Dan Boneh Odds and ends Deterministic Encryption Online Cryptography Course Dan Boneh

Dan Boneh The need for det. Encryption (no nonce) encrypted database Alice data k 1, k 2 Alice data Bob data ⋮ ??

Dan Boneh The need for det. Encryption (no nonce) encrypted database Alice data k 1, k 2 Bob data ⋮ ?? Later: Retrieve record E(k 1, “Alice”) Alice data det. enc. enables later lookup

Dan Boneh Problem: det. enc. cannot be CPA secure The problem: attacker can tell when two ciphertexts encrypt the same message ⇒ leaks information Leads to significant attacks when message space M is small. equal ciphertexts means same index

Dan Boneh Problem: det. enc. cannot be CPA secure The problem: attacker can tell when two ciphertexts encrypt the same message ⇒ leaks information Chal.Adv. kKkK m 0, m 1  M c  E(k, m b ) m 0, m 0  M c 0  E(k, m 0 ) output 0 if c = c 0 Attacker wins CPA game: b

Dan Boneh A solution: the case of unique messages Suppose encryptor never encrypts same message twice: the pair (k, m) never repeats This happens when encryptor: Chooses messages at random from a large msg space (e.g. keys) Message structure ensures uniqueness (e.g. unique user ID)

Dan Boneh Deterministic CPA security E = (E,D) a cipher defined over (K,M,C). For b=0,1 define EXP(b) as: Def: E is sem. sec. under det. CPA if for all efficient A: Adv dCPA [A, E ] = | Pr[EXP(0)=1] – Pr[EXP(1)=1] | is negligible. Chal. b Adv. kKkK b’  {0,1} m i,0, m i,1  M : |m i,0 | = |m i,1 | c i  E(k, m i,b ) where m 1,0, …, m q,0 are distinct and m 1,1, …, m q,1 are distinct for i=1,…,q:

Dan Boneh A Common Mistake CBC with fixed IV is not det. CPA secure. Let E: K × {0,1} n {0,1} n be a secure PRP used in CBC Chal.Adv. kKkK m 0 =0 n, m 1 = 1 n c  [ FIV, E(k, FIV) ] or 0 n 1 n, 0 n 1 n c 1  [ FIV, E(k, 0 n FIV), … ] output 0 if c[1] = c 1 [1] c  [ FIV, E(k, 1 n FIV) ] Leads to significant attacks in practice. b

Template vertLeftWhite2 Is counter mode with a fixed IV det. CPA secure? Yes No It depends message F(k, FIV) ll F(k, FIV+1) ll … ll F(k, FIV+L) ciphertext Chal. Adv. kKkK m 0, m 1 c’  m b F(k, FIV) m, mm, m c  mF(k, FIV) output 0 if cc’=mm 0 b

Dan Boneh End of Segment