Foundations of Cryptography Rahul Jain CS6209, Jan – April

Foundations of Cryptography : Basic Applications Encryption Schemes. Digital Signatures. General Cryptographic Protocols.

Encryption Schemes

Private key v/s Public key encryption schemes, Fig. 5.1, 5.2. Definition of encryption schemes (Def ). Definition of security : Semantic security – private key (Def 5.2.1), Semantic security – public key (Def 5.2.2). Indistinguishability of Encryptions : Private Key (Def ), Public-key (Def 5.2.4). Thm : (Equivalence of definitions – private key) A private-key encryption scheme is semantically secure if and only if it has indistinguishable encryptions. Proof done in class.

Encryption Schemes : Multiple Messages Semantic Security – Multiple messages (Def ) Indistinguishability of encryptions - Multiple messages (Def ) Thm (equivalence of definitions – multiple messages) : A private-key (resp. public- key) encryption scheme is semantically secure for multiple messages if and only if it has indistinguishable encryptions for multiple messages. Proof on similar lines as that of Thm Thm (single-message security implies multiple-message security) : A public-key encryption scheme has indistinguishable encryptions for multiple messages if and only if it has indistinguishable encryptions for a single message. Proof done in class. Propositions (Effect on the private-key model) : Suppose there exists pseudorandom generators (robust against polynomial size circuits). Then there exists a private-key encryption scheme that satisfies Def but does not satisfy Def Proof done in class.

Constructions of Encryption Schemes Block-Ciphers (Def ), Semantic-security – private-key block-ciphers (Def ), Public-key equivalent definition can be given similarly. Construction (from block-ciphers to general encryption schemes) Proposition : Suppose (G,E,D) and (G’,E’,D’) be as in Construction Suppose that the former is a secure private-key (resp. public-key) block cipher. Then the latter is a secure private-key (resp. public-key) encryption scheme. Proof done in class. Construction (a private-key block-cipher based on pseudorandom functions)

Constructions of Encryption Schemes Proposition : Let F and (G,E,D) be as in Construction and suppose that F is pseudorandom with respect to polynomial size circuits. Then (G,E,D) is secure. Proof done in class. Theorem : If there exists (non-uniformly strong) one-way functions, then there exists secure private-key encryption schemes. Proof done in class. Public key encryptions schemes : Trapdoor permutations, definition. Construction (public-key block-cipher with block length 1 using trapdoor permutations with a hard-core predicate). Proposition : Suppose that b is a (non-uniformly strong) hard core of the collection {p α }. Then Construction constitutes a secure public-key block-cipher with block length l = 1. Proof done in class.

Constructions of Encryption Schemes Theorem : If there exists collections of (non-uniformly hard) trapdoor permutations, then there exists secure public-key encryption schemes. Proof done in class. Large Hard-Core Conjecture for RSA. Construction (Randomized-RSA, a public-key block-cipher scheme) Proposition : Suppose that the large hard-core conjecture for RSA does hold. Then Construction constitutes a secure public-key block-cipher (with block- length l(n) = n ). Proof done in class.

Constructions of Encryption Schemes Construction (an alternate public-key encryption scheme based on one-way permutations) Proposition : Suppose that b is a (non-uniformly strong) hard core of the collection {p α }. Furthermore, suppose that this trapdoor collection utilizes a domain sampling algorithm S so that the statistical difference between S(α) and the uniform distribution over the domain of p α is negligible in terms of |α|. Then Construction constitutes a secure public-key encryption scheme. Proof done in class. Construction (the Blum-Goldwasser Public-Key Encryption Scheme) Corollary : Suppose factoring is infeasible, then Construction constitutes a secure public-key encryption scheme.

Digital Signatures and Message Authentication

A scheme for unforgeable signatures must satisfy: 1)Each user can efficiently produce his/her own signature on documents of his/her choice; 2)Every user can efficiently verify whether a given string is a signature of another (specific) user on a specific document; but 3)It is infeasible to produce signatures of other users to documents that they did not sign. A scheme for message authentication should satisfy: 1)Each of the communicating parties can efficiently produce an authentication tag to any message of his/her choice; 2)Each of the communication parties can efficiently verify whether a given string is an authentication tag of a given message; but 3)It is infeasible for an external adversary (i.e. a party other than the communicating parties) to produce authentication tags to messages not sent by the communicating parties.

Digital Signatures and Message Authentication Definition (signature scheme) A chosen message attack is a process that can obtain signatures to strings of its choice, relative to some fixed signing-key that is generated by G. We distinguish two case: The private-key case: Here the attacker is given 1 n