Asymmetric Cryptography part 1 & 2 Haya Shulman Many thanks to Amir Herzberg who donated some of the slides from

Talk Outline Heuristic vs Provable Security Approaches Kerkhoff Principle Public-key Encryption Scheme Definition Security Definition  Adversarial Power and the Break  Symmetric&Asymmetric Security Specifications (CPA, CCA, CCA2) Information Theoretically Secure Public Key Encryption Scheme? Deterministic Public Key Schemes? Hybrid encryption

Heuristic vs Provable Security Approaches The heuristic approach Build-break-fix paradigm Failed cryptanalysis The provable security  Reductions to hardness assumptions  Reduction is a basic cryptographic technique The information theoretic security

Kerckhoff’s Principle: Known Design Security through obscurity is a common approach in the industry  Attacks (e.g. cryptanalysis) of unknown design can be much harder But using public (non-secret) designs…  Published designs are often stronger  No need to replace the system once the design is exposed  No need to worry that design was exposed  Establish standards for multiple applications: Efficiency of production and of test attacks / cryptanalysis Kerckhoff’s Known Design Principle [1883]: adversary knows the design – everything except the secret keys

Talk Outline 好晚 Heuristic vs Provable Security Approaches Kerkhoff Principle Public-key Encryption Scheme Definition Security Definition  Adversarial Power and the Break  Symmetric&Asymmetric Security Specifications (CPA, CCA, CCA2) Information Theoretically Secure Public Key Encryption Scheme? Deterministic Public Key Schemes? Hybrid encryption

Public-key Encryption Scheme B.e is a public encryption key, B.d is a matching private decryption key Only the key protects confidentiality plaintext ciphertext B.e encryption algorithm decryption algorithm Key Alice uses to encrypt to Bob Key Bob uses to decrypt B.d Alice (the sender) Bob (the receiver)

Encryption Scheme Definition No distinction between public/ secret key encryption schemes No security requirement  Includes trivial (insecure) encryption schemes

Talk Outline Heuristic vs Provable Security Approaches Kerkhoff Principle Public-key Encryption Scheme Definition Security Definition  Adversarial Power and the Break  Symmetric&Asymmetric Security Specifications (CPA, CCA, CCA2) Information Theoretically Secure Public Key Encryption Scheme? Deterministic Public Key Schemes? Hybrid encryption

Defining Adversarial Power Computational power  Computational bounds on its running time  Uniform/ non-uniform What actions can it take?  Passive, eavesdropping  Active, can obtain encryptions/ decryptions

Defining the Break Define the successful break of the scheme  Recovering the secret key  Decrypting the challenge  Learning some partial information about the encrypted message! Simulating reality using experiments  Indistinguishability (CPA, CCA, adaptive-CCA)

Indistinguishability Experiment (asymmetric encryption, a.k.a Public Key) plaintext ciphertext B.e encryption algorithm decryption algorithm Encrypt, or select b  {0,1} and encrypt m b Key Bob uses to decrypt B.d Chosen plaintext m Selected messages m 0, m 1 Chosen ciphertext c Ciphertext c=E B.e (m) Decryptions m=D B.d (c) Guess of b AliceBob Eve

IND-CPA Security Specification

IND-CCA Security Specification

IND-CCA2 Security Specification

Indistinguishability Experiment (symmetric encryption, i.e. shared key) plaintext ciphertext k encryption algorithm decryption algorithm Encrypt, or select b  {0,1} and encrypt m b k Chosen plaintext m Selected messages m 0, m 1 Chosen ciphertext c Ciphertext c=E k (m,r e ) Decryptions m=D k (c) Guess of b AliceBob Eve

Eavesdropping (Passive) Attacks Security Specification Weakest type of adversary Adversary only obtains the ciphertext that it wishes to decrypt  Eavesdropps on the communication line between two parties and intercepts the encrypted communication  Does not obtain oracle access to encryption or decryption functionality  Does not obtain the encryption key

Eavesdropping Attacks Security Specification

Chosen Plaintext Attacks Security Specification

Talk Outline Heuristic vs Provable Security Approaches Kerkhoff Principle Public-key Encryption Scheme Definition Security Definition  Adversarial Power and the Break  Symmetric&Asymmetric Security Specifications (CPA, CCA, CCA2) Information Theoretically Secure Public Key Encryption Scheme? Deterministic Public Key Schemes? Hybrid encryption

Perfectly Secure Public-Key Encryption Scheme A public key encryption scheme is perfectly secure if for every public encryption key e, all messages m 0, m 1, |m 0 |=|m 1 |, all ciphertexts c and all algorithms A holds What does it mean for an encryption scheme to be perfectly secure?  The adversary gains no advantage  Above pure guess

Perfectly Secure Public-Key Encryption Schemes Do NOT Exist Proof  Let = (G,E,D) be a public key encryption scheme  operates over messages of one bit and encryption/ decryption always succeeds  Construct an algorithm A s.t.

Perfectly Secure Public-Key Encryption Schemes Do NOT Exist If c is an encryption of 0 then there exists a random i 0, otherwise there exists i 1 A will always return a correct answer since while

Talk Outline Heuristic vs Provable Security Approaches Kerkhoff Principle Public-key Encryption Scheme Definition Security Definition  Adversarial Power and the Break  Symmetric&Asymmetric Specifications (CPA, CCA, CCA2) Information Theoretically Secure Public Key Encryption Scheme? Deterministic Public Key Schemes? Hybrid encryption

Deterministic Public Key Encryption Schemes Do NOT Exist Proof  Let =(G,E,D) be a deterministic public key encryption scheme  operates over messages of one bit length and the decryption always succeeds  Construct A s.t.

Talk Outline Heuristic vs Provable Security Approaches Kerkhoff Principle Public-key Encryption Scheme Definition Security Definition  Adversarial Power and the Break  Symmetric&Asymmetric Security Specifications (CPA, CCA, CCA2) Information Theoretically Secure Public Key Encryption Scheme? Deterministic Public Key Schemes? Hybrid encryption

Symmetric vs. Asymmetric Is there a perfectly secure private key encryption scheme? Is there a secure deterministic private key encryption scheme?  Depends on the attack model Why not define the strongest security for any scheme?  There is a price for being overly conservative

Arbitrary Length Public-key Encryption Scheme Secure public-key encryption scheme for one bit implies security under multiple encryptions, given m=m 1 …m L encrypt Inefficient  L times the computational cost of encrypting one block  Ciphertext length increases  Public key cryptosystems are slow  Also: most (e.g. RSA) have fixed block size (FIL)  Using a long block size is veeery slooow

Hybrid Encryption (`enveloping`) Can we do better?  Use VIL secret key cryptosystem, encrypt shared key and use it to encrypt plaintext K  {0,1} k C KEY  E PK e (K) C MSG  E SK K (m) Encryption e Plaintext m Decryption K  D PK d ( C KEY ) D SK K (C MSG ) C KEY C MSG

Hybrid Encryption - Construction Secure public key encryption scheme Secure private key encryption scheme construct a hybrid encryption scheme

Hybrid Encryption - Security Theorem: If is an IND-CPA secure public key encryption scheme and is an IND-CPA secure private key encryption scheme then is an IND- CPA secure public key encryption scheme for arbitrary length messages Proof: We need to show that For any PPT A and any m 0, m 1 we need to bound

Hybrid Encryption Proof, cont’ By definition of hybrid encryption algorithm it is equivalent to Now given A against the hybrid scheme construct an algorithm A SK against the private key encryption scheme

Hybrid Encryption Proof, cont’ Analysis of A SK ‘s success probability But, is this equivalent to Why? Because There is no way for to choose the key K’ s.t. it is equal to K used to encrypt the challenge

Hybrid Encryption Proof, 2 nd Attempt Given A=(A 1,A 2 ) against we construct and against The advantage of A is bounded by the sum of the advantages of each of the algorithms above

Hybrid Encryption Proof, cont’ We first show that Given a PPT algorithm A=(A 1,A 2 ) construct a PPT against

Hybrid Encryption Proof, cont’ The success probability of Since is IND-CPA secure the advantage is negligible

Hybrid Encryption Proof, cont’ We next show that Given a PPT algorithm A=(A 1,A 2 ) construct a PPT against

Hybrid Encryption Proof, cont’ The success probability of Since is IND-CPA secure the advantage is negligible

Hybrid Encryption Proof, cont’ In the third step show that Given a PPT algorithm A=(A 1,A 2 ) construct a PPT against

Hybrid Encryption Proof, cont’ The success probability of Since is IND-CPA secure the advantage is negligible We obtain and conclude that

Hybrid Encryption Proof, fin’

Asymmetric Encryption End of part 1 and 2 Questions? Thank you.