Provably Secure Cryptography: State of the Art and Industrial Applications


 Job Ford
 1 years ago
 Views:
Transcription
1 Provably Secure Cryptography: State of the Art and Industrial Applications Pascal Paillier Gemplus/R&D/ARSC/STD/Advanced Cryptographic Services FrenchJapanese Joint Symposium on Computer Security
2 Outline Outline What is provable security? Security Proofs for Signatures Security Proofs for Encryption Designing Cryptosystems Proof Techniques Present and Future Trends
3 What is provable security? Focus on Provable Security Focus on Provable Security Our ultimate goal: Providing evidence that a given cryptographic protocol is secure Find new ways of building secure protocols Cryptographic protocols contain basic ingredients Asymmetric encryption schemes (and variations), Signature schemes (and variations),... So the first thing to do is trying to prove the security of these two primitives. But what does it mean to be secure?
4 What is provable security? Focus on Provable Security Focus on Provable Security Our ultimate goal: Providing evidence that a given cryptographic protocol is secure Find new ways of building secure protocols Cryptographic protocols contain basic ingredients Asymmetric encryption schemes (and variations), Signature schemes (and variations),... So the first thing to do is trying to prove the security of these two primitives. But what does it mean to be secure?
5 What is provable security? Focus on Provable Security Focus on Provable Security Our ultimate goal: Providing evidence that a given cryptographic protocol is secure Find new ways of building secure protocols Cryptographic protocols contain basic ingredients Asymmetric encryption schemes (and variations), Signature schemes (and variations),... So the first thing to do is trying to prove the security of these two primitives. But what does it mean to be secure?
6 What is provable security? Focus on Provable Security Focus on Provable Security Our ultimate goal: Providing evidence that a given cryptographic protocol is secure Find new ways of building secure protocols Cryptographic protocols contain basic ingredients Asymmetric encryption schemes (and variations), Signature schemes (and variations),... So the first thing to do is trying to prove the security of these two primitives. But what does it mean to be secure?
7 What is provable security? Focus on Provable Security Focus on Provable Security Our ultimate goal: Providing evidence that a given cryptographic protocol is secure Find new ways of building secure protocols Cryptographic protocols contain basic ingredients Asymmetric encryption schemes (and variations), Signature schemes (and variations),... So the first thing to do is trying to prove the security of these two primitives. But what does it mean to be secure?
8 What is provable security? Focus on Provable Security Focus on Provable Security Our ultimate goal: Providing evidence that a given cryptographic protocol is secure Find new ways of building secure protocols Cryptographic protocols contain basic ingredients Asymmetric encryption schemes (and variations), Signature schemes (and variations),... So the first thing to do is trying to prove the security of these two primitives. But what does it mean to be secure?
9 What is provable security? Focus on Provable Security Focus on Provable Security Our ultimate goal: Providing evidence that a given cryptographic protocol is secure Find new ways of building secure protocols Cryptographic protocols contain basic ingredients Asymmetric encryption schemes (and variations), Signature schemes (and variations),... So the first thing to do is trying to prove the security of these two primitives. But what does it mean to be secure?
10 What is provable security? Focus on Provable Security Focus on Provable Security Our ultimate goal: Providing evidence that a given cryptographic protocol is secure Find new ways of building secure protocols Cryptographic protocols contain basic ingredients Asymmetric encryption schemes (and variations), Signature schemes (and variations),... So the first thing to do is trying to prove the security of these two primitives. But what does it mean to be secure?
11 What is provable security? Focus on Provable Security Focus on Provable Security Our ultimate goal: Providing evidence that a given cryptographic protocol is secure Find new ways of building secure protocols Cryptographic protocols contain basic ingredients Asymmetric encryption schemes (and variations), Signature schemes (and variations),... So the first thing to do is trying to prove the security of these two primitives. But what does it mean to be secure?
12 What is provable security? Focus on Provable Security Focus on Provable Security Our ultimate goal: Providing evidence that a given cryptographic protocol is secure Find new ways of building secure protocols Cryptographic protocols contain basic ingredients Asymmetric encryption schemes (and variations), Signature schemes (and variations),... So the first thing to do is trying to prove the security of these two primitives. But what does it mean to be secure?
13 What is provable security? How Can One Prove Security? How Can One Prove Security? Once a cryptosystem is described, how can we prove its security? By trying to mount an attack Attack found system insecure! Attack not found nothing can be said By proving that no attack exists under some assumptions Public verifiability of the proof Attack found false assumption When a security proof is provided, no one should be able to highlight a system defect. But the assumption has to be reasonnable... (e.g. the KoLee assumption over Braid groups was recently proven wrong).
14 What is provable security? How Can One Prove Security? How Can One Prove Security? Once a cryptosystem is described, how can we prove its security? By trying to mount an attack Attack found system insecure! Attack not found nothing can be said By proving that no attack exists under some assumptions Public verifiability of the proof Attack found false assumption When a security proof is provided, no one should be able to highlight a system defect. But the assumption has to be reasonnable... (e.g. the KoLee assumption over Braid groups was recently proven wrong).
15 What is provable security? How Can One Prove Security? How Can One Prove Security? Once a cryptosystem is described, how can we prove its security? By trying to mount an attack Attack found system insecure! Attack not found nothing can be said By proving that no attack exists under some assumptions Public verifiability of the proof Attack found false assumption When a security proof is provided, no one should be able to highlight a system defect. But the assumption has to be reasonnable... (e.g. the KoLee assumption over Braid groups was recently proven wrong).
16 What is provable security? How Can One Prove Security? How Can One Prove Security? Once a cryptosystem is described, how can we prove its security? By trying to mount an attack Attack found system insecure! Attack not found nothing can be said By proving that no attack exists under some assumptions Public verifiability of the proof Attack found false assumption When a security proof is provided, no one should be able to highlight a system defect. But the assumption has to be reasonnable... (e.g. the KoLee assumption over Braid groups was recently proven wrong).
17 What is provable security? How Can One Prove Security? How Can One Prove Security? Once a cryptosystem is described, how can we prove its security? By trying to mount an attack Attack found system insecure! Attack not found nothing can be said By proving that no attack exists under some assumptions Public verifiability of the proof Attack found false assumption When a security proof is provided, no one should be able to highlight a system defect. But the assumption has to be reasonnable... (e.g. the KoLee assumption over Braid groups was recently proven wrong).
18 What is provable security? How Can One Prove Security? How Can One Prove Security? Once a cryptosystem is described, how can we prove its security? By trying to mount an attack Attack found system insecure! Attack not found nothing can be said By proving that no attack exists under some assumptions Public verifiability of the proof Attack found false assumption When a security proof is provided, no one should be able to highlight a system defect. But the assumption has to be reasonnable... (e.g. the KoLee assumption over Braid groups was recently proven wrong).
19 What is provable security? How Can One Prove Security? How Can One Prove Security? Once a cryptosystem is described, how can we prove its security? By trying to mount an attack Attack found system insecure! Attack not found nothing can be said By proving that no attack exists under some assumptions Public verifiability of the proof Attack found false assumption When a security proof is provided, no one should be able to highlight a system defect. But the assumption has to be reasonnable... (e.g. the KoLee assumption over Braid groups was recently proven wrong).
20 What is provable security? How Can One Prove Security? How Can One Prove Security? Once a cryptosystem is described, how can we prove its security? By trying to mount an attack Attack found system insecure! Attack not found nothing can be said By proving that no attack exists under some assumptions Public verifiability of the proof Attack found false assumption When a security proof is provided, no one should be able to highlight a system defect. But the assumption has to be reasonnable... (e.g. the KoLee assumption over Braid groups was recently proven wrong).
21 What is provable security? How Can One Prove Security? How Can One Prove Security? Once a cryptosystem is described, how can we prove its security? By trying to mount an attack Attack found system insecure! Attack not found nothing can be said By proving that no attack exists under some assumptions Public verifiability of the proof Attack found false assumption When a security proof is provided, no one should be able to highlight a system defect. But the assumption has to be reasonnable... (e.g. the KoLee assumption over Braid groups was recently proven wrong).
22 What is provable security? How Can One Prove Security? How Can One Prove Security? Once a cryptosystem is described, how can we prove its security? By trying to mount an attack Attack found system insecure! Attack not found nothing can be said By proving that no attack exists under some assumptions Public verifiability of the proof Attack found false assumption When a security proof is provided, no one should be able to highlight a system defect. But the assumption has to be reasonnable... (e.g. the KoLee assumption over Braid groups was recently proven wrong).
23 What is provable security? Provable Security is Desired Provable Security is Desired Efficient proven secure schemes have been discovered Sign. PSS(R)RSA, GHR, CramerShoup, EDL... Enc. RSAOAEP, CramerShoup,... There exist generic conversions to create more of them Sign. FiatShamir heuristic applied to ZKPK Enc. OAEP(+/++), FujisakiOkamoto, REACT, GEMI, GEMII,... Provably secure schemes are adopted in standards Sign. PSS in IEEE P1363a and PKCS#1 v2.1. Enc. RSAOAEP in PKCS#1 v2.0, P1363a DHIES in ANSI X9.63, P1363a. Standard bodies ask for security proofs along with submissions
24 What is provable security? Provable Security is Desired Provable Security is Desired Efficient proven secure schemes have been discovered Sign. PSS(R)RSA, GHR, CramerShoup, EDL... Enc. RSAOAEP, CramerShoup,... There exist generic conversions to create more of them Sign. FiatShamir heuristic applied to ZKPK Enc. OAEP(+/++), FujisakiOkamoto, REACT, GEMI, GEMII,... Provably secure schemes are adopted in standards Sign. PSS in IEEE P1363a and PKCS#1 v2.1. Enc. RSAOAEP in PKCS#1 v2.0, P1363a DHIES in ANSI X9.63, P1363a. Standard bodies ask for security proofs along with submissions
25 What is provable security? Provable Security is Desired Provable Security is Desired Efficient proven secure schemes have been discovered Sign. PSS(R)RSA, GHR, CramerShoup, EDL... Enc. RSAOAEP, CramerShoup,... There exist generic conversions to create more of them Sign. FiatShamir heuristic applied to ZKPK Enc. OAEP(+/++), FujisakiOkamoto, REACT, GEMI, GEMII,... Provably secure schemes are adopted in standards Sign. PSS in IEEE P1363a and PKCS#1 v2.1. Enc. RSAOAEP in PKCS#1 v2.0, P1363a DHIES in ANSI X9.63, P1363a. Standard bodies ask for security proofs along with submissions
26 What is provable security? Provable Security is Desired Provable Security is Desired Efficient proven secure schemes have been discovered Sign. PSS(R)RSA, GHR, CramerShoup, EDL... Enc. RSAOAEP, CramerShoup,... There exist generic conversions to create more of them Sign. FiatShamir heuristic applied to ZKPK Enc. OAEP(+/++), FujisakiOkamoto, REACT, GEMI, GEMII,... Provably secure schemes are adopted in standards Sign. PSS in IEEE P1363a and PKCS#1 v2.1. Enc. RSAOAEP in PKCS#1 v2.0, P1363a DHIES in ANSI X9.63, P1363a. Standard bodies ask for security proofs along with submissions
27 What is provable security? Provable Security is Desired Provable Security is Desired Efficient proven secure schemes have been discovered Sign. PSS(R)RSA, GHR, CramerShoup, EDL... Enc. RSAOAEP, CramerShoup,... There exist generic conversions to create more of them Sign. FiatShamir heuristic applied to ZKPK Enc. OAEP(+/++), FujisakiOkamoto, REACT, GEMI, GEMII,... Provably secure schemes are adopted in standards Sign. PSS in IEEE P1363a and PKCS#1 v2.1. Enc. RSAOAEP in PKCS#1 v2.0, P1363a DHIES in ANSI X9.63, P1363a. Standard bodies ask for security proofs along with submissions
28 What is provable security? Provable Security is Desired Provable Security is Desired Efficient proven secure schemes have been discovered Sign. PSS(R)RSA, GHR, CramerShoup, EDL... Enc. RSAOAEP, CramerShoup,... There exist generic conversions to create more of them Sign. FiatShamir heuristic applied to ZKPK Enc. OAEP(+/++), FujisakiOkamoto, REACT, GEMI, GEMII,... Provably secure schemes are adopted in standards Sign. PSS in IEEE P1363a and PKCS#1 v2.1. Enc. RSAOAEP in PKCS#1 v2.0, P1363a DHIES in ANSI X9.63, P1363a. Standard bodies ask for security proofs along with submissions
29 What is provable security? Provable Security is Desired Provable Security is Desired Efficient proven secure schemes have been discovered Sign. PSS(R)RSA, GHR, CramerShoup, EDL... Enc. RSAOAEP, CramerShoup,... There exist generic conversions to create more of them Sign. FiatShamir heuristic applied to ZKPK Enc. OAEP(+/++), FujisakiOkamoto, REACT, GEMI, GEMII,... Provably secure schemes are adopted in standards Sign. PSS in IEEE P1363a and PKCS#1 v2.1. Enc. RSAOAEP in PKCS#1 v2.0, P1363a DHIES in ANSI X9.63, P1363a. Standard bodies ask for security proofs along with submissions
30 What is provable security? Provable Security is Desired Provable Security is Desired Efficient proven secure schemes have been discovered Sign. PSS(R)RSA, GHR, CramerShoup, EDL... Enc. RSAOAEP, CramerShoup,... There exist generic conversions to create more of them Sign. FiatShamir heuristic applied to ZKPK Enc. OAEP(+/++), FujisakiOkamoto, REACT, GEMI, GEMII,... Provably secure schemes are adopted in standards Sign. PSS in IEEE P1363a and PKCS#1 v2.1. Enc. RSAOAEP in PKCS#1 v2.0, P1363a DHIES in ANSI X9.63, P1363a. Standard bodies ask for security proofs along with submissions
31 What is provable security? Provable Security is Desired Provable Security is Desired Efficient proven secure schemes have been discovered Sign. PSS(R)RSA, GHR, CramerShoup, EDL... Enc. RSAOAEP, CramerShoup,... There exist generic conversions to create more of them Sign. FiatShamir heuristic applied to ZKPK Enc. OAEP(+/++), FujisakiOkamoto, REACT, GEMI, GEMII,... Provably secure schemes are adopted in standards Sign. PSS in IEEE P1363a and PKCS#1 v2.1. Enc. RSAOAEP in PKCS#1 v2.0, P1363a DHIES in ANSI X9.63, P1363a. Standard bodies ask for security proofs along with submissions
32 What is provable security? Provable Security is Desired Provable Security is Desired Efficient proven secure schemes have been discovered Sign. PSS(R)RSA, GHR, CramerShoup, EDL... Enc. RSAOAEP, CramerShoup,... There exist generic conversions to create more of them Sign. FiatShamir heuristic applied to ZKPK Enc. OAEP(+/++), FujisakiOkamoto, REACT, GEMI, GEMII,... Provably secure schemes are adopted in standards Sign. PSS in IEEE P1363a and PKCS#1 v2.1. Enc. RSAOAEP in PKCS#1 v2.0, P1363a DHIES in ANSI X9.63, P1363a. Standard bodies ask for security proofs along with submissions
33 What is provable security? Provable Security is Desired (Cont d) Provable Security is Desired (Cont d) Provably secure schemes are found in present systems Sign. RSAPSS Enc. RSAOAEP These are to be widely deployed, but there may be others in near future. Provably secure schemes in upcoming systems This is no longer just theory. Product developers, security architects and users want to know which systems to use how different cryptosystems compare
34 What is provable security? Provable Security is Desired (Cont d) Provable Security is Desired (Cont d) Provably secure schemes are found in present systems Sign. RSAPSS Enc. RSAOAEP These are to be widely deployed, but there may be others in near future. Provably secure schemes in upcoming systems This is no longer just theory. Product developers, security architects and users want to know which systems to use how different cryptosystems compare
35 What is provable security? Provable Security is Desired (Cont d) Provable Security is Desired (Cont d) Provably secure schemes are found in present systems Sign. RSAPSS Enc. RSAOAEP These are to be widely deployed, but there may be others in near future. Provably secure schemes in upcoming systems This is no longer just theory. Product developers, security architects and users want to know which systems to use how different cryptosystems compare
36 What is provable security? Provable Security is Desired (Cont d) Provable Security is Desired (Cont d) Provably secure schemes are found in present systems Sign. RSAPSS Enc. RSAOAEP These are to be widely deployed, but there may be others in near future. Provably secure schemes in upcoming systems This is no longer just theory. Product developers, security architects and users want to know which systems to use how different cryptosystems compare
37 What is provable security? Provable Security is Desired (Cont d) Provable Security is Desired (Cont d) Provably secure schemes are found in present systems Sign. RSAPSS Enc. RSAOAEP These are to be widely deployed, but there may be others in near future. Provably secure schemes in upcoming systems This is no longer just theory. Product developers, security architects and users want to know which systems to use how different cryptosystems compare
38 What is provable security? Provable Security is Desired (Cont d) Provable Security is Desired (Cont d) Provably secure schemes are found in present systems Sign. RSAPSS Enc. RSAOAEP These are to be widely deployed, but there may be others in near future. Provably secure schemes in upcoming systems This is no longer just theory. Product developers, security architects and users want to know which systems to use how different cryptosystems compare
39 What is provable security? Provable Security is Desired (Cont d) Provable Security is Desired (Cont d) Provably secure schemes are found in present systems Sign. RSAPSS Enc. RSAOAEP These are to be widely deployed, but there may be others in near future. Provably secure schemes in upcoming systems This is no longer just theory. Product developers, security architects and users want to know which systems to use how different cryptosystems compare
40 What is provable security? Provable Security is Desired (Cont d) Provable Security is Desired (Cont d) Provably secure schemes are found in present systems Sign. RSAPSS Enc. RSAOAEP These are to be widely deployed, but there may be others in near future. Provably secure schemes in upcoming systems This is no longer just theory. Product developers, security architects and users want to know which systems to use how different cryptosystems compare
41 What is provable security? Provable Security is Desired (Cont d) Provable Security is Desired (Cont d) Provably secure schemes are found in present systems Sign. RSAPSS Enc. RSAOAEP These are to be widely deployed, but there may be others in near future. Provably secure schemes in upcoming systems This is no longer just theory. Product developers, security architects and users want to know which systems to use how different cryptosystems compare
42 What is provable security? How to Get a Security Proof? How to Get a Security Proof? To get a security proof, one needs to 1 Describe a cryptosystem and its operational modes, 2 Formally define a security notion to achieve, 3 Make precise computational assumptions, 4 Exhibit a reduction between an algorithm which breaks the security notion and an algorithm that breaks the assumptions. Reduction to prove P 1 P 2 i.e. that problem P 1 is reducible to problem P 2, one shows an algorithm with polynomial resources that solves P 1 with access to an oracle that solves P 2.
43 What is provable security? How to Get a Security Proof? How to Get a Security Proof? To get a security proof, one needs to 1 Describe a cryptosystem and its operational modes, 2 Formally define a security notion to achieve, 3 Make precise computational assumptions, 4 Exhibit a reduction between an algorithm which breaks the security notion and an algorithm that breaks the assumptions. Reduction to prove P 1 P 2 i.e. that problem P 1 is reducible to problem P 2, one shows an algorithm with polynomial resources that solves P 1 with access to an oracle that solves P 2.
44 What is provable security? How to Get a Security Proof? How to Get a Security Proof? To get a security proof, one needs to 1 Describe a cryptosystem and its operational modes, 2 Formally define a security notion to achieve, 3 Make precise computational assumptions, 4 Exhibit a reduction between an algorithm which breaks the security notion and an algorithm that breaks the assumptions. Reduction to prove P 1 P 2 i.e. that problem P 1 is reducible to problem P 2, one shows an algorithm with polynomial resources that solves P 1 with access to an oracle that solves P 2.
45 What is provable security? How to Get a Security Proof? How to Get a Security Proof? To get a security proof, one needs to 1 Describe a cryptosystem and its operational modes, 2 Formally define a security notion to achieve, 3 Make precise computational assumptions, 4 Exhibit a reduction between an algorithm which breaks the security notion and an algorithm that breaks the assumptions. Reduction to prove P 1 P 2 i.e. that problem P 1 is reducible to problem P 2, one shows an algorithm with polynomial resources that solves P 1 with access to an oracle that solves P 2.
46 What is provable security? How to Get a Security Proof? How to Get a Security Proof? To get a security proof, one needs to 1 Describe a cryptosystem and its operational modes, 2 Formally define a security notion to achieve, 3 Make precise computational assumptions, 4 Exhibit a reduction between an algorithm which breaks the security notion and an algorithm that breaks the assumptions. Reduction to prove P 1 P 2 i.e. that problem P 1 is reducible to problem P 2, one shows an algorithm with polynomial resources that solves P 1 with access to an oracle that solves P 2.
47 What is provable security? How to Get a Security Proof? How to Get a Security Proof? To get a security proof, one needs to 1 Describe a cryptosystem and its operational modes, 2 Formally define a security notion to achieve, 3 Make precise computational assumptions, 4 Exhibit a reduction between an algorithm which breaks the security notion and an algorithm that breaks the assumptions. Reduction to prove P 1 P 2 i.e. that problem P 1 is reducible to problem P 2, one shows an algorithm with polynomial resources that solves P 1 with access to an oracle that solves P 2.
48 What is provable security? How to Get a Security Proof? How to Get a Security Proof? To get a security proof, one needs to 1 Describe a cryptosystem and its operational modes, 2 Formally define a security notion to achieve, 3 Make precise computational assumptions, 4 Exhibit a reduction between an algorithm which breaks the security notion and an algorithm that breaks the assumptions. Reduction to prove P 1 P 2 i.e. that problem P 1 is reducible to problem P 2, one shows an algorithm with polynomial resources that solves P 1 with access to an oracle that solves P 2.
49 Security Proofs for Signatures Digital Signatures Digital Signatures Signer Alice generates a public/private key pair (pk, sk) by running a probabilistic key generation algorithm G( pk ), pk being the security parameter. Alice publishes pk. Whenever Alice wishes to sign a digital document m {0, 1}, she computes the signature s = S(sk, m) where S is the (possibly probabilistic) signing algorithm. She outputs s and maybe also m. Knowing m and s (and Alice s public key pk), Bob can verify that s is a signature of m output by Alice by running the verification algorithm V (pk, m, s) returning 1 if s = S(sk, m) or 0 otherwise. The cryptographic system given by the triple (G, S, V ) and their domains is called a signature scheme.
50 Security Proofs for Signatures Digital Signatures Digital Signatures Signer Alice generates a public/private key pair (pk, sk) by running a probabilistic key generation algorithm G( pk ), pk being the security parameter. Alice publishes pk. Whenever Alice wishes to sign a digital document m {0, 1}, she computes the signature s = S(sk, m) where S is the (possibly probabilistic) signing algorithm. She outputs s and maybe also m. Knowing m and s (and Alice s public key pk), Bob can verify that s is a signature of m output by Alice by running the verification algorithm V (pk, m, s) returning 1 if s = S(sk, m) or 0 otherwise. The cryptographic system given by the triple (G, S, V ) and their domains is called a signature scheme.
51 Security Proofs for Signatures Digital Signatures Digital Signatures Signer Alice generates a public/private key pair (pk, sk) by running a probabilistic key generation algorithm G( pk ), pk being the security parameter. Alice publishes pk. Whenever Alice wishes to sign a digital document m {0, 1}, she computes the signature s = S(sk, m) where S is the (possibly probabilistic) signing algorithm. She outputs s and maybe also m. Knowing m and s (and Alice s public key pk), Bob can verify that s is a signature of m output by Alice by running the verification algorithm V (pk, m, s) returning 1 if s = S(sk, m) or 0 otherwise. The cryptographic system given by the triple (G, S, V ) and their domains is called a signature scheme.
52 Security Proofs for Signatures Digital Signatures Digital Signatures Signer Alice generates a public/private key pair (pk, sk) by running a probabilistic key generation algorithm G( pk ), pk being the security parameter. Alice publishes pk. Whenever Alice wishes to sign a digital document m {0, 1}, she computes the signature s = S(sk, m) where S is the (possibly probabilistic) signing algorithm. She outputs s and maybe also m. Knowing m and s (and Alice s public key pk), Bob can verify that s is a signature of m output by Alice by running the verification algorithm V (pk, m, s) returning 1 if s = S(sk, m) or 0 otherwise. The cryptographic system given by the triple (G, S, V ) and their domains is called a signature scheme.
53 Security Proofs for Signatures Security Notions Security Notions Depending on the context in which a given cryptosystem is used, one may formally define a security notion for this system, by telling what goal an adversary would attempt to reach, and what means or information are made available to her (the attack model). A security notion (or level) is entirely defined by coupling an adversarial goal with an adversarial model. Examples: UBKMA, UUFKOA, EUFSOCMA, EUFCMA.
54 Security Proofs for Signatures Security Notions Security Notions Depending on the context in which a given cryptosystem is used, one may formally define a security notion for this system, by telling what goal an adversary would attempt to reach, and what means or information are made available to her (the attack model). A security notion (or level) is entirely defined by coupling an adversarial goal with an adversarial model. Examples: UBKMA, UUFKOA, EUFSOCMA, EUFCMA.
55 Security Proofs for Signatures Security Notions Security Notions Depending on the context in which a given cryptosystem is used, one may formally define a security notion for this system, by telling what goal an adversary would attempt to reach, and what means or information are made available to her (the attack model). A security notion (or level) is entirely defined by coupling an adversarial goal with an adversarial model. Examples: UBKMA, UUFKOA, EUFSOCMA, EUFCMA.
56 Security Proofs for Signatures Security Notions Security Notions Depending on the context in which a given cryptosystem is used, one may formally define a security notion for this system, by telling what goal an adversary would attempt to reach, and what means or information are made available to her (the attack model). A security notion (or level) is entirely defined by coupling an adversarial goal with an adversarial model. Examples: UBKMA, UUFKOA, EUFSOCMA, EUFCMA.
57 Security Proofs for Signatures Security Goals Security Goals [Unbreakability] the attacker recovers the secret key sk from the public key pk (or an equivalent key if any). This goal is denoted UB. Implicitly appeared with publickey cryptography. [Universal Unforgeability] the attacker, without necessarily having recovered sk, can produce a valid signature of any message in the message space. Noted UUF. [Selective Unforgeability] the attacker can produce a valid signature of a message he committed to before knowing the public key. Noted SUF. Not often used in proofs (except in recent pairingbased signatures).
58 Security Proofs for Signatures Security Goals Security Goals [Unbreakability] the attacker recovers the secret key sk from the public key pk (or an equivalent key if any). This goal is denoted UB. Implicitly appeared with publickey cryptography. [Universal Unforgeability] the attacker, without necessarily having recovered sk, can produce a valid signature of any message in the message space. Noted UUF. [Selective Unforgeability] the attacker can produce a valid signature of a message he committed to before knowing the public key. Noted SUF. Not often used in proofs (except in recent pairingbased signatures).
59 Security Proofs for Signatures Security Goals Security Goals [Unbreakability] the attacker recovers the secret key sk from the public key pk (or an equivalent key if any). This goal is denoted UB. Implicitly appeared with publickey cryptography. [Universal Unforgeability] the attacker, without necessarily having recovered sk, can produce a valid signature of any message in the message space. Noted UUF. [Selective Unforgeability] the attacker can produce a valid signature of a message he committed to before knowing the public key. Noted SUF. Not often used in proofs (except in recent pairingbased signatures).
60 Security Proofs for Signatures Security Goals Security Goals [Existential Unforgeability] the attacker creates a message and a valid signature of it (likely not of his choosing). Denoted EUF. [NonMalleability] the attacker is given (m, s) and is challenged to construct (m, s ). Denoted NM.
61 Security Proofs for Signatures Security Goals Security Goals [Existential Unforgeability] the attacker creates a message and a valid signature of it (likely not of his choosing). Denoted EUF. [NonMalleability] the attacker is given (m, s) and is challenged to construct (m, s ). Denoted NM.
62 Security Proofs for Signatures Adversarial Models Adversarial Models Several types of computational resources an adversary has access to are considered: KeyOnly Attacks (KOA), unavoidable scenario. Known Message Attacks (KMA) where an adversary has access to signatures for a set of known messages. Directed ChosenMessage Attacks (DCMA) are a scenario in which the adversary chooses a set of messages {m i } i and is given corresponding signatures {s i } i. The choice of {m i } i is nonadaptive.
63 Security Proofs for Signatures Adversarial Models Adversarial Models Several types of computational resources an adversary has access to are considered: KeyOnly Attacks (KOA), unavoidable scenario. Known Message Attacks (KMA) where an adversary has access to signatures for a set of known messages. Directed ChosenMessage Attacks (DCMA) are a scenario in which the adversary chooses a set of messages {m i } i and is given corresponding signatures {s i } i. The choice of {m i } i is nonadaptive.
64 Security Proofs for Signatures Adversarial Models Adversarial Models Several types of computational resources an adversary has access to are considered: KeyOnly Attacks (KOA), unavoidable scenario. Known Message Attacks (KMA) where an adversary has access to signatures for a set of known messages. Directed ChosenMessage Attacks (DCMA) are a scenario in which the adversary chooses a set of messages {m i } i and is given corresponding signatures {s i } i. The choice of {m i } i is nonadaptive.
65 Security Proofs for Signatures Adversarial Models (Cont d) Adversarial Models (Cont d) Single Occurence ChosenMessage Attacks (SOCMA) the adversary is allowed to use the signer as an oracle (full access), and may request the signature of any message of his choice but only once. (Adaptive) ChosenMessage Attacks (CMA) here too the adversary is allowed to use the signer as an oracle (full access), and may request the signature of any message of his choice (multiple requests of the same message are allowed).
66 Security Proofs for Signatures Adversarial Models (Cont d) Adversarial Models (Cont d) Single Occurence ChosenMessage Attacks (SOCMA) the adversary is allowed to use the signer as an oracle (full access), and may request the signature of any message of his choice but only once. (Adaptive) ChosenMessage Attacks (CMA) here too the adversary is allowed to use the signer as an oracle (full access), and may request the signature of any message of his choice (multiple requests of the same message are allowed).
67 Security Proofs for Signatures Relations Among Security Notions Relations Among Security Notions EUF SUF UUF UB KOA KMA SOCMA CMA
68 Security Proofs for Signatures ChosenMessage Security ChosenMessage Security Because EUFCMA is the upper security level (Goldwasser, Micali, Rivest, 1988), it is desirable to prove security with respect to this notion. Formally, an signature scheme is said to be (q, τ, ε)secure if for any adversary A with running time upperbounded by τ, [ ] Succ EUF CMA (sk, pk) G(1 (A) = Pr k ), < ε, (m, s ) A S(sk, ) (pk), V (pk, m, s ) = 1 where the probability is taken over all random choices. The notation A S(sk, ) means that the adversary has access to a signing oracle throughout the game, but at most q times. The message m output by A must not have been requested to the signing oracle.
69 Security Proofs for Signatures ChosenMessage Security ChosenMessage Security Because EUFCMA is the upper security level (Goldwasser, Micali, Rivest, 1988), it is desirable to prove security with respect to this notion. Formally, an signature scheme is said to be (q, τ, ε)secure if for any adversary A with running time upperbounded by τ, [ ] Succ EUF CMA (sk, pk) G(1 (A) = Pr k ), < ε, (m, s ) A S(sk, ) (pk), V (pk, m, s ) = 1 where the probability is taken over all random choices. The notation A S(sk, ) means that the adversary has access to a signing oracle throughout the game, but at most q times. The message m output by A must not have been requested to the signing oracle.
70 Security Proofs for Signatures ChosenMessage Security ChosenMessage Security Because EUFCMA is the upper security level (Goldwasser, Micali, Rivest, 1988), it is desirable to prove security with respect to this notion. Formally, an signature scheme is said to be (q, τ, ε)secure if for any adversary A with running time upperbounded by τ, [ ] Succ EUF CMA (sk, pk) G(1 (A) = Pr k ), < ε, (m, s ) A S(sk, ) (pk), V (pk, m, s ) = 1 where the probability is taken over all random choices. The notation A S(sk, ) means that the adversary has access to a signing oracle throughout the game, but at most q times. The message m output by A must not have been requested to the signing oracle.
71 Security Proofs for Signatures ChosenMessage Security ChosenMessage Security Because EUFCMA is the upper security level (Goldwasser, Micali, Rivest, 1988), it is desirable to prove security with respect to this notion. Formally, an signature scheme is said to be (q, τ, ε)secure if for any adversary A with running time upperbounded by τ, [ ] Succ EUF CMA (sk, pk) G(1 (A) = Pr k ), < ε, (m, s ) A S(sk, ) (pk), V (pk, m, s ) = 1 where the probability is taken over all random choices. The notation A S(sk, ) means that the adversary has access to a signing oracle throughout the game, but at most q times. The message m output by A must not have been requested to the signing oracle.
72 Security Proofs for Signatures EUFCMA: Playing the Game EUFCMA: Playing the Game Key Generator G(1 k ) pk sk Signing Oracle A S(sk,.) m *, s * Verification V(pk,.) 1?
73 Security Proofs for Encryption PublicKey Encryption PublicKey Encryption An asymmetric encryption scheme is a triple of algorithms (K, E, D) where K is a probabilistic key generation algorithm which returns random pairs of secret and public keys (sk, pk) depending on the security parameter κ, E is a probabilistic encryption algorithm which takes on input a public key pk and a plaintext m M, runs on a random tape u U and returns a ciphertext c, D is a deterministic decryption algorithm which takes on input a secret key sk, a ciphertext c and returns the corresponding plaintext m or the symbol. We require that if (sk, pk) K, then D sk (E pk (m, u)) = m for all (m, u) M U. We note E pk (m) = E pk (m, U).
74 Security Proofs for Encryption PublicKey Encryption PublicKey Encryption An asymmetric encryption scheme is a triple of algorithms (K, E, D) where K is a probabilistic key generation algorithm which returns random pairs of secret and public keys (sk, pk) depending on the security parameter κ, E is a probabilistic encryption algorithm which takes on input a public key pk and a plaintext m M, runs on a random tape u U and returns a ciphertext c, D is a deterministic decryption algorithm which takes on input a secret key sk, a ciphertext c and returns the corresponding plaintext m or the symbol. We require that if (sk, pk) K, then D sk (E pk (m, u)) = m for all (m, u) M U. We note E pk (m) = E pk (m, U).
75 Security Proofs for Encryption PublicKey Encryption PublicKey Encryption An asymmetric encryption scheme is a triple of algorithms (K, E, D) where K is a probabilistic key generation algorithm which returns random pairs of secret and public keys (sk, pk) depending on the security parameter κ, E is a probabilistic encryption algorithm which takes on input a public key pk and a plaintext m M, runs on a random tape u U and returns a ciphertext c, D is a deterministic decryption algorithm which takes on input a secret key sk, a ciphertext c and returns the corresponding plaintext m or the symbol. We require that if (sk, pk) K, then D sk (E pk (m, u)) = m for all (m, u) M U. We note E pk (m) = E pk (m, U).
76 Security Proofs for Encryption PublicKey Encryption PublicKey Encryption An asymmetric encryption scheme is a triple of algorithms (K, E, D) where K is a probabilistic key generation algorithm which returns random pairs of secret and public keys (sk, pk) depending on the security parameter κ, E is a probabilistic encryption algorithm which takes on input a public key pk and a plaintext m M, runs on a random tape u U and returns a ciphertext c, D is a deterministic decryption algorithm which takes on input a secret key sk, a ciphertext c and returns the corresponding plaintext m or the symbol. We require that if (sk, pk) K, then D sk (E pk (m, u)) = m for all (m, u) M U. We note E pk (m) = E pk (m, U).
77 Security Proofs for Encryption PublicKey Encryption PublicKey Encryption An asymmetric encryption scheme is a triple of algorithms (K, E, D) where K is a probabilistic key generation algorithm which returns random pairs of secret and public keys (sk, pk) depending on the security parameter κ, E is a probabilistic encryption algorithm which takes on input a public key pk and a plaintext m M, runs on a random tape u U and returns a ciphertext c, D is a deterministic decryption algorithm which takes on input a secret key sk, a ciphertext c and returns the corresponding plaintext m or the symbol. We require that if (sk, pk) K, then D sk (E pk (m, u)) = m for all (m, u) M U. We note E pk (m) = E pk (m, U).
78 Security Proofs for Encryption History of Security Goals History of Security Goals It shouldn t be feasible to: Compute the secret key sk from the public key pk (unbreakability or UBK). Implicitly appeared with publickey crypto. Invert the encryption function over any ciphertext under any given key pk (onewayness or OW). Diffie and Hellman, late 70 s. Recover even a single bit of information about a plaintext given its encryption under any given key pk (indistinguishability of encryptions or IND). Goldwasser and Micali, Transform some ciphertext into another ciphertext such that plaintext are meaningfully related (nonmalleability or NM). Dolev, Dwork and Naor, 1991.
79 Security Proofs for Encryption History of Security Goals History of Security Goals It shouldn t be feasible to: Compute the secret key sk from the public key pk (unbreakability or UBK). Implicitly appeared with publickey crypto. Invert the encryption function over any ciphertext under any given key pk (onewayness or OW). Diffie and Hellman, late 70 s. Recover even a single bit of information about a plaintext given its encryption under any given key pk (indistinguishability of encryptions or IND). Goldwasser and Micali, Transform some ciphertext into another ciphertext such that plaintext are meaningfully related (nonmalleability or NM). Dolev, Dwork and Naor, 1991.
80 Security Proofs for Encryption History of Security Goals History of Security Goals It shouldn t be feasible to: Compute the secret key sk from the public key pk (unbreakability or UBK). Implicitly appeared with publickey crypto. Invert the encryption function over any ciphertext under any given key pk (onewayness or OW). Diffie and Hellman, late 70 s. Recover even a single bit of information about a plaintext given its encryption under any given key pk (indistinguishability of encryptions or IND). Goldwasser and Micali, Transform some ciphertext into another ciphertext such that plaintext are meaningfully related (nonmalleability or NM). Dolev, Dwork and Naor, 1991.
81 Security Proofs for Encryption History of Security Goals History of Security Goals It shouldn t be feasible to: Compute the secret key sk from the public key pk (unbreakability or UBK). Implicitly appeared with publickey crypto. Invert the encryption function over any ciphertext under any given key pk (onewayness or OW). Diffie and Hellman, late 70 s. Recover even a single bit of information about a plaintext given its encryption under any given key pk (indistinguishability of encryptions or IND). Goldwasser and Micali, Transform some ciphertext into another ciphertext such that plaintext are meaningfully related (nonmalleability or NM). Dolev, Dwork and Naor, 1991.
82 Security Proofs for Encryption History of Adversarial Models History of Adversarial Models Several types of computational resources an adversary has access to have been considered: chosenplaintext attacks (CPA), unavoidable scenario. nonadaptive chosenciphertext attacks (CCA1) (also known as lunchtime or midnight attacks), wherein the adversary gets, in addition, access to a decryption oracle before being given the challenge ciphertext. Naor and Yung, adaptive chosenciphertext attacks (CCA2) as a scenario in which the adversary queries the decryption oracle before and after being challenged; her only restriction here is that she may not feed the oracle with the challenge ciphertext itself. This is the strongest known attack scenario. Rackoff and Simon, 1991.
83 Security Proofs for Encryption History of Adversarial Models History of Adversarial Models Several types of computational resources an adversary has access to have been considered: chosenplaintext attacks (CPA), unavoidable scenario. nonadaptive chosenciphertext attacks (CCA1) (also known as lunchtime or midnight attacks), wherein the adversary gets, in addition, access to a decryption oracle before being given the challenge ciphertext. Naor and Yung, adaptive chosenciphertext attacks (CCA2) as a scenario in which the adversary queries the decryption oracle before and after being challenged; her only restriction here is that she may not feed the oracle with the challenge ciphertext itself. This is the strongest known attack scenario. Rackoff and Simon, 1991.
84 Security Proofs for Encryption History of Adversarial Models History of Adversarial Models Several types of computational resources an adversary has access to have been considered: chosenplaintext attacks (CPA), unavoidable scenario. nonadaptive chosenciphertext attacks (CCA1) (also known as lunchtime or midnight attacks), wherein the adversary gets, in addition, access to a decryption oracle before being given the challenge ciphertext. Naor and Yung, adaptive chosenciphertext attacks (CCA2) as a scenario in which the adversary queries the decryption oracle before and after being challenged; her only restriction here is that she may not feed the oracle with the challenge ciphertext itself. This is the strongest known attack scenario. Rackoff and Simon, 1991.
85 Security Proofs for Encryption Relations Among Security Notions Relations Among Security Notions NM IND OW UBK CPA CCA1 CCA2 indicates an implication: a scheme secure in notion A is also secure in notion B. indicates a separation: there exists a scheme secure in notion A but not in B.
86 Security Proofs for Encryption ChosenCiphertext Security ChosenCiphertext Security Because INDCCA2 NMCCA2 is the upper security level, it is desirable to prove security with respect to this notion. It is also denoted by INDCCA and called chosen ciphertext security. Formally, an asymmetric encryption scheme is said to be (τ, ε)indcca if for any adversary A = (A 1, A 2 ) with running time upperbounded by τ, Adv ind (A) = 2 Pr b R {0,1} u R U [ (sk, pk) K(1 κ ), (m0, m 1, σ) A 1 (pk) c E pk (m b, u) : A 2 (c, σ) = b ] 1 < ε, where the probability is taken over the random choices of A. The two plaintexts m 0 and m 1 chosen by the adversary have to be of identical length. Access to a decryption oracle is allowed throughout the game. We also have Adv ind (A) = Pr [A = 1 b = 1] Pr [A = 1 b = 0].
87 Security Proofs for Encryption ChosenCiphertext Security ChosenCiphertext Security Because INDCCA2 NMCCA2 is the upper security level, it is desirable to prove security with respect to this notion. It is also denoted by INDCCA and called chosen ciphertext security. Formally, an asymmetric encryption scheme is said to be (τ, ε)indcca if for any adversary A = (A 1, A 2 ) with running time upperbounded by τ, Adv ind (A) = 2 Pr b R {0,1} u R U [ (sk, pk) K(1 κ ), (m0, m 1, σ) A 1 (pk) c E pk (m b, u) : A 2 (c, σ) = b ] 1 < ε, where the probability is taken over the random choices of A. The two plaintexts m 0 and m 1 chosen by the adversary have to be of identical length. Access to a decryption oracle is allowed throughout the game. We also have Adv ind (A) = Pr [A = 1 b = 1] Pr [A = 1 b = 0].
88 Security Proofs for Encryption ChosenCiphertext Security ChosenCiphertext Security Because INDCCA2 NMCCA2 is the upper security level, it is desirable to prove security with respect to this notion. It is also denoted by INDCCA and called chosen ciphertext security. Formally, an asymmetric encryption scheme is said to be (τ, ε)indcca if for any adversary A = (A 1, A 2 ) with running time upperbounded by τ, Adv ind (A) = 2 Pr b R {0,1} u R U [ (sk, pk) K(1 κ ), (m0, m 1, σ) A 1 (pk) c E pk (m b, u) : A 2 (c, σ) = b ] 1 < ε, where the probability is taken over the random choices of A. The two plaintexts m 0 and m 1 chosen by the adversary have to be of identical length. Access to a decryption oracle is allowed throughout the game. We also have Adv ind (A) = Pr [A = 1 b = 1] Pr [A = 1 b = 0].
89 Security Proofs for Encryption ChosenCiphertext Security ChosenCiphertext Security Because INDCCA2 NMCCA2 is the upper security level, it is desirable to prove security with respect to this notion. It is also denoted by INDCCA and called chosen ciphertext security. Formally, an asymmetric encryption scheme is said to be (τ, ε)indcca if for any adversary A = (A 1, A 2 ) with running time upperbounded by τ, Adv ind (A) = 2 Pr b R {0,1} u R U [ (sk, pk) K(1 κ ), (m0, m 1, σ) A 1 (pk) c E pk (m b, u) : A 2 (c, σ) = b ] 1 < ε, where the probability is taken over the random choices of A. The two plaintexts m 0 and m 1 chosen by the adversary have to be of identical length. Access to a decryption oracle is allowed throughout the game. We also have Adv ind (A) = Pr [A = 1 b = 1] Pr [A = 1 b = 0].
90 Security Proofs for Encryption INDCCA: Playing the Game INDCCA: Playing the Game Key Generator pk (find stage) m, m 0 1 A1 reject only c b c b Random Encryption A2 (guess stage) Decryption b'==b?
91 Designing Cryptosystems How Can We Build Cryptosystems? How Can We Build Cryptosystems? These security notions are targets for scheme designers. But how does one design (secure) cryptosystems? Publickey design allows to construct systems by assembling and connecting smaller structures together. These may be smaller cryptosystems or atomic primitives: oneway functions, oneway trapdoor functions, oneway trapdoor permutations, hash functions, pseudorandom generators, secretkey permutations, message authentication codes, arithmetic or boolean operations, etc.
Introduction. Digital Signature
Introduction Electronic transactions and activities taken place over Internet need to be protected against all kinds of interference, accidental or malicious. The general task of the information technology
More informationCryptoVerif Tutorial
CryptoVerif Tutorial Bruno Blanchet INRIA ParisRocquencourt bruno.blanchet@inria.fr November 2014 Bruno Blanchet (INRIA) CryptoVerif Tutorial November 2014 1 / 14 Exercise 1: preliminary definition SUFCMA
More informationUniversal Padding Schemes for RSA
Universal Padding Schemes for RSA JeanSébastien Coron, Marc Joye, David Naccache, and Pascal Paillier Gemplus Card International, France {jeansebastien.coron, marc.joye, david.naccache, pascal.paillier}@gemplus.com
More informationRSA OAEP is Secure under the RSA Assumption
This is a revised version of the extended abstract RSA OAEP is Secure under the RSA Assumption which appeared in Advances in Cryptology Proceedings of CRYPTO 2001 (19 23 august 2001, Santa Barbara, California,
More informationOutline. Computer Science 418. Digital Signatures: Observations. Digital Signatures: Definition. Definition 1 (Digital signature) Digital Signatures
Outline Computer Science 418 Digital Signatures Mike Jacobson Department of Computer Science University of Calgary Week 12 1 Digital Signatures 2 Signatures via Public Key Cryptosystems 3 Provable 4 Mike
More informationChosenCiphertext Security from IdentityBased Encryption
ChosenCiphertext Security from IdentityBased Encryption Dan Boneh Ran Canetti Shai Halevi Jonathan Katz Abstract We propose simple and efficient CCAsecure publickey encryption schemes (i.e., schemes
More informationMACs Message authentication and integrity. Table of contents
MACs Message authentication and integrity Foundations of Cryptography Computer Science Department Wellesley College Table of contents Introduction MACs Constructing Secure MACs Secure communication and
More informationChosenCiphertext Security from IdentityBased Encryption
ChosenCiphertext Security from IdentityBased Encryption Dan Boneh Ran Canetti Shai Halevi Jonathan Katz June 13, 2006 Abstract We propose simple and efficient CCAsecure publickey encryption schemes
More informationLecture 15  Digital Signatures
Lecture 15  Digital Signatures Boaz Barak March 29, 2010 Reading KL Book Chapter 12. Review Trapdoor permutations  easy to compute, hard to invert, easy to invert with trapdoor. RSA and Rabin signatures.
More informationAuthenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm By Mihir Bellare and Chanathip Namprempre
Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm By Mihir Bellare and Chanathip Namprempre Some slides were also taken from Chanathip Namprempre's defense
More informationSecurity of Blind Digital Signatures
Security of Blind Digital Signatures (Revised Extended Abstract) Ari Juels 1 Michael Luby 2 Rafail Ostrovsky 3 1 RSA Laboratories. Email: ari@rsa.com. 2 Digital Fountain 3 UCLA, Email: rafail@cs.ucla.edu.
More informationCryptography. Identitybased Encryption. JeanSébastien Coron and David Galindo. May 15, 2014. Université du Luxembourg
Identitybased Encryption Université du Luxembourg May 15, 2014 Summary IdentityBased Encryption (IBE) What is IdentityBased Encryption? Difference with conventional PK cryptography. Applications of
More informationThe Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)
The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?) Hugo Krawczyk Abstract. We study the question of how to generically compose symmetric encryption and authentication
More informationMESSAGE AUTHENTICATION IN AN IDENTITYBASED ENCRYPTION SCHEME: 1KEYENCRYPTTHENMAC
MESSAGE AUTHENTICATION IN AN IDENTITYBASED ENCRYPTION SCHEME: 1KEYENCRYPTTHENMAC by Brittanney Jaclyn Amento A Thesis Submitted to the Faculty of The Charles E. Schmidt College of Science in Partial
More information1 Message Authentication
Theoretical Foundations of Cryptography Lecture Georgia Tech, Spring 200 Message Authentication Message Authentication Instructor: Chris Peikert Scribe: Daniel Dadush We start with some simple questions
More informationProvableSecurity Analysis of Authenticated Encryption in Kerberos
ProvableSecurity Analysis of Authenticated Encryption in Kerberos Alexandra Boldyreva Virendra Kumar Georgia Institute of Technology, School of Computer Science 266 Ferst Drive, Atlanta, GA 303320765
More information1 Digital Signatures. 1.1 The RSA Function: The eth Power Map on Z n. Crypto: Primitives and Protocols Lecture 6.
1 Digital Signatures A digital signature is a fundamental cryptographic primitive, technologically equivalent to a handwritten signature. In many applications, digital signatures are used as building blocks
More information1 Signatures vs. MACs
CS 120/ E177: Introduction to Cryptography Salil Vadhan and Alon Rosen Nov. 22, 2006 Lecture Notes 17: Digital Signatures Recommended Reading. KatzLindell 10 1 Signatures vs. MACs Digital signatures
More informationLecture 9  Message Authentication Codes
Lecture 9  Message Authentication Codes Boaz Barak March 1, 2010 Reading: BonehShoup chapter 6, Sections 9.1 9.3. Data integrity Until now we ve only been interested in protecting secrecy of data. However,
More informationTrading OneWayness against ChosenCiphertext Security in FactoringBased Encryption
Trading OneWayness against ChosenCiphertext Security in FactoringBased Encryption Pascal Paillier 1 and Jorge L. Villar 2 1 Cryptography Group, Security Labs, Gemalto pascal.paillier@gemalto.com 2 Departament
More informationLecture 2: Complexity Theory Review and Interactive Proofs
600.641 Special Topics in Theoretical Cryptography January 23, 2007 Lecture 2: Complexity Theory Review and Interactive Proofs Instructor: Susan Hohenberger Scribe: Karyn Benson 1 Introduction to Cryptography
More informationDigital Signatures. Prof. Zeph Grunschlag
Digital Signatures Prof. Zeph Grunschlag (Public Key) Digital Signatures PROBLEM: Alice would like to prove to Bob, Carla, David,... that has really sent them a claimed message. E GOAL: Alice signs each
More informationIdentitybased Encryption with PostChallenge Auxiliary Inputs for Secure Cloud Applications and Sensor Networks
Identitybased Encryption with PostChallenge Auxiliary Inputs for Secure Cloud Applications and Sensor Networks Tsz Hon Yuen  Huawei, Singapore Ye Zhang  Pennsylvania State University, USA Siu Ming
More information1 Domain Extension for MACs
CS 127/CSCI E127: Introduction to Cryptography Prof. Salil Vadhan Fall 2013 Reading. Lecture Notes 17: MAC Domain Extension & Digital Signatures KatzLindell Ÿ4.34.4 (2nd ed) and Ÿ12.012.3 (1st ed).
More informationComputational Soundness of Symbolic Security and Implicit Complexity
Computational Soundness of Symbolic Security and Implicit Complexity Bruce Kapron Computer Science Department University of Victoria Victoria, British Columbia NII Shonan Meeting, November 37, 2013 Overview
More informationUniversal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure PublicKey Encryption
Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure PublicKey Encryption Ronald Cramer Victor Shoup December 12, 2001 Abstract We present several new and fairly practical publickey
More information1 Construction of CCAsecure encryption
CSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong 10 October 2012 1 Construction of secure encryption We now show how the MAC can be applied to obtain a secure encryption scheme.
More informationCSCE 465 Computer & Network Security
CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Public Key Cryptogrophy 1 Roadmap Introduction RSA DiffieHellman Key Exchange Public key and
More informationVictor Shoup Avi Rubin. fshoup,rubing@bellcore.com. Abstract
Session Key Distribution Using Smart Cards Victor Shoup Avi Rubin Bellcore, 445 South St., Morristown, NJ 07960 fshoup,rubing@bellcore.com Abstract In this paper, we investigate a method by which smart
More informationOverview of Cryptographic Tools for Data Security. Murat Kantarcioglu
UT DALLAS Erik Jonsson School of Engineering & Computer Science Overview of Cryptographic Tools for Data Security Murat Kantarcioglu Pag. 1 Purdue University Cryptographic Primitives We will discuss the
More informationNetwork Security. Computer Networking Lecture 08. March 19, 2012. HKU SPACE Community College. HKU SPACE CC CN Lecture 08 1/23
Network Security Computer Networking Lecture 08 HKU SPACE Community College March 19, 2012 HKU SPACE CC CN Lecture 08 1/23 Outline Introduction Cryptography Algorithms Secret Key Algorithm Message Digest
More informationCryptography. Jonathan Katz, University of Maryland, College Park, MD 20742.
Cryptography Jonathan Katz, University of Maryland, College Park, MD 20742. 1 Introduction Cryptography is a vast subject, addressing problems as diverse as ecash, remote authentication, faulttolerant
More informationLecture 25: PairingBased Cryptography
6.897 Special Topics in Cryptography Instructors: Ran Canetti and Ron Rivest May 5, 2004 Lecture 25: PairingBased Cryptography Scribe: Ben Adida 1 Introduction The field of PairingBased Cryptography
More informationUniversally Composable IdentityBased Encryption
All rights are reserved and copyright of this manuscript belongs to the authors. This manuscript has been published without reviewing and editing as received from the authors: posting the manuscript to
More informationAnalysis and Design of Public Key Cryptographic Schemes
Analysis and Design of Public Key Cryptographic Schemes by Ron Steinfeld, Dissertation Submitted by Ron Steinfeld for fulfillment of the Requirements for the Degree of Doctor of Philosophy (0190) in the
More informationMTAT.07.003 Cryptology II. Digital Signatures. Sven Laur University of Tartu
MTAT.07.003 Cryptology II Digital Signatures Sven Laur University of Tartu Formal Syntax Digital signature scheme pk (sk, pk) Gen (m, s) (m,s) m M 0 s Sign sk (m) Ver pk (m, s)? = 1 To establish electronic
More informationImproved Online/Offline Signature Schemes
Improved Online/Offline Signature Schemes Adi Shamir and Yael Tauman Applied Math. Dept. The Weizmann Institute of Science Rehovot 76100, Israel {shamir,tauman}@wisdom.weizmann.ac.il Abstract. The notion
More informationKey Privacy for Identity Based Encryption
Key Privacy for Identity Based Encryption Internet Security Research Lab Technical Report 20062 Jason E. Holt Internet Security Research Lab Brigham Young University c 2006 Brigham Young University March
More informationCh.9 Cryptography. The Graduate Center, CUNY.! CSc 75010 Theoretical Computer Science Konstantinos Vamvourellis
Ch.9 Cryptography The Graduate Center, CUNY! CSc 75010 Theoretical Computer Science Konstantinos Vamvourellis Why is Modern Cryptography part of a Complexity course? Short answer:! Because Modern Cryptography
More informationDigital Signatures. Nicolas T. Courtois  University College of London
Nicolas T. Courtois  University College of London Roadmap Legal aspects What are Digital Signatures? How Secure they are? Main realizations known Applications 2 1. What is a [Digital] Signature? Legal
More informationA Method for Making PasswordBased Key Exchange Resilient to Server Compromise
A Method for Making PasswordBased Key Exchange Resilient to Server Compromise Craig Gentry 1, Philip MacKenzie 2, and Zulfikar Ramzan 3 1 Stanford University, Palo Alto, CA, USA, cgentry@cs.stanford.edu
More informationDigital Signatures. Nicolas T. Courtois  University College London
Nicolas T. Courtois  University College London Roadmap Legal aspects What are Digital Signatures? How Secure they are? Main realizations known Applications 2 1. What is a [Digital] Signature? Legal Aspects
More informationCIS 6930 Emerging Topics in Network Security. Topic 2. Network Security Primitives
CIS 6930 Emerging Topics in Network Security Topic 2. Network Security Primitives 1 Outline Absolute basics Encryption/Decryption; Digital signatures; DH key exchange; Hash functions; Application of hash
More information7! Cryptographic Techniques! A Brief Introduction
7! Cryptographic Techniques! A Brief Introduction 7.1! Introduction to Cryptography! 7.2! Symmetric Encryption! 7.3! Asymmetric (PublicKey) Encryption! 7.4! Digital Signatures! 7.5! Public Key Infrastructures
More informationNew Efficient Searchable Encryption Schemes from Bilinear Pairings
International Journal of Network Security, Vol.10, No.1, PP.25 31, Jan. 2010 25 New Efficient Searchable Encryption Schemes from Bilinear Pairings Chunxiang Gu and Yuefei Zhu (Corresponding author: Chunxiang
More informationMessage Authentication Codes 133
Message Authentication Codes 133 CLAIM 4.8 Pr[Macforge A,Π (n) = 1 NewBlock] is negligible. We construct a probabilistic polynomialtime adversary A who attacks the fixedlength MAC Π and succeeds in
More informationDIGITAL SIGNATURES 1/1
DIGITAL SIGNATURES 1/1 Signing by hand COSMO ALICE ALICE Pay Bob $100 Cosmo Alice Alice Bank =? no Don t yes pay Bob 2/1 Signing electronically Bank Internet SIGFILE } {{ } 101 1 ALICE Pay Bob $100 scan
More informationTalk announcement please consider attending!
Talk announcement please consider attending! Where: Maurer School of Law, Room 335 When: Thursday, Feb 5, 12PM 1:30PM Speaker: Rafael Pass, Associate Professor, Cornell University, Topic: Reasoning Cryptographically
More informationLecture 5  CPA security, Pseudorandom functions
Lecture 5  CPA security, Pseudorandom functions Boaz Barak October 2, 2007 Reading Pages 82 93 and 221 225 of KL (sections 3.5, 3.6.1, 3.6.2 and 6.5). See also Goldreich (Vol I) for proof of PRF construction.
More informationAuthentication and Encryption: How to order them? Motivation
Authentication and Encryption: How to order them? Debdeep Muhopadhyay IIT Kharagpur Motivation Wide spread use of internet requires establishment of a secure channel. Typical implementations operate in
More informationSemantic Security for the McEliece Cryptosystem without Random Oracles
Semantic Security for the McEliece Cryptosystem without Random Oracles Ryo Nojima 1, Hideki Imai 23, Kazukuni Kobara 3, and Kirill Morozov 3 1 National Institute of Information and Communications Technology
More informationCertificate Based Signature Schemes without Pairings or Random Oracles
Certificate Based Signature Schemes without Pairings or Random Oracles p. 1/2 Certificate Based Signature Schemes without Pairings or Random Oracles Joseph K. Liu, Joonsang Baek, Willy Susilo and Jianying
More informationNonBlackBox Techniques In Crytpography. Thesis for the Ph.D degree Boaz Barak
NonBlackBox Techniques In Crytpography Introduction Thesis for the Ph.D degree Boaz Barak A computer program (or equivalently, an algorithm) is a list of symbols a finite string. When we interpret a
More informationAuthenticated Encryption: Relations among notions and analysis of the generic composition paradigm
An extended abstract of this paper appears in Tatsuaki Okamoto, editor, Advances in Cryptology ASIACRYPT 2000, Volume 1976 of Lecture Notes in Computer Science, pages 531 545, Kyoto, Japan, December 3
More informationRSA Attacks. By Abdulaziz Alrasheed and Fatima
RSA Attacks By Abdulaziz Alrasheed and Fatima 1 Introduction Invented by Ron Rivest, Adi Shamir, and Len Adleman [1], the RSA cryptosystem was first revealed in the August 1977 issue of Scientific American.
More informationThreshold Identity Based Encryption Scheme without Random Oracles
WCAN 2006 Threshold Identity Based Encryption Scheme without Random Oracles Jin Li School of Mathematics and Computational Science Sun Yatsen University Guangzhou, P.R. China Yanming Wang Lingnan College
More informationCS 758: Cryptography / Network Security
CS 758: Cryptography / Network Security offered in the Fall Semester, 2003, by Doug Stinson my office: DC 3122 my email address: dstinson@uwaterloo.ca my web page: http://cacr.math.uwaterloo.ca/~dstinson/index.html
More informationLecture 10: CPA Encryption, MACs, Hash Functions. 2 Recap of last lecture  PRGs for one time pads
CS 7880 Graduate Cryptography October 15, 2015 Lecture 10: CPA Encryption, MACs, Hash Functions Lecturer: Daniel Wichs Scribe: Matthew Dippel 1 Topic Covered Chosen plaintext attack model of security MACs
More informationIdentityBased Encryption from the Weil Pairing
Appears in SIAM J. of Computing, Vol. 32, No. 3, pp. 586615, 2003. An extended abstract of this paper appears in the Proceedings of Crypto 2001, volume 2139 of Lecture Notes in Computer Science, pages
More informationRelations Among Notions of Security for Identity Based Encryption Schemes
Relations Among Notions of Security for Identity Based Encryption Schemes Nuttapong Attrapadung 1, Yang Cui 1, David Galindo 2, Goichiro Hanaoka 3, Ichiro Hasuo 2, Hideki Imai 1,3, Kanta Matsuura 1, Peng
More informationAdvanced Cryptography
Family Name:... First Name:... Section:... Advanced Cryptography Final Exam July 18 th, 2006 Start at 9:15, End at 12:00 This document consists of 12 pages. Instructions Electronic devices are not allowed.
More informationAdvanced Topics in Cryptography and Network Security
Advanced Topics in Cryptography and Network Security Breno de Medeiros Department of Computer Science Florida State University Advanced Topics in Cryptography and Network Security p.1 Class Reference Sheet
More informationGroup Blind Digital Signatures: Theory and Applications by Zulækar Amin Ramzan Submitted to the Department of Electrical Engineering and Computer Science in partial fulællment of the requirements for the
More informationNoninteractive and Reusable Nonmalleable Commitment Schemes
Noninteractive and Reusable Nonmalleable Commitment Schemes Ivan Damgård a Jens Groth b June 16, 2003 Abstract We consider nonmalleable (NM) and universally composable (UC) commitment schemes in the
More informationPostQuantum Cryptography #4
PostQuantum Cryptography #4 Prof. Claude Crépeau McGill University http://crypto.cs.mcgill.ca/~crepeau/waterloo 185 ( 186 Attack scenarios Ciphertextonly attack: This is the most basic type of attack
More informationPublic Key Cryptography. c Eli Biham  March 30, 2011 258 Public Key Cryptography
Public Key Cryptography c Eli Biham  March 30, 2011 258 Public Key Cryptography Key Exchange All the ciphers mentioned previously require keys known apriori to all the users, before they can encrypt
More informationDr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010
CS 494/594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Introduction to Cryptography What is cryptography?
More informationLukasz Pater CMMS Administrator and Developer
Lukasz Pater CMMS Administrator and Developer EDMS 1373428 Agenda Introduction Why do we need asymmetric ciphers? Oneway functions RSA Cipher Message Integrity Examples Secure Socket Layer Single Sign
More informationLecture 3: OneWay Encryption, RSA Example
ICS 180: Introduction to Cryptography April 13, 2004 Lecturer: Stanislaw Jarecki Lecture 3: OneWay Encryption, RSA Example 1 LECTURE SUMMARY We look at a different security property one might require
More informationEfficient PasswordAuthenticated Key Exchange Using HumanMemorable Passwords
Efficient PasswordAuthenticated Key Exchange Using HumanMemorable Passwords Jonathan Katz 1 Rafail Ostrovsky 2 Moti Yung 3 1 Telcordia Technologies and Department of Computer Science, Columbia University.
More informationComputer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 20 PublicKey Cryptography and Message Authentication First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown PublicKey Cryptography
More informationThe Exact Security of Digital Signatures How to Sign with RSA and Rabin
Appears in Advances in Cryptology Eurocrypt 96 Proceedings, Lecture Notes in Computer Science Vol. 1070, U. Maurer ed., SpringerVerlag, 1996. The Exact Security of Digital Signatures How to Sign with
More informationPublicKey Cryptanalysis
To appear in Recent Trends in Cryptography, I. Luengo (Ed.), Contemporary Mathematics series, AMSRSME, 2008. PublicKey Cryptanalysis Phong Q. Nguyen Abstract. In 1976, Diffie and Hellman introduced the
More informationPrivacyProviding Signatures and Their Applications. PhD Thesis. Author: Somayeh Heidarvand. Advisor: Jorge L. Villar
PrivacyProviding Signatures and Their Applications PhD Thesis Author: Somayeh Heidarvand Advisor: Jorge L. Villar PrivacyProviding Signatures and Their Applications by Somayeh Heidarvand In fulfillment
More informationMultiRecipient Encryption Schemes: Efficient Constructions and their Security
This is the full version of the paper with same title that appeared in IEEE Transactions on Information Theory, Volume 53, Number 11, 2007. It extends the previously published versions Ku, BBS. MultiRecipient
More informationOverview of PublicKey Cryptography
CS 361S Overview of PublicKey Cryptography Vitaly Shmatikov slide 1 Reading Assignment Kaufman 6.16 slide 2 PublicKey Cryptography public key public key? private key Alice Bob Given: Everybody knows
More informationMessage Authentication Code
Message Authentication Code Ali El Kaafarani Mathematical Institute Oxford University 1 of 44 Outline 1 CBCMAC 2 Authenticated Encryption 3 Padding Oracle Attacks 4 Information Theoretic MACs 2 of 44
More informationCapture Resilient ElGamal Signature Protocols
Capture Resilient ElGamal Signature Protocols Hüseyin Acan 1, Kamer Kaya 2,, and Ali Aydın Selçuk 2 1 Bilkent University, Department of Mathematics acan@fen.bilkent.edu.tr 2 Bilkent University, Department
More informationChapter 12. Digital signatures. 12.1 Digital signature schemes
Chapter 12 Digital signatures In the public key setting, the primitive used to provide data integrity is a digital signature scheme. In this chapter we look at security notions and constructions for this
More informationFoundations of Group Signatures: The Case of Dynamic Groups
A preliminary version of this paper appears in Topics in Cryptology CTRSA 05, Lecture Notes in Computer Science Vol.??, A. Menezes ed., SpringerVerlag, 2005. This is the full version. Foundations of
More informationPublic Key Cryptography and RSA. Review: Number Theory Basics
Public Key Cryptography and RSA Murat Kantarcioglu Based on Prof. Ninghui Li s Slides Review: Number Theory Basics Definition An integer n > 1 is called a prime number if its positive divisors are 1 and
More informationCIS 5371 Cryptography. 8. Encryption 
CIS 5371 Cryptography p y 8. Encryption  Asymmetric Techniques Textbook encryption algorithms In this chapter, security (confidentiality) is considered in the following sense: Allornothing secrecy.
More informationProvably Secure TimedRelease Public Key Encryption
Provably Secure TimedRelease Public Key Encryption JUNG HEE CHEON Seoul National University, Korea and NICHOLAS HOPPER, YONGDAE KIM and IVAN OSIPKOV University of Minnesota  Twin Cities A timedrelease
More informationCryptographic Hash Functions Message Authentication Digital Signatures
Cryptographic Hash Functions Message Authentication Digital Signatures Abstract We will discuss Cryptographic hash functions Message authentication codes HMAC and CBCMAC Digital signatures 2 Encryption/Decryption
More informationPrivacy in Encrypted Content Distribution Using Private Broadcast Encryption
Privacy in Encrypted Content Distribution Using Private Broadcast Encryption Adam Barth 1, Dan Boneh 1, and Brent Waters 2 1 Stanford University, Stanford, CA 94305 {abarth, dabo}@cs.stanford.edu 2 SRI
More informationCiphertext verification security of symmetric encryption schemes
www.scichina.com info.scichina.com www.springerlink.com Ciphertext verification security of symmetric encryption schemes HU ZhenYu 1, SUN FuChun 1 & JIANG JianChun 2 1 National Laboratory of Information
More informationDIRECT ONLINE/OFFLINE DIGITAL SIGNATURE SCHEMES. Ping Yu, M.S. Dissertation Prepared for the Degree of DOCTOR OF PHILOSOPHY UNIVERSITY OF NORTH TEXAS
DIRECT ONLINE/OFFLINE DIGITAL SIGNATURE SCHEMES Ping Yu, M.S. Dissertation Prepared for the Degree of DOCTOR OF PHILOSOPHY UNIVERSITY OF NORTH TEXAS December 2008 APPROVED: Stephen R. Tate, Major Professor
More informationA Proposal for an ISO Standard for Public Key Encryption (version 2.1)
A Proposal for an ISO Standard for Public Key Encryption (version 2.1) Victor Shoup IBM Zurich Research Lab, Säumerstr. 4, 8803 Rüschlikon, Switzerland sho@zurich.ibm.com December 20, 2001 Abstract This
More informationSymmetric Key cryptosystem
SFWR C03: Computer Networks and Computer Security Mar 811 200 Lecturer: Kartik Krishnan Lectures 222 Symmetric Key cryptosystem Symmetric encryption, also referred to as conventional encryption or single
More informationSecuring Remote Access Inside Wireless Mesh Networks
This is the full version of the paper which appears in: Information Security Applications: 10th International Workshop, WISA 2009, Busan, Korea, August 2527, 2009. H. Y. Youm, M. Yung (Eds.) SpringerVerlag,
More informationDigital signatures are one of the most important inventions/applications of modern cryptography.
CHAPTER 7: DIGITAL SIGNATURES Digital signatures are one of the most important inventions/applications of modern cryptography. Part VII Digital signatures The problem is how can a user sign (electronically)
More information36 Toward Realizing PrivacyPreserving IPTraceback
36 Toward Realizing PrivacyPreserving IPTraceback The IPtraceback technology enables us to trace widely spread illegal users on Internet. However, to deploy this attractive technology, some problems
More informationChosenCiphertext Security from IdentityBased Encryption
ChosenCiphertext Security from IdentityBased Encryption Ran Canetti 1, Shai Halevi 1, and Jonathan Katz 2 1 IBM T. J. Watson Research Center, Hawthorne, NY. {canetti,shaih}@watson.ibm.com 2 Dept. of
More informationEnsuring Integrity in Cloud Computing via Homomorphic Digital Signatures: new tools and results
Ensuring Integrity in Cloud Computing via Homomorphic Digital Signatures: new tools and results Dario Catalano Dario Fiore Luca Nizzardo University of Catania Italy IMDEA Software Institute Madrid, Spain
More informationSecurity Aspects of. Database Outsourcing. Vahid Khodabakhshi Hadi Halvachi. Dec, 2012
Security Aspects of Database Outsourcing Dec, 2012 Vahid Khodabakhshi Hadi Halvachi Security Aspects of Database Outsourcing Security Aspects of Database Outsourcing 2 Outline Introduction to Database
More informationDigital signatures. Informal properties
Digital signatures Informal properties Definition. A digital signature is a number dependent on some secret known only to the signer and, additionally, on the content of the message being signed Property.
More informationCommon Pitfalls in Cryptography for Software Developers. OWASP AppSec Israel July 2006. The OWASP Foundation http://www.owasp.org/
Common Pitfalls in Cryptography for Software Developers OWASP AppSec Israel July 2006 Shay Zalalichin, CISSP AppSec Division Manager, Comsec Consulting shayz@comsecglobal.com Copyright 2006  The OWASP
More informationMAC. SKE in Practice. Lecture 5
MAC. SKE in Practice. Lecture 5 Active Adversary Active Adversary An active adversary can inject messages into the channel Active Adversary An active adversary can inject messages into the channel Eve
More information9 Digital Signatures: Definition and First Constructions. Hashing.
Leo Reyzin. Notes for BU CAS CS 538. 1 9 Digital Signatures: Definition and First Constructions. Hashing. 9.1 Definition First note that encryption provides no guarantee that a message is authentic. For
More information