CMSC 414 Computer and Network Security Lecture 4 Jonathan Katz

One-time pad  The one-time pad achieves perfect secrecy  But, it has a number of drawbacks –Key size equal to message size –Can only be used once –Insecure under chosen-plaintext attack  Unfortunately, these drawbacks are inherent if we want perfect secrecy

A weaker security guarantee  Instead of requiring that no adversary can learn anything about the plaintext…  …require that no adversary running in a “reasonable amount of time” can learn anything about the plaintext except with “very small probability” –“Reasonable time” = 10 6 years –“Very small probability” = –Computational security

A simpler characterization  Equivalent to the following, simpler definition: –Given a ciphertext C which is known to be an encryption of either M 0 or M 1, no adversary running in a reasonable amount of time can guess correctly which message was encrypted with probability significantly better than ½.

The take-home message  Weakening the definition slightly allows us to construct much more efficient schemes!  Strictly speaking, no longer 100% absolutely guaranteed to be secure –Security of encryption now depends on security of building blocks (which are analyzed extensively, and are assumed to be secure) –Given enough time, the scheme can be broken

Attacks  As always, we can couple our security notion with a variety of attacks –Ciphertext only –Known plaintext –Chosen plaintext –Chosen ciphertext (includes chosen plaintext attacks)

Attacks…  The default standard is security against chosen-plaintext attacks  Security against chosen-ciphertext attacks is increasingly required  Note that the one-time pad is insecure even against known-plaintext attack

Randomized encryption  To be secure against chosen-plaintext attack, encryption must be randomized –We will see later how this comes into play  Moral: always use randomized encryption!

Block ciphers  Keyed permutation; input/output length  Large key space  Modeled as a (family of) random permutations…  Example – “trivial” encryption: –C = F K (m) –This is not randomized…

Modes of encryption  ECB –C i = F K (m i )  CBC –C i = F K (m i  C i-1 )  OFB (stream cipher mode) –z i = F K (z i-1 ); C i = z i  m i  CFB (stream cipher mode) –z i = F K (C i-1 ); C i = z i  m i

Security?  All previous modes (except ECB) are secure against chosen-plaintext attacks –ECB is deterministic…