1. Universal Guessing with Applications to Cipher Systems A Report on Progress DRDO-IISc PME Rajesh Sundaresan ECE Department 14 March 2008 TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AA A

2. A Cipher System Eve guesses K in decreasing order of its probabilities K of length n, from an i.i.d. source with letter PMF P –Requires ~ 2 nH 1/2 (P) guesses –H 1/2 (P) : Rényi entropy, an analogue to Shannon entropy K MM C Eve

3. Let’s hide the parameters of the source we use to generate our key stream … Our bag of sources is not perfect. What shall we do? If your bag is made of i.i.d. sources, hiding won’t help! A bigger bag of sources with memory doesn’t help either …

4. Measures of performance Growth rate of moments Tail probabilities behaviour Compare with that when source parameters known

5. Hiding source information If the set of sources is i.i.d.: –Eve has an asymptotically optimal guessing strategy [Arikan-Merhav 1998, S2007] If the set is made of a fixed fraction of tosses from one coin and remaining from another coin –Hiding the sequence of coin pickings helps [S2007] If the set of sources is unifilar? Or finite-state Markov? Stationary and ergodic? –k th order Markov is a unifilar source

6. Methodology In [S2007] established connections in the expectations sense between source compression and guessing LZ source compression is universal –Guess in the increasing order of compression lengths Plan: –First year: key rate = 1 –Second year: key rate < 1 UnifilarFinite-state Markov Explicit answersBounds Explicit answersBounds

7. Refinements Compression and guessing are tightly related –For any class of sources, if there is an asymptotically optimal compression strategy to minimise, there is an asymptotically optimal guessing strategy and vice versa. –For R < 1, analogous results with a saturated cost of encoding. –Performance explicitly characterised for unifilar sources for guessing moment criterion and large deviations criterion –Attacks based on increasing Lempel-Ziv lengths of messages yields an asymptotically optimal attack strategy for FSM sources with a redundancy of O(log log n / log n) –Attacks based on increasing MDL of messages yields an asymptically optimal attack for unifilar sources with a redundancy of O(log n / n) –Both attack strategies are competitively optimal

8. Ongoing work Imperfect key bits (SAG input) Guessing subject to distortion? –Connections to rate-distortion theory –Applications to searches in large data bases –A little more theory Sources with arbitrary alphabet spaces Deeper connections with large deviations theory Statistical analysis of password protected systems

9. Publications and interactions Journal –R.Sundaresan, “Guessing under source uncertainty”, IEEE Trans. on Inform. Th., Jan. 2007 –R.Sundaresan, “Guessing based on length functions for a Shannon cipher system”, to be submitted to Sadhana Conferences –R.Sundaresan, “Guessing based on length functions”, ISIT 2007, June 2007 –R.Sundaresan, “Guessing based on length functions for a Shannon cipher system”, MCDES 2008, May 2008 Technical Report –R.Sundaresan, “Guessing based on length functions”, Feb 2007, revised Nov 2007 Invited articles –R.Sundaresan, “An introduction to guessing”, Chakravyuh, expository article, to be published, mid-2008 Under preparation: Guessing and compression : Under preparation – to include rate-distortion Visits with SAG –Talk: January 2007 –Discussion: September 2007 Manpower training: –One Project Assistant: October 2006 – June 2007 –One Project Assistant: September 2007 – present (Manjesh Kumar, formerly employed by CAIR)

10. Password-Protected Systems N users, lock-password after 3 failed attempts –H(X 1 ) = 4, H(X i | X i-1 ) = 2, i > 1 NIST Electronic Authentication Guideline Why? Easy to remember –Weak passwords: “password”, 1/1000 picks one of two most frequent passwords Access to system in 700 tries, w.p. ½ –Promptings to use special characters results in simple choices Models for password choices? Asymptotics as N grows? Relationship with entropies? Impact: Quantitative evaluation of security levels