COS433/Math 473: Cryptography. Mark Zhandry Princeton University Spring 2017

Transcription

1 COS433/Math 473: Cryptography Mar Zhandry Princeton University Spring 2017

2 Announcements Homewor 3 due tomorrow Homewor 4 up Tae- home midterm tentative dates: Posted 3pm am Monday 3/13 Due 1pm Wednesday 3/15

3 Last Time CPA Security Pseudorandom unctions

4 Pseudorandom unctions unctions that loo lie random functions Syntax: Key space {0,1} λ Domain X (usually {0,1} m, m may depend on λ) Co- domain/range Y (usually {0,1} n, may depend on λ) unction :{0,1} λ Xà Y

5 Pseudorandom unctions Security: λ b x X y Challenger b

6 Pseudorandom unctions Security: λ b=0 x X y Challenger ß K λ y ß (,x) b PR-Exp 0 (, λ)

7 Pseudorandom unctions Security: λ b=1 x X y Challenger Hß uncs(x,y) y = H(x) b PR-Exp 1 (, λ)

8 PR Security Definition Definition: is a secure PR if, for all probabilistic polynomial time (PPT), there exists a negligible function ε such that Pr[1ß PR-Exp 0 (, λ) ] Pr[1ß PR-Exp 1 (, λ) ] ε(λ)

9 Using PRs to Build Encryption Enc(, m): Choose random rß X Compute yß (,r) Compute cß y m Output (r,c) Dec(, (r,c) ): Compute y ß (,r) Compute and output m ß c y Correctness: y =y since is deterministic m = c y = y m y = m

10 Counter Mode Enc(, m): Choose random rß {0,1} λ/2 Write i as λ/2- bit string or i=1,, m, Compute y i ß (,r i) Compute c i ß y i m i Output (r,c) where c=(c 1,,c m ) Dec(, (r,c) ): or i=1,,l, Compute y i ß (,r i) Compute m i ß y i c i Output m=m 1,,m l Handles any message of length at most 2 λ/2 Includes all polynomial- length messages

11 Counter Mode IV ( IV, )

12 Counter Mode Decryption (, )

13 This Time Pseudorandom Permutations/Bloc Ciphers Modes of Operation

14 Pseudorandom Permutations (also nown as bloc ciphers) unctions that loo lie random permutations Syntax: Key space {0,1} λ Domain X (usually {0,1} n, n usually depends on λ) Range X unction :{0,1} λ Xà X unction -1 :{0,1} λ Xà X Correctness:,x, -1 (, (, x) ) = x

15 Pseudorandom Permutations b λ Security: Challenger x X y b

16 Pseudorandom Permutations b=0 λ Security: Challenger x X y y ß (,x) b PR-Exp0( ß Kλ, λ)

17 Pseudorandom Permutations b=1 λ Security: Challenger Hß Perms(X,X) x X y = H(x) y b PR-Exp1(, λ)

18 Theorem: A PRP (, -1 ) is secure iff is a secure as a PR

19 Proof Secure as PRP Secure as PR Assume, hybrids Hybrid 0: x X Challenger ß K λ y y ß (,x) b

20 Proof Secure as PRP Secure as PR Assume, hybrids Hybrid 1: x X Challenger Hß Perms(X,X) y y ß (,x) b

21 Proof Secure as PRP Secure as PR Assume, hybrids Hybrid 2: x X Challenger Hß uncs(x,x) y y ß (,x) b

22 Proof Secure as PRP Secure as PR Assume, hybrids Hybrids 0 and 1 are indistinguishable by PRP security Hybrids 1 and 2? In Hybrid 1, sees random distinct answers In Hybrid 2, sees random answers Except with probability q 2 /2 n+1, random answers will be distinct anyway

23 Proof Secure as PR Secure as PRP Assume, hybrids Proof essentially identical to other direction

24 Suppose (, -1 ) is a secure PRP Is ( -1,) also a secure PRP?

25 How to use bloc ciphers for encryption

26 Counter Mode (CTR) IV ( IV, )

27 Electronic Code Boo (ECB) Enc(, m): Brea m into t blocs m i of n bits or each bloc m i, let c i = (, m i ) Output c = (c 1,, c t ) Dec(, c): Brea c into t blocs c i of n bits or each bloc c i, let m i = -1 (, c i ) Output m = (m 1,, m t ) substitution cipher for n- bit alphabet

28 Electronic Code Boo (ECB)

29 ECB Decryption

30 Security of ECB? Is ECB mode CPA secure? Is ECB mode one- time secure?

31 Security of ECB Plaintex Ciphertext Ideal

32 Cipher Bloc Chaining (CBC) Mode IV ( ) (, ) IV (or now, assume all messages are multiples of the bloc length)

33 CBC Mode Decryption (, ) IV ( )

34 Theorem: If (, -1 ) is a secure pseudorandom permutation, then CBC mode encryption is CPA secure

35 Proof Setch Assume toward contradiction an adversary CBC mode for Hybrids

36 Proof Setch Hybrid 0 m 0 IV ( ) (, ) IV

37 Proof Setch Hybrid 1 m 0 IV ( ) H H H H H (, ) IV

38 Proof Setch Hybrid 2 m 1 IV ( ) H H H H H (, ) IV

39 Proof Setch Hybrid 3 m 1 IV ( ) (, ) IV

40 Proof Setch Hybrid 0,1 differ by replacing calls to with calls to random permutation H Indistinguishable by PRP security Same for Hybrids 2,3 All that is left is to show indistinguishability of 1,2

41 Proof Setch Hybrid 1 m 0 IV ( ) H H H H H (, ) IV

42 Proof Setch Hybrid 2 m 1 IV ( ) H H H H H (, ) IV

43 Proof Setch Idea: As long as, say, the sequence of left messages queried by does not result in two calls to on the same input, all outputs will be random (distinct) outputs or each message, first query to will be uniformly random Second query gets XORed with output of first query to uniformly random

44 Proof Setch Idea: Since queries to are (essentially) uniformly random, probability of querying same input twice is exponentially small Ciphertexts will be essentially random True regardless of encrypting m 0 or m 1

45 Stateful Variants of CBC Chained CBC IV is set to last bloc of previous ciphertext Deterministic IV Sender eeps a counter To encrypt, IV is set to counter, and counter is incremented Both variants mean no need to send IV

46 Chained CBC IV ( ) (, ) ( ) ( )

47 Is Chained CBC Secure?

48 Deterministic IV ctr ( ) ctr ++ ( )

49 Is Deterministic IV Secure?

50 Output eedbac Mode (OB) IV (, ) IV Turn bloc cipher into self stream cipher

51 OB Decryption IV

52 What happens if a bloc is lost in transmission?

53 Cipher eedbac (CB) IV (, ) IV Turn bloc cipher into self- synchronizing stream cipher

54 CB Decryption IV

55 What happens if a bloc is lost in transmission?

56 Security of OB, CB modes Security very similar to CBC Define 4 hybrids 0: encrypt left messages 1: replace PRP with random permutation 2: encrypt right messages 3: replace random permutation with PRP 0,1 and 2,3 are indistinguishable by PRP security 1,2 are indistinguishable since ciphertexts are essentially random

57 Summary PRPs/Bloc Ciphers Modes of operations: ECB, Counter, CBC, OB, CB

58 Next Time Constructing PRPs/bloc ciphers