, to prove security of a cryptographic scheme we would need to show
a lower bound on the computational complexity of some problem.
In the “asymptotic setting” that would mean that at least
we show that P ≠ NP.
Does the implication in the other direction hold?(that is: does P ≠ NP imply anything for cryptography?)
No! (at least as far as we know)
Intuitively: because NP is a notion from the “worst case complexity”, and cryptography concerns the “average case complexity”.
Therefore
proving that an encryption scheme is secure is probably much harder than proving that P ≠ NP.
What can we prove?
We can prove conditional results.
That is, we can show theorems of a type:
Suppose that some scheme Y is secure
then scheme X is secure.
Suppose that some “computationalassumption A”
holds
then scheme X is secure.
Research program in cryptographyBase the security of cryptographic schemes on a small
number of well-specified “computational assumptions”.
then scheme X is secure.
Some “computationalassumption A”
holds
in this we
have to
“believe”
the rest is
provable
Examples of A:
“decisional Diffie-Hellman assumption”
“strong RSA assumption”
Example
We are now going to show an example of such reasoning:
then scheme X is secure.
Suppose that some “computationalassumption A”
holds
we G can construct a secure encryption
scheme
Suppose that G is a “cryptographic pseudorandom
generator”
Pseudorandom generators
s G(s)
If we use a “normal PRG” – this idea doesn’t work (exercise).
It works only with the cryptographic PRGs.
“Looks random”
What does it mean?
Non-cryptographic applications:
should pass some statistical tests.
Cryptography:
should pass all polynomial-time tests.
Cryptographic PRG
a polynomial-timedistinguisher D
a random string R
G(S) (where S random)
or
Should not be able to distinguish...
outputs:
0 if he thinks it’s R
1 if he thinks it’s G(S)
Constructions
There exists constructions of cryptographic pseudorandom-generators, that are conjectured to be secure.
Some of them are extremely efficient, and widely used in practice.
They are called the “stream ciphers” (we will discuss them later).
TheoremIf G is a cryptographic PRG then the encryption
scheme constructed before is semantically-secure (i.e. it has indistinguishable encryptions).
cryptographic
PRGs
computationally-secure
encryption
Proof (sketch)
Suppose that it is not secure.
Therefore there exists an adversary that wins the “guessing game” with probability 0.5 + δ(n), where δ(n) is not negligible.
X
chooses m0,m1 m0,m1 1. b = 0,1 random 2. c := x xor mb
chas to guess b
simulates
If the adversary guessed b correctly then output 1: “x is pseudorandom”.
Otherwise output 0: “x is random”.
x is a random string R x = G(S)
the adversary guesses b correctly with probability 0.5
the adversary guesses b correctly with probability 0.5 + δ(n)
prob. 0.5 prob. 0.5prob.
0.5 + δ(n)prob.
0.5 - δ(n)
1 0 1 0outputs:
QED
Moral
To construct secure encryption it suffices to construct a secure PRG.
cryptographic
PRGs
semantically-secure
encryption
Outlook
Cryptography
• one time pad,• quantum cryptography,• “the satellite scenario”
often called:• “information-theoretic”,• “unconditional”
“computationally-secure”
based on 2 assumptions:
1. some problems are computationally difficult
2. our understanding of what “computational difficulty” means is correct.
