1 CIS 5371 Cryptography 3. Private-Key Encryption and Pseudorandomness B ased on: Jonathan Katz and Yehuda Lindel Introduction to Modern Cryptography

2 A Computational Approach to Cryptography The principal of Kerchoffs essentially says that it is not necessary to use a perfectly-secret encryption scheme, but instead it suffices to use a scheme that cannot be broken in reasonable time with any reasonable probability of success.

3 A Computational Approach to Cryptography That is, it suffices to use an encryption scheme that can be broken in theory but that cannot be broken in practice with probability better than in 200 years using the fastest available supercomputer.

4 A Computational Approach 1.Security is only preserved against efficient adversaries 2.Adversaries can potentially succeed with some very small probability (small enough so that we are not concerned that it will ever really happen)

5 A concrete approach

6 The asymptotic approach

7 The asymptotic approach

8

9 The asymptotic approach – an example

10 The asymptotic approach – an example

11 The asymptotic approach – an example

12 The asymptotic approach – an example The asymptotic approach has the advantage of not depending on any specific assumptions regarding, e.g., the type of computer an adversary will use.

13 Efficient Algorithms

14 Efficient Algorithms Generating randomness There are a number of ways random bits are obtained in practice. One solution is to use a hardware random number generator that generates random bit- streams based on certain physical phenomena like thermal/electrical noise or radioactive decay. Another possibility is to use software random number generators which generate random bit- streams based on unpredictable behavior such as the time between key-strokes, movement of the mouse, hard disk access times, and so on.

15 Efficient Algorithms Generating randomness Some modern operating systems provide functions of this sort. Note that, in either of these cases, the underlying unpredictable event is unlikely to directly yield uniformly-distributed bits, and so further processing of the initial bit- stream is needed. Techniques for doing this are complex and poorly understood.

16 Efficient Algorithms Generating randomness One must careful in how random bits are chosen, and the use of badly designed or inappropriate random number generators can often leave a good cryptosystem vulnerable to attack. Particular care must be taken to use a random number generator that is designed for cryptographic use, rather than a general-purpose random number generator which may be fine for some applications but not cryptographic ones

17 Negligible Success

18 Negligible Success

19 Proofs by Reduction Strategy 1. Assume that some low-level problem is hard to solve. 2. Then prove that the construction in question is secure given this assumption.

20 Proofs by Reduction The proof that a given construction is secure as long as some underlying problem is hard generally proceeds by presenting an explicit reduction showing how to convert any efficient adversary A that succeeds in breaking the construction with non-negligible probability into an efficient algorithm A’ succeeds in solving the problem that was assumed to be hard.

21 Proofs by Reduction

22 Proofs by Reduction Instance  of  BreakSolution to x

23 Computationally Secure Encryption

24 Computationally Secure Encryption

25 Computationally Secure Encryption

26 Computationally Secure Encryption

27 Computationally Secure Encryption

Theorem 28

Proof of Theorem We shall reduce the “indistinguishability of the bits of encrypted messages” to the “indistinguishability of the encryptions of the messages” in the presence of an eavesdropper. 29

30 Adversary A Protocol , being analyzed

31 Proof, in detail

32 Proof of theorem– by reduction Adversary A ( bit distinguisher ) Algorithm A’ ( message distinguisher )

Semantic Security 33

Semantic Security: Definition 34

Semantic Security: Theorem A private-key encryption scheme has indistinguishable encryptions in the presence of an eavesdropper if and only if, it is semantically secure in the presence of an eavesdropper. 35