Authenticated Encryption. Jeremy, Paul, Ken, and Mike

Transcription

1 uthntcatd Encrypton Jrmy Paul Kn and M

2 Objctvs Examn thr mthods of authntcatd ncrypton and dtrmn th bst soluton consdrng prformanc and scurty

3 Basc Componnts Mssag uthntcaton Cod + Symmtrc Encrypton Both of ths componnts ar usd as blac boxs

4 Gnrc Composton - Symmtrcncrypton schm E - ncrypton algorthm D - Dcrypton lgorthm M - Mssag authntcaton schm T - taggng algorthm V - tag vrfng algorthm K - randomzd y gnraton algorthm κ - scurty paramtr lngth of th y - th y Not: W sparat th taggng and vrfcaton algorthm

5 Basc Componnts Mssag uthntcaton Cod MC Intgrty / uthntcty Intgrty of Plantxt INT-PTXT Intgrty of Cphrtxt INT-CTXT Symmtrc Encrypton Prvacy Indstngushablty Chosn-plantxt attac IND-CP Chosn-cphrtxt attac IND-CC Non-mallablty Chosn-plantxt attac NM-CP Chosn-cphrtxt attac NM-CP

6 Intgrty Intgrty of Plantxt INT-PTXT Computatonally nfasbl to produc a cphrtxt dcryptng to a mssag whch th sndr has nvr ncryptd Intgrty of Cphrtxt INT-CTXT Computatonally nfasbl to produc a cphrtxt not prvously producd by th sndr rgardlss of whthr or not th undrlyng plantxt s nw

7 Intgrty of symmtrc ncrypton schmd = E K D lgorthm D * K C If D K C thn rturn 1 Els rturn 0 Vrfcaton algorthm or Vrfcaton oracl E Encrypton lgorthm K Randomzd y gnraton algorthm D Dcrypton lgorthm

8 Intgrty of uthntcatd ncrypton schm Th schm s sad to b INT-PTXT f th nt ptxt functon dv th advantag of ptxt s ptxt vry small for any advrsary whos tm- complxty s polynomal n. Lws th schm s sad to b INT-CTXT nt ctxt f th functon dv ctxt th advantag of ctxt s vry small for any advrsary whos tm- complxty s polynomal n.

9 Intgrty of uthntcatd ncrypton schm Exprmnt Exp R K Κ κ If th oracl D - D ΕK D ptxt * K * C rturns1 and - M df D κ mas a qury C to K * K nt ptxt ptxt such that thn rturn 1ls rturn 0 C was nvr a qury to E K Exprmnt Exp R K Κ κ If th oracl D - D - C ΕK D ctxt * K * κ mas a qury C to * K nt ctxt ctxt such that C rturns1 and was nvr a rspons toe thn rturn 1ls rturn 0 K dv dv nt ptxt ptxt nt ctxt ctxt = = Pr[ Exp Pr[ Exp nt ptxt ptxt nt ctxt ctxt = 1] = 1] dvantags of th advrsars dv dv nt ptxt nt ctxt t q t q q q d d µ µ µ µ d d = = max{ dv max{ dv ptxt ctxt nt ptxt ptxt nt ctxt ctxt } } dvantags of th schm

10 Indstngushablty Indstngushablty of Chosn Plantxt ttac IND-CP Indstngushablty of Chosn Cphrtxt ttac IND-CC If M0 M and M1 M ar ncryptd a rasonabl advrsary should not b abl to dtrmn whch mssag s snt.

11 Lft-or-rght Σ K LR..b whr b {0 1} to ta nput M 0 M 1 M 0 = M 1 f b = 0 C Σ K M 0 rturn C ls C Σ K M 1 rturn C s was mntond from dam s s lctur w consdr th ncrypton schm to b good f a rasonabl advrsary cannot obtan sgnfcant advantag n dstngushng th cass b = 0 and b = 1 gvn accss to th lft-or-rght oracl.

12 Non-mallablty Prvnts th gnraton of a cphrtxt whos plantxts ar manngful Rqurs that an attacr gvn a challng cphrtxt b unabl to modfy t nto anothr dffrnt cphrtxt n such a way that th plantxts undrlyng th two cphrtxts ar manngful rlatd to ach othr... Ptxt1: snd a chc of $ Ptxt2: snd a chc of $

13 Non-mallablty - Formally Non-mallablty - Formally x Exp Exprmnt 2 1 cpa.. rturn s c p x c D p s c K b cpa b LR E cpa R b cpa nm κ x Exp Exprmnt 2 1 cca.. rturn s c p x c D p s c K b cca b LR E cca R b cca nm κ 1] Pr[ 1] Pr[ 1] Pr[ 1] Pr[ = = = = = = Exp Exp dv Exp Exp dv cca nm cca nm cpa nm cpa nm cpa nm cpa nm cca cca cca cpa cpa cpa } max{ } max{ dv q t dv dv q t dv cca nm cca nm cpa nm cpa nm cca cca cpa cpa = = µ µ 2 oracls 1oracl {01} b D E K cca cca cca cpa cpa cpa N = = = κ If nglgbl NM-CP If nglgbl NM-CC

14 Unforgablty Wa Unforgablty aganst Chosn Mssag ttacs WUF-CM dvrsary F can t t crat a nw mssag and tag Strong Unforgabllty aganst Chosn Mssag ttacs SUF-CM dvrsary F can t t crat a nw tag for an xstng mssag

15 Dffcults Th notons of authntcty ar by thmslvs qut dsjont from th notons of prvacy.. Sndng th mssag n th clar wth an accompanyng strong MC achvs INT- CTXT but no nd of prvacy

16 Rlatons among notons of symmtrc ncrypton INT-CTXT ^ IND-CP IND-CC NM-CP INT-PTXT ^ IND-CP IND-CP NM-CC

17 Rlatons among notons of symmtrc INT CTXT INT ncrypton Thorm 3.1 PTXT nt ptxt nt ctxt dv t q q µ µ dv t q q µ µ advrsary mountng an attac aganst ntgrty of plantxts of advrsary mountng an attac aganst ntgrty of cphrtxts of = dvrsary ' rturn C C - s th wnnngqury d d dv It s ntatv that f an advrsary volats ntgrty of plantxts of a schm = KED also volats ntgrty of cphrtxts of th sam schm nt d d ptxt nt ctxt dv '

18 Proposton 3.3 IND-CC INT-PTXT Gvn a symmtrc ncrypton schm whch s IND-CC scur w can construct a symmtrc ncrypton schm whch s also IND-CC scur but s not INT-PTXT scur

19 IND-CC INT-PTXT Lt = K E D W dfn a such that s IND-CC scur but s not INT- PTXT scur Bascally a crtan nown strng or strngs wll b vwd by as vald and dcryptd to crtan nown mssags so that forgry s asy Howvr ths cphrtxts wll nvr b producd by th ncrypton algorthm so prvacy wll not b affctd lgorthm E M C' E M C 0 C' Rturn C = K E D D lgorthm D C Pars C as b C' whr b s a bt E M f b = 0 thn M D C'; rturn M Elsrturn 0

20 IND-CC INT-PTXT ttac dvrsary D Submt qury 10 to oracl D * 10 = 0 E K D lttl Endan LSB 1 st dv nt ptxt = 1 * Qury 10 s a vald cphrtxt It dcrypts to a msg 0 that th advrsary nvr qurd of ts oracl mas zro qurs to E K and on qury to D K totalng 2 bts and Is Crtanly poly-tm

21 IND-CC INT-PTXT dvrsary B E for = 1...q whn mas a qury M 0 E whn mas a qury C ' Pars C as b C f b = 0 thn D Els 0 LR.. b D + q do LRM d 0 whr b IND-CC To prov that s IND-CC scur t suffcs nough to assocat wth any poly-tm advrsary B attacng n th IND-CC nd cca nd cca sns such that dv dv B M C 1 ' 0 to ts dcrypton oracl do M b 1 s a bt to ts lft - or - rght ncrypton oracl do B smulats and Uss ts oracls to nswr s oracl qurs It s asy for B to bra th schm f can

22 Othr Rlatons Thorm 3.2 INT-CTXT ^ IND-CP IND-CC Proposton 3.4 INT-PTXT ^ IND-CP dos not NM-CP

23 Scurty of th Compost Schms Provn to mt th scurty rqurmnt assumng componnt ncrypton schm mts IND-CP and mssag authntcaton schm s unforgabl undr CM Som IND-CP scur symmtrc ncrypton and som mssag authntcaton schm unforgabl undr CM xst that dosn t t mt th scurty rqurmnt

24 Gnrc Composton Usng both functons as blac boxs MC Symmtrc Encrypton

25 Encrypt-and-MC C = Encrypt M II MC M

26 Encrypt-and-MC Scurty Scurty IND-CP Wa MC Strong MC Prvacy IND-CC NM-CP Intgrty INT-PTXT INT-CTXT

27 MC-thn-Encrypt C = Encrypt M MC M II

28 MC-thn-Encrypt Scurty Scurty IND-CP Wa MC Strong MC Prvacy IND-CC NM-CP Intgrty INT-PTXT INT-CTXT

29 Encrypt-thn-MC C = Encrypt M II MC Encrypt M

30 Encrypt-thn-MC Scurty Scurty IND-CP Wa MC Strong MC Prvacy IND-CC NM-CP Intgrty INT-PTXT INT-CTXT

31 Summary of Mthods Summary of Mthods Encrypt-thn-MC Encrypt-thn-MC MC-thn-Encrypt MC-thn-Encrypt Encrypt-and-MC Encrypt-and-MC INT-CTXT INT-CTXT INT-PTXT INT-PTXT NM-CP NM-CP IND-CC IND-CC IND-CP IND-CP Intgrty Intgrty Prvacy Prvacy Composton Composton Mthod Mthod Encrypt-thn-MC Encrypt-thn-MC MC-thn-Encrypt MC-thn-Encrypt Encrypt-and-MC Encrypt-and-MC INT-CTXT INT-CTXT INT-PTXT INT-PTXT NM-CP NM-CP IND-CC IND-CC IND-CP IND-CP Intgrty Intgrty Prvacy Prvacy Composton Composton Mthod Mthod Waly Waly Unforgabl Unforgabl Strongly Strongly Unforgabl Unforgabl

32 Thorm 4.7 Encrypt-thn-MC mthod s IND-CP and INT-PTXT b a symmtrc schm M b mssag authntcaton schm dv dv nd cpa nt ptxt t q µ t q q d dv µ µ nd cpa d t q µ dv wuf cma M t q q d µ µ d

33 Thorm IND-CP dv nd cpa nd cpa dv t q µ p dvrsary m For = 1...q do Whn mas a C E E K p R K K b' Rturn b' m LR.. b κ LRM κ qury M o M 1 o M b; τ 1 to ts lft Τ K m C or rght ; C τ ncrypton oracl do

34 Thorm INT-PTXT dv nt ptxt wuf cma dv M p dvrsary R Τ K E K m For = 1...q C F Pars C K V κ as C K m + q Whn mas a M ; τ Whn mas a p.. d κ do qury M τ ; v Τ K qury C m V to ts ncrypton oracl do C K m ' ; C C τ ; v ' ' τ to ts vrfcaton oracl do

35 Proposton 4.9 Encrypt-thn-MC mthod wth a SUF- CM-scur MC s INT-CTXT IND-CP and IND-CC dv nt ctxt suf cma dv M F dv dv dv nd cpa nt ctxt nd cca t q µ dv t q t q q d q d µ µ dv t q µ µ µ 2 dv nd cpa d d + suf cma M dv nd cpa t q suf cma M t q t q q d µ q µ d + q l µ µ d + q l µ d

36 Concluson Encrypt-thn-MC provds th most scur soluton for authntcatd ncrypton

37

38 CBC Cphr Bloc Chan If IV s dffrnt thn nstancs of sam msg or bloc wll b ncryptd dffrntly If K th cphr bloc C gts corruptd n transmsson only blocs P and P+1 ar affctd Ths can also allow som msg tamprng If on plantxt bloc P s changd ll subsqunt cphrtxt blocs wll b affctd Ths lads to an ffctv MC

39 ECB Elctronc Cod Boo If th sam y s usd thn dntcal plantxt blocs map to dntcal cphrtxt

40 Proposton 4.1 Encrypt-and MC mthod s not IND-CP

41 Proposton 4.2 Encrypt-and MC mthod s IND-CP nscur for any dtrmnstc MC

42 Thorm 4.3 Encrypt-and-MC s INT-PTXT scur

43 Proposton 4.4 Encrypt-and-MC mthod s not INT- CTXT scur

44 Thorm 4.5 MC-thn-ncrypt mthod s both INT- PTXT an IND-CP scur

45 Proposton 4.6 MC-thn-ncrypt mthod s not NM-CP scur

46 Proposton 4.8 Encrypt-thn-MC mthod wth a WUF- CM-scur MC s not NM-CP scur