1. Cryptography
Lecture 6

2. Clicker quiz
Let G(x) = x || parity(x). Which of the following proves that G is not a pseudorandom generator?
G is not expanding
Consider the following distinguisher D: D(y) outputs 1 iff the first bit of y is 1
Consider the following distinguisher D: D(y) outputs 1 iff the parity of the first n bits of y is 0
Consider the following distinguisher D: D(y) outputs 1 iff the parity of the first n bits of y is equal to the last bit of y

3. PRGs
Let G be a deterministic, poly-time algorithm that is expanding, i.e., |G(x)| = p(|x|) > |x|
seed G
output

4. PRGs
Let G be a deterministic, poly-time algorithm that is expanding, i.e., |G(x)| = p(|x|) > |x|
G defines a sequence of distributions!
Dn = the distribution on p(n)-bit strings defined by choosing x  Un and outputting G(x)
PrDn[y] = PrUn[G(x) = y] = x : G(x)=y PrUn[x] = x : G(x)=y 2-n = |{x : G(x)=y}|/2n
Note that most y occur with probability 0
I.e., Dn is far from uniform

5. PRGs G is a PRG iff {Dn} is pseudorandom
I.e., for all efficient distinguishers A, there is a negligible function  such that | Prx  Un[A(G(x))=1] - Pry  Up(n)[A(y)=1] | ≤ (n)
I.e., no efficient A can distinguish whether it is given G(x) (for uniform x) or a uniform string y!

6. Example (insecure PRG)
Let G(x) = 0….0
Distinguisher?
Analysis?

7. Example (insecure PRG)
Let G(x) = x | OR(bits of x)
Distinguisher?
Analysis?

8. Do PRGs exist? We don’t know…
Would imply P  NP
We will assume certain algorithms are PRGs
Recall the 3 principles of modern crypto…
This is what is done in practice
We will return to this later in the course
Can construct PRGs from weaker assumptions
For details, see Chapter 7

9. Where things stand
We saw that there are some inherent limitations if we want perfect secrecy
In particular, key must be as long as the message
We defined computational secrecy, a relaxed notion of security
Can we overcome prior limitations?

10. Recall: one-time pad
p bits
key
p bits
p bits 
message
ciphertext

11.  “Pseudo” one-time pad n bits key p bits G “pseudo” key p bits p bits
message
ciphertext

12. Pseudo one-time pad
Let G be a deterministic algorithm, with |G(k)| = p(|k|)
Gen(1n): output uniform n-bit key k
Security parameter n  message space {0,1}p(n)
Enck(m): output G(k)  m
Deck(c): output G(k)  c
Correctness is obvious…

13. Security of pseudo-OTP?
Would like to be able to prove security
Based on the assumption that G is a PRG

14. Definitions, proofs, and assumptions
We’ve defined computational secrecy
Our goal is to prove that the pseudo OTP meets that definition
We cannot prove this unconditionally
Beyond our current techniques…
Anyway, security clearly depends on G
Can prove security based on the assumption that G is a pseudorandom generator

15. PRGs, revisited
Let G be an efficient, deterministic function with |G(k)| = p(|k|)
k  Un
y  Up(n) G D y b
For any efficient D, the probabilities that D outputs 1 in each case must be “close”

16. Proof by reduction Assume G is a pseudorandom generator
Assume toward a contradiction that there is an efficient attacker A who “breaks” the pseudo-OTP scheme (as per the definition)
Use A as a subroutine to build an efficient D that “breaks” pseudorandomness of G
By assumption, no such D exists!
 No such A can exist

17. Alternately… Assume G is a pseudorandom generator
Fix some arbitrary, efficient A attacking the pseudo-OTP scheme
Use A as a subroutine to build an efficient D attacking G
Relate the distinguishing gap of D to the success probability of A
By assumption, the distinguishing gap of D must be negligible
 Use this to bound the success probability of A

18. Security theorem
If G is a pseudorandom generator, then the pseudo one-time pad Π is EAV-secure (i.e., computationally indistinguishable)

19. The reduction y D
m0, m1
b←{0,1} mb c b’ A
if (b=b’) output 1

20. Analysis
If A runs in polynomial time, then so does D

21. Analysis Let µ(n) = Pr[PrivKA,Π(n) = 1]
Claim: when y=G(x) for uniform x, then the view of A is exactly as in PrivKA,Π(n)
 Prx ← Un[D(G(x))=1] = µ(n)

22. The reduction k  Un y G -Enc m0, m1 b←{0,1} mb c b’ A
if (b=b’) output 1 D

23. Analysis Let µ(n) = Pr[PrivKA,Π(n) = 1]
If y=G(x) for uniform x, then the view of A is exactly as in PrivKA,Π(n)
 Prx ← Un[D(G(x))=1] = µ(n)
If distribution of y is uniform, then A succeeds with probability exactly ½
 Pry ← Up(n)[D(y)=1] = ½

24. The reduction y  Up(n) y OTP-Enc m0, m1 b←{0,1} mb c b’ A
if (b=b’) output 1 D

25. Analysis Let µ(n) = Pr[PrivKA,Π(n) = 1]
If y=G(x) for uniform x, then the view of A is exactly as in PrivKA,Π(n)
 Prx ← Un[D(G(x))=1] = µ(n)
If distribution of y is uniform, then A succeeds with probability exactly ½
 Pry ← Up(n)[D(y)=1] = ½
Since G is pseudorandom:
| µ(n) – ½ | ≤ negl(n)
Pr[PrivKA,Π(n) = 1] ≤ ½ + negl(n)

26. Stepping back… Proof that the pseudo OTP is secure…
We have a provably secure scheme, rather than just a heuristic construction!

27. Stepping back… Proof that the pseudo OTP is secure… …with some caveats
Assuming G is a pseudorandom generator
Relative to our definition
The only ways the scheme can be broken are:
If a weakness is found in G
If the definition isn’t sufficiently strong…

28. Have we gained anything?
YES: the pseudo-OTP has a key shorter than the message
n bits vs. p(n) bits
The fact that the parties internally generate a p(n)-bit temporary string to encrypt/decrypt is irrelevant
The key is what the parties share in advance
Parties do not store the p(n)-bit temporary value

29. Recall… Perfect secrecy has two limitations/drawbacks
Key as long as the message
Key can only be used once
We have seen how to circumvent the first
Does the pseudo OTP have the second limitation?
How can we circumvent the second?

30. But first… Develop an appropriate security definition
Recall that security definitions have two parts
Security goal
Threat model
We will keep the security goal the same, but strengthen the threat model

31. Single-message secrecyk k m
c  Enck(m)

32. Multiple-message secrecy
c1, …, ct k k
m1, …, mt
c1  Enck(m1) … ct  Enck(mt)

33. A formal definition Fix , A
Define a randomized exp’t PrivKmultA,(n):
A(1n) outputs two vectors (m0,1, …, m0,t) and (m1,1, …, m1,t)
Require that |m0,i| = |m1,i| for all i
k  Gen(1n), b  {0,1}, for all i: ci  Enck(mb,i)
b’  A(c1, …, ct); A succeeds if b = b’, and experiment evaluates to 1 in this case

34. A formal definition
 is multiple-message indistinguishable if for all PPT attackers A, there is a negligible function  such that Pr[PrivKmultA,(n) = 1] ≤ ½ + (n)
Exercise: show that the pseudo-OTP is not multiple-message indistinguishable