# Introduction to Security Proof of Cryptosystems

Save this PDF as:

Size: px
Start display at page:

## Transcription

1 Introduction to Security Proof of Cryptosystems D. J. Guan November 16, 2007

2 Abstract Provide proof of security is the most important work in the design of cryptosystems. Problem reduction is a tool to prove the security of cryptosystems. However, most cryptosystems have not been able to find a suitable way to prove their security based on the standard notions of problem reduction. Recently random oracle model has been proposed for the prove of the security of cryptosystems. In this talk, I will use examples to illustrate the prove of the security of the cryptosystems by using random oracle model.

3 Introduction A cryptosystem C is defined by (P, C, K, E, D), where 1. P is a finite set of pliantexts, 2. C is a finite set of cyphertext, 3. K is a finite set of keys, 4. E is a finite set of encryption functions, and 5. D is a finite set of decryption functions. 1

4 RSA Cryptosystem n = p q; p, q: large distinct primes P = C = Z n K = {(n, e, d) e d 1 (mod φ(n))} e k (x) = x e mod n d k (y) = y d mod n 2

5 To prove a cryptosystem C is secure we must 1. formally define the security requirements of C, and 2. show that C satisfies the security requirements. 3

6 The security of RSA RSA is secure if for every y C it is hard to compute x, x e y (mod n). By the above definition, RSA is not secure, since 1 e 1 (mod n) Any acceptable security definitions to make RSA secure? Is RSA secure? 4

7 How to Show a Problem is Hard? L = < Show that it needs at least L computational steps to solve the problem. Time complexity T (n), or space complexity S(n), of a problem. Lower bound of a problem. Very few problems lower bounds have been proved. 5

8 How to Show a Problem is Hard? Show that the most efficient algorithm known today to solve the problem needs at least L computational steps. Some problems are hard to solve by the best known algorithms. NP-Complete problems: No polynomial time algorithms have been discovered. Factoring an integer, Discrete logarithm problem: O(e α(log n)β (log log n) (1 β) ), where β = 1/3 for number field sieve. 6

9 Problem Reduction 1. select a problem P which is known to be hard to solve, 2. reduce the problem P to the security of C. Since P is hard to solve, the cryptosystem C is hard to break. This is called problem reduction. 7

10 Problem Reduction A p B: problem A is polynomial time reducible to problem B if 1. Given an instance I A of A we can construct an instance I B of B such that the solution B(I B ) can be converted into the solution A(I A ). 2. Both the construction of the instance and the conversion of the solution can be done in polynomial time. 8

11 This is called many-one reduction. If A p B then problem B is harder to solve than A. A p B if A p B and B p A. 9

12 Problem Reduction, an Example Let n = p q, where p and q are unknown distinct primes. Problem A: factor n Problem B: solve x 2 a (mod n) for x Theorem 1 A p B. 10

13 A p B: Assume B can be solved in polynomial time, Then the following is a polynomial time probabilistic algorithm to factor n. input: an integer n output: a factor of n method: 1. Randomly select an integer y. 2. If d = gcd(y, n) > 1 then d is a factor of n; stop. 3. Compute a = y 2 mod n. 4. Solve x 2 a (mod n) for x by using algorithm B. 5. If x = ±y then fail; otherwise gcd(x + y, n) is a factor of n. 11

14 B p A: Assume A can be solved in polynomial time. The following is an algorithm to solve x 2 a (mod n) for x in polynomial time. input: two integers a and n output: x, x 2 a (mod n) method: 1. Factor n = pq by using algorithm A. 2. Solve x 2 p a (mod p) for x p. 3. Solve x 2 q a (mod q) for x q. 4. Compute x such that x mod p = x p and x mod q = x q by using Chinese remainder theorem. 12

15 Turing Reduction and Oracle Computation An oracle O B is a hypothetical algorithm for solving problem B. To show that a problem A is solvable by a Turing machine with oracle O B is the same as to show A p B The oracle can be called many times. 13

16 Public-Key Cryptosystem A public-key encryption scheme consists of 1. key generation algorithm K: It is a probabilistic algorithm. On input the security parameter w, K generates public key k p and secrete key k s. 2. encryption algorithm E kp : On input a message m, E kp computes the ciphertext c = E kp (m). The encryption algorithm may be probabilistic. That is, in addition to the message m, it can take a random number r as its input. 3. decryption algorithm D ks : On input a ciphertext c, D ks computes the original message m. 14

17 Semantically Secure A public key cryptosystem is semantically secure if no polynomialtime attacker can learn any information about the plaintext from the ciphertext. 15

18 Define a game G played by two players A and B. 1. A selects two messages m 0 and m 1, and sends them to B. 2. B randomly selects one of the message m j {m 0, m 1 } to encode. The ciphertext c = E kp (m j ) is then given to the A. 3. A determines which one of the messages whose encryption is c, that is. c = E kp (m 0 ) or c = E kp (m 1 ). A wins if A can determine the message whose encryption is c; otherwise B wins. 16

19 Semantically Secure A cryptosystem is semantically secure if the game G is a fair game for both players. That is, A has no strategy with the probability of winning ɛ for any ɛ > 0. In the above game, A should be regarded as a polynomial-time probabilistic Turing machine. That is, A can use only a limited computing resources. 17

20 Random Oracles As mentioned above, it is difficult to find a problem reduction to show that a cryptosystem is secure. In some cases, we can show that a cryptosystem is secure by adding more oracles. These additional oracles are usually hash functions. On input x, the hash function usually responds a random number. On some specific input, the response is a special number which is useful to solve the hard problem. 18

21 An Example Define a cryptosystem C as follows. 1. public functions: f: one-way trap-door function, and h: random number generator. 2. encryption: E kp (m, r) = (f(r), m h(r)), where r is a random number. 3. decryption: (exercise) The one-way trap-door function f is considered to be hard to invert without the trap-door (key). 19

22 Theorem 2 The cryptosystem C is semantically secure. Assume that there is an attacker A with probability of winning ɛ, then there is a Turing machine with random oracle O (or a hash function h) which can invert the one-way trap-door function f with probability of success ɛ. There are two oracles, the attacker A and the random oracle O. Note that ɛ should be non-negligible. That is, ɛ 1/p(w), where p(w) is a polynomial of the security parameter w. 20

23 Construct a Turing machine, T with oracle A and O. On input f and y, T finds r such that f(r) = y. 1. The oracle O. Whenever A makes a query to h(r) (a) If f(r) = y then print r and stop. (b) Otherwise return a random number t. 2. The attacker A. Play the role of A in the game G. 3. After receiving the two messages m 0 and m 1 from A, T randomly selects an s and let c = (y, s). 21

24 We need to show that 1. the random oracle O (or a hash function h) is consistent, and 2. c = (y, s) is the encryption of m 0 or m 1. (Recall that E kp (m, r) = (f(r), m h(r))) 3. the algorithm will succeed with probability ɛ in inverting the function f. 22

25 Digital Signature Scheme A signature scheme consists of 1. key generation algorithm K It is a probabilistic algorithm. On input the security parameter w, K generates public key k p and secrete key k s. 2. signing algorithm S ks On input a message m, S ks computes the signature u = S ks (m). The signing algorithm may be probabilistic. 3. verification algorithm V kp On input a signature u and m, V kp (u, m) = 1 if and only if u is a valid signature of m. 23

26 An Example Define a signature scheme S as follows. 1. public functions: f: one-way trap-door function h: one-way hash function 2. signature: u = S ks (m) = f 1 (h(m)) 3. verification: V kp (u, m) = 1 if and only if f(u) = h(m). 24

27 Polynomial Time Attacker of S An attacker of the signature scheme S is an probabilistic polynomial time algorithm F that can compute a valid signature u for a message m. The attacker F must call hash function for the signature of the message m. In addition, F can also ask for the signature of messages other than m. 25

28 Theorem 3 The signature scheme S is secure. Assume that there is an attacker F with probability of success ɛ, then there is a random oracle O (or a hash function h) that can be used to invert the one-way trap-door function f with probability of success ɛ/r, where r is the number of queries to the random oracle. Assume that F makes r queries to the random oracle, and that it must query h(m) before it can compute the signature of m. 26

29 Given f and y, find r such that f(r) = y. O for h(r): 1. Randomly chooses s [1, r]. 2. Checks if f(r) = y or not. If it is, then print r and stop; otherwise (a) if i = s then return y. (b) if i s then choose a random number t and return f(t). S for the signature: 1. if m = m s then fail; stop; 2. if m m s, it returns t; 27

30 We need to show that the random oracle is consistent and the algorithm will succeed with probability ɛ/r in inverting the function f. m : m 1 m 2 m s... m r u : t 1 t 2 r... t r h(m) : f(t 1 ) f(t 2 ) y... f(t r ) Recall that the signature of m is u = f 1 (h(m i )). 28

31 Summary of the Random Oracle Method To prove that a cryptosystem or a signature scheme is secure, we need to do the following steps. 1. Define the security requirements of the cryptosystem formally. 2. Find a hard problem. 3. Make assumptions that the attacker must do. 4. Use the attacker to solve the hard problem. 29

32 In the above, (1), (2), and (4) are the same as the standard problem reduction. If we make no assumptions on the attacker to break the cryptosystem, then the proof can be converted into a standard problem reduction. In standard problem reduction, we take the attacker as a black box. The theorem we proved in this way is the strongest one. 30

33 As mentioned before, standard problem reduction is difficult to find for almost all cryptosystems, signature schemes, and cryptographic protocols. However, if we make some assumptions on the attacking algorithm, then we can prove the security of some cryptosystems, signature schemes, or cryptographic protocols. The more assumptions we make, the weaker the theorems are. 31

34 Assumptions we can make on the attacking algorithm include 1. calls to the hash function, 2. calls to the signature function, 3. etc. In addition to the above assumptions, we can also rewrite the hash function, etc. In doing these, we must must make everything consistent. We should also make these functions provided by us look the same as the real functions to the attacking algorithm. 32

35 Since it is believed that the attacking algorithm should work for every reasonable hash functions, the attacking algorithm should also work for the function provided by us. What have we proved by using the random oracle model and play the role of generating the values for the hash function? We have shown that there exists a hash functions which, together with the attacking algorithm, can allow us to solve some hard problems. Since we believe that the attacking algorithm works for any reasonable hash functions, the attacking algorithm, if it exists, can be used to solve hard problems. 33

36 References 1. Mihir Bellare and Phillip Rogaway. Random oracles are practical: A paradigm for designing efficient protocols. In Proceedings of the First ACM Conference on computer and Communication, pages 62 73, New York, November ACM Press. 2. Shafi Goldwasser and Silvio Micali. Probabilistic encryption. Journal of Computer and System Sciences, 28: , 1984.

Family Name:... First Name:... Section:... Advanced Cryptography Final Exam July 18 th, 2006 Start at 9:15, End at 12:00 This document consists of 12 pages. Instructions Electronic devices are not allowed.

### Improved Online/Offline Signature Schemes

Improved Online/Offline Signature Schemes Adi Shamir and Yael Tauman Applied Math. Dept. The Weizmann Institute of Science Rehovot 76100, Israel {shamir,tauman}@wisdom.weizmann.ac.il Abstract. The notion

### 1 Digital Signatures. 1.1 The RSA Function: The eth Power Map on Z n. Crypto: Primitives and Protocols Lecture 6.

1 Digital Signatures A digital signature is a fundamental cryptographic primitive, technologically equivalent to a handwritten signature. In many applications, digital signatures are used as building blocks

### Public Key Cryptography. c Eli Biham - March 30, 2011 258 Public Key Cryptography

Public Key Cryptography c Eli Biham - March 30, 2011 258 Public Key Cryptography Key Exchange All the ciphers mentioned previously require keys known a-priori to all the users, before they can encrypt

### CIS 5371 Cryptography. 8. Encryption --

CIS 5371 Cryptography p y 8. Encryption -- Asymmetric Techniques Textbook encryption algorithms In this chapter, security (confidentiality) is considered in the following sense: All-or-nothing secrecy.

### Universal Padding Schemes for RSA

Universal Padding Schemes for RSA Jean-Sébastien Coron, Marc Joye, David Naccache, and Pascal Paillier Gemplus Card International, France {jean-sebastien.coron, marc.joye, david.naccache, pascal.paillier}@gemplus.com

### The mathematics of cryptology

The mathematics of cryptology Paul E. Gunnells Department of Mathematics and Statistics University of Massachusetts, Amherst Amherst, MA 01003 www.math.umass.edu/ gunnells April 27, 2004 What is Cryptology?

### In this paper a new signature scheme and a public key cryptotsystem are proposed. They can be seen as a compromise between the RSA and ElGamal-type sc

Digital Signature and Public Key Cryptosystem in a Prime Order Subgroup of Z n Colin Boyd Information Security Research Centre, School of Data Communications Queensland University of Technology, Brisbane

### Key Privacy for Identity Based Encryption

Key Privacy for Identity Based Encryption Internet Security Research Lab Technical Report 2006-2 Jason E. Holt Internet Security Research Lab Brigham Young University c 2006 Brigham Young University March

### Lecture 15 - Digital Signatures

Lecture 15 - Digital Signatures Boaz Barak March 29, 2010 Reading KL Book Chapter 12. Review Trapdoor permutations - easy to compute, hard to invert, easy to invert with trapdoor. RSA and Rabin signatures.

### Cryptography: RSA and the discrete logarithm problem

Cryptography: and the discrete logarithm problem R. Hayden Advanced Maths Lectures Department of Computing Imperial College London February 2010 Public key cryptography Assymmetric cryptography two keys:

### Outline. Computer Science 418. Digital Signatures: Observations. Digital Signatures: Definition. Definition 1 (Digital signature) Digital Signatures

Outline Computer Science 418 Digital Signatures Mike Jacobson Department of Computer Science University of Calgary Week 12 1 Digital Signatures 2 Signatures via Public Key Cryptosystems 3 Provable 4 Mike

### CSC474/574 - Information Systems Security: Homework1 Solutions Sketch

CSC474/574 - Information Systems Security: Homework1 Solutions Sketch February 20, 2005 1. Consider slide 12 in the handout for topic 2.2. Prove that the decryption process of a one-round Feistel cipher

### Lecture 9 - Message Authentication Codes

Lecture 9 - Message Authentication Codes Boaz Barak March 1, 2010 Reading: Boneh-Shoup chapter 6, Sections 9.1 9.3. Data integrity Until now we ve only been interested in protecting secrecy of data. However,

### Introduction. Digital Signature

Introduction Electronic transactions and activities taken place over Internet need to be protected against all kinds of interference, accidental or malicious. The general task of the information technology

### Shor s algorithm and secret sharing

Shor s algorithm and secret sharing Libor Nentvich: QC 23 April 2007: Shor s algorithm and secret sharing 1/41 Goals: 1 To explain why the factoring is important. 2 To describe the oldest and most successful

### Proofs in Cryptography

Proofs in Cryptography Ananth Raghunathan Abstract We give a brief overview of proofs in cryptography at a beginners level. We briefly cover a general way to look at proofs in cryptography and briefly

### Identity-Based Encryption from the Weil Pairing

Appears in SIAM J. of Computing, Vol. 32, No. 3, pp. 586-615, 2003. An extended abstract of this paper appears in the Proceedings of Crypto 2001, volume 2139 of Lecture Notes in Computer Science, pages

### Capture Resilient ElGamal Signature Protocols

Capture Resilient ElGamal Signature Protocols Hüseyin Acan 1, Kamer Kaya 2,, and Ali Aydın Selçuk 2 1 Bilkent University, Department of Mathematics acan@fen.bilkent.edu.tr 2 Bilkent University, Department

### Elements of Applied Cryptography Public key encryption

Network Security Elements of Applied Cryptography Public key encryption Public key cryptosystem RSA and the factorization problem RSA in practice Other asymmetric ciphers Asymmetric Encryption Scheme Let

### U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra

U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory

### Overview of Public-Key Cryptography

CS 361S Overview of Public-Key Cryptography Vitaly Shmatikov slide 1 Reading Assignment Kaufman 6.1-6 slide 2 Public-Key Cryptography public key public key? private key Alice Bob Given: Everybody knows

### An Overview of Common Adversary Models

An Overview of Common Adversary Karl Palmskog palmskog@kth.se 2012-03-29 Introduction Requirements of Software Systems 1 Functional Correctness: partial, termination, liveness, safety,... 2 Nonfunctional

### CIS 6930 Emerging Topics in Network Security. Topic 2. Network Security Primitives

CIS 6930 Emerging Topics in Network Security Topic 2. Network Security Primitives 1 Outline Absolute basics Encryption/Decryption; Digital signatures; D-H key exchange; Hash functions; Application of hash

### Post-Quantum Cryptography #4

Post-Quantum Cryptography #4 Prof. Claude Crépeau McGill University http://crypto.cs.mcgill.ca/~crepeau/waterloo 185 ( 186 Attack scenarios Ciphertext-only attack: This is the most basic type of attack

### Victor Shoup Avi Rubin. fshoup,rubing@bellcore.com. Abstract

Session Key Distribution Using Smart Cards Victor Shoup Avi Rubin Bellcore, 445 South St., Morristown, NJ 07960 fshoup,rubing@bellcore.com Abstract In this paper, we investigate a method by which smart

### QUANTUM COMPUTERS AND CRYPTOGRAPHY. Mark Zhandry Stanford University

QUANTUM COMPUTERS AND CRYPTOGRAPHY Mark Zhandry Stanford University Classical Encryption pk m c = E(pk,m) sk m = D(sk,c) m??? Quantum Computing Attack pk m aka Post-quantum Crypto c = E(pk,m) sk m = D(sk,c)

### Security Arguments for Digital Signatures and Blind Signatures

Journal of Cryptology, Volume 13, Number 3. Pages 361 396, Springer-Verlag, 2000. 2000 International Association for Cryptologic Research Security Arguments for Digital Signatures and Blind Signatures

### Lukasz Pater CMMS Administrator and Developer

Lukasz Pater CMMS Administrator and Developer EDMS 1373428 Agenda Introduction Why do we need asymmetric ciphers? One-way functions RSA Cipher Message Integrity Examples Secure Socket Layer Single Sign

### Textbook: Introduction to Cryptography 2nd ed. By J.A. Buchmann Chap 12 Digital Signatures

Textbook: Introduction to Cryptography 2nd ed. By J.A. Buchmann Chap 12 Digital Signatures Department of Computer Science and Information Engineering, Chaoyang University of Technology 朝 陽 科 技 大 學 資 工

### Ch.9 Cryptography. The Graduate Center, CUNY.! CSc 75010 Theoretical Computer Science Konstantinos Vamvourellis

Ch.9 Cryptography The Graduate Center, CUNY! CSc 75010 Theoretical Computer Science Konstantinos Vamvourellis Why is Modern Cryptography part of a Complexity course? Short answer:! Because Modern Cryptography

### Outline. CSc 466/566. Computer Security. 8 : Cryptography Digital Signatures. Digital Signatures. Digital Signatures... Christian Collberg

Outline CSc 466/566 Computer Security 8 : Cryptography Digital Signatures Version: 2012/02/27 16:07:05 Department of Computer Science University of Arizona collberg@gmail.com Copyright c 2012 Christian

### Lecture 13: Factoring Integers

CS 880: Quantum Information Processing 0/4/0 Lecture 3: Factoring Integers Instructor: Dieter van Melkebeek Scribe: Mark Wellons In this lecture, we review order finding and use this to develop a method

### The Mathematics of the RSA Public-Key Cryptosystem

The Mathematics of the RSA Public-Key Cryptosystem Burt Kaliski RSA Laboratories ABOUT THE AUTHOR: Dr Burt Kaliski is a computer scientist whose involvement with the security industry has been through

### Computer Security: Principles and Practice

Computer Security: Principles and Practice Chapter 20 Public-Key Cryptography and Message Authentication First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Public-Key Cryptography

### A Factoring and Discrete Logarithm based Cryptosystem

Int. J. Contemp. Math. Sciences, Vol. 8, 2013, no. 11, 511-517 HIKARI Ltd, www.m-hikari.com A Factoring and Discrete Logarithm based Cryptosystem Abdoul Aziz Ciss and Ahmed Youssef Ecole doctorale de Mathematiques

### Principles of Public Key Cryptography. Applications of Public Key Cryptography. Security in Public Key Algorithms

Principles of Public Key Cryptography Chapter : Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter : Security on Network and Transport

### RSA Attacks. By Abdulaziz Alrasheed and Fatima

RSA Attacks By Abdulaziz Alrasheed and Fatima 1 Introduction Invented by Ron Rivest, Adi Shamir, and Len Adleman [1], the RSA cryptosystem was first revealed in the August 1977 issue of Scientific American.

### Secure Network Communication Part II II Public Key Cryptography. Public Key Cryptography

Kommunikationssysteme (KSy) - Block 8 Secure Network Communication Part II II Public Key Cryptography Dr. Andreas Steffen 2000-2001 A. Steffen, 28.03.2001, KSy_RSA.ppt 1 Secure Key Distribution Problem

### CSCE 465 Computer & Network Security

CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Public Key Cryptogrophy 1 Roadmap Introduction RSA Diffie-Hellman Key Exchange Public key and

### An Introduction to the RSA Encryption Method

April 17, 2012 Outline 1 History 2 3 4 5 History RSA stands for Rivest, Shamir, and Adelman, the last names of the designers It was first published in 1978 as one of the first public-key crytographic systems

### The Bit Security of Paillier s Encryption Scheme and its Applications

The Bit Security of Paillier s Encryption Scheme and its Applications Dario Catalano 1, Rosario Gennaro and Nick Howgrave-Graham 1 Dipartimento di Matematica e Informatica Università di Catania. Viale

Chapter 11 Theory of Computation 2007 Pearson Addison-Wesley. All rights reserved Chapter 11: Theory of Computation 11.1 Functions and Their Computation 11.2 Turing Machines 11.3 Universal Programming

### MESSAGE AUTHENTICATION IN AN IDENTITY-BASED ENCRYPTION SCHEME: 1-KEY-ENCRYPT-THEN-MAC

MESSAGE AUTHENTICATION IN AN IDENTITY-BASED ENCRYPTION SCHEME: 1-KEY-ENCRYPT-THEN-MAC by Brittanney Jaclyn Amento A Thesis Submitted to the Faculty of The Charles E. Schmidt College of Science in Partial

### Outline. Cryptography. Bret Benesh. Math 331

Outline 1 College of St. Benedict/St. John s University Department of Mathematics Math 331 2 3 The internet is a lawless place, and people have access to all sorts of information. What is keeping people

### Breaking Generalized Diffie-Hellman Modulo a Composite is no Easier than Factoring

Breaking Generalized Diffie-Hellman Modulo a Composite is no Easier than Factoring Eli Biham Dan Boneh Omer Reingold Abstract The Diffie-Hellman key-exchange protocol may naturally be extended to k > 2

### Lecture 6 - Cryptography

Lecture 6 - Cryptography CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07 Question 2 Setup: Assume you and I don t know anything about

### Lecture Notes on Cryptography

Lecture Notes on Cryptography Shafi Goldwasser 1 Mihir Bellare 2 July 2008 1 MIT Computer Science and Artificial Intelligence Laboratory, The Stata Center, Building 32, 32 Vassar Street, Cambridge, MA

### Public Key Cryptography and RSA. Review: Number Theory Basics

Public Key Cryptography and RSA Murat Kantarcioglu Based on Prof. Ninghui Li s Slides Review: Number Theory Basics Definition An integer n > 1 is called a prime number if its positive divisors are 1 and

### Cryptographic hash functions and MACs Solved Exercises for Cryptographic Hash Functions and MACs

Cryptographic hash functions and MACs Solved Exercises for Cryptographic Hash Functions and MACs Enes Pasalic University of Primorska Koper, 2014 Contents 1 Preface 3 2 Problems 4 2 1 Preface This is a

### Lecture 3: One-Way Encryption, RSA Example

ICS 180: Introduction to Cryptography April 13, 2004 Lecturer: Stanislaw Jarecki Lecture 3: One-Way Encryption, RSA Example 1 LECTURE SUMMARY We look at a different security property one might require

### Guaranteed Slowdown, Generalized Encryption Scheme, and Function Sharing

Guaranteed Slowdown, Generalized Encryption Scheme, and Function Sharing Yury Lifshits July 10, 2005 Abstract The goal of the paper is to construct mathematical abstractions of different aspects of real

### Paillier Threshold Encryption Toolbox

Paillier Threshold Encryption Toolbox October 23, 2010 1 Introduction Following a desire for secure (encrypted) multiparty computation, the University of Texas at Dallas Data Security and Privacy Lab created

### 1 Message Authentication

Theoretical Foundations of Cryptography Lecture Georgia Tech, Spring 200 Message Authentication Message Authentication Instructor: Chris Peikert Scribe: Daniel Dadush We start with some simple questions

### MATH 168: FINAL PROJECT Troels Eriksen. 1 Introduction

MATH 168: FINAL PROJECT Troels Eriksen 1 Introduction In the later years cryptosystems using elliptic curves have shown up and are claimed to be just as secure as a system like RSA with much smaller key

### SECURITY IMPROVMENTS TO THE DIFFIE-HELLMAN SCHEMES

www.arpapress.com/volumes/vol8issue1/ijrras_8_1_10.pdf SECURITY IMPROVMENTS TO THE DIFFIE-HELLMAN SCHEMES Malek Jakob Kakish Amman Arab University, Department of Computer Information Systems, P.O.Box 2234,

### Signature Schemes. CSG 252 Fall 2006. Riccardo Pucella

Signature Schemes CSG 252 Fall 2006 Riccardo Pucella Signatures Signatures in real life have a number of properties They specify the person responsible for a document E.g. that it has been produced by

### 9 Modular Exponentiation and Cryptography

9 Modular Exponentiation and Cryptography 9.1 Modular Exponentiation Modular arithmetic is used in cryptography. In particular, modular exponentiation is the cornerstone of what is called the RSA system.

### 6.080 / 6.089 Great Ideas in Theoretical Computer Science Spring 2008

MIT OpenCourseWare http://ocw.mit.edu 6.080 / 6.089 Great Ideas in Theoretical Computer Science Spring 2008 For information about citing these materials or our Terms of Use, visit: http://ocw.mit.edu/terms.

### Privacy-Providing Signatures and Their Applications. PhD Thesis. Author: Somayeh Heidarvand. Advisor: Jorge L. Villar

Privacy-Providing Signatures and Their Applications PhD Thesis Author: Somayeh Heidarvand Advisor: Jorge L. Villar Privacy-Providing Signatures and Their Applications by Somayeh Heidarvand In fulfillment

### Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption

Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption Ronald Cramer Victor Shoup December 12, 2001 Abstract We present several new and fairly practical public-key

### 1 Signatures vs. MACs

CS 120/ E-177: Introduction to Cryptography Salil Vadhan and Alon Rosen Nov. 22, 2006 Lecture Notes 17: Digital Signatures Recommended Reading. Katz-Lindell 10 1 Signatures vs. MACs Digital signatures

### Lecture Note 5 PUBLIC-KEY CRYPTOGRAPHY. Sourav Mukhopadhyay

Lecture Note 5 PUBLIC-KEY CRYPTOGRAPHY Sourav Mukhopadhyay Cryptography and Network Security - MA61027 Modern/Public-key cryptography started in 1976 with the publication of the following paper. W. Diffie

### Study of algorithms for factoring integers and computing discrete logarithms

Study of algorithms for factoring integers and computing discrete logarithms First Indo-French Workshop on Cryptography and Related Topics (IFW 2007) June 11 13, 2007 Paris, France Dr. Abhijit Das Department

### The application of prime numbers to RSA encryption

The application of prime numbers to RSA encryption Prime number definition: Let us begin with the definition of a prime number p The number p, which is a member of the set of natural numbers N, is considered

### RSA Question 2. Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true?

RSA Question 2 Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true? Bob chooses a random e (1 < e < Φ Bob ) such that gcd(e,φ Bob )=1. Then, d = e -1

### Cryptography and Network Security

Cryptography and Network Security Fifth Edition by William Stallings Chapter 9 Public Key Cryptography and RSA Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared

### Network Security. Chapter 2 Basics 2.2 Public Key Cryptography. Public Key Cryptography. Public Key Cryptography

Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Encryption/Decryption using Public Key Cryptography Network Security Chapter 2 Basics 2.2 Public Key Cryptography

### Digital Signatures. Prof. Zeph Grunschlag

Digital Signatures Prof. Zeph Grunschlag (Public Key) Digital Signatures PROBLEM: Alice would like to prove to Bob, Carla, David,... that has really sent them a claimed message. E GOAL: Alice signs each

### Cryptography and Network Security Chapter 9

Cryptography and Network Security Chapter 9 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 9 Public Key Cryptography and RSA Every Egyptian received two names,

### Twin Signatures: an Alternative to the Hash-and-Sign Paradigm

Proceedings of the 8th ACM Conference on Computer and Communications Security. Pages 20 27. (november 5 8, 2001, Philadelphia, Pennsylvania, USA) Twin Signatures: an Alternative to the Hash-and-Sign Paradigm

### On Factoring Integers and Evaluating Discrete Logarithms

On Factoring Integers and Evaluating Discrete Logarithms A thesis presented by JOHN AARON GREGG to the departments of Mathematics and Computer Science in partial fulfillment of the honors requirements

### Public Key (asymmetric) Cryptography

Public-Key Cryptography UNIVERSITA DEGLI STUDI DI PARMA Dipartimento di Ingegneria dell Informazione Public Key (asymmetric) Cryptography Luca Veltri (mail.to: luca.veltri@unipr.it) Course of Network Security,

### VoteID 2011 Internet Voting System with Cast as Intended Verification

VoteID 2011 Internet Voting System with Cast as Intended Verification September 2011 VP R&D Jordi Puiggali@scytl.com Index Introduction Proposal Security Conclusions 2. Introduction Client computers could

### Threshold Identity Based Encryption Scheme without Random Oracles

WCAN 2006 Threshold Identity Based Encryption Scheme without Random Oracles Jin Li School of Mathematics and Computational Science Sun Yat-sen University Guangzhou, P.R. China Yanming Wang Lingnan College

### LUC: A New Public Key System

LUC: A New Public Key System Peter J. Smith a and Michael J. J. Lennon b a LUC Partners, Auckland UniServices Ltd, The University of Auckland, Private Bag 92019, Auckland, New Zealand. b Department of

### Lecture 2: Complexity Theory Review and Interactive Proofs

600.641 Special Topics in Theoretical Cryptography January 23, 2007 Lecture 2: Complexity Theory Review and Interactive Proofs Instructor: Susan Hohenberger Scribe: Karyn Benson 1 Introduction to Cryptography

### Chosen-Ciphertext Security from Identity-Based Encryption

Chosen-Ciphertext Security from Identity-Based Encryption Dan Boneh Ran Canetti Shai Halevi Jonathan Katz June 13, 2006 Abstract We propose simple and efficient CCA-secure public-key encryption schemes

### Fuzzy Identity-Based Encryption

Fuzzy Identity-Based Encryption Janek Jochheim June 20th 2013 Overview Overview Motivation (Fuzzy) Identity-Based Encryption Formal definition Security Idea Ingredients Construction Security Extensions

### Lecture 25: Pairing-Based Cryptography

6.897 Special Topics in Cryptography Instructors: Ran Canetti and Ron Rivest May 5, 2004 Lecture 25: Pairing-Based Cryptography Scribe: Ben Adida 1 Introduction The field of Pairing-Based Cryptography

### Public Key Cryptography: RSA and Lots of Number Theory

Public Key Cryptography: RSA and Lots of Number Theory Public vs. Private-Key Cryptography We have just discussed traditional symmetric cryptography: Uses a single key shared between sender and receiver

### CS 758: Cryptography / Network Security

CS 758: Cryptography / Network Security offered in the Fall Semester, 2003, by Doug Stinson my office: DC 3122 my email address: dstinson@uwaterloo.ca my web page: http://cacr.math.uwaterloo.ca/~dstinson/index.html

### Alternative machine models

Alternative machine models Computational complexity thesis: All reasonable computer models can simulate one another in polynomial time (i.e. P is robust or machine independent ). But the Turing machine

### Chapter 12. Digital signatures. 12.1 Digital signature schemes

Chapter 12 Digital signatures In the public key setting, the primitive used to provide data integrity is a digital signature scheme. In this chapter we look at security notions and constructions for this

### 3. Applications of Number Theory

3. APPLICATIONS OF NUMBER THEORY 163 3. Applications of Number Theory 3.1. Representation of Integers. Theorem 3.1.1. Given an integer b > 1, every positive integer n can be expresses uniquely as n = a

### Non-Black-Box Techniques In Crytpography. Thesis for the Ph.D degree Boaz Barak

Non-Black-Box Techniques In Crytpography Introduction Thesis for the Ph.D degree Boaz Barak A computer program (or equivalently, an algorithm) is a list of symbols a finite string. When we interpret a

MACs Message authentication and integrity Foundations of Cryptography Computer Science Department Wellesley College Table of contents Introduction MACs Constructing Secure MACs Secure communication and

### Crittografia e sicurezza delle reti. Digital signatures- DSA

Crittografia e sicurezza delle reti Digital signatures- DSA Signatures vs. MACs Suppose parties A and B share the secret key K. Then M, MAC K (M) convinces A that indeed M originated with B. But in case

### Non-interactive and Reusable Non-malleable Commitment Schemes

Non-interactive and Reusable Non-malleable Commitment Schemes Ivan Damgård a Jens Groth b June 16, 2003 Abstract We consider non-malleable (NM) and universally composable (UC) commitment schemes in the

### DIRECT ONLINE/OFFLINE DIGITAL SIGNATURE SCHEMES. Ping Yu, M.S. Dissertation Prepared for the Degree of DOCTOR OF PHILOSOPHY UNIVERSITY OF NORTH TEXAS

DIRECT ONLINE/OFFLINE DIGITAL SIGNATURE SCHEMES Ping Yu, M.S. Dissertation Prepared for the Degree of DOCTOR OF PHILOSOPHY UNIVERSITY OF NORTH TEXAS December 2008 APPROVED: Stephen R. Tate, Major Professor

### Enhancing privacy with quantum networks

Enhancing privacy with quantum networks P. Mateus N. Paunković J. Rodrigues A. Souto SQIG- Instituto de Telecomunicações and DM - Instituto Superior Técnico - Universidade de Lisboa Abstract Using quantum

### Message Authentication Code

Message Authentication Code Ali El Kaafarani Mathematical Institute Oxford University 1 of 44 Outline 1 CBC-MAC 2 Authenticated Encryption 3 Padding Oracle Attacks 4 Information Theoretic MACs 2 of 44

### On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order

J. Cryptology (2006) 19: 463 487 DOI: 10.1007/s00145-006-0224-0 2006 International Association for Cryptologic Research On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order

### RSA OAEP is Secure under the RSA Assumption

This is a revised version of the extended abstract RSA OAEP is Secure under the RSA Assumption which appeared in Advances in Cryptology Proceedings of CRYPTO 2001 (19 23 august 2001, Santa Barbara, California,

### Discrete Mathematics, Chapter 4: Number Theory and Cryptography

Discrete Mathematics, Chapter 4: Number Theory and Cryptography Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 4 1 / 35 Outline 1 Divisibility

### 1 Domain Extension for MACs

CS 127/CSCI E-127: Introduction to Cryptography Prof. Salil Vadhan Fall 2013 Reading. Lecture Notes 17: MAC Domain Extension & Digital Signatures Katz-Lindell Ÿ4.34.4 (2nd ed) and Ÿ12.0-12.3 (1st ed).

### The Exact Security of Digital Signatures How to Sign with RSA and Rabin

Appears in Advances in Cryptology Eurocrypt 96 Proceedings, Lecture Notes in Computer Science Vol. 1070, U. Maurer ed., Springer-Verlag, 1996. The Exact Security of Digital Signatures How to Sign with