COS433/Math 473: Cryptography. Mark Zhandry Princeton University Spring 2020

(1)

COS433/Math 473:

Cryptography

Mark Zhandry Princeton University

(2)

Announcements/Reminders

HW2 due September 29

• Submit through Gradescope PR1 Due October 6

(3)

(4)

Pseudorandom Functions

Functions that “look like” random functions Syntax:

• Key space K_λ

• Domain X_λ

• Co-‐domain/range Y_λ

• Function F:K_λ × X_λàY_λ

(5)

Pseudorandom Functions

Security:

x∈X_λ

y

Challenger

b

(6)

Pseudorandom Functions

Security:

x∈X_λ

y

k ß K_λ

y ß F(k,x)

Challenger

b=0

b’

(7)

Pseudorandom Functions

Security:

x∈X_λ

y

Challenger

b=1

b’

HßFuncs(X_λ,Y_λ)

y = H(x)

(8)

Using PRFs to Build Encryption

F k

y

m

⊕

c

r ßX

(9)

Counter Mode

F k

⊕

Xà r

( , ) 1 F k

⊕

2 F k

⊕

3 F k

⊕

4 F k

⊕

5

(10)

Today

Block ciphers, more modes of operation Begin constructing block ciphers/PRFs

(11)

Pseudorandom Permutations

Functions that “look like” random permutations

Syntax:

• Key space K_λ

• Domain=Range= X_λ

• Function F:K_λ × X_λ à X_λ

• Function F-1_:K

λ × Xλ à Xλ

Correctness: ∀k,x, F-1(k, F(k, x) ) = x

(12)

Pseudorandom Permutations

Security:

x∈X_λ

y

Challenger

b

(13)

Pseudorandom Permutations

Security:

x∈X_λ

y

k ß K_λ

y ß F(k,x)

Challenger

b=0

b’

(14)

Pseudorandom Permutations

Security:

x∈X_λ

y

Challenger

b=1

b’

HßPerms(X_λ,X_λ)

y = H(x)

(15)

PRP Security Definition

Definition: F is a secure PRP if, for all running in polynomial time, ∃ negligible ε such that:

|

Pr[1

ß

PRF-Exp

₀

( ,

λ

) ]

(16)

Theorem: Assuming |X_λ| is super-‐polynomial, a PRP

(17)

Proof

Secure as PRP ⇒ Secure as PRF

• Assume , hybrids Hybrid 0:

x∈X

y

k ß K

y ß F(k,x)

Challenger

(18)

Proof

x∈X

y _y ß H(x)

Challenger

b’

(19)

Proof

x∈X

y _y ß H(x)

Challenger

b’

(20)

Proof

• Assume , hybrids

Hybrids 0 and 1 are indistinguishable by PRP security Hybrids 1 and 2?

• In Hybrid 1, sees random distinct answers

• In Hybrid 2, sees random answers

• Except with probability ≈q2_/2|X

λ|, random answers

(21)

Proof

Secure as PRF ⇒ Secure as PRP

• Assume , hybrids

(22)

How to use block ciphers for

encryption

(23)

( , )

Counter Mode (CTR)

F k

⊕

IV IV 1 F k

⊕

2 F k

⊕

3 F k

⊕

4 F k

⊕

5

(24)

Electronic Code Book (ECB)

F

(25)

ECB Decryption

F-1

(26)

Security of ECB?

Is ECB mode CPA secure?

(27)

Security of ECB

(28)

Cipher Block Chaining (CBC) Mode

( , )

F k

IV

F

k k F k F k F

⊕

IV

( )

(29)

CBC Mode Decryption

F-1

k _k F-1 _k _F-1 _k _F-1 _k _F-1

⊕

( , )IV

( )

(30)

Theorem: If (F,F-1₎_{is a secure pseudorandom}

permutation and |X_λ| is super-‐polynomial, then CBC mode encryption is CPA secure.

(31)

Proof Sketch

Assume toward contradiction an adversary for CBC mode

(32)

Proof Sketch

Hybrid 0

( , )

F k

IV

F

k k F k F k F

⊕

IV

( )

(33)

Proof Sketch

Hybrid 1

( , )

H

IV

H H H H

⊕

IV

( )

(34)

Proof Sketch

Hybrid 2

( , )

H

IV

H H H H

⊕

IV

( )

(35)

Proof Sketch

Hybrid 3

( , )

F k

IV

F

k k F k F k F

⊕

IV

( )

(36)

Proof Sketch

Hybrid 0,1 differ by replacing calls to F with calls to random permutation H

• Indistinguishable by PRP security Same for Hybrids 2,3

(37)

Proof Sketch

Hybrid 1

( , )

H

IV

H H H H

⊕

IV

( )

(38)

Proof Sketch

Hybrid 2

( , )

H

IV

H H H H

⊕

IV

( )

(39)

Proof Sketch

Idea:

• As long as, say, the sequence of left messages

queried by does not result in two calls to H on the same input, all outputs will be random

(distinct) outputs

• For each message, first query to H will be uniformly random

• Second query gets XORed with output of first query to H ⇒ ≈ uniformly random

(40)

Proof Sketch

Idea:

• Since queries to H are (essentially) uniformly

random, probability of querying same input twice is exponentially small

• Ciphertexts will be essentially random

(41)

Output Feedback Mode (OFB)

F k

IV

( , )IV

⊕

F k

⊕

F k

⊕

F k

⊕

(42)

OFB Decryption

F k

⊕

F k

⊕

F k

⊕

IV F k

⊕

(43)

Cipher Feedback (CFB)

F k

IV

( , )IV

⊕

F k

⊕

F k

⊕

F k

⊕

(44)

CFB Decryption

F k

⊕

F k

⊕

F k

⊕

IV F k

⊕

(45)

Security of OFB, CFB modes

Security very similar to CBC Define 4 hybrids

• 0: encrypt left messages

• 1: replace PRP with random permutation

• 2: encrypt right messages

• 3: replace random permutation with PRP

0,1 and 2,3 are indistinguishable by PRP security 1,2 are indistinguishable since ciphertexts are essentially random

(46)

Which Mode to Use?

Never use ECB

Otherwise, largely depends on application

(47)

Parallelism

F k

⊕

Xà r

( , ) 1 F k

⊕

2 F k

⊕

3 F k

⊕

4 F k

⊕

5

Enc,Dec easily parallelized

CTR mode:

(48)

Parallelism

Enc not parallelizable

CBC mode encryption:

✘

( , )

F k

IV

F

k k F k F k F

⊕

IV

(49)

Parallelism

Dec parallelizable

CBC mode decryption:

F-1

k _k F-1 _k _F-1 _k _F-1 _k _F-1

⊕

( , )IV

( )

⊕

(50)

Parallelism

Enc,Dec not parallelizable

OFB mode:

F k

⊕

F k

⊕

F k

⊕

IV F k

⊕

✘

(51)

Parallelism

Enc not parallelizable

CFB mode encryption:

✘

F k

IV

( , )IV

⊕

F k

⊕

F k

⊕

F k

⊕

(52)

Parallelism

CFB mode decryption:

F k

⊕

F k

⊕

F k

⊕

IV F k

⊕

(53)

Lose Block During Transmission?

F k

⊕

( , ) 1 F k

⊕

2 F k

⊕

3 F k

⊕

4 F k

⊕

5 CTR mode decryption:

r

Message corrupted after deleted block

✘

(54)

Lose Block During Transmission?

CBC mode decryption:

Lose one block, one more corrupted, rest fine

F-1

k _k F-1 _k _F-1 _k _F-1 _k _F-1

⊕

( , )IV

( )

⊕

✓

(55)

PRPs vs PRFs

In practice, PRPs are the central building block of most crypto

• Also PRFs

• Can build PRGs

(56)

(57)

Difficulties

2n_!_{Permutations on}_n_{-‐bit blocks}

⇒ ≈n2n bits to write down random perm.

Reasonable for very small n (e.g. n<20), but totally infeasible for large n (e.g. n=128)

Challenge:

• Design permutations with small description that “behave like” random permutations

(58)

Difficulties

For a random permutation H, H(x) and H(x’) are (essentially) independent random strings

• Even if x and x’ differ by just a single bit

Therefore, for a random key k, changing a single bit of x should “affect” all output bits of F(k,x)

(59)

Definition: For a function H:{0,1}n _à _{0,1}n_{, we}

say that bit i of the input affects bit j of the output if

For a random x₁,…,x_i-1,x_i+1, …, x_n, if we let

y=H(x₁…x_i-10x_i+1…x_n) and

z=H(x₁…x_i-11x_i+1…x_n)

(60)

Proof sketch:

• For random permutations this is true

• If bit i did not affect bit j, we can construct an adversary that distinguishes F from random

Theorem: If (F,F-1₎ _{is a secure PRP, then with (with}

“high” probability over the key k), for the function

(61)

(62)

Confusion/Diffusion Paradigm

Goal: build permutation for large blocks from permutations for small blocks

• Small block perms can be made truly random

(63)

Confusion/Diffusion Paradigm

First attempt: break blocks into smaller blocks, apply smaller permutation blockwise

f₁ f₂ f₃ f₄ f₅ f₆

Small blocks (e.g. 8 bits)

Big blocks (e.g. λ=128 bits)

(64)

Confusion/Diffusion Paradigm

Is this a secure PRP?

• Key size: ≈(8×28₎_×₍_λ_{/8) = O(}_λ₎

• Running time: a few table lookups, so efficient

• Security?

(65)

Confusion/Diffusion Paradigm

Second attempt: shuffle output bits

Is this a secure PRP?

• Key size: ≈ 28_λ ₊_λ×_log _λ

• Running time: a few table lookups

• Security?

f₁ f₂ f₃ f₄ f₅ f₆

π

Confusion Diffusion

(66)

Confusion/Diffusion Paradigm

f₁ f₂ f₃ f₄ f₅ f₆

π₂

f₇ f₈ f₉ f₁₀ f₁₁ f₁₂

π₁

Round Third Attempt: Repeat multiple times!

(67)

Confusion/Diffusion Paradigm

While single round is insecure, we’ve made progress

• Each bit affects 8 output bits

With repetition, hopefully we will make more and more progress

(68)

Confusion/Diffusion Paradigm

With 2 rounds,

• Each bit affects 64 output bits

With 3 rounds, all 128 bits are affected

(69)

Announcements/Reminders

HW2 due September 29

• Submit through Gradescope PR1 Due October 6