Cryptography Lecture 2 Arpita Patra © Arpita Patra

Recall >> Crypto: Past and Present (aka Classical vs. Modern Cryto) Scope Scientific Basis (Formal Def. + Precise Assumption + Rigorous Proof) End-users >> Secure Communication in Secret Key Setting Secret Key Encryption (SKE) >> Learn From the Blunders of Classical SKE Algorithms of SKE (in general in crypto) must be PUBLIC Secret Key Space Must be large enough to fail brute force No ad-hoc algorithm without definition and proof

Today’s Goal Do Secure Communication in a ‘modern’ way ditching the ‘classic’ approach Formulate a formal definition (threat + break model) Identify assumptions needed and build a construction Prove security of the construction relative to the definition and assumption

Secure Communication in Private Key Setting Encryption Decryption ?? k k Secret key k shared in advance (by “some” mechanism) m is the plain-text c is the cipher-text (scrambled message) Need: An encryption scheme (Gen, Enc, Dec) - Private (Secret) Key Encryption- Keys are private to the sender and the receiver - Symmetric Key Encryption- The same key is used for encryption and decryption

Syntax of Secret Key Encryption (SKE) Key-generation Algorithm: Gen() > Outputs a key k chosen according to some probability distribution. > MUST be a Randomized algorithm 2. Encryption Algorithm: Enck(m) > c  Enck(m) when randomized and c:=Enck(m) when deterministic > Deterministic/Randomized algorithm Gen is not randomized. Kerchoffs Principle the security should hold when all algorithms are public. The adversary also knows which key will be output by the Gen. No Security can be obtained. 3. Decryption Algorithm: Deck(c) > Outputs m:= Deck(c) > Usually deterministic

Syntax of SKE SKE is specified using (Gen, Enc, Dec) and M Key space (K): > Set of all possible keys output by algorithm Gen 2. Plaintext / message space (M): > Set of all possible “legal” message (i.e. those supported by Enc) 3. Ciphertext space (C): M is independent of the scheme so it should be a part of the description. Other sets are subsumed in the triple algorithms description. > Set of all cipher-texts output by algorithm Enc SKE is specified using (Gen, Enc, Dec) and M

Formal Definition of Security Two components of a security definition: Threat: >> Who is your threat? >> Who do you want to protect from? >> Cultivate your enemy a.k.a adversary in crypto language. >> Look out in practical scenarios / be an adversary >> Unless you know your adv, no hope of defeating him Break: >> What are you afraid of losing? >> What do you want to protect? >> If you don’t know what to protect then how to do you when or if you are protecting it?

Threat Model computationally? - How powerful > Best is to have no assumption on the computing power of the adv. a.k.a unbounded powerful adversary > Give him any so-called hard problem (factoring etc), he solves in no time > Strongest adversary that we can think of in terms of computing power - What are his capabilities (in terms of attacking a secure communication protocol)? m c Enc ?? k k > Attacker/adv. can eavesdrop/tap the ciphertext during transit- Passive or Eavesdropper > Ciphertext Only Attack (COA) Can you think of a smarter attack?

Threat Model Randomized Unbounded Powerful COA - Can sample random coins? (deterministic or randomized) > Randomness is absolute necessity in Crypto; it is practical and Good guys use randomness often. Why not adversary? > Good to be liberal in terms of giving more power to adversary Randomized Unbounded Powerful COA

Break Model Attempt I>> Secret key ? Then Enc(m) = m is secure Attempt II>> Entire Message? Then Enc(m) leaking most significant 10 bits is secure; m: bank password| amazon password| Recall what do we mean by break. Attempt III>> No additional info about the message irrespective of prior information? Right Notion Need basics of Discrete Probability Theory How to formalise?

Discrete Probability Background > U: Finite set; e.g. {0,1} > Probability Distribution on U specifies the probabilities of the occurrence of the elements of U - e.g Probability Distribution on U = {0,1}: Pr(0) = ½ , Pr(1) = ½ Pr(0) = 0 , Pr(1) = 1 Probability distribution: Probability distribution Pr over U is a function Pr: U ⟶ [0,1] such that Σ Pr(x) = 1 x in U Recall what do we mean by break. > Uniform Probability Distribution on U: Pr(x) = 1/|U| for every x

Discrete Probability Background Event: Occurrence of one or more elements of U is called an event - e.g Consider Uniform Distribution on U = {0,1}4 - Let A = occurrence of elements of U with msb two bits as 01 - Pr(A) = 1/4 Union Bound: For events A1 and A2 Pr[ A1 ∪ A2 ] ≤ Pr[A1] + Pr[A2] (extend for more than 2) Conditional probability: probability that one event occurs, assuming some other event occurred. - Pr(A | B) = Pr(A ∧ B) / Pr(B) - For independent A, B: Pr(A | B) = Pr(A) and Pr(A ∧ B) = Pr(A) . Pr(B)

Discrete Probability Background Law of total probability: Let E1, …, En are a partition of all possibilities of events. Then for any event A: Pr[A] = i Pr[A ∧ Ei] = i Pr[A | Ei] · Pr[Ei] Bayes’s Theorem: If Pr(B) ≠ 0 then Pr(A | B) = Pr(B | A) . Pr(A) / Pr(B) Random Variable: variable that takes on (discrete) values from a finite set with certain probabilities (defined with respect to a finite set) Recall what do we mean by break. Probability distribution for a random variable: specifies the probabilities with which the variable takes on each possible value of a finite set - Each probability must be between 0 and 1 - The probabilities must sum to 1 Done!!

Formulating Definition for SKE=(Gen,Enc,Dec) All the distributions are known to Prob. Dist. Of C depends on dist. of M and K ilu ihu Prob. Dist. Of M and K are independent M C K Random Variable M K C Prob. Dist. Recall what do we mean by break. - Determined by external factors - Depends on Gen Choose a message m, according to the given dist. - Generate a key k using Gen - Compute c  Enck(m) Pr(M = ilu) = .7 Pr(M = ihu) = .3 Pr(K = k) = Pr(Gen outputs k)

Numerical Example - - - - - - - M = {a b c d} K = {k1 k2 k3} 4 - 3 10 - 3 20 - 3 10 - 1 4 - 1 2 - 1 4 - .26 .26 .26 .21 Enc What is the probability distribution on the cipher-text space C ? Pr [C = 1] : Pr [M = b] Pr [K = k2] + Pr [M = c] Pr [K = k3] + Pr [M = d] Pr [K = k1] = 0.2625 Pr [C = 2] : Pr [M = c] Pr [K = k1] + Pr [M = d] Pr [K = k2] + Pr [M = d] Pr [K = k3] = 0.2625 Pr [C = 3] : Pr [M = a] Pr [K = k1] + Pr [M = a] Pr [K = k2] + Pr [M = b] Pr [K = k3] = 0.2625 Pr [C = 4] : Pr [M = a] Pr [K = k3] + Pr [M = b] Pr [K = k1] + Pr [M = c] Pr [K = k2] = 0.2125

Threat & Break Model Perfect Security!!!! What is the point in tapping over channel. I better watch the cricket match today Threat & Break Model Randomized Unbounded Powerful COA No additional info about the message should be leaked from the ciphertext irrespective of the prior information that the adv has Perfect Security!!!! What captures the prior information of the attacker about m ? - Probability distribution on the plain-text space M - The probability distribution {Pr[M = m]} Observing the cipher-text c should not change the attacker’s knowledge about the distribution of the plaintext - Mathematically, Pr[M = m | C = c] = Pr[M = m]

Perfectly-secure Encryption : Formal Definition Definition (Perfectly-secure Encryption): An encryption scheme (Gen, Enc, Dec) over a plaintext space M is perfectly-secure if for every probability distribution over M, every plain-text m  M and every cipher-text c  C, the following holds: Pr [M = m | C = c] = Pr [M = m] Posteriori probability that m is encrypted in c a priori probability that m might be communicated Probably the first formal definition of security - C. E. Shannon. Communication theory of secrecy systems. Bell Systems Technical Journal, 28(4): 656-715, 1949.

What have we done so far.. No assumption!! Formulate a formal definition (threat + break model) Identify assumptions needed and build a construction Prove security of the construction relative to the definition and assumption No assumption!!

Perfectly-secure Encryption- Construction M = K = C = {0, 1}l k k Dec m:= ck Enc c:= mk k R K m  M c c  C m Gen Correctness: Deck( ) Enck(m) = m Vernam Cipher [1917]: But Shannon proved its security after formulating perfect security

Perfectly-secure Encryption- Construction M = K = C = {0, 1}l k k Dec m:= ck Enc c:= mk k R K m  M c c  C m Gen Theorem (Security): Vernam Cipher is perfectly-secure Proof: To prove Pr[M = m | C = c] = Pr[M = m] For arbitrary c and m, Pr[C = c | M = m] = Pr[K = c  m] = 1/2l Pr[C = c] = Σ Pr[C = c | M = m] Pr[M = m] (irrespective of p. d. over M) m in M = 1/2l Σ Pr[M = m] = 1/2l m in M

Perfectly-secure Encryption- Construction M = K = C = {0, 1}l k k Dec m:= ck Enc c:= mk k R K m  M c c  C m Gen Pr[C = c | M = m ] Pr[M = m] Pr[M = m | C = c] = (Bayes' Theorem) Pr[C = c] Historical Use of Vernam Cipher: Redline between White House & Kremlin during Cold war. = Pr[M = m]

What have we done so far.. Formulate a formal definition (threat + break model) Identify assumptions needed and build a construction Prove security of the construction relative to the definition and assumption

Vernam Cipher is not all that nice because.. How long is the key? length is as long as the message - For long messages hard to agree on long key - What happens the parties cannot predict the message size in advance One-time Pad (OTP) Can we reuse the keys for multiple messages? No!! VENONA Project: US & UK decrypted Russian Plaintext exploiting the use of same key to pad many messages - c = m  k, c’ = m’  k - c  c’ = m  m’ Adversary learns the difference! - Perfect security breaks down  Let us design another scheme that overcomes the drawbacks.. Alas! Inherent problems..

Chalk & Talk Assignment Various Perfect Security Definitions and their Equivalence ≈ Definition II: Pr [C = c | M = m] = Pr [C = c | M = m’] Definition I: Pr [M = m | C = c] = Pr [M = m] ≈ ≈ Definition III: KL Chapter 2 Define it

≈ ≈ ≈ ≈Shannon Next class… Various Perfect Security Definitions and their Equivalence ≈ Definition II: Pr [C = c | M = m] = Pr [C = c | M = m’] Definition I: Pr [M = m | C = c] = Pr [M = m] ≈ ≈ Definition III: KL Chapter 2 ≈Shannon Define it Definition IV: