�ݺ�ߣ

So far…
• Heuristic constructions; build, break, repeat,
…
– This isn’t very satisfying
• Can we prove that some encryption scheme
is secure?
• First need to define what we mean by
“secure” in the first place…

Modern cryptography
• Historically, cryptography was an art
– Heuristic design and analysis
• Starting in the early ‘80s,
cryptography began to develop into
more of a science
• Based on three principles that
underpin most real-world
cryptography today

Core principles of modern
crypto
• Formal definitions
– Precise, mathematical model and definition
of what security means
• Assumptions
– Clearly stated and unambiguous
• Proofs of security
– Move away from design-break-patch cycle

Importance of definitions
• Definitions are essential for the
design, analysis, and sound usage of
crypto

Importance of definitions --
design
• Developing a precise definition forces
the designer to think about what
they really want
– What is essential and (sometimes more
important) what is not
• Often reveals subtleties of the problem

design
If you don’t understand what you want
to achieve, how can you possibly know
when (or if) you have achieved it?

Importance of definitions -- analysis
• Definitions enable meaningful
analysis, evaluation, and comparison
of schemes
– Does a scheme satisfy the definition?
– What definition does it satisfy?
• Note: there may be multiple meaningful
definitions!
• One scheme may be less efficient than
another, yet satisfy a stronger security
definition

usage
• Definitions allow others to
understand the security guarantees
provided by a scheme
• Enables schemes to be used as
components of a larger system
(modularity)
• Enables one scheme to be
substituted for another if they satisfy
the same definition

Assumptions
• With few exceptions, cryptography
currently requires computational
assumptions
– At least until we prove P 
NP (and even
that would not be enough)
• Principle: any such assumptions must
be made explicit

Importance of clear
assumptions
• Allow researchers to (attempt to) validate
assumptions by studying them
• Allow meaningful comparison between
schemes based on different assumptions
– Useful to understand minimal assumptions
needed
• Practical implications if assumptions are
wrong
• Enable proofs of security

Proofs of security
• Provide a rigorous proof that a
construction satisfies a given definition
under certain specified assumptions
– Provides an iron-clad guarantee (relative
to your definition and assumptions!)
• Proofs are crucial in cryptography,
where there is a malicious attacker
trying to “break” the scheme

Limitations?
• Cryptography still remains partly an art as well
• Proofs given an iron-clad guarantee of security
– …relative to the definition and assumptions!
• Provably secure schemes can be broken!
– If the definition does not correspond to the real-world
threat model
• I.e., if attacker can go “outside the assumed security model”
• This happens a lot in practice
– If the assumption is invalid
– If the implementation is flawed
• This happens a lot in practice

Nevertheless…
• This does not detract from the
importance of having formal
definitions in place and giving proofs
of security

Crypto definitions
(generally)
• Security guarantee/goal
– What we want to achieve (or what we
want to prevent the attacker from
achieving)
• Threat model
– What (real-world) capabilities the
attacker is assumed to have

Recall
• A private-key encryption scheme is defined
by a message space M and algorithms
(Gen, Enc, Dec):
– Gen (key-generation algorithm): generates k
– Enc (encryption algorithm): takes key k and
message
m  M as input; outputs ciphertext c
c  Enck(m)
– Dec (decryption algorithm): takes key k and
ciphertext c as input; outputs m.
m := Deck(c)

Private-key encryption
k k
c
key
m
c  Enck(m)
message/plaintext
encryption
ciphertext
m := Deck(c)
decryption
key

Threat models for
encryption
• Ciphertext-only attack
– One ciphertext or many?
• Known-plaintext attack
• Chosen-plaintext attack
• Chosen-ciphertext attack

Goal of secure encryption?
• How would you define what it means
for encryption scheme (Gen, Enc,
Dec) over message space M to be
secure?
– Against a (single) ciphertext-only attack

Secure encryption?
• “Impossible for the attacker to learn
the key”
– The key is a means to an end, not the end
itself
– Necessary (to some extent) but not
sufficient
– Easy to design an encryption scheme that
hides the key completely, but is insecure
– Can design schemes where most of the
key is leaked, but the scheme is still secure

Secure encryption?
the plaintext from the ciphertext”
– What if the attacker learns 90% of the
plaintext?

Secure encryption?
any character of the plaintext from
the ciphertext”
– What if the attacker is able to learn
(other)
partial information about the plaintext?
• E.g., salary is greater than $75K
– What if the attacker guesses a character
correctly, or happens to know it?

The right definition
• “Regardless of any prior information
the attacker has about the plaintext,
the ciphertext should leak no
additional information about the
plaintext”
– How to formalize?

Probability review
• Random variable: variable that takes on
(discrete) values with certain probabilities
• Probability distribution for a random
variable gives the probabilities with which
the variable takes on each possible value
– Each probability must be between 0 and 1
– The probabilities must sum to 1

Probability review
• Event: a particular occurrence in some experiment
– E.g., the event that random variable X takes value x
– Pr[E]: probability of event E
• Conditional probability: probability that one event
occurs, given that some other event occurred
– Pr[A | B] = Pr[A and B]/Pr[B]
• Two random variables X, Y are independent if
for all x, y: Pr[X=x | Y=y] = Pr[X=x]

Probability review
• Law of total probability: say E1, …, En are a
partition of all possibilities. Then for any A:
Pr[A] = i Pr[A and Ei] = i Pr[A | Ei] ·
Pr[Ei]

Notation
• K (key space) – set of all possible
keys
• C (ciphertext space) – set of all
possible ciphertexts

Probability distributions
• Let M be the random variable denoting
the value of the message
– M ranges over M
– Context dependent!
– Reflects the likelihood of different
messages being sent, given the attacker’s
prior knowledge
– E.g.,
Pr[M = “attack today”] = 0.7
Pr[M = “don’t attack”] = 0.3

• Let K be a random variable denoting
the key
– K ranges over K
• Fix some encryption scheme (Gen,
Enc, Dec)
– Gen defines a probability distribution for
K:
Pr[K = k] = Pr[Gen outputs key k]
– Generally the uniform distribution, but

• Assume random variables M and K
are independent
– I.e., parties don’t pick the key based on
the message, or the message based on
the key
• In general, this assumption holds
• If it doesn’t hold, can cause problems

• Fix some encryption scheme (Gen, Enc, Dec),
and some distribution for M
• Consider the following (randomized)
experiment:
1. Generate a key k using Gen
2. Choose a message m, according to the given
distribution
3. Compute c  Enck(m)
• This defines a distribution on the ciphertext!
• Let C be a random variable denoting the value
of the ciphertext in this experiment

Example 1
• Consider the shift cipher
– So for all k  {0, …, 25}, Pr[K = k] = 1/26
• Say Pr[M = ‘a’] = 0.7, Pr[M = ‘z’] = 0.3
• What is Pr[C = ‘b’] ?
– Either M = ‘a’ and K = 1, or M = ‘z’ and K = 2
– Pr[C=‘b’] = Pr[M=‘a’]·Pr[K=1] + Pr[M=‘z’] ·Pr[K=2]
Pr[C=‘b’] = 0.7 · (1/26) + 0.3 · (1/26)
Pr[C=‘b’] = 1/26

Example 2
• Consider the shift cipher, and the
distribution on M given by
Pr[M = ‘one’] = ½, Pr[M = ‘ten’]
= ½
• Pr[C = ‘rqh’] = ?
= Pr[C = ‘rqh’ | M = ‘one’] · Pr[M = ‘one’]
+ Pr[ C = ‘rqh’ | M = ‘ten’] · Pr[M = ‘ten’]
= 1/26 · ½ + 0 · ½ = 1/52

Perfect secrecy (informal)
• “Regardless of any prior information
the attacker has about the plaintext,
the ciphertext should leak no
additional information about the
plaintext”

Perfect secrecy (informal)
• Attacker’s information about the
plaintext = attacker knows the
distribution of M
• Perfect secrecy: observing the
ciphertext should not change the
attacker’s knowledge about the
distribution of M

Perfect secrecy (formal)
• Encryption scheme (Gen, Enc, Dec) with
message space M and ciphertext space C is
perfectly secret if for every distribution over
M, every m  M, and every c  C with
Pr[C=c] > 0, it holds that
Pr[M = m | C = c] = Pr[M = m].
• I.e., the distribution of M does not change,
even conditioned on observing the ciphertext

Example 3
• Consider the shift cipher, and the
distribution Pr[M = ‘one’] = ½, Pr[M
= ‘ten’] = ½
• Take m = ‘ten’ and c = ‘rqh’
• Pr[M = ‘ten’ | C = ‘rqh’] = ?
= 0

Pr[M = ‘ten’]

Bayes’s theorem
• Pr[A | B] = Pr[B | A] · Pr[A]/Pr[B]

Example 4
• Shift cipher;
Pr[M=‘hi’] = 0.3,
Pr[M=‘no’] = 0.2,
Pr[M=‘in’]= 0.5
• Pr[M = ‘hi’ | C = ‘xy’] = ?
= Pr[C = ‘xy’ | M = ‘hi’] · Pr[M = ‘hi’]/Pr[C = ‘xy’]

Example 4, continued
• Pr[C = ‘xy’ | M = ‘hi’] = 1/26
• Pr[C = ‘xy’]
= Pr[C = ‘xy’ | M = ‘hi’] · 0.3 + Pr[C = ‘xy’ | M =
‘no’] · 0.2
+ Pr[C=‘xy’ | M=‘in’] · 0.5
= (1/26) · 0.3 + (1/26) · 0.2 + 0 · 0.5
= 1/52

Example 4, continued
• Pr[M = ‘hi’ | C = ‘xy’] = ?
= Pr[C = ‘xy’ | M = ‘hi’] · Pr[M = ‘hi’]/Pr[C = ‘xy’]
= (1/26) · 0.3/(1/52)
= 0.6

Pr[M = ‘hi’]

Conclusion
• The shift cipher is not perfectly
secret!
– At least not for 2-character messages
• How to construct a perfectly secret
scheme?

One-time pad
• Patented in 1917 by Vernam
– Recent historical research indicates it
was invented (at least) 35 years earlier
• Proven perfectly secret by Shannon
(1949)

One-time pad
• Let M = {0,1}n
• Gen: choose a uniform key k  {0,1}n
• Enck(m) = k  m
• Deck(c) = k  c
• Correctness:
Deck( Enck(m) ) = k  (k  m)
= (k  k)  m = m

One-time pad
key
n bits
messag
e
n bits
cipherte
xt
n bits


Perfect secrecy of one-time
pad
• Note that any observed ciphertext
can correspond to any message
(why?)
– (This is necessary, but not sufficient, for
perfect secrecy)
• So, having observed a ciphertext, the
attacker cannot conclude for certain
which message was sent

pad
• Fix arbitrary distribution over M = {0,1}n
,
and
arbitrary m, c  {0,1}n
• Pr[M = m | C = c] = ?
= Pr[C = c | M = m] · Pr[M = m]/Pr[C = c]
• Pr[C = c]
= m’ Pr[C = c | M = m’] · Pr[M = m’]
= m’ Pr[K = m’  c | M = m’] · Pr[M = m’]
= m’ 2-n
· Pr[M = m’]
= 2-n

pad
• Fix arbitrary distribution over M =
{0,1}n
, and arbitrary m, c  {0,1}n
• Pr[M = m | C = c] = ?
= Pr[C = c | M = m] · Pr[M = m]/Pr[C = c]
= Pr[K = m  c | M = m] · Pr[M = m] / 2-n
= 2-n
· Pr[M = m] / 2-n
= Pr[M = m]

�ݺ�ߣ

lec3.pdf

Recommended

More Related Content

Similar to lec3.pdf (20)

More from ssuser8b461f (8)

Recently uploaded (20)

lec3.pdf