Foudations of Cryptography
Foudations of Cryptography
Foundations of Cryptography
II Basic Applications
Oded Goldreich
Weizmann Institute of Science
To Dana
Contents
II Basic Applications
page xi
xiii
xxi
List of Figures
Preface
Acknowledgments
373
5 Encryption Schemes
5.1. The Basic Setting
5.1.1. Private-Key Versus Public-Key Schemes
5.1.2. The Syntax of Encryption Schemes
Semantic Security
Indistinguishability of Encryptions
Equivalence of the Security Denitions
Multiple Messages
A Uniform-Complexity Treatment
Stream-Ciphers
Preliminaries: Block-Ciphers
Private-Key Encryption Schemes
Public-Key Encryption Schemes
Overview
Key-Dependent Passive Attacks
Chosen Plaintext Attack
Chosen Ciphertext Attack
Non-Malleable Encryption Schemes
5.5. Miscellaneous
5.5.1. On Using Encryption Schemes
5.5.2. On Information-Theoretic Security
5.5.3. On Some Popular Schemes
vii
374
375
376
378
379
382
383
389
394
403
404
408
410
413
422
422
425
431
438
470
474
474
476
477
CONTENTS
5.5.4.
5.5.5.
5.5.6.
5.5.7.
Historical Notes
Suggestions for Further Reading
Open Problems
Exercises
Unique Signatures
Super-Secure Signature Schemes
Off-Line/On-Line Signing
Incremental Signatures
Fail-Stop Signatures
6.6. Miscellaneous
6.6.1.
6.6.2.
6.6.3.
6.6.4.
6.6.5.
6.6.6.
6.6.7.
478
480
481
481
497
498
498
499
501
502
505
507
507
508
516
523
523
531
537
538
543
560
575
575
576
580
581
583
584
584
585
586
587
589
590
590
599
viii
600
601
607
609
CONTENTS
Denitions
Security in the Semi-Honest Model
The Malicious Models: Overview and Preliminaries
The First Compiler: Forcing Semi-Honest Behavior
The Second Compiler: Effectively Preventing Abort
7.7. Miscellaneous
7.7.1.*
7.7.2.*
7.7.3.
7.7.4.
7.7.5.
7.7.6.
7.7.7.
ix
615
615
619
626
634
636
640
643
645
650
650
652
657
681
693
694
701
708
714
729
741
742
743
746
747
747
752
755
756
757
758
759
765
765
768
768
769
770
771
772
772
773
774
CONTENTS
775
775
780
783
784
785
795
Bibliography
Index
List of Figures
0.1
0.2
0.3
5.1
5.2
6.1
6.2
6.3
6.4
6.5
7.1
7.2
7.3
xi
page xvi
xvii
xviii
375
376
500
519
522
546
547
601
658
690
Preface
PREFACE
obtained using them. Our emphasis is on the clarication of fundamental concepts and
on demonstrating the feasibility of solving several central cryptographic problems.
Solving a cryptographic problem (or addressing a security concern) is a two-stage
process consisting of a denitional stage and a constructive stage. First, in the denitional stage, the functionality underlying the natural concern is to be identied, and an
adequate cryptographic problem has to be dened. Trying to list all undesired situations
is infeasible and prone to error. Instead, one should dene the functionality in terms of
operation in an imaginary ideal model, and require a candidate solution to emulate this
operation in the real, clearly dened model (which species the adversarys abilities).
Once the denitional stage is completed, one proceeds to construct a system that satises the denition. Such a construction may use some simpler tools, and its security is
proven relying on the features of these tools. In practice, of course, such a scheme may
also need to satisfy some specic efciency requirements.
This work focuses on several archetypical cryptographic problems (e.g., encryption
and signature schemes) and on several central tools (e.g., computational difculty,
pseudorandomness, and zero-knowledge proofs). For each of these problems (resp.,
tools), we start by presenting the natural concern underlying it (resp., its intuitive
objective), then dene the problem (resp., tool), and nally demonstrate that the problem
may be solved (resp., the tool can be constructed). In the last step, our focus is on demonstrating the feasibility of solving the problem, not on providing a practical solution. As
a secondary concern, we typically discuss the level of practicality (or impracticality)
of the given (or known) solution.
Computational Difculty
The specic constructs mentioned earlier (as well as most constructs in this area) can
exist only if some sort of computational hardness exists. Specically, all these problems
and tools require (either explicitly or implicitly) the ability to generate instances of hard
problems. Such ability is captured in the denition of one-way functions (see further
discussion in Section 2.1). Thus, one-way functions are the very minimum needed for
doing most sorts of cryptography. As we shall see, one-way functions actually sufce for
doing much of cryptography (and the rest can be done by augmentations and extensions
of the assumption that one-way functions exist).
Our current state of understanding of efcient computation does not allow us to prove
that one-way functions exist. In particular, the existence of one-way functions implies
that N P is not contained in BPP P (not even on the average), which would
resolve the most famous open problem of computer science. Thus, we have no choice
(at this stage of history) but to assume that one-way functions exist. As justication for
this assumption, we may only offer the combined beliefs of hundreds (or thousands) of
researchers. Furthermore, these beliefs concern a simply stated assumption, and their
validity follows from several widely believed conjectures that are central to various
elds (e.g., the conjecture that factoring integers is hard is central to computational
number theory).
Since we need assumptions anyhow, why not just assume what we want (i.e., the
existence of a solution to some natural cryptographic problem)? Well, rst we need
xiv
PREFACE
to know what we want: As stated earlier, we must rst clarify what exactly we want;
that is, we must go through the typically complex denitional stage. But once this stage
is completed, can we just assume that the denition derived can be met? Not really.
Once a denition is derived, how can we know that it can be met at all? The way to
demonstrate that a denition is viable (and so the intuitive security concern can be
satised at all) is to construct a solution based on a better-understood assumption (i.e.,
one that is more common and widely believed). For example, looking at the denition
of zero-knowledge proofs, it is not a priori clear that such proofs exist at all (in a
non-trivial sense). The non-triviality of the notion was rst demonstrated by presenting
a zero-knowledge proof system for statements regarding Quadratic Residuosity that
are believed to be hard to verify (without extra information). Furthermore, contrary to
prior beliefs, it was later shown that the existence of one-way functions implies that
any NP-statement can be proven in zero-knowledge. Thus, facts that were not at all
known to hold (and were even believed to be false) were shown to hold by reduction to
widely believed assumptions (without which most of modern cryptography collapses
anyhow). To summarize, not all assumptions are equal, and so reducing a complex,
new, and doubtful assumption to a widely believed simple (or even merely simpler)
assumption is of great value. Furthermore, reducing the solution of a new task to the
assumed security of a well-known primitive typically means providing a construction
that, using the known primitive, solves the new task. This means that we not only know
(or assume) that the new task is solvable but also have a solution based on a primitive
that, being well known, typically has several candidate implementations.
PREFACE
PREFACE
More advanced material is typically presented at a faster pace and with fewer details.
Thus, we hope that the attempt to satisfy a wide range of readers will not harm any of
them.
Teaching. The material presented in this work, on the one hand, is way beyond what
one may want to cover in a course and, on the other hand, falls very short of what one
may want to know about Cryptography in general. To assist these conicting needs, we
make a distinction between basic and advanced material and provide suggestions for
further reading (in the last section of each chapter). In particular, sections, subsections,
and subsubsections marked by an asterisk (*) are intended for advanced reading.
xvii
PREFACE
This work is intended to provide all material required for a course on Foundations
of Cryptography. For a one-semester course, the teacher will denitely need to skip all
advanced material (marked by an asterisk) and perhaps even some basic material; see
the suggestions in Figure 0.3. Depending on the class, this should allow coverage of the
basic material at a reasonable level (i.e., all material marked as main and some of the
optional). This work can also serve as a textbook for a two-semester course. In such
a course, one should be able to cover the entire basic material suggested in Figure 0.3,
and even some of the advanced material.
Practice. The aim of this work is to provide sound theoretical foundations for cryptography. As argued earlier, such foundations are necessary for any sound practice of
cryptography. Indeed, practice requires more than theoretical foundations, whereas the
current work makes no attempt to provide anything beyond the latter. However, given a
sound foundation, one can learn and evaluate various practical suggestions that appear
elsewhere (e.g., in [149]). On the other hand, lack of sound foundations results in an
inability to critically evaluate practical suggestions, which in turn leads to unsound
xviii
PREFACE
decisions. Nothing could be more harmful to the design of schemes that need to withstand adversarial attacks than misconceptions about such attacks.
xix
Acknowledgments
. . . very little do we have and inclose which we can call our own in the
deep sense of the word. We all have to accept and learn, either from our
predecessors or from our contemporaries. Even the greatest genius would
not have achieved much if he had wished to extract everything from inside
himself. But there are many good people, who do not understand this,
and spend half their lives wondering in darkness with their dreams of
originality. I have known artists who were proud of not having followed
any teacher and of owing everything only to their own genius. Such fools!
Goethe, Conversations with Eckermann, 17.2.1832
First of all, I would like to thank three remarkable people who had a tremendous
inuence on my professional development: Shimon Even introduced me to theoretical
computer science and closely guided my rst steps. Silvio Micali and Sha Goldwasser
led my way in the evolving foundations of cryptography and shared with me their
constant efforts for further developing these foundations.
I have collaborated with many researchers, yet I feel that my collaboration with
Benny Chor and Avi Wigderson had the most important impact on my professional
development and career. I would like to thank them both for their indispensable contribution to our joint research and for the excitement and pleasure I had when collaborating
with them.
Leonid Levin deserves special thanks as well. I had many interesting discussions
with Leonid over the years, and sometimes it took me too long to realize how helpful
these discussions were.
Special thanks also to four of my former students, from whom I have learned a lot
(especially regarding the contents of this volume): to Boaz Barak for discovering the
unexpected power of non-black-box simulations, to Ran Canetti for developing denitions and composition theorems for secure multi-party protocols, to Hugo Krawczyk
for educating me about message authentication codes, and to Yehuda Lindell for significant simplication of the construction of a posteriori CCA (which enables a feasible
presentation).
xxi
ACKNOWLEDGMENTS
Next, Id like to thank a few colleagues and friends with whom I had signicant
interaction regarding Cryptography and related topics. These include Noga Alon,
Hagit Attiya, Mihir Bellare, Ivan Damgard, Uri Feige, Shai Halevi, Johan Hastad,
Amir Herzberg, Russell Impagliazzo, Jonathan Katz, Joe Kilian, Eyal Kushilevitz,
Yoad Lustig, Mike Luby, Daniele Micciancio, Moni Naor, Noam Nisan, Andrew
Odlyzko, Yair Oren, Rafail Ostrovsky, Erez Petrank, Birgit Ptzmann, Omer Reingold,
Ron Rivest, Alon Rosen, Amit Sahai, Claus Schnorr, Adi Shamir, Victor Shoup,
Madhu Sudan, Luca Trevisan, Salil Vadhan, Ronen Vainish, Yacob Yacobi, and David
Zuckerman.
Even assuming I did not forget people with whom I had signicant interaction on
topics touching upon this book, the list of people Im indebted to is far more extensive.
It certainly includes the authors of many papers mentioned in the reference list. It also
includes the authors of many Cryptography-related papers that I forgot to mention, and
the authors of many papers regarding the Theory of Computation at large (a theory
taken for granted in the current book).
Finally, I would like to thank Boaz Barak, Alex Healy, Vlad Kolesnikov, Yehuda
Lindell, and Minh-Huyen Nguyen for reading parts of this manuscript and pointing out
various difculties and errors.
xxii
CHAPTER FIVE
Encryption Schemes
ENCRYPTION SCHEMES
In fact, in many cases, the legitimate interest may be served best by publicizing the scheme itself, because this
allows an (independent) expert evaluation of the security of the scheme to be obtained.
374
plaintext
X
plaintext
ciphertext
ADVERSARY
The key K is known to both receiver and sender, but is unknown to
the adversary. For example, the receiver may generate K at random
and pass it to the sender via a perfectly-private secondary channel (not
shown here).
Figure 5.1: Private-key encryption schemes: an illustration.
decryption-key, yields the original plaintext. We stress that knowledge of the decryptionkey is essential for the latter transformation.
ENCRYPTION SCHEMES
plaintext
X
plaintext
ciphertext
e
e
Senders protected region
ADVERSARY
The key-pair (e, d) is generated by the receiver, who posts the
encryption-key e on a public media, while keeping the decryption-key
d secret.
Figure 5.2: Public-key encryption schemes: an illustration.
absolute security. However, its usage of the key is inefcient; or, put in other words,
it requires keys of length comparable to the total length (or information contents) of
the data being communicated. By contrast, the rest of this chapter will focus on encryption schemes in which n-bit long keys allow for the secure communication of
data having an a priori unbounded (albeit polynomial in n) length. In particular, n-bit
long keys allow for signicantly more than n bits of information to be communicated
securely.
Public-Key Encryption Schemes. A new type of encryption schemes emerged in
the 1970s. In these so-called public-key (or asymmetric) encryption schemes, the
decryption-key differs from the encryption-key. Furthermore, it is infeasible to nd the
decryption-key, given the encryption-key. These schemes enable secure communication
without the use of a secure channel. Instead, each party applies the key-generation
algorithm to produce a pair of keys. The party (denoted P) keeps the decryption-key,
denoted d P , secret and publishes the encryption-key, denoted e P . Now, any party can
send P private messages by encrypting them using the encryption-key e P . Party P can
decrypt these messages by using the decryption-key d P , but nobody else can do so.
(See illustration in Figure 5.2.)
where the probability is taken over the internal coin tosses of algorithms E and D.
The integer n serves as the security parameter of the scheme. Each (e, d) in the range
of G(1n ) constitutes a pair of corresponding encryption/decryption keys. The string
E(e, ) is the encryption of the plaintext {0, 1} using the encryption-key e, whereas
D(d, ) is the decryption of the ciphertext using the decryption-key d.
We stress that Denition 5.1.1 says nothing about security, and so trivial (insecure)
def
def
algorithms may satisfy it (e.g., E(e, ) = and D(d, ) = ). Furthermore, Denition 5.1.1 does not distinguish private-key encryption schemes from public-key ones.
The difference between the two types is introduced in the security denitions: In a
public-key scheme the breaking algorithm gets the encryption-key (i.e., e) as an additional input (and thus e = d follows), while in private-key schemes e is not given to
the breaking algorithm (and thus, one may assume, without loss of generality, that
e = d).
We stress that this denition requires the scheme to operate for every plaintext,
and specically for plaintext of length exceeding the length of the encryption-key.
(This rules out the information theoretic secure one-time pad scheme mentioned
earlier.)
Notation. In the rest of this text, we write E e () instead of E(e, ) and Dd () instead
of D(d, ). Sometimes, when there is little risk of confusion, we drop these subscripts.
Also, we let G 1 (1n ) (resp., G 2 (1n )) denote the rst (resp., second) element in the
pair G(1n ). That is, G(1n ) = (G 1 (1n ), G 2 (1n )). Without loss of generality, we may
assume that |G 1 (1n )| and |G 2 (1n )| are polynomially related to n, and that each of these
integers can be efciently computed from the other. (In fact, we may even assume that
|G 1 (1n )| = |G 2 (1n )| = n; see Exercise 6.)
Comments. Denition 5.1.1 may be relaxed in several ways without signicantly harming its usefulness. For example, we may relax Condition (2) and allow a negligible decryption error (e.g., Pr[Dd (E e ()) = ] < 2n ). Alternatively, one may postulate that
Condition (2) holds for all but a negligible measure of the key-pairs generated by G(1n ).
At least one of these relaxations is essential for some suggestions of (public-key) encryption schemes.
Another relaxation consists of restricting the domain of possible plaintexts (and
ciphertexts). For example, one may restrict Condition (2) to s of length (n), where
: N N is some xed function. Given a scheme of the latter type (with plaintext
length ), we may construct a scheme as in Denition 5.1.1 by breaking plaintexts into
blocks of length (n) and applying the restricted scheme separately to each block. (Note
that security of the resulting scheme requires that the security of the length-restricted
scheme be preserved under multiple encryptions with the same key.) For more details
see Sections 5.2.4 and 5.3.2.
377
ENCRYPTION SCHEMES
ENCRYPTION SCHEMES
that is exponential in the security parameter (see Exercise 3). Likewise, we restrict the
functions f and h to be polynomially-bounded, that is, | f (z)|, |h(z)| poly(|z|).
The difference between private-key and public-key encryption schemes is manifested
in the denition of security. In the latter case, the adversary (which is trying to obtain
information on the plaintext) is given the encryption-key, whereas in the former case
it is not. Thus, the difference between these schemes amounts to a difference in the
adversary model (considered in the denition of security). We start by presenting the
denition for private-key encryption schemes.
Denition 5.2.1 (semantic security private-key): An encryption scheme, (G, E, D),
is semantically secure (in the private-key model) if for every probabilistic polynomialtime algorithm A there exists a probabilistic polynomial-time algorithm A such that
for every probability ensemble {X n }nN , with |X n | poly(n), every pair of polynomially bounded functions f, h : {0, 1} {0, 1} , every positive polynomial p and all
sufciently large n
Pr A(1n , E G 1 (1n ) (X n ), 1|X n | , h(1n , X n )) = f (1n , X n )
< Pr A (1n , 1|X n | , h(1n , X n )) = f (1n , X n ) +
1
p(n)
(The probability in these terms is taken over X n as well as over the internal coin tosses
of either algorithms G, E, and A or algorithm A .)
We stress that all the occurrences of X n in each of the probabilistic expressions refer to the same random variable (see the general convention stated in Section 1.2.1
in Volume 1). The security parameter 1n is given to both algorithms (as well as to the
functions h and f ) for technical reasons.2 The function h provides both algorithms with
partial information regarding the plaintext X n . Furthermore, h also makes the denition implicitly non-uniform; see further discussion in Section 5.2.1.2. In addition, both
algorithms get the length of X n . These algorithms then try to guess the value f (1n , X n );
namely, they try to infer information about the plaintext X n . Loosely speaking, in a semantically secure encryption scheme the ciphertext does not help in this inference task.
That is, the success probability of any efcient algorithm (i.e., algorithm A) that is given
the ciphertext can be matched, up to a negligible fraction, by the success probability of
an efcient algorithm (i.e., algorithm A ) that is not given the ciphertext at all.
Denition 5.2.1 refers to private-key encryption schemes. To derive a denition of
security for public-key encryption schemes, the encryption-key (i.e., G 1 (1n )) should
be given to the adversary as an additional input.
2
The auxiliary input 1n is used for several purposes. First, it allows smooth transition to fully non-uniform
formulations (e.g., Denition 5.2.3) in which the (polynomial-size) adversary depends on n. Thus, it is good to
provide A (and thus also A ) with 1n . Once this is done, it is natural to allow also h and f to depend on n. In
fact, allowing h and f to explicitly depend on n facilitates the proof of Proposition 5.2.7. In light of the fact
that 1n is given to both algorithms, we may replace the input part 1|X n | by |X n |, because the former may be
recovered from the latter in poly(n)-time.
380
1
p(n)
Recall that (by our conventions) both occurrences of G 1 (1n ), in the rst probabilistic
expression, refer to the same random variable. We comment that it is pointless to give
the random encryption-key (i.e., G 1 (1n )) to algorithm A (because the task as well as
the main inputs of A are unrelated to the encryption-key, and anyhow A could generate
a random encryption-key by itself).
Terminology. For sake of simplicity, we refer to an encryption scheme that is semantically secure in the private-key (resp., public-key) model as a semantically secure
private-key (resp., public-key) encryption scheme.
The reader may note that a semantically secure public-key encryption scheme cannot
employ a deterministic encryption algorithm; that is, E e (x) must be a random variable
rather than a xed string. This is more evident with respect to the equivalent Denition 5.2.4. See further discussion following Denition 5.2.4.
ENCRYPTION SCHEMES
given to the algorithms) the algorithms are asked to guess the value of f (at a plaintext
implicit in the ciphertext given only to A). However, as we shall see in the sequel (see
also Exercise 13), the actual technical content of semantic security is that the probability ensembles {(1n , E(X n ), 1|X n | , h(1n , X n ))}n and {(1n , E(1|X n | ), 1|X n | , h(1n , X n ))}n
are computationally indistinguishable (and so whatever A can compute can also be
computed by A ). Note that the latter statement does not refer to the function f , which
explains why we need not make any restriction regarding f.
Other Modications of No Impact. Actually, inclusion of a priori information regarding the plaintext (represented by the function h) does not affect the denition of
semantic security: Denition 5.2.1 remains intact if we restrict h to only depend on
the security parameter (and so only provide plaintext-oblivious non-uniform advice).
(This can be shown in various ways; e.g., see Exercise 14.1.) Also, the function f can
be restricted to be a Boolean function having polynomial-size circuits, and the random
variable X n may be restricted to be very dull (e.g., have only two strings in its support): See proof of Theorem 5.2.5. On the other hand, Denition 5.2.1 implies stronger
forms discussed in Exercises 13, 17 and 18.
1
p(n)
The probability in these terms is taken over the internal coin tosses of algorithms G
and E.
Note that the potential plaintexts to be distinguished can be incorporated into the circuit
Cn . Thus, the circuit models both the adversarys strategy and its a priori information:
See Exercise 11.
Again, the security denition for public-key encryption schemes is derived by adding
the encryption-key (i.e., G 1 (1n )) as an additional input to the potential distinguisher.
382
1
p(n)
ENCRYPTION SCHEMES
Proposition 5.2.6 (useful direction: indistinguishability implies security): Suppose that (G, E, D) is a ciphertext-indistinguishable private-key encryption scheme.
Then (G, E, D) is semantically secure. Furthermore, Denition 5.2.1 is satised by
using A = M A , where M is a xed oracle machine; that is, there exists a single M
such that for every A letting A = M A will do.
Proposition 5.2.7 (opposite direction: security implies indistinguishability): Suppose that (G, E, D) is a semantically secure private-key encryption scheme. Then
(G, E, D) has indistinguishable encryptions. Furthermore, the conclusion holds even
if the denition of semantic security is restricted to the special case satisfying the
following four conditions:
1. The random variable X n is uniformly distributed over a set containing two strings;
2. The value of h depends only on the length of its input or alternatively h(1n , x) =
h (n), for some h ;
3. The function f is Boolean and is computable by a family of (possibly non-uniform)
polynomial-size circuits;
4. The algorithm A is deterministic.
In addition, no computational restrictions are placed on algorithm A (i.e., A can be
any function), and moreover A may depend on {X n }nN , h, f , and A.
Observe that the four itemized conditions limit the scope of the four universal quantiers
in Denition 5.2.1, whereas the last sentence removes a restriction on the existential
quantier (i.e., removes the complexity bound on A ) and reverses the order of quantiers allowing the existential quantier to depend on all universal quantiers (rather than
only on the last one). Thus, each of these modications makes the resulting denition
potentially weaker. Still, combining Propositions 5.2.7 and 5.2.6, it follows that a weak
version of Denition 5.2.1 implies (an even stronger version than) the one stated in
Denition 5.2.1.
A guesses f (1n , X n ) essentially as well when given a dummy encryption as when given
the encryption of X n ). Details follow.
The construction of A : Let A be an algorithm that tries to infer partial information (i.e.,
the value f (1n , X n )) from the encryption of the plaintext X n (when also given 1n , 1|X n |
and a priori information h(1n , X n )). Intuitively, on input E() and (1n , 1|| , h(1n , )),
algorithm A tries to guess f (1n , ). We construct a new algorithm, A , that performs
essentially as well without getting the input E(). The new algorithm consists of invoking A on input E G 1 (1n ) (1|| ) and (1n , 1|| , h(1n , )), and outputting whatever A does.
That is, on input (1n , 1|| , h(1n , )), algorithm A proceeds as follows:
< Pr A (1n , 1|X n | , h(1n , X n )) = f (1n , X n ) +
1
p(n)
def
Proof: To simplify the notations, let us incorporate 1|| into h n () = h(1n , ) and let
def
ENCRYPTION SCHEMES
Assume toward the contradiction that for some polynomial p and innitely many
ns Eq. (5.1) is violated. Then, for each such n, we have E[n (X n )] > 1/ p(n), where
def
n (x) = Pr A(E G 1 (1n ) (x), h n (x)) = f n (x) Pr A(E G 1 (1n ) (1|x| ), h n (x)) = f n (x)
We use an averaging argument to single out a string xn in the support of X n such that
n (xn ) E[n (X n )]: That is, let x n {0, 1}poly(n) be a string for which the value of
n () is maximum, and so n (xn ) > 1/ p(n). Using this x n , we introduce a circuit Cn ,
which incorporates the xed values f n (xn ) and h n (xn ), and distinguishes the encryption
of xn from the encryption of 1|xn | . The circuit Cn operates as follows. On input = E(),
the circuit C n invokes A(, h n (xn )) and outputs 1 if and only if A outputs the value
f n (xn ). Otherwise, Cn outputs 0.
This circuit is indeed of polynomial size because it merely incorporates strings of
polynomial length (i.e., f n (xn ) and h n (xn )) and emulates a polynomial-time computation
(i.e., that of A). (Note that the circuit family {Cn } is indeed non-uniform since its
denition is based on a non-uniform selection of xn s as well as on a hardwiring of
(possibly uncomputable) corresponding strings h n (xn ) and f n (x n ).) Clearly,
Pr C n (E G 1 (1n ) ()) = 1 = Pr A(E G 1 (1n ) (), h n (xn )) = f n (x n )
(5.2)
Combining Eq. (5.2) with the denition of n (xn ), we get
Pr Cn (E G 1 (1n ) (xn )) = 1 Pr Cn (E G 1 (1n ) (1|xn | )) = 1 = n (x n )
>
1
p(n)
This contradicts our hypothesis that E has indistinguishable encryptions, and the claim
follows.
We have just shown that A performs essentially as well as A, and so Proposition 5.2.6
follows.
Comments. The fact that we deal with a non-uniform model of computation allows
the preceding proof to proceed regardless of the complexity of f and h. All that
our denition of C n requires is the hardwiring of the values of f and h on a single
string, and this can be done regardless of the complexity of f and h (provided that
| f n (xn )|, |h n (x n )| poly(n)).
When proving the public-key analogue of Proposition 5.2.6, algorithm A is dened
exactly as in the present proof, but its analysis is slightly different: The distinguishing
circuit, considered in the analysis of the performance of A , obtains the encryption-key
as part of its input and passes it to algorithm A (upon invoking the latter).
1 (1
n)
(x n )) = 1 Pr Cn (E G 1 (1n ) (yn )) = 1 >
1
p(n)
(5.3)
r The (Boolean) function f is dened such that f (1n , xn ) = 1 and f (1n , yn ) = 0, for
every n. Note that f (1n , X n ) = 1 with probability 1/2 and equals 0 otherwise.
r The function h is dened such that h(1n , X n ) equals the description of the circuit
Note that X n , f , and h satisfy the restrictions stated in the furthermore-clause of the
proposition. Intuitively, Eq. (5.3) implies violation of semantic security with respect to
the X n , h, and f . Indeed, we will present a (deterministic) polynomial-time algorithm
A that, given Cn = h(1n , X n ), guesses the value of f (1n , X n ) from the encryption
of X n , and does so with probability non-negligibly greater than 1/2. This violates
(even the restricted form of) semantic security, because no algorithm, regardless of its
complexity, can guess f (1n , X n ) with probability greater than 1/2 when only given
1|X n | (because given the constant values 1|X n | and h(1n , X n ), the value of f (1n , X n ) is
uniformly distributed over {0, 1}). Details follow.
Let us assume, without loss of generality, that for innitely many ns
Pr C n (E G 1 (1n ) (xn )) = 1 > Pr Cn (E G 1 (1n ) (yn )) = 1 +
1
p(n)
(5.4)
1
1
+
Pr A(1n , E G 1 (1n ) (X n ), 1|X n | , h(1n , X n )) = f (1n , X n ) >
2 2 p(n)
Proof: The desired algorithm A merely uses C n = h(1n , X n ) to distinguish E(x n ) from
E(yn ), and thus given E(X n ) it produces a guess for the value of f (1n , X n ). Specically,
on input = E() (where is in the support of X n ) and (1n , 1|| , h(1n , )), algorithm A
387
ENCRYPTION SCHEMES
1
Pr A (1n , 1|X n | , h(1n , X n )) = f (1n , X n )
2
(5.5)
Proof: Just observe that the output of A , on its constant input values 1n , 1|X n | and
h(1n , X n ), is stochastically independent of the random variable f (1n , X n ), which in
turn is uniformly distributed in {0, 1}. Eq. (5.5) follows (and equality holds in case A
always outputs a value in {0, 1}).
Combining Claim 5.2.7.1 and Fact 5.2.7.2, we reach a contradiction to the hypothesis
that the scheme is semantically secure (even in the restricted sense mentioned in the
furthermore-clause of the proposition). Thus, the proposition follows.
Comment. When proving the public-key analogue of Proposition 5.2.7, algorithm A
is dened as in the current proof except that it passes the encryption-key, given to it as
part of its input, to the circuit Cn . The rest of the proof remains intact.
3
We comment that the value 1 output by Cn is an indication that is more likely to be xn , whereas the
def
output of A is a guess of f (). This point may be better stressed by redening f such that f (1n , x n ) = x n and
def
n
f (1 , x) = yn if x = x n , and having A output x n if C n outputs 1 and output yn otherwise.
388
5.2.4.1. Denitions
For a sequence of strings x = (x (1) , ..., x (t) ), we let E e (x) denote the sequence of the
t results that are obtained by applying the randomized process E e to the t strings
x (1) , ..., x (t) , respectively. That is, E e (x) = (E e (x (1) ), ..., E e (x (t) )). We stress that in
each of these t invocations, the randomized process E e utilizes independently chosen
random coins. For the sake of simplicity, we consider the encryption of (polynomially) many plaintexts of the same (polynomial) length (rather than the encryption of
plaintexts of various lengths as discussed in Exercise 20). The number of plaintexts
as well as their total length (in unary) are given to all algorithms either implicitly or
explicitly.4
Denition 5.2.8 (semantic security multiple messages):
For private-key: An encryption scheme, (G, E, D), is semantically secure for multiple messages in the private-key model if for every probabilistic polynomialtime algorithm A, there exists a probabilistic polynomial-time algorithm A such
(1)
(t(n))
(1)
that for every probability ensemble {X n = (X n , ..., X n )}nN , with |X n | = =
(t(n))
|X n | poly(n) and t(n) poly(n), every pair of polynomially bounded functions
f, h : {0, 1} {0, 1} , every positive polynomial p and all sufciently large n
Pr A(1n , E G 1 (1n ) (X n ), 1|X n | , h(1n , X n )) = f (1n , X n )
1
< Pr A (1n , t(n), 1|X n | , h(1n , X n )) = f (1n , X n ) +
p(n)
For public-key: An encryption scheme, (G, E, D), is semantically secure for multiple
messages in the public-key model if for A, A , t, {X n }nN , f, h, p, and n, as in the
4
For example, A can infer the number of plaintexts from the number of ciphertexts, whereas A is given this
number explicitly. Given the number of the plaintexts as well as their total length, both algorithms can infer the
length of each plaintext.
389
ENCRYPTION SCHEMES
1
p(n)
1
p(n)
The equivalence of Denitions 5.2.8 and 5.2.9 can be established analogously to the
proof of Theorem 5.2.5.
Theorem 5.2.10 (equivalence of denitions multiple messages): A private-key (resp.,
public-key) encryption scheme is semantically secure for multiple messages if and only
if it has indistinguishable encryptions for multiple messages.
Thus, proving that single-message security implies multiple-message security for one
denition of security yields the same for the other. We may thus concentrate on the
ciphertext-indistinguishability denitions.
1
p(n)
where x = (x1 , ..., xt(n) ) and y = (y1 , ..., yt(n) ). Let us consider such a generic n and
the corresponding sequences x1 , ..., x t(n) and y1 , ..., yt(n) . We use a hybrid argument.
Specically, dene
def
h (i) = (x 1 , ..., x i , yi+1 , ..., yt(n) )
def
(t(n))
it follows that
= (G 1 (1n ), E G 1 (1n ) (x)),
Pr C n (H (i) ) = 1 Pr C n (H (i+1) ) = 1 >
n
n
1
t(n) p(n)
(5.6)
We show that Eq. (5.6) yields a polynomial-size circuit that distinguishes the encryption
of xi+1 from the encryption of yi+1 , and thus derive a contradiction to security in the
single-message setting. Specically, we construct a circuit Dn that incorporates the
circuit Cn as well as the index i and the strings x 1 , ..., xi+1 , yi+1 , ..., yt(n) . On input an
encryption-key e and (corresponding) ciphertext , the circuit Dn operates as follows:
ENCRYPTION SCHEMES
(i)
1
t(n) p(n)
1
p(n)
where Un is uniformly distributed over {0, 1}n and |x| = |y| = m = poly(n). On the
other hand,
Pr[Cn (x Um ) = 1] = Pr[Cn (y Um ) = 1]
392
1
2 p(n)
Incorporating x into the circuit Cn , we obtain a circuit that distinguishes Um from g(Un ),
in contradiction to our hypothesis (regarding the pseudorandomness of g).
Next, we observe that this encryption scheme does not satisfy Denition 5.2.9.
Specically, given the ciphertexts of two plaintexts, one may easily retrieve the
exclusive-or of the corresponding plaintexts. That is,
Es (x1 ) E s (x2 ) = (x1 g(s)) (x2 g(s)) = x1 x 2
This clearly violates Denition 5.2.8 (e.g., consider f (x1 , x2 ) = x1 x 2 ) as well as
Denition 5.2.9 (e.g., consider any x = (x 1 , x2 ) and y = (y1 , y2 ) such that x1 x2 =
y1 y2 ). Viewed in a different way, note that any plaintext-ciphertext pair yields a
corresponding prex of the pseudorandom sequence, and knowledge of this prex
violates the security of additional plaintexts. That is, given the encryption of a known
plaintext x1 along with the encryption of an unknown plaintext x2 , we can retrieve
x 2 .5
Discussion. The single-message security of the scheme used in the proof of Proposition 5.2.12 was proven by considering an ideal version of the scheme in which the
pseudorandom sequence is replaced by a truly random sequence. The latter scheme
is secure in an information-theoretic sense, and the security of the actual scheme followed by the indistinguishability of the two sequences. As we show in Section 5.3.1, this
construction can be modied to yield a private-key stream-cipher that is secure for
multiple message encryptions. All that is needed in order to obtain multiple-message
security is to make sure that (as opposed to this construction) the same portion of the
pseudorandom sequence is never used twice.
An Alternative Proof of Proposition 5.2.12. Given an arbitrary private-key encryption
scheme (G, E, D), consider the following private-key encryption scheme (G , E , D ):
r G (1n ) = ((k, r ), (k, r )), where (k, k) G(1n ) and r is uniformly selected in
{0, 1}|k| ;
r and D
(k,r ) (y,
z) = Dk (y).
If (G, E, D) is secure, then so is (G , E , D ) (with respect to a single message); however, (G , E , D ) is not secure with respect to two messages. For further discussion see
Exercise 21.
5
On input the ciphertexts 1 and 2 , knowing that the rst plaintext is x 1 , we rst retrieve the pseudorandom
def
sequence (i.e., it is just r = 1 x1 ), and next retrieve the second plaintext (i.e., by computing 2 r ).
393
ENCRYPTION SCHEMES
1
p(n)
where E e (x) = (E e (x (1) ), ..., E e (x (t(n)) )), for x = (x (1) , ..., x (t(n)) ) {0, 1}t(n)(n) , is as
in Denition 5.2.8.
394
395
ENCRYPTION SCHEMES
following proof). In the other direction, we seem to use the multiple-message version (of semantic security) in an essential way. An alterative treatment is provided in
Exercise 23.
Proof Sketch: Again, we start with the more important direction (i.e., indistinguishability implies semantic security). Specically, assuming that (G, E, D) has indistinguishable encryptions in the uniform sense, even merely in the special case where
Z n = X n Y n , we show that it is semantically secure in the uniform sense. Our construction of algorithm A is analogous to the construction used in the non-uniform treatment.
Specically, on input (1n , t(n), 1|| , h(1n , )), algorithm A generates a random encryption of a dummy sequence of plaintexts (i.e., 1|| ), feeds it to A, and outputs whatever
A does.7 That is,
A (1n , t(n), 1|| , u) = A(1n , G 1 (1n ), E G 1 (1n ) (1|| ), 1|| , u)
(5.7)
As in the non-uniform case, the analysis of algorithm A reduces to the following claim.
Claim 5.2.15.1: For every two polynomials t and , every polynomial-time constructible
(1)
(t(n))
(i)
ensemble {X n }nN , with X n = (X n , ..., X n ) and |X n | = (n), every polynomialtime computable h, every positive polynomial p, and all sufciently large ns
Pr A(1n , G 1 (1n ), E G 1 (1n ) (X n ), 1|X n | , h(1n , X n )) = f (1n , X n )
< Pr A(1n , G 1 (1n ), E G 1 (1n ) (1|X n | ), 1|X n | , h(1n , X n )) = f (1n , X n ) +
1
p(n)
Proof Sketch: Analogously to the non-uniform case, assuming toward the contradiction
that the claim does not hold yields an algorithm that distinguishes encryptions of X n
from encryptions of Y n = 1|X n | , when getting auxiliary information Z n = X n Y n =
X n 1|X n | . Thus, we derive a contradiction to Denition 5.2.14 (even under the special
case postulated in the theorem).
We note that the auxiliary information that is given to the distinguishing algorithm
replaces the hardwiring of auxiliary information that was used in the non-uniform
case (and is not possible in the uniform-complexity model). Specically, rather than
using a hardwired value of h (at some non-uniformly xed sequence), the distinguishing algorithm will use the auxiliary information Z n = X n 1|X n | in order to compute
def
h n (X n ) = (1n , 1|X n | , h(1n , X n )), which it will pass to A. Indeed, we rely on the hypothesis that h is efciently computable.
The actual proof is quite simple in case the function f is also polynomialtime computable (which is not the case in general). In this special case, on input
(1n , e, z, E e ()), where z = (x, 1|x| ) and {x, 1|x| } for x X n , the distinguishing
algorithm computes u = h(1n , x) and v = f (1n , x), invokes A, and outputs 1 if and
only if A(1n , e, E e (), 1|x| , u) = v.
7
More accurately, algorithm A proceeds as follows. Using t(n), the algorithm breaks 1|| into a sequence of t(n)
equal-length (unary) strings, using 1n it generates a random encryption-key, and using this key it generates the
corresponding sequence of encryptions.
396
The proof becomes more involved in the case where f is not polynomial-time
computable.8 Again, the solution is in realizing that indistinguishability of encryption postulates a similar output prole (of A) in both cases, where the two cases
correspond to whether A is given an encryption of x or an encryption of 1x (for
x X n ). In particular, no value can occur as the output of A in one case with nonnegligibly higher probability than in the other case. To clarify the point, for every xed
x, we dene n,v (x) to be the difference between Pr[A(G 1 (1n ), E G 1 (1n ) (x), h n (x)) = v]
def
and Pr[A(G 1 (1n ), E G 1 (1n ) (1|x| ), h n (x)) = v], where h n (x) = (1n , 1|x| , h(1n , x)) and the
probability space is over the internal coin tosses of algorithms G, E, and A. Taking
the expectation over X n , the contradiction hypothesis means that E[n, f (1n , X n ) (X n )] >
1/ p(n), and so with probability at least 1/2 p(n) over the choice of x X n we have
n, f (1n , x) (x) > 1/2 p(n). The problem is that, given x (and 1n ), we cannot even approximate n, f (1n , x) (x), because we do not have the value f (1n , x) (and we cannot compute
def
it). Instead, we let n (x) = maxv{0,1}poly(n) {n,v (x)}, and observe that E[n (X n )]
E[n, f (1n , X n ) (X n )] > 1/ p(n). Furthermore, given (1n , x), we can (efciently) approximate n (x) as well as nd a value v such that n,v (x) > n (x) (1/2 p(n)), with
probability at least 1 2n .
On approximating n (x) and nding an adequate v: Let q(n) be a bound on the
length of f (1n , x). Our goal is to approximate n (x), which is the maximum of
n,v (x) taken over all v {0, 1}q(n) , as well as nd a value v for which n,v (x) is
close to n (x). For each xed v, it is easy to approximate n,v (x), but we cannot
afford to seperately compute each of these approximations. Yet we can efciently
compute an implicit representation of all the 2q(n) approximations, where all but
polynomially many of the n,v (x)s will be approximated by zero. This is possible
because the n,v (x)s are the differences between corresponding two sequences
of positive numbers (where each sequence has a sum equal to one). Specically,
def
we obtain m = O((n + q(n)) p(n)2 ) outputs of A(G 1 (1n ), E G 1 (1n ) (x), h n (x)) and
m outputs of A(G 1 (1n ), E G 1 (1n ) (1|x| ), h n (x)), where in each of the invocations we
use new coin tosses for algorithms A, G, and E. For each v, the quantity n,v (x)
is approximated by the difference between the fraction of times that v occurs as
output in the rst case and the fraction of times it occurs as output in the second
case. Indeed, at most, 2m values may occur as outputs, and for all other vs the
n,v (x) the
quantity n,v (x) is implicitly approximated by zero. Let us denote by
approximation computed (explicitly or implicitly) for n,v (x). Note that for every
n,v (x)| > 1/4 p(n) is at most 2(n+q(n)) ;
xed v, the probability that |n,v (x)
n
n,v (x)| 1/4 p(n) holds for
hence, with probability at least 1 2 , |n,v (x)
all vs. Having computed all these approximations, we just select a string v for
n, v (x) is the largest. To analyze the quality of
which the approximated quantity
Unlike in the non-uniform treatment, here we cannot hardwire values (such as the values of h and f on good
sequences) into the algorithm D , because D is required to be uniform.
397
ENCRYPTION SCHEMES
our selection, let us denote by vn a string s that maximizes n,s (x) (i.e., n,vn (x) =
n (x)). Then, with probability at least 1 2n , the string v satises
n, v (x) (1/4 p(n))
n, v (x)
n,vn (x) (1/4 p(n))
n,vn (x) (1/4 p(n)) (1/4 p(n))
where the rst and last inequalities are due to the quality of our approximations, and
n, (x). Thus, n, v (x)
the second inequality is due to the fact that v maximizes
n (x) (1/2 p(n)).
Thus, on input (1n , e, z, E e ()), where z = (x, 1|x| ), the distinguisher, denoted D ,
operates in two stages.
1. In the rst stage, D ignores the ciphertext E e (). Using z, algorithm D recovers
def
x, and computes u = h n (x) = (1n , 1|x| , h(1n , x)). Using x and u, algorithm D estimates n (x), and nds a value v as noted. That is, with probability at least 1 2n ,
it holds that n,v (x) > n (x) (1/2 p(n)).
2. In the second stage (using u and v, as determined in the rst stage), algorithm D
invokes A, and outputs 1 if and only if A(e, E e (), u) = v.
Let Vn (x) be the value found in the rst stage of algorithm A (i.e., obliviously of the
ciphertext E e ()). The reader can easily verify that
n
Pr D (1 , G 1 (1n ), Z n , E G (1n ) (X n )) = 1
1
Pr D (1n , G 1 (1n ), Z n , E G 1 (1n ) (1 X n )) = 1
= E n, Vn (X n ) (X n )
1
1 2n E n (X n )
2n
2 p(n)
1
2
>
> E n (X n )
3 p(n)
3 p(n)
where the rst inequality is due to the quality of the rst stage (and the 2n factors account for the probability that the value found in that stage is bad). Thus, we have derived
a probabilistic polynomial-time algorithm (i.e., D ) that distinguishes encryptions of X n
from encryptions of Y n = 1|X n | , when getting auxiliary information Z n = X n 1|X n | . By
hypothesis, {X n } is polynomial-time constructible, and it follows that so is {X n Y n Z n }
Thus, we derive contradiction to Denition 5.2.14 (even under the special case postulated in the theorem), and the claim follows.
Having established the important direction, we now turn to the opposite one. That is,
we assume that (G, E, D) is (uniformly) semantically secure and prove that it has (uniformly) indistinguishable encryptions. Again, the proof is by contradiction. However,
the proof is more complex than in the non-uniform case, because here distinguishable
encryptions means distinguishing between two plaintext-distributions (rather than between two xed sequences of plaintexts), when also given a possibly related auxiliary
398
input Z n . Thus, it seems that we need to incorporate Z n into the input given to the
(semantic-security) adversary, and the only way to do so seems to be by letting Z n be
part of the a priori information given to that adversary (i.e., letting h(plaintext) = Z n ).
Indeed, this will be part of the construction presented next.
Suppose, without loss of generality, that there exists a probabilistic polynomial-time
def
algorithm D , a polynomial-time constructible ensemble T = {T n = X n Y n Z n }nN (as
in Denition 5.2.14), a positive polynomial p, and innitely many ns such that
Pr D (Z n , G 1 (1n ), E G 1 (1n ) (X n )) = 1
1
> Pr D (Z n , G 1 (1n ), E G 1 (1n ) (Y n )) = 1 | +
p(n)
Let t(n) and (n) be such that X n (resp., Y n ) consists of t(n) strings, each of length
(n). Suppose, without loss of generality, that |Z n | = m(n) (n), and parse Z n into
(1)
(m(n))
(1)
(m(n))
Z n = (Z n , ..., Z n
) ({0, 1}(n) )m(n) such that Z n = Z n Z n
. We dene an
def
auxiliary polynomial-time constructible ensemble Q = {Q n }nN such that
0(n) Z n X n Y n with probability 12
Qn =
(5.8)
1(n) Z n Y n X n with probability 12
That is, Q n is a sequence of 1 + m(n) + 2t(n) strings, each of length (n), that contains
Z n X n Y n in addition to a bit (encoded in the (n)-bit long prex) indicating whether or
not the order of X n and Y n is switched. We dene the function f to be equal to this
switch-indicator bit, and the function h to provide all information in Q n except this
switch bit. That is, we dene f and h as follows:
ENCRYPTION SCHEMES
dened to equal
Pr D (z, G 1 (1n ), E G 1 (1n ) (x)) = 1 Pr D (z, G 1 (1n ), E G 1 (1n ) (y)) = 1
Specically, using O(n p(n)2 ) samples, algorithm A obtains an approximation, de n (z, x, y) n (z, x, y)| < 1/3 p(n) with probability
n (z, x, y), such that |
noted
n
at least 1 2 .
n (z, x, y) <
n (z, x, y) > 1/3 p(n), sets = 1 if
Algorithm A sets = 1 if
n (z, x, y)| 1/3 p(n)). Intuitively,
1/3 p(n), and sets = 0 otherwise (i.e., |
n (z, x, y), provided that the absolute value of the latter is
indicates the sign of
large enough, and is set to zero otherwise. In other words, with overwhelmingly high
probability, indicates whether the value of Pr[D (z, , E (x)) = 1] is signicantly
greater, smaller, or about the same as Pr[D (z, , E (y)) = 1].
In case = 0, algorithm A halts with an arbitrary reasonable guess (say a randomly
selected bit). (We stress that all this is done obliviously of the ciphertext E e (),
which is only used next.)
2. In the second stage, algorithm A extracts the last block of ciphertexts (i.e., E e (v))
out of E e () = E e ( (n) z u v), and invokes D on input (z, e, E e (v)), where z is as
extracted in the rst stage. Using the value of as determined in the rst stage,
algorithm A decides (i.e., determines its output bit) as follows:
1
1
+
Pr A(G 1 (1n ), E G 1 (1n ) (Q n ), h(1n , Q n )) = f (1n , Q n ) >
2 7 p(n)
Proof Sketch: We focus on the case in which the approximation of n (z, x, y) computed
by (the rst stage of) A is within 1/3 p(n) of the correct value. Thus, in case = 0, the
sign of agrees with the sign of n (z, x, y). It follows that for every possible (z, x, y)
such that = 1 (it holds that n (z, x, y) > 0 and) the following holds:
Pr A(G 1 (1n ), E G 1 (1n ) (Q n ), h(1n , Q n )) = f (1n , Q n ) | (Z n , X n , X n ) = (z, x, y)
1
= Pr A(G 1 (1n ), E G 1 (1n ) (0(n) , z, x, y), h n (0(n) , z, x, y)) = 0
2
1
+ Pr A(G 1 (1n ), E G 1 (1n ) (1(n) , z, y, x), h n (1(n) , z, y, x)) = 1
2
1
= Pr D (z, G 1 (1n ), E G 1 (1n ) (y)) = 0
2
1
+ Pr D (z, G 1 (1n ), E G 1 (1n ) (x)) = 1
2
1
=
(1 + n (z, x, y))
2
400
Similarly, for every possible (z, x, y) such that = 1 (it holds that n (z, x, y) < 0
and) the following holds:
Pr A(G 1 (1n ), E G 1 (1n ) (Q n ), h(1n , Q n )) = f (1n , Q n ) | (Z n , X n , X n ) = (z, x, y)
=
1
(1 n (z, x, y))
2
2
2
>
1
1
1 + (1/ p(n)) (2/3 p(n))
=
+
2
2 6 p(n)
where the last inequality follows by the contradiction hypothesis (i.e., that
1
E[n (Z n , X n , Y n )] > p(n)
). The claim follows (because the negligible probability ignored in the last [displayed] inequality is certainly upper-bounded by (1/6 p(n))
(1/7 p(n))).
This completes the proof of the opposite direction.
Discussion. The proof of the rst (i.e., important) direction holds also in the singlemessage setting. In general, for any function t, in order to prove that semantic security
holds with respect to t-long sequences of ciphertexts, we just use the hypothesis that tlong message-sequences have indistinguishable encryptions. In contrast, the proof of the
second (i.e., opposite) direction makes an essential use of the multiple-message setting.
In particular, in order to prove that t-long message-sequences have indistinguishable
encryptions, we use the hypothesis that semantic security holds with respect to (1 +
m + 2t)-long sequences of ciphertexts, where m depends on the length of the auxiliary
input in the claim of ciphertext-indistinguishability. Thus, even if we only want to
establish ciphertext-indistinguishability in the single-message setting, we do so by
using semantic security in the multiple-message setting. Furthermore, we use the fact
that given a sequence of ciphertexts, we can extract a certain subsequence of ciphertexts.
9
This analysis looks somewhat odd but is nevertheless valid. Our aim is to get a uniform expression for
the success probability of A in all cases (i.e., for all values of ). In case | | = 1, we have the lower-bound
(1 + |n (z, x, y)|)/2, which is certainly lower-bounded by (1 + |n (z, x, y)| (2/3 p(n)))/2, whereas in case
= 0 we articially lower-bound 1/2 by the same expression. Once we have such a uniform expression, we
may take expectation over it (without breaking it to cases).
401
ENCRYPTION SCHEMES
objects), rather than handed down from heaven (where it might have been selected
non-uniformly or using non-recursive procedures).
r Replace the input pair (e, z), which is given to the attackers rst part (i.e., A1 ), by 1n .
That is, eliminate the (non-uniform) auxiliary input z, and omit the encryption-key
e (also in the public-key version).
r Remove the encryption oracle (i.e., E e ) from the denitions; that is, model the
attacker by an ordinary (probabilistic polynomial-time) algorithm, rather than by an
oracle machine.
Consequently, the denition of semantic security (Denition 5.4.8) can be simplied
by using A1 = A1 and omitting Condition 2 (which refers to the distributions produced
by A1 and A1 ). Doing so requires a minor change in the rst part of the proof of
Theorem 5.4.11 (i.e., letting A2 rather than A1 generate a random encryption-key).
In the resulting denitions, the rst part of the attacker is conned to an oblivious
selection of a challenge template (i.e., the challenge template is selected independently
of the encryption-key), whereas the second part of the attacker is given an adequate
challenge (and nothing else). In the case of semantic security, this means that the adversary rst selects the application that consists of the plaintext distribution, the partial
information function h, and the desired information function f . These three objects
are represented by circuits. Next, a plaintext x is selected according to the specied
distribution, and the adversary is given a corresponding ciphertext (i.e., E e (x)), as well
as the corresponding partial information h(x).
r Using any (non-uniformly robust) pseudorandom function, one can construct secure
private-key encryption schemes. Recall that the former can be constructed using any
(non-uniformly strong) one-way function.
r Using any (non-uniform strong) trapdoor one-way permutation, one can construct
secure public-key encryption schemes.
403
ENCRYPTION SCHEMES
In addition, we review some popular suggestions for private-key and public-key encryption schemes.
Probabilistic Encryption. Before starting, we recall that a secure public-key encryption scheme must employ a probabilistic (i.e., randomized) encryption algorithm. Otherwise, given the encryption-key as (additional) input, it is easy to distinguish the
encryption of the all-zero message from the encryption of the all-ones message. The
same holds for private-key encryption schemes when considering the multi-message
setting.10 For example, using a deterministic (private-key) encryption algorithm allows
the adversary to distinguish two encryptions of the same message from the encryptions
of a pair of different messages. Thus, the common practice of using pseudorandom permutations as block-ciphers (see denition in Section 5.3.2) is not secure (again, one
can distinguish two encryptions of the same message from encryptions of two different
messages). This explains the linkage between our security denitions and randomized
(aka probabilistic) encryption schemes. Indeed, all our encryption schemes will employ
randomized encryption algorithms.11
5.3.1.* Stream-Ciphers
It is common practice to use pseudorandom generators as a basis for private-key
stream-ciphers (see denition in Section 5.3.1.1). Specically, the pseudorandom generator is used to produce a stream of bits that are XORed with the corresponding
plaintext bits to yield corresponding ciphertext bits. That is, the generated pseudorandom sequence (which is determined by the a priori shared key) is used as a one-time
pad instead of a truly random sequence, with the advantage that the generated sequence may be much longer than the key (whereas this is not possible for a truly
random sequence). This common practice is indeed sound, provided one actually uses
pseudorandom generators (as dened in Section 3.3 of Volume 1), rather than programs
that are called pseudorandom generators but actually produce sequences that are easy
to predict (such as the linear congruential generator or some modications of it that
output a constant fraction of the bits of each resulting number).
As we shall see, by using any pseudorandom generator one may obtain a secure
private-key stream-cipher that allows for the encryption of a stream of plaintext bits.
We note that such a stream-cipher does not conform to our formulation of an encryption
scheme (i.e., as in Denition 5.1.1), because in order to encrypt several messages one is
required to maintain a counter (to prevent reusing parts of the pseudorandom one-time
pad). In other words, we obtain a secure encryption scheme with a variable state that
is modied after the encryption of each message. We stress that constructions of secure
10
We note that this does not hold with respect to private-key schemes in the single-message setting (or for the
augmented model of state-based ciphers discussed in Section 5.3.1). In such a case, the private-key can be
augmented to include a seed for a pseudorandom generator, the output of which can be used to eliminate
randomness from the encryption algorithm. (Question: Why does the argument fail in the public-key setting
and in the multi-message private-key setting?)
11 The (private-key) stream-ciphers discussed in Section 5.3.1 are an exception, but (as further explained in Section 5.3.1) these schemes do not adhere to our (basic) formulation of encryption schemes (as in Denition 5.1.1).
404
and stateless encryption schemes (i.e., conforming with Denition 5.1.1) are known
and are presented in Sections 5.3.3 and 5.3.4. The traditional interest in stream-ciphers
is due to efciency considerations. We discuss this issue at the end of Section 5.3.3.
But before doing so, let us formalize the discussion.
5.3.1.1. Denitions
We start by extending the simple mechanism of encryption schemes (as presented
in Denition 5.1.1). The key-generation algorithm remains unchanged, but both the
encryption and decryption algorithm take an additional input and emit an additional
output, corresponding to their state before and after the operation. The length of the state
is not allowed to grow by too much during each application of the encryption algorithm
(see Item 3 in Denition 5.3.1), or else the efciency of the entire repeated encryption
process cannot be guaranteed. For the sake of simplicity, we incorporate the key in the
state of the corresponding algorithm. Thus, the initial state of each of the algorithms is
set to equal its corresponding key. Furthermore, one may think of the intermediate states
as updated values of the corresponding key. For clarity, the reader may consider the
special case in which the state contains the initial key, the number of times the scheme
was invoked (or the total number of bits in such invocations), and auxiliary information
that allows a speedup of the computation of the next ciphertext (or plaintext).
For simplicity, we assume that the decryption algorithm (i.e., D) is deterministic
(otherwise formulating the reconstruction condition would be more complex). Intuitively, the main part of the reconstruction condition (i.e., Item 2 in Denition 5.3.1)
is that the (proper) iterative encryptiondecryption process recovers the original plaintexts. The additional requirement in Item 2 is that the state of the decryption algorithm
is updated correctly so long as it is fed with strings of length equal to the length of
the valid ciphertexts. The reason for this additional requirement is discussed following
Denition 5.3.1. We comment that in traditional stream-ciphers, the plaintexts (and ciphertexts) are individual bits or blocks of a xed number of bits (i.e., | (i) | = | (i) | =
for all is).
Denition 5.3.1 (state-based cipher the mechanism): A state-based encryption
scheme is a triple, (G, E, D), of probabilistic polynomial-time algorithms satisfying
the following three conditions:
1. On input 1n , algorithm G outputs a pair of bit strings.
2. For every pair (e(0) , d (0) ) in the range of G(1n ), and every sequence of plaintexts (i) s,
the following holds: If (e(i) , (i) ) E(e(i1) , (i) ) and (d (i) , (i) ) D(d (i1) , (i) ),
for i = 1, 2, ..., then (i) = (i) for every i. Furthermore, for every i and every
(i)
{0, 1}| | , it holds that D(d (i1) , ) = (d (i) , ). That is, d (i) is actually determined by
d (i1) and | (i) |.12
12
Alternatively, we may decompose the decryption (resp., encryption) algorithm into two algorithms, where the
rst takes care of the actual decryption (resp., encryption) and the second takes care of updating the state. For
details see Exercise 24.
405
ENCRYPTION SCHEMES
3. There exists a polynomial p such that for every pair (e(0) , d (0) ) in the range of
G(1n ), and every sequence of (i) s and e(i) s as in Item 2, it holds that |e(i) |
|e(i1) | + | (i) | p(n). Similarly for the d (i) s.
That is, as in Denition 5.1.1, the encryptiondecryption process operates properly
(i.e., the decrypted message equals the plaintext), provided that the corresponding
algorithms get the corresponding keys (or states). Note that in Denition 5.3.1, the
keys are modied by the encryptiondecryption process, and so correct decryption
requires holding the correctly updated decryption-key. We stress that the furthermoreclause in Item 2 guarantees that the decryption-key is correctly updated so long as the
decryption process is fed with strings of the correct lengths (but not necessarily with the
correct ciphertexts). This extra requirement implies that given the initial decryptionkey and the current ciphertext, as well as the lengths of all previous ciphertexts (which
may be actually incorporated in the current ciphertext), one may recover the current
plaintext. This fact is interesting for two reasons:
A theoretical reason: It implies that without loss of generality (albeit with possible
loss in efciency), the decryption algorithm may be stateless. Furthermore, without
loss of generality (again, with possible loss in efciency), the state of the encryption
algorithm may consist of the initial encryption-key and the lengths of the plaintexts
encrypted so far.
A practical reason: It allows for recovery from the loss of some of the ciphertexts. That
is, assuming that all ciphertexts have the same (known) length (which is typically
the case in the relevant applications), if the receiver knows (or is given) the total
number of ciphertexts sent so far, then it can recover the current plaintext from the
current ciphertext, even if some of the previous ciphertexts were lost. See the special
provision in Construction 5.3.3.
We comment that in Construction 5.3.3, it holds that |e(i) | |e(0) | + log2 ij=1 | ( j) |,
which is much stronger than the requirement in Item 3 (of Denition 5.3.1).
We stress that Denition 5.3.1 refers to the encryption of multiple messages (and
meaningfully extends Denition 5.1.1 only when considering the encryption of multiple
messages). However, Denition 5.3.1 by itself does not explain why one should encrypt
the ith message using the updated encryption-key e(i1) , rather than reusing the initial
encryption-key e(0) in all encryptions (where decryption is done by reusing the initial
decryption-key d (0) ). Indeed, the reason for updating these keys is provided by the
following security denition that refers to the encryption of multiple messages, and
holds only in case the encryption-keys in use are properly updated (in the multiplemessage encryption process). Here we present only the semantic security denition for
private-key schemes.
Denition 5.3.2 (semantic security state-based cipher): For a state-based encryption scheme, (G, E, D), and any x = (x (1) , ..., x (t) ), we let E e (x) = (y (1) , ..., y (t) ) be
def
the result of the following t-step (possibly random) process, where e(0) = e. For
i = 1, ..., t, we let (e(i) , y (i) ) E(e(i1) , x (i) ), where each of the t invocations E utilizes
406
ENCRYPTION SCHEMES
Decrypting the ciphertext bit y with state (s, t, s ): Let s = g(s ), where |s | = |s |
and {0, 1}. Output the plaintext bit y , and set the new state to (s, t + 1, s ).
Special recovery procedure: When notied that some ciphertext bits may have been
lost and that the current ciphertext bit has index t , the decryption procedure rst
recovers the correct current state, denoted st , to be used in decryption instead of s .
def
This can be done by computing si i = g(si1 ), for i = 1, ..., t , where s0 = s.13
Note that both the encryption and decryption algorithms are deterministic, and that the
state after encryption of t bits has length 2n + log2 t < 3n (for t < 2n ).
Recall that g (as in Construction 5.3.3) is called a next-step function of an onp
line pseudorandom generator if for every polynomial p the ensemble {G n }nN is
p
pseudorandom (with respect to polynomial-size circuits), where G n is dened by the
following random process:
Uniformly select s0 {0, 1}n ;
For i = 1 to p(n), let si i g(si1 ), where i {0, 1} (and si {0, 1}n );
Output 1 2 p(n) .
Also recall that if g is itself a pseudorandom generator, then it constitutes a next-step
function of an on-line pseudorandom generator (see Exercise 21 of Chapter 3). We
have:
Proposition 5.3.4: Suppose that g is a next-step function of an on-line pseudorandom generator. Then Construction 5.3.3 constitutes a secure state-based private-key
encryption scheme.
Proof Idea: Consider an ideal version of Construction 5.3.3 in which a truly random
sequence is used instead of the output produced by the on-line pseudorandom generator dened by g. The ideal version coincides with the traditional one-time pad, and
thus is perfectly secure. The security of the actual Construction 5.3.3 follows by the
pseudorandomness of the on-line generator.
More generally, if the decryption procedure holds the state at time t < t then it needs only compute st+1 , ..., st .
In using the term block-cipher, we abuse standard terminology by which a block-cipher must, in addition to operating on plaintext of specic length, produce ciphertexts of a length that equals the length of the corresponding
plaintexts. We comment that the latter cannot be semantically secure; see Exercise 25.
408
5.3.2.1. Denitions
We start by considering the syntax (cf. Denition 5.1.1).
Denition 5.3.5 (block-cipher): A block-cipher is a triple, (G, E, D), of probabilistic
polynomial-time algorithms satisfying the following two conditions:
1. On input 1n , algorithm G outputs a pair of bit strings.
2. There exists a polynomially bounded function : N N, called the block length, so
that for every pair (e, d) in the range of G(1n ), and for each {0, 1}(n) , algorithms
E and D satisfy
Pr[Dd (E e ()) = ] = 1
Typically, we use either (n) = (n) or (n) = 1. Analogously to Denition 5.1.1, this
denition does not distinguish private-key encryption schemes from public-key ones.
The difference between the two types is captured in the security denitions, which are
essentially as before, with the modication that we only consider plaintexts of length
(n). For example, the analogue of Denition 5.2.8 (for private-key schemes) reads:
Denition 5.3.6 (semantic security private-key block-ciphers): A block-cipher,
(G, E, D), with block length is semantically secure (in the private-key model) if for
every probabilistic polynomial-time algorithm A there exists a probabilistic polynomial(1)
(t(n))
time algorithm A such that for every ensemble {X n = (X n , ..., X n )}nN , with
(1)
(t(n))
|X n | = = |X n | = (n) and t(n) poly(n), every pair of polynomially bounded
functions f, h, every positive polynomial p, and all sufciently large n, it holds that
Pr A(1n , E G 1 (1n ) (X n ), 1|X n | , h(1n , X n )) = f (1n , X n )
1
< Pr A (1n , t(n), 1|X n | , h(1n , X n )) = f (1n , X n ) +
p(n)
where E e (x (1) , ..., x (t) ) = (E e (x (1) ), ..., E e (x (t) )), as in Denition 5.2.8.
Note that, in case is polynomial-time computable, we can omit the auxiliary input
1|X n | = 1t(n)(n) , because it can be reconstructed from the security parameter n and the
value t(n).
ENCRYPTION SCHEMES
is easily resolved by padding the last block (while indicating the end of the actual
plaintext).15
Construction 5.3.7 (from block-ciphers to general encryption schemes): Let
(G, E, D) be a block-cipher with block length function . We construct an encryption scheme, (G , E , D ), as follows. The key-generation algorithm, G , is identical to
G. To encrypt a message (with encryption-key e generated under security parameter
n), we break it into consecutive blocks of length (n), while possibly augmenting the
last block. Let 1 , ..., t be the resulting blocks. Then
E e () = (||, E e (1 ), ..., E e (t ))
def
We choose to use a very simple indication of the end of the actual plaintext (i.e., to include its length in the
ciphertext). In fact, it sufces to include the length of the plaintext modulo (n). Another natural alternative
is to use a padding of the form 10((n)||1) mod (n) , while observing that no padding is ever required in case
(n) = 1.
16 Recall that throughout this section security means security in the multiple-message setting.
410
1
q(n)
ENCRYPTION SCHEMES
The v ( j) s either equal the x ( j) s or the y ( j) s, whereas the r ( j) s are random (or are xed by an averaging
argument). The conclusion follows by considering the actual encryptions of the x ( j) s and the y ( j) s versus
their ideal encryptions. Since the actual encryptions are distinguishable whereas the ideals are not, the actual
encryption of either the x ( j) s or the y ( j) s must be distinguishable from the corresponding ideal version.
412
permutations as block-ciphers18 is not secure (e.g., one can distinguish two encryptions
of the same message from encryptions of two different messages).
Recall that by combining Constructions 5.3.7 and 5.3.9 (and referring to Propositions 5.3.8 and 5.3.10), we obtain a (full-edged) private-key encryption scheme. A
more efcient scheme is obtained by a direct combination of the ideas underlying both
constructions:
Construction 5.3.12 (a private-key encryption scheme based on pseudorandom functions): Let F = {Fn } be as in Construction 5.3.9 (that is, F = {Fn } is an efciently
computable function ensemble) and I and V be the selection and evaluation algorithms associated with it (e.g., V (s, x) = f s (x)). We dene a private-key encryption
scheme, (G, E, D), as follows:
Key-generation: G(1n ) = (k, k), where k I (1n ).
Encrypting plaintext {0, 1} (using the key k): Break into consecutive blocks of
length n, while possibly augmenting the last block. Let 1 , ..., t be the resulting
blocks. Associate {0, 1}n with the set of integer residues modulo 2n , select uniformly
r {0, 1}n , and compute ri = r + i mod 2n , for i = 1, ..., t. Finally, form the ciphertext (r, ||, V (k, r1 ) 1 , ..., V (k, rt ) t ). That is,
E k (x) = (r, ||, f k (r + 1 mod 2n ) 1 , ..., f k (r + t mod 2n ) t )
Decrypting ciphertext (r, m, y1 , ..., yt ) (using the key k): For i = 1, ..., t, compute
i = V (k, (r + i mod 2n )) yi , and output the m-bit long prex of 1 t . That
is, Dk (r, m, y1 , ..., yt ) is the m-bit long prex of
(V (k, (r + 1 mod 2n )) y1 ) (V (k, (r + t mod 2n )) yt )
= ( f k (r + 1 mod 2n ) y1 ) ( f k (r + t mod 2n ) yt )
Clearly, Construction 5.3.12 constitutes a secure private-key encryption scheme (provided that F is pseudorandom with respect to polynomial-size circuits). See Exercise 26.
That is, letting E k (x) = pk (x), where pk is the permutation associated with the string k.
413
ENCRYPTION SCHEMES
Trapdoor permutations. All our constructions employ a collection of trapdoor permutations, as in Denition 2.4.5. Recall that such a collection, { p } , comes with four
probabilistic polynomial-time algorithms, denoted here by I, S, F, and B (for index,
sample, forward, and backward ), such that the following (syntactic) conditions hold:
1. On input 1n , algorithm I selects a random n-bit long index of a permutation p ,
along with a corresponding trapdoor ;
2. On input , algorithm S samples the domain of p , returning a random element in
it;
3. For x in the domain of p , given and x, algorithm F returns p (x) (i.e., F(, x) =
p (x));
4. For y in the range of p , if (, ) is a possible output of I (1n ), then given and y,
algorithm B returns p1 (y) (i.e., B(, y) = p1 (y)).
The hardness condition refers to the difculty of inverting p on a random element of
its range, when given only the range-element and . That is, let I1 (1n ) denote the rst
element in the output of I (1n ) (i.e., the index); then for every polynomial-size circuit
family {Cn }, every polynomial p and all sufciently large ns
Pr[Cn (I1 (1n ), p I1 (1n ) (S(I1 (1n )))) = S(I1 (1n ))] <
1
p(n)
Namely, Cn fails to invert p on p (x), where and x are selected by I and S as in the
previous paragraph. Recall that the collection can be easily modied to have a hard-core
predicate (see Theorem 2.5.2). For simplicity, we continue to refer to the collection as
{ p }, and let b denote the corresponding hard-core predicate.
Clearly, for every possible (, ) output of G and for every {0, 1}, it holds that
D (E ( )) = D (F(, S()), b(S()))
= ( b(S())) b(B(, F(, S())))
= b(S()) b( p1 ( p (S())))
= b(S()) b(S()) =
The security of this public-key encryption scheme follows from the (non-uniform) oneway feature of the collection { p } (or rather from the hypothesis that b is a corresponding
hard-core predicate).
Proposition 5.3.14: Suppose that b is a (non-uniformly strong) hard-core of the collection { p }. Then Construction 5.3.13 constitutes a secure public-key block-cipher (with
block-length 1).
Proof: Recall that by the equivalence theorems (i.e., Theorems 5.2.5 and 5.2.11), it
sufces to show single-message ciphertext-indistinguishability. Furthermore, by the
fact that here there are only two plaintexts (i.e., 0 and 1), it sufces to show that one
cannot distinguish the encryptions of these two plaintexts. That is, all we need to prove
is that, given the encryption-key , it is infeasible to distinguish E (0) = ( p (r ), b(r ))
from E (1) = ( p (r ), 1 b(r )), where r S(). But this is easily implied by the
hypothesis that b is a hard-core of the collection { p }. Details follow.
Recall that by saying that b is a hard-core of { p }, we mean that for every polynomialsize circuit family {Cn }, every polynomial p and all sufciently large ns
Pr[Cn (I1 (1n ), p I1 (1n ) (S(I1 (1n )))) = b(S(I1 (1n )))] <
1
1
+
2
p(n)
(5.9)
However, analogously to the second proof of Theorem 3.4.1, it can be shown that this
implies that for every polynomial-size circuit family {C n }, every polynomial p , and all
sufciently large ns
|Pr[Cn (, p (r ), b(r )) = 1] Pr[Cn (, p (r ), 1 b(r )) = 1]| <
1
p (n)
ENCRYPTION SCHEMES
We stress that the conjecture is not known to follow from the assumption that the RSA
collection is (non-uniformly) hard to invert. What is known to hold under the latter assumption is only that the rst O(log n) least-signicant bits of the argument constitute
a (non-uniformly strong) hard-core function of RSA (with n-bit long moduli). Still, if
the large hard-core conjecture holds, then one obtains a secure public-key encryption
scheme with efciency comparable to that of plain RSA (see the following discussion).
Furthermore, this scheme is related (but not identical) to the common practice of randomly padding messages (using padding equal in length to the message) before encrypting them (by applying the RSA function).19 That is, we consider the following scheme:
Construction 5.3.16 (Randomized RSA a public-key block-cipher scheme): This
scheme employs the RSA collection of trapdoor permutations (cf. Subsections 2.4.3
and 2.4.4). The following description is, however, self-contained.
Key-generation: The key-generation algorithm consists of selecting at random two
n-bit primes, P and Q, setting N = P Q, selecting at random a pair (e, d) such that
e d 1 (mod (P 1) (Q 1)), and outputting the pair ((N , e), (N , d)), where
(N , e) is the encryption-key and (N , d) is the decryption-key. That is, ((N , e),
(N , d)) G(1n ), where N , e, and d are as specied here.
(Note that N is 2n-bits long.)
Encryption: To encrypt an n-bit string (using the encryption-key (N , e)), the encryption algorithm randomly selects an element r {0, ..., N 1}, and produces the
ciphertext (r e mod N , lsb(r )), where lsb(r ) denotes the n least-signicant bits
of r . That is, E (N ,e) ( ) = (r e mod N , lsb(r )).
Decryption: To decrypt the ciphertext (y, ) {0, ..., N 1} {0, 1}n (using the
decryption-key (N , d)), the decryption algorithm just computes lsb(y d mod N ),
where lsb() is as in the Encryption procedure. That is, D(N ,d) (y, ) =
lsb( y d mod N ).
The bandwidth of this scheme is much better than in Construction 5.3.13: A plaintext of
length n is encrypted via a ciphertext of length 2n + n = 3n. Furthermore, Randomized
RSA is almost as efcient as plain RSA (or the RSA function itself).
19
The conjectured security of the common practice relies on a seemingly stronger assumption; that is, the assumption is that for every x {0, ..., 2n 1}, given (N , e) as generated in Construction 5.3.16, it is infeasible
to distinguish r e mod N from (x + s2n )e mod N , where r (resp., s) is uniformly distributed in {0, ..., N 1}
(resp., in {0, ...,
N /2n 1}).
416
ENCRYPTION SCHEMES
(5.10)
(| |)
|)
(| |) | G
= ( G (|
(r )) G ( p
|)
(| |)
= G (|
(r ) G (r ) =
418
(r )|
( p| | (r )))
The security of this public-key encryption scheme follows from the (non-uniform)
one-way feature of the collection { p }, but here we restrict the sampling algorithm
S to produce almost uniform distribution over the domain (so that this distribution is
preserved under successive applications of p ).
Proposition 5.3.19: Suppose that b is a (non-uniformly strong) hard-core of the trapdoor collection { p }. Furthermore, suppose that this trapdoor collection utilizes a
domain sampling algorithm S so that the statistical difference between S() and
the uniform distribution over the domain of p is negligible in terms of ||. Then
Construction 5.3.18 constitutes a secure public-key encryption scheme.
Proof: Again, we prove single-message ciphertext-indistinguishability. It sufces
(| |)
to show that for every , the distributions (, p| | (S()), G (S())) and
(, p| | (S()), s) are indistinguishable, where s {0, 1}| | is uniformly distributed, independently of anything else. The latter claim holds by a minor extension
to Proposition 3.4.6: This proposition refers to the case where S() is uniform over the
domain of p , but can be extended to the case in which there is a negligible statistical
difference between the distributions.
Details: We need to prove that for every polynomial and every sequence of
def
(n)
pairs (n , n ) {0, 1}(n) {0, 1}(n) , the distributions Dn = (, p (S()), n
def
Dn =
(n)
(, p (S()), n G
G (S())) and
n
where I1 (1 ). We prove this in two steps:
((n))
((n))
def
((n))
(n)
(n)
and {Rn }nN , where Rn = (, p (S()), n U(n) ), are indistinguishable.
Furthermore, {Rn }nN and {Rn }nN are identically distributed. Thus, {Dn }nN
and {Dn }nN are indistinguishable.
ENCRYPTION SCHEMES
integers) in the role of the trapdoor permutation used in Construction 5.3.18. This yields
a secure public-key encryption scheme with efciency comparable to that of plain RSA
(see further discussion latter in this section).
Construction 5.3.20 (the Blum-Goldwasser Public-Key Encryption Scheme): Consult
Appendix A in Volume 1 for the relevant number-theoretic background, and note that
for P 3 (mod 4) the number (P + 1)/4 is an integer. For simplicity, we present a
block-cipher with arbitrary block-length (n) poly(n); a full-edged encryption
scheme can be derived by an easy modication (see Exercise 27 ).
Key-generation: The key-generation algorithm consists of selecting at random two nbit primes, P and Q, each congruent to 3 mod 4, and outputting the pair (N , (P, Q)),
where N = P Q.
Actually, for sake of efciency, the key-generator also computes
d P = ((P + 1)/4)(n) mod P 1 (in {0, ..., P 2})
d Q = ((Q + 1)/4)(n) mod Q 1 (in {0, ..., Q 2})
c P = Q (Q 1 mod P)
c Q = P (P
mod Q)
Again, one can easily verify that this construction constitutes an encryption scheme:
The main fact to verify is that the value of s1 as reconstructed in the decryption stage
equals the value used in the encryption stage. This follows by combining the Chinese
Reminder Theorem with the fact that for every quadratic residue s mod N , it holds that
(n)
(n)
s (s 2 mod N )d P (mod P) and s (s 2 mod N )d Q (mod Q).
Details: Recall that for a prime P 3 (mod 4), and every quadratic residue r , we
have r (P+1)/2 r (mod P). Thus, for every quadratic residue s (modulo N ) and
every , we have
((P+1)/4)
(mod P)
(s 2 mod N )d P s 2 mod N
s ((P+1)/2)
s
(mod P)
(mod P)
421
ENCRYPTION SCHEMES
to that of (plain or Randomized) RSA. In contrast, recall that plain RSA itself is not
secure (as it employs a deterministic encryption algorithm), whereas Randomized RSA
(i.e., Construction 5.3.16) is not known to be secure under a standard assumption such
as intractability of factoring (or even of inverting the RSA function).21
5.4.1. Overview
We start with an overview of the type of attacks and results considered in the current
(rather long) section.
Recall that Randomized RSA is secure provided that the n/2 least-signicant bits constitute a hard-core function
for n-bit RSA moduli. This is a reasonable conjecture, but it seems stronger than the conjecture that RSA is hard
to invert: Assuming that RSA is hard to invert, we only know that the O(log n) least-signicant bits constitute
a hard-core function for n-bit moduli.
422
Chosen Plaintext Attacks. Here the attacker may obtain encryptions of plaintexts of
its choice (under the key being attacked). Indeed, such an attack does not add power in
the case of public-key schemes.
Chosen Ciphertext Attacks. Here the attacker may obtain decryptions of ciphertexts
of its choice (under the key being attacked). That is, the attacker is given oracle access
to the decryption function corresponding to the decryption-key in use. We distinguish
two types of such attacks.
1. In an a priori chosen ciphertext attack, the attacker is given access to the decryption
oracle only prior to being presented with the ciphertext that it should attack (i.e., the
ciphertext for which it has to learn partial information). That is, the attack consists
of two stages: In the rst stage, the attacker is given the above oracle access, and in
the second stage, the oracle is removed and the attacker is given a test ciphertext
(i.e., a test of successful learning).
2. In an a posteriori chosen ciphertext attack, after being given the test ciphertext, the
decryption oracle is not removed, but rather the adversarys access to this oracle is
restricted in the natural way (i.e., the adversary is allowed to query the oracle on any
ciphertext except for the test ciphertext).
In both cases, the adversary may make queries that do not correspond to a legitimate
ciphertext, and the answer will be accordingly (i.e., a special failure symbol). Furthermore, in both cases the adversary may effect the selection of the test ciphertext (by
specifying a distribution from which the corresponding plaintext is to be drawn).
Formal denitions of all these types of attacks are given in the following subsections
(i.e., in Sections 5.4.2, 5.4.3, and 5.4.4, respectively). In addition, in Section 5.4.5,
we consider the related notion of malleability, that is, attacks aimed at generating
encryptions of plaintexts related to the secret plaintext, rather than gaining information
about the latter.
5.4.1.2. Constructions
As in the basic case (i.e., Section 5.3), actively secure private-key encryption schemes
can be constructed based on the existence of one-way functions, whereas actively
secure public-key encryption schemes are based on the existence of (enhanced) trapdoor
permutations. In both cases, withstanding a posteriori chosen ciphertext attacks is harder
than withstanding a priori chosen ciphertext attacks. We will present the following
results.
For Private-Key Schemes. In Section 5.4.4.3, we show that the private-key encryption
scheme based on pseudorandom functions (i.e., Construction 5.3.9) is secure also under
a priori chosen ciphertext attacks, but is not secure under an a posteriori chosen
ciphertext attack. We also show how to transform any passively secure private-key
encryption scheme into a scheme secure under (a posteriori) chosen ciphertext attacks
by using a message-authentication scheme on top of the basic encryption. Thus, the latter
construction relies on message-authentication schemes as dened in Section 6.1. We
423
ENCRYPTION SCHEMES
Indeed, an alternative presentation may start with the strongest notion of security (i.e., corresponding to aposteriori chosen ciphertext attacks), and obtain the weaker notions by imposing various restrictions (on the
attacks).
424
ciphertext attacks, we will use some results from Chapter 6. In the case of private-key
encryption schemes (treated in Section 5.4.4.3), we will use a message-authentication
scheme, but do so in a self-contained way. In the case of public-key encryption schemes
(treated in Section 5.4.4.4), we will use signature schemes (having an extra property)
in order to construct a certain non-interactive zero-knowledge proof, which we use for
the construction of the encryption scheme. At that point we will refer to a specic result
proved in Chapter 6.
5.4.2.1. Denitions
Recall that we seek a denition that guarantees that partial information about the plaintext remains secret even if the plaintext does depend on the encryption-key in use. That
is, we seek a strengthening of semantic security (as dened in Denition 5.2.2) in which
one allows the plaintext distribution ensemble (denoted {X n }nN in Denition 5.2.2)
to depend on the encryption-key in use (i.e., for encryption-key e, we consider the
distribution X e over {0, 1}poly(|e|) ). Furthermore, we also allow the partial information
functions (denoted f and h in Denition 5.2.2) to depend on the encryption-key in use
(i.e., for encryption-key e, we consider the functions f e and h e ). In the actual denition
23
Indeed, it is natural (and even methodologically imperative) that a high-level application that uses encryption as
a tool be oblivious of the keys used by that tool. However, this refers only to a proper operation of the application,
and deviation may be caused (in some settings) by an improper behavior (i.e., an adversary).
425
ENCRYPTION SCHEMES
Recall that without loss of generality, we may assume that the keys generated by G(1n ) have length n. Thus,
there is no point in providing the algorithms with 1n as an auxiliary input (as done in Denition 5.2.2).
25 As usual, S (e, r ) denotes the output of the circuit S on input e and coins r . We stress that for every e, the
n
n
length of X e is xed.
426
Denition 5.4.2 (indistinguishability of encryptions under key-dependent passive attacks): The sequence {(x e , ye )}e{0,1} is admissible for the current denition if there exists a non-uniform family of polynomial-size circuits {Pn }nN that maps each encryptionkey e {0, 1} to the corresponding pair of (equal-length) strings (x e , ye ). That is, for
every e in the range of G 1 (1n ), it holds that Pn (e) = (xe , ye ). An encryption scheme,
(G, E, D), has indistinguishable encryptions under key-dependent passive attacks
if for every non-uniform family of polynomial-size circuits {Cn }, every admissible sequence {(x e , ye )}e{0,1} , every positive polynomial p, and all sufciently large n it holds
that
1
| Pr [Cn (e, E e (xe )) = 1] Pr [Cn (e, E e (ye )) = 1] | <
p(n)
where (e, d) G(1n ), and the probability is taken over the internal coin tosses of
algorithms G and E.
As in the basic case (i.e., Section 5.2), the two denitions are equivalent.
Theorem 5.4.3 (equivalence of denitions for key-dependent passive attacks): A
public-key encryption scheme (G, E, D) is semantically secure under key-dependent
passive attacks if and only if it has indistinguishable encryptions under key-dependent
passive attacks.
Proof Sketch: In order to show that indistinguishability of encryptions implies semantic
security, we follow the proof of Proposition 5.2.6. Specically, A is constructed and
analyzed almost as before, with the exception that A gets and uses the encryptionkey e (rather than letting it generate a random encryption-key by itself).26 That is, we
let A (e, 1|x| , h e (x)) = A(e, E e (1|x| ), 1|x| , h e (x)), and show that for all (deterministic)
polynomial-size circuit families {Sn }nN and {Hn }nN it holds that
Pr A(e, E e (Sn (e)), 1|Sn (e)| , Hn (e, Sn (e))) = f e (Sn (e))
(5.11)
1
< Pr A(e, E e (1|Sn (e)| ), 1|Sn (e)| , Hn (e, Sn (e))) = f e (Sn (e)) +
poly(n)
where e G 1 (1n ) and : N [0,1] is a negligible function. Once established,
Eq. (5.11) implies that (G, E, D) satises Denition 5.4.1.
On how Eq. (5.11) implies Denition 5.4.1: The issue is that Eq. (5.11) refers to
deterministic plaintext-selecting circuits (i.e., the Sn s), whereas Denition 5.4.1
refers to probabilistic plaintext-sampling circuits (i.e., the Sn s). This small gap
can be bridged by xing a sequence of coins for the latter probabilistic (sampling) circuits. Specically, starting with any admissible (for Denition 5.4.1) sequence {( f e , h e , X e )}e{0,1} , where Hn (e, x) = h e (x) and X e Sn (e, Upoly(n) ), we
consider some sequence of coins rn (for Sn ) that maximizes the gap between
Pr[A(e, E e (x e ), 1|xe | , Hn (e, x e )) = f e (x e )] and Pr[A (e, 1|xe | , Hn (e, x e )) = f e (x e )],
26
Here we use the convention by which A gets e along with h e (x) (and 1|x| ). This is important because A must
feed a matching pair (e, h e (x)) to A.
427
ENCRYPTION SCHEMES
Assuming (to the contrary of the above claim) that Eq. (5.11) does not hold, we obtain
a sequence of admissible pairs {(xe , ye )}e{0,1} for Denition 5.4.2 such that their
encryptions can be distinguished (in contradiction to our hypothesis). Specically,
def
def
def
we set x e = Sn (e) and ye = 1|xe | , and let C n (e, ) = A(e, , 1|xe | , Hn (e, x e )). Thus, we
obtain a (poly(n)-size) circuit Cn such that for some positive polynomial p and innitely
many ns
Pr[C (e, E e (x e )) = f e (xe )] Pr[C (e, E e (ye )) = f e (xe )] >
n
n
1
p(n)
where e is distributed according to G 1 (1n ). Using an idea as in the proof of Theorem 5.2.15, we derive a (poly(n)-size) circuit Cn that distinguishes (e, E e (xe )) from
(e, E e (ye )), where e G 1 (1n ), in contradiction to our hypothesis.
Details: We refer to the proof of Claim 5.2.15.1 (contained in the proof of The-
orem 5.2.15). Recall that the idea was to proceed in two stages. First, using
only
e (which also yields xe and ye ), we nd
an arbitrary value v such that
Pr[C (e, E e (x e )) = v] Pr[C (e, E e (ye )) = v] is large. In the second stage, we
n
n
use this value v in order to distinguish the case in which we are given an encryption
of x e from the case in which we are given an encryption of ye . (We comment if
(e, x) f e (x) were computable by a poly(n)-size circuit, then converting Cn into a
distinguisher Cn would have been much easier; we further comment that as a corollary to the current proof, one can conclude that the restricted form is equivalent to
the general one.)
This concludes the proof that indistinguishability of encryptions (as per Denition 5.4.2)
implies semantic security (as per Denition 5.4.1), and we now turn to the opposite
direction.
Suppose that (G, E, D) does not have indistinguishable encryptions, and consider an
admissible sequence {(xe , ye )}e{0,1} that witnesses this failure. Following the proof of
Proposition 5.2.7, we dene a probability ensemble {X e }e{0,1} and function ensembles
{h e }e{0,1} and { f e }e{0,1} in an analogous manner:
distinguishes (e, E e (xe )) from (e, E e (ye )), where e G 1 (1n ) (and (xe , ye ) = Pn (e)).
Using the admissibility of the sequence {(x e , ye )}e (for Denition 5.4.2), it follows that
{( f e , h e , X e )}e is admissible for Denition 5.4.1. Using the same algorithm A as in the
proof of Proposition 5.2.7 (i.e., A(e, , Cn ) = Cn (e, ), where is a ciphertext and
Cn = h e (X e )), and using the same analysis, we derive a contradiction to the hypothesis
that (G, E, D) satises Denition 5.4.1.
428
1
p(n)
1
1
+
2 2 p(n)
Pr A (e, 1|X e | , h e (X e )) = f e (X e )
1
2
5.4.2.2. Constructions
All the results presented in Section 5.3.4 extend to security under key-dependent passive
attacks. That is, for each of the constructions presented in Section 5.3.4, the same
assumption used to prove security under key-oblivious passive attacks actually sufces
for proving security under key-dependent passive attacks. Before demonstrating this
fact, we comment that (in general) security under key-oblivious passive attacks does
not necessarily imply security under key-dependent passive attacks; see Exercise 32.
Initial observations. We start by observing that Construction 5.3.7 (i.e., the transformation of block-ciphers to general encryption schemes) maintains its security in our
context. That is:
Proposition 5.4.4: (extension of Proposition 5.3.8): Let (G, E, D) and (G , E , D )
be as in Construction 5.3.7; that is, let (G , E , D ) be the full-edged encryption
constructed based on the block-cipher (G, E, D). Then if (G, E, D) is secure under
key-dependent passive attacks, then so is (G , E , D ).
429
ENCRYPTION SCHEMES
Proof Idea: As in the proof of Proposition 5.3.8, we merely observe that multiplemessage security of (G , E , D ) is equivalent to multiple-message security of
(G, E, D).
We next observe that Construction 5.3.13 (a block-cipher with block-length 1)
maintains its security also under a key-dependent passive attack. This is a special case
of the following observation:
Proposition 5.4.5: Let (G, E, D) be a block-cipher with logarithmically bounded
block-length (i.e., (n) = O(log n)). If (G, E, D) is secure under key-oblivious passive attacks, then it is also secure under key-dependent passive attacks.
Proof Sketch: Here we use the denition of ciphertext-indistinguishability in the singlemessage setting. The key observation is that the set of possible messages is relatively
small, and so selecting a message in a key-dependent manner does not give much
advantage over selecting a message at random (i.e., obliviously of the key).
Consider an arbitrary admissible (for Denition 5.4.2) set of pairs, {(xe , ye )}e{0,1} ,
where |xe | = |ye | = O(log |e|), and a circuit family {Cn } that tries to distinguish
(e, E e (xe )) from (e, E e (ye )). We shall show that {Cn } necessarily fails by relating its
distinguishing gap to the distinguishing gap of a key-oblivious attack (represented in
x, y
the next paragraph by the Cn s).
Let {Pn }nN be the circuit family producing the aforementioned admissible set (i.e.,
Pn (e) = (x e , ye )). Fixing some n N and an arbitrary (x, y) {0, 1} {0, 1} , we
x, y
consider a circuit Cn (depending on the circuits Cn and Pn and the pair (x, y)) that,
on input (e, ), operates as follows:
x, y
1. Using the hard-wired circuit Pn and the input (key) e, the circuit Cn checks whether
x, y
(xe , ye ) equals the hard-wired pair (x, y) (i.e., C n checks whether Pn (e) = (x, y)).
x, y
In case the check fails, Cn outputs an arbitrary value (e.g., 1) obliviously of the
ciphertext .
x, y
2. Otherwise (i.e., Pn (e) = (x, y)), the circuit C n invokes C n on its own input and
answers accordingly (i.e., outputs C n (e, )).
Since (G, E, D) is secure under key-oblivious passive attacks, it follows that (for every
x, y
(x, y) {0, 1}m {0, 1}m , where m poly(n)) the circuit C n cannot distinguish the
case = E e (x) from the case = E e (y). Thus, for some negligible function : N
[0,1] and every pair (x, y) {0, 1}m {0, 1}m , the following holds:
(n) > Pre [Cnx, y (e, E e (x)) = 1] Pre [Cnx, y (e, E e (y)) = 1]
Cn (e, E e (xe )) = 1
Cn (e, E e (ye )) = 1
= Pre
Pre
(xe , ye ) = (x, y)
(xe , ye ) = (x, y)
where e G 1 (1n ), and equality holds because in case (xe , ye ) = (x, y), the output of
x, y
x, y
x, y
C n (e, ) is independent of (and so in this case Cn (e, E e (x)) = Cn (e, E e (y))).
Since this holds for any pair (x, y) {0, 1}m {0, 1}m , and since |xe | = |ye | = (n), it
430
follows that
|Pre [Cn (e, E e (xe )) = 1] Pre [Cn (e, E e (ye )) = 1]|
C n (e, E e (x e )) = 1
C
(e,
E
(y
))
=
1
n
e
e
Pre
Pre
(x e , ye ) = (x, y)
(xe , ye ) = (x, y)
|x|=|y|=(n)
Recall that here serves as an encryption-key and C n () is a key-dependent plaintext. Typically, Cn () would
be the rst or second element in the plaintext pair (x , y ) = Pn ().
431
ENCRYPTION SCHEMES
attacks, we start with mild active attacks in which the adversary may obtain (from some
legitimate user) ciphertexts corresponding to plaintexts of the adversarys choice. Such
attacks will be called chosen plaintext attacks, and they characterize the adversarys
abilities in some applications. For example, in some settings, the adversary may (directly
or indirectly) control the encrypting module (but not the decrypting module).
Intuitively, a chosen plaintext attack poses additional threat in the case of privatekey encryption schemes (see Exercise 33), but not in the case of public-key encryption
schemes. In fact, we will show that in the case of public-key encryption schemes, a
chosen plaintext attack can be emulated by a passive key-dependent attack.
5.4.3.1. Denitions
We start by rigorously formulating the framework of chosen plaintext attacks. Intuitively, such attacks proceed in four stages corresponding to the generation of a key (by
a legitimate party), the adversarys requests (answered by the legitimate party) to encrypt
plaintexts under this key, the generation of a challenge ciphertext (under this key and
according to a template specied by the adversary), and additional requests to encrypt
plaintexts (under the same key). That is, a chosen plaintext attack proceeds as follows:
1. Key generation: A key-pair (e, d) G(1n ) is generated (by a legitimate party). In
the public-key setting the adversary is given (1n , e), whereas in the private-key setting
the adversary is only given 1n . Actually, assuming (without loss of generality) that
|e| = n, we may replace (1n , e) by e in the former case.
2. Encryption requests: Based on the information obtained so far, the adversary may
request (the legitimate party) to encrypt plaintexts of its (i.e., the adversarys) choice.
A request to encrypt the plaintext x is answered with a value taken from the distribution E e (x), where e is as determined in Step 1. After making several such requests,
the adversary moves to the next stage.
3. Challenge generation: Based on the information obtained so far, the adversary species a challenge template and is given an actual challenge.
When dening semantic security, the challenge template is a triplet of circuits
(Sm , h m , f m ), where Sm species a distribution of m-bit long plaintexts (and
h m , f m : {0, 1}m {0, 1} ), and the actual challenge is a pair (E e (x), h m (x)) where
x is distributed according to Sm (Upoly(n) ). When dening indistinguishability of encryptions, the challenge template is merely a pair of equal-length strings, and the
actual challenge is an encryption of one of these two strings.
4. Additional encryption requests: Based on the information obtained so far, the adversary may request the encryptions of additional plaintexts of its choice. These
requests are handled as in Step 2. After making several such requests, the adversary
produces an output and halts.
In the actual denition, the adversarys strategy will be decoupled into two parts corresponding to its actions before and after the generation of the actual challenge. Each
part will be represented by a (probabilistic polynomial-time) oracle machine, where
the oracle is an encryption oracle (with respect to the key generated in Step 1). The
432
rst part, denoted A1 , represents the adversarys behavior during Step 2. It is given
a security parameter (and possibly an encryption-key), and its output is a pair (, ),
where is the template generated in the beginning of Step 3 and is state information
passed to the second part of the adversary. The second part of the adversary, denoted
A2 , represents the adversarys behavior during Step 4. It is given the state (of the rst
part), as well as the actual challenge (generated Step 3), and produces the actual output
of the adversary.
In accordance with the use of non-uniform formulations, we let each of the two
oracle machines have a (non-uniform) auxiliary input. In fact, it sufces to provide
only the rst machine with such a (non-uniform) auxiliary input, because it can pass
auxiliary input to the second machine in the state information . (Similarly, in the case
of public-key schemes, it sufces to provide only the rst machine with the encryptionkey.) We comment that we provide these machines with probabilistic oracles; that is, in
response to a plaintext query x, the oracle E e returns a random ciphertext E e (x) (i.e.,
the result of a probabilistic process applied to e and x). Thus, in the case of public-key
schemes, the four-step attack process can be written as follows:
(e, d) G(1n )
(, ) A1E e (e, z)
def
ENCRYPTION SCHEMES
v = f m (x) where
(e, d) G(1n )
Ee
Pr
((Sm , h m , f m ), ) A1 (e, z)
v = f m (x) where
p(n)
x Sm (Upoly(n) )
|x|
v A2 (, 1 , h m (x))
Recall that (Sm , h m , f m ) is a triplet of circuits produced as in Step 3 of the
foregoing description, and that x is a sample from the distribution induced by Sm .
2. For every n and z, the rst elements (i.e., the (Sm , h m , f m ) part) in the random
E G (1n )
variables A1 (1n , z) and A1 1 (G 1 (1n ), z) are identically distributed.
For private-key schemes: The denition is identical except that algorithm A1 gets the
security parameter 1n instead of the encryption-key e.
Note that as in almost all other denitions of semantic security (with the exception of
Denition 5.4.1), algorithm A1 does not get a (random) encryption-key as input (but may
rather generate one by itself).28 Since the challenge template is not xed (or determined
by e) but, rather, is chosen by A and A themselves, it is very important to require
that in both cases, the challenge template be distributed identically (or approximately
so): There is no point in relating the success probability of A and A , unless these
probabilities refer to same distribution of problems (i.e., challenge templates).29 (The
issue arises also in Denition 5.4.1 where it was resolved by forcing A to refer to the
challenge template determined by the public-key e.)30
Denition 5.4.8 implies Denition 5.4.1, but this may not be evident from the definitions themselves (most importantly, because here f m is computationally bounded
whereas in Denition 5.4.1 the function is computationally unbounded). Still, the validity of the claim follows easily from the equivalence of the two denitions to the
In fact, A1 is likely to start by generating e G 1 (1n ), because it has to generate a challenge template that is
distributed as the one produced by A1 on input e G 1 (1n ).
29 Failure to make this requirement would have resulted in a fundamentally bad denition (by which every encryption scheme is secure). For example, algorithm A1 could have set h m to equal the function f m selected by A1 (in
a corresponding attack). Doing so, the success of A to guess the value of fm (x) from the (insecure) encryption
of x and a (possibly) useless value h m (x) (e.g., for a constant function h m ) would have been met by the success
of A to guess the value of f m (x) from f m (x) itself (without being given the encryption of x). An alternative
approach, which follows the formulation of Denition 5.4.1, is presented in Exercise 34.
30 Indeed, an alternative solution could have been the one adopted here and in the sequel; that is, in an alternative
to Denition 5.4.1, one may allow A to select the challenge template by itself, provided that the selection yields
a distribution similar to the one faced by A (as induced by the public-key e). For details, see Exercise 30.
28
434
corresponding notions of indistinguishability of encryptions (and the fact that the implication is evident for the latter formulations).
Indistinguishability of Encryptions. Deriving the corresponding denition of indistinguishability of encryptions (from the previous framework) is considerably simpler.
Here, the challenge generation consists of the adversary specifying two equal-length
strings and the adversary being presented with the encryption of one of them. The
adversarys goal is to distinguish the two possible cases.
Denition 5.4.9 (indistinguishability of encryptions under chosen plaintext attacks):
For public-key schemes: A public-key encryption scheme, (G, E, D), is said to have
indistinguishable encryptions under chosen plaintext attacks if for every pair
of probabilistic polynomial-time oracle machines, A1 and A2 , for every positive
polynomial p, and for all sufciently large n and z {0, 1}poly(n) it holds that
(1)
(2)
pn,z
| <
| pn,z
where
1
p(n)
(i)
pn,z
v = 1 where
(e, d) G(1n )
def
Ee
(1)
(2)
= Pr
((x , x ), ) A1 (e, z)
c E e (x (i) )
Ee
v A2 (, c)
where |x (1) | = |x (2) |.
For private-key schemes: The denition is identical except that A1 gets the security
parameter 1n instead of the encryption-key e.
Clearly, Denition 5.4.9 implies Denition 5.4.2 as a special case. Furthermore, for
public-key schemes, the two denitions are equivalent (see Proposition 5.4.10), whereas
for private-key schemes, Denition 5.4.9 is strictly stronger (see Exercise 33).
Proposition 5.4.10: Let (G, E, D) be a public-key encryption scheme that has indistinguishable encryptions under key-dependent passive attacks. Then (G, E, D) has
indistinguishable encryptions under chosen plaintext attack.
Proof Sketch: The key observation is that in the public-key model, a chosen plaintext
attack can be emulated by a passive key-dependent attack. Specically, the (passive)
attacker can emulate access to an encryption oracle by itself (by using the encryptionkey given to it). Thus, we obtain an attacker as in Denition 5.4.9, with the important
exception that it never makes oracle calls (but rather emulates E e by itself). In other
words, we have an attacker as in Denition 5.4.2, with the minor exception that it is
a probabilistic polynomial-time machine with auxiliary input z (rather than being a
polynomial-size circuit) and that it distinguishes a pair of plaintext distributions rather
than a pair of (xed) plaintexts (which depend on the encryption-key). However, xing
435
ENCRYPTION SCHEMES
the best-possible coins for this attacker (and incorporating them as well as z in an
adequate circuit), we obtain an attacker exactly as in Denition 5.4.2 such that its
distinguishing gap is at least as large as the one of the (initial) chosen plaintext attacker.
(For details, see Exercise 30.)
Equivalence of Semantic Security and Ciphertext-Indistinguishability. As in previous cases, we show that the two formulations of (chosen plaintext attack) security
(i.e., semantic security and indistinguishability of encryptions) are in fact equivalent.
Theorem 5.4.11 (equivalence of denitions for chosen plaintext attacks): A public-key
(resp., private-key) encryption scheme (G, E, D) is semantically secure under chosen plaintext attacks if and only if it has indistinguishable encryptions under chosen
plaintext attacks.
Proof Sketch: In order to show that indistinguishabity of encryptions implies semantic
security, we follow again the ideas underlying the proof of Proposition 5.2.6. Specifically, for both the private-key and public-key cases, A1 and A2 are constructed as
follows:
def
2. A2 ((e, ), 1m , ) = A2E e (, (E e (1m ), )), where typically = h m (x) and m = |x|.
Since A1 merely emulates the generation of a key-pair and the actions of A1 with respect
to such a pair, the equal distribution condition (i.e., Item 2 in Denition 5.4.8) holds.
Using the (corresponding) indistinguishability of encryption hypothesis, we show that
(even in the presence of an encryption oracle E e ) the distributions (, (E e (x), h(x)))
and (, (E e (1|x| ), h(x))) are indistinguishable, where (e, d) G(1n ), ((S, h, f ), )
A1Ee (y, z) (with y = e or y = 1n depending on the model), and x S(Upoly(n) ).
E
436
and outputs ((x (1) , x (2) ), (, h(x (1) ))). That is, (x (1) , x (2) ) is the challenge template,
and it is answered with E e (x (i) ), where i is either 1 or 2. The second part of the
new distinguisher gets as input a challenge ciphertext E e (x (i) ) and the state
generated by the rst part (, h(x (1) )), and invokes the distinguisher of the contradiction hypothesis with input (, (, h(x (1) ))), while answering its oracle queries by
forwarding these queries to its own E e oracle. Thus, the new distinguisher violates
the condition in Denition 5.4.9, in contradiction to the hypothesis that (G, E, D)
has indistinguishable encryptions.
It follows that indistinguishability of encryptions (as per Denition 5.4.9) implies semantic security (as per Denition 5.4.8). (Here, this implication is easier to prove than
in previous cases because the function f is computable via a circuit that is generated
as part of the challenge template [and, without loss of generality, is part of ].)
We now turn to the opposite direction. Suppose that (G, E, D) does not have indistinguishable encryptions, and consider the pairs (x (1) , x (2) ) produced as a challenge
template by the distinguishing adversary. Following the ideas of the proof of Proposition 5.2.7, we let the semantic-security adversary generate a corresponding challenge
template (S, h, f ) such that
ENCRYPTION SCHEMES
these ciphertexts using knowledge of the encryption-key, which is only possible in the
public-key setting).
5.4.3.2. Constructions
In view of Proposition 5.4.10 (and Theorem 5.4.11), we focus on private-key encryption
schemes (because a public-key encryption scheme is secure under chosen plaintext
attacks if and only if it is secure under passive key-dependent attacks). All the results
presented in Section 5.3.3 extend to security under chosen plaintext attacks. Specically,
we prove that Constructions 5.3.9 and 5.3.12 remain secure also under a chosen plaintext
attack.
Proposition 5.4.12: Let F and (G, E, D) be as in Construction 5.3.9, and suppose
that F is pseudorandom with respect to polynomial-size circuits. Then the private-key
encryption scheme (G, E, D) is secure under chosen plaintext attacks. The same holds
with respect to Construction 5.3.12.
Proof Sketch: We focus on Construction 5.3.9 and follow the technique underlying the
proof of Proposition 5.3.10. That is, we consider an idealized version of the scheme, in
which one uses a uniformly selected function : {0, 1}n {0, 1}n , rather than the pseudorandom function f s . Essentially, all that the adversary obtains by encryption queries
in the ideal version is pairs (r, (r )), where the r s are uniformly and independently
distributed in {0, 1}n . As to the challenge itself, the plaintext is masked by the value
of at another uniformly and independently distributed element in {0, 1}n . Thus, unless
the latter element happens to equal one of the r s used by the encryption oracle (which
happens with negligible probability), the challenge plaintext is perfectly masked. Thus,
the ideal version is secure under a chosen plaintext attack, and the same holds for the
real scheme (since otherwise one derives a contradiction to the hypothesis that F is
pseudorandom).
Summary. Private-key and public-key encryption schemes that are secure under chosen plaintext attacks exist if and only if corresponding schemes that are secure under
passive (key-dependent) attacks exist.31
Hint: When establishing the claim for the private-key case, use Exercise 2.
438
Both types of attacks address security threats in realistic applications: In some settings, the adversary may experiment with the decryption module, before the actual
ciphertext in which it is interested is sent. Such a setting corresponds to an a priori
chosen ciphertext attack. In other settings, one may invoke the decryption module on
inputs of ones choice at any time, but all these invocations are recorded, and real
damage is caused only by knowledge gained with respect to a ciphertext for which a
decryption request was not recorded. In such a setting, protection against a posteriori
chosen ciphertext attacks is adequate. Furthermore, in both cases, decryption requests
can also be made with respect to strings that are not valid ciphertexts, in which case
the decryption module returns a special error symbol.
Typically, in settings in which a mild or strong form of a chosen ciphertext attack is
possible, a chosen plaintext attack is possible, too. Thus, we actually consider combined
attacks in which the adversary may ask for encryption and decryption of strings of its
choice. Indeed (analogously to Proposition 5.4.10), in the case of public-key schemes
(but not in the case of private-key schemes), the combined attack is equivalent to a
pure chosen ciphertext attack.
Organization. We start by providing security denitions for the two types of attacks
discussed here. In Section 5.4.4.2, we further extend the denitional treatment of security (and derive a seemingly stronger notion that is in fact equivalent to the notions
in Section 5.4.4.1). In Section 5.4.4.3 (resp., Section 5.4.4.4) we discuss the construction of private-key (resp., public-key) encryption schemes that are secure under chosen
ciphertext attacks.
ENCRYPTION SCHEMES
is not a valid ciphertext (with respect to E e ) is answered with a special error symbol.
After making several such requests, the adversary moves to the next stage.
3. Challenge generation: Based on the information obtained so far, the adversary species a challenge template and is given an actual challenge. This is done as in the
corresponding step in the framework of chosen plaintext attacks.
4. Additional encryption and decryption requests: Based on the information obtained
so far, the adversary may request the encryptions of additional plaintexts of its
choice. In addition, in the case of an a posteriori chosen ciphertext attack (but
not in the case of an a priori chosen ciphertext attack), the adversary may make
additional decryption requests with the only (natural) restriction that it not be allowed
to ask for a decryption of the challenge ciphertext. All requests are handled as in
Step 2. After making several such requests, the adversary produces an output and
halts.
In the actual denition, as in the case of chosen plaintext attacks, the adversarys
strategy will be decoupled into two parts corresponding to its actions before and after
the generation of the actual challenge. Each part will be represented by a (probabilistic polynomial-time) two-oracle machine, where the rst oracle is an encryption oracle and the second is a decryption oracle (both with respect to the corresponding key generated in Step 1). As in the case of chosen plaintext attacks, the
two parts are denoted A1 and A2 , and A1 passes state information (denoted ) to
A2 . Again, in accordance with the use of non-uniform formulations, we provide A1
with a (non-uniform) auxiliary input. Thus, in the case of (a posteriori chosen ciphertext attacks on) public-key schemes, the four-step attack process can be written as
follows:
(e, d) G(1n )
(, ) A1Ee , Dd (e, z)
def
outputting a challenge template, and the second is in charge of solving the challenge,
where state information is passed from the rst part to the second part. Furthermore,
it is again important to require that the challenge template produced by the corresponding algorithm be distributed exactly as the challenge template produced by the
adversary.
Denition 5.4.13 (Semantic Security under Chosen Ciphertext Attacks):
For public-key schemes: A public-key encryption scheme, (G, E, D), is said to be semantically secure under a priori chosen ciphertext attacks if for every pair of
probabilistic polynomial-time oracle machines, A1 and A2 , there exists a pair of
probabilistic polynomial-time algorithms, A1 and A2 , such that the following two
conditions hold:
1. For every positive polynomial p, and all sufciently large n and z {0, 1}poly(n)
it holds that
v = f (x) where
(e, d) G(1n )
E e , Dd
(e, z)
((S, h, f ), ) A1
Pr
v = f (x) where
p(n)
x S(Upoly(n) )
|x|
v A2 (, 1 , h(x))
2. For every n and z, the rst elements (i.e., the (S, h, f ) part) in the random variables
E G (1n ) , DG 2 (1n )
(G 1 (1n ), z) are identically distributed.
A1 (1n , z) and A1 1
Semantic security under a posteriori chosen ciphertext attacks is dened analogously, except that A2 is given oracle access to both E e and Dd with the restriction
that when given the challenge c = (c , c ), machine A2 is not allowed to make the
query c to the oracle Dd .
For private-key schemes: The denition is identical except that algorithm A1 gets the
security parameter 1n instead of the encryption-key e.
Clearly, the a posteriori version of Denition 5.4.13 implies its a priori version, which
in turn implies Denition 5.4.8. Furthermore, these implications are strict (see Exercises 36 and 35, respectively).
Indistinguishability of Encryptions. As in the case of chosen plaintext attacks,
deriving the corresponding denition of indistinguishability of encryptions (from
the previous framework) is considerably simpler: The challenge generation consists
of the adversary specifying two equal-length strings, and the adversary is presented
with the encryption of one of them.
441
ENCRYPTION SCHEMES
1
p(n)
where
(i)
pn,z
v = 1 where
(e, d) G(1n )
def
E e , Dd
(1)
(2)
= Pr
(e, z)
((x , x ), ) A1
c E e (x (i) )
Ee
v A2 (, c)
where |x (1) | = |x (2) |.
For private-key schemes: The denition is identical, except that A1 gets the security
parameter 1n instead of the encryption-key e.
Clearly, the a posteriori version of Denition 5.4.14 implies its a priori version, which
in turn implies Denition 5.4.9 as a special case. Again, these implications are strict
(see again Exercises 36 and 35, respectively).
Terminology. We use CCA as a shorthand for chosen ciphertext attack.
Equivalence of Semantic Security and Ciphertext-Indistinguishability. Again, we
show that the two formulations of security (i.e., semantic security and indistinguishability of encryptions) are in fact equivalent.
Theorem 5.4.15 (equivalence of denitions for CCA): A public-key (resp., privatekey) encryption scheme (G, E, D) is semantically secure under a priori CCA if and
only if it has indistinguishable encryptions under a priori CCA. An analogous claim
holds for a posteriori CCA.
Proof Sketch: We adapt the proof of Theorem 5.4.11 to the current setting. The adaptation is straightforward, and we focus on the case of a posteriori CCA security (while
commenting on the case of a priori CCA security).
442
(, ) A1E e , Dd (1n , z). Finally, A1 sets = ((e, d), ). (In the case of a-priori
def
|x|. (In the case of a priori CCA security, we may set A2 ((e, ), 1m , ) =
A2Ee (, (E e (1m ), )), as in the proof of Theorem 5.4.11.)
Again, since A1 merely emulates the generation of a key-pair and the actions of A1 with
respect to such a pair, the equal distribution condition (i.e., Item 2 in Denition 5.4.13)
holds. Using the (corresponding) indistinguishability of encryption hypothesis, we show
that (even in the presence of the encryption oracle E e and a restricted decryption oracle
Dd ) the distributions (, (E e (x), h(x))) and (, (E e (1|x| ), h(x))) are indistinguishable,
where (e, d) G(1n ), ((S, h, f ), ) A1Ee (y, z) (with y = e or y = 1n depending
on the model), and x S(Upoly(n) ). The main thing to notice is that the oracle queries
made by a possible distinguisher of these distributions can be handled by a distinguisher
of encryptions (as in Denition 5.4.14), by passing these queries to its own oracles.
It follows that indistinguishability of encryptions (as per Denition 5.4.14) implies
semantic security (as per Denition 5.4.13).
We now turn to the opposite direction. Here, the construction of a challenge template
(as per Denition 5.4.13) is exactly as the corresponding construction in the proof of
Theorem 5.4.11. Again, the thing to notice is that the oracle queries made by a possible
distinguisher of encryptions (as in Denition 5.4.14) can be handled by the semanticsecurity adversary, by passing these queries to its own oracles. We derive a contradiction to the hypothesis that (G, E, D) satises Denition 5.4.13, and the theorem
follows.
Multiple-Message Security. Denitions 5.4.13 and 5.4.14 can be easily generalized
to handle challenges in which multiple plaintexts are encrypted. We stress that in the
case of a posteriori CCA, the adversary is not allowed to make a decryption query
that equals any of the challenge ciphertexts. As in previous cases, the corresponding
(multiple-plaintext) denitions are equivalent. Furthermore, as in the case of chosen
plaintext attacks, the multiple-plaintext denitions are equivalent to the single-plaintext
denitions (both for public-key and private-key schemes). We stress that this notion of
multiple-message CCA security refers to a single challenge-generation step in which a
sequence of messages (rather than a single message) can be specied. A more general
notion of multiple-message CCA security allows multiple challenge-generation steps
that may be interleaved with the query steps. This notion generalizes the notion of
443
ENCRYPTION SCHEMES
chosen ciphertext attacks and is discussed next (i.e., in Subsection 5.4.4.2). Actually,
we will focus on this generalization when applied to a posteriori chosen ciphertext
attacks, although a similar generalization can be applied to a priori chosen ciphertext
attacks (and in fact also to chosen plaintext attacks).
Note that in this section we generalize the notion of an a posteriori chosen ciphertext attack. When generalizing
the notion of an a priori chosen ciphertext attack, we disallow decryption queries after the rst challenge template
is produced.
33 Independently distributed plaintexts can be obtained by sampling circuits that refer to disjoint parts of the
random string r . On the other hand, we can obtain a pair of plaintexts such that the second plaintext is a function
of the rst one by letting the second sampling circuit equal the composition of the rst sampling circuit with
the said function. That is, making queries of the form (S, ) and (C S, ), where C is a deterministic circuit,
def
we obtain answers that refer to the plaintexts x = S(r ) and C(x).
34 In general, the description of functions in terms of circuits that are not of minimal size is redundant, and opens
the door for encoding of additional information.
444
We now turn to describe the benign adversary (which does not see the ciphertexts).
Such an adversary is given oracle access to a corresponding oracle, Tr , that behaves
as follows. On query a challenge template of the form (S, h), the oracle returns h(x),
where x = S(r ). (Again, r is not known to the adversary.) Like the real adversary, the
benign adversary also terminates by outputting a function f and a value v, hoping that
f (x 1 , ..., x t ) = v, where x i = S i (r ) and (S i , h i ) is the i-th challenge query made by
the adversary.
Security amounts to asserting that the effect of any efcient multiple-challenge CCA
can be simulated by an efcient benign adversary that does not see the ciphertexts. As
in Denition 5.4.13, the simulation has to satisfy two conditions: First, the probability
that f (x 1 , ..., x t ) = v in the CCA must be met by the probability that a corresponding
event holds in the benign model (where the adversary does not see ciphertexts). Second,
the challenge queries, as well as the function f , should be distributed similarly in the
two models. Actually, the second condition should be modied in order to account
for the case that the real CCA adversary makes a decryption query that refers to a
ciphertext that is contained in the answer given to a previous challenge query, denoted
(S, h). Note that such a decryption query (i.e., E e (S(r ))) reveals S(r ) to the attacker,
and that this has nothing to do with the security of the encryption scheme. Thus, it is
only fair to also allow the benign adversary (which sees no ciphertexts) to make the
corresponding query, which is equivalent to the challenge query (S, id), where id is
the identity function. (Indeed, the answer will be id(S(r )) = S(r ).)
In order to obtain the actual denition, we need to dene the trace of the execution
of these two types of adversaries. For a multiple-challenge CCA adversary, denoted
A, the trace is dened as the sequence of challenge queries made during the attack,
augmented by ctitious challenge queries such that the (ctitious challenge) query
(S, id) is included if and only if the adversary made a decryption query c such that (c, )
is the answer given to a previous challenge query of the form (S, ). (This convention
is justied by the fact that the answer (E e (S(r )), id(S(r ))) to the ctitious challenge
query (S, id) is efciently computable from the answer S(r ) to the decryption query
c = E e (S(r )).)35 In fact, for simplicity, we will assume in the following denition that A
(or rather a minor modication of A) actually makes these ctitious challenge queries.
For the benign adversary, denoted B, the trace is dened as the sequence of challenge
queries made during the attack.
Indeed, the value (E e (S(r )), id(S(r ))) is obtained from S(r ) by making an encryption query S(r ).
445
ENCRYPTION SCHEMES
it holds that
v = f (x 1 , ..., x t ) where
Pr
( f, v) A Ee , Dd , Te,r (e, z)
i
i
x S (r ), for i = 1, ..., t.
1
v = f (x , ..., x t ) where
r Upoly(n)
+ 1
< Pr
Tr n
p(n)
( f, v) B (1 , z)
i
i
x S (r ), for i = 1, ..., t.
where t is the number of challenge queries made by A (resp., B), and S i is the
rst part of the i-th challenge query made by A (resp., B) to Te,r (resp., to Tr ).
2. The following two probability ensembles, indexed by n N and z {0, 1}poly(n),
are computationally indistinguishable:
(a) The trace of A E G 1 (1 ) , DG 2 (1 ) , TG 1 (1 ),Upoly(n) (G 1 (1n ), z) augmented by the rst element of its output pair (i.e., the function f ).
(b) The trace of B TUpoly(n) (1n , z) augmented by the rst element of its output pair.
n
can perfectly simulate any multiple-challenge CCA without making decryption queries
to ciphertexts obtained as part of answers to challenge queries. Instead, these canonical
adversaries make corresponding queries of the form (S, id), where id is the identity
function and (S, ) is the challenge-query that was answered with the said ciphertext.
Specically, suppose that a multiple-challenge CCA has made the challenge query
(S, h), which was answered by (c, v) where c = Ee (x), v = h(x) and x = S(r ), and at a
later stage makes the decryption query c, which is to be answered by Dd (c) = x. Then,
the corresponding canonical adversary makes the challenge query (S, h) as the original
adversary, receiving the same pair (c, v), but later (instead of making the decryption
query c) the canonical adversary makes the challenge query (S, id), which is answered
by id(S(r )) = x = Dd (c). Note that the trace of the corresponding canonical adversary
is identical to the trace of the original CCA adversary (and the same holds with respect
to their outputs).
Thus, given an a posteriori CCAsecure encryption scheme, it sufces to establish
Denition 5.4.16 when the quantication is restricted to canonical adversaries A. Indeed, as in previous cases, we construct a benign adversary B in the natural manner:
On input (1n , z), machine B generates (e, d) G(1n ), and invokes A on input (y, z),
where y = e if we are in the public-key case and y = 1n otherwise. Next, B emulates
all oracles expected by A, while using its own oracle Tr . Specically, the oracles E e and
Dd are perfectly emulated by using the corresponding keys (known to B), and the oracle
Te,r is (imperfectly) emulated using the oracle Tr ; that is, the query (S, h) is forwarded
to Tr , and the answer h(S(r )) is augmented with E e (1m ), where m is the number of
output bits in S. Note that the latter emulation (i.e., the answer (E e (1|S(r )| ), h(S(r )))) is
imperfect since the answer of Te,r would have been (E e (S(r )), h(S(r ))), yet (as we shall
show) A cannot tell the difference.
In order to show that B satises both conditions of Denition 5.4.16 (with respect
to this A), we will show that the following two ensembles are computationally indistinguishable:
1. The global view in a real attack of A on (G, E, D). That is, we consider the output
of the following experiment:
(a) (e, d) G(1n ) and r Upoly(n) .
(b) ( f, v) A E e , Dd , Te,r (y, z), where y = e if we are in the public-key case and
y = 1n otherwise. Furthermore, we let ((S 1 , h 1 ), ..., (S t , h t )) denote the trace of
the execution A Ee , Dd , Te,r (y, z).
(c) The output is ((S 1 , h 1 ), ..., (S t , h t )), ( f, v), r .
2. The global view in an attack emulated by B . That is, we consider the output of an
experiment as in Item 1, except that A Ee , Dd , Te,r (y, z) is replaced by A E e , Dd , Te,r (y, z),
where on query (S, h) the oracle Te,r
replies with (E e (1|S(r )| ), h(S(r ))) rather than
with (Ee (S(r )), h(S(r ))).
Note that computational indistinguishability of these ensembles immediately implies
Condition 2 of Denition 5.4.16, whereas Condition 1 also follows because using r , we
447
ENCRYPTION SCHEMES
can determine whether or not f (S 1 (r ), ..., S t (r )) = v holds (for ( f, v) and S 1 , ..., S t that
appear in the ensembles output). Also note that these ensembles may be computationally
indistinguishable only in the case where A is canonical (which we have assumed to be
the case).36
The computational indistinguishability of these two ensembles is proven using a
hybrid argument, which in turn relies on the hypothesis that (G, E, D) has indistinguishable encryptions under a posteriori CCAs. Specically, we introduce t + 1 mental
experiments that are hybrids of the two ensembles (which we wish to relate). Each of
these mental experiments is given oracle access to E e and Dd , where (e, d) G(1n ) is
selected from the outside. The i-th hybrid experiment uses these two oracles (in addition
to y, which equals e in the public-key case and 1n otherwise) in order to emulate an
i
execution of A Ee , Dd ,e,r ( y, z), where r is selected by the experiment itself and ie,r is
. Specically, ie,r is a history-dependent process that answers
a hybrid of Te,r and Te,r
like Te,r on the rst i queries and like Te,r
on the rest. Thus, for i = 0, ..., t, we dene
the i-th hybrid experiment as a process that, given y (which equals e or 1n ) and oracle
access to E e and Dd , where (e, d) G(1n ), behaves as follows:
1. The process selects r Upoly(n) .
i
2. The process emulates an execution of A E e , Dd ,e,r (y, z), where y = e if we are in the
public-key case and y = 1n otherwise, by using the oracles E e and Dd . Specically,
the answers of ie,r are emulated using the knowledge of r and oracle access to E e :
the j-th query to ie,r , denoted (S j , h j ), is answered by (E e (S j (r )), h j (S j (r ))) if
j
j i and is answered by (E e (1|S (r )| ), h j (S j (r ))) otherwise. (The process answers
As queries to E e and Dd by forwarding them to its own corresponding oracles.)
i
3. As before, ( f, v) denotes the output of A E e , Dd ,e,r (y, z), and ((S 1 , h 1 ), ..., (S t , h t ))
denotes its trace. The process outputs ((S 1 , h 1 ), ..., (S t , h t )), ( f, v), r .
We stress that since A is canonical, none of the Dd -queries equals a ciphertext obtained
as part of the answer of a ie,r -query.
Clearly, the distribution of the 0-hybrid is identical to the distribution of the global
view in an attack emulated by B, whereas the distribution of the t-hybrid is identical to
the distribution of the global view in a real attack by A. On the other hand, distinguishing
the i-hybrid from the (i + 1)-hybrid yields a successful a posteriori CCA (in the sense of
distinguishing encryptions). That is, assuming that one can distinguish the i-hybrid from
the (i + 1)-hybrid, we construct an a posteriori CCA adversary (as per Denition 5.4.14)
36
Non-canonical adversaries can easily distinguish the two types of views by distinguishing the oracle Te,r from
. For example, suppose we make a challenge query with a sampling-circuit S that generates some
oracle Te,r
distribution over {0, 1}m \ {1m }, next make a decryption query on the ciphertext obtained in the challenge
query, and output the answer. Then, in case we query the oracle Te,r , we output Dd (E e (S(r ))) = 1m ; whereas
, we output D (E (1m )) = 1m . Recall, however, that at this point of the proof,
in case we query the oracle Te,r
d
e
we are guaranteed that A is canonical (and indeed A might have been derived by perfectly emulating some
non-canonical A ). An alternative way of handling non-canonical adversaries is to let B handle the disallowed
(decryption) queries by making the corresponding challenge query, and returning its answer rather than the
, can detect which queries are disallowed.)
decryption value. (Note that B, which emulates Tr,e
448
as follows. For (e, d) G(1n ), given y = e if we are in the public-key case and y = 1n
otherwise, the attacker (having oracle access to E e and Dd ) behaves as follows:
1. The attacker selects r Upoly(n) .
j
2. The attacker emulates an execution of A Ee , Dd ,e,r (y, z), where j {i, i + 1} (is unknown to the attacker), as follows. The queries to E e and Dd are answered by using
the corresponding oracles available to the attacker, and the issue is answering the
j
j
queries to e,r . The rst i queries to e,r are answered as in both ie,r and i+1
e,r (i.e.,
query (S, h) is answered by (E e (S(r )), h(S(r )))), and the last t (i + 1) queries are
|S(r )|
), h(S(r ))), this time).
also answered as in both ie,r and i+1
e,r (i.e., by (E e (1
st
i+1
i+1
The i + 1 query, denoted (S , h ), is answered by producing the challenge
i+1
template (S i+1 (r ), 1|S (r )| ), which is answered by the challenge ciphertext c (where
i+1
c {E e (S i+1 (r )), E e (1|S (r )| )}), and replying with (c, h i+1 (S i+1 (r ))).
|S
Note that if c = E e (S i+1 (r )), then we emulate i+1
e,r , whereas if c = E e (1
i
we emulate e,r .
i+1 (r )|
) then
3. Again, ( f, v) denotes the output of A E e , Dd ,e,r (y, z), and ((S 1 , h 1 ), ..., (S t , h t )) denotes its trace. The attacker feeds ((S 1 , h 1 ), ..., (S t , h t )), ( f, v), r to the hybrid distinguisher (which we have assumed to exist toward the contradiction), and outputs
whatever the latter does.
This is an a posteriori CCA as in Denition 5.4.14: It produces a single challenge
i+1
(i.e., the pair of plaintexts (Si+1 (r ), 1|S (r )| )), and distinguishes the case that it is
given the ciphertext c = E e (S i+1 (r )) from the case that it is given the ciphertext c =
i+1
E e (1|S (r )| ), without querying Dd on the challenge ciphertext c. The last assertion
follows by the hypothesis that A is canonical, and so none of the Dd -queries that A
j
makes equals the ciphertext c obtained as (part of) the answer to the i + 1st e,r -query.
Thus, distinguishing the i + 1st and i-th hybrids implies distinguishing encryptions
under an a posteriori CCA, which contradicts our hypothesis regarding (G, E, D). The
theorem follows.
Further Generalization. Recall that we have allowed arbitrary challenge queries of the
form (S, h) that were answered by (E e (S(r )), h(S(r ))). Instead, we may allow queries
of the form (S, h) that are answered by (E e (S(r )), h(r )); that is, h is applied to r itself
rather than to S(r ). Actually, given the independence of h from S, one could have
replaced the challenge queries by two types of queries: partial-information (on r )
queries that correspond to the hs (and are answered by h(r )), and encrypted partialinformation queries that correspond to the Ss (and are answered by E e (S(r ))). As
shown in Exercise 38, all these forms are in fact equivalent.
ENCRYPTION SCHEMES
Security under a-priori CCA. All the results presented in Section 5.3.3 extend to
security under a priori chosen ciphertext attacks. Specically, we prove that Constructions 5.3.9 and 5.3.12 remain secure also under an a priori CCA.
Proposition 5.4.18: Let F and (G, E, D) be as in Construction 5.3.9, and suppose
that F is pseudorandom with respect to polynomial-size circuits. Then the private-key
encryption scheme (G, E, D) is secure under a priori chosen ciphertext attacks. The
same holds with respect to Construction 5.3.12.
Proof Sketch: As in the proof of 5.4.12, we focus on Construction 5.3.9, and consider
an idealized version of the scheme in which one uses a uniformly selected function
: {0, 1}n {0, 1}n (rather than the pseudorandom function f s ). Again, all that the adversary obtains by encryption queries in the ideal version is pairs (r, (r )), where the
r s are uniformly and independently distributed in {0, 1}n . Similarly, decryption queries
provide the adversary with pairs (r, (r )), but here the r s are selected by the adversary.
Still in an a priori CCA, all decryption queries are made before the challenge is presented, and so these r s are selected (by the adversary) independent of the challenge.
Turning to the challenge itself, we observe that the plaintext is masked by the value
of at another uniformly and independently distributed element in {0, 1}n , denoted
rC . We stress that rC is independent of all r s selected in decryption queries (because
these occur before rC is selected), as well as being independent of all r s selected by the
encryption oracle (regardless of whether these queries are made prior or subsequently
to the challenge). Now, unless rC happens to equal one of the r s that appear in the
pairs (r, (r )) obtained by the adversary (which happens with negligible probability),
the challenge plaintext is perfectly masked. Thus, the ideal version is secure under an a
priori CCA. The same holds for the real scheme, because pseudorandom functions are
indistinguishable from truly random ones (even by machines that adaptively query the
function at arguments of their choice).
Security under a-posteriori CCA. Unfortunately, Constructions 5.3.9 and 5.3.12 are
not secure under a posteriori chosen ciphertext attacks: Given a challenge ciphertext
(r, x f s (r )), the adversary may obtain f s (r ) by making the query (r, y ), for any
y = x f s (r ). This query is allowed and is answered with x such that y = x f s (r ).
Thus, the adversary may recover the challenge plaintext x from the challenge ciphertext
def
(r, y), where y = x f s (r ), by computing y (y x ). Thus, we should look for new
private-key encryption schemes if we want to obtain one that is secure under a posteriori
CCA. Actually, we show how to transform any private-key encryption scheme that is
secure under chosen plaintext attack (CPA) into one that is secure under a posteriori
CCA.
The idea underlying our transformation (of CPA-secure schemes into CCA-secure
ones) is to eliminate the adversarys gain from chosen ciphertext attacks by making it
infeasible to produce a legitimate ciphertext (other than the ones given explicitly to the
adversary). Thus, an a posteriori CCA adversary can be emulated by a chosen plaintext
attack (CPA) adversary, while almost preserving the success probability.
450
The question is indeed how to make it infeasible for the (a posteriori CCA) adversary
to produce a legitimate ciphertext (other than the ones explicitly given to it). One answer
is to use Message Authentication Codes (MACs) as dened in Section 6.1.37 That is,
we augment each ciphertext with a corresponding authentication tag (which is hard
to forge), and consider an augmented ciphertext to be valid only if it consists of a
valid (string,tag)-pair. For the sake of self-containment (and concreteness), we will use
a specic implementation of such MACs via pseudorandom functions. Incorporating
this MAC in Construction 5.3.9, we obtain the following:
Construction 5.4.19 (a private-key block-cipher secure against a-posteriori CCA): As
in Construction 5.3.9, let F = {Fn } be an efciently computable function ensemble
and let I be the function-selection algorithm associated with it; i.e., I (1n ) selects a
function f s with distribution Fn . We dene a private-key block-cipher, (G, E, D), with
block-length (n) = n as follows:
Key-generation: G(1n ) = ((k, k ), (k, k )), where k and k are generated by two independent invocations of I (1n ).
Encrypting plaintext x {0, 1}n (using the key (k, k )):
E k,k (x) = ((r, f k (r ) x), f k (r, f k (r ) x)),
where r is uniformly chosen in {0, 1}n .
Decrypting ciphertext (r, y) (using the key (k, k )): Dk, k ((r, y), t) = f k (r ) y if
f k (r, y) = t and Dk,k ((r, y), t) = otherwise.
Proposition 5.4.20: Let F and (G, E, D) be as in Construction 5.4.19, and suppose
that F is pseudorandom with respect to polynomial-size circuits. Then the private-key
encryption scheme (G, E, D) is secure under a posteriori chosen ciphertext attacks.
Proof Sketch: Following the motivation preceding the construction, we emulate any a
posteriori CCA adversary by a CPA adversary. Specically, we need to show how to
answer decryption queries made by the CCA adversary. Let us denote such a generic
query by ((r, y), t), and consider the following three cases:
1. If ((r, y), t) equals the answer given to some (previous) encryption query x, then we
answer the current query with x.
Clearly, the answer we give is always correct.
2. If ((r, y), t) equals the challenge ciphertext, then this query is not allowed.
3. Otherwise, we answer that ((r, y), t) is not a valid ciphertext.
We need to show that our answer is indeed correct. Recall that in this case, ((r, y), t)
neither appeared before as an answer to an encryption query nor equals the challenge ciphertext. Since for every (r, y) there is a unique t such that ((r, y), t ) is
a valid ciphertext, the case hypothesis implies that one of the following sub-cases
37
In fact, we need to use secure Message Authentication Codes that have unique valid tags (or at least are
super-secure), as discussed in Section 6.5.1 (resp., Section 6.5.2).
451
ENCRYPTION SCHEMES
must occur:
Case 1: Some ((r, y), t ), with t = t, has appeared before either as an answer to an
encryption query or as the challenge ciphertext. In this case, ((r, y), t) is denitely
not a valid ciphertext, because ((r, y), t ) is the unique valid ciphertext of the form
((r, y), ).
Case 2: No triple of the form ((r, y), ) has appear before (as such an answer to an
encryption query or as the challenge ciphertext). In this sub-case, the ciphertext
is valid if and only if t = f k (r, y). That is, in order to produce such a valid
ciphertext, the adversary must guess the value of f k at (r, y), when only seeing
the value of f k at other arguments. By the pseudorandomness of the function f k ,
the adversary may succeed in such a guess only with negligible probability, and
hence our answer is wrong only with negligible probability.
Finally, note that the CPA-security of Construction 5.3.9 (see Proposition 5.4.12) implies
the CPA-security of Construction 5.4.19. The proposition follows.
An Alternative Proof of Proposition 5.4.20. Augmenting the proof of Proposition 5.4.18, we (need to) consider here also decryption queries made after the challenge
ciphertext, denoted ((rC , yC ), tC ), is presented. Let us denote such a generic decryption query by ((r, y), t). We consider four cases, ignoring the unlikely case that some
encryption query is answered by a pair of the form ((rC , ), ):
1. If r = rC then the query ((r, y), t) can be treated as in the proof of Proposition 5.4.18,
because it reveals nothing on f k (rC ). Indeed, such a query is not more dangerous
than a query made during an a priori CCA attack.
2. If r = rC and y = yC then, except with negligible probability, the query ((r, y), t) is
not a valid ciphertext, because it is infeasible to guess the value of f k (r, y) (which
is the only value of t such that ((r, y), t ) is valid). Thus, such queries (which are
almost always answered by ) can be ignored.
3. If (r, y) = (rC , yC ) and t = tC then (surely) the query ((r, y), t) is not a valid ciphertext, and can be ignored (as in the previous case).
4. If (r, y, t) = (rC , yC , tC ) then the query ((r, y), t) is not allowed.
The proposition follows.
The same construction and analysis can be applied to Construction 5.3.12. Combining Proposition 5.4.20 with Corollary 3.6.7, we get:
Theorem 5.4.21: If there exist (non-uniformly hard) one-way functions, then there exist
private-key encryption schemes that are secure under a posteriori chosen ciphertext
attacks.
the constructions in order to handle a posteriori CCA. Specically, we will show how
to transform any public-key encryption scheme that is secure in the passive (keydependent) sense into one that is secure under a posteriori CCA. As in the case of privatekey schemes, the idea underlying the transformation is to eliminate the adversarys gain
from chosen ciphertext attacks.
Recall that in the case of private-key schemes, the adversarys gain from a CCA was
eliminated by making it infeasible (for the adversary) to produce legitimate ciphertexts
(other than those explicitly given to it). However, in the context of public-key schemes,
the adversary can easily generate legitimate ciphertexts (by applying the keyed encryption algorithm to any plaintext of its choice). Thus, in the current context, the adversarys
gain from a CCA is eliminated by making it infeasible (for the adversary) to produce
legitimate ciphertexts without knowing the corresponding plaintext. This, in turn,
will be achieved by augmenting the plaintext with a non-interactive zero-knowledge
proof of knowledge of the corresponding plaintext.
r Syntax: Both machines are given the same uniformly selected reference string
r {0, 1}m along with an actual input x {0, 1} such that |x| = poly(m) and
an auxiliary input. Specically, on input r , x and w (supposedly, (x, w) R L ), the
prover P outputs an alleged proof P(x, w, r ); whereas on input r , x and ,
the verier V decides according to V (x, r, ) {0, 1}.
r Completeness: For every (x, w) R L with |x| = poly(m), the probability that V
does not accept the input x (based on the proof P(x, w, Um ) and the reference string
Um ) is negligible; that is, Pr[V (x, Um , P(x, w, Um )) = 1] is negligible. (Typically,
the error probability here is zero, in which case we say that the proof has perfect
completeness.)
453
ENCRYPTION SCHEMES
r Adaptive Soundness: For every : {0, 1}m ({0, 1}poly(m) \ L) and every :
{0, 1}m {0, 1}poly(m) , the probability that V accepts the input (Um ) (based
on the proof (Um ) and the reference string Um ) is negligible; that is,
Pr[V ((Um ), Um , (Um )) = 1] is negligible.
r Adaptive Zero-Knowledge: There exist two probabilistic polynomial-time algorithms, S1 and S2 , such that for every pair of functions : {0, 1}m ({0, 1}poly(m)
L) and W : {0, 1}m {0, 1}poly(m) such that and W are both implementable
by polynomial-size circuits and ((r ), W (r )) R L (r {0, 1}m ), the ensembles
{(Um , (Um ), P((Um ), W (Um ), Um ))}mN and {S (1m )}mN are computationally
indistinguishable (by non-uniform families of polynomial-size circuits), where
S (1m ) denotes the output of the following randomized process:
1.
2.
3.
4.
(r, s) S1 (1m );
x (r );
S2 (x, s);
Output (r, x, ).
Indeed, S is a two-stage simulator that rst produces (obliviously of the actual input)
an alleged reference string r (along with the auxiliary information s),38 and then,
given an actual input (which may depend on r ), simulates the actual proof.
Note that it is important that in the zero-knowledge condition, the function is required
to be implementable by polynomial-size circuits (because otherwise only languages in
BPP can have such proof systems; see Exercise 39). In the rest of this subsection,
whenever we refer to an adaptive NIZK, we mean this denition. Actually, we may
relax the adaptive soundness condition so that it only applies to functions and that
are implementable by polynomial-size circuits. That is, computational soundness will
actually sufce for the rest of this subsection.
Additional Conventions. Note that (analogously to Proposition 5.4.10) in the case
of public-key schemes, the combined chosen plaintext and ciphertext attack (as in
Denitions 5.4.13 and 5.4.14) is equivalent to a pure chosen ciphertext attack. Thus,
in this subsection we consider only attacks of the latter type. Another technical point is
that in our construction we can use any public-key encryption scheme that is secure in
the passive (key-dependent) sense, provided that for all but a negligible measure of the
key-pairs that it generates, there is no decryption error. For simplicity of presentation,
we will assume that the basic encryption scheme has no decryption error at all (i.e., on
all key-pairs).
The General Framework. The following schema (for constructing CCA-secure
public-key encryption schemes) uses a passively secure public-key encryption
38
The auxiliary information s may explicitly contain r . Alternatively, s may just equal the coins used by S1 . In the
constructions that follow, we do not follow either of these conventions, but rather let s equal the very information
about r that S2 needs.
454
scheme, denoted (G, E, D), and an adaptive NIZK, denoted (P, V ), for a related
NP-set.
Construction 5.4.23 (CCA-security construction framework): Let E e (x, s) denote the
ciphertext produced by E when given the encryption-key e, the plaintext x, and the
coins s; that is, E e (x) E e (x, s), where s is selected uniformly among the set of
poly(|e|, |x|)-long bit strings. We use an adaptive NIZK (P, V ) for the language L R
dened by the following NP-relation:
def
Key-generation: G (1n ) = ((e1 , e2 , r ), (d1 , d2 , r )), where (e1 , d1 ) and (e2 , d2 ) are selected at random by invoking G(1n ) twice, and r is uniformly distributed in
{0, 1}n .
Encrypting plaintext x {0, 1} (using the key e = (e1 , e2 , r )):
def
E e (x) = (y1 , y2 , ), where s1 , s2 are uniformly selected poly(n)-long bit strings,
y1 = E e1 (x, s1 ), y2 = E e2 (x, s2 ), and P((e1 , e2 , y1 , y2 ), (x, s1 , s2 ), r ).
Decrypting ciphertext (y1 , y2 , ) (using the key d = (d1 , d2 , r )):
If V ((e1 , e2 , y1 , y2 ), r, ) = 1, then return Dd1 (y1 ) or else return an error symbol
indicating that the ciphertext is not valid.
Indeed, our choice to decrypt according to y1 (in case is a valid proof) is immaterial,
and we could as well decrypt according to y2 . Another alternative could be to decrypt
according to both y1 and y2 and return a result only if both outcomes are identical (and
is a valid proof). We stress that, here as well as in the following analysis, we rely
on the hypothesis that decryption is error-free, which implies that Dd (E e (x)) = x for
every (e, d) in the range of G. Thus, Dd1 (y1 ) = Dd2 (y2 ), for any (e1 , e2 , y1 , y2 ) L R ,
where the (ei , di )s are in the range of G.
Clearly, Construction 5.4.23 constitutes a public-key encryption scheme; that is,
Dd (E e (x)) = x, provided that the NIZK proof generated during the encryption stage
was accepted during the decryption stage. Indeed, if the NIZK system enjoys perfect
completeness (which is typically the case), then the decryption error is zero. By the zeroknowledge property, the passive security of the original encryption scheme (G, E, D)
is preserved by Construction 5.4.23. Intuitively, creating a valid ciphertext seems to
imply knowledge of the corresponding plaintext, but this appealing claim should be
examined with more care (and in fact is not always valid). Furthermore, as stated previously, our actual proof will not refer to the notion of knowledge. Instead, the actual
proof will proceed by showing how a chosen ciphertext attack on Construction 5.4.23
can be transformed into a (key-dependent) passive attack on (G, E, D). In fact, we will
need to augment the notion of (adaptive) NIZK in order to present such a transformation. We will do so in two steps. The rst augmentation will be used to deal with
a priori CCA, and further augmentation will be used to deal with a posteriori CCA.
455
ENCRYPTION SCHEMES
Indeed, prove that the distribution produced by the simulator must be far away from uniform. See related
Exercises 39 and 40.
456
satisfying weak simulation-soundness can be constructed given any adaptive NIZK (for
N P).
Construction 5.4.25 (from adaptive NIZK to weak simulation-soundness): Let (P, V )
be an adaptive NIZK for some language L, and let (S1 , S2 ) be the corresponding twostage simulator. We construct the following adaptive NIZK that works with reference
string ((r10 , r11 ), ..., (rn0 , rn1 )), where ri {0, 1}n .
Prover P : On common input x and auxiliary-input w (s.t., (x, w) R L ), (and reference string ((r10 , r11 ), ..., (rn0 , rn1 ))), uniformly select b1 , ..., bn {0, 1}, compute
def
def
output (r , s), where r = ((r10 , r11 ), ..., (rn0 , rn1 )) and s = (c1 , ..., cn , s1 , ..., sn ).
Simulators second stage S2 : On input (s, x), where s = (c1 , ..., cn , s1 , ..., sn ), compute
i S2 (x, si ) for i = 1, ..., n, and output (c1 , ..., cn , 1 , ..., n ).
It is easy to see that Construction 5.4.25 preserves the adaptive NIZK features of
(P, V, S1 , S2 ). Furthermore, as will be shown, Construction 5.4.25 is weak simulationsound.
Proposition 5.4.26: Construction 5.4.25 is an adaptive NIZK for L, and weak
simulation-soundness holds with respect to the prescribed simulator.
Proof Sketch: Completeness and soundness follow by the corresponding properties
of (P, V ). To see that the simulation is indistinguishable from the real execution of
(P , V ), note that the two probability ensembles differ in two aspects: First, the simulation uses rici s generated by S1 (1n ), whereas in the real execution, the rici s are uniformly
distributed; and second, the simulation uses simulated proofs produced by S2 (x, si ),
rather than real proofs produced by P(x, w, ribi ). Still, the indistinguishability of the
output of the original simulator from the real execution of (P, V ) can be used to prove
that the current ensembles are indistinguishable, too. Specically, we consider a hybrid
distribution in which all rib s are generated by S1 (1n ) but the individual proofs (i.e.,
i s) are produced by P(x, w, ribi ). Using the fact that indistinguishability (by small
circuits) is preserved under repeated sampling, we show that this hybrid ensemble is
indistinguishable from each of the two original ensembles (i.e., the real execution of
(P , V ) and the simulation by (S1 , S2 )).
To establish the weak simulation-soundness property, we consider an arbitrary cheating prover C = (, ) that is implementable by a family of small circuits. We say that
C(r ) = ((r ), (r )) succeeds if it holds that (r ) L and V ((r ), r , (r )) = 1.
We are interested in the probability that C(r ) succeeds when (r , s) S1 (1n ). Recall
457
ENCRYPTION SCHEMES
that s = (c1 , ..., cn , s1 , ..., sn ), where the ci s are selected uniformly in {0, 1}, whereas
(r ) has the form (b1 , ..., bn , 1 , ..., n ). Let us denote the latter sequence of bi s by
B(r ); that is, (r ) = (B(r ), (r )). We distinguish two cases according to whether or
def
not B(r ) = c = (c1 , ..., cn ):
Pr[C(r ) = ((r ), (B(r ), (r ))) succeeds, when (r , s) S1 (1n )]
(5.13)
(5.14)
Eq. (5.13), which corresponds to the rst case, must be negligible because the corresponding probability that refers to a uniformly selected reference string (as appearing
in the real proof) is negligible, and the indistinguishability of a simulated reference
string from a uniformly distributed one was established previously.
Details: For a uniformly distributed reference string r , we have Pr[B(r ) = c] = 2n
Eq. (5.14) must be negligible because in this case, at least one of the alleged proofs (to
a false assertion) is with respect to a uniformly distributed reference string.
Details: By the case hypothesis (i.e., B(r ) = c), there exists an i such that the i-th bit
of B(r ) is different from ci (i.e., bi = ci ). Thus, the i-th alleged proof (i.e., i ) is with
respect to a uniformly distributed reference string, that is, with respect to ribi = ri1ci ,
where ri1ci is selected uniformly in {0, 1}n . By the (adaptive) soundness of (P, V ),
this proof for a false assertion can be valid only with negligible probability, which
in turn implies that Eq. (5.14) is negligible.
Having established that both Eq. (5.13) and Eq. (5.14) are negligible, the proposition
follows.
Using Adaptive NIZKs with Weak Simulation-Soundness. Following the foregoing
motivating discussion, we show that if the adaptive NIZK used in Construction 5.4.23
has the weak simulation-soundness property, then the resulting encryption scheme
(G , E , D ) is secure under a priori CCA.
Theorem 5.4.27: Suppose that the adaptive NIZK (P, V ) used in Construction 5.4.23
has the weak simulation-soundness property and that the public-key encryption scheme
(G, E, D) is passively secure in the key-dependent sense. Further suppose that the
probability that G(1n ) produces a pair (e, d) such that Pr[Dd (E e (x)) = x] < 1, for
some x {0, 1}poly(n) , is negligible. Then Construction 5.4.23 constitutes a public-key
encryption scheme that is secure under a priori CCA.
458
Combining the above with Theorem 4.10.16 and Proposition 5.4.26, it follows that
public-key encryption schemes that are secure under a priori CCA exist, provided that
enhanced40 trapdoor permutations exists.
Proof Sketch: Assuming toward the contradiction that the scheme (G , E , D ) is not
secure under a priori CCA, we show that the scheme (G, E, D) is not secure under
a (key-dependent) passive attack. Specically, we refer to the denitions of security
in the sense of indistinguishability of encryptions (as in Denitions 5.4.14 and 5.4.2,
respectively). To streamline the proof, we reformulate Denition 5.4.2, incorporating
both circuits (i.e., the one selecting message pairs and the one trying to distinguish their
encryptions) into one circuit and allow this circuit to be probabilistic. (Certainly, this
model of a key-dependent passive attack is equivalent to the one in Denition 5.4.2.)
Let (A1 , A2 ) be an a priori CCA adversary attacking the scheme (G , E , D ) (as per
Denition 5.4.14), and (S1 , S2 ) be the two-stage simulator for (P, V ). We construct a
(key-dependent) passive adversary A (attacking (G, E, D)) that, given an encryptionkey e (in the range of G 1 (1n )), behaves as follows:
1. Initialization: A generates (e1 , d1 ) G(1n ), (r, s) S1 (n), and sets e = (e1 , e, r ).
def
(We assume that (e, d) G(1n ), and let (e2 , d2 ) = (e, d), so e = (e1 , e2 , r ).)
Dd
2. Emulation of A1 (e): A invokes A1 on input e, and answers its (decryption) queries
as follows. When asked to decrypt the alleged ciphertext (q1 , q2 , q3 ), adversary A
checks if q3 is a valid proof of consistency of q1 and q2 (with respect to the reference
string r ). If the proof is valid, then A answers with Dd1 (q1 ) or else A returns the
error symbol.
(Note that the emulation of the oracle Dd by A is perfect, although A only knows
part of the corresponding decryption-key d. Also note that A emulates A1 on an
input and oracle access that are computationally indistringuishable from the input
and oracle access given to A1 in a real attack.)
3. Using A2 for the nal decision: Let ((x (1) , x (2) ), ) denote the challenge template output by A1 . Then, A outputs (x (1) , x (2) ) as its own challenge pair. Next, given a ciphertext y = E e (x), where x {x (1) , x (2) }, adversary A forms a corresponding (almost
(1)
certainly illegal) ciphertext under E , denoted (y1 , y, ), by letting y1 E e1 (0|x | )
and S2 (s, (e1 , e, y1 , y)). Finally, A invokes A2 on input (, (y1 , y, )), and outputs whatever the latter does. Recall that here (in the case of a priori CCA), A2 is an
ordinary machine (rather than an oracle machine).
(Note that A emulates A2 on an input that is computationally indistringuishable from
the input given to A2 in a real attack. In particular, A typically invokes A2 with an
illegal ciphertext, whereas in a real attack, A2 is always given a legal ciphertext.)
In order to analyze the performance of A, we introduce the following hybrid process,
denoted H , as a mental experiment. The hybrid process behaves as A, with the only
exception that (in Step 3) y1 E e1 (x) (rather than y1 E e1 (0|x| )). Thus, unlike A,
40
459
ENCRYPTION SCHEMES
the hybrid process invokes A2 with a legal ciphertext. (The question of how the hybrid
process knows or gets this y1 is out of place; we merely dene a mental experiment.)
( j)
( j)
( j)
( j)
Let p A = p A (n) (resp., p H = p H (n)) denote the probability that A (resp., the hybrid
( j)
process H ) outputs 1 when x = x , where the probability is taken over the choices of
(e, d) G(1n ) and the internal coin tosses of A (resp., H ).
( j)
( j)
Claim 5.4.27.1: For both js, the absolute difference between p A (n) and p H (n) is a
negligible function in n.
Proof: Dene an auxiliary hybrid process that behaves as the hybrid process, except
that when emulating Dd , the auxiliary process answers according to Dd2 (rather than
( j)
according to Dd1 ). (Again, this is a mental experiment.) Let p H H denote the probability
( j)
that this auxiliary process outputs 1 when x = x . Similarly, dene another mental
experiment that behaves as A, except that when emulating Dd , this process answers
( j)
according to Dd2 (rather than according to Dd1 ), and let p A A denote the probability that
( j)
the latter process outputs 1 when x = x . We stress that in Step 3, the latter mental
experiment behaves exactly like A; the only aspect in which this mental experiment
differs from A is in its decryption operations at Step 2. The various processes are
tabulated next.
answers
dec-queries
by using Dd1
the challenge
ciphertext for A
(E e1 (0|x| ), E e (x), )
H
HH
AA
by using Dd1
by using Dd2
by using Dd2
(E e1 (x), E e (x), )
(E e1 (x), E e (x), )
(E e1 (0|x| ), E e (x), )
nature of process
a real (passive) attack
on (G, E, D) (w.r.t. key e)
a mental experiment
a mental experiment
a mental experiment
( j)
Fact 1. For both js, the absolute difference between p H and p H H is negligible.
The reason is that the two processes differ only in the way they answer the decryption
queries: In the rst process the decryption is according to Dd1 , and in the second
it is according to Dd2 . However, by weak simulation-soundness, it is infeasible to
produce triples (q1 , q2 , q3 ) such that (e1 , e, q1 , q2 ) L R and yet q3 is a valid proof
(with respect to r , for the false assertion that (e1 , e, q1 , q2 ) is in L R ). Thus, except
with negligible probability, either Dd1 (q1 ) = Dd2 (q2 ) or q3 is not valid, and so it does
not matter whether one decrypts according to Dd1 or to Dd2 .41
( j)
( j)
Fact 2. Similarly, for both js, the absolute difference between p A and p A A is
negligible.
( j)
( j)
Fact 3. Finally, for both js, the absolute difference between p H H and p A A is negligible.
41
Here, we rely on the hypothesis that except with negligible probability over the key-generation process, the
decryption is error-less (i.e., always yields the original plaintext).
460
The reason is that the experiments A A and H H differ only in the input (, (y1 , y, )) that they feed to A2 ; whereas A A forms y1 E e1 (0|x| )
(and S2 (s, (e1 , e, y1 , y))), the process H H forms y1 E e1 (x) (and
S2 (s, (e1 , e, y1 , y))). However, A2 cannot distinguish the two cases because this
would have violated the security of E e1 .
That is, to establish Fact 3, we construct a passive attack, denoted B, that behaves
similarly to A except that it switches its reference to the two basic keys (i.e., the
rst two components of the encryption-key e) and acts very differently in Step 3
(e.g., B produces a different challenge template). Specically, given an attacked
encryption-key e, adversary B generates (e2 , d2 ) G(1n ), sets e = (e, e2 , ), and
emulates A1 Dd (e) using the decryption-key d2 to answer queries. For a xed j, when
obtaining (from A1 ) the challenge template ((x (1) , x (2) ), ), adversary B produces the
( j)
challenge template ((0|x | , x ( j) ), ), and invokes A2 on input (, (y, y2 , )), where
( j)
y = E e (x) (x {0|x | , x ( j) }) is the challenge ciphertext given to B, and B computes
y2 E e2 (x ( j) ) and S2 (s, (e, e2 , y, y2 )). (Finally, B outputs the output obtained
from A2 .) Note that when given the challenge ciphertext E e (x ( j) ), the adversary
B effectively behaves as experiment H H (for the same j), whereas when given
( j)
( j)
E e (0|x | ), it effectively behaves as experiment A A (for the same j). Thus, if p H H
( j)
and p A A differ in a non-negligible manner, then B violates the passive security of
the encryption scheme (G, E, D).
Combining these three facts, the current claim follows.
Let us denote by pcca (n) the probability that the CCA adversary ( A1 , A2 ) outputs 1
when given a ciphertext corresponding to the j th plaintext in its challenge template (see
(1)
(2)
Denitions 5.4.14). Recall that by the contradiction hypothesis, | pcca (n) pcca (n)| is
not negligible.
( j)
( j)
( j)
Claim 5.4.27.2: For both js, the absolute difference between pcca (n) and p H (n) is a
negligible function in n.
Proof: The only difference between the output in a real attack of ( A1 , A2 ) and the output
of the hybrid process is that in the hybrid process, a simulated reference string and
a simulated proof are used instead of a uniformly distributed reference string and a
real NIZK proof. However, this difference is indistinguishable.42
Combining Claims 5.4.27.1 and 5.4.27.2, we obtain that for some negligible function
it holds that
(1)
(2)
(1)
(2)
(2)
We stress that the current claim relies only on the fact that the simulated reference-string and proof are indistinguishable from the corresponding real objects.
461
ENCRYPTION SCHEMES
(for A1 ). Next, we analyze this passive adversary as in the proof of Theorem 5.4.27,
while referring to an A2 that may make decryption queries.43 The analysis of the handling of these (additional) queries relies on the 1-proof simulation-soundness property.
In particular, when proving a claim analogous to Claim 5.4.27.1, we have to establish
two facts (corresponding to Facts 1 and 2) that refer to the difference in the processs
output when decrypting according to Dd1 and Dd2 , respectively. Both facts follow from
the fact (established next) that, except with negligible probability, neither A1 nor A2 can
produce a query (q1 , q2 , q3 ) such that q3 is a valid proof that q1 and q2 are consistent
and yet Dd1 (q1 ) = Dd2 (q2 ). (We stress that in the current context we refer also to
A2 , which may try to produce such a query based on the challenge ciphertext given
to it.)
Fact 5.4.29.1: The probability that A1 produces a query (q1 , q2 , q3 ) such that q3 is a
valid proof (with respect to reference string r ) that (supposedly) there exists x, s1 , s2
such that qi = E ei (x, si ) (for i = 1, 2), and yet Dd1 (q1 ) = Dd2 (q2 ) is negligible. The
same holds for A2 so long as the query is different from the challenge ciphertext given
to it. This holds regardless of whether the challenge ciphertext (given to A2 ) is produced
as in A (i.e., y1 = E e1 (0m )) or as in the hybrid process H (i.e., y1 = E e1 (x)).
Proof: Recall that one of our hypotheses is that the encryption (G, E, D) is error-free
(except for a negligible measure of the key-pairs). Thus, the current fact refers to a
situation that either A1 or A2 produces a valid proof for a false statement. The rst part
(i.e., referring to A1 ) follows from the weak simulation-soundness of the NIZK, which
in turn follows from its 1-proof simulation-soundness property. We focus on the second
part, which refers to A2 .
Let (y1 , y2 , ) denote the challenge ciphertext given to A2 ; that is, y2 = y is the
challenge ciphertext given to A(e) (or to H (e)), which augments it with y1 and
S2 (s, (e1 , e2 , y1 , y2 )). Recall that (r, s) S1 (1n ) and that e2 = e. Suppose that
A2 produces a query (q1 , q2 , q3 ) as in the claim; that is, (q1 , q2 , q3 ) = (y1 , y2 , ), the
encryptions q1 and q2 are not consistent (with respect to e1 and e2 , respectively), and
def
yet V ((e1 , e2 , q1 , q2 ), r, q3 ) = 1. Specically, it holds that x 2 = (e1 , e2 , q1 , q2 ) L R ,
where L R is as in Construction 5.4.23 (see Eq. (5.12)), and yet V (x 2 , r, q3 ) = 1 (i.e.,
def
2 = q3 is a valid proof of the false statement regarding x 2 ). Since (y1 , y2 , ) is
def
produced by letting S2 (s, (e1 , e2 , y1 , y2 )), it follows that 1 = is a simulated proof (with respect to the reference string r ) for the alleged membership of
def
x 1 = (e1 , e2 , y1 , y2 ) in L R , where (r, s) S1 (1n ). Furthermore, given such a proof
(along with the reference string r ), A2 produces a query (q1 , q2 , q3 ) that yields a pair
(x 2 , 2 ), where 2 = q3 , such that x 2 = (e1 , e2 , q1 , q2 ) L R and yet V (x 2 , r, 2 ) = 1
and (x 2 , 2 ) = (x 1 , 1 ). Thus, using A1 and A2 (along with (G, E, D)), we obtain circuits 1 , 2 , 2 that violate the hypothesis that (S1 , S2 ) is 1-proof simulation-sound.
Details: On input a (simulated) reference string r , the circuit 1 selects (e1 , d1 )
and (e2 , d2 ) in the range of G(1n ), and emulates the execution of A1 Dd (e), where
e = (e1 , e2 , r ) and d = (d1 , d2 , r ). (Indeed, we x the best possible choice of
43
Indeed, in the proof of Theorem 5.4.27, where ( A1 , A2 ) is an a priori CCA, A2 makes no such queries.
463
ENCRYPTION SCHEMES
(e1 , d1 ) and (e2 , d2 ), rather than selecting both at random, and emulate the oracle Dd using d that is known to the circuit.) When A1 outputs a challenge
template, 1 emulates the selection of the challenge x, sets y1 E e1 (0|x| ) (or
y1 E e1 (x) when we argue about the hybrid process H ), y2 E e2 (x), and outdef
puts x 1 = (e1 , e2 , y1 , y2 ). (Again, we may x the best choice of x 1 , y1 , and y2 ,
rather than generating them at random.) The challenge ciphertext is formed by
augmenting y1 , y2 with 1 S2 (s, x 1 ), where s is the auxiliary information generated by S(1n ) (i.e., (r, s) S(1n )). Next, we describe the circuits 2 and 2 ,
which obtain x 1 = (e1 , e2 , y1 , y2 ) (as produced by 1 ) along with a simulated proof
1 = S2 (s, x 1 ). On input a reference string r and x 1 , 1 (as just discussed), these
circuits emulate A2 Dd (, (y1 , y2 , 1 )), where is the state information generated
by A1 . For some i (xed as the best choice), we consider the i-th decryption query
made during the emulation (i.e., we emulate the answers to previous queries by
emulating Dd ). Denoting this (i.e., i-th) query by (q1 , q2 , q3 ), the circuit 2 outdef
def
puts x 2 = (e1 , e2 , q1 , q2 ) and 2 outputs 2 = q3 . Since (q1 , q2 , q3 ) = (y1 , y2 , 1 ),
it follows that (x 2 , 2 ) = ((e1 , e2 , q1 , q2 ), 2 ) = ((e1 , e2 , y1 , y2 ), 1 ) = (x 1 , 1 ).
The event stated in the claim refers to the case that x 2 L R and yet 2 is accepted as a proof (with respect to the reference string r ). But this event and the
current process are exactly as in the denition of 1-proof simulation soundness. We
stress that the argument applies to the process dened by the actual attack, as well
as to the process dened by the hybrid H . In the rst case x 1 L R , whereas in the
second case x 1 L R , but 1-proof simulation soundness applies to both cases.
It follows that a query (q1 , q2 , q3 ) as in the claim can be produced only with negligible
probability.
Fact 5.4.29.1 implies (an adequate extension of) the rst two facts in the proof of a
claim analogous to Claim 5.4.27.1. The third fact in that proof, as well as the proof of
the analogue of Claim 5.4.27.2, do not refer to the soundness of the NIZK-proofs, and
are established here exactly as in the proof of Theorem 5.4.27. The current theorem
follows.
Constructing Adaptive NIZK with 1-Proof Simulation-Soundness Property. We
construct the desired NIZK by using a standard (adaptive) NIZK proof, a weak form
of a signature scheme, and a specic commitment scheme. Since all ingredients can be
implemented using enhanced trapdoor permutations (see Denition C.1.1 in Appendix
C), we obtain:
Theorem 5.4.30: If there exist collections of (non-uniformly hard) enhanced trapdoor permutations, then every language in N P has an adaptive NIZK with 1-proof
simulation-soundness property.
Proof Sketch: Let L N P. We construct a suitable NIZK for L using the following
three ingredients:
1. An adaptive Non-Interactive Witness-Indistinguishable (NIWI ) proof, denoted
(P WI , V WI ), for a suitable language in N P. We stress that we mean a proof system
464
that operates with a reference string of length n and can be applied to prove (adaptively chosen) statements of length poly(n), where the adaptivity refers both to the
soundness and witness-indistinguishability requirements.
As shown in Section 4.10.3.2,44 the existence of enhanced trapdoor permutations
implies that every language in N P has an adaptive NIZK that operates with a
reference string of length n and can be applied to prove statements of length poly(n).
Indeed, in analogy to discussions in Section 4.6, any NIZK is a NIWI.
2. A super-secure one-time signature scheme, denoted (G OT , S OT , V OT ). Specically,
one-time security (see Section 6.4.1) means that we consider only attacks in which
the adversary may obtain a signature to a single document of its choice (rather
than signatures to polynomially many documents of its choice). On the other hand,
super-security (see Section 6.5.2) means that the adversary should fail to produce a
valid document-signature that is different from the query-answer pair that appeared
in the attack. (We stress that unlike in ordinary security, the adversary is deemed
successful even if it produces a different signature to the same document for which
it has obtained a signature during the attack.)
By Theorem 6.5.2, super-secure one-time signature schemes can be constructed
on the basis of any one-way function. (If we were willing to assume the existence
of collision-free hashing functions, then we could have used instead the easier-toestablish Theorem 6.5.1.)
3. A perfectly-binding commitment scheme, denoted C, as dened in Section 4.4.1,
with the following two additional properties: The rst additional property is that
the commitment strings are pseudorandom; that is, the ensembles {C(x)}x{0,1} and
{U|C(x)| }x{0,1} are computationally indistinguishable. The second property is that
the support of C(Un ) is a negligible portion of {0, 1}|C(Un )| .
Using any collection of one-way permutations (e.g., the one in the hypothesis),
we may obtain the desired commitment scheme. Specically, Construction 4.4.2
constitutes a commitment scheme that satises the pseudorandomness property (but
not the negligible portion property). To obtain the additional negligible portion
property, we merely let C(x) equal a pair of two independent commitments to x
(and it follows that the support of C(Un ) is at most a 2n (2n )2 = 2n fraction of
{0, 1}|C(Un )| ).45 We denote by C(x, r ) the commitment to value x produced using
coins r ; that is, C(x) = C(x, r ), where r is uniformly chosen in {0, 1}(|x|) , for some
polynomial .
Given these ingredients, we construct an adaptive (1-proof simulation-sound) NIZK
for L (with witness relation R) as follows. The NIZK proof uses a reference string of
def
def
the form r = (r1 , r2 ), where n = |r2 | and m = |r1 | = poly(n). (The length of r1 is set
to equal the length of C(v), where (s, v) G OT (1n ).)
44
45
See Theorem 4.10.16 and comment following it, as well as Sections C.1 and C.4 in Appendix C.
This presupposes that in the original commitment scheme, the support of C(x) is at most a 2|x| fraction
of {0, 1}|C(x)|, which does hold for Construction 4.4.2. An alternative construction of a commitment scheme
satisfying both additional properties can be obtained using any one-way function. Specically, Construction 4.4.4
will do, except that it uses two messages. However, since the rst message (i.e., sent by the receiver) is a random
string, we may incorporate it in the reference string (of the NIZK scheme presented next).
465
ENCRYPTION SCHEMES
1. Generates a key-pair for the one-time signature scheme; that is, (s, v) G OT (1n ).
2. Computes a pre-proof p P WI ((x, r1 , v), w, r2 ), where (P WI , V WI ) is a proof
system (using r2 as reference string) for the following NP-language L :
L = {(x, y, v) : (x L) (w y = C(v, w ))}
def
(5.15)
(5.16)
Note that P indeed feeds P WI with an adequate NP-witness (i.e., ((x, r1 , v), w)
R since (x, w) R). The rst part of the reference string of P is part of the
statement fed to P WI , whereas the second part of Ps reference string
serves as a reference string for P WI . The behavior of V (with respect
to V WI ) will be analogous.
3. The prover computes a signature to (x, p) relative to the signing-key s (generated
in Step 1). That is, P computes SsOT (x, p).
The prover outputs the triplet (v, p, ).
Verier V : On common input x and an alleged proof (v, p, ) (and reference string
r = (r1 , r2 )), the verier accepts if and only if the following two conditions hold:
1. is a valid signature, with respect to the verication-key v, of the pair (x, p).
That is, VvOT ((x, p), ) = 1.
2. p is a valid proof, with respect to the reference string r2 , of the statement
(x, r1 , v) L . That is, V WI ((x, r1 , v), r2 , p) = 1.
Simulators rst stage S1 : On input 1m+n (from which S1 determines n and m), the
rst stage produces a reference string and auxiliary information as follows:
1. Like the real prover, S1 (1m+n ) starts by generating a key-pair for the one-time
signature scheme; that is, (s, v) G OT (1n ).
2. Unlike in the real setting, S1 (1m+n ) selects s1 uniformly in {0, 1}(|v|) , and sets r1 =
C(v, s1 ). (Note that in the real setting, r1 is uniformly distributed independently
of v, and thus in the real setting, r1 is unlikely to be in the support of C, let alone
in that of C(v).)
3. Like in the real setting, S1 (1m+n ) selects r2 uniformly in {0, 1}n .
S1 (1m+n ) outputs the pair (r , s), where r = (r1 , r2 ) is a simulated reference string
and s = (v, s, s1 , r2 ) is auxiliary information to be passed to S2 .
Simulators second stage S2 : On input a statement x and auxiliary input s =
(v, s, s1 , r2 ) (as generated by S1 ), S2 proceeds as follows:
466
able from the one produced by P. That is, the ensembles {S (1m+n )} and R , W =
{(Um+n , (Um+n ), P((Um+n ), W (Um+n ), Um+n ))} are computationally indistinguishable, where S is dened as in Denition 5.4.22.
Proof: Consider a hybrid distribution H (1m+n ), in which everything except the preproof is produced as by S (1m+n ), and the pre-proof is computed as by the real prover.
That is, (r , s) S1 (1m+n ) (where r = (r1 , r2 ) and s = (v, s, s1 , r2 )) is produced as by
S , but then for (x, w) = ((r ), W (r )), the pre-proof is computed using the witness
w; that is, p P WI ((x, r1 , v), w, r2 ), rather than p P WI ((x, r1 , v), s1 , r2 ). The nal
proof = (v, p, ) is obtained (as in both cases) by letting SsOT (x, p). We now
relate the hybrid ensemble to each of the two ensembles referred to in the claim.
467
ENCRYPTION SCHEMES
2
(x L) ((x 2 , 2 ) = (x 1 , 1 ))
2
2
2
(5.17)
= Pr (VvOT
2 ((x , p ), ) = 1)
WI
2
2
2
(V ((x , r1 , v ), r2 , p ) = 1)
where the equality is due to the denition of V . We consider two cases (in which the
event in Eq. (5.17) may hold):
v2 = v 1 : In this case, either (x 2 , p2 ) = (x 1 , p 1 ) or 2 = 1 must hold (because otherwise (x 2 , 2 ) = (x 2 , (v 2 , p2 , 2 )) = (x 1 , (v 1 , p 1 , 1 )) = (x 1 , 1 ) follows). But this
means that (2 , 2 ), given a single valid signature 1 (to the document (x 1 , p 1 )) with
respect to a randomly generated verication-key v = v 1 = v 2 , is able to produce a
valid document-signature pair ((x 2 , p 2 ), 2 ) (with respect to the same vericationkey) such that ((x 2 , p 2 ), 2 ) = ((x 1 , p1 ), 1 ), in contradiction to the super-security
of the one-time signature scheme.
Details: It sufces to upper-bound
Pr
(v 2 = v 1 ) ((x 2 , 2 ) = (x 1 , 1 ))
2
2
2
(VvOT
2 ((x , p ), ) = 1)
(5.18)
As explained in the previous paragraph, the rst two conditions in Eq. (5.18)
imply that ((x 2 , p2 ), 2 ) = ((x 1 , p1 ), 1 ). Using (S1 , S2 ) and (1 , 2 , 2 ), we
derive an attacker, A, that violates the super-security of the (one-time) signature scheme. The attacker just emulates the process described in the claims
hypothesis, except that it obtains v as input (rather than generating the pair (s, v)
468
by invoking G OT ) and uses oracle access to SsOT (rather than s itself ) in order
to produce the signature 1 . Specically, on input v, the attacker A rst selects s1 {0, 1} and r2 {0, 1}n uniformly, sets r1 = C(v, s1 ) and r = (r1 , r2 ),
and obtains x 1 1 (r ). Next, A computes p 1 P WI ((x 1 , r1 , v), s1 , r2 ) and
queries SsOT on (x 1 , p1 ), obtaining the answer 1 SsOT (x 1 , p1 ) and setting
1 = (v, p 1 , 1 ). (Indeed, 1 so produced is distributed exactly as S2 (s, x 1 ),
where s = (v, s, s1 , r2 ), although A does not know s; the argument relies on
the fact that S2 (s, x 1 ) can be implemented without knowledge of s and while
making a single query to the signing oracle SsOT .) Finally, A sets (x 2 , 2 )
(2 (r , 1 ), 2 (r , 1 )), and outputs ((x 2 , p2 ), 2 ), where 2 = (v 2 , p2 , 2 ).
Note that A queries its signing oracle only once. (Recall that A queries SsOT
on (x 1 , p1 ), obtains the answer 1 , and produces the output pair ((x 2 , p2 ), 2 ).)
On the other hand, the probability that A produces a valid document-signature
pair (with respect to the verication-key v) that is different from the (single)
query-answer pair it makes equals Eq. (5.18). Thus, the super-security of the
one-time signature scheme implies that Eq. (5.18) is negligible.
v2 =
v 1 : Since r1 = C(v 1 , s1 ), it follows (by the perfect binding property of C) that r1
is not in the support of C(v 2 ) (i.e., for every w , r1 = C(v 2 , w )). Thus, if x 2 L, then
(x 2 , r1 , v 2 ) L . Now, by the adaptive soundness of (P WI , V WI ) and the fact that r2
was selected uniformly in {0, 1}n , it follows that, except with negligible probability,
p2 is not a valid proof (with respect to the reference string r2 ) of the false statement
(x 2 , r1 , v 2 ) L .
Details: It sufces to upper-bound
Pr
(v 2 = v 1 ) (x 2 L)
(V WI ((x 2 , r1 , v 2 ), r2 , p2 ) = 1)
(5.19)
As explained in the previous paragraph, the rst two conditions in Eq. (5.19)
imply (x 2 , r1 , v 2 ) L . The key observation is that r2 (generated by S1 ) is uniformly distributed in {0, 1}n , and thus the adaptive soundness of the NIWI system
applies. We conclude that Eq. (5.19) is upper-bounded by the (negligible) soundness error of the NIWI system, and the claim follows also in this case.
ENCRYPTION SCHEMES
5.4.5.1. Denitions
For the sake of brevity, we present only a couple of denitions. Specically, focusing
on the public-key model, we consider only the simplest and strongest types of attacks;
that is, we rst consider (key-oblivious) passive attacks, and then we turn to chosen
ciphertext attacks. The denitions refer to an adversary that is given a ciphertext and
tries to generate a (different) ciphertext to a plaintext related to the original one. That
is, given E e (x), the adversary tries to output E e (y) such that (x, y) R with respect to
46
Note that considering a randomized process applied to the plaintext does not make the denition stronger.
470
(x, y) R where
Pr
|x|
(x, y) R where
+ 1
< Pr
x Xn
p(n)
y A (1n , 1|x| , h(x))
We stress that the denition effectively prevents the adversary A from just outputting
the ciphertext given to it (because in this case, its output is treated as if it were E e (0|x| )).
This provision is important because otherwise no encryption scheme could have satised the denition (see Exercise 42). A more subtle issue, which was hand-waved in the
denition, is how to handle the case in which A produces an illegal ciphertext (i.e., is
y dened in such a case to be a standard string [e.g., 1|d| ] or a special error symbol).49
The rest of our text holds under both conventions. Note that A can certainly produce
plaintexts, but its information regarding X n is restricted to h(X n ) (and 1|X n | ). Thus, if
when given h(X n ) and 1|X n | it is infeasible to generate y such that (X n , y) R, then A
as in Denition 5.4.32 may produce such a y only with negligible probability. Consequently, Denition 5.4.32 implies that in this case, given E e (X n ) (and e, h(X n ), 1|X n | ),
it is infeasible to produce E e (y) such that (X n , y) R.
47
The computational restriction on R is essential here; see Exercise 16, which refers to a related denition of
semantic security.
48 Potentially, this can only make the denition stronger, because the ability to produce plaintexts implies the
ability to produce corresponding ciphertexts (with respect to a given or a randomly chosen encryption-key).
49 It is interesting to note that in the case of passive attacks, the two possible conventions seem to yield nonequivalent denitions. The issue is whether the adversary can correlate the generation of an illegal ciphertext
to the encrypted plaintext handed to it. The question of whether this issue is important or not seems to depend
on the type of application. (In contrust, in the case of a posteriori CCA, the two conventions yield equivalent
denitions, because without loss of generality, the attacker may check whether the ciphertext produced by it is
legal.)
471
ENCRYPTION SCHEMES
Denition 5.4.32 cannot be satised by encryption schemes in which one can modify
bits in the ciphertext without changing the corresponding plaintext (i.e., consider the
identity relation). We stress that such encryption schemes may be semantically secure
under passive attacks (e.g., given a semantically secure encryption scheme (G, E, D),
consider E e (x) = E e (x) , for randomly chosen {0, 1}). However, such encryption
schemes may not be (semantically) secure under a posteriori CCA.
Turning to the denition of non-malleability under chosen ciphertext attacks, we
adopt the denitional framework of Section 5.4.4.1. Specically, analogous to Denition 5.4.13, the challenge template produced by A1 (and A1 ) is a triplet of circuits representing a distribution S (represented by a sampling circuit), a function h (represented
by an evaluation circuit), and a relation R (represented by a membership recognition
circuit). The goal of A2 (and A2 ) will be to produce a ciphertext of a plaintext that is
R-related to the challenge plaintext S(Upoly(n) ).
Denition 5.4.33 (non-malleability under chosen ciphertext attacks): A public-key encryption scheme is said to be non-malleable under a priori chosen ciphertext attacks
if for every pair of probabilistic polynomial-time oracle machines, A1 and A2 , there
exists a pair of probabilistic polynomial-time algorithms, A1 and A2 , such that the
following two conditions hold:
1. For every positive polynomial p and all sufciently large n and z {0, 1}poly(n) :
(x, y) R where
(e, d) G(1n )
E e , Dd
(e, z)
((S, h, R), ) A1
Pr
c A Ee (, c, v)
2
(x, y) R where
x S(Upoly(n) )
|x|
y A2 (, 1 , h(x))
2. For every n and z, the rst element (i.e., the (S, h, R) part) in the random variables
E G (1n )
A1 (1n , z) and A1 1 (G 1 (1n ), z) are identically distributed.
Non-malleability under a posteriori chosen ciphertext attacks is dened analogously,
except that A2 is given oracle access to both E e and Dd , with the restriction that when
given the challenge (c, v), machine A2 is not allowed to make the query c to the
oracle Dd .
We comment that the denitional treatment can be extended to multiple-message nonmalleability, but we refrain from doing so here.50
50
We warn that even in the case of public-key schemes, (single-message) non-malleability (under some type of
attacks) does not necessarily imply the corresponding notion of multiple-message non-malleability.
472
In order to avoid certain objections, we refrain from using the simpler relation R = {(x, x) : x {0, 1} }.
473
ENCRYPTION SCHEMES
B = (B1 , B2 ) that emulates A (while using its own oracles) and produces its own
output by querying its own decryption oracle on the ciphertext output by A, which is
assumed (without loss of generality) to be different from the challenge ciphertext given
to A. The key point is that B can make this extra query because it is an a posteriori
CCA adversary, and thus the difference between outputting a ciphertext and outputting
the corresponding plaintext disappears. Intuitively, B violates semantic security (with
respect to relations and a posteriori CCA, as can be dened analogously to Exercise 16).
Details follow.
Given an encryption-key e, algorithm B1 invokes A1 (e), while answering A1 s queries
by querying its own oracles, and obtains the challenge template (S, h, R) (and state ),
which it outputs as its own challenge template. Algorithm B2 is given a ciphertext
c (along with the adequate auxiliary information) and invokes A2 on the very same
input, while answering A2 s queries by querying its own oracles. When A2 halts with
output c = c, algorithm B2 forwards c to its decryption oracle and outputs the answer.
Thus, for every relation R, the plaintext output by B hits the relation R with the
same probability that the decryption of As output hits R. We have to show that this
hitting probability cannot be met by a corresponding benign algorithm that does not
get the ciphertext; but this follows from the hypothesis regarding A (and the fact that
in both cases, the corresponding benign algorithm [i.e., A or B ] outputs a plaintext
[rather than a ciphertext]). Finally, we have to establish, analogously to Exercise 16,
that semantic security with respect to relations holds (in our current context of chosen
ciphertext attacks) if and only if semantic security (with respect to functions) holds.
The latter claim follows as in Exercise 16 by relying on the fact that in the current
context, the relevant relations have polynomial-size circuits. (A similar argument holds
for private-key schemes.)
Conclusion. Combining Theorem 5.4.31 and Proposition 5.4.35 we get:
Theorem 5.4.36: If there exist collections of (non-uniformly hard) enhanced trapdoor
permutations, then there exist public-key encryption schemes that are non-malleable
under a posteriori chosen ciphertext attacks.
Analogously, using Theorem 5.4.21, we get:
Theorem 5.4.37: If there exist (non-uniformly hard) one-way functions, then there
exist private-key encryption schemes that are non-malleable under a posteriori chosen
ciphertext attacks.
5.5. Miscellaneous
5.5.1. On Using Encryption Schemes
Once dened and constructed, encryption schemes may be (and actually are) used as
building blocks toward various goals that are different from the original motivation.
474
5.5 MISCELLANEOUS
One reason not to use the public-key encryption scheme itself for the actual (encrypted) communication is that
private-key encryption schemes tend to be much faster.
475
ENCRYPTION SCHEMES
the (pseudorandom function-based) encryption scheme of Construction 5.3.9 for a couple of reasons. First, applying an on-line pseudorandom generator is likely to be more
efcient than applying a pseudorandom function. Second, for an -bit long counter (or
random value), Construction 5.3.3 allows for securely encrypting
2 messages (or bits),
whereas Construction 5.3.9 denitely becomes insecure when 2 messages (or bits)
are encrypted. For small values of (e.g., = 64), this difference is crucial.
Using Public-Key Schemes: Public-Key Infrastructure. As in the case of privatekey schemes, an important distinction refers to the question of whether the insecure
communication channel between the legitimate parties is tapped by a passive adversary
or may even be subject to active attacks. In typical applications of public-key encryption
schemes, the parties communicate through a communication network (and not via a
point-to-point channel), in which case active attacks are very realistic (e.g., it is easy to
send mail over the Internet pretending to be somebody else). Thus, the standard use of
public-key encryption schemes in real-life communication requires a mechanism for
providing the sender with the receivers authentic encryption-key (rather than trusting an
unauthenticated incoming message to specify an encryption-key). In small systems,
one may assume that each user holds a local record of the encryption-keys of all
other users. However, this is not realistic in large-scale systems, and so the sender
must obtain the relevant encryption-key on the y in a reliable way (i.e., typically,
certied by some trusted authority). In most theoretical work, one assumes that the
encryption-keys are posted and can be retrieved from a public-le that is maintained
by a trusted party (which makes sure that each user can post only encryption-keys
bearing its own identity). Alternatively, such a trusted party may provide each user with
a (signed) certicate stating the authenticity of the users encryption-key. In practice,
maintaining such a public-le (and/or handling such certicates) is a major problem, and
mechanisms that implement this abstraction are typically referred to by the generic term
public-key infrastructure (PKI). For a discussion of the practical problems regarding
PKI deployment see, e.g., [149, Chap. 13].
5.5 MISCELLANEOUS
which can be used to securely communicate an a priori bounded number of bits. Furthermore, multiple messages may be handled provided that their total length is a priori
bounded and that we use a state (as in Construction 5.3.3). We stress that this state-based
private-key perfectly secure encryption scheme uses a key of length equal to the total
length of plaintexts to be encrypted. Indeed, the key must be at least that long (to allow
perfect-security), and a state is essential for allowing several plaintexts to be securely
encrypted.
Partial Information Models. Note that in the case of private-key encryption schemes,
the limitations of perfect-security hold only if the adversary has full information of the
communication over the channel. On the other hand, perfectly secure private channels
can be implemented on top of channels to which the adversary has limited access.
We mention three types of channels of the latter type, which have received a lot of
attention.
r The bounded-storage model, where the adversary can freely tap the communication
channel(s) but is restricted in the amount of data it can store (cf., [148, 48, 187]).53
r The noisy channel model (which generalizes the wiretap channel of [189]), where
both the communication between the legitimate parties and the tapping channel of
the adversary are subjected to noise (cf., [148, 69] and the references therein).
r Quantum channels, where an adversary is (supposedly) prevented from obtaining
full information by the (currently believed) laws of quantum mechanics (cf., [45]
and the references therein).
Following are the authors subjective opinions regarding these models (as a possible
basis for actual secure communication). The bounded-storage model is very appealing,
because it clearly states its reasonable assumptions regarding the abilities of the adversary. In contrast, making absolute assumptions about the noise level at any point in
time seems (overly) optimistic, and thus not adequate in the context of cryptography.
Basing cryptography on quantum mechanics sounds like a very appealing idea, but attempts to implement this idea have often stumbled over unjustied hidden assumptions
(which are to be expected, given the confusing nature of quantum mechanics and the
discrepancy between its scientic culture and cryptography).
Typically, this model postulates the existence of an auxiliary (uni-directional) public channel on which a trusted
party (called a beacon) transmits a huge amount of random bits.
54 Typically, these schemes are not (semantically) secure. Furthermore, these proposals fail to suggest a weaker
denition of security that is supposedly satised by the proposed schemes.
477
ENCRYPTION SCHEMES
r The common practice of using pseudorandom generators as a basis for privatekey stream-ciphers (i.e., Construction 5.3.3) is sound, provided that one actually
uses pseudorandom generators (rather than programs that are called pseudorandom
generators but actually produce sequences that are easy to predict).55
r Whereas the plain RSA public-key encryption scheme (which employs a deterministic encryption algorithm) is not secure, the randomized RSA encryption scheme
(i.e., Construction 5.3.16) is secure, provided that the large hard-core conjecture
holds (see Section 5.3.4.1). Some support for the latter (clearly stated) conjecture
may be derived from the fact that a related function (i.e., much fewer least-signicant
bits) constitutes a hard-core of the RSA.
We comment that the common practice of randomly padding messages before encrypting them (by applying the RSA function) is secure under a seemingly stronger
conjecture; see footnote 19 (in Section 5.3.4.1).
r Assuming the intractability of factoring, there exists a secure public-key encryption
scheme with efciency comparable to that of plain RSA: We refer to the BlumGoldwasser public-key encryption scheme (i.e., Construction 5.3.20).
Finally, we warn that encryption schemes proved to be secure in the random oracle
model are not necessarily secure (in the standard sense). For further discussion of the
Random Oracle Methodology, we refer the reader to Section 6.6.3.
The linear congruential generator is easy to predict [43]. The same holds for some modications of it that
output a constant fraction of the bits of each resulting number [94]. We warn that sequences having large
linear-complexity (LFSR-complexity) are not necessarily hard to predict.
478
5.5 MISCELLANEOUS
Adleman [176] and by Merkle and Hellman [154]. The abstract notion, as well as
the concrete candidate implementations (especially the RSA scheme of [176]), have
been the driving force behind the theoretical study of encryption schemes. However, the
aforementioned pioneering works did not provide a denition of security. Such satisfactory denitions were provided (only a few years later) by Goldwasser and Micali [123].
The two denitions presented in Section 5.2 originate in [123], where it was shown that
ciphertext-indistinguishability implies semantic security. The converse direction is due
to [156].
Regarding the seminal paper of Goldwasser and Micali [123], a few additional comments are in place. Arguably, this paper is the basis of the entire rigorous approach
to cryptography (presented in the current work): It introduced general notions such
as computational indistinguishability, denitional approaches such as the simulation
paradigm, and techniques such as the hybrid argument. Its title (Probabilistic Encryption) is due to the authors realization that public-key encryption schemes in which
the encryption algorithm is deterministic cannot be secure in the sense dened in their
paper. Indeed, this led the authors to (explicitly) introduce and justify the paradigm
of randomizing the plaintext as part of the encryption process. Technically speaking, the paper only presents security denitions for public-key encryption schemes,
and furthermore, some of these denitions are syntactically different from the ones
we have presented here (yet all these denitions are equivalent). Finally, the term
ciphertext-indistinguishability used here replaces the (generic) term polynomialsecurity used in [123]. Many of our modications (to the denitions in [123]) are
due to Goldreich [104], which is also the main source of our uniform-complexity
treatment.56
The rst construction of a secure public-key encryption scheme based on a simple complexity assumption was given by Goldwasser and Micali [123].57 Specically,
they constructed a public-key encryption scheme assuming that deciding Quadratic
Residiousity modulo composite numbers is intractable. The condition was weakened
by Yao [190], who showed that any trapdoor permutation will do. The efcient publickey encryption scheme of Construction 5.3.20 is due to Blum and Goldwasser [41].
The security is based on the fact that the least-signicant bit of the modular squaring
function is a hard-core predicate, provided that factoring is intractable, a result mostly
due to [1].
For decades, it has been common practice to use pseudorandom generators in the
design of stream-ciphers. As pointed out by Blum and Micali [42], this practice is sound
provided that one uses pseudorandom generators (as dened in Chapter 3 of this work).
The construction of private-key encryption schemes based on pseudorandom functions
is due to [111].
We comment that it is indeed peculiar that the rigorous study of (the security of)
private-key encryption schemes has lagged behind the corresponding study of publickey encryption schemes. This historical fact may be explained by the very thing that
56
57
Section 5.2.5.5 was added during the copyediting stage, following discussions with Johan Hastad.
Recall that plain RSA is not secure, whereas Randomized RSA is based on the Large Hard-Core Conjecture for
RSA (which is less appealing that the standard conjecture referring to the intractability of inverting RSA).
479
ENCRYPTION SCHEMES
makes it peculiar; that is, private-key encryption schemes are less complex than publickey ones, and hence, the problematics of their security (when applied to popular candidates) is less obvious. In particular, the need for a rigorous study of (the security of)
public-key encryption schemes arose from observations regarding some of their concrete applications (e.g., doubts raised by Lipton concerning the security of the mental
poker protocol of [184], which used plain RSA as an encryption scheme). In contrast, the need for a rigorous study of (the security of) private-key encryption schemes
arose later and by analogy to the public-key case.
5.5 MISCELLANEOUS
5.5.7. Exercises
Exercise 1: Secure encryption schemes imply secure communication protocols: A
secure communication protocol is a two-party protocol that allows the parties
to communicate in secrecy (i.e., as in Denition 5.2.1). We stress that the sender
58
We comment that the reasonably-efcient scheme of [68] is based on a strong assumption regarding a specic
computational problem related to the Dife-Hellman Key Exchange. Specically, it is assumed that for a prime P
and primitive element g, given (P, g, (g x mod P), (g y mod P), (g z mod P)), it is infeasible to decide whether
z x y (mod P 1).
481
ENCRYPTION SCHEMES
enters such a protocol with input that equals the message to be delivered, and the
receiver enters with no input (or with input that equals the security parameter).
1. Show that any secure public-key encryption scheme yields a (two-message) secure
communication protocol.
2. Dene secure communication protocol with initial set-up, and show that any secure private-key encryption scheme yields such a (one-message) protocol. (Here,
the communicating parties obtain an [equal] auxiliary input that is generated at
random according to some pre-determined process.)
Advanced: Show that a secure communication protocol (even with initial set-up but
with a priori unbounded messages) implies the existence of one-way functions.
Guideline (advanced part): See guideline for Exercise 2.
Exercise 2: Secure encryption schemes imply one-way function [132]: Show that the
existence of a secure private-key encryption scheme (i.e., as in Denition 5.2.1)
implies the existence of one-way functions.
Guideline: Recall that, by Exercise 11 of Chapter 3 in Volume 1, it sufces to prove
that the former implies the existence of a pair of polynomial-time constructible
probability ensembles that are statistically far apart and still are computationally indistinguishable. To prove the existence of such ensembles, consider the encryption
of (n + 1)-bit plaintexts relative to a random n-bit long key, denoted K n . Specifically, let the rst ensemble be {(Un+1 , E(Un+1 ))}nN , where E(x) = E K n (x), and
(1)
(2)
(1)
(2)
the second ensemble be {(Un+1 , E(Un+1 ))}nN , where Un+1 and Un+1 are independently distributed. It is easy to show that these ensembles are computationally
indistinguishable and are both polynomial-time constructible. The more interesting
part is to show that these ensembles are statistically far apart. Note that the correct decryption condition implies that (K n , E K n (Un+1 )) contains n + 1 o(1) bits
of information about Un+1 . On the other hand, if these ensembles are statistically
close, then E K n (Un+1 ) contains o(1) bits of information about Un+1 . Contradiction
follows, because K n may contain at most n bits of information.
Exercise 4: Encryption schemes must leak information about the length of the plaintext: Suppose that the denition of semantic security is modied so that the
482
5.5 MISCELLANEOUS
algorithms are not given the length of the plaintext. Prove that in such a case there
exists no semantically secure encryption scheme.
Guideline: First show that for some polynomial p, |E(1n )| < p(n) (always holds),
whereas for some x {0, 1} p(n) it must hold that Pr[|E(x)| < p(n)] < 1/2.
Exercise 5: Hiding partial information about the length of the plaintext: Using an arbitrary secure encryption scheme, construct a correspondingly secure encryption
scheme that hides the exact length of the plaintext. In particular, construct an encryption scheme that reveals only the following function h of the length of the
plaintext:
1. h (m) = m/n n, where n is the security parameter.
2. h (m) = 2log2 m .
(Hint: Just use an adequate padding convention, making sure that it always allows
correct decryption.)
Exercise 8: Deterministic encryption schemes: Prove that a semantically secure publickey encryption scheme must employ a probabilistic encryption algorithm.
Guideline: For any public-key encryption scheme having a deterministic encryption algorithm, given the encryption-key, one can distinguish the encryptions of two
candidate plaintexts by computing the unique ciphertext corresponding to each of
them.
ENCRYPTION SCHEMES
where C n T (C n ) and the probability is also taken over the internal coin
tosses of T .
Formulate and show an analogous result for public-key encryption.
Guideline: The alternative view of non-uniformity, discussed in Section 1.3 of
Volume 1, is useful here. That is, we can view a circuit family as a sequence
of advices given to a universal machine. Thus, the alternative formulation of the
denition states that advices for a machine that gets the ciphertext can be efciently
transformed into advices for a machine that does not get the ciphertext. However, we
can incorporate the (probabilistic) transformation program into the second universal
algorithm (which then become probabilistic). Consequently, the advices are identical
for both machines (and can be incorporated in the auxiliary input h(1n , X n ) used
in Denition 5.2.1). Viewed this way, the alternative formulation is equivalent to
asserting that for some (universal) deterministic polynomial-time algorithm U , there
exists a probabilistic polynomial-time algorithm U such that for every {X n }nN ,
f, h : {0, 1} {0, 1} , p, and n as in Denition 5.2.1
1
p(n)
Still, a gap remains between Denition 5.2.1 and this denition: The last refers
only to one possible deterministic algorithm U , whereas Denition 5.2.1 refers
to all probabilistic polynomial-time algorithms. To close the gap, we rst observe
that (by Propositions 5.2.7 and 5.2.6), Denition 5.2.1 is equivalent to a form
in which one only quanties over deterministic polynomial-time algorithms A.
We conclude by observing that one can code any algorithm A (and polynomial
time-bound) referred to by Denition 5.2.1 in the auxiliary input (i.e., h(1n , X n ))
given to U .
Exercise 10: In continuation of Exercise 9, consider a denition in which the transformation T (of the circuit family {Cn }nN to the circuit family {C n }nN ) is not even
required to be computable.59 Clearly, the new denition is not stronger than the one
in Exercise 9. Show that the two denitions are in fact equivalent.
Guideline: Use the furthermore-clause of Proposition 5.2.7 to show that the new
denition implies indistinguishability of encryptions, and conclude by applying
Proposition 5.2.6 and invoking Exercise 9.
Exercise 11: An alternative formulation of Denition 5.2.3: Prove that Denition 5.2.3
remains unchanged when supplying the circuit with auxiliary input. That is, an
encryption scheme satises the modied Denition 5.2.3 if and only if
59
Equivalently, one may require that for any polynomial-size circuit family {Cn }nN there exists a polynomial-size
circuit family {Cn }nN satisfying the relevant inequality.
484
5.5 MISCELLANEOUS
1
p(n)
Exercise 12: Equivalence of the security denitions in the public-key model: Prove
that a public-key encryption scheme is semantically secure if and only if it has
indistinguishable encryptions.
Exercise 13: The technical contents of semantic security: The following explains the
lack of computational requirements regarding the function f , in Denition 5.2.1.
Prove that an encryption scheme, (G, E, D), is (semantically) secure (in the privatekey model) if and only if the following holds:
There exists a probabilistic polynomial-time algorithm A such that for every {X n }nN and h as in Denition 5.2.1, the following two ensembles are
computationally indistinguishable:
1. {E G 1 (1n ) (X n ), 1|X n | , h(1n , X n )}nN .
2. {A (1n , 1|X n | , h(1n , X n ))}nN .
Formulate and prove an analogous claim for the public-key model.
Guideline: We care mainly about the fact that the latter formulation implies semantic security. The other direction can be proven analogously to the proof of
Proposition 5.2.7.
485
ENCRYPTION SCHEMES
Exercise 15: A variant on Exercises 13 and 14.1: Prove that an encryption scheme,
(G, E, D), is (semantically) secure (in the private-key model) if and only if the
following holds:
For every probabilistic polynomial-time algorithm A there exists a probabilistic
polynomial-time algorithm A such that for every ensemble {X n }nN , with
|X n | = poly(n), and polynomially-bounded h , the following two ensembles
are computationally indistinguishable.
1. {A(1n , E G 1 (1n ) (X n ), 1|X n | , h (1n ))}nN .
2. {A (1n , 1|X n | , h (1n ))}nN .
An equivalent form is obtained by replacing h (1n ) with a poly(n)-bit long string vn .
Formulate and prove an analogous claim for the public-key model.
Guideline: Again, we care mainly about the fact that this variant implies semantic security. The easiest proof of this direction is by applying Propositions 5.2.7
and 5.2.6. A more interesting proof is obtained by using Exercise 13: Indeed, the
current formulation is a special case of the formulation in Exercise 13, and so
we need to prove that it implies the general case. The latter is proven by observing that otherwise using an averaging argument we derive a contradiction in
one of the residual probability spaces dened by conditioning on h(1n , X n ) (i.e.,
(X n |h(1n , X n ) = v) for some v).
Exercise 16: Semantic security with respect to relations: The formulation of semantic security in Denition 5.2.1 refers to computing a function (i.e., f ) of the
plaintext. Here we present a (related) denition that refers to nding strings that
are in a certain relation to the plaintext. Note that, unlike in Denition 5.2.1,
here we consider only efciently recognizable relations. Specically, we require the
following:
For every probabilistic polynomial-time algorithm A there exists a probabilistic polynomial-time algorithm A such that for every ensemble {X n }nN ,
with |X n | = poly(n), every polynomially bounded function h, every polynomially bounded relation R that is recognizable by a (non-uniform) family
of polynomial-size circuits, every positive polynomial p, and all sufciently
large n
Pr (X n , A(1n , E G 1 (1n ) (X n ), 1|X n | , h(1n , X n ))) R
1
< Pr (X n , A (1n , 1|X n | , h(1n , X n ))) R +
p(n)
1. Prove that this denition is in fact equivalent to the standard denition of semantic
security.
2. Show that if the computational restriction on the relation R is removed, then no
encryption scheme can satisfy the resulting denition.
486
5.5 MISCELLANEOUS
Exercise 17: Semantic security with a randomized h: The following syntactic strengthening of semantic security is important in some applications. Its essence is in considering information related to the plaintext, in the form of a related random variable,
rather than partial information about the plaintext (in the form of a function of
it). Prove that an encryption scheme, (G, E, D), is (semantically) secure (in the
private-key model) if and only if the following holds:
For every probabilistic polynomial-time algorithm A there exists a probabilistic polynomial-time algorithm A such that for every {(X n , Z n )}nN , with
|(X n , Z n )| = poly(n), where Z n may depend arbitrarily on X n , and f , p, and
n as in Denition 5.2.1
Pr A(1n , E G 1 (1n ) (X n ), 1|X n | , Z n ) = f (1n , X n )
1
< Pr A (1n , 1|X n | , Z n ) = f (1n , X n ) +
p(n)
That is, the auxiliary input h(1n , X n ) of Denition 5.2.1 is replaced by the random
variable Z n . Formulate and prove an analogous claim for the public-key model.
Guideline: Denition 5.2.1 is clearly a special case of the latter formulation. On
the other hand, the proof of Proposition 5.2.6 extends easily to this (seemingly
stronger) formulation of semantic security.
Exercise 18: Semantic Security with respect to Oracles (suggested by Boaz Barak):
Consider an extended denition of semantic security in which, in addition to the
regular inputs, the algorithms have oracle access to a function H1n , x : {0, 1}
{0, 1} (instead of being given the value h(1n , x)). The H1n , x s have to be restricted to
have polynomial (in n + |x|) size circuits. That is, an encryption scheme, (G, E, D),
is extended-semantically secure (in the private-key model) if the following holds:
For every probabilistic polynomial-time algorithm A there exists a probabilistic polynomial-time algorithm B such that for every ensemble {X n }nN ,
with |X n | = poly(n), every polynomially bounded function f , every family of
polynomial-sized circuits {H1n , x }nN, x{0,1} ,every positive polynomial p, and
all sufciently large n
Pr A H1n , X n (1n , E G 1 (1n ) (X n ), 1|X n | ) = f (1n , X n )
1
< Pr B H1n , X n (1n , 1|X n | ) = f (1n , X n ) +
p(n)
487
ENCRYPTION SCHEMES
Exercise 19: Another equivalent denition of security: The following exercise is interesting mainly for historical reasons. In the denition of semantic security appearing
in [123], the term maxu,v {Pr[ f (1n , X n ) = v|h(1n , X n ) = u]} appears instead of the
term Pr[A (1n , 1|X n | , h(1n , X n )) = f (1n , X n )]. That is, it is required that the following holds:
For every probabilistic polynomial-time algorithm A, every ensemble {X n }nN ,
with |X n | = poly(n), every pair of polynomially bounded functions f, h :
{0, 1} {0, 1} , every positive polynomial p, and all sufciently large n
Pr A(1n , E G 1 (1n ) (X n ), 1|X n | , h(1n , X n )) = f (1n , X n )
1
< max Pr [ f (1n , X n ) = v|h(1n , X n ) = u] +
u,v
p(n)
Prove that this formulation is in fact equivalent to Denition 5.2.1.
Guideline: First, note that this denition is implied by Denition 5.2.1 (because maxu,v {Pr[ f (1n , X n ) = v|h(1n , X n ) = u]} Pr[A (1n , 1|X n | , h(1n , X n )) =
f (1n , X n )], for every algorithm A ). Next note that in the special case, in which X n
satises Pr[ f (1n , X n ) = 0|h(1n , X n ) = u] = Pr[ f (1n , X n ) = 1|h(1n , X n ) = u] = 12 ,
for all us, the previous terms are equal (because A can easily achieve success probability 1/2 by simply always outputting 1). Finally, combining Propositions 5.2.7
and 5.2.6, infer that it sufces to consider only the latter special case.
60
This refers to the private-key case, whereas in the public-key case, H1n , x may be dened such that, when queried
about an encryption-key, it reveals the decryption-key in use.
488
5.5 MISCELLANEOUS
(1)
(t(n))
), h(1n , X n )) = f (1n , X n )
(1)
(t(n))
< Pr A (1n , (1|X n | , ..., 1|X n | ), h(1n , X n )) = f (1n , X n ) +
1
p(n)
Exercise 21: Private-key encryption secure with respect to exactly t messages. In continuation of Proposition 5.2.12, show that if secure private-key encryption schemes
exist, then for every t there are such schemes that are secure with respect to the
encryption of t messages but not with respect to the encryption of t + 1 messages.
Guideline: Given an arbitrary private-key encryption scheme (G, E, D), consider
the following private-key encryption scheme (G , E , D ):
r
r
r
G (1n ) = (k, k), where k = (k0 , k1 , ..., kt ) such that (k0 , k0 ) G(1n ) and
k1 , ..., kt are uniformly and independently selected in {0, 1}n (without loss of
generality, n = |k0 |);
t
E (k 0 ,k1 ,...,kt ) (x) = (E k0 (x), r, i=0
ki r i ), where r is uniformly selected in {0, 1}n ,
and the arithmetics is of the eld G F(2n );
and D(k
(y, r, v) = Dk0 (y).
0 ,k 1 ,...,k t )
Exercise 22: Known plaintext attacks: Loosely speaking, in a known plaintext attack
on a private-key (resp., public-key) encryption scheme, the adversary is given some
plaintext/ciphertext pairs in addition to some extra ciphertexts (without corresponding plaintexts). Semantic security in this setting means that whatever can be efciently computed about the missing plaintexts can also be efciently computed given
only the length of these plaintexts.
1. Provide formal denitions of security under known plaintext attacks, treating both
the private-key and public-key models and referring to both the single-message
and multiple-message settings.
2. Prove that any secure public-key encryption scheme is also secure in the presence
of known plaintext attacks.
3. Prove that any private-key encryption scheme that is secure in the multiplemessage setting is also secure in the presence of known plaintext attacks.
489
ENCRYPTION SCHEMES
Guideline (for Part 3): Consider a function h in the multiple-message setting that
reveals some of the plaintexts.
5.5 MISCELLANEOUS
Exercise 26: A secure private-key encryption scheme: Assuming that F is pseudorandom with respect to polynomial-size circuits, prove that Construction 5.3.12
constitutes a secure private-key encryption scheme.
Guideline: Adapt the proof of Proposition 5.3.10. When referring to the security of
t = poly(n) messages, each of length = poly(n), the adaptation requires bounding
the probability that for t uniformly selected r ( j) s there exists j1 , j2 {1, ..., t} and
i 1 , i 2 {1, ..., /n} such that r ( j1 ) + i 1 r ( j2 ) + i 2 (mod 2n ).
Exercise 28: On the importance of restricting the ensembles {h e }e{0,1} and {X e }e{0,1}
in Denition 5.4.1:
1. Show that if one allows arbitrary function ensembles {h e }e{0,1} in Denition 5.4.1, then no encryption scheme can satisfy it.
2. Show that if one allows arbitrary probability ensembles {X e }e{0,1} in Denition 5.4.1, then no encryption scheme can satisfy it, even if one uses only a single
function h that is polynomial-time computable.
Guideline: For Part 1, consider the functions h e (x) = d, where d is a decryptionkey corresponding to the encryption-key e. For Part 2, consider the random variable
X e = (d, U|e| ), where d is as before, and the function h(x , x ) = x .
Exercise 29: An alternative formulation of Denition 5.4.1: Show that the following
formulation of the denition of admissible ensembles {h e }e and {X e }e is equivalent
to the one in Denition 5.4.1:
ENCRYPTION SCHEMES
r There is a non-uniform family of polynomial-size circuits {Tn } that transform encryption-keys (i.e., e in G 1 (1n )) into circuits that sample the corresponding distributions (i.e., X e ). That is, on input e G 1 (1n ), the circuit Tn outputs a circuit Se such that Se (Um ) is distributed identically to X e ,
where Um denotes the uniform distribution over the set of strings of length
m = m(e).
Note that this formulation is in greater agreement with the motivating discussion preceding Denition 5.4.1. The formulation in Denition 5.4.1 was preferred because
of its relative simplicity.
Guideline: Consider, for example, the condition regarding {h e }. The formulation in
Denition 5.4.1 is shown to imply the one in this exercise by considering the circuit
family {Tn } such that on input e (in the range of G 1 (1n )), the circuit Tn outputs
def
the circuit Ce () = Hn (e, ), where Hn is the circuit guaranteed by Denition 5.4.1.
That is, Tn has the description of Hn hard-wired, and outputs the description of
the circuit obtained from Hn by xing its rst input to be e. On the other hand,
given a circuit family {Tn } that transforms e C e as here, we obtain a circuit Hn
as required in the formulation of Denition 5.4.1 as follows. The circuit Hn has
Tn hard wired, and so, on input (e, x), the circuit Hn rst reconstructs the circuit
Ce Tn (e), and then emulates the computation of the value Ce (x).
Exercise 30: Alternative formulations of Denitions 5.4.1 and 5.4.2: Following the
framework of Section 5.4.3, present alternative denitions of security for keydependent passive attacks (by replacing the oracle machines A1 and A2 in Definitions 5.4.8 and 5.4.9 with ordinary machines). Show that these denitions are
equivalent to Denitions 5.4.1 and 5.4.2.
Guideline: For example, show how to derive circuits Pn and C n (as in Denition 5.4.2) from the machines A1 , A2 and the auxiliary input z (of Denition 5.4.9).
Exercise 31: Multiple-message security in the context of key-dependent passive attacks on public-key schemes: Formulate multiple-message generalizations of Denitions 5.4.1 and 5.4.2, and prove that both are equivalent (in the public-key model)
to the single-message denitions.
Guideline: Note that admissibility for the multiple-message generalization of Definition 5.4.2 means that, given an encryption-key e, one can compute (via a
polynomial-size circuit that depends only on |e|) a corresponding pair of sequences
(1)
(t(|e|))
(1)
(t(|e|))
), (ye , ..., ye
)). Thus, ability to distinguish corresponding se((x e , ..., xe
(i)
quences of encryptions yields ability to distinguish, for some i, the encryption of xe
(i)
from the encryption of ye , where the latter distinguisher generates the corresponding x-y hybrid (by using the circuit guaranteed by the admissibility condition and
the input encryption-key e), and invokes the former distinguisher on the resulting
sequence of encryptions.
Exercise 32: Key-oblivious versus key-dependent passive attacks: Assuming the existence of secure public-key encryption schemes, show that there exists one that
492
5.5 MISCELLANEOUS
satises the basic denition (i.e., as in Denition 5.2.2) but is insecure under
key-dependent passive attacks (i.e., as in Denition 5.4.1).
Guideline: Given a scheme (G, E, D), dene (G, E , D ) such that E e (x) =
(1, E e (x)) if x = e and E e (x) = (0, x) otherwise (i.e., for x = e). Using Exercise 7
(which establishes that each encryption-key is generated with negligible probability), show that (G, E , D ) satises Denition 5.2.2. Alternatively, use G (1n ) =
((r, G 1 (1n )), G 2 (1n )), where r is uniformly distributed in {0, 1}n , which immediately
implies that each encryption-key is generated with negligible probability.
Exercise 33: Passive attacks versus Chosen Plaintext Attacks: Assuming the existence
of secure private-key encryption schemes, show that there exists one that is secure
in the standard (multi-message) sense (i.e., as in Denition 5.2.8) but is insecure
under a chosen plaintext attack (i.e., as in Denition 5.4.8).
Guideline: Given a scheme (G, E, D), dene (G , E , D ) such that
1. G (1n ) = ((k, r ), (k, r )), where (k, k) G(1n ) and r is selected uniformly in
{0, 1}n .
2. E (k,r
) (x) = (1, r, E k (x)) if x = r and E (k,r ) (x) = (0, k, x) otherwise (i.e., for
x = r ).
Show that (G , E , D ) is secure in the standard sense, and present a (simple but
very harmful) chosen plaintext attack on it.
Exercise 34: Alternative formulations of semantic security for CPA and CCA: Consider
an alternative form of Denition 5.4.8 (resp., Denition 5.4.13) in which A1 (1, z) is
replaced by A1E e (e, z) (resp., A1Ee , Dd (e, z)), where (e, d) G(1n ) and Condition 2
is omitted. Show that the current form is equivalent to the one presented in the main
text.
Guideline: The alternative forms presented here restrict the choice of A1 (to a
canonical one), and thus the corresponding denitions are at least as strong as the
ones in the main text. However, since Theorem 5.4.11 (resp., Theorem 5.4.15) is
established using the canonical A1 , it follows that the current denitions are actually
equivalent to the ones in the main text. We comment that we consider the formulation
in the main text to be more natural, alas more cumbersome.
Exercise 35: Chosen Plaintext Attacks versus Chosen Ciphertext Attacks: Assuming
the existence of private-key (resp., public-key) encryption schemes that are secure
under a chosen plaintext attack, show that there exists one that is secure in the
former sense but is not secure under a chosen ciphertext attack (not even in the a
priori sense).
Guideline: Given a scheme (G, E, D), dene (G , E , D ) such that G = G and
1. E e (x) = (1, E e (x)) with probability 1 2|e| and E e (x) = (0, x) otherwise.
2. Dd (1, y) = Dd (y) and Dd (0, y) = (d, y).
Recall that decryption is allowed to fail with negligible probability, and note that the
construction is adequate for both public-key and private-key schemes. Alternatively,
to obtain error-free decryption, dene Ee (x) = (1, E e (x)), Dd (1, y) = Dd (y) and
493
ENCRYPTION SCHEMES
Dd (0, y) = (d, y). In the case of private-key schemes, we may dene E k (k) =
(0, 1|k| ) and E k (x) = (1, E k (x)) for x = k.
Exercise 36: Chosen Ciphertext Attacks: a priori versus a posteriori: Assuming the
existence of private-key (resp., public-key) encryption schemes that are secure under
an a priori chosen plaintext attack, show that there exists one that is secure in the
former sense but is not secure under an a posteriori chosen ciphertext attack.
Guideline: Given a scheme (G, E, D), dene (G , E , D ) such that G = G and
def
Exercise 39: On the computational restriction on the choice of input in the denition
of adaptive NIZK: Show that if Denition 5.4.22 is strengthened by waiving the
computational bounds on , then only trivial NIZKs (i.e., languages in BPP) can
satisfy it.
61
Furthermore, we may even restrict this challenge query to be of the form (S, 0), where 0 is the all-zero function
(which yields no information).
494
5.5 MISCELLANEOUS
Guideline: Show that allowing a computationally unbounded forces the simulator to generate a reference string that is statistically close to the uniform distribution.
Thus, soundness implies weak simulation-soundness in the strong sense of Exercise 40 (i.e., with respect to a computationally unbounded as in Denition 5.4.22),
and by applying Exercise 40 we are done.
Exercise 40: Weak simulation-soundness can hold only with respect to computationally
bounded cheating provers. Show that if Denition 5.4.24 is strengthened by waiving
the computational bounds on , then only trivial NIZKs (i.e., for languages in BPP)
can satisfy it.
Guideline: Show that otherwise the two-stage simulation procedure, S = (S1 , S2 ),
can be used to distinguish inputs in the language L from inputs outside the language,
because in the rst case it produces a valid proof whereas in the second case it cannot
do so. The latter fact is proved by showing that if S2 (which also gets an auxiliary
input s produced by S1 along with the reference string) produces a valid proof for
some x L, then a computationally unbounded prover may do the same by rst
generating s according to the conditional distribution induced by the reference string
(and then invoking S2 ).
Exercise 41: Does weak simulation-soundness hold for all adaptive NIZKs?
1. Detect the aw in the following argument toward an afrmative answer: If weak
simulation-soundness does not hold, then we can distinguish a uniformly selected
reference string (for which soundness holds) from a reference string generated
by S1 (for which soundness does not hold).
2. Assuming the existence of one-way permutations (and adaptive NIZKs), show
an adaptive NIZK with a suitable simulator such that weak simulation-soundness
does not hold.
3. (Suggested by Boaz Barak and Yehuda Lindell): Consider languages containing
pairs (, x) such that one can generate s along with suitable trapdoors t()s that
allow for determining whether or not inputs of the form (, ) are in the language.
For such languages, dene a weaker notion of simulation-soundness that refers
to the setting in which a random is generated and then one attempts to produce
valid proofs for a no-instance of the form (, ) with respect to a reference-string
generated by S1 . (The weaker notion asserts that in this setting it is infeasible to
produce a valid proof for such a no-instance.) Provide a clear denition, prove
that it is satised by any adaptive NIZK for the corresponding language, and show
that this denition sufces for proving Theorem 5.4.27.
Guideline (Part 1): The existence of an efcient C = (, ) that violates weak
simulation-soundness only means that for a reference string generated by S1 , the
cheating generates a valid proof for a no-instance selected by . When C is given
a uniformly selected reference string, it either may fail to produce a valid proof or
may produce a valid proof for a yes-instance. However, we cannot necessarily
distinguish no-instances from yes-instances (see, for example, Part 2). This gap is
eliminated in Part 3.
495
ENCRYPTION SCHEMES
r2 G(Un ) (and S2 (x, s) = S2 (x, s)). Verify that the modied algorithms satisfy the denition of an adaptive NIZK, and note that weak simulation-soundness
is easily violated by (r1 , r2 ) = r2 L (and any ).
496
CHAPTER SIX
Message authentication and (digital) signatures were the rst tasks that joined encryption to form modern cryptography. Both message authentication and digital signatures are concerned with the authenticity of data, and the difference between
them is analogous to the difference between private-key and public-key encryption
schemes.
In this chapter, we dene message authentication and digital signatures, and the security notions associated with them. We show how to construct message-authentication
schemes using pseudorandom functions, and how to construct signature schemes using
one-way permutations. We stress that the latter construction employs arbitrary one-way
permutations, which do not necessarily have a trapdoor.
Organization. The basic denitions are presented in Section 6.1. Constructions of
message-authentication schemes and signature schemes are presented in Sections 6.3
and 6.4, respectively. Toward presenting these constructions, we discuss restricted types
of message authentication and signature schemes, which are of independent interest,
such as length-restricted schemes (see Section 6.2) and one-time signature schemes
(see Section 6.4.1). Additional issues are discussed in Sections 6.5 and 6.6.
Teaching Tip. In contrast to the case of encryption schemes (cf. Chapter 5), the definitional treatment of signatures (and message authentication) is quite simple. The
treatment of length-restricted schemes (see Section 6.2) plays an important role in
the construction of standard schemes, and thus we strongly recommend highlighting
this treatment. We suggest focusing on the presentation of the simplest construction of
message-authentication schemes (provided in Section 6.3.1) and on the (not-so-simple)
construction of signature schemes that is provided in Sections 6.4.1 and 6.4.2. As in
Chapter 5, we assume that the reader is familiar with the material in Chapters 2 and 3 of
Volume 1 (and specically with Sections 2.2, 2.4, and 3.6). This familiarity is important
not only because we use some of the notions and results presented in these sections but
also because we use similar proof techniques (and do so while assuming that this is not
the readers rst encounter with these techniques).
497
r Each user can efciently produce his/her own signature on documents of his/her
choice;
r every user can efciently verify whether a given string is a signature of another
(specic) user on a specic document; but
r it is infeasible to produce signatures of other users to documents that they did not
sign.
We note that the formulation of unforgeable digital signatures also provides a clear
statement of the essential ingredients of handwritten signatures. The ingredients are
each persons ability to sign for him/herself, a universally agreed-upon verication
procedure, and the belief (or assertion) that it is infeasible (or at least hard) to
forge signatures in a manner that passes the verication procedure. It is not clear
to what extent handwritten signatures do meet these requirements. In contrast, our
treatment of digital-signature schemes provides precise statements concerning the
extend to which digital signatures meet these requirements. Furthermore, unforgeable digital signature schemes can be constructed based on the existence of one-way
functions.
Message authentication is a task related to the setting considered for encryption schemes; that is, communication over an insecure channel. This time, we consider an active adversary that is monitoring the channel and may alter the messages sent on it. The parties communicating through this insecure channel wish
to authenticate the messages they send so that their counterpart can tell an original message (sent by the sender) from a modied one (i.e., modied by the
498
adversary). Loosely speaking, a scheme for message authentication should satisfy the
following:
r each of the communicating parties can efciently verify whether a given string is an
authentication tag of a given message; but
r it is infeasible for an external adversary (i.e., a party other than the communicating
parties) to produce authentication tags to messages not sent by the communicating
parties.
Note that in contrast to the specication of signature schemes, we do not require universal verication: Only the designated receiver is required to be able to verify the
authentication tags. Furthermore, we do not require that the receiver be unable to produce authentication tags by itself (i.e., we only require that external parties not be able
to do so). Thus, message-authentication schemes cannot convince a third party that the
sender has indeed sent the information (rather than the receiver having generated it by
itself ). In contrast, signatures can be used to convince third parties. In fact, a signature
to a document is typically sent to a second party so that in the future, this party may
(by merely presenting the signed document) convince third parties that the document
was indeed generated (or sent or approved) by the signer.
the possession of the signing-key constitutes the senders advantage over the adversary
(see analogous discussion in Chapter 5). That is, without the signing-key, it is infeasible
to generate valid signatures (with respect to the corresponding verication-key). Furthermore, even after receiving signatures to messages of its choice, an adversary (lacking
the signing-key) cannot generate a valid signature to any other message.
As previously stated, the ability to produce valid signatures is linked to the knowledge of the signing-key. Loosely speaking, security (or unforgeability) means the
infeasibility of producing valid signatures without knowledge of the signing-key, where
validity means passing verication with respect to the corresponding verication-key.
The difference between message-authentication and signature schemes amounts to the
question of whether security also holds when the verication-key is publicly known:
In the case of message-authentication schemes, the verication-key is assumed to be
kept secret (and so these schemes are of the private-key type), whereas in the case
of signature schemes, the verication-key may be made public (and so these schemes
are of the public-key type). Thus, the difference between message-authentication
and signature schemes is captured by the security denition, and effects the possible
applications of these schemes.
From the point of view of their functionality, the difference between messageauthentication and signature schemes arises from the difference in the settings for which
they are intended, which amounts to a difference in the identity of the receiver and in
the level of trust that the sender has in the receiver. Typically, message-authentication
schemes are employed in cases where the receiver is predetermined (at the time of
message transmission) and is fully trusted by the sender, whereas signature schemes
allow verication of the authenticity of the data by anybody (which is certainly not
trusted by the sender). In other words, signature schemes allow for universal verication, whereas message-authentication schemes may only allow predetermined parties
to verify the authenticity of the data. Thus, in signature schemes the verication-key
must be known to anybody, and in particular is known to the adversary. In contrast, in
message-authentication schemes, the verication-key is only given to a set of predetermined receivers that are all trusted not to abuse this knowledge; that is, in such schemes
it is postulated that the verication-key is not (a priori) known to the adversary. (See
Figure 6.1.)
Summary and Terminology. Message-authentication and signature schemes differ
in the question of whether the verication-key is private (i.e., a secret unknown to
the adversary) or public (i.e., known to everybody and in particular known to the
adversary). Thus, in a sense, these are private-key and public-key versions of a task that
Type
Message auth.
schemes
Signature
schemes
Verication-key known
to the designated
(trusted) receiver(s) only
to everybody
(including the adversary)
Verication possible
for the designated
(trusted) receiver(s) only
for anybody
(including the adversary)
500
lacks a good name (since both authentication and signatures are already taken by one
of the two versions). Still, seeking a uniform terminology, we shall sometimes refer to
message-authentication schemes (also known as Message Authentication Codes [mac])
as to private-key signature schemes. Analogously, we shall sometimes refer to signature
schemes as to public-key signature schemes.
where the probability is taken over the internal coin tosses of algorithms S and V .
The integer n serves as the security parameter of the scheme. Each (s, v) in the range
of G(1n ) constitutes a pair of corresponding signing/verication keys.
We sometimes call S(s, ) a signature to the document produced using the
signing-key s . Likewise, when V (v, , ) = 1, we say that is a valid signature
to with respect to the verication-key v. (Indeed, at this point, we may assume that
algorithm V is deterministic, but see subsequent comments.) This denition asserts that
any signature to produced using the signing-key s is a valid signature to with respect
to the corresponding verication-key v. Note that there may be valid signatures (with
respect to v) that are not produced by the signing process (using the corresponding s).
We stress that Denition 6.1.1 says nothing about security, and so trivial (i.e., insedef
def
cure) triples of algorithms may satisfy it (e.g., S(s, ) = 0 and V (v, , ) = 1, for all
s, v, and ). Furthermore, Denition 6.1.1 does not distinguish private-key signature
schemes from public-key ones. The difference between the two types is introduced in
the security denitions: In a public-key scheme, the adversary gets the vericationkey (i.e., v) as an additional input (and thus v = s follows), whereas in private-key
501
schemes, v is not given to the adversary (and thus one may assume, without loss of
generality, that v = s).
Notation. In the rest of this work, we shall write Ss () instead of S(s, ) and Vv (, )
instead of V (v, , ). Also, we let G 1 (1n ) (resp., G 2 (1n )) denote the rst (resp., second)
element in the pair G(1n ). That is, G(1n ) = (G 1 (1n ), G 2 (1n )). Without loss of generality,
we may assume that |G 1 (1n )| and |G 2 (1n )| are polynomially related to n, and that each
of these integers can be efciently computed from the other.
Indeed, robustness follows by amplication (i.e., error- reduction) of the verication algorithm. For example,
given V as here, one may consider V that applies V to the tested pair for a linear number of times and accepting
if and only if V has accepted in all tries.
Indeed, in general, the distinction between generating something new and extracting something implicit
cannot be placed on rm grounds. However, our reference to this distinction is merely at the motivational
level. Furthermore, this distinction can be formalized in the context that we care about, which is the context
of comparing encryption and signature schemes (or, rather, the adversaries attacking these schemes). In the
case of encryption schemes, we consider adversaries that try to extract information about the plaintext from
the ciphertext. That is, the desired object is a function of the given input. In contrast, in the case of signature
schemes, we consider adversaries that try to generate a valid signature with respect to a certain verication-key.
That is, the desired object is not a function of the given input.
502
Furthermore, the typical applications of signature schemes are to setting in which the
adversary may obtain from the legitimate signer valid signatures to some documents
of the adversarys choice. For this reason, the basic denition of security of signature
schemes refers to such chosen message attacks (to be discussed and dened next).
(Indeed, the situation here is different from the case of encryption schemes, where the
basic denition refers to a passive adversary that only wire-taps a communication
line, in encrypted form, over this line.)
We shall consider a very strong denition of security (against chosen message
attacks). That is, we consider very powerful attacks on the signature scheme, as well
as a very liberal notion of breaking it. Specically, during the course of the attack,
the attacker is allowed to obtain signatures to any document of its choice. One may
argue that in many applications, such a general attack is not possible (because, in
these applications, documents to be signed must have a specic format). Yet our view
is that it is impossible to dene a general (i.e., application-independent) notion of
admissible documents, and thus a general/robust denition of an attack seems to have
to be formulated as suggested here. (Note that at worst, our approach is overly cautious.)
Likewise, the attacker is said to be successful if it can produce a valid signature to any
document for which it has not asked for a signature during its attack. Again, this denes
the ability to form signatures to possibly nonsensical documents as a breaking of the
scheme. Yet, again, we see no way to have a general (i.e., application-independent)
notion of meaningful documents (so that only forging signatures to them will be
considered a breaking of the scheme). This discussion leads to the following (slightly
informal) formulation:
r A chosen message attack is a process that can obtain signatures to strings of its
choice, relative to some xed signing-key that is generated by G. We distinguish two
cases:
The private-key case: Here the attacker is given 1n as input, and the signatures are
produced relative to s, where (s, v) G(1n ).
The public-key case: Here the attacker is given v as input, and the signatures are
produced relative to s, where (s, v) G(1n ).
r Such an attack is said to succeed (in existential forgery) if it outputs a valid signature
to a string for which it has not requested a signature during the attack. That is, the
attack is successful if it outputs a pair (, ) such that Vv (, ) = 1 (where v is as in
the previous item) and is different from all strings for which a signature has been
required during the attack.
r A signature scheme is secure (or unforgeable) if every feasible chosen message
attack succeeds with at most negligible probability.
Formally, a chosen message attack is modeled by a probabilistic polynomial-time
oracle machine that is given oracle access to a keyed signing process (i.e., the signing
algorithm combined with a signing-key). Depending on the version (i.e., public-key
or not), the attacker may get the corresponding verication-key as input. We stress
that this is the only difference between the two cases (i.e., private-key and public-key),
503
which are spelled out in Denition 6.1.2. We refer the reader to the clarifying discussion
that follows Denition 6.1.2; in fact, some readers may prefer to read that discussion
rst.
Denition 6.1.2 (unforgeable signatures): For a probabilistic oracle machine, M, we
denote by Q O
M (x) the set of queries made by M on input x and access to oracle O.
As usual, M O (x) denotes the output of the corresponding computation. We stress that
O
QO
M (x) and M (x) are dependent random variables that represents two aspects of the
same probabilistic computation.
The private-key case: A private-key signature scheme is secure if for every probabilistic polynomial-time oracle machine M, every positive polynomial p, and all
sufciently large n, it holds that
1
Vv (, ) = 1 & Q SMs (1n )
Pr
<
where (s, v) G(1n ) and (, ) M Ss (1n )
p(n)
where the probability is taken over the coin tosses of algorithms G, S, and V, as well
as over the coin tosses of machine M.
The public-key case: A public-key signature scheme is secure if for every probabilistic
polynomial-time oracle machine M, every positive polynomial p, and all sufciently
large n, it holds that
1
Vv (, ) = 1 & Q SMs (v)
Pr
<
where (s, v) G(1n ) and (, ) M Ss (v)
p(n)
where the probability is taken over the coin tosses of algorithms G, S, and V , as
well as over the coin tosses of machine M.
The denition refers to the following experiment. First a pair of keys, (s, v), is generated
by invoking G(1n ), and is xed for the rest of the discussion. Next, an attacker is invoked
on input 1n or v, depending on whether we are in the private-key or public-key case.
In both cases, the attacker is given oracle access to Ss , where the latter may be a
probabilistic oracle rather than a standard deterministic one (e.g., if queried twice for
the same value, then the probabilistic signing-oracle may answer in different ways).
Finally, the attacker outputs a pair of strings (, ). The attacker is deemed successful
if and only if the following two conditions hold:
1. The string is different from all queries (i.e., requests for signatures) made by the
attacker; that is, the rst string in the output pair (, ) = M Ss (x) is different from
any string in Q SMs (x), where x = 1n or x = v, depending on whether we are in the
private-key or public-key case.
We stress that both M Ss (x) and Q SMs (x) are random variables that are dened based
on the same random execution of M (on input x and oracle access to Ss ).
2. The pair (, ) corresponds to a valid document-signature pair relative to the verication key v. In case V is deterministic (which is typically the case) this means that
504
6.1.5.* Variants
Clearly, any signature scheme that is secure in the public-key model is also secure in
the private-key model. The converse is not true: Consider, for example, the privatekey scheme presented in Construction 6.3.1 (as well as any other natural messageauthentication scheme). Following are a few other comments regarding the denitions.
combined attack on such a private-key signature scheme, we emulate the vericationqueries (in the standard model) as follows:
6.2.1. Denition
The essence of the length-restriction is that security is guaranteed only with respect to
documents of the predetermined length. Note that the question of what is the result of
invoking the signature algorithm on a document of improper length is immaterial. What
is important is that an attacker (of a length-restricted scheme) is deemed successful only
if it produces a signature to a (different) document of proper length. Still, for the sake of
concreteness (and simplicity of subsequent treatment), we dene the basic mechanism
only for documents of proper length.
Denition 6.2.1 (signature scheme for xed-length documents): Let : N N. An
-restricted signature scheme is a triple, (G, S, V ), of probabilistic polynomial-time
algorithms satisfying the following two conditions:
1. As in Denition 6.1.1, on input 1n , algorithm G outputs a pair of bit strings.
2. Analogously to Denition 6.1.1, for every n and every pair (s, v) in the range of G(1n ),
and for every {0, 1}(n) , algorithms S and V satisfy Pr[Vv (, Ss ()) = 1] = 1.
507
Such a scheme is called secure (in the private-key or public-key model) if the (corresponding) requirements of Denition 6.1.2 hold when restricted to attackers that only
make queries of length (n) and output a pair (, ) with || = (n).
We stress that the essential modication is presented in the security condition. The latter
considers an adversary to be successful only in case it forges a signature to a (different)
document of the proper length (i.e., || = (n)).
Recall that such triviality does not hold in the context of encryption schemes, not even in the private-key case.
See Section 5.3.2.
508
Loosely speaking, the method consists of parsing the original document into blocks
(with adequate linkage between blocks), and applying the length-restricted scheme
to each (augmented) block.
Let and (G, S, V ) be as in Theorem 6.2.2. We construct a general signature scheme,
(G , S , V ), with G = G, by viewing documents as sequences of strings, each of length
(n) = (n)/O(1). That is, we associate = 1 t with the sequence (1 , ..., t ),
where each i has length (n). (At this point, the reader may think of (n) = (n),
but actually we will use (n) = (n)/4 in order to make room for some auxiliary
information.)
To motivate the actual construction, we consider rst the following simpler schemes
all aimed at producing secure signatures for arbitrary (documents viewed as) sequences
of (n)-bit long strings. The simplest scheme consists of just signing each of the strings
in the sequence. That is, the signature to the sequence (1 , ..., t ), is a sequence of
i s, each being a signature (with respect to the length-restricted scheme) to the corresponding i . This will not do, because an adversary, given the (single) signature
(1 , 2 ) to the sequence (1 , 2 ) with 1 = 2 , can present (2 , 1 ) as a valid signature
to (2 , 1 ) = (1 , 2 ). So how about foiling this forgery by preventing a reordering
of the atomic signatures (i.e., the i s); that is, how about signing the sequence
(1 , ..., t ) by applying the restricted scheme to each pair (i, i ), rather than to i itself? This will not do either, because an adversary, given a signature to the sequence
(1 , 2 , 3 ), can easily present a signature to the sequence (1 , 2 ). So we also need
to include in each (n)-bit string the total number of i s in the sequence. But even
this is not enough, because given signatures to the sequences (1 , 2 ) and (1 , 2 ),
with 1 = 1 and 2 = 2 , an adversary can easily generate a signature to (1 , 2 ).
Thus, we have to prevent the forming of new sequences of basic signatures by combining elements from different signature sequences. This can be done by associating
(say, at random) an identier with each sequence and incorporating this identier in
each (n)-bit string to which the basic (restricted) signature scheme is applied. This
discussion yields the signature scheme presented next, where a signature to a message
(1 , ..., t ) consists of a sequence of (basic) signatures to statements of the (effective) form the string i is the i-th block, out of t blocks, in a message associate with
identier r .
Construction 6.2.3 (signing augmented blocks): Let and (G, S, V ) be as in Theorem 6.2.2. We construct a general signature scheme, (G , S , V ), with G = G, by
considering documents as sequences of strings. We construct S and V as follows,
using G = G and (n) = (n)/4:
Signing with S : On input a signing-key s (in the range of G 1 (1n )) and a document
{0, 1} , algorithm S rst parses into a sequence of blocks (1 , ..., t ), such
that is uniquely reconstructed from the i s and each i is an (n)-bit long string.4
4
The parsing rule should apply to strings of arbitrary length, regardless of whether or not this length is a multiple
of (n). For example, we may parse as (1 , ..., t ) such that 1 t = 10 j and j {0, 1, ..., (n) 1}.
(Note that under this parsing rule, if || is a multiple of (n), then |1 t | = || + (n).)
509
Next, S uniformly selects r {0, 1} (n) . For i = 1, ..., t, algorithm S computes
i Ss (r, t, i, i )
where i and t are represented as (n)-bit long strings. That is, i is essentially
a signature to the statement i is the i-th block, out of t blocks, in a sequence
associate with identier r . Finally, S outputs as signature the sequence
(r, t, 1 , ...., t )
Verication with V : On input a verifying-key v (in the range of G 2 (1n )), a document {0, 1} , and a sequence (r, t, 1 , ...., t ), algorithm V rst parses into
1 , ..., t , using the same parsing rule as used by S . Algorithm V accepts if and
only if the following two conditions hold:
1. t = t, where t is obtained in the parsing of and t is part of the alleged signature.
2. For i = 1, ..., t, it holds that Vv ((r, t, i, i ), i ) = 1, where i is obtained in the
parsing of and the rest are as in the corresponding parts of the alleged signature.
Clearly, the triplet (G , S , V ) satises Denition 6.1.1. We need to show that is also
inherits the security of (G, S, V ). That is:
Proposition 6.2.4: Suppose that (G, S, V ) is an -restricted signature scheme that is
secure in the private-key (resp., public-key) model. Then (G , S , V ), as dened in
Construction 6.2.3, is a full-edged signature scheme that is secure in the private-key
(resp., public-key) model.
Theorem 6.2.2 follows immediately from Proposition 6.2.4.
Proof: Intuitively, ignoring the unlikely case that two messages signed by Ss were
assigned the same random identier, a forged signature with respect to (G , S , V )
must contain some Ss -signature that was not contained in any of the Ss -signatures
(provided in the attack). Thus, forgery with respect to (G , S , V ) yields forgery with
respect to (G, S, V ). Indeed, the proof is by a reducibility argument, and it holds for
both the private-key and the public-key models.
Given an adversary A attacking the complex scheme (G , S , V ), we construct an
adversary A that attacks the -restricted scheme, (G, S, V ). In particular, A invokes A
with input identical to its own input (which is the security parameter or the vericationkey, depending on the model), and uses its own oracle in order to emulate the oracle
Ss for A . This can be done in a straightforward manner; that is, algorithm A will
act as Ss does by using the oracle Ss . Specically, A parses each query of A into
a corresponding sequence (1 , ..., t ), uniformly selects an identier r , and obtains
Ss -signatures to (r , t , j, j ), for j = 1, ..., t . When A outputs a document-signature
pair relative to the complex scheme (G , S , V ), algorithm A tries to use this pair in
order to form a document-signature pair relative to the -restricted scheme, (G, S, V ).
We stress that from the point of view of adversary A , the distribution of keys and
oracle answers that A provides it with is exactly as in a real attack on (G , S , V ).
510
This is a crucial point, because we use the fact that events that occur in a real attack
of A on (G , S , V ) occur with the same probability in the emulation of (G , S , V )
by A.
Assume that with (non-negligible) probability (n), the (probabilistic polynomialtime) algorithm A succeeds in existentially forging relative to the complex scheme
(G , S , V ). We consider the following cases regarding the forging event:
1. The identier supplied in the forged signature is different from all the random identiers supplied (by A) as part of the signatures given to A . In this case, each -restricted
signature supplied as part of the forged (complex) signature yields existential forgery
relative to the -restricted scheme.
Formally, let (1) , ..., (m) be the sequence of queries made by A , and let
(1)
(m)
(r (1) , t (1) , ), ..., (r (m) , t (m) , ) be the corresponding (complex) signatures sup(i)
(i)
plied to A by A (using Ss to form the s). It follows that each consists of a
sequence of Ss -signatures to (n)-bit strings starting with r (i) {0, 1}(n)/4 , and that
the oracle Ss was invoked (by A) only on strings of this form. Let (, (r, t, 1 , ..., t ))
be the output of A , where is parsed as (1 , ..., t ), and suppose that applying Vv
to the output of A yields 1 (i.e., the output is a valid document-signature pair for the
complex scheme). The case hypothesis states that r = r (i) , for all is. It follows that
each of the j s is an Ss -signature to a string starting with r {0, 1}(n)/4 , and thus
different from all queries made to the oracle Ss . Thus, each pair ((r, t, i, i ), i )
is a valid document-signature pair (because Vv (, (r, t, 1 , ..., t )) = 1 implies
Vv ((r, t, i, i ), i ) = 1), with a document different from all queries made to Ss .
This yields a successful forgery with respect to the -restricted scheme.
2. The identier supplied in the forged signature equals the random identier supplied
(by A) as part of exactly one of the signatures given to A . In this case, existential forgery relative to the -restricted scheme is obtained by considering the relation between the output of A and the single supplied signature having the same
identier.
As in the previous case, let (1) , ..., (m) be the sequence of queries made by A , and
(1)
(m)
let (r (1) , t (1) , ), ..., (r (m) , t (m) , ) be the corresponding (complex) signatures
supplied to A by A. Let (, (r, t, 1 , ..., t )) be the output of A , where is parsed as
(1 , ..., t ), and suppose that = (i) for all is and that Vv (, (r, t, 1 , ..., t )) = 1.
The hypothesis of the current case is that there exists a unique i so that r = r (i) .
We consider two subcases regarding the relation between t and t (i) :
r t = t (i) . In this subcase, each -restricted signature supplied as part of the forged
block in the parsing of (i) . For this j, the string j (supplied as part of the forged
complex-signature) yields existential forgery relative to the -restricted scheme.
Specically, we have Vv ((r, t, j, j ), j ) = 1, whereas (r, t, j, j ) is different
(i )
from each query (r (i ) , t (i ) , j , j ) made by A to Ss .
(i )
Thus, ((r, t, j, j ), j ) is a valid document-signature pair with a document different from all queries made to Ss .
3. The identier supplied in the forged signature equals the random identiers supplied
(by A) as part of at least two signatures given to A . In particular, it follows that two
signatures given to A use the same random identier. The probability that this event
occurs is at most
m
2 (n) < m 2 2(n)/4
2
However, m = poly(n) (since A runs in polynomial-time), and 2(n)/4 is negligible
(since is super-logarithmic). So this case occurs with negligible probability and
may be ignored.
Note that A can easily determine which of the cases occurs and act accordingly.5 Thus,
assuming that A forges relative to the complex scheme with non-negligible probability (n), it follows that A forges relative to the length-restricted scheme with nonnegligible probability (n) (n) poly(n) 2(n)/4 , in contradiction to the propositions hypothesis.
Comment. We call the readers attention to the essential role of the hypothesis that
is super-logarithmic in the proof of Proposition 6.2.4. Indeed, Construction 6.2.3 is
insecure in case (n) = O(log n). The reason is that by asking for polynomially many
signatures, the adversary may obtain two Ss -signatures that use the same (random)
identier. Furthermore, with some care, these signatures yield existential forgery (see
Exercise 6).
This observation only saves us a polynomial factor in the forging probability. That is, if A did not know which
part of the forged complex-signature to use for its own forgery, it could have just selected one at random (and
be correct with probability 1/poly(n) because there are only poly(n)-many possibilities).
512
1
p(n)
where the probability is taken over the internal coin tosses of algorithms I and A.
The function is called the range specier of the collection.
Note that the range specier must be super-logarithmic (or else one may easily nd a
collision by selecting 2(n) + 1 different pre-images and computing their image under
the function). In Section 6.2.3, we show how to construct collision-free hashing functions using claw-free collections. But rst, we show how to use the former in order to
convert a length-restricted signature scheme into a full-edged one.
6
This condition is made merely in order to avoid annoying technicalities. In particular, this condition allows the
collision-forming adversary to run for poly(n)-time (because by this condition n = poly(|s|)), as well as allows
for determining n from s. Note that |s| = poly(n) holds by denition of I .
513
Construction 6.2.6 (hash and sign): Let and (G, S, V ) be as in Theorem 6.2.2, and
let {h r : {0, 1} {0, 1}(|r |) }r {0,1} be as in Denition 6.2.5. We construct a general
signature scheme, (G , S , V ), as follows:
Key-generation with G : On input 1n , algorithm G rst invokes G to obtain (s, v)
G(1n ). Next, it invokes I , the indexing algorithm of the collision-free hashing collection, to obtain r I (1n ). Finally, G outputs the pair ((r, s), (r, v)), where (r, s)
serves as a signing-key and (r, v) serves as a verication-key.
Signing with S : On input a signing-key (r, s) (in the range of G 1 (1n )) and a document
{0, 1} , algorithm S invokes S once to produce and output Ss (h r ()).
Verication with V : On input a verifying-key (r, v) (in the range of G 2 (1n )), a document {0, 1} , and an alleged signature , algorithm V invokes V and outputs
Vv (h r (), ).
Note that the resulting signature scheme applies the original one once (per each invocation of the resulting scheme). We stress that the length of resulting signatures only
depend on the length of the signing-key and is independent of the document being
signed; that is, |Sr,s
()| = |Ss (h r ())|, which in turn is bounded by poly(|s|, (|r |)).
Proposition 6.2.7: Suppose that (G, S, V ) is an -restricted signature scheme that
is secure in the private-key (resp., public-key) model. Suppose that {h r : {0, 1}
{0, 1}(|r |) }r {0,1} is indeed a collision-free hashing collection. Then (G , S , V ), as
dened in Construction 6.2.6, is a full-edged signature scheme that is secure in the
private-key (resp., public-key) model.
Proof: Intuitively, the security of (G , S , V ) follows from the security of (G, S, V )
and the collision-freeness property of the collection {h r }. Specically, forgery relative
to (G , S , V ) can be obtained either by a forged S-signature to a hash-value different
from all hash-values that appeared in the attack or by forming a collision under the
hash function. The actual proof is by a reducibility argument. Given an adversary A
attacking the complex scheme (G , S , V ), we construct an adversary A that attacks the
-restricted scheme, (G, S, V ), as well as an algorithm B forming collisions under the
hashing collection {h r }. Both A and B will have running time related to that of A . We
show if A is successful with non-negligible probability, than the same holds for either
A or B. Thus, in either case, we reach a contradiction. We start with the description of
algorithm A, which is designed to attack the -restricted scheme (G, S, V ). We stress
that almost the same description applies in both the private-key and public-key case.
On input x, which equals the security parameter 1n in the private-key case and a
verication-key v otherwise (i.e., in the public-key case), the adversary A operates as
follows. First, A uses I (the indexing algorithm of the collision-free hashing collection)
to obtain r I (1n ), exactly as done in the second step of G . Next, A invokes A (on
input 1n or (r, v), depending on the case) and uses r as well as its own oracle Ss in order
to emulate the oracle Sr,s
for A . The emulation is done in a straightforward manner;
that is, algorithm A will act as Sr,s
does by using the oracle Ss (i.e., to answer query
q, algorithm A makes the query h r (q)). When A outputs a document-signature pair
514
relative to the complex scheme (G , S , V ), algorithm A tries to use this pair in order
to form a document-signature pair relative to the -restricted scheme, (G, S, V ). That
is, if A outputs the document-signature pair (, ), then A will output the documentsignature pair (h r (), ).
As in the proof of Proposition 6.2.4, we stress that the distribution of keys and oracle
answers that A provides A is exactly as in a real attack of A on (G , S , V ). This is
a crucial point, because we use the fact that events that occur in a real attack of A on
(G , S , V ) occur with the same probability in the emulation of (G , S , V ) by A.
Assume that with (non-negligible) probability (n), the (probabilistic polynomialtime) algorithm A succeeds in existentially forging relative to the complex scheme
(G , S , V ). We consider the following two cases regarding the forging event, letting
( (i) , (i) ) denote the i-th query and answer pair made by A , and (, ) denote the
forged document-signature pair that A outputs (in case of success):
Case 1: h r () = h r ( (i) ) for all is. (That is, the hash-value used in the forged signature
is different from all hash-values used in the queries to Ss .) In this case, the pair
(h r (), ) constitutes a success in existential forgery relative to the -restricted
scheme.
Case 2: h r () = h r ( (i) ) for some i. (That is, the hash-value used in the forged signature equals the hash-value used in the i-th query to Ss , although = (i) .) In this
case, the pair (, (i) ) forms a collision under h r (and we do not obtain success in
existential forgery relative to the -restricted scheme).
Thus, if Case 1 occurs with probability at least (n)/2, then A succeeds in its attack
on (G, S, V ) with probability at least (n)/2, which contradicts the security of the
-restricted scheme (G, S, V ). On the other hand, if Case 2 occurs with probability
at least (n)/2, then we derive a contradiction to the collision-freeness of the hashing
collection {h r : {0, 1} {0, 1}(|r |) }r {0,1} . Details (regarding the second case) follow.
We construct an algorithm, denoted B, that given r I (1n ), attempts to form collisions under h r as follows. On input r , algorithm B generates (s, v) G(1n ) and
emulates the attack of A on this instance of the -restricted scheme, with the exception
that B does not invoke algorithm I to obtain an index of a hash function but rather uses
the index r (given to it as input). Recall that A, in turn, emulates an attack of A on
, and that A answers the query q made by A by forwarding the
the signing-oracle Sr,s
query q = h r (q ) to Ss . Thus, B actually emulates the attack of A (on the signing-oracle
) and does so in a straightforward manner; that is, to answer query q made by A ,
Sr,s
algorithm B rst obtains q = h r (q ) (using its knowledge of r ) and then answers with
Ss (q) (using its knowledge of s). Finally, when A outputs a forged document-signature
pair, algorithm B checks whether Case 2 occurs (i.e., whether h r () = h r ( (i) ) holds
for some i), in which case it obtains (and outputs) a collision under hr . (Note that in
the public-key case, B invokes A on input (r, v), whereas in the private-key case, B
invokes A on input 1n . Thus, in the private-key case, B actually does not use r but
rather only uses an oracle access to hr .)
We stress that from the point of view of the emulated adversary A, the execution is distributed exactly as in its attack on (G, S, V ). Thus, since we assumed that
515
the second case occurs with probability at least (n)/2 in a real attack, it follows
that B succeeds in forming a collision under h I (1n ) with probability at least (n)/2.
This contradicts the collision-freeness of the hashing functions, and the proposition
follows.
Comment. For the private-key case, the proof of Proposition 6.2.7 actually established
a stronger claim than stated. Specically, the proof holds even for a weaker denition of
collision-free hashing in which the adversary is not given a description of the hashing
function, but can rather obtain its value at any pre-image of its choice. This observation
is further pursued in Section 6.3.1.3.
On Using the Hash-and-Sign Paradigm in Practice. The hash-and-sign paradigm,
underlying Construction 6.2.6, is often used in practice. Specically, a document is
signed using a two-stage process: First, the document is hashed into a (relatively) short
bit string, and next, a basic signature scheme is applied to the resulting string. One
appealing feature of this process is that the length of resulting signatures only depends
on the length of the signing-key (and is independent of the document being signed). We
stress that this process yields a secure signature scheme only if the hashing scheme is
collision-free (as dened previously). In Section 6.2.3, we present several constructions
of collision-free hashing functions (based on general assumptions). Alternatively, one
may indeed postulate that certain off-the-shelf products (such as MD5 or SHA) are
collision-free, but such assumptions need to be seriously examined (and indeed may
turn out false).7 We stress that using a hashing scheme, in the two-stage (hash-andsign) process, without seriously evaluating whether or not it is collision-free is a very
dangerous practice.
We comment that a variant on the hash-and-sign paradigm will be presented in
Construction 6.4.30. The two variants are compared in Section 6.4.3.4.
516
1
p(n)
Actually, as will become evident from the proof of Proposition 6.2.9, as far as
Construction 6.2.8 is concerned, the denition of claw-free permutations can be relaxed: We do not need an algorithm that, given an index s, generates a uniformly
distributed element in Ds ; any efcient algorithm that generates elements in Ds will do
(regardless of the distribution induced on Ds , and in particular, even if the algorithm
always outputs the same element in Ds ).
Proposition 6.2.9: Suppose that the collection of permutation pairs {( f s0 , f s1 )}s , together with the index-selecting algorithm I , constitutes a claw-free collection. Then,
the function ensemble {h (s,r ) : {0, 1} {0, 1}|r | }(s,r ){0,1} {0,1} as dened in Construction 6.2.8 constitutes a collision-free hashing with a range specifying function
satisfying (n + (n)) = (n).
Proof: Intuitively, forming collisions under h (s,r ) means nding two different sequences
of functions from { f s0 , f s1 } that (when applied to r ) yield the same image (e.g., f s1
f s0 f s0 (r ) = f s1 f s1 (r ) f s1 (r )). Since these two sequences cannot be a prex of one
another, it must be that somewhere along the process (of applying these f s s), the
application of two different functions yields the same image (i.e., a claw).
The proof is by a reducibility argument. Given an algorithm A that on input (s, r )
forms a collision under h (s,r ) , we construct an algorithm A that on input s forms a
claw for index s. On input s (supposedly generated by I (1n )), algorithm A selects r
(uniformly) in Ds , and invokes algorithm A on input (s, r ). Suppose that A outputs a
pair (x, x ) so that h (s,r ) (x) = h (s,r ) (x ) but x = x . Without loss of generality,8 assume
that the coding of x equals y1 yi1 0zi+1 z t , and that the coding of x equals
y1 yi1 1z i+1
z t . By the denition of h (s,r ) , it follows that
z
z
(6.1)
z
f s0 f szi+1 f sz t (r ) = f s1 f s i+1 f s t (r )
def
def
z
(6.2)
z
Let C(x) (resp., C(x )) denote the prex-free coding of x (resp., x ). Then C(x) is not a prex of C(x ), and
C(x ) is not a prex of C(x). It follows that C(x) = uv and C(x ) = uv , where v and v differ in their leftmost
bit. Without loss of generality, we may assume that the leftmost bit of v is 0, and the leftmost bit of v is 1.
518
1
p(n)
where the probability is taken over the internal coin tosses of algorithms I and A.
Indeed, we focus on the case (n) = poly(n), or else the hardness condition holds
vacuously (since no polynomial-time algorithm can print a pair of strings of superpolynomial length). On the other hand, we only care about the case (n) > (n) (otherwise the functions may be 1-1). Finally, recall that must be super-logarithmic.
Following is a simple construction of full-edge collision-free hashing based on any
2-restricted collision-free hashing (see also Figure 6.2).
Construction 6.2.11 (from 2-restricted CFH to full-edged CFH): Let {h s :
{0, 1}2(|s|) {0, 1}(|s|) }s{0,1} be a collection of functions. Consider the collection
{h s : {0, 1} {0, 1}2(|s|) }s{0,1} , where h s (x) is dened by the following process,
which we call block-chaining:
def
1. Break x into t = |x|/(|s|) consecutive blocks, while possibly padding the last
block with 0s, such that each block has length (|s|). Denote these (|s|)-bit long
blocks by x1 , ..., xt . That is, x 1 x t = x0t(|s|)|x| .
X1
X2
y1
hs
X3
y2
hs
X4
y3
hs
X5
y4
hs
X6
y5
hs
X7
y6
hs
519
y7
For the sake of uniformity, in case |x| (|s|), we let t = 2 and x 1 x2 = x02(|s|)|x| .
On the other hand, we may assume that |x| < 2(|s|) , and so |x| can be represented
by an (|s|)-bit long string.9
def
2. Let y1 = x1 . For i = 2, ..., t, compute yi = h s (yi1 xi ).
3. Set h s (x) to equal (yt , |x|).
An interesting property of Construction 6.2.11 is that it allows for computing the hashvalue of an input string while processing the input in an on-line fashion; that is, the
implementation of the hashing process may process the input x in a block-by-block
manner, while storing only the current block and a small amount of state information
(i.e., the current yi and the number of blocks encountered so far). This property is
important in applications in which one wishes to hash a long stream of input bits.
Proposition 6.2.12: Let {h s : {0, 1}2(|s|) {0, 1}(|s|) }s{0,1} and {h s : {0, 1}
{0, 1}2(|s|) }s{0,1} be as in Construction 6.2.11, and suppose that the former is a collection of 2-restricted collision-free hashing functions. Then the latter constitutes a
(full-edged) collection of collision-free hashing functions.
Proof: Recall that forming a collision under h s means nding x = x such that h s (x) =
h s (x ). By the denition of h s , this means that (yt , |x|) = h s (x) = h s (x ) = (yt , |x |),
where t, t and yt , yt are determined by h s (x) and h s (x ). In particular, it follows that
|x| = |x | and so t = t (where, except when |x| (|s|), it holds that t = |x|/(|s|) =
|x |/(|s|) = t ). Recall that yt = yt and consider two cases:
, x t ), then we obtain a collision under h s (since
Case 1: If (yt1 , xt ) = (yt1
h s (yt1 xt ) = yt = yt = h s (yt1
x t )), and derive a contradiction to its collision-free
hypothesis.
Case 2: Otherwise (yt1 , x t ) = (yt1
, x t ), and we consider the two corresponding cases
, xt1
); that is, we further consider
with respect to the relation of (yt2 , x t1 ) to (yt2
whether or not (yt2 , xt1 ) equals (yt2 , x t1 ).
The adversary trying to form collisions with respect to h s runs in poly(|s|)-time. Using (|s|) = (log |s|), it
follows that such an adversary cannot output a string of length 2(|s|) . (The same also holds, of course, for
legitimate usage of the hashing function.)
520
2. A (s) computes t, x1 , ..., x t and y1 , ..., yt (resp., t , x1 , ..., xt and y1 , ..., yt ) as
in Construction 6.2.11. Next, A (s) nds an i {2, ..., t} such that yi = yi and
, xi ), and outputs the pair (yi1 xi , yi1
xi ). (We will show next that
(yi1 , xi ) = (yi1
such an i indeed exists.)
Note that (since h s (x) = h s (x )) it holds that t = t and yt = yt . On the other hand,
(x1 , ..., x t ) = (x1 , ..., xt ). As argued in the motivating discussion, it follows that there
, xi ).
exists an i {2, ..., t} such that yi = yi and (yi1 , xi ) = (yi1
On the existence of a suitable i (more details): Suppose, toward the contra-
diction that, for every i {2, ..., t}, it holds that either yi = yi or (yi1 , xi ) =
(yi1
, xi ). Using the hypothesis yt = yt , it follows (by descending induction on
j) that (y j1 , x j ) = (y j1 , x j ), for j = t, ..., 2. Using y1 = x 1 and y1 = x1 , it
follows that x j = x j for every j = 1, ..., t, which contradicts the hypothesis
(x1 , ..., x t ) = (x 1 , ..., xt ).
Clearly, the output pair (yi1 xi , yi1
xi ) constitutes a collision under h s (because
xi ).
h s (yi1 xi ) = yi = yi = h s (yi1 xi ), whereas yi1 xi = yi1
Thus, whenever A(s) forms a collision under h s , it holds that A (s) outputs a pair of
2(s)-bit long strings that form a collision under h s . The proposition follows.
Variants on Construction 6.2.11. The said construction can be generalized to use
any (non-trivial) length-restricted collision-free hashing. That is, for any > , let
{h s : {0, 1} (|s|) {0, 1}(|s|) }s{0,1} be a collection of -restricted collision-free hashing functions, and consider a parsing of the input string x into a sequence x1 , ..., x t
of ( (|s|) (|s|))-bit long blocks. Then we get a full-edged collision-free hashing
family {h s : {0, 1} {0, 1}2(|s|) } by letting h s (x) = (yt , |x|), where yi = h s (yi1 xi )
for i = 2, ..., t. (Construction 6.2.11 is obtained as a special case, for (n) = 2(n).) In
case (n) (n) = (log n), we obtain another variant by letting h s (x) = h s (yt , |x|)
(rather than h s (x) = (yt , |x|)), where yt is as in Construction 6.2.11. The latter variant is
quite popular. In establishing its security, when considering a collision h s (x) = h s (x ),
we distinguish the case (yt , |x|) = (yt , |x |) (which is handled as in the proof of
Proposition 6.2.12) from the case (yt , |x|) = (yt , |x |) (which yields an immediate collision under h s ).
X1
X2
y3,1
X3
X4
3,2
3,3
hs
X5
3,4
X8
3,6
3,7
hs
3,8
hs
2,1
X7
3,5
hs
y
X6
2,2
2,3
hs
2,4
hs
y
1,1
1,2
hs
y
0,1
1. Break x into t = 2log2 (|x|/(|s|)) consecutive blocks, while possibly adding dummy
0-blocks and padding the last block with 0s, such that each block has length (|s|).
Denote these (|s|)-bit long blocks by x 1 , ..., xt . That is, x 1 x t = x0t(|s|)|x| .
Let d = log2 t, and note that d is a positive integer.
Again, for the sake of uniformity, in case |x| (|s|), we let t = 2 and x 1 x 2 =
x02(|s|)|x| . On the other hand, again, we assume that |x| < 2(|s|) , and so |x| can be
represented by an (|s|)-bit long string.
def
2. For i = 1, ..., t, let yd,i = xi .
3. For j = d 1, ..., 1, 0 and i = 1, ..., 2 j , compute y j,i = h s (y j+1,2i1 y j+1,2i ).
4. Set h s (x) to equal (y0,1 , |x|).
That is, hashing is performed by placing the (|s|)-bit long blocks of x at the leaves of
a binary tree of depth d, and computing the values of internal nodes by applying h s to
the values associated with the two children (of the node). The nal hash-value consists
of the value associated with the root (i.e., the only level-0 node) and the length of x.
Proposition 6.2.14: Let {h s : {0, 1}2(|s|) {0, 1}(|s|) }s{0,1} and {h s : {0, 1}
{0, 1}2(|s|) }s{0,1} be as in Construction 6.2.13, and suppose that the former is a collection of 2-restricted collision-free hashing functions. Then the latter constitutes a
(full-edged) collection of collision-free hashing functions.
Proof Sketch: Recall that forming a collision under h s means nding x = x such that
h s (x) = h s (x ). By the denition of h s , this means that (y0,1 , |x|) = h s (x) = h s (x ) =
(y0,1
, |x |), where (t, d) and y0,1 (resp., (t , d ) and y0,1
) are determined by h s (x) (resp.,
h s (x )). In particular, it follows that |x| = |x | and so d = d (because 2d = t = t =
522
2d ). Recall that y0,1 = y0,1
, and let us state this fact by saying that for j = 0 and for
j
every i {1, ..., 2 }, it holds that y j,i = y j,i . Starting with j = 0, we consider two cases
(for level j + 1 in the tree):
Case 1: If for some i {1, ..., 2 j+1 } it holds that y j+1,i = y j+1,i , then we obtain a
collision under h s , and derive a contradiction to its collision-free hypothesis. Specifdef
ically, the collision is obtained because z = y j+1,2i/21 y j+1,2i/2 is different from
def
measured in terms of the length of the signatures and the time it takes to produce and
verify them.
An Alternative Presentation. Construction 6.3.4 was analyzed by invoking the hashand-sign paradigm (i.e., Proposition 6.2.7), while referring to the xed-length MAC
arising from the pseudorandom function ensemble { f s : {0, 1}|s| {0, 1}|s| }s{0,1} . An
alternative analysis may proceed by rst establishing that {gs,r = f s h r }s{0,1} ,r I (1|s| )
is a generalized pseudorandom function (as per Denition 3.6.12), and next observing
that any such ensemble yields a full-edged MAC (see Exercise 8).
r Since we are in the private-key setting, the adversary does not get the description
of the hash function used in the hash-and-sign process. Furthermore, applying the
pseudorandom function to the hash-value hides it from the adversary. Thus, when
trying to form collisions under the hash function, the adversary is in total darkness
and may only rely on the collision probability of the hashing function (as dened
next). (Recall that in case the adversary fails to form a collision, it must succeed in
forging with respect to the length-restricted scheme if it wishes to forge with respect
to the full-edged scheme.)
r Using an ordinary hashing instead of a collision-free hash function means that the
only intractability assumption used is the existence of pseudorandom functions (or,
equivalently, of one-way functions).
The reason that applying an ordinary hashing, rather than a collision-free hash function, may yield an efciency improvement is that the former is likely to be more
efcient than the latter. This is to be expected, given that ordinary hashing need only
satisfy a weak (probabilistic) condition, whereas collision-free hashing refers to a
more complicated (intractability) condition.10
By ordinary hashing we mean function ensembles as dened in Section 3.5.1.1 of
Volume 1. For starters, recall that these are collections of functions mapping (n)bit strings to m(n)-bit strings. These collections are associated with a set of strings,
m(n)
m(n)
m(n)
denoted S(n) , and we may assume that S(n) {0, 1}n . Specically, we call {S(n) }nN
10
This intuition may not hold when comparing a construction of ordinary hashing that is rigorously analyzed with an ad hoc suggestion of a collision-free hashing. But it certainly holds when comparing the
former to the constructions of collision-free hashing that are based on a well-established intractability
assumption.
527
In fact, for the current application, we can replace the third condition by the following
weaker condition, parameterized by a function cp : N [0, 1] (s.t. cp(n) 2m(n) ): For
every x = y {0, 1}(n) ,
Prh [h(x) = h(y)] cp(n)
(6.3)
Indeed, the pairwise independence condition implies that Eq. (6.3) is satised with
m(n)
cp(n) = 2m(n) . Note that Eq. (6.3) asserts that the collision probability of S(n)
is
at most cp(n), where the collision probability refers to the probability that h(x) =
m(n)
h(y) when h is uniformly selected in S(n) and x = y {0, 1}(n) are arbitrary xed
strings.
Hashing ensembles with n (n) + m(n) and cp(n) = 2m(n) can be constructed
(for a variety of functions , m : N N, e.g., (n) = 2n/3 and m(n) = n/3); see Exercise 22. Using such ensembles, we rst present a construction of length-restricted
message-authentication schemes (and later show how to generalize the construction to
obtain full-edged message-authentication schemes).
Construction 6.3.5 (Construction 6.3.4, revisited length-restricted version): Let
{h r : {0, 1}(|r |) {0, 1}m(|r |) }r {0,1} and { f s : {0, 1}m(|s|) {0, 1}m(|s|) }s{0,1} be efciently computable function ensembles. We construct the following -restricted scheme,
(G, S, V ):
Key-generation with G: On input 1n , algorithm G selects independently and uniformly
r, s {0, 1}n . The key-pair output by G is ((r, s), (r, s)).
Signing with S: On input a signing-key (r, s) in the range of G 1 (1n ) and a document
{0, 1}(n) , algorithm S outputs the signature/tag f s (h r ()).
Verication with V : On input a verifying-key (r, s) in the range of G 2 (1n ), a document {0, 1}(n) , and an alleged signature , algorithm outputs 1 if and only if
f s (h r ()) = .
Note that a generalization of Construction 6.3.5 in which the pseudorandom function is
replaced by an arbitrary (length-restricted) secure message-authentication scheme may
be insecure; see Exercise 9.
Proposition 6.3.6: Suppose that { f s : {0, 1}m(|s|) {0, 1}m(|s|) }s{0,1} is a pseudorandom function, and that the collision probability of the collection {h r : {0, 1}(|r |)
528
It follows that any adversary attacking the ideal scheme may succeed in existential
forgery with at most negligible probability (provided it makes at most polynomially
many queries). The same must hold for any efcient adversary that attacks the actual
scheme, since otherwise such an adversary yields a violation of the pseudorandomness
of { f s : {0, 1}m(|s|) {0, 1}m(|s|) }s{0,1} . The exact implementation of this argument
follows the details given in the proof of Proposition 6.3.2.
529
Obtaining Full-Fledged MACs. Construction 6.3.5 can be generalized to obtain fulledged MACs by using generalized hashing families that map arbitrary strings (rather
than xed-length ones) to xed-length strings. Specically, for : N N and cp :
N [0,1], we call {h r : {0, 1} {0, 1}m(|r |) }nN a generalized hashing ensemble
with a (, cp)-collision property if it satises the following two conditions:
1. Efcient evaluation: There exists a polynomial-time algorithm that, on input r (representing the function h r ) and a string x {0, 1} , returns h r (x).
2. Collision probability:11 For every n N and x = y such that |x|, |y| (n), the
probability that h r (x) = h r (y) when r is uniformly selected in {0, 1}n is at most
cp(n).
For our construction of a full-edged MAC, we need a generalized hashing ensemble
with an (, cp)-collision property for some super-polynomial (n) and negligible cp(n)
(e.g., (n) = 1/cp(n) = 2n for some constant > 0). The existence of such ensembles
will be discussed after the proof of Proposition 6.3.7.
Proposition 6.3.7 (Construction 6.3.4, revisited full-edged version): Suppose that
{ f s : {0, 1}m(|s|) {0, 1}m(|s|) }s{0,1} is a pseudorandom function ensemble. For some
super-polynomial : N N and negligible cp : N [0, 1], suppose that {h r :
{0, 1} {0, 1}m(|r |) }r {0,1} is a generalized hashing ensemble with an (, cp)-collision
property. Then (G, S, V ) as in Construction 6.3.4 constitutes a secure MAC. That is,
we refer to the following scheme:
Key-generation with G: On input 1n , algorithm G selects independently and uniformly
r, s {0, 1}n , and outputs ((r, s), (r, s)).
Signing with S: On input a signing-key (r, s) and a document {0, 1} , algorithm
S outputs the signature/tag f s (h r ()).
Verication with V : On input a verifying-key (r, s), a document {0, 1} , and an
alleged signature , algorithm outputs 1 if and only if f s (h r ()) = .
Proof Sketch: The proof is identical to the proof of Proposition 6.3.6, except that here
the (polynomial-time) adversary attacking the scheme may query for the signatures
of strings of various lengths. Still, all these queries (as well as the nal output) are
of polynomial length and thus shorter than (n). Thus, the (, cp)-collision property
implies that, except with negligible probability, all these queries (as well as the relevant
part of the output) are hashed to different values.
Note that it is essential to restrict the collision condition to strings of bounded length. In contrast, for every nite
family of functions H , there exist two different strings that are mapped to the same image by each function in
H . For details, see Exercise 21.
530
hashing ensembles, see Section 6.6.5. Combining any of these constructions with
Proposition 6.3.7, we get:
Theorem 6.3.8: Assuming the existence of one-way functions, there exist messageauthentication schemes with xed-length signatures; that is, signatures of length that
depend on the length of the signing-key but not on the length of the document.
An Alternative Presentation. The proofs of Propositions 6.3.6 and 6.3.7 actually
establish that {gs,r = f s h r }s{0,1} ,r {0,1}|s| is a generalized pseudorandom function
(as per Denition 3.6.12). For further discussion of this aspect, see Section C.2 in
Appendix C. Hence, the actual claim of these propositions (i.e., the security of the
constructed MAC) can be derived from the fact that any generalized pseudorandom
function yields a full-edged MAC (see Exercise 8).
We comment that this specic hiding method is not 1-1, and furthermore, it is not clear whether it can also be
efciently inverted when given the secret key (i.e., the seed of the pseudorandom function). In contrast, the
alternative hiding method described next is 1-1 and can be efciently inverted when given the secret key.
13 The hashing function should belong to an AXU family, as dened in Section 6.3.2.2.
531
then show how to construct them based on the hash-and-hide (or rather tag-and-hide)
paradigm.
Alternatively, we may decompose the verication (resp., signing) algorithm into two algorithms, where the rst
takes care of the actual verication (resp., signing) and the second takes care of updating the state. For details,
see Exercise 18.
532
That is, as in Denition 6.1.1, the signing-verication process operates properly provided that the corresponding algorithms get the corresponding keys (states). Note that
in Denition 6.3.9, the keys are modied by the signing-verication process, and so
correct verication requires holding the correctly updated verication-key. We stress
that the furthermore-clause in Condition 2 guarantees that the verication-key is correctly updated as long as the verication process is fed with strings of the correct lengths
(but not necessarily with the correct document-signature pairs). This extra requirement
implies that, given the initial verication-key and the current document-signature pair,
as well as the lengths of all previous pairs (which may be actually incorporated in
the current signature), one may correctly decide whether or not the current documentsignature pair is valid. As in the case of state-based ciphers (cf. Section 5.3.1), this fact
is interesting for two reasons:
A theoretical reason: It implies that without loss of generality (alas, with possible loss
in efciency), the verication algorithm may be stateless. Furthermore, without loss
of generality (alas, with possible loss in efciency), the state of the signing algorithm
may consist of the initial signing-key and the lengths of the messages signed so far.
(We assume here that the length of the signature is determined by the length of the
message and the length of the signing-key.)
A practical reason: It allows for recovery from the loss of some of the messagesignature pairs. That is, assuming that all messages have the same length (which
is typically the case in MAC applications), if the receiver knows (or is given) the
total number of messages sent so far, then it can verify the authenticity of the current
message-signature pair, even if some of the previous message-signature pairs were
lost.
We stress that Denition 6.3.9 refers to the signing of multiple messages (and
is meaningless when considering the signing of a single message). However, Denition 6.3.9 (by itself) does not explain why one should sign the i-th message using the updated signing-key s (i1) , rather than by reusing the initial signing-key s (0)
(where all corresponding verications are done by reusing the initial verication-key
v (0) ). Indeed, the reason for updating these keys is provided by the following security denition that refers to the signing of multiple messages, and holds only in case
the signing-keys in use are properly updated (in the multiple-message authentication
process).
during the attack, and V (v (i1) , , ) = (, 1) holds for some intermediate state
(verication-key) v (i1) (as in Denition 6.3.9).15
r A state-based MAC is secure if every probabilistic polynomial-time chosen message
attack as in the rst item succeeds with at most negligible probability.
Note that Denition 6.3.10 (only) differs from Denition 6.1.2 in the way that the
signatures (i) s are produced (i.e., using the updated signing-key s (i1) , rather than the
initial signing-key s (0) ). Furthermore, Denition 6.3.10 guarantees nothing regarding
a signing process in which the signature to the i-th message is obtained by invoking
S(s (0) , ) (as in Denition 6.1.2).
In fact, one may strengthen the denition by using a weaker notion of success in which it is only required that
= (i) (rather than requiring that { ( j) } j ). That is, the attack is successful if, for some i, it outputs a
pair (, ) such that = (i) and V (v (i1) , , ) = (, 1), where the ( j) s and v ( j) s are as in Denition 6.3.9.
The stronger denition provides replay protection (i.e., even if the adversary obtains a valid signature that
authenticates as the j-th message, it cannot produce a valid signature that authenticates as the i-th message,
unless was actually authenticated as the i-th message).
534
Key-generation and initial state: Uniformly select s, r {0, 1}n , and output the keypair ((s, r ), (s, r )). The initial state of each algorithm is set to (s, r, 0, s).
(We maintain the initial key (s, r ) and a step-counter in order to allow recovery from
loss of message-signature pairs.)
def
Signing message with state (s, r, t, s ): Let s0 = s . For i = 1, ..., m(n), compute
si i = g(si1 ), where |si | = n and i {0, 1}. Output the signature h r ()
1 m(n) , and set the new state to (s, r, t + m(n), sm(n) ).
Verication of the pair (, ) with respect to the state (s, r, t, s ): Compute 1 m(n)
and sm(n) as in the signing process; that is, for i = 1, ..., m(n), compute si i =
def
g(si1 ), where s0 = s . Set the new state to (s, r, t + m(n), sm(n) ), and accept if and
only if = hr () 1 m(n) .
Special recovery procedure: When notied that some message-signature pairs may
have been lost and that the current message-signature pair has index t , one rst
recovers the correct current state, which as in the ordinary verication (of the predef
vious paragraph) will be denoted s0 . This is done by setting st = s and computing
sit it = g(sit 1 ), for i = 1, ..., t . Indeed, recovery of s0 is required only if
t = t.16
Note that both the signing and verication algorithms are deterministic, and that the
state after authentication of t messages has length 3n + log2 (t m(n)) < 4n, provided
that t < 2n /m(n).
We now turn to the analysis of the security of Construction 6.3.11. The hashing
property of the collection of h r s should be slightly stronger than the one used in
Section 6.3.1.3. Specically, rather than a bound on the collision probability (i.e., the
probability that h r (x) = h r (y) for any relevant xed x, y and a random r ), we need
a bound on the probability that h r (x) h r (y) equals any xed string (again, for any
relevant xed x, y and a random r ). This property is commonly referred to by the name
Almost-Xor-Universal (AXU). That is, {h r : {0, 1} {0, 1}m(|r |) }r {0,1} is called an
(, )-AXU family if for every n N, every x = y such that |x|, |y| (n), and every
z, it holds that
Pr[h Un (x) h Un (y) = z] (n)
(6.4)
535
Hence, by the AXU property, the probability that the adversary succeeds is at most
(n).
536
The security of the real scheme follows (or else one could have distinguished
the sequence produced by iterating the next-step function g from a truly random
sequence).
Construction 6.3.11 Versus the Constructions of Section 6.3.1.3: Recall that all
these schemes are based on the hash-and-hide paradigm. The difference between the
schemes is that in Section 6.3.1.3, a pseudorandom function is applied to the hash-value
(i.e., the signature to is f s (h r ())), whereas in Construction 6.3.11, the hash-value
is XORed with a pseudorandom value (i.e., we may view the signature as consisting
of (c, h r () f s (c)), where c is a counter value and f s (c) is the c-th block produced
by iterating the next-step function g starting with the initial seed s). We note two advantages of the state-based MAC over the MACs presented in Section 6.3.1.3: First,
applying an on-line pseudorandom generator is likely to be more efcient than applying a pseudorandom function. Second, a counter allows for securely authenticating
more messages than can be securely authenticated by applying a pseudorandom function to the hashed value. Specically, the use of an an m-bit long counter allows for
securely authenticating 2m messages, whereas using an m-bit long
hash-value suffers
from the birthday effect (i.e., collisions are likely to occur when 2m messages are
authenticated). Indeed, these advantages are relevant only in applications in which using state-based MACs is possible, and are most advantageous in applications where
verication is performed in the same order as signing (e.g., in fifo communication).
In the latter case, Construction 6.3.11 offers another advantage: replay protection (as
discussed in footnote 15).
use them instead of collision-free hashing (in the aforementioned constructions and,
in particular, within a modied hash-and-sign paradigm). Indeed, the gain in using
universal one-way hashing (rather than collision-free hashing) is that the former can be
constructed based on any one-way function (whereas this is not known for collision-free
hashing). Thus, we obtain:
Theorem 6.4.1: Secure signature schemes exist if and only if one-way functions exist.
The difcult direction is to show that the existence of one-way functions implies the
existence of signature schemes. For the opposite direction, see Exercise 7.
6.4.1.1. Denitions
Loosely speaking, one-time signature schemes are signature schemes for which the
security requirement is restricted to attacks in which the adversary asks for at most
one string to be signed. That is, the mechanics of one-time signature schemes is as
of ordinary signature schemes (see Denition 6.1.1), but the security requirement is
relaxed as follows:
polynomial-time computable and length-preserving. We construct an -restricted onetime signature scheme, (G, S, V ), as follows:
0
1
, s(n)
{0, 1}n , and compute vi = f (si ), for i = 1, ..., (n) and j = 0, 1. We let s =
0
1
0
1
, s(n)
)), and v = ((v10 , v11 ), ..., (v(n)
, v(n)
)), and output the key-pair
((s10 , s11 ), ..., (s(n)
(s, v).
(Note that |s| = |v| = 2 (n) n.)
0
1
Signing with S: On input a signing-key s = ((s10 , s11 ), ..., (s(n)
, s(n)
)) and an (n)-bit
(n)
1
string = 1 (n) , we output (s1 , ..., s(n) ) as a signature of .
0
1
Verication with V : On input a verication-key v = ((v10 , v11 ), ..., (v(n)
, v(n)
)), an
(n)-bit string = 1 (n) , and an alleged signature = (1 , ..., (n) ), we accept if and only if vii = f (i ), for i = 1, ..., (n).
Proof of Proposition 6.4.5: Intuitively, forging a signature (after seeing at most one signature to a different message) requires inverting f on some random image (corresponding to a bit location on which the two (n)-bit long messages differ). The actual proof
is by a reducibility argument. Given an adversary A attacking the scheme (G, S, V ),
while making at most one query, we construct an algorithm A for inverting f .
As a warm-up, let us rst deal with the case in which A makes no queries at all. In
this case, on input y (supposedly in the range of f ), algorithm A proceeds as follows.
First A selects uniformly and independently a position p in {1, ..., (n)}, a bit b, and
0
1
, s(n)
. (Actually, s bp is not
a sequence of (2(n) many) n-bit long strings s10 , s11 , ..., s(n)
used and needs not be selected.) For every i {1, ..., (n)} \ { p}, and every j {0, 1},
j
j
algorithm A computes vi = f (si ). Algorithm A also computes v 1b
= f (s 1b
p
p ), and
0
1
0
1
b
sets v p = y and v = ((v1 , v1 ), ..., (v(n) , v(n) )). Note that if y = f (x), for a uniformly
distributed x {0, 1}n , then for each possible choice of p and b, the sequence v is
distributed identically to the public-key generated by G(1n ). Next, A invokes A on
input v, hoping that A will forge a signature, denoted = 1 (n) , to a message
= 1 (n) so that p = b. If this event occurs, A obtains a pre-image of y under
540
1 p
= v bp = y).
This follows from an even stronger statement by which conditioned on the value of v, on the internal coin tosses
of A, and on the value of p, the current case happens with probability 12 . The stronger statement holds because
under all these conditions, b is uniformly distributed in {0, 1} (and so p = b happens with probability exactly
1
2 ).
19 Recall that, without loss of generality, we may assume that A always makes a single query; see Exercise 11.
18
541
1 |{i : i = i }|
(n)
2
(n)
2(n)
it is not know whether collision-free hashing can be constructed based on any one-way
function. Wishing to construct signature schemes based on any one-way function, we
later avoid (in Section 6.4.3) the use of collision-free hashing. Instead, we use universal
one-way hashing functions (to be dened), and present a variant of Construction 6.2.6
that uses these functions, rather than collision-free ones.
the gain in terms of security is that a full-edged chosen message attack cannot be
launched on (G, S, V ). All that an attacker may obtain (via a chosen message attack
on the new scheme) is signatures, relative to the original signing-key s, to randomly
chosen strings (taken from the distribution G 2 (1n )), as well as additional signatures
each relative to a random and independently chosen signing-key.
We refrain from analyzing the features of the signature scheme presented in this
example. Instead, as a warm-up to the actual construction used in the next section (in
order to establish Theorem 6.4.9), we present and analyze a similar construction (which
is, in some sense, a hybrid of the two constructions). The reader may skip this warm-up,
and proceed directly to Section 6.4.2.2.
Construction 6.4.11 (a warm-up): Let (G, S, V ) be a signature scheme and
(G , S , V ) be a one-time signature scheme. Consider a signature scheme, (G , S , V ),
with G = G, as follows:
Signing with S : On input a signing-key s (in the range of G 1 (1n )) and a document
{0, 1} , rst invoke G to obtain (s , v ) G (1n ). Next, invoke S to obtain
1 Ss (v ), and S to obtain 2 Ss (). The nal output is (1 , v , 2 ).
Verication with V : On input a verifying-key v, a document {0, 1} , and an alleged signature = (1 , v , 2 ), we output 1 if and only if both Vv (v , 1 ) = 1 and
Vv (, 2 ) = 1.
Construction 6.4.11 differs from the previous example only in that a one-time signature
scheme is used to generate the second signature (rather than using the same ordinary
signature scheme). The use of a one-time signature scheme is natural here, because it
is unlikely that the same signing-key s will be selected in two invocations of S .
Proposition 6.4.12: Suppose that (G, S, V ) is a secure signature scheme, and that
(G , S , V ) is a secure one-time signature scheme. Then (G , S , V ), as dened in
Construction 6.4.11, is a secure signature scheme.
We comment that the proposition holds even if (G, S, V ) is secure only against attackers
that select queries according to the distribution G 2 (1n ). Furthermore, (G, S, V ) need
only be -restricted, for some suitable function : N N.
Proof Sketch: Consider an adversary A attacking the scheme (G , S , V ). We may
ignore the case in which two queries of A are answered by triplets containing the
same one-time verication-key v (because if this event occurs with non-negligible
probability, then the one-time scheme (G , S , V ) cannot be secure). We consider two
cases regarding the relation of the one-time verication-keys included in the signatures
provided by Ss and the one-time verication-key included in the signature forged by A .
1. In case, for some i, the one-time verication-key v contained in the forged message
equals the one-time verication-key v (i) contained in the answer to the i-th query,
we derive violation to the security of the one-time scheme (G , S , V ).
544
Specically, consider an adversary A that on input a verication-key v for the onetime scheme (G , S , V ), generates (s, v) G(1n ) at random, selects i at random
(among polynomially many possibilities), invokes A on input v, and answers its
queries as follows. The i-th query of A , denoted (i) , is answered by making the only
query to Ss , obtaining = Ss ( (i) ), and returning (Ss (v ), v , ) to A . (Note that A
holds s.) Each other query of A , denoted ( j) , is answered by invoking G to obtain
(s ( j) , v ( j) ) G (1n ), and returning (Ss (v ( j) ), v ( j) , Ss ( j) ( ( j) ) to A . If A answers
with a forged signature and v is the verication-key contained in it, then A obtains
a forged signature relative to the one-time scheme (G , S , V ) (i.e., a signature to a
message different from (i) , which is valid with respect to the verication-key v ).
Furthermore, conditioned on the case hypothesis and a forgery event, the second
event (i.e., v is the verication-key contained in the forged signature) occurs with
probability 1/poly(n). Note that, indeed, A makes at most one query to Ss , and that
the distribution seen by A is exactly as in an actual attack on (G , S , V ).
2. In case, for all i, the one-time verication-key v contained in the forged message is
different from the one-time verication-key v (i) contained in the answer to the i-th
query, we derive violation to the security of the scheme (G, S, V ).
Specically, consider an adversary A that on input a verication-key v for the scheme
(G, S, V ), invokes A on input v, and answers its queries as follows. To answer the
j-th query of A , denoted ( j) , algorithm A invokes G to obtain (s ( j) , v ( j) )
G (1n ), queries Ss for a signature to v ( j) , and returns (Ss (v ( j) ), v ( j) , Ss ( j) ( ( j) )) to A .
When A answers with a forged signature and v {v ( j) : j = 1, ..., poly(n)} is the
one-time verication-key contained in it, A obtains a forged signature relative to the
scheme (G, S, V ) (i.e., a signature to a string v different from all v ( j) s, which is
valid with respect to the verication-key v). (Note again that the distribution seen
by A is exactly as in an actual attack on (G , S , V ).)20
Thus, in both cases we derive a contradiction to some hypothesis, and the proposition
follows.
6.4.2.2. Authentication-Trees
The refreshing paradigm by itself (i.e., as employed in Construction 6.4.11) does not
seem to sufce for establishing Theorem 6.4.9. Recall that our aim is to construct
a general signature scheme based on a one-time signature scheme. The refreshing
paradigm suggests using a fresh instance of a one-time signature scheme in order to
sign the actual document; however, whenever we do so (as in Construction 6.4.11), we
must authenticate this fresh instance relative to the single verication-key that is public.
A straightforward implementation of this scheme (as presented in Construction 6.4.11)
calls for many signatures to be signed relative to the single verication-key that is
public, and so a one-time signature scheme cannot be used (for this purpose). Instead,
a more sophisticated method of authentication is called for.
20
Furthermore, all queries to Ss are distributed according to G 2 (1n ), justifying the comment made just before the
proof sketch.
545
x
sx
vx
+ authx
x0
x1
sx0 vx0
sx1
+ authx0
+ authx1
vx1
Let us try to sketch the basic idea underlying the new authentication method. The
idea is to use the public verication-key (of a one-time signature scheme) in order
to authenticate several (e.g., two) fresh instances (of the one-time signature scheme),
use each of these instances to authenticate several fresh instances, and so on. We
obtain a tree of fresh instances of the one-time signature, where each internal node
authenticates its children. We can now use the leaves of this tree in order to sign
actual documents, where each leaf is used at most once. Thus, a signature to an actual
document consists of (1) a one-time signature to this document authenticated with
respect to the verication-key associated with some leaf, and (2) a sequence of onetime verication-keys associated with the nodes along the path from the root to this leaf,
where each such verication-key is authenticated with respect to the verication-key
of its parent (see Figures 6.4 and 6.5). We stress that each instance of the one-time
signature scheme is used to sign at most one string (i.e., several verication-keys if the
instance resides in an internal node, and an actual document if the instance resides in a
leaf).
This description may leave the reader wondering how one actually signs (and veries
signatures) using the process outlined here. We start with a description that does not t
our denition of a signature scheme, because it requires the signer to keep a record of
its actions during all previous invocations of the signing process.21 We refer to such a
scheme as memory dependent, and dene this notion rst.
21
546
+ auth
1
s0
s1
v0
+ auth 0
v1
+ auth1
00
01
s00 v00
s01 v01
+ auth 00
+ auth 01
010
011
s010 v010
s011 v011
+ auth 010
+ auth 011
to (public-key) signature schemes, whereas Denition 6.3.10 refers to MACs. Second, in Denition 6.4.13, only the signing algorithm is state-based (or memorydependent), whereas in Denition 6.3.10 also the verication algorithm is statebased. The latter difference reects the difference in the applications envisioned for
both types of schemes. (Typically, MACs are intended for communication between
a predetermined set of mutually synchronized parties, whereas signature schemes
are intended for production of signatures that may be universally veriable at any
time.)
We note that memory-dependent signature schemes may sufce in many applications
of signature schemes. Still, it is preferable to have memoryless (i.e., ordinary) signature schemes. In the following, we use any one-time signature schemes to construct a
memory-dependent signature scheme. The memory requirement will be removed in the
next section, so as to obtain a (memoryless) signature scheme (as in Denition 6.1.1).
The memory-dependent signature scheme presented (in Construction 6.4.14) maintains a binary tree of depth n, associating to each node an instance of a one-time
signature scheme. Each node in the tree is labeled by a binary string, denoted 1 i
for some i {0, 1, ..., n}, and is associated with a (signing and verication) key-pair,
denoted (s1 i , v1 i ). The root of the tree is labeled by the empty string, , and
the verication-key v associated with it is used as the verication-key of the entire (memory-dependent) signature scheme. The children of an internal node labeled
1 i are labeled 1 i 0 and 1 i 1, and their verication-keys (i.e., v1 i 0
and v1 i 1 ) are authenticated with respect to the verication-key v1 i . With the exception of the (one-time) instance associated with the root of the tree, all the other
instances are generated (when needed) on the y, and are stored in memory (along with
their authentication with respect to their parents). A new document is signed by allocating a new leaf, authenticating the actual document with respect to the verication-key
associated with this leaf, and authenticating each relevant verication-key with respect
to the verication-key associated with its parent. The relevant key-pairs (as well as their
authentication with respect to their parents) are generated on the y, unless they are
already stored in memory (which means that they were generated in the course of signing a previous document). Thus, the verication-key associated with the relevant leaf
is authenticated with respect to the verication-key associated with its parent, which in
turn is authenticated with respect to the verication-key associated with its own parent, and so on up to the authentication (of the verication-keys of the roots children)
with respect to the verication-key associated with the root. The latter sequence of
authentications (of each nodes verication-key with respect to the verication-key of
its parent) is called an authentication path (see Figure 6.5). We stress that the (one-time)
instance associated with each node is used to authenticate at most one string. A formal
description of this memory-dependent signature scheme follows:
Construction 6.4.14 (a memory-dependent signature scheme): Let (G, S, V ) be a onetime signature scheme. Consider the following memory-dependent signature scheme,
(G , S , V ), with G = G. On security parameter n, the scheme uses a full binary tree
of depth n. Each of the nodes in this tree is labeled by a binary string so that the root is
labeled by the empty string, denoted , and the left (resp., right) child of a node labeled
548
by x is labeled by x0 (resp., x1). Here we refer to the current state of the signing process
as to a record.
Initiating the scheme: To initiate the scheme, on security parameter n, we invoke G(1n )
and let (s, v) G(1n ). We record (s, v) as the key-pair associated with the root,
and output v as the (public) verication-key.
In the rest of the description, we denote by (sx , vx ) the key-pair associated with the
node labeled x; thus, (s , v ) = (s, v).
Signing with S using the current record: Recall that the current record contains the
signing-key s = s , which is used to produce auth (dened in the sequel).
To sign a new document, denoted , we rst allocate an unused leaf. Let 1 n be
the label of this leaf. For example, we may keep a counter of the number of documents
signed, and determine 1 n according to the counter value (e.g., if the counter
value is c, then we use the c-th string in lexicographic order).22
Next, for every i = 1, ..., n and every {0, 1}, we try to retrieve from our record
the key-pair associated with the node labeled 1 i1 . In case such a pair is not
found, we generate it by invoking G(1n ) and store it (i.e., add it to our record) for
future use; that is, we let (s1 i1 , v1 i1 ) G(1n ).
Next, for every i = 1, ..., n, we try to retrieve from our record a signature to the
string v1 i1 0 v1 i1 1 relative to the signing-key s1 i1 . In case such a signature
is not found, we generate it by invoking Ss1 i1 , and store it for future use; that
is, we obtain Ss1 i1 (v1 i1 0 v1 i1 1 ). (The ability to retrieve this signature from
memory, for repeated use, is the most important place in which we rely on the memory
dependence of our signature scheme.)23 We let
def
auth1 i1 = v1 i1 0 , v1 i1 1 , Ss1 i1 (v1 i1 0 v1 i1 1 )
(Intuitively, via auth1 i1 , the node labeled 1 i1 authenticates the
verication-keys associated with its children.)
Finally, we sign by invoking Ss1 n , and output
(1 n , auth , auth1 , ..., auth1 n1 , Ss1 n ())
Verication with V : On input a verication-key v, a document , and an alleged
signature , we accept if and only if the following conditions hold:
1. has the form
(1 n , (v0,0 , v0,1 , 0 ), (v1,0 , v1,1 , 1 ), ..., (vn1,0 , vn1,1 , n1 ), n )
22
Alternatively, as done in Construction 6.4.16, we may select the leaf at random (while ignoring the negligible
probability that the selected leaf is not unused).
23 This allows the signing process S to use each (one-time) signing-key s for producing a single S -signature.
x
sx
s
In contrast, the use of a counter for determining a new leaf can be easily avoided, by selecting a leaf at random.
549
where the i s are bits and all other symbols represent strings.
(Jumping ahead, we mention that vi, is supposed to equal v1 i ; that is,
the verication-key associated by the signing process with the node labeled
1 i . In particular, vi1,i is supposed to equal v1 i .)
2. Vv (v0,0 v0,1 , 0 ) = 1.
(That is, the public-key (i.e., v) authenticates the two strings v0,0 and v0,1 claimed
to correspond to the instances of the one-time signature scheme associated with
the nodes labeled 0 and 1, respectively.)
3. For i = 1, ..., n 1, it holds that Vvi1,i (vi,0 vi,1 , i ) = 1.
(That is, the verication-key vi1,i , which is already believed to be authentic
and supposedly corresponds to the instance of the one-time signature scheme
associated with the node labeled 1 i , authenticates the two strings vi,0 and
vi,1 that are supposed to correspond to the instances of the one-time signature
scheme associated with the nodes labeled 1 i 0 and 1 i 1, respectively.)
4. Vvn1,n (, n ) = 1.
(That is, the verication-key vn1,n , which is already believed to be authentic,
authenticates the actual document .)
Regarding the verication algorithm, note that Conditions 2 and 3 establish that vi,i+1 is
authentic (i.e., equals v1 i i+1 ). That is, v = v authenticates v1 , which authenticates
v1 2 , and so on up-to v1 n . The fact that the vi, i+1 s are also proven to be authentic
(i.e., equal to the v1 i i+1 s, where = 1 ) is not really useful (when signing a
message using the leaf associated with 1 n ). This excess is merely an artifact of
the need to use s1 i only once during the entire operation of the memory-dependent
signature scheme: In the currently (constructed) Ss -signature, we may not care about the
authenticity of some v1 i i+1 , but we may care about it in some other Ss -signatures.
For example, if we use the leaf labeled 0n to sign the rst document and the leaf
labeled 0n1 1 to sign the second, then in the rst Ss -signature we care only about the
authenticity of v0n , whereas in the second Ss -signature we care about the authenticity
of v0n1 1 .
Proposition 6.4.15: If (G, S, V ) is a secure one-time signature scheme, then Construction 6.4.14 constitutes a secure memory-dependent signature scheme.
Proof: Recall that a Ss -signature to a document has the form
(1 n , auth , auth1 , ..., auth1 n1 , Ss1 n ())
where the authx s, vx s, and sx s satisfy
(6.5)
(6.6)
(See Figure 6.4.) In this case, we say that this Ss -signature uses the leaf labeled
1 n . For every i = 1, ..., n, we call the sequence (auth , auth1 , ..., auth1 i1 )
550
an authentication path for v1 i ; see Figure 6.5. (Note that this sequence is also an
authentication path for v1 i1 i , where = 1 .) Thus, a valid Ss -signature to a
document consists of an n-bit string 1 n , authentication paths for each v1 i
(i = 1, ..., n), and a signature to with respect to the one-time scheme (G, S, V ) using
the signing-key s1 n .
Intuitively, forging an Ss -signature requires either using only verication-keys supplied by the signer (i.e., supplied by Ss as part of an answer to a query) or producing
an authentication path for a verication-key that is different from all verication-keys
supplied by the signer. In both cases, we reach a contradiction to the security of the onetime signature scheme (G, S, V ). Specically, in the rst case, the forged Ss -signature
contains a one-time signature that is valid with respect to the one-time verication-key
associated by the signing process with a leaf labeled 1 n , because by the cases
hypothesis, the forged signature utilizes only verication-keys supplied by the signer.
This yields forgery with respect to the instance of the one-time signature scheme associated with the leaf labeled 1 n (because the document that is Ss -signed by the
forger must be different from all Ss -signed documents, and thus the forged document
is different from all strings to which a one-time signature associated with a leaf was
applied).24 We now turn to the second case (i.e., forgery with respect to (G , S , V ) is
obtained by producing an authentication path for a verication-key that is different from
all verication-keys supplied by the signer). As in the rst case, we denote by 1 n
the label of the leaf used for the (forged) signature. Let i {0, ..., n 1} be the largest
integer such that the signature produced by the forger refers to the verication-key
v1 i (as supplied by the signer), rather than to a different value (claimed by the forger
to be the verication-key associated with the node labeled 1 i ). (Note that i = 0
corresponds to the forger not even using v1 , whereas i < n by the case hypothesis.)
, vi,1
, i ) that is contained in the Ss -signature proFor this i, the triple auth1 i = (vi,0
duced by the forger contains a one-time signature (i.e., i ) that is valid with respect to
the one-time verication-key associated by the signing process with the node labeled
1 i (where v is always used by the signing process). Furthermore, by maximality
vi,1
) that is different from the string
of i, the latter signature is to a string (i.e., vi,0
to which the Ss -signer has applied Ss1 i (i.e., vi,
= v1 i+1 ). This yields forgery
i+1
with respect to the instance of the one-time signature scheme associated with the node
labeled 1 i .
The actual proof is by a reducibility argument. Given an adversary A attacking the
complex scheme (G , S , V ), we construct an adversary A that attacks the one-time
signature scheme, (G, S, V ). In particular, the adversary A will use its (one-time) oracle
access to Ss in order to emulate the memory-dependent signing oracle for A . We stress
that the adversary A may make at most one query to its Ss -oracle. Following is a detailed
description of the adversary A. Since we care only about probabilistic polynomial-time
adversaries, we may assume that A makes at most t = poly(n) many queries, where n
is the security parameter.
24
Note that what matters is merely that the document Ss -signed by the forger is different from the (single) document
to which Ss1n was applied by the Ss -signer, in case Ss1n was ever applied by the Ss -signer.
551
adds it to its record. In this case, A does not know s1 i1 , which is dened to
equal s, yet A can obtain a single signature relative to s by making a (single)
query to its own oracle (i.e., the oracle Ss ).
From this point on, the one-time instance associated with the node labeled
1 i1 will be called the j-th instance.
ii. Otherwise (i.e., the current instance is not the j-th one to be encountered), A
acts as the signing process: It invokes G(1n ), obtains (s1 i1 , v1 i1 )
G(1n ), and adds it to the record. (Note that in this case, A knows s1 i1
and can generate by itself signatures relative to it.)
The one-time instance just generated is given the next serial number. That
is, the one-time instance associated with the node labeled 1 i1 will
be called the k-th instance if the current record (i.e., after the generation of
the one-time key-pair associated with the node labeled 1 i1 ) contains
exactly k instances.
(c) For every i = 1, ..., n, machine A tries to retrieve from its record a (one-time)
signature to the string v1i1 0 v1i1 1 , relative to the signing-key s1i1 .
If such a signature does not exist in the record then A distinguishes two
cases:
i. If the one-time signature instance associated with the node labeled
1 i1 is the j-th such instance, then A obtains the one-time signature Ss1i1 (v1i1 0 v1i1 1 ) by querying Ss , and adds this signature to
the record.
Note that by the previous steps (i.e., Step 3(b)i as well as Step 2), s is identied
with s1i1 , and that the instance associated with a node labeled 1 i1 is
only used to produce a single signature; that is, to the string v1i1 0 v1i1 1 .
Thus, in this case, A queries Ss at most once.
We stress that this makes crucial use of the fact that, for every , the
verication-key associated with the node labeled 1 i1 is identical in all
executions of the current step. This fact guarantees that A only needs a single
signature relative to the instance associated with a node labeled 1 i1 ,
and thus queries Ss at most once (and retrieves this signature from memory
if it ever needs this signature again).
ii. Otherwise (i.e., the one-time signature instance associated with the node
labeled 1 i1 is not the j-th such instance), A acts as the signing process:
It invokes Ss1i1 , obtains the one-time signature Ss1i1 (v1i1 0 v1i1 1 ),
and adds it to the record. (Note that in this case, A knows s1i1 and can
generate by itself signatures relative to it.)
Thus, in both cases, A obtains auth1i1 = (v1i1 0 , v1i1 1 , i1 ), where
i1 = Ss1i1 (v1i1 0 v1i1 1 ).
(d) Machine A now obtains a one-time signature of relative to Ss1n . (Since
a new leaf is allocated for each query made by A , we need to generate at
most one signature relative to the one-time instance Ss1n associated with the
553
leaf 1 n .) This is done analogously to the previous step (i.e., Step 3c).
Specically:
i. If the one-time signature instance associated with the (leaf) node labeled
1 n is the j-th instance, then A obtains the one-time signature Ss1n ()
by querying Ss .
Note that in this case, s is identied with s1n , and that an instance associated
with a leaf is only used to produce a single signature. Thus, also in this case
(which is disjoint of Case 3(c)i), A queries Ss at most once.
ii. Otherwise (i.e., the one-time signature instance associated with the node
labeled 1 n is not the j-th instance), A acts as the signing process: It
invokes Ss1n and obtains the one-time signature Ss1n (). (Again, in this
case A knows s1n and can generate by itself signatures relative to it.)
Thus, in both cases, A obtains n = Ss1n ().
(e) Finally, A answers the query with
(1 n , auth , auth1 , ..., auth1n1 , n )
4. Using the output of A : When A halts with output ( , ), machine A checks
whether this is a valid document-signature pair with respect to Vv and whether the
document did not appear as a query of A . If both conditions hold, then A tries
to obtain forgery with respect to Ss . To explain how this is done, we need to take a
closer look at the valid document-signature pair, ( , ), output by A . Specically,
suppose that has the form
, v0,1
, 0 ), (v1,0
, v1,1
, 1 ), ..., (vn1,0
, vn1,1
, n1
), n )
(1 n , (v0,0
and that the various components satisfy all conditions stated in the verication
, v0,1
, 0 ), ..., (vn1,0
, vn1,1
, n1
) is
procedure. (In particular, the sequence (v0,0
the authentication path (for vn1,n ) output by A .) Recall that strings of the form
denote the verication-keys included in the output of A , whereas strings of the
vk,
form vx denote the verication-keys (as used in the answers given to A by A and)
as recorded by A.
Let i be maximal such that the sequence of key-pairs (v0,0
, v0,1
), ..., (vi1,0
, vi1,1
)
25
appears in some authentication path supplied to A (by A). Note that
i {0, ..., n}, where i = 0 means that (v0,0
, v0,1
) differs from (v0 , v1 ), and
, vn1,1
)) equals the
i = n means that the sequence ((v0,0 , v0,1 ), ..., (vn1,0
sequence ((v0 , v1 ), ..., (v1n1 0 , v1n1 1 )). In general, the sequence ((v0,0
,
v0,1 ), ..., (vi1,0 , vi1,1 )) equals the sequence ((v0 , v1 ), ..., (v1i1
0 , v1i1
1 )). In
particular, for i 1, it holds that vi1,
= v , whereas for i = 0 we shall only
1
i
i
25
), the sequence
That is, i is such that for some 0 , ..., i1 (which may but need not equal 0 , ..., i1
(v0,0
, v0,1
, 0 ), ..., (vi1,0
, vi1,1
, i1 ) is a prex of some authentication path (for some v i+1n ) sup1
i
s equal the corresponding
plied to A by A. We stress that here we only care about whether or not some vk,
verication-keys supplied by A, and ignore the question of whether (in case of equality) the verication-keys
were authenticated using the very same (one-time) signature. We mention that things will be different in the
analogous part of the proof of Theorem 6.5.2 (which refers to super-security).
554
We shall make comments regarding the minor changes required in order to use ordinary pseudorandom functions.
The rst comment is that we shall consider an encoding of strings of length up to n + 2 by strings of length
n + 3 (e.g., for i n + 2, the string x {0, 1}i is encoded by x10n+2i ).
27 In case we use ordinary pseudorandom functions, rather than generalized ones, we select r uniformly in {0, 1}n+3
such that fr : {0, 1}n+3 {0, 1}n+3 . Actually, we shall be using the function f r : {0, 1}n+3 {0, 1}n derived
from the original fr by dropping the last 3 bits of the function value.
556
Signing algorithm S : On input a signing-key (r, s) (in the range of G 1 (1n )) and a
document , the algorithm proceeds as follows:
1. It selects uniformly 1 n {0, 1}n .
(Algorithm S will use the leaf labeled 1 n {0, 1}n to sign the current document. Indeed, with exponentially vanishing probability, the same leaf may be
used to sign two different documents, and this will lead to forgery [but only with
negligible probability].)
(Alternatively, to obtain a deterministic signing algorithm, one may set 1
n fr (select-leaf, ), where select-leaf is a special character.)28
2. Next, for every i = 1, ..., n and every {0, 1}, the algorithm invokes G and sets
(s1i1 , v1i1 ) G(1n , fr (key-gen, 1 i1 ))
where key-gen is a special character.29
3. For every i = 1, ..., n, the algorithm invokes Ss1i1 and sets
def
auth1i1 = v1i1 0 , v1i1 1 ,
r Vv (v0,0 v0,1 , 0 ) = 1.
r For i = 1, ..., n 1, it holds that Vv (vi,0 vi,1 , i ) = 1.
i1,i
r Vv
(, n ) = 1.
n1,n
In case we use ordinary pseudorandom functions, rather than generalized ones, this alternative can be (directly)
implemented only if it is guaranteed that || n. In such a case, we apply the f r to the (n + 3)-bit encoding of
00.
29 In case we use ordinary pseudorandom functions, rather than generalized ones, the argument to f is the
r
(n + 3)-bit encoding of 101 i1 .
30 In case we use ordinary pseudorandom functions, rather than generalized ones, the argument to f is the
r
(n + 3)-bit encoding of 111 i1 .
31 In case we use ordinary pseudorandom functions, rather than generalized ones, the argument to f is the
r
(n + 3)-bit encoding of 111 n .
557
uniformly select a leaf) and generate the path from the root to a given leaf. We consider
a few possibilities:
In particular, the number of documents that can be signed should denitely be smaller than the square root of
the size of the tree (or else two documents are likely to be assigned the same leaf ). Furthermore, we cannot use
a small tree (e.g., of size 1,000) even if we know that the total number of documents that will ever be signed is
small (e.g., 10), because in this case, the probability that two documents are assigned the same leaf is too big
(e.g., 1/20).
559
r It is common practice to authenticate messages sent during a communication session via a (fresh) session-key that is typically authenticated by a master-key. One
of the reasons for this practice is the prevention of a chosen message attack on the
(more valuable) master-key. (Other reasons include allowing the use of a faster (alas,
less secure) authentication scheme for the actual communication and introducing independence between sessions.)
r Observe the analogy between the tree-hashing (of Construction 6.2.13) and the
authentication-tree (of Construction 6.4.14). Despite the many differences, in both
cases the value of each internal node authenticates the values of its children. Thus,
the value of the root may be used to authenticate a very large number of values
(associated with the leaves). Furthermore, the value associated with each leaf can
be veried within complexity that is linear in the depth of the tree.
r Recall the application of one-time signatures to the construction of CCA-secure
public-key encryption schemes (see the proof of Theorem 5.4.30).
6.4.3.1. Denition
A collection of universal one-way hash functions is dened analogously to a collection of
collision-free hash functions. The only difference is that the hardness (to form collisions)
requirement is relaxed. Recall that in the case of (a collection of) collision-free hash
560
functions, it was required that, given the functions description, it is hard to form an
arbitrary collision under the function. In the case of (a collection of) universal one-way
hash functions, we only require that, given the functions description h and a pre-image
x0 , it is hard to nd an x = x 0 so that h(x) = h(x0 ). We refer to this requirement as to
hardness to form designated collisions.
Our formulation of the hardness to form designated collisions is actually seemingly stronger. Rather than being supplied with a (random) pre-image x0 , the collisionforming algorithm is allowed to select x 0 by itself, but must do so before being presented
with the functions description. That is, the attack of the collision-forming algorithm
proceeds in three stages: First the algorithm selects a pre-image x 0 , next it is given a
description of a randomly selected function h, and nally it is required to output x = x0
such that h(x) = h(x0 ). We stress that the third stage in the attack is also given the
random coins used for producing the initial pre-image (at the rst stage). This yields
the following denition, where the rst stage is captured by a deterministic polynomialtime algorithm A0 (which maps a sequence of coin tosses, denoted Uq(n) , to a pre-image
of the function), and the third stage is captured by algorithm A (which is given the very
same coins Uq(n) as well as the functions description).
Denition 6.4.18 (universal one-way hash functions UOWHF): Let : N N. A
collection of functions {h s : {0, 1} {0, 1}(|s|) }s{0,1} is called universal one-way
hashing (UOWHF) if there exists a probabilistic polynomial-time algorithm I so that
the following holds:
1. (admissible indexing technical):33 For some polynomial p, all sufciently large
ns, and every s in the range of I (1n ), it holds that n p(|s|). Furthermore, n can
be computed in polynomial-time from s.
2. (efcient evaluation): There exists a polynomial-time algorithm that, given s and x,
returns h s (x).
3. (hard-to-form designated collisions): For every polynomial q, every deterministic
polynomial-time algorithm A0 , every probabilistic polynomial-time algorithm A,
every positive polynomial p, and all sufciently large ns
1
h I (1n ) (A(I (1n ), Uq(n) )) = h I (1n ) (A0 (Uq(n) ))
(6.7)
Pr
<
n
and A(I (1 ), Uq(n) ) = A0 (Uq(n) )
p(n)
where the probability is taken over Uq(n) and the internal coin tosses of algorithms
I and A.
The function is called the range specier of the collection.
We stress that the hardness to form designated collisions condition refers to the
following three-stage process: First, using a uniformly distributed r {0, 1}q(n) , the
(initial) adversary generates a pre-image x 0 = A0 (r ); next, a function h is selected (by
invoking I (1n )); and, nally, the (residual) adversary A is given h (as well as r used
33
This condition is made merely to avoid annoying technicalities. Note that |s| = poly(n) holds by denition of I .
561
at the rst stage) and tries to nd a pre-image x = x0 such that h(x) = h(x0 ). Indeed,
def
Eq. (6.7) refers to the probability that x = A(h, r ) = x0 and yet h(x) = h(x 0 ).
Note that the range specier (i.e., ) must be super-logarithmic (or else, given s and
x0 Un , one is too likely to nd an x = x0 such that h s (x) = h s (x0 ), by uniformly
selecting x in {0, 1}n ). Also note that any UOWHF collection yields a collection of
one-way functions (see Exercise 19). Finally, note that any collision-free hashing is
universally one-way hashing, but the converse is false (see Exercise 20). Furthermore,
it is not known whether collision-free hashing can be constructed based on any one-way
functions (in contrast to Theorem 6.4.29, to follow).
6.4.3.2. Constructions
We construct UOWHF collections in several steps, starting with a related but restricted
notion, and relaxing the restriction gradually (until we reach the unrestricted notion
of UOWHF collections). The aforementioned restriction refers to the length of the
arguments to the function. Most importantly, the hardness (to form designated collisions) requirement will refer only to an argument of this length. That is, we refer to the
following technical denition:
Denition 6.4.19 ((d, r )-UOWHFs): Let d, r : N N. A collection of functions {h s :
{0, 1}d(|s|) {0, 1}r (|s|) }s{0,1} is called (d, r )-UOWHF if there exists a probabilistic
polynomial-time algorithm I so that the following holds:
1. For all sufciently large ns and every s in the range of I (1n ), it holds that |s| = n.34
2. There exists a polynomial-time algorithm that, given s and x {0, 1}d(|s|) , returns
h s (x).
3. For every polynomial q, every deterministic polynomial-time algorithm A0 mapping
q(n)-bit long strings to d(|s|)-bit long strings, every probabilistic polynomial-time
algorithm A, every positive polynomial p, and all sufciently large ns, Eq. (6.7)
holds.
Of course, we care only about (d, r )-UOWHF for functions d, r : N N satisfying
d(n) > r (n). (The case d(n) r (n) is trivial since collisions can be avoided altogether,
say, by the identity map.) The minimal non-trivial case is when d(n) = r (n) + 1.
Indeed, this is our starting point. Furthermore, the construction of such a minimal
(d, d 1)-UOWHF (undertaken in the following rst step) is the most interesting step
to be taken on our entire way toward the construction of full-edged UOWHF. We start
with an overview of the steps taken along the way.
Step I: Constructing (d, d 1)-UOWHFs: This construction utilizes a one-way permutation f and a family of hashing functions mapping n-bit long strings to (n 1)bit long strings. A generic function in the constructed collection is obtained by
34
Here we chose to make a more stringent condition, requiring that |s| = n, rather than n poly(|s|). In fact, one
can easily enforce this more stringent condition by modifying I into I so that I (1l(n) ) = I (1n ) for a suitable
function l : N N satisfying l(n) poly(n) and n poly(l(n)).
562
Intuitively, the ability to form designated collisions with respect to the constructed
collection yields such an ability with respect to (one of) the original collections. (In
the actual argument, we rely on the fact that the denition of (d, d 1)-UOWHF
refers also to adversaries that get the random coins used for producing the designated
pre-image, and not merely the designated preimage itself.)
Step III: In this step, we construct (length-unrestricted) quasi-UOWHFs that shrink
their input by a factor of two. These functions are constructed by applying a (single)
random function taken from a collection as constructed in Step II to each block of
d consequtive bits of the pre-image. (Clearly, a collision of the entire sequence of
blocks yields collisions at some block.)
Step IV: Obtaining full-edged UOWHFs: This construction is analogous to the one
used in Step II. We merely compose random functions taken from a collection as
constructed in Step III. Successively applying t such functions, we essentially map
2t n-bit long pre-images to n-bit long images.
That is, h s : {0, 1}d(|s|) {0, 1}d(|s|)1 , where d(m) is the largest integer n satisfying
p(n) m. Note that d is monotonically non-decreasing, and that for 1-1 ps, the corresponding d is onto (i.e., d( p(n)) = n for every n).
The following analysis uses, in an essential way, an additional property of the aforementioned families of hashing functions; specically, we assume that given two preimageimage pairs, it is easy to uniformly generate a hashing function (in the family)
that is consistent with these two mapping conditions. Furthermore, to facilitate the
analysis, we use a specic family of hashing functions, presented in Exercise 23 of
Chapter 3: Functions in Snn1 are described by a pair of elements of the nite eld
GF(2n ) so that the pair (a, b) describes the function h a,b that maps x GF(2n ) to the
(n 1)-bit prex of the n-bit representation of ax + b, where the arithmetic is of
the eld GF(2n ). This specic family satises all the additional properties required in
the next proposition (see Exercise 24).
Proposition 6.4.21: Suppose that f is a one-way permutation, and that Snn1 is a
family of hashing functions (as dened in Section 3.5.1.1) such that log2 |Snn1 | = 2n.
Furthermore, suppose that Snn1 satises the following two conditions:
C1 All but a negligible fraction of the functions in Snn1 are 2-to-1.
C2 There exists a probabilistic polynomial-time algorithm that, given y1 , y2 {0, 1}n
and z 1 , z 2 {0, 1}n1 , outputs a uniformly distributed element of {s Snn1 :
h s (yi ) = z i i {1, 2}}.
Then {h s }s{0,1} as in Construction 6.4.20 is a (d, d 1)-UOWHF, for d(m) = m/2.
Proof Sketch: Intuitively, forming designated collisions under h s h s f yields the
ability to invert f on a random y, because the collisions are due to h s , which may be
selected such that h s (y) = h s ( f (x 0 )) for any given y and x 0 . We stress that typically
there are only two pre-images of h s (x0 ) under h s , one being x 0 itself (which is given to
the collision-nder) and the other being f 1 (y). Thus, the ability to form a designated
collision with x0 yields an ability to invert f on a random y, by selecting a random s
such that h s (y) = h s (x 0 ), and forming a designated collision under h s . More precisely,
suppose we wish to invert f on a random image y. Then we may invoke a collisionnder, which rst outputs some x0 , supply it with a random s satisfying h s (y) = h s (x 0 ),
and hope that it forms a collision (i.e., nds a different pre-image x satisfying h s (x) =
h s (x0 )). Indeed, typically, the different pre-image must be f 1 (y), which means that
whenever the collision-nder succeeds, we also succeed (i.e., invert f on y). Details
follow.
Evidently, the proof is by a reducibility argument. Suppose that we are given a
probabilistic polynomial-time algorithm A that forms designated collisions under {h s },
with respect to pre-images produced by a deterministic polynomial-time algorithm A0 ,
564
which maps p(n)-bit strings to n-bit strings. Then, we construct an algorithm A that
inverts f . On input y = f (x), where n = |y| = |x|, algorithm A proceeds as follows:
(1) Select r0 uniformly in {0, 1} p(n) , and compute x0 = A0 (r0 ) and y0 = f (x0 ).
(2) Select s uniformly in {s Snn1 : h s (y0 ) = h s (y)}.
(Recall that y is the input to A, and y0 is generated by A at Step (1).)
(3) Invoke A on input (s, r0 ), and output whatever A does.
By Condition C2, Step (2) can be implemented in probabilistic polynomial-time.
Turning to the analysis of algorithm A, we consider the behavior of A on input
y = f (x) for a uniformly distributed x {0, 1}n , which implies that y is uniformly
distributed over {0, 1}n . We rst observe that for every xed r0 selected in Step (1), if y
is uniformly distributed in {0, 1}n , then s as determined in Step (2) is almost uniformly
distributed in Snn1 .
On the distribution of s as selected in Step (2): Fixing r0 {0, 1}q(n) means that
y0 = f (A0 (r0 )) {0, 1}n is xed. Using the pairwise independence property of
def
Snn1 , it follows that for each y {0, 1}n \ {y0 }, the cardinality of S y = {s Snn1 :
h s (y0 ) = h s (y)} equals |Snn1 |/2n1 . Furthermore, in case h s is 2-to-1, the string
s resides in exactly two S y s (one being Sy0 ). Recalling that all but a negligible
fraction of the h s s are 2-to-1 (i.e., Condition C1), it follows that each such function
is selected with probability 2 2n (|Snn1 |/2n1 )1 = |Snn1 |1 . Other functions
(i.e., non-2-to-1 functions) are selected with negligible probability.
By the construction of A (which ignores y in Step (1)), the probability that f (x0 ) = y is
negligible (but we could have taken advantage of this case, too, by augmenting Step (1)
such that if y0 = y, then A halts with output x0 ). Note that in case f (x 0 ) = y and
h s is 2-to-1, if A returns x such that x = x0 and h s (x ) = h s (x0 ), then it holds that
f (x ) = y.
def
Justifying the last claim: Let v = h s (y) and suppose that h s is 2-to-1. Then, by
Step (2) and f (x0 ) = y, it holds that x = f 1 (y) and x0 are the two pre-images of
v = h s (x) = h s (x 0 ) under h s , where h s = h s f is 2-to-1 because f is 1-to-1 and
h s is 2-to-1. Since x = x0 is also a pre-image of v under h s , it follows that x = x.
We conclude that if A forms designated collisions with probability (n), then A inverts
f with probability (n) (n), where is a negligible function (accounting for the
negligible probability that h s is not 2-to-1). (Indeed, we rely on the fact that s as selected
in Step (2) is distributed almost uniformly, and furthermore that each 2-to-1 function
appears with exectly the right probability.) The proposition follows.
Step II: Constructing (d , d /2)-UOWHFs. We now take the second step on our
way, and use any (d, d 1)-UOWHF in order to construct a (d , d /2)-UOWHF. That
is, we construct length-restricted UOWHFs that shrink their input by a factor of 2.
The construction is obtained by composing a sequence of different functions taken
from different (d, d 1)-UOWHFs. That is, each function in the sequence shrinks the
input by one bit, and the composition of d /2 functions shrinks the initial d -bit long
565
def
That is, letting x0 = x, and xi h si (xi1 ) for i = 1, ..., d(n)/2, we set h s (x0 ) =
xd(n)/2 . (Note that d(|si |) = d(n) + 1 i and |xi | = d(n) + 1 i indeed hold.)
Tedious details: We refer to an index selection algorithm that, on input 1m , deterdef d(n)/2 1
mines the largest integer n such that m m = i=1
d (d(n) + 1 i), uni1
formly selects s1 , ..., sd(n)/2 such that si {0, 1}d (d(n)+1i) , and s0 {0, 1}mm ,
def
That is, for m = |s|, we have h s : {0, 1}d(n) {0, 1}d(n)/2 , where n is the largest integer
d(n)/2 1
d (d(n) + 1 i). Thus, d (m) = d(n), where n is the length
such that m i=1
of the index in the (d, d 1) - UOWHF; that is, we have h s : {0, 1}d (|s|) {0, 1}d (|s|)/2 ,
with d (|s|) = d(n). Note that for d(n) = (n) (as in Construction 6.4.20), it holds that
d (O(n 2 )) d(n) and d (m) =
( m) follows. More generally, if for some polynomial
p it holds that p(d(n)) n d(n) (for all ns), then for some polynomial p it holds
that p (d (m)) m d (m) (for all ms), because d (d(n) n) d(n). We call such a
function sufciently growing; that is, d : N N is sufciently growing if there exists
a polynomial p so that for every n it holds that p(d(n)) n. (E.g., for every xed
, > 0, the function d(n) = n is sufciently growing.)
Proposition 6.4.23: Suppose that {h s }s{0,1} is a (d, d 1)-UOWHF, where d : N N
is onto, non-decreasing, and sufciently growing. Then, for some sufciently growing
function d : N N, Construction 6.4.22 is a (d , d /2)-UOWHF.
Proof Sketch: Intuitively, a designated collision under h s1 ,...,sd/2 yields a desigdef
nated collision under one of the h si s. That is, let x0 = x and xi h si (xi1 ) for
i = 1, ..., d(n)/2. Then if given x and s = (s1 , ..., sd/2 ), one can nd an x = x such
and xi = h si (xi1 ) =
that h s (x) = h s (x ); then there exists an i so that xi1 = xi1
h si (xi1 ) = xi , where the x j s are dened analogously to the x j s. Thus, we obtain
a designated collision under h si . We stress that because h s does not shrink its input too much, the length of si is polynomially related to the length of s (and thus,
forming collisions with respect to h si by using the collision-nder for h s yields a
contradiction).
The actual proof uses the hypothesis that it is hard to form designated collisions
when one is also given the coins used in the generation of the pre-image (and not
merely the pre-image itself). In particular, we construct an algorithm that forms designated collisions under one of the h si s, when given not only xi1 but also x0 (which
566
actually yields xi1 ). The following details are quite tedious and merely provide an
implementation of this idea.
As stated, the proof is by a reducibility argument. We are given a probabilistic
polynomial-time algorithm A that forms designated collisions under {h s }, with respect
to pre-images produced by a deterministic polynomial-time algorithm A0 that maps
p (n)-bit strings to n-bit strings. We construct algorithms A0 and A such that A forms
designated collisions under {h s } with respect to pre-images produced by algorithm A0 ,
which maps p(n)-bit strings to n-bit strings, for a suitable polynomial p. (Specically,
p : N N is 1-1 and p(n) p (d 1 (2d(n))) + n + n d 1 (2d(n)), where the factor
of 2 appearing in the expression is due to the shrinking factor of h s .)
We start with the description of A0 , that is, the algorithm that generates pre-images
of {h s }. Intuitively, A0 selects a random j, uses A0 to obtain a pre-image x 0 of {h s },
generates random s0 , ..., s j1 , and outputs a pre-image x j1 of {h s j }, computed by
xi = h si (xi1 ) for i = 1, ..., j 1. (Algorithm A will be given x j1 (or rather the coins
used to generate x j1 ) and a random h s j and will try to form a collision with x j1 under
h s j .)
Detailed description of A0 : Recall that p is a polynomial, d(n) n and d 1 (n) =
def
def
s = (s0 , s1 , ..., s j1 , s, s j+1 , ..., sd(n)/2 ), where s j+1 , ..., sd(n)/2 are uniformly selected
by A. Finally, A outputs h s j1 ( (h s1 (A (r , s )) ).
Detailed description of A: On input s {0, 1}n and r {0, 1} p(n) , algorithm A
proceeds as follows.
(12) Using r , determine m, j, and n exactly as done by A0 .
(3) If d 1 (d(n ) + 1 j) = n, then abort.
(4) Otherwise (i.e., n = d 1 (d(n ) + 1 j)), do:
(4.1) Determine s0 , s1 , ..., s j1 and r exactly as A0 does (at its Step (4)).
1
(4.2) Uniformly select s j+1 , ..., sd(n )/2 such that si {0, 1}d (d(n )+1i) ,
and set s = (s0 , s1 , ..., s j1 , s, s j+1 , ..., sd(n )/2 ).
(4.3) Invoke A on input (s , r ), and obtain x0 A (s , r ).
(Comment: x0 {0, 1}d(n ) .)
(4.4) For i = 1, ..., j 1, compute xi h si (xi1
).
d(n)
Output x j1 {0, 1} .
functions description). Thus, the resulting construct yields a (d , d /2)-UOWHF for any
polynomially bounded function d (e.g., d (n) = n 2 ), whereas in Construction 6.4.22,
the function d is xed and satises d (n) n. The construction itself amounts to
parsing the input into blocks and applying the same function (taken from a (d, d/2)UOWHF) to each block.
Construction 6.4.24 (a (d , d /2)-UOWHF for any d ): Let {h s : {0, 1}d(|s|)
{0, 1}d(|s|)/2 }s{0,1} , where d : N N is onto and non-decreasing. Then, for every
s {0, 1}n and every x {0, 1} , we dene
h s (x) = h s (x1 ) h s (xt 10d(n)|xt |1 )
def
where x = x 1 x t , 0 |xt | < d(n) and |xi | = d(n) for i = 1, ..., t 1. The indexselection algorithm of {h s } is identical to the one of {h s }.
Clearly, |h s (x)| = (|x| + 1)/d(n) d(n)/2, which is approximately |x|/2 (provided |x| d(n)). Furthermore, Construction 6.4.24 satises Conditions 1 and 2 of
Denition 6.4.18, provided that {h s } satises the corresponding conditions of Definition 6.4.19. We thus focus on the hardness to form designated collisions (i.e.,
Condition 3).
Proposition 6.4.25: Suppose that {h s }s{0,1} is a (d, d/2)-UOWHF, where d : N N
is onto, non-decreasing, and sufciently growing. Then Construction 6.4.22 satises
Condition 3 of Denition 6.4.18.
Proof Sketch: Intuitively, a designated collision under h s yields a designated collision
under h s . That is, consider the parsing of each string into blocks of length d(n), as in
Construction 6.4.24. Now if, given x = x1 x t and s, one can nd an x = x1 xt =
x such that h s (x) = h s (x ), then t = t and there exists an i such that xi = xi and
h s (xi ) = h s (xi ). Details follow.
The actual proof is by a reducibility argument. Given a probabilistic polynomial-time
algorithm A that forms designated collisions under {h s }, with respect to pre-images
produced by a polynomial-time algorithm A0 , we construct algorithms A0 and A such
that A forms designated collisions under {h s } with respect to pre-images produced
by algorithm A0 . Specically, algorithm A0 invokes A0 and uses extra randomness
(supplied in its input) to uniformly select one of the d(n)-bit long blocks in the standard
parsing of the output of A0 . That is, the random-tape used by algorithm A0 has the form
(r , i), and A0 outputs the i-th block in the parsing of the string A0 (r ). Algorithm A
is derived analogously. That is, given s {0, 1}n and the coins r = (r , i) used by A0 ,
algorithm A invokes A on input s and r , obtains the output x , and outputs the i-th
block in the standard parsing of x .
Note that whenever we have a collision under h s (i.e., a pair x = x such that h s (x) =
h s (x )), we obtain at least one collision under the corresponding h s (i.e., for some i, the
i-th blocks of x and x differ, and yet both blocks are mapped by h s to the same image).
Thus, if algorithm A succeeds (in forming designated collisions with respect to {h s })
569
with probability (n), then algorithm A succeeds (in forming designated collisions
with respect to {h s }) with probability at least (n)/t(n), where t(n) is a bound on the
running time of A (which also upper-bounds the length of the output of A , and so
1/t(n) is a lower bound on the probability that the colliding strings differ at a certain
uniformly selected block). The proposition follows.
Step IV: Obtaining Full-Fledged UOWHFs. The last step on our way consists of
using any quasi-UOWHFs as constructed (in Step III) to obtain full-edged UOWHFs.
That is, we use quasi-UOWHFs that are applicable to any input length but shrink each
input to half its length (rather than to a xed length that only depends on the function
description). The resulting construct is a UOWHF (as dened in Denition 6.4.18).
The construction is obtained by composing a sequence of different functions (each
taken from the same quasi-UOWHF); that is, the following construction is analogous
to Construction 6.4.22.
Construction 6.4.26 (a UOWHF): Let {h s : {0, 1} {0, 1} }s{0,1} , such that
|h s (x)| = |x|/2, for every x {0, 1}2i|s| where i N. Then, for every s1 , ..., sn {0, 1}n
t
and every t N and x {0, 1}2 n , we dene
h s1 ,...,sn (x) = (t, h st ( h s2 (h s1 (x)) ))
def
def
that, on input 1m , determines n = m, uniformly selects s1 , ..., sn {0, 1}n and
def
Observe that h s0 ,s1 ,...,sn (x) = h s0 ,s1 ,...,sn (x ) implies that both equal the pair (t, h st ( h s2
(h s1 (x)) )), where t = log2 (|x|/n) = log2 (|x |/n). Note that h s0 ,s1 ,...,sn :
{0, 1} {0, 1}n+log2 n , and that m = |s0 , s1 , ..., sn | < (n + 1)2 .
Proposition 6.4.27: Suppose that {h s }s{0,1} satises the conditions of Denition 6.4.18, except that it maps arbitrary input strings to outputs having half the length
(rather than a length determined by |s|). Then Construction 6.4.26 constitutes a collection of UOWHFs.
The proof of Proposition 6.4.27 is omitted because it is almost identical to the proof of
Proposition 6.4.23.
Conclusion. Combining the previous four steps, we obtain a construction of (fulledged) UOWHFs (based on any one-way permutation). That is, combining Propositions 6.4.21, 6.4.23, 6.4.25, and 6.4.27, we obtain:35
35
Actually, there is a minor gap between Constructions 6.4.24 and 6.4.26. In the former we constructed functions
that hash every x into a value of length (|x| + 1)/d(n) d(n)/2, whereas in the latter we used functions that
hash every x {0, 1}2in into a value of length i n.
570
Theorem 6.4.28: If one-way permutations exist, then universal one-way hash functions
exist.
Note that the only barrier toward constructing UOWHFs based on arbitrary one-way
functions is Proposition 6.4.21, which refers to one-way permutations. Thus, if we
wish to constructs UOWHF based on any one-way function, then we need to present
an alternative construction of a (d, d 1)-UOWHF (i.e., an alternative to Construction 6.4.20, which fails in case f is 2-to-1).36 Such a construction is actually known,
and so the following result is known to hold (but its proof it too complex to t in this
work):
Theorem 6.4.29: Universal one-way hash functions exist if and only if one-way functions exist.
We stress that the difcult direction is the one referred to earlier (i.e., from oneway functions to UOWHF collections). For the much easier (converse) direction, see
Exercise 19.
For example, if f (, x ) = (0, f (x )), for {0, 1}, then forming designated collisions under Construction 6.4.20 is easy: Given (0, x ), one outputs (1, x ), and indeed a collision is formed (already under f ).
571
q, algorithm A generates a1 I (1n ), forwards (a1 , h a1 (q)) to its own oracle (i.e., Ss ),
and answers with (a1 , a2 ), where a2 = Ss (a1 , h a1 (q)). (We stress that A issues a single
Ss -query per each Ss -query made by A .) When A outputs a document-signature pair
relative to the complex scheme (G , S , V ), algorithm A tries to use this pair in order
to form a document-signature pair relative to the -restricted scheme, (G, S, V ). That
is, if A outputs the document-signature pair (, ), where = (1 , 2 ), then A will
def
output the document-signature pair (2 , 2 ), where 2 = (1 , h 1 ()).
Assume that with (non-negligible) probability (n), the (probabilistic polynomialtime) algorithm A succeeds in existentially forging relative to the complex scheme
(G , S , V ). Let ( (i) , (i) ) denote the i-th query and answer pair made by A , and let
(, ) be the forged document-signature pair that A outputs (in case of success), where
(i)
(i)
(i) = (1 , 2 ) and = (1 , 2 ). We consider the following two cases regarding the
forging event:
(i)
Case 1: (1 , h 1 ()) = (1 , h (i) ( (i) )) for all is. (That is, the Ss -signed value in the
1
forged signature (i.e., the value (1 , h 1 ())) is different from all queries made to
Ss .) In this case, the document-signature pair ((1 , h 1 ()), 2 ) constitutes a success
in existential forgery relative to the -restricted scheme (G, S, V ).
(i)
Case 2: (1 , h 1 ()) = (1 , h (i) ( (i) )) for some i. (That is, the Ss -signed value used
1
in the forged signature equals the i-th query made to Ss , although = (i) .) Thus,
(i)
1 = 1 and h 1 () = h (i) ( (i) ), although = (i) . In this case, the pair (, (i) )
1
forms a designated collision under h (i) (and we do not obtain success in existential
1
forgery relative to the -restricted scheme). We stress that A selects (i) before it
is given the description of the function h (i) , and thus its ability to later produce
1
= (i) such that h 1 () = h (i) ( (i) ) yields a violation of the UOWHF property.
1
Thus, if Case 1 occurs with probability at least (n)/2, then A succeeds in its attack
on (G, S, V ) with probability at least (n)/2, which contradicts the security of the
-restricted scheme (G, S, V ). On the other hand, if Case 2 occurs with probability
at least (n)/2, then we derive a contradiction to the difculty of forming designated
collisions with respect to {h r }. Details regarding Case 2 follow.
We start with a sketch of the construction of an algorithm that attempts to form
designated collisions under a randomly selected hash function. Loosely speaking, we
construct an algorithm B that tries to form designated collisions by emulating the
attack of A on a random instance of (G , S , V ) that B selects by itself. Thus, B can
easily answer any signing-query referred to it by A , but in one of these queries (the
index of which is selected at random by B ), algorithm B will use a hash function given
to it from the outside (rather than generating such a function at random by itself). In
case A forges a signature while using this specic function-value pair (as in Case 2),
algorithm B obtains and outputs a designated collision.
We now turn to the actual construction of algorithm B (which attempts to form
designated collisions under a randomly selected hash function). Recall that such an
algorithm operates in three stages (see discussion in Section 6.4.3.1): First the algorithm
selects a pre-image x 0 , next it is given a description of a function h, and nally it is
573
required to output x = x0 such that h(x) = h(x0 ). We stress that the third stage in the
attack is also given the random coins used for producing the pre-image x0 (at the rst
stage). Now, on input 1n , algorithm B proceeds in three stages:
Stage 1: Algorithm B selects uniformly i {1, ..., t(n)}, where t(n) bounds the running time of A (G 1 (1n )) (and thus the number of queries it makes). Next, B selects (s, v) G (1n ) and emulates the attack of A (v) on Ss , while answering
the queries of Ss as follows. All queries except the i-th one are emulated in the
straightforward manner (i.e., by executing the program of Ss as stated). That is, for
( j)
j = i, the j-th query, denoted ( j) , is answered by producing 1 I (1n ), com( j)
( j)
(
j)
puting 2 Ss (1 , h ( j) ( )) (using the knowledge of s), and answering with
1
( j)
( j)
the pair (1 , 2 ). The i-th query of A , denoted (i) , will be used as the designated
pre-image. Once (i) is issued (by A ), algorithm B completes its rst stage (without
answering this query), and the rest of the emulation of A will be conducted by the
third stage of B .
Stage 2: At this point (i.e., after B has selected the designated pre-image (i) ), B
obtains a description of a random hashing function h r (thus completing its second
operation stage). That is, this stage consists of B being given r I (1n ).
Stage 3: Next, algorithm B answers the i-th query (i.e., (i) ) by applying Ss to the
pair (r, h r ( (i) )). Subsequent queries are emulated in the straightforward manner (as
in Stage 1). When A halts, B checks whether A has output a valid document( j)
signature pair (, ) as in Case 2 (i.e., 1 = 1 and h 1 () = h ( j) ( ( j) ) for some
1
j), and whether the collision formed is indeed on the i-th query (i.e., j = i, which
means that h r () = h r ( (i) )). When this happens, B outputs (which is different
than (i) ), and in doing so it has succeeded in forming a designated collision (with
(i) under h r ).
Now, if Case 2 occurs with probability at least 2(n) (and A makes at most t(n) queries),
then B has succeeded in forming a designated collision with probability at least
1
2(n) , because the actions of A are independent of the random value of i. This
t(n)
contradicts the hypothesis that {h r } is UOWHF.
As mentioned earlier, the furthermore-part of the proposition follows by observing
that if the forging algorithm A makes at most one query, then the same holds for the
algorithm A constructed in the beginning of the proof. Thus, if (G , S , V ) can be
broken via a single-message attack, then either (G, S, V ) can be broken via a singlemessage attack or one can form designated collisions (with respect to {h r }). In both
cases, we reach a contradiction.
Conclusion. Combining the furthermore-part of Proposition 6.4.31, Corollary 6.4.6,
and the fact that UOWHF collections imply one-way functions (see Exercise 19), we
obtain:
Theorem 6.4.32: If there exist universal one-way hash functions, then secure one-time
signature schemes exist, too.
574
Note that this property is related, but not equivalent, to the question of whether or
not the signing algorithm is deterministic (which is considered in Exercise 1). Indeed,
if the signing algorithm is deterministic, then for every key pair (s, v) and document ,
the result of applying Ss to is unique (and indeed Vv (, Ss ()) = 1). Still, this does
not mean that there is no other (which is never produced by applying Ss to ) such
that Vv (, ) = 1. On the other hand, the unique signature property may hold even in
case the signing algorithm is randomized, but (as mentioned earlier) this randomization
can be eliminated anyhow.
Can Secure Signature Schemes Have Unique Signatures? The answer is denitely
afrmative, and in fact we have seen several such schemes in the previous sections.
Specically, all private-key signature schemes presented in Section 6.3 have unique signatures. Furthermore, every secure private-key signature scheme can be transformed
into one having unique signatures (e.g., by combining deterministic signing as in
Exercise 1 with canonical verication as in Exercise 2). Turning to public-key signature
schemes, we observe that if the one-way function f used in Construction 6.4.4 is 1-1,
then the resulting secure length-restricted one-time (public-key) signature scheme has
unique signatures (because each f -image has a unique pre-image). In addition, Construction 6.2.6 (i.e., the basic hash-and-sign paradigm) preserves the unique signature
property. Let use summarize all these observations:
Theorem 6.5.1 (Secure Schemes with Unique Signatures):
1. Assuming the existence of one-way functions, there exist secure message authentication schemes having the unique signature property.
2. Assuming the existence of 1-1 one-way functions, there exist secure length-restricted
one-time (public-key) signature schemes having the unique signature property.
3. Assuming the existence of 1-1 one-way functions and collision-free hashing collections, there exist secure one-time (public-key) signature schemes having the unique
signature property.
In addition, it is known that secure (full-edged) signature schemes having the unique
signature property can be constructed based on a mild variant on the standard RSA
assumption (see reference in Section 6.6.5). Still, this leaves open the question of
whether or not secure signature schemes having the unique signature property exist if
and only if secure signature schemes exist.
0
1
vi = h i (si ), for i = 1, ..., (n) and j = 0, 1. We let s = ((s10 , s11 ), ..., (s(n)
, s(n)
)),
37
We comment that a simpler proof sufces in case we are willing to use a one-way permutation (rather than
an arbitrary one-way function). In this case, we can start from (Part 2 of ) Theorem 6.5.1 (rather than prove
Claim 6.5.2.1), and use Theorem 6.4.28 (rather than Theorem 6.4.29, which has a more complicated proof ).
577
1. The valid signature formed by A is to the same document for which A has obtained a
different signature (via its single query). In this case, for at least one of the UOWHFs
contained in the verication-key, we obtain a pre-image (of the image also contained
in the verication-key) that is different from the one contained in the signing-key.
Adapting the construction presented in the proof of Proposition 6.4.5, we derive (in
this case) an ability to form designated collisions (in contradiction to the UOWHF
property). We stress that the pre-images contained in the signing-key are selected
independently of the description of the UOWHFs (because both are selected independently by the key-generation process). In fact, we obtain a designated collision
for a uniformly selected pre-image.
2. The valid signature formed by A is to a document that is different from the one
for which A has obtained a signature (via its single query). In this case, the proof
of Proposition 6.4.5 yields the ability to invert a randomly selected UOWHF (on
a randomly selected image), which contradicts the UOWHF property (as shown in
Exercise 19).
Thus, in both cases we derive a contradiction, and the claim follows.
Claim 6.5.2.2: When applying the revised hash-and-sign construction (i.e., Construction 6.4.30) to a super-secure length-restricted signature scheme, the result is a supersecure signature scheme. In case the length-restricted scheme is only super-secure under a chosen one-message attack, the same holds for the resulting (length-unrestricted)
scheme.
Proof Sketch: We follow the proof of Proposition 6.4.31, and use the same construction of a forger for the length-restricted scheme (based on the forger for the complex
scheme). Furthermore, we consider the two forgery cases analyzed in the proof of
Proposition 6.4.31:38
(i)
Case 1: (1 , h 1 ()) = (1 , h (i) ( (i) )) for all is. In this case, the analysis is exactly
1
as in the original proof. Note that it does not matter whether or not = (i) , since
in both subcases we obtain a valid signature for a new string with respect to the
38
Recall that (, ) denotes the document-signature pair output by the original forger (i.e., for the complex scheme),
whereas ( (i) , (i) ) denotes the i-th query-answer pair (to that scheme). The document-signature pair that we
def
output (as a candidate forgery with respect to a length-restricted scheme) is (2 , 2 ), where 2 = (1 , h 1 ())
and = (1 , 2 ). Recall that a generic valid document-signature for the complex scheme has the form ( , ),
where = (1 , 2 ) satises Vv ((1 , h ( )), 2 ) = 1.
1
578
Case 2: (1 , h 1 ()) = (1 , h (i) ( (i) )) for some i. The case = (i) was handled in
1
the original proof (by showing that it yields a designated collision [under h (i) , which
1
is supposedly a UOWHF]), so here we only handle the case = (i) . Now, suppose
(i)
(i)
that super-security of the complex scheme was violated; that is, (1 , 2 ) = (1 , 2 ).
(i)
(i)
Then, by the case hypothesis (which implies 1 = 1 ), it must be that 2 = 2 . This
means that we derive a violation of the super-security of the length-restricted scheme,
(i)
because 2 is a different valid Ss -signature of (1 , h 1 ()) = (1 , h (i) ( (i) )).
1
(i)
1. The rst case is when the forged signature for the complex scheme (G , S , V )
contains an authentication path (for a leaf) that equals some authentication path
provided by the signing-oracle (as part of the answer to some oracle-query of the
attacker). In this case, the (one-time) verication-key associated with this leaf must
be authentic (i.e., equal to the one used by the signing-oracle), and we derive violation
of the super-security of the instance of (G, S, V ) associated with it. We consider two
subcases (regarding the actual document authenticated via this leaf):
(a) The rst subcase is when no oracle-answer has used the instance associated
with this leaf for signing an actual document. (This may happen if the instance
39
Recall that forging a signature for the general scheme requires either using an authentication path supplied
by the (general) signing-oracle or producing an authentication path different from all paths supplied by the
(general) signing-oracle. These are the cases considered here. In contrast, in the proof of Proposition 6.4.15
we considered only the text part of these paths, ignoring the question of whether or not the authenticating
(one-time) signatures (provided as part of these paths) are equal.
579
associated with the sibling of this leaf was used for signing an actual document.)
In this subcase, as in the proof of Proposition 6.4.15, we obtain (ordinary) forgery
with respect to the instance of (G, S, V ) associated with the leaf (without making
any query to that instance of the one-time scheme).
(b) Otherwise (i.e., the instance associated with this leaf was used for signing an
actual document), the forged document-signature pair differs from the queryanswer pair that used the same leaf. The difference is either in the actual document or in the part of the complex-signature that corresponds to the one-time
signature produced at the leaf (because, by the case hypothesis, the authentication paths are identical). In both subcases this yields violation of the supersecurity of the instance of (G, S, V ) associated with that leaf. Specically, in the
rst sub-subcase, we obtain a one-time signature to a different document (i.e.,
violation of ordinary security), whereas in the second sub-subcase, we obtain
a different one-time signature to the same document (i.e., only a violation of
super-security). We stress that in both subcases, the violating signature is obtained after making a single query to the instance of (G, S, V ) associated with
that leaf.
2. We now turn to the second case (i.e., forgery with respect to (G , S , V ) is obtained
by producing an authentication path different from all paths supplied by the signingoracle). In this case, we obtain violation of the (one-time) super-security of the
scheme (G, S, V ) associated with one of the internal nodes (specically the rst node
on which the relevant paths differ). The argument is similar (but not identical) to the
one given in the proof of Proposition 6.4.15. Specically, we consider the maximal
prex of the authentication path provided by the forger that equals a corresponding
prex of an authentication path provided by the signing-oracle (as part of its answer).
The extension of this path in the complex-signature provided by the forger either
uses a different pair of (one-time) verication-keys or uses a different (one-time)
signature to the same pair. In the rst subcase, we obtain a one-time signature to
a different document (i.e., violation of ordinary security), whereas in the second
subcase, we obtain a different one-time signature to the same document (i.e., only a
violation of super-security). We stress that in both subcases, the violating signature
is obtained after making a single query to the instance of (G, S, V ) associated with
that internal node.
Thus, in both cases we reach a contradiction to the super-security of the one-time
signature scheme, which establishes our claim that the general signature scheme must
be super-secure.
Combining the three claims (and recalling that universal one-way hashing functions
can be constructed using any one-way function [cf. Theorem 6.4.29]), the theorem
follows.
in two steps, where the rst step is independent of the actual message to be signed.
That is, the computation of Ss () can be decoupled into two steps, performed by randomized algorithms that are denoted S off and S on , respectively, such that Ss ()
Sson (, S off (s)). Thus, one may prepare (or precompute) S off (s) before the document
is known (i.e., off-line), and produce the actual signature (on-line) once the document
is presented (by invoking algorithm S on on input (, S off (s))). This yields improvement in on-line response-time to signing requests, provided that S on is signicantly
faster than S itself. This improvement is worthwhile in many natural settings in which
on-line response-time is more important than off-line processing time.
We stress that S off must be randomized (because, otherwise, S off (s) can be incorporated in the signing-key). Indeed, one may view algorithm S off as an augmentation
of the key-generation algorithm that produces random extensions of the signing-key
on the y (i.e., after the verication-key has already been determined). We stress that
algorithm S off is invoked once per each document to be signed, but this invocation can
take place at any time (and even before the document to be signed is even determined).
(In contrast, it may be insecure to reuse the result obtained from S off for two different
signatures.)
Can Secure Signature Schemes Employ Meaningful Off-Line/On-Line Signing
Algorithms? Of course, any algorithm can be vacuously decoupled into two steps, but
we are only interested in meaningful decouplings in which the off-line step takes most
of the computational load. It is interesting to note that schemes based on the refreshing
paradigm (cf. Section 6.4.2.1) lend themselves to such a decoupling. Specically, in
Construction 6.4.16, only the last step in the signing process depends on the actual
document (and needs to be performed on-line). Furthermore, this last step amounts to
applying the signing algorithm of a one-time signature scheme, which is typically much
faster than all the other steps (which can be performed off-line).40
For example, when using the one-time signature scheme suggested in Proposition 6.4.7, producing onetime signatures amounts to applying a collision-free hashing function and outputting corresponding parts of
the signing-key. This is all that needs to be performed in the on-line step of Construction 6.4.16. In contrast, the
off-line step (of Construction 6.4.16) calls for n applications of a pseudorandom function, n applications of
the key-generation algorithm of the one-time signature scheme, and n applications of the signing algorithm of
the one-time signature scheme.
581
modied document in time proportional to the number of edit operations (rather than
proportional to | |). Indeed, here time is measured in a direct-access model of computation. Of course, the time saved on the signing side should not come at the expense of
a signicant increase in verication time. In particular, verication time should depend
only on the length of the nal document (and not on the number of edit operations).41
An incremental signing process is benecial in settings where one needs to sign
many textually related documents (e.g., in simple contracts, much of the text is almost
identical and the few edit changes refer to the partys specic details, as well as to
specic clauses that may be modied from their standard form in order to meet the
partys specic needs). In some cases, the privacy of the edit sequence may be of
concern; that is, one may require that the nal signature be distributed in a way that
only depends on the nal document (rather than depending also on documents that
contributed signatures to the process of generating the nal signature).
Can Secure Signature Schemes Employ a Meaningful Incremental Signing Process? Here, meaningful refers to the set of supported text-modication operations. The
answer is afrmative, and furthermore, these schemes may even protect the privacy of
the edit sequence. In the following, we refer to edit operations that delete/insert xlength bit-strings called blocks from/to a document (as well as to the cut-and-paste
operations mentioned previously).
Theorem 6.5.3 (secure schemes with incremental signing process):
1. Assuming the existence of one-way functions, there exist secure messageauthentication schemes having an incremental signing process that supports block
deletion and insertion. Furthermore, the scheme uses a xed-length authentication
tag.
2. Assuming the existence of one-way functions, there exist secure (private-key and
public-key) signature schemes having an incremental signing process that supports
block deletion and insertion as well as cut and paste.
Furthermore, in both parts, the resulting schemes protect the privacy of the edit
sequence.
Part 1 is proved by using a variant of an efcient message-authentication scheme that is
related to the schemes presented in Section 6.3.1. Part 2 is proved by using an arbitrary
secure (private-key or public-key) signature scheme that produces n-bit long signatures
to O(n)-bit long strings, where n is the security parameter. (Indeed, the scheme need
only be secure in the O(n)-restricted sense.) The document is stored in the leaves of a 2
3 tree, and the signature essentially consists of the tags of all internal nodes, where each
internal node is tagged by applying the basic signature scheme to the tags of its children.
41
This rules out the naive (unsatisfactory) solution of providing a signature of the original document along with a
signature of the sequence of edit operations. More sophisticated variants of this naive solution (e.g., refreshing
the signature whenever enough edits have occurred) are not ruled out here, but typically they will not satisfy
the privacy requirement discussed in the sequel.
582
One important observation is that a 23 tree supports the said operations while incurring
only a logarithmic (in its size) cost; that is, by modifying only the links of logarithmically
many nodes in the tree. Thus, only the tags of these nodes and their ancestors in the tree
need to be modied in order to form the correspondingly modied signature. (Privacy
of the edit sequence is obtained by randomizing the standard modication procedure for
23 trees.) By analogy to Construction 6.2.13 (and Proposition 6.2.14), the incremental
signature scheme is secure.
Allowing memory-dependent signing is essential to the existence of secure fail-stop signature schemes; see
Exercise 25.
43 It seems reasonable to restrict even computationally unbounded adversaries to polynomially many signing
requests.
583
6.6. Miscellaneous
6.6.1. On Using Signature Schemes
Once dened and constructed, signature schemes may be (and are actually) used as
building blocks toward various goals that are different from the original motivation.
Still, the original motivation (i.e., reliable communication of information) is of great
importance, and in this subsection we discuss several issues regarding the use of signature schemes toward achieving it. The discussion is analogous to a similar discussion
conducted in Section 5.5.1, but the analogous issues discussed here are even more
severe.
Using Private-Key Schemes: The Key-Exchange Problem. As discussed in Section 6.1, using a private-key signature scheme (i.e., a message-authentication scheme)
requires the communicating parties to share a secret key. This key can be generated
by one party and secretly communicated to the other party by an alternative (expensive) secure and reliable channel. Often, a preferable solution consists of employing a
key-exchange (or rather key-generation) protocol, which is executed over the standard
(unreliable) communication channel. We stress that here (unlike in Section 5.5.1) we
must consider active adversaries. Consequently, the focus should be on key-exchange
protocols that are secure against active adversaries and are called unauthenticated keyexchange protocols (because the messages received over the channel are not necessarily
authentic). Such protocols are too complex to be treated in this section, and the interested
reader is referred to [29, 30, 15].
44
We refer to the natural convention by which a proof of forgery frees the signer of any obligations implied by the
document. In this case, when accepting a valid signature, the recipient is only guaranteed that it is infeasible for
the signer to revoke the signature.
584
6.6 MISCELLANEOUS
Using State-Dependent Message-Authentication Schemes. In many communication settings, it is reasonable to assume that the authentication device may maintain
(and modify) a state (e.g., a counter or a clock). Furthermore, in many applications, a
changing state (e.g., a clock) must be employed anyhow in order to prevent replay of
old messages (i.e., each message is authenticated along with its transmission time). In
such cases, state-dependent schemes as discussed in Section 6.3.2 may be preferable.
(See further discussion in Section 6.3.2 and analogous discussion in Section 5.5.1.)
Using Signature Schemes: Public-Key Infrastructure. The standard use of (publickey) signature schemes in real-life applications requires a mechanism for providing the
veriers with the signers authentic verication-key. In small systems, one may assume
that each user holds a local record of the verication-keys of all other users. However,
this is not realistic in large-scale systems, and so the verier must obtain the relevant
verication-key on the y in a reliable way (i.e., typically, certied by some trusted
authority). In most theoretical work, one assumes that the verication-keys are posted
and can be retrieved from a public-le that is maintained by a trusted party (which
makes sure that each user can post only verication-keys bearing its own identity).
Alternatively, such a trusted party may provide each user with a (signed) certicate
stating the authenticity of the users verication-key. In practice, maintaining such a
public-le (and/or handling such certicates) is a major problem, and mechanisms that
implement these abstractions are typically referred to by the generic term publickey infrastructure (PKI). For a discussion of the practical problems regarding PKI
deployment, see, e.g., [149, Chap. 13].
Needless to say, we did not even consider presenting schemes that are not known to satisfy some robust notion
of security.
46 Recall that, in contrast, the methodology of Section 3.6.3 (which is applied often in the current chapter) refers
to a situation in which the adversary does not have direct oracle access to the random function, and does not
obtain the description of the pseudorandom function used in the latter implementation.
586
6.6 MISCELLANEOUS
signature schemes that are secure in the Random Oracle Model, but replacing the random function (used in them) by any function ensemble yields a totally insecure scheme
(cf., [54]).
The aw in this folklore is rooted in implicit (unjustied) assumptions regarding the notion of a constructive
proof of security (based on factoring). In particular, it was implicitly assumed that the signature scheme uses
a verication-key that equals a composite number, and that the proof of security reduces the factoring of such a
composite N to forging with respect to the verication-key N . In such a case, the folklore suggested that the reduction yields an oracle machine for factoring the verication-key, where the oracle is the corresponding signingoracle (associated with N ), and that the factorization of the verication-key allows for efciently producing
signatures to any message. However, none of these assumptions is justied. In contrast, the verication-key in the
scheme of [125] consists of a pair (N , x), and its security is proven by reducing the factoring of N to forging with
respect to the verication-key (N , r ), where r is randomly selected by the reduction. Furthermore, on input N , the
(factoring) reduction produces a verication-key (N , r ) that typically does not equal the verication-key (N , x)
being attacked, and so being given access to a corresponding signing-oracle does not allow the factoring of N .
587
6.6 MISCELLANEOUS
was introduced (and rst instantiated) in [85]. The notion of incremental cryptographic schemes (and, in particular, incremental signature schemes) was introduced
and instantiated in [18, 19]. In particular, the incremental MAC of [19] (i.e., Part 1 of
Theorem 6.5.3) builds on the message-authentication scheme of [22], and the incremental signature scheme that protects the privacy of the edit sequence is due to [158]
(building upon [19]). Fail-stop signatures were dened and constructed in [167].
6.6.7. Exercises
Exercise 1: Deterministic signing and verication algorithms:
1. Using a pseudorandom function ensemble, show how to transform any (privatekey or public-key) signature scheme into one employing a deterministic signing
algorithm.
2. Using a pseudorandom function ensemble, show how to transform any messageauthentication scheme into one employing deterministic signing and verication
algorithms.
3. Verify that all signature schemes presented in the current chapter employ a deterministic verication algorithm.
4. (By Boaz Barak:) Show that any length-restricted signature scheme can be easily
transformed into one employing a deterministic verication algorithm.
Guideline (for Part 1): Augment the signing-key with a description of a pseudorandom function, and apply this function to the string to be signed in order to extract
the randomness used by the original signing algorithm.
Guideline (for Part 2): Analogous to Part 1. (Highlight your use of the private-key
hypothesis.) Alternatively, see Exercise 2.
Guideline (for Part 4): First transform the signature scheme into one in which
all valid signatures are of a length that is bounded by a polynomial in the security
parameter (and the length of the messages). Let (n) denote the length of the documents and m(n) denote the length of the corresponding signatures. Next, amplify the
verication algorithm such that its error probability is smaller than 2((n)+m(n)+n) .
Finally, incorporate the coin tosses of the verication algorithm in the vericationkey, making the former deterministic.
590
6.6 MISCELLANEOUS
Exercise 2: Canonical verication in the private-key version: Show that, without loss
of generality, the verication algorithm of a private-key signature scheme may consist of comparing the alleged signature to one produced by the verication algorithm itself; that is, the verication algorithm uses a verication-key that equals the
signing-key and produces signatures exactly as the signing algorithm.
Why does this claim fail with respect to public-key schemes?
Guideline: Use Part 1 of Exercise 1, and conclude that on a xed input, the signing
algorithm always produces the same output. Use the fact that (by Exercise 7.3) the
existence of message-authentication schemes implies the existence of pseudorandom functions, which are used in Part 1 of Exercise 1.
Exercise 3: Augmented attacks in the private-key case: In continuation of the discussion in Section 6.1.5.1, consider the denition of an augmented attack (on a privatekey signature scheme) in which the adversary is allowed verication-queries.
1. Show that in case the private-key signature scheme has unique valid signatures,
it is secure against augmented attacks if and only if it is secure against ordinary
attacks (as in Denition 6.1.2).
2. Assuming the existence of secure private-key signature schemes (as in
Denition 6.1.2), present such a secure scheme that is insecure under augmented
attacks.
Guideline (Part 1): Analyze the emulation outlined in the proof of Proposition 6.1.3. Specically, ignoring the redundant verication-queries (for which the
answer is determined by previous answers), consider the probability that the emulation has gambled correctly on all the verication-queries up to (and including)
the rst such query that should be answered afrmatively.
Guideline (Part 2): Given any secure MAC, (G, S, V ), assume without loss of
generality that in the key-pairs output by G, the verication-key equals the signingkey. Consider the scheme (G , S , V ) (with G = G), where Ss () = (Ss (), 0),
Vv (, (, 0)) = Vv (, ), and Vv (, (, i, )) = 1 if both Vv (, ) = 1 and the i-th
bit of v is . Prove that (G , S , V ) is secure under ordinary attacks, and present an
augmented attack that totally breaks it (i.e., obtains the signing-key s = v).
Exercise 4: The signature may reveal the document: Both for private-key and publickey signature schemes, show that if such secure schemes exist, then there exist
secure signature schemes in which any valid signature to a message allows for
efcient recovery of the entire message.
Exercise 5: On the triviality of some length-restricted signature schemes:
1. Show that for logarithmically bounded , secure -restricted private-key signature schemes (i.e., message-authentication schemes) can be trivially constructed
(without relying on any assumption).
2. In contrast, show that the existence of a secure -restricted public-key signature
scheme, even for 1, implies the existence of one-way functions.
591
(n)
Guideline (Part 1): On input 1n , the key-generator uniformly selects s {0, 1}2 n ,
and outputs the key pair (s, s). View s = s1 s2(n) , where each si is an n-bit
long string, and consider any xed ordering of the 2(n) strings of length (n).
The signature to {0, 1}(n) is dened as si , where i is the index of in the latter
ordering.
Guideline (Part 2): Let (G, S, V ) be a 1-restricted public-key signature scheme.
Dene f (1n , r ) = v if, on input 1n and coins r , algorithm G generates a key-pair
of the form (, v). Assuming that algorithm A inverts f with probability (n), we
construct a forger that attacks (G, S, V ) as follows. On input a verication key v,
the forger invokes A on input v. With probability (n), the forger obtains r such
that f (1n , r ) = v. In such a case, the forger obtains a matching signing-key s (i.e.,
(s, v) is output by G(1n ) on coins r ), and so can produce valid signatures to any
string of its choice.
Exercise 6: Failure of Construction 6.2.3 in case (n) = O(log n): Show that if Construction 6.2.3 is used with a logarithmically bounded , then the resulting scheme
is insecure.
Guideline: Note that by asking for polynomially many signatures, the adversary
may obtain two Ss -signatures that use the same (random) identier. Specically,
consider making the queries , for all possible {0, 1}(n) , and note that if
and are Ss -signed using the same identier, then we can derive a valid
Ss -signature to .
Exercise 7: Secure MACs imply one-way functions: Prove that the existence of secure message-authentication schemes implies the existence of one-way functions.
Specically, let (G, S, V ) be as in the hypothesis.
1. To simplify the following two items, show that, without loss of generality, G(1n )
uses n coins and outputs a signing-key of length n.
2. Assume rst that S is a deterministic signing algorithm. Prove that
def
f (r, 1 , ..., m ) = (Ss (1 ), ..., Ss (m ), 1 , ..., m ) is a one-way function, where
s = G 1 (r ) is the signing-key generated with coins r , all i s are of length n = |r |,
and m = (n).
3. Extend the proof to handle randomized signing algorithms, thus establishing the
main result.
Guideline (Parts 2 and 3): Note that with high probability (over the choice of the
i s), the m signatures (i.e., Ss (i )s) determine a set R such that for every r R,
it holds that SG 1 (r ) () = Ss () for most {0, 1}n . (Note that G 1 (r ) does not
necessarily equal s.) Show that this implies that the ability to invert f yields the
ability to forge (under a chosen message attack). (Hint: Use m random signingqueries to produce a random image of f , and use the obtained pre-image under
f , which contains an adequate signing-key, to forge a signature to a new random
message.) The extension to randomized signing is obtained by augmenting the preimage of the one-way function with the coins used by the m invocations of the
signing algorithm.
592
6.6 MISCELLANEOUS
Exercise 9: Consider a generalization of Construction 6.3.5 in which the pseudorandom function is replaced by an arbitrary secure MAC such that on input a
signing-key (r, s), a document {0, 1}(n) is signed by applying the MAC (with
signing-key s) to h r (). Show that, for some secure MAC and some collections
of hash functions with negligible collision probability, the suggested scheme is
insecure.
Guideline: Use the fact that the MAC may reveal the rst part of its argument,
whereas the hashing function may yield an output value in which the second part
is xed. Furthermore, it may be easy to infer the hashing function from sufciently
many inputoutput pairs, and it may be easy to nd a random pre-image of a
given hash function on a given image. Present constructions that satisfy all these
conditions, and show how combining them yields the desired result.
Exercise 10: Easily obtaining pseudorandom functions from certain MACs (advanced
exercise, based on [162]): Let (G, S, V ) be a secure message-authentication scheme,
and suppose that S is deterministic. Furthermore, suppose that |G 1 (1n )| = n and that
def
for every s, x {0, 1}n it holds that |Ss (x)| = (n) = |Ss (1n )|. Consider the Boolean
function ensemble { f s1 ,s2 : {0, 1}|s1 | {0, 1}}s1 ,s2 , where s1 is selected according to
G 1 (1n ) and s2 {0, 1}(n) is uniformly distributed, such that f s1 ,s2 () is dened to
equal the inner product mod 2 of Ss1 () and s2 . Prove that this function ensemble
is pseudorandom (as dened in Denition 3.6.9 for the case d(n + (n)) = n and
r (n) = 1).
Guideline: Consider hybrid experiments such that in the i-th hybrid the rst i
queries are answered by a truly random Boolean function and the rest of the queries
are answered by a uniformly distributed f s1 ,s2 . (Note that it seems important to use
this non-standard order of random versus pseudorandom answers.) Show that distinguishability of the i-th and i + 1st hybrids implies that a probabilistic polynomialtime oracle machine can have a non-negligible advantage in the following game. In
the game, the machine is rst asked to select ; next f s1 ,s2 is uniformly selected,
and the machine is given s2 as well as oracle access to Ss1 (but is not allowed the
query ) and is asked to guess f s1 ,s2 () (or, equivalently, to distinguish f s1 ,s2 ()
from a truly random bit).48 At this point, one may apply the proof of Theorem 2.5.2,
48
Note that the particular order (of random versus pseudorandom answers in the hybrids) allows this oracle
machine to generate the (corresponding) hybrid while playing this game properly. That is, the player answers
593
and deduce that the said oracle machine can be modied to construct Ss1 () with
non-negligible probability (when given oracle access to Ss1 but not being allowed
the query ), in contradiction to the security of the MAC.
Exercise 11: Prove that without loss of generality, one can always assume that a chosen
message attack makes at least one query. (This holds for general signature schemes
as well as for length-restricted and/or one-time ones.)
Guideline: Given an adversary A that outputs a message-signature pair ( , )
without making any query, modify it such that it makes an arbitrary query
{0, 1}| | \ { } just before producing that output.
Exercise 13: Secure one-time (public-key) signatures imply one-way functions: In contrast to Exercise 12, prove that the existence of secure one-time signature schemes
implies the existence of one-way functions. Furthermore, prove that this holds even
the rst i queries at random, sets to equal the i + 1st query, uses the tested bit value as the corresponding
answer, and uses s2 and the oracle Ss1 to answer the subsequent queries. It is also important that the game be
dened such that s2 is given only after the machine has selected ; see [162].
594
6.6 MISCELLANEOUS
for 1-restricted signature schemes that are secure (only) under attacks that make no
signing-queries.
Guideline: See guideline for Item 2 in Exercise 5.
Exercise 14: Prove that the existence of collision-free hashing collections implies the
existence of one-way functions.
Guideline: Given a collision-free hashing collection, {h r : {0, 1}
{0, 1}(|r |) }r {0,1} , consider the function f (r, x) = (r, h r (x)), where (say) |x| =
(|r |) + |r |. Prove that f is a one-way function, by assuming toward the contradiction that f can be efciently inverted with non-negligible probability, and deriving an efcient algorithm that forms collisions on random h r s. Given r , form a
collision under the function h r , by uniformly selecting x {0, 1}(|r |)+|r | , and feeding the inverting algorithm with input (r, h r (x)). Observe that with non-negligible
probability, a pre-image is obtained, and that only with exponentially vanishing
probability this pre-image is (r, x) itself. Thus, with non-negligible probability, we
obtain a pre-image (r, x ) = (r, x) such that h r (x ) = h r (x).
Exercise 15: Modify Construction 6.2.8 so as to allow the computation of the hashvalue of an input string while processing the input in an on-line fashion; that is,
the implementation of the hashing process should process the input x in a bit-by-bit
manner, while storing only the current bit and a small amount of state information
(i.e., the number of bits encountered so far and an element of Ds ).
def
Exercise 16: Secure MACs that hide the message: In contrast to Exercise 4, show that
if secure message-authentication schemes exist, then there exist such schemes in
which it is infeasible (for a party not knowing the key) to extract from the signature any partial information about the message (except for the message length).
(Indeed, privacy of the message is formulated as the denition of semantic security
of encryption schemes; see Chapter 5.)
Guideline: Combine a message-authentication scheme with an adequate privatekey encryption scheme. Refer to such issues as the type of security required of the
encryption scheme and why the hypothesis yields the existence of the ingredients
used in the construction.
Exercise 17: In continuation of Exercise 16, show that if there exist collision-free
hashing functions, then there exist message-authentication schemes in which it is
infeasible (for a party not knowing the key) to extract from the signature any partial
information about the message including the message length. How come we can
595
hide the message length in this context, whereas we cannot do this in the context of
encryption schemes?
Guideline: Combine a message-authentication scheme having xed-length signatures with an adequate private-key encryption scheme. Again, refer to issues as in
Exercise 16.
Exercise 18: Alterntaive formulation of state-based MACs (by Boaz Barak): For
S = (S , S ) and V = (V , V ), consider the following reformulation of Item 2 of
Denition 6.3.9: For every pair (s (0) , v (0) ) in the range of G(1n ), every sequence
of messages (i) s, and every i, it holds that V (v (i1) , (i) , S (s (i1) , (i) )) = 1,
( j)
( j)
( j1) | ( j) |
where s ( j) = S (s ( j1) , 1| | ) and v ( j) = V (v ( j1) , 1| | , 1|S (e ,1 )| ) for j =
1, ..., i 1. Prove the equivalence of the two formulations.
Exercise 19: Prove that the existence of collections of UOWHF implies the existence
of one-way functions. Furthermore, show that uniformly chosen functions in any
collection of UOWHFs are hard to invert (in the sense of Denition 2.4.3).
Guideline: Note that the guidelines provided in Exercise 14 can be modied to t
the current context. Specically, the suggested collision-forming algorithm is given
uniformly distributed r and x, and invokes the inverter on input (r, h r (x)), hoping
to obtain a designated collision with x under h r . Note that the furthermore-clause
is implicit in the proof.
Exercise 20: Assuming the existence of one-way functions, show that there exists a
collection of universal one-way hashing functions that is not collision-free.
Guideline: Given a collection of universal one-way hashing functions, { f s :
{0, 1} {0, 1}|s| }, consider the collection F = { f s : {0, 1} {0, 1}|s| } dened
so that f s (x) = (0, f s (x)) if the |s|-bit long prex of x is different from s, and
f s (sx ) = (1, s) otherwise. Clearly, F is not collision-free. Show that F is a collection of universal one-way hashing functions.
Exercise 21: Show that for every nite family of functions H , there exists x = y such
that h(x) = h(y) for every h H . Furthermore, show that for H = {h : {0, 1}
{0, 1}m }, this holds even for |x|, |y| m |H |.
t
Guideline: Consider the mapping x (h 1 (x), ..., h t (x)), where H = {h i }i=1
.
m t
Since the number of possible images is at most (2 ) , we get a collision as soon as
we consider more than 2mt pre-images.
596
6.6 MISCELLANEOUS
Guideline: Note that we have eliminated the shifting vector b used in Exercise 22.2
of Chapter 3, but this does not affect the relevant analysis.
2 n/2 . (Hint: Use a different hashing function at each level of the tree.)
2. (By Hugo Krawczyk): Show that the tree-hashing scheme of Construction 6.2.13,
where the same hashing function is used in all levels of the tree, fails in the current
context. That is, there exists a hashing ensemble {hr : {0, 1}2m(|r |) {0, 1}m(|r |) }r
with negligible collision probability, such that applying Construction 6.2.13 to it
(even with depth two) yields an ensemble with high collision probability.
3. As in Part 2, show that the block-chaining method of Construction 6.2.11 fails in
the current context (even for three blocks).
Guideline (Part 1): Let {h r : {0, 1}2m(|r |) {0, 1}m(|r |) }r be a hashing ensemble
with collision probability cp. Recall that such ensembles with m(n) = n/3 and
cp(n) = 2m(n) can be constructed (see Exercise 22). Then, consider the function
ensemble {h r1 ,...,rm(n) : {0, 1} {0, 1}2m(n) }nN , where all ri s are of length n, such
that h r1 ,...,rm(n) (x) is dened as follows:
def
2. Let i = 1, ..., t, and let yd,i = xi . For j = d 1, ..., 1, 0 and i = 1, ..., 2 j , let
y j,i = h r j (y j+1,2i1 y j+1,2i ). The hash value equals (y0,1 , |x|).
def
The above functions have description length N = m(n) n and map strings of
length at most 2m(n) to strings of length 2m(n). It is easy to bound the collision
probability (for strings of equal length) by the probability of collision occuring
in each of the levels of the tree. In fact, for x1 x t = x1 xt such that xi = xi ,
it sufces to bound the sum of the probabilities that y j,i/2d j = y j,i/2d j holds
(given that y j+1,i/2d( j+1) = y j+1,i/2d( j+1) ) for j = d 1, ..., 1, 0. Thus, this generalized hashing ensemble has a (, )-collision property, where (N ) = 2m(n) and
(N ) = m(n) cp(n). We stress that the collision probability of the tree-hashing
scheme grows linearly with the depth of the tree (rather than linearly with its size).
Recalling that we may use m(n) = n/3 and cp(n) = 2m(n) , we obtain (using N =
1/2
1/2
1/2
n 2 /3 = 3m(n)2 ) (N ) = 2(N /3) > 2(N /4) and (N ) < (N /(N )) < 2(N /4) (as
desired).
Guideline (Part 2): Given a hashing family as in the hypothesis, modify it into
{h r,s
: {0, 1}2m {0, 1}m }r,s , where s {0, 1}m , such that h r,s
(02m ) = s, h r,s
(sv) =
m
m
2m
0 for all v {0, 1} , and h r,s (w) = h r (w) for each other w {0, 1} . Note that
the new family maintains the collision probability of the original one up to an
additive term of O(2m ). On the other hand, for every w {0, 1}2m , it holds
597
Exercise 24: On the additional properties required in Proposition 6.4.21: In continuation of Exercise 23 of Chapter 3, show that the function family Snn1 presented
there satises the following two properties:
1. All but a negligible fraction of the functions in Snn1 are 2-to-1.
2. There exists a probabilistic polynomial-time algorithm that, given y1 , y2 {0, 1}n
and z 1 , z 2 {0, 1}n1 , outputs a uniformly distributed element of {s Snn1 :
h s (yi ) = z i i {1, 2}}.
Guideline: Recall that each function in Snn1 is described by a pair of elements of
the nite eld GF(2n ), where the pair (a, b) describes the function h a,b that maps
x GF(2n ) to the (n 1)-bit prex of the n-bit representation of ax + b, where
the arithmetic is of the eld GF(2n ). The rst condition follows by observing that
the function h a,b is 2-to-1 if and only if a = 0. The second condition follows by
observing that h a,b (yi ) = zi if and only if ayi + b = vi for some vi that is a singlebit extension of zi . Thus, generating a pair (a, b), such that h a,b (yi ) = z i for both
is, amounts to selecting random single-bit extensions vi s, and (assuming y1 = y2 )
solving the system {ayi + b = vi }i=1,2 (for the variables a and b).
598
CHAPTER SEVEN
7.1. Overview
A general framework for casting (m-party) cryptographic (protocol) problems consists
of specifying a random process that maps m inputs to m outputs. The inputs to the
process are to be thought of as local inputs of m parties, and the m outputs are their
corresponding (desired) local outputs. The random process describes the desired functionality. That is, if the m parties were to trust each other (or trust some external party),
then they could each send their local input to the trusted party, who would compute
the outcome of the process and send to each party the corresponding output. A pivotal
question in the area of cryptographic protocols is the extent to which this (imaginary)
trusted party can be emulated by the mutually distrustful parties themselves. (See
illustration in Figure 7.1.)
600
7.1 OVERVIEW
REAL MODEL
IDEAL MODEL
The results mentioned previously and surveyed later describe a variety of models in
which such an emulation is possible. The models vary by the underlying assumptions
regarding the communication channels, the numerous parameters relating to the extent
of adversarial behavior, and the desired level of emulation of the trusted party (i.e.,
level of security). We stress that unless stated differently, the two-party case is an
important special case of the treatment of the multi-party setting (i.e., we consider any
m 2).
the correctness of the honest parties local outputs (i.e., their consistency with the
functionality).
The approach outlined here can be applied in a variety of models, and is used to
dene the goals of security in these models.1 We rst discuss some of the parameters
used in dening various models, and next demonstrate the application of this approach
to a couple of important cases (cf. Sections 7.1.1.2 and 7.1.1.3).
r Set-up assumptions: Unless differently stated, we make no set-up assumptions (except for the obvious assumption that all parties have copies of the protocols program).
However, in some cases it is assumed that each party knows some information (e.g.,
a verication-key) corresponding to each of the other parties (or, one may assume
the existence of a public-key infrastructure). Another assumption, made more rarely,
is that all parties have access to some common (trusted) random string.
r The communication channels: Here we refer to issues like the privacy and reliablity
of data sent over the channels, as well as to the availability and the communication
features of the channels.
The standard assumption in the area is that the adversary can tap all communication
channels (between honest parties); that is, the channels per se do not provide privacy
(i.e., privacy of the data sent over them). In contrast, one may postulate that the adversary cannot obtain messages sent between honest parties, yielding the so-called
private-channel model. This postulate may be justied in some settings. Furthermore, it may be viewed as a useful abstraction that provides a clean model for study
and development of secure protocols. In this respect, it is important to mention that
in a variety of settings of the other parameters, the private-channel model can be
emulated by ordinary (i.e., tapped point-to-point) channels.
The standard assumption in the area is that the adversary cannot omit, modify, duplicate, or generate messages sent over the communication channels (between honest
1
A few technical comments are in place. Firstly, we assume that the inputs of all parties are of the same length.
We comment that as long as the lengths of the inputs are polynomially related, this convention can be enforced
by padding. On the other hand, some length restriction is essential for the security results, because (in general)
it is impossible to hide all information regarding the length of the inputs to a protocol. Secondly, we assume that
the desired functionality is computable in probabilistic polynomial-time, because we wish the secure protocol to
run in probabilistic polynomial-time (and a protocol cannot be more efcient than the corresponding centralized
algorithm). Clearly, the results can be extended to functionalities that are computable within any given (timeconstructible) time bound, using adequate padding.
602
7.1 OVERVIEW
parties); that is, the channels are postulated to be reliable (in the sense that they guarantee the authenticity of the data sent over them). Furthermore, one may postulate
the existence of a broadcast channel. Again, these assumptions can be justied in
some settings and emulated in others.
Most work in the area assumes that communication is synchronous and that pointto-point channels exist between every pair of processors. However, one may also
consider asynchronous communication and arbitrary networks of point-to-point
channels.
r Computational limitations: Typically, we consider computationally bounded adversaries (e.g., probabilistic polynomial-time adversaries). However, the private-channel
model also allows for (meaningful) consideration of computationally unbounded adversaries.
We stress that, also in the latter case, security should be dened by requiring
that for every real adversary, whatever the adversary can compute after participating in the execution of the actual protocol be computable within comparable
time (e.g., in polynomially related time) by an imaginary adversary participating
in an imaginary execution of the trivial ideal protocol (for computing the desired
functionality with the help of a trusted party). Thus, results in the computationally
unboundedadversary model trivially imply results for computationally bounded
adversaries.
r Restricted adversarial behavior: The most general type of an adversary considered
in the literature is one that may corrupt parties to the protocol while the execution
goes on, and decide which parties to corrupt based on partial information it has
gathered so far. A somewhat more restricted model, which seems adequate in many
settings, postulates that the set of dishonest parties is xed (arbitrarily) before the
execution starts (but this set is, of course, not known to the honest parties). The latter
model is called non-adaptive as opposed to the adaptive adversary mentioned
rst.
An orthogonal parameter of restriction refers to whether a dishonest party takes
active steps to disrupt the execution of the protocol (i.e., sends messages that differ from those specied by the protocol), or merely gathers information (which it
may later share with the other dishonest parties). The latter adversary has been
given a variety of names, such as semi-honest, passive, and honest-but-curious.
This restricted model may be justied in certain settings, and certainly provides a
useful methodological locus (cf. Section 7.1.3). In the following, we refer to the
adversary of the unrestricted model as active; another commonly used name is
malicious.
r Restricted notions of security: One example is the willingness to tolerate unfair
protocols in which the execution can be suspended (at any time) by a dishonest
party, provided that it is detected doing so. We stress that in case the execution is
suspended, the dishonest party does not obtain more information than it could have
obtained if the execution were not suspended. What may happen is that some honest
parties will not obtain their desired outputs (although other parties did obtain their
corresponding outputs), but will rather detect that the execution was suspended. We
603
will say that this restricted notion of security allows abort (or allows premature
suspension of the execution).
r Upper bounds on the number of dishonest parties: In some models, secure multi-party
computation is possible only if a strict majority of the parties are honest.2 Sometimes even a special majority (e.g., 2/3) is required. General resilient adversarystructures have been considered, too (i.e., security is guaranteed in the case that the
set of dishonest parties equals one of the sets specied in a predetermined family
of sets).
r Mobile adversary: In most works, once a party is said to be dishonest it remains
so throughout the execution. More generally, one may consider transient adversarial
behavior (e.g., an adversary seizes control of some site and later withdraws from
it). This model, which will not be further discussed in this work, allows for the
construction of protocols that remain secure, even in case the adversary may seize
control of all sites during the execution (but never control concurrently, say, more than
10 percent of the sites). We comment that schemes secure in this model were later
termed proactive.
In the rest of this chapter we will consider a few specic settings of these parameters.
Specically, we will focus on non-adaptive, active, and computationally bounded adversaries, and will not assume the existence of private channels. In Section 7.1.1.2 we
consider this setting while restricting the dishonest parties to a strict minority, whereas
in Section 7.1.1.3 we consider a restricted notion of security for two-party protocols
that allows unfair suspension of execution (or allows abort).
Indeed, requiring an honest majority in the two-party case yields a meaningless model.
604
7.1 OVERVIEW
r For a real-model adversary A, controlling some minority of the parties (and tapping
all communication channels), and an m-sequence x, we denote by real, A (x) the
sequence of m outputs resulting from the execution of on input x under attack of
the adversary A.
r For an ideal-model adversary A , controlling some minority of the parties, and an
m-sequence x, we denote by ideal f, A (x) the sequence of m outputs resulting from
the ideal process described previously, on input x under attack of the adversary A .
We say that securely implements f with honest majority if for every feasible realmodel adversary A, controlling some minority of the parties, there exists a feasible idealmodel adversary A , controlling the same parties, so that the probability ensembles
{real, A (x)}x and {ideal f, A (x)}x are computationally indistinguishable (as in Part 2
of Denition 3.2.7 in Volume 1).
Thus, security means that the effect of each minority group in a real execution of a secure
protocol is essentially restricted to replacing its own local inputs (independently of
the local inputs of the majority parties) before the protocol starts, and replacing its
605
own local outputs (depending only on its local inputs and outputs) after the protocol
terminates. (We stress that in the real execution, the minority parties do obtain additional
pieces of information; yet in a secure protocol they gain nothing from these additional
pieces of information.)
The fact that Denition 7.1.1 refers to a model without private channels is reected
in the set of possible ensembles {real, A (x)}x that is determined by the (sketchy)
denition of the real-model adversary (which is allowed to tap all the communication
channels). When dening security in the private-channel model, the real-model adversary is not allowed to tap channels between honest parties, which in turn restricts the
set of possible ensembles {real, A (x)}x . Thus, the difference between the two models
is only reected in the denition of the real-model adversary. On the other hand, when
we wish to dene security with respect to passive adversaries, both the scope of the
real-model adversaries and the scope of the ideal-model adversaries change. In the realmodel execution, all parties follow the protocol, but the adversary may alter the output
of the dishonest parties arbitrarily, depending on all their intermediate internal states
(during the execution). In the corresponding ideal-model, the adversary is not allowed
to modify the inputs of dishonest parties (in Step 1), but is allowed to modify their
outputs (in Step 3).
We comment that a denition analogous to Denition 7.1.1 can also be presented
in case the dishonest parties are not in the minority. In fact, such a denition seems
more natural, but the problem is that such a denition cannot be satised. That is,
most natural functionalities do not have a protocol for computing them securely in case
at least half of the parties are dishonest and employ an adequate (active) adversarial
strategy. This follows from an impossibility result regarding two-party computation,
which essentially asserts that there is no way to prevent a party from prematurely
suspending the execution. On the other hand, secure multi-party computation with
dishonest majority is possible if (and only if) premature suspension of the execution is
not considered a breach of security.
606
7.1 OVERVIEW
each of the two parties may shut down the trusted (third) party at any point in time.
In particular, this may happen after the trusted party has supplied the outcome of the
computation to one party but before it has supplied it to the second. That is, an execution
in the ideal model proceeds as follows:
1. Each party sends its input to the trusted party, where the dishonest party may replace
its input or send no input at all (which may be viewed as aborting).
2. Upon receiving inputs from both parties, the trusted party determines the corresponding outputs and sends the rst output to the rst party.
3. In case the rst party is dishonest, it may instruct the trusted party to halt; otherwise
it always instructs the trusted party to proceed. If instructed to proceed, the trusted
party sends the second output to the second party.
4. Upon receiving the output message from the trusted party, the honest party outputs
it locally, whereas the dishonest party may determine its output based on all it knows
(i.e., its initial input and its received output).
A secure two-party computation allowing abort is required to emulate this ideal
model. That is, as in Denition 7.1.1, security is dened by requiring that for every
feasible real-model adversary A, there exists a feasible ideal-model adversary A , controlling the same party, so that the probability ensembles representing the corresponding
(real and ideal) executions are computationally indistinguishable. This means that each
partys effective malfunctioning in a secure protocol is restricted to supplying an initial input of its choice and aborting the computation at any point in time. (Needless to
say, the choice of the initial input of each party may not depend on the input of the other
party.)
We mention that an alternative way of dealing with the problem of premature suspension of execution (i.e., abort) is to restrict attention to single-output functionalities,
that is, functionalities in which only one party is supposed to obtain an output. The denition of secure computation of such functionalities can be identical to Denition 7.1.1,
with the exception that no restriction is made on the set of dishonest parties (and, in
particular, one may consider a single dishonest party in the case of two-party protocols).
For further details, see Section 7.2.3.2.
Theorem 7.1.2 (the main feasibility results a sketch): Assuming the existence of
enhanced trapdoor permutations (as in Denition C.1.1 in Appendix C), general secure
multi-party computation is possible in the following three models:
1. Passive adversary, for any number of dishonest parties.
2. Active adversary that may control only a strict minority of the parties.
3. Active adversary, controlling any number of bad parties, provided that suspension
of execution is not considered a violation of security.
In all these cases, the adversary is computationally bounded and non-adaptive. On the
other hand, the adversary may tap the communication lines between honest parties (i.e.,
we do not assume the existence of private channels). The results for active adversaries
assume a broadcast channel.
Recall that a broadcast channel can be implemented (while tolerating any number of bad parties) using a signature scheme and assuming a public-key infrastructure (i.e., each party knows the verication-key corresponding to each of the other
parties).4
Most of the current chapter will be devoted to proving Theorem 7.1.2. In Sections 7.3
and 7.4 we prove Theorem 7.1.2 for the special case of two parties: In that case, Part 2
is not relevant, Part 1 is proved in Section 7.3, and Part 3 is proved in Section 7.4. The
general case (i.e., of multi-party computation) is treated in Section 7.5.
Note that the implementation of a broadcast channel can be cast as a cryptographic protocol problem (i.e., for
the functionality (v, , ..., ) (v, v, ..., v), where v {0, 1} and denotes the empty string). Thus, it is not
surprising that the results regarding active adversaries assume the existence of either such a channel or a setting
in which such a channel can be implemented (e.g., either that less than a third of the parties are faulty or that a
public-key infrastructure exists). (This reasoning fails if the denition of secure protocols is relaxed such that
it does not imply agreement; see [122].)
608
7.1 OVERVIEW
r Assuming the intractability of inverting RSA (or of the DLP), general secure
multi-party computation is possible in a model allowing an adaptive and active
computationally bounded adversary that may control only less than one third of the
parties. We stress that this result does not assume the existence of private channels.
Results for asynchronous communication and arbitrary networks of point-to-point channels are also known. For further details, see Section 7.7.5.
protocol that is secure in one of the two models of active adversaries (i.e., either
in a model allowing the adversary to control only a minority of the parties or in a
model in which premature suspension of the execution is not considered a violation of
security).
Recall that in the model of passive adversaries, all parties follow the prescribed
protocol, but at termination, the adversary may alter the output of the dishonest parties
depending on all their intermediate internal states (during the execution). In the following, we refer to protocols that are secure in the model of passive (resp., general or
active) adversaries by the term passively secure (resp., actively secure).
7.1 OVERVIEW
of the secrets associated with the wire exiting this gate. Furthermore, there is a
random correspondence between each pair of secrets and the Boolean values (of the
corresponding wire). That is, wire w is assigned a pair of secrets, denoted (sw , sw ),
and there is a random 1-1 mapping, denoted w , between this pair and the pair of
Boolean values (i.e., {w (sw ), w (sw )} = {0, 1}).
Each gadget is constructed such that knowledge of a secret that corresponds to
each wire entering the corresponding gate (in the circuit) yields a secret corresponding to the wire that exits this gate. Furthermore, the reconstruction of secrets using each gadget respects the functionality of the corresponding gate. For
example, if one knows the secret that corresponds to the 1-value of one entry-wire
and the secret that corresponds to the 0-value of the other entry-wire, and the gate
is an or-gate, then one obtains the secret that corresponds to the 1-value of the
exit-wire.
Specically, each gadget consists of four templates that are presented in a random
order, where each template corresponds to one of the four possible values of the
two entry-wires. A template may be merely a double encryption of the secret that
corresponds to the appropriate output value, where the double encryption uses as
keys the two secrets that correspond to the input values. That is, suppose a gate
computing f : {0, 1}2 {0, 1} has input wires w 1 and w 2 , and output wire w 3 .
Then, each of the four templates of this gate has the form E sw 1 (E sw 2 (sw 3 )), where
f (w 1 (sw 1 ), w 2 (sw 2 )) = w 3 (sw 3 ).
r Sending the scrambled circuit: The rst party sends the scrambled circuit to the
second party. In addition, the rst party sends to the second party the secrets that
correspond to its own (i.e., the rst partys) input bits (but not the values of these bits).
The rst party also reveals the correspondence between the pair of secrets associated
with each output (i.e., circuit-output wire) and the Boolean values.5 We stress that
the random correspondence between the pair of secrets associated with each other
wire and the Boolean values is kept secret (by the rst party).
r Oblivious Transfer of adequate secrets: Next, the rst party uses a (1-out-of-2) Oblivious Transfer protocol in order to hand the second party the secrets corresponding
to the second partys input bits (without the rst party learning anything about these
bits).
Loosely speaking, a 1-out-of-k Oblivious Transfer is a protocol enabling one party to
obtain one of k secrets held by another party, without the second party learning which
secret was obtained by the rst party. That is, we refer to the two-party functionality
(i, (s1 , ..., sk )) (si , )
(7.1)
r Locally evaluating the scrambled circuit: Finally, the second party evaluates the
scrambled circuit gate-by-gate, starting from the top (circuit-input) gates (for which
it knows one secret per each wire) and ending at the bottom (circuit-output) gates
5
This can be done by providing, for each output wire, a succinct 2-partition (of all strings) that separates the two
secrets associated with this wire.
612
7.1 OVERVIEW
r When encountering a gate, the parties already hold shares of the values of the wires
entering the gate, and their aim is to obtain shares of the value of the wire exiting
the gate.
r For a not-gate, propagating shares through the gate is easy: The rst party just ips
the value of its share, and all other parties maintain their shares.
r For an and-gate, propagating shares through the gate requires a secure (i.e., passively
secure) multi-party protocol. Since an and-gate corresponds to multiplication modulo 2, the parties need to securely compute the following randomized functionality
(in which the xi s denote shares of one entry-wire, the yi s denote shares of the second
entry-wire, the z i s denote shares of the exit-wire, and the shares indexed by i belong
to Party i):
((x 1 , y1 ), ..., (x m , ym )) (z 1 , ..., z 2 )
(7.2)
where
m
m
m
zi =
xi
yi
i=1
i=1
(7.3)
i=1
For simplicity, we may assume the private-channel model, in which case a value sent to an honest party cannot
be read by the adversary.
613
i=1
i=1
1i< jm
Thus, the m-ary functionality of Eq. (7.2) and Eq. (7.3) can be computed as follows
(where all arithmetic operations are mod 2):
def
Corresponding
value of (x j , y j )
(0, 0)
(0, 1)
(1, 0)
(1, 1)
(secret-sharing) polynomials representing the two inputs (using the fact that for polynomials p and q, and any eld element e [and in particular e = 0, 1, ..., m], it holds
that p(e) + q(e) = ( p + q)(e)). The emulation of multiplication is more involved and
requires interaction (because the product of polynomials yields a polynomial of higher
degree, and thus the polynomial representing the output cannot be the product of the
polynomials representing the two inputs). Indeed, the aim of the interaction is to turn
the shares of the product polynomial into shares of a degree d polynomial that has the
same free-term as the product polynomial (which is of degree 2d). This can be done
using the fact that the coefcients of a polynomial are a linear combination of its values
at sufciently many arguments (and the other way around), and the fact that one can
privately compute any linear combination (of secret values). For further details, see
Section 7.6.
r Symmetric deterministic functionalities: This is the simplest general case often considered in the literature. In this case, for some predetermined function, g, both parties
wish to obtain the value of g evaluated at the input pair. That is, the functionality
def
they wish to (securely) compute is f (x, y) = (g(x, y), g(x, y)). For example, they
may be interested in determining whether their local inputs are equal (i.e., g(x, y) =
1 iff x = y) or whether their local inputs viewed as sets are disjoint (i.e., g(x, y) =
1 iff for every i either x i = 0 or yi = 0).
r Input-oblivious randomized functionalities: Whereas input-oblivious deterministic
functionalities are trivial, some input-oblivious randomized functionalities are very
interesting. Suppose, for example, that the two parties wish to toss a fair coin (i.e.,
615
such that no party can inuence the outcome by itself). This task can be cast
by requiring that for every input pair (x, y), the output pair f (x, y) is uniformly
distributed over {(0, 0), (1, 1)}.
r Asymmetric functionalities: The general case of asymmetric functionalities is capdef
tured by functionalities of the form f (x, y) = ( f (x, y), ), where f : {0, 1}
{0, 1} {0, 1} is a randomized process and denotes the empty string. A special case of interest is when one party wishes to obtain some predetermined partial
information regarding the secret input of the other party, where the latter secret
is veriable with respect to the input of the rst party. This task is captured by a
def
def
functionality f such that f (x, y) = (R(y), ) if V (x, y) = 1 and f (x, y) = (, )
otherwise, where R represents the partial information to be revealed and V represents
the verication procedure.7
We stress that whenever we consider a protocol for securely computing f , it is implicitly
assumed that the protocol correctly computes f when both parties follow the prescribed
program. That is, the joint output distribution of the protocol, played by honest parties,
on input pair (x, y), equals the distribution of f (x, y).
Notation. We let denote the empty string and denote a special error symbol.
That is, whereas {0, 1} (and || = 0), we postulate that {0, 1} (and is thus
distinguishable from any string in {0, 1} ).
One may also consider the non-veriable case (i.e., V 1), but in this case, nothing can prevent the second
party from acting as if its input is different from its actual secret input.
The situation is analogous to the denition of secure encryption, where it is required that the message length
be polynomially related to the key length. Actually, things become even worse in the current setting because of
the possible malicious behavior of parties.
616
padding, any natural functionality can be cast as one satisfying the equal-length
convention.9
We now turn to the second convention. Certainly, the total running time of a secure
two-party protocol for computing the functionality cannot be smaller than the time required to compute the functionality (in the ordinary sense). Arguing as in the case of
input lengths, one can see that we need an a priori bound on the complexity of the functionality. A more general approach would be to let such a bound be given explicitly to
both parties as an auxiliary input. In such a case, the protocol can be required to run for
a time that is bounded by a xed polynomial in this auxiliary parameter (i.e., the timecomplexity bound of f ). Assuming that a good upper bound of the complexity of f is
time-constructible, and using standard padding techniques, we can reduce this general
case to the special case discussed previously: That is, given a general functionality, g,
and a time-bound t : N N, we introduce the functionality
g(x, y) if i = j = t(|x|) = t(|y|)
def
f ((x, 1i ), (y, 1 j )) =
(, ) otherwise
where is a special error symbol. Now, the problem of securely computing g reduces
to the problem of securely computing f , which in turn is polynomial-time computable.
Finally, we turn to the third convention. Indeed, a more general convention would
be to have an explicit security parameter that determines the security of the protocol.
This general alternative is essential for allowing secure computation of nite functionalities (i.e., functionalities dened on nite input domains). We may accommodate
the general convention using the special case, postulated previously, as follows. Suppose that we want to compute the functionality f , on input pair (x, y) with security
(polynomial in) the parameter s. Then we introduce the functionality
f ((x, 1s ), (y, 1s )) = f (x, y) ,
def
and consider secure protocols for computing f . Indeed, this reduction corresponds to
the realistic setting where the parties rst agree on the desired level of security, and
only then proceed to compute the function (using this level of security).
Partial functionalities. The rst convention postulates that we are actually not considering mapping from the set of all pairs of bit strings, but rather mappings from a
certain (general) set of pairs of strings (i.e., nN {0, 1}n {0, 1}n ). Taking this convention one step further, one may consider functionalities that are dened only over a set
R nN {0, 1}n {0, 1}n . Clearly, securely computing such a functionality f can be
reduced to computing any of its extensions to nN {0, 1}n {0, 1}n (e.g., computing
def
def
f such that f (x, y) = f (x, y) for (x, y) R and f (x, y) = (, ) otherwise). With
one exception (to be discussed explicitly), our exposition only refers to functionalities
that are dened over the set of all pairs of strings of equal length.
9
In the sequel, we sometimes take the liberty of presenting functionalities in a form that violates the equal-length
convention (e.g., in the case of Oblivious Transfer). Indeed, these formulations can be easily modied to t the
equal-length convention.
617
1
p(n)
(7.5)
Note that an innite sequence of ws may be incorporated in the family; hence, the
denition is not strengthened by providing the circuit Cn with w as an additional input.11
Recall that computational indistinguishability is a relaxation of statistical indistindef
def
guishability, where here, the ensembles X = {X w }wS and Y = {Yw }wS are statistis
cally indistinguishable, denoted X Y , if for every positive polynomial p(), every
sufciently large n and every w S {0, 1}n ,
{0,1}
1
p(n)
(7.6)
In case the differences are all equal to zero, we say that the ensembles are identically
distributed (and denote this by X Y ).
10
11
Consequently, the value of f n (x, y) may depend only on poly(n)-long prexes of x and y.
Indeed, here we capitalize on the non-uniformity of the class of potential distinguishers. In case one considers the
class of uniform (probabilistic polynomial-time) distinguishers, it is necessary to provide these distinguishers
with the distributions index (i.e., w); see (Part 2 of) Denition 3.2.2.
618
In the following, we present two equivalent formulations of security in the semihonest model. The rst formulation capitalizes on the simplicity of the current model
and denes security in it by a straightforward extension of the denition of zeroknowledge. The second formulation applies the general methodology outlined in Section 7.1.1. Indeed, both formulations follow the simulation paradigm, but the rst does
so by extending the denition of zero-knowledge, whereas the second does so by degenerating the general real-vs.-ideal methodology.
(7.7)
(7.8)
where |x| = |y|. (Recall that denotes computational indistinguishability by (nonuniform) families of polynomial-size circuits.)
r (general case) We say that privately computes f if there exist probabilistic
polynomial-time algorithms, denoted S1 and S2 , such that
c
{(S1 (x, f 1 (x, y)), f (x, y))}x, y {(view
1 (x, y), output (x, y))} x, y
c
{(S2 (y, f 2 (x, y)), f (x, y))}x, y {(view
2 (x, y), output (x, y))} x, y
12
(7.9)
(7.10)
By saying that computes (rather than privately computes) f , we mean that the output distribution of the
protocol (when played by honest or semi-honest parties) on input pair (x, y) is distributed identically to f (x, y).
620
Consider rst the deterministic case: Eq. (7.7) (resp., Eq. (7.8)) asserts that the view of
the rst (resp., second) party, on each possible pair of inputs, can be efciently simulated
based solely on its own input and output. Thus, all that this party learns from the full transcript of the proper execution is effectively implied by its own output from this execution
(and its own input to it). In other words, all that the party learns from the (semi-honest)
execution is essentially implied by the output itself. Next, note that the formulation for
the deterministic case coincides with the general formulation as applied to deterministic
functionalities (because, in any protocol that computes a deterministic functionality
f , it must hold that output (x, y) = f (x, y), for each pair of inputs (x, y)).13
In contrast to the deterministic case, augmenting the view of the semi-honest party by
the output of the other party is essential when randomized functionalities are concerned.
Note that in this case, for any protocol that computes a randomized functionality
f , it does not necessarily hold that output (x, y) = f (x, y), because each of the two
objects is a random variable. Indeed, these two random variables must be identically (or
similarly) distributed, but this does not sufce for asserting, for example, that Eq. (7.7)
implies Eq. (7.9). Two disturbing counterexamples follow:
1. Consider the functionality (1n , 1n ) (r, ), where r is uniformly distributed in
{0, 1}n , and a protocol in which Party 1 uniformly selects r {0, 1}n , sends it to
Party 2, and outputs r . Clearly, this protocol computes the said functionality; alas,
intuitively we should not consider this computation private (because Party 2 learns
the output of Party 1 although Party 2 is not supposed to learn anything about that
output). However, a simulator S2 (1n ) that outputs a uniformly chosen r {0, 1}n
satises Eq. (7.8) (but does not satisfy Eq. (7.10)).
The point is that Eq. (7.9) and Eq. (7.10) refer to the relation between a partys
output and the other partys view in the same execution of the protocol, and require
that this relation be maintained in the simulation. As is vividly demonstrated in
the aforementioned example, this relation is at the heart of the notion of security:
We should simulate a view (of the semi-honest party) that ts the actual output of the
honest party, and not merely simulate a view that ts the distribution of the possible
output of the honest party.
2. Furthermore, Eq. (7.9) and Eq. (7.10) require that the partys simulated view t its
actual output (which is given to the simulator). To demonstrate the issue at hand,
consider the foregoing functionality, and a protocol in which Party 1 uniformly selects
s {0, 1}n , and outputs r F(s), where F is a one-way permutation. Again, this
protocol computes the previous functionality, but it is not clear whether or not we
may consider this computation private (because Party 1 learns the pre-image of its
own output under F, something it could not have obtained if a trusted party were to
13
Recall that the input pairs (x, y) serve as indices to the distributions in the two ensembles under consideration,
and as such they are always given (or incorporated) in the potential distinguisher; see Section 7.2.1.2.
621
give it the output). Note that a simulator S1 (1n , r ) that uniformly selects s {0, 1}n
and outputs (s, F(s)) satises Eq. (7.7) (but does not satisfy Eq. (7.9)).
We comment that the current issue is less acute than the rst one (i.e., the one raised
in Item 1). Indeed, consider the following alternative to both Eq. (7.7) and Eq. (7.9):
c
{(S1 (x, f 1 (x, y)), f 2 (x, y))}x, y {(view
1 (x, y), output2 (x, y))}x, y (7.11)
Note that Eq. (7.11) addresses the problem raised in Item 1, but not the problem raised
in the current item. But is the current problem a real one? Note that the only difference
between Eq. (7.9) and Eq. (7.11) is that the former forces the simulated view to t the
output given to the simulator, whereas this is not guaranteed in Eq. (7.11). Indeed,
in Eq. (7.11) the view simulated for Party 1 may not t the output given to the
simulator, but the simulated view does t the output given to the honest Party 2. Is
the former fact of real importance or is it the case that all that matters is the relation
of the simulated view to the honest partys view? We are not sure, but (following a
general principle) when in doubt, we prefer to be more careful and adopt the more
stringent denition. Furthermore, the stronger denition simplies the proof of the
Composition Theorem for the semi-honest model (i.e., Theorem 7.3.3).
What about Auxiliary Inputs? Auxiliary inputs are implicit in Denition 7.2.1. They
are represented by the fact that the denition asks for computational indistinguishability by non-uniform families of polynomial-size circuits (rather than computational
indistinguishability by probabilistic polynomial-time algorithms). In other words, indistinguishability also holds with respect to probabilistic polynomial-time machines
that obtain (non-uniform) auxiliary inputs.
Private Computation of Partial Functionalities. For functionalities that are dened
only for inputs pairs in some set R {0, 1} {0, 1} (see Section 7.2.1.1), private
computation is dened as in Denition 7.2.1, except that the ensembles are indexed by
pairs in R.
of each party sending its input to the trusted party (via a secure private channel), and
the third party computing the corresponding output pair and sending each output to the
corresponding party. The only adversarial behavior allowed here is for one of the parties
to determine its own output based on its input and the output it has received (from the
trusted party).14 This adversarial behavior represents the attempt to learn something
from the partys view of a proper execution (which, in the ideal model, consists only of
its local input and output). The other (i.e., honest) party merely outputs the output that
it has received (from the trusted party).
Next, we turn to the real model. Here, there is a real two-party protocol and the
adversarial behavior is restricted to be semi-honest. That is, the protocol is executed
properly, but one party may produce its output based on (an arbitrary polynomialtime computation applied to) its view of the execution (as dened earlier). We
stress that the only adversarial behavior allowed here is for one of the parties to
determine its own output based on its entire view of the proper execution of the
protocol.
Finally, we dene security in the semi-honest model. A secure protocol for the real
(semi-honest) model is such that for every feasible semi-honest behavior of one of the
parties, we can simulate the joint outcome (of their real computation) by an execution in
the ideal model (where also one party is semi-honest and the other is honest). Actually,
we need to augment the denition to account for a priori information available to semihonest parties before the protocol starts. This is done by supplying these parties with
auxiliary inputs.
Note that in both (ideal and real) models, the (semi-honest) adversarial behavior
takes place only after the proper execution of the corresponding protocol. Thus, in the
ideal model, this behavior is captured by a computation applied to the local inputoutput
pair, whereas in the real model, this behavior is captured by a computation applied to
the partys local view (of the execution).
Denition 7.2.2 (security in the semi-honest model): Let f : {0, 1} {0, 1}
{0, 1} {0, 1} be a functionality, where f 1 (x, y) (resp., f 2 (x, y)) denotes the rst
(resp., second) element of f (x, y), and let be a two-party protocol for computing f .
We stress that unlike in the malicious model, discussed in Section 7.2.3, here the dishonest (or rather semi-honest)
party is not allowed to modify its input (but must hand its actual input to the trusted party).
623
{ideal f, B(z) (x, y)}x, y,z {real, A(z) (x, y)}x, y,z
(7.12)
Without loss of generality, we show how to simulate the rst partys view. Toward this
end, we dene the following admissible pair A = (A1 , A2 ) for the real model: A1 is
merely the identity transformation (i.e., it outputs the view given to it), whereas A2
(which represents an honest strategy for Party 2) produces an output as determined
by the view given to it. We stress that we consider an adversary A1 that does not
get an auxiliary input (or alternatively ignores it). Furthermore, the adversary merely
outputs the view given to it (and leaves the possible processing of this view to the
potential distinguisher). Let B = (B1 , B2 ) be the ideal-model adversary guaranteed
by Denition 7.2.2. We claim that (using) B1 (in the role of S1 ) satises Eq. (7.9),
rather than only Eq. (7.7). Loosely speaking, the claim holds because Denition 7.2.2
guarantees that the relation between the view of Party 1 and the outputs of both parties
in a real execution is preserved in the ideal model. Specically, since A1 is a passive
adversary (and computes f ), the output of Party 1 in a real execution equals the
value that is determined in the view (of Party 1), which in turn ts the functionality.
Now, Denition 7.2.2 implies that the same relation between the (simulated) view of
Party 1 and the outputs must hold in the ideal model. It follows that using B1 in role of
S1 guarantees that the simulated view ts the output given to the simulator (as well as
the output not given to it).
We now show that Denition 7.2.1 implies Denition 7.2.2. Suppose that privately
computes f , and let S1 and S2 be as guaranteed in Denition 7.2.1. Let A = (A1 , A2 ) be
an admissible pair for the real-model adversaries. Without loss of generality, we assume
that A2 merely maps the view (of the second party) to the corresponding output (i.e.,
f 2 (x, y)); that is, Party 2 is honest (and Party 1 is semi-honest). Then, we dene an idealdef
def
model pair B = (B1 , B2 ) such that B1 (x, v, z) = A1 (S1 (x, v), z) and B2 (y, v, z) = v.
(Note that B is indeed admissible with respect to the ideal model.) The following holds
(for any innite sequence of (x, y, z)s):
real, A(z) (x, y) = (output (x, y), A1 (view
1 (x, y), z), A 2 (view2 (x, y), z))
= (output (x, y), A1 (view
1 (x, y), z), output2 (x, y))
c
where the computational indistinguishability (i.e., ) is due to the guarantee regarding S1 (in its general form); that is, Eq. (7.9). Indeed, the latter only guaranc
tees (view
1 (x, y), output (x, y)) (S1 (x, f 1 (x, y)), f (x, y)), but by incorporating
A1 and z in the potential distinguisher, the soft-equality follows.
Conclusion. This proof demonstrates that the alternative formulation of Denition 7.2.2
is merely a cumbersome form of the simpler Denition 7.2.1. We stress that the reason we have presented the cumbersome form is the fact that it follows the general
framework of denitions of security that is used for the malicious adversarial behavior. In the rest of this chapter, whenever we deal with the semi-honest model (for
625
two-party computation), we will use Denition 7.2.1. Furthermore, since much of the
text focuses on deterministic functionalities, we will be able to use the simpler case of
Denition 7.2.1.
which case the complications introduced by aborting do not arise. The interested reader
may proceed directly to Section 7.2.3.2, which is mostly self-contained.)
The Ideal Model. We rst translate the previous discussion into a denition of an ideal
model. That is, we will allow in the ideal model whatever cannot possibly be prevented
in any real execution. An alternative way of looking at things is that we assume that the
the two parties have at their disposal a trusted third party, but even such a party cannot
prevent certain malicious behavior. Specically, we allow a malicious party in the ideal
model to refuse to participate in the protocol or to substitute its local input. (Clearly,
neither can be prevented by a trusted third party.) In addition, we postulate that the
rst party has the option of stopping the trusted party just after obtaining its part of
the output, and before the trusted party sends the other output part to the second party.
Such an option is not given to the second party.15 Thus, an execution in the ideal model
proceeds as follows (where all actions of both the honest and the malicious parties must
be feasible to implement):
Inputs: Each party obtains an input, denoted u.
Sending inputs to the trusted party: An honest party always sends u to the trusted party.
A malicious party may, depending on u (as well as on an auxiliary input and its coin
tosses), either abort or send some u {0, 1}|u| to the trusted party.16
The trusted party answers the rst party: In case it has obtained an input pair, (x, y),
the trusted party (for computing f ) rst replies to the rst party with f 1 (x, y).
Otherwise (i.e., in case it receives only one input), the trusted party replies to both
parties with a special symbol, denoted .
The trusted party answers the second party: In case the rst party is malicious, it may,
depending on its input and the trusted partys answer, decide to stop the trusted
party. In this case, the trusted party sends to the second party. Otherwise (i.e., if
not stopped), the trusted party sends f 2 (x, y) to the second party.
Outputs: An honest party always outputs the message it has obtained from the trusted
party. A malicious party may output an arbitrary (polynomial-time computable)
function of its initial input (auxiliary input and random-tape) and the message it has
obtained from the trusted party.
In fact, without loss of generality, we may assume that both parties send inputs to the
trusted party (rather than allowing the malicious party not to enter the protocol). This
assumption can be justied by letting the trusted party use some default value (or a
15
This asymmetry is due to the non-concurrent nature of communication in the model. Since we postulate that
the trusted party sends the answer rst to the rst party, the rst party (but not the second) has the option of
stopping the trust party after obtaining its part of the output. The second party can only stop the trust party
before obtaining its output, but this is the same as refusing to participate. See further discussion at the end of
the current subsection.
16 We comment that restricting the ideal-model adversary (to replacing u by u of the same length) only strengthens
the denition of security. This restriction is essential to our formulation, because (by our convention) the
functionality f is dened only for pairs of strings of equal length.
627
special abort symbol) in case it does not get an input from one of the parties.17 Thus, the
ideal model (computation) is captured by the following denition, where the algorithms
B1 and B2 represent all possible actions in the model.18 In particular, B1 (x, z, r ) (resp.,
B2 (y, z, r )) represents the input handed to the trusted party by Party 1 (resp., Party 2)
having local input x (resp., y) and auxiliary input z and using random-tape r . Indeed, if
Party 1 (resp., Party 2) is honest, then B1 (x, z, r ) = x (resp., B2 (y, z, r ) = y). Likewise,
B1 (x, z, r, v) = represents a decision of Party 1 to stop the trusted party, on input
x (auxiliary input z and random-tape r ), after receiving the (output) value v from the
trusted party. In this case, B1 (x, z, r, v, ) represents the partys local output. Otherwise
(i.e., B1 (x, z, r, v) = ), we let B1 (x, z, r, v) itself represent the partys local output.
The local output of Party 2 is always represented by B2 (y, z, r, v), where y is the partys
local input (z is the auxiliary input, r is the random-tape) and v is the value received from
the trusted party. Indeed, if Party 1 (resp., Party 2) is honest, then B1 (x, z, r, v) = v
(resp., B2 (y, z, r, v) = v).
Denition 7.2.4 (malicious adversaries, the ideal model): Let f : {0, 1} {0, 1}
{0, 1} {0, 1} be a functionality, where f 1 (x, y) (resp., f 2 (x, y)) denotes the rst
(resp., second) element of f (x, y). Let B = (B1 , B2 ) be a pair of probabilistic
polynomial-time algorithms representing strategies in the ideal model. Such a pair
is admissible (in the ideal malicious model) if for at least one i {1, 2}, called honest, we have Bi (u, z, r ) = u and Bi (u, z, r, v) = v, for every possible value of u, z, r ,
and v. Furthermore, |Bi (u, z, r )| = |u| must hold for both is. The joint execution of
f under B in the ideal model (on input pair (x, y) and auxiliary input z), denoted
ideal f, B(z) (x, y), is dened by uniformly selecting a random-tape r for the adversary,
def
and letting ideal f, B(z) (x, y) = (x, y, z, r ), where (x, y, z, r ) is dened as follows:
(7.13)
(7.14)
(7.15)
def
Both options (i.e., default value or a special abort symbol) are useful, and the choice depends on the protocol
designer. In case a special abort symbol is used, the functionality should be modied accordingly, such that if
one of the inputs equals the special abort symbol, then the output is a special abort symbol.
18 As in Denition 7.2.2, we make the peculiar choice of feeding both B s with the same auxiliary input z (and the
i
same random-tape r ). However, again, the honest strategy ignores this auxiliary input, which is only used by the
malicious strategy. Note that unlike in previous denitions, we make the random-tape (of the adversary) explicit
in the notation, the reason being that the same strategy is used to describe two different actions of the adversary
(rather than a single action, as in Denition 7.2.2). Since these actions may be probabilistically related, it is
important that they be determined based on the same random-tape.
628
Eq. (7.14) and Eq. (7.15) refer to the case in which Party 2 is honest (and Party 1 may
be malicious). Specically, Eq. (7.14) represents the sub-case where Party 1 invokes
the trusted party with a possibly substituted input, denoted B1 (x, z, r ), and aborts while
stopping the trusted party right after obtaining the output, f 1 (B1 (x, z, r ), y). In this
sub-case, Party 2 obtains no output (from the trusted party). Eq. (7.15) represents the
sub-case where Party 1 invokes the trusted party with a possibly substituted input, and
allows the trusted party to answer Party 2. In this sub-case, Party 2 obtains and outputs
f 2 (B1 (x, z, r ), y). In both sub-cases, the trusted party computes f (B1 (x, z, r ), y), and
Party 1 outputs a string that depends on both x, z, r and f 1 (B1 (x, z, r ), y). Likewise,
Eq. (7.13) represents possible malicious behavior of Party 2; however, in accordance
with the previous discussion, the trusted party rst supplies output to Party 1, and so
Party 2 does not have a real aborting option (analogous to Eq. (7.14)).
Execution in the Real Model. We next consider the real model in which a real (twoparty) protocol is executed (and there exist no trusted third parties). In this case, a
malicious party may follow an arbitrary feasible strategy, that is, any strategy implementable by a probabilistic polynomial-time algorithm (which gets an auxiliary input).
In particular, the malicious party may abort the execution at any point in time, and when
this happens prematurely, the other party is left with no output. In analogy to the ideal
case, we use algorithms to dene strategies in a protocol, where these strategies (or
algorithms implementing them) map partial execution histories to the next message.
Denition 7.2.5 (malicious adversaries, the real model): Let f be as in Denition 7.2.4,
and be a two-party protocol for computing f . Let A = (A1 , A2 ) be a pair of probabilistic polynomial-time algorithms representing strategies in the real model. Such a
pair is admissible (with respect to ) (for the real malicious model) if at least one Ai
coincides with the strategy specied by . (In particular, this Ai ignores the auxiliary
input.) The joint execution of under A in the real model (on input pair (x, y) and
auxiliary input z), denoted real, A(z) (x, y), is dened as the output pair resulting from
the interaction between A1 (x, z) and A2 (y, z). (Recall that the honest Ai ignores the
auxiliary input z, and so our peculiar choice of providing both Ai s with the same z is
immaterial.)
In some places (in Section 7.4), we will assume that the algorithms representing the
real-model adversaries (i.e., the algorithm Ai that does not follow ) are deterministic.
This is justied by observing that one may just (consider and) x the best possible
choice of coins for a randomized adversary and incorporate this choice in the auxiliary
input of a deterministic adversary (cf. Section 1.3.3 of Volume 1).
Security as Emulation of Real Execution in the Ideal Model. Having dened the
ideal and real models, we obtain the corresponding denition of security. Loosely
speaking, the denition asserts that a secure two-party protocol (in the real model)
emulates the ideal model (in which a trusted party exists). This is formulated by saying
that admissible adversaries in the ideal model are able to simulate (in the ideal model)
the execution of a secure real-model protocol under any admissible adversaries.
629
Denition 7.2.6 (security in the malicious model): Let f and be as in Denition 7.2.5. Protocol is said to securely compute f (in the malicious model) if for
every probabilistic polynomial-time pair of algorithms A = (A1 , A2 ) that is admissible
for the real model (of Denition 7.2.5), there exists a probabilistic polynomial-time pair
of algorithms B = (B1 , B2 ) that is admissible for the ideal model (of Denition 7.2.4)
such that
c
{ideal f, B(z) (x, y)}x, y,z {real, A(z) (x, y)}x, y,z
c
where x, y, z {0, 1} such that |x| = |y| and |z| = poly(|x|). (Recall that denotes computational indistinguishability by (non-uniform) families of polynomial-size
circuits.) When the context is clear, we sometimes refer to as a secure implementation of f .
One important property that Denition 7.2.6 implies is privacy with respect to malicious adversaries. That is, all that an adversary can learn by participating in the
protocol, while using an arbitrary (feasible) strategy, can be essentially inferred from
the corresponding output alone. Another property that is implied by Denition 7.2.6 is
correctness, which means that the output of the honest party must be consistent with
an input pair in which the element corresponding to the honest party equals the partys
actual input. Furthermore, the element corresponding to the adversary must be chosen
obliviously of the honest partys input. We stress that both properties are easily implied
by Denition 7.2.6, but the latter is not implied by combining the two properties. For
further discussion, see Exercise 3.
We wish to highlight another property that is implied by Denition 7.2.6: Loosely
speaking, this denition implies that at the end of the (real) execution of a secure protocol, each party knows the value of the corresponding input for which the output
is obtained.19 That is, when a malicious Party 1 obtains the output v, it knows an x
(which does not necessarily equal to its initial local input x) such that v = f 1 (x , y) for
some y (i.e., the local input of the honest Party 2). This knowledge is implied by the
equivalence to the ideal model, in which the party explicitly hands the (possibly modied) input to the trusted party. For example, say Party 1 uses the malicious strategy A1 .
Then the output values (in real, A (x, y)) correspond to the input pair (B1 (x), y),
where B1 is the ideal-model adversary derived from the real-model adversarial
strategy A1 .
We comment that although Denition 7.2.6 does not talk about transforming admissible As to admissible Bs, we will often use such phrases. Furthermore, although
the denition does not even guarantee that such a transformation is effective (i.e.,
computable), the transformations used in this work are all polynomial-time computable. Moreover, these transformations consist of generic programs for Bi that use
19
One concrete case where this property plays a central role is in the input-commitment functionality (of Section 7.4.3.6). Specically, if a secure implementation of this functionality is rst used in order to let Party 1
commit to its input, and next, Party 2 uses it in order to commit to its own input, then this property implies that
Party 2 cannot just copy the commitment made by Party 1 (unless Party 2 knows the input of Party 1).
630
One alternative convention is to associate with each protocol a binary value indicating which of the two parties is
allowed to meaningfully abort. This convention yields a more general (or less restrictive) denition of security,
where Denition 7.2.6 is obtained as a special case (in which this value is always required to equal 1). Yet the
protocols presented in this work are shown to be secure under the more restrictive denition.
21 Actually, the treatment of the case in which only the second party obtains an output (i.e., f (x, y) = (, f (x, y)))
2
is slightly different. However, also in this case, the event in which the rst party aborts after obtaining its (empty)
output can be discarded. In this case, this event (of obtaining an a priori xed output) is essentially equivalent
to the party aborting before obtaining output, which in turn can be viewed as replacing its input by a special
symbol.
631
with what happens after the rst party obtains its output (because the second party has
no output), and thus the complications arising from the issue of aborting the execution
can be eliminated. Consequently, computation in the ideal model takes the following
form:
Inputs: Each party obtains an input, denoted u.
Sending inputs to the trusted party: An honest party always sends u to the trusted party.
A malicious party may, depending on u (as well as on an auxiliary input and its coin
tosses), either abort or send some u {0, 1}|u| to the trusted party. However, without
loss of generality, aborting at this stage may be treated as supplying the trusted party
with a special symbol.
The answer of the trusted party: Upon obtaining an input pair, (x, y), the trusted party
(for computing f ) replies to the rst party with f 1 (x, y). Without loss of generality,
the trusted party only answers the rst party, because the second party has no output
(or, alternatively, should always output ).
Outputs: An honest party always outputs the message it has obtained from the trusted
party. A malicious party may output an arbitrary (polynomial-time computable)
function of its initial input (auxiliary input and its coin tosses) and the message it
has obtained from the trusted party.
Thus, the ideal model (computation) is captured by the following denition, where
the algorithms B1 and B2 represent all possible actions in the model. In particular,
B1 (x, z, r ) (resp., B2 (y, z, r )) represents the input handed to the trusted party by Party 1
(resp., Party 2) having local input x (resp., y), auxiliary input z, and random-tape r .
Indeed, if Party 1 (resp., Party 2) is honest, then B1 (x, z, r ) = x (resp., B2 (y, z, r ) = y).
Likewise, B1 (x, z, r, v) represents the output of Party 1, when having local input x
(auxiliary input z and random-tape r ) and receiving the value v from the trusted party,
whereas the output of Party 2 is represented by B2 (y, z, r, ). Indeed, if Party 1 (resp.,
Party 2) is honest, then B1 (x, z, r, v) = v (resp., B2 (y, z, r, ) = ).
Denition 7.2.8 (the ideal model): Let f : {0, 1} {0, 1} {0, 1} {} be a
single-output functionality such that f (x, y) = ( f 1 (x, y), ). Let B = (B1 , B2 ) be a
pair of probabilistic polynomial-time algorithms representing strategies in the ideal
model. Such a pair is admissible (in the ideal malicious model) if for at least one
i {1, 2}, called honest, we have Bi (u, z, r ) = u and Bi (u, z, r, v) = v for all possible u, z, r , and v. Furthermore, |Bi (u, z, r )| = |u| must hold for both is. The joint
execution of f under B in the ideal model (on input pair (x, y) and auxiliary input
z), denoted ideal f, B(z) (x, y), is dened by uniformly selecting a random-tape r for the
def
That is, ideal f, B(z) (x, y) = (B1 (x, z, r, v), B2 (y, z, r, )), where v f 1 (B1 (x, z, r ),
B2 (y, z, r )) and r is uniformly distributed among the set of strings of adequate length.22
We next consider the real model in which a real (two-party) protocol is executed (and
there exist no trusted third parties). In this case, a malicious party may follow an arbitrary
feasible strategy, that is, any strategy implementable by a probabilistic polynomial-time
algorithm. The denition is identical to Denition 7.2.5, and is reproduced here (for
the readers convenience).
Denition 7.2.9 (the real model): Let f be as in Denition 7.2.8, and be a two-party
protocol for computing f . Let A = (A1 , A2 ) be a pair of probabilistic polynomial-time
algorithms representing strategies in the real model. Such a pair is admissible (with
respect to ) (for the real malicious model) if at least one Ai coincides with the strategy
specied by . The joint execution of under A in the real model (on input pair
(x, y) and auxiliary input z), denoted real, A(z) (x, y), is dened as the output pair
resulting from the interaction between A1 (x, z) and A2 (y, z). (Note that the honest Ai
ignores the auxiliary input z.)
Having dened the ideal and real models, we obtain the corresponding denition of
security. Loosely speaking, the denition asserts that a secure two-party protocol (in
the real model) emulates the ideal model (in which a trusted party exists). This is
formulated by saying that admissible adversaries in the ideal model are able to simulate
(in the ideal model) the execution of a secure real-model protocol under any admissible
adversaries. The denition is analogous to Denition 7.2.6.
Denition 7.2.10 (security): Let f and be as in Denition 7.2.9. Protocol is said
to securely compute f (in the malicious model) if for every probabilistic polynomialtime pair of algorithms A = (A1 , A2 ) that is admissible for the real model (of Denition 7.2.9), there exists a probabilistic polynomial-time pair of algorithms B = (B1 , B2 )
that is admissible for the ideal model (of Denition 7.2.8) such that
c
{ideal f, B(z) (x, y)}x, y,z {real, A(z) (x, y)}x, y,z
where x, y, z {0, 1} such that |x| = |y| and |z| = poly(|x|).
Clearly, as far as single-output functionalities are concerned, Denitions 7.2.6
and 7.2.10 are equivalent (because in this case, the ideal-model denitions coincide).
It is also clear from the previous discussions that the two denitions are not equivalent in general (i.e., with respect to two-output functionalities). Still, it is possible
to securely implement any (two-output) functionality by using a protocol for securely
computing a (related) single-output functionality. That is, the ability to construct secure
protocols under Denition 7.2.10 yields the ability to construct secure protocols under
Denition 7.2.6.
22
Recall that if Bi is honest, then it passes its input to the trusted party and outputs its response. Thus, our peculiar
choice to feed both parties with the same auxiliary input and same random-tape is immaterial, because the
honest party ignores both.
633
Proposition 7.2.11: Suppose that there exist one-way functions and that any singleoutput functionality can be securely computed as per Denition 7.2.10. Then any functionality can be securely computed as per Denition 7.2.6.
Proof Sketch: Suppose that the parties wish to securely compute the (two-output)
functionality (x, y) ( f 1 (x, y), f 2 (x, y)). The rst idea that comes to mind is to
rst let the parties (securely) compute the rst output (i.e., by securely computing
(x, y) ( f 1 (x, y), )) and next let them (securely) compute the second output (i.e.,
by securely computing (x, y) (, f 2 (x, y))). This solution is insecure, because a
malicious party may enter different inputs in the two invocations (not to mention that
the approach will fail for randomized functionalities even if both parties are honest).
Instead, we are going to let the rst party obtain its output as well as an (authenticated
and) encrypted version of the second partys output, which it will send to the second
party (which will be able to decrypt and verify the value). That is, we will use privatekey encryption and authentication schemes, which exist under the rst hypothesis, as
follows. First, the second party generates an encryption/decryption-key, denoted e, and
a signing/verication-key, denoted s. Next, the two parties securely compute the randomized functionality ((x, (y, e, s)) (( f 1 (x, y), c, t) , ), where c is the ciphertext
obtained by encrypting the plaintext v = f 2 (x, y) under the encryption-key e, and t is
an authentication-tag of c under the signing-key s. Finally, the rst party sends (c, t) to
the second party, which veries that c is properly signed and (if so) recovers f 2 (x, y)
from it.
634
a private manner. Put in other words, we will show that privately evaluating the circuit
reduces to privately evaluating single gates on values shared by both parties.
Our presentation is modular, where the modularity is supported by an appropriate
notion of a reduction. Thus, we rst dene such notion, and show that indeed it is
suitable to our goals; that is, combining a reduction of (the private computation of) g
to (the private computation of) f and a protocol for privately computing f yields a
protocol for privately computing g. Applying this notion of a reduction, we reduce the
private computation of general functionalities to the private computation of deterministic functionalities, and thus focus on the latter.
We next consider, without loss of generality, the evaluation of Boolean circuits with
and and xor gates of fan-in 2.24 Actually, we nd it more convenient to consider the
corresponding arithmetic circuits over GF(2), where multiplication corresponds to and
and addition to xor. A value v is shared by the two parties in the natural manner (i.e.,
the sum of the shares equals v mod 2). We show how to propagate shares of values
through any given gate (operation). Propagation through an addition gate is trivial, and
we concentrate on propagation through a multiplication gate. The generic case is that
the rst party holds (a1 , b1 ) and the second party holds (a2 , b2 ), where a1 + a2 is the
value of one input wire and b1 + b2 is the value of the other input wire. What we want
is to provide each party with a random share of the value of the output wire, that is, a
share of the value (a1 + a2 ) (b1 + b2 ). In other words, we are interested in privately
computing the following randomized functionality
((a1 , b1 ), (a2 , b2 )) (c1 , c2 )
where c1 + c2 = (a1 + a2 ) (b1 + b2 ).
(7.17)
(7.18)
That is, (c1 , c2 ) ought to be uniformly distributed among the pairs satisfying c1 + c2 =
(a1 + a2 ) (b1 + b2 ). As shown in Section 7.3.3, this functionality can be privately
computed by reduction to a variant of Oblivious Transfer (OT). This variant is dened
in Section 7.3.2, where it is shown that this variant can be privately implemented
assuming the existence of (enhanced) trapdoor one-way permutations. We stress that
the specic functionalities mentioned here are relatively simple (e.g., they have a nite
domain). Thus, Section 7.3.4 reduces the private computation of arbitrary (complex)
functionalities to the construction of protocols for privately computing a specic simple
functionality (e.g., the one of Eq. (7.17) and Eq. (7.18)).
The actual presentation proceeds bottom-up. We rst dene reductions between (twoparty) protocol problems (in the semi-honest model). Next, we dene and implement
OT, and show how to use OT for privately computing a single multiplication gate. Finally,
we show how to use the latter protocol to derive a protocol for privately evaluating the
entire circuit.
Teaching Tip. Some readers may prefer to see a concrete protocol (and its privacy
analysis) before coping with the abstract notion of a privacy reduction (and a corresponding composition theorem). We advise such readers to read Section 7.3.2 before
reading Section 7.3.1.
24
Indeed, negation can be emulated by xoring the given bit with the constant true.
635
The identity of the requesting party may be determined by the two parties (according to interaction prior to the
request). In particular, as in all protocols used in this work, the identity of the requesting party may be xed a
priori.
26 This requirement guarantees that the security of the oracle calls be related to the security of the high-level
protocol.
636
supposes that Party i is the party that plays the i-th party in f (i.e., Party 1 is the
party in g| f that requests all oracle calls to f ). But, in general, it may be that, in
some invocations of f , Party 2 plays the rst party in f (i.e., Party 1 is the party
in g| f that requests this particular oracle call). In this case, we should simulate the
execution of f by using the simulator that simulates the view of the corresponding
party in f (rather than the corresponding party in ).
Advanced comment: Note that we capitalize on the fact that in the semi-honest
model, the execution of the steps of g| f (inside ) is independent of the actual
executions of f (and depends only on the outcomes of f ). This fact allows us
to rst simulate a transcript of g| f , and next generate simulated transcripts of f .
In contrast, in the malicious model, the adversarys actions in g| f may depend on
the transcript of previous executions of f , and thus this simulation strategy will
not work in the malicious model (and a more complex simulation strategy will be
used).
It is left to show that Si indeed generates a distribution that (augmented by the value
of g) is indistinguishable from the view of Party i (augmented by the output of both
parties) in actual executions of . Toward this end, we introduce a hybrid distribution,
denoted Hi . This hybrid distribution represents the view of Party i (and the output of
637
g| f
Using the guarantees regarding Si (resp., Si ), we show that the distributions corresponding to Hi and (resp., Hi and Si ) are computationally indistinguishable.
Specically:
1. The distributions represented by Hi and are computationally indistinguishable:
The reason is that these distributions differ only in that the invocations of f in
f
are replaced in Hi by Si -simulated transcripts. Thus, the hypothesis regarding
f
Si implies that the two distributions are computationally indistinguishable (where
indistinguishability is measured with respect to the length of the queries, and holds
also when measured with respect to the length of the initial inputs).27 Specically,
one may consider hybrids of and Hi such that in the j-th hybrid, the rst j
invocations of f are real and the rest are simulated. Then distinguishability of
f
neighboring hybrids contradicts the hypothesis regarding Si (by incorporating a
possible transcript of the rest of the execution into the distinguisher).
2. The distributions represented by Hi and Si are computationally indistinguishable:
g| f
The reason is that these distributions are obtained, respectively, from g| f and Si ,
f
by augmenting the latter with invocations of Si . Thus, indistinguishability follows
g| f
by the hypothesis regarding Si . Specically, distinguishing Hi and Si implies disg|
f
f
tinguishing g| f and Si (by incorporating the program Si into the distinguisher).
The theorem follows.
Application: Reducing Private Computation of General Functionalities to Deterministic Ones. Given a general functionality g, we rst write it in a way that makes
the randomization explicit. That is, we let g(r, (x, y)) denote the value of g(x, y) when
using coin tosses r {0, 1}poly(|x|) ; that is, g(x, y) is the randomized process consisting
of uniformly selecting r {0, 1}poly(|x|) , and deterministically computing g(r, (x, y)).
Next, we privately reduce g to a deterministic f , where f is dened as follows:
def
(7.19)
Here we use the hypothesis (made in the rst item of Denition 7.3.2) that the length of each query is polynomially
related to the length of the initial input.
638
= Pr[i = ri ]
the simulated view (and output) is distributed identically to the view (and output) in a
real execution. The claim (which only requires these ensembles to be computationally
indistinguishable) follows.
(7.20)
input
Step S1
Sender (S)
(1 , ..., k )
(, t) G(1n )
Step R1
Step S2
R2 (output)
c j = j b( f 1 (y j ))
Receiver (R)
i
generates y j s
(y1 , ..., yk ) (knows xi = f 1 (yi ))
(c1 , ..., ck )
ci b(xi )
We start by presenting a simulator for the senders view. On input (((1 , ..., k ), 1n ), ),
this simulator randomly selects (as in Step S1) and generates uniformly and independently y1 , ..., yk D . That is, let r denote the sequence of coins used to generate
, and assume without loss of generality that the inverting-with-trapdoor algorithm
is deterministic (which is typically the case anyhow). Then the simulator outputs
(((1 , ..., k ), 1n ), r, (y1 , ..., yk )), where the rst element represents the partys input,
the second its random choices, and the third the (single) message that the party
has received. Clearly, this output distribution is identical to the view of the sender
in the real execution. (This holds because f is a permutation, and thus applying
it to a uniformly distributed element of D yields a uniformly distributed element
of D .)
We now turn to the receiver. On input ((i, 1n ), i ), the simulator (of the receivers
view) proceeds as follows:
1. Emulating Step S1, the simulator uniformly selects an index-trapdoor pair, (, t), by
running the generation algorithm on input 1n .
2. As in Step R1, it uniformly and independently selects r1 , ..., rk for the domain sampler
D, and sets x j = D(, r j ) for j = 1, ..., k. Next, it sets yi = f (xi ) and y j = x j , for
each j = i.
3. It sets ci = i b(xi ), and uniformly selects c j {0, 1}, for each j = i.
4. Finally, it outputs ((i, 1n ), (r1 , ..., rk ), (, (c1 , ..., ck ))), where the rst element represents the partys input, the second its random choices, and the third element represents
the two messages that the party has received.
Note that, except for the sequence of c j s, this output is distributed identically to the
corresponding prex of the receivers view in the real execution. Furthermore, the said
equality holds even if we include the bit ci (which equals i b( f 1 (yi )) = i b(xi )
in the real execution as well as in the simulation). Thus, the two distributions differ only in the values of the other c j s: For j = i, in the simulation c j is uniform and independent of anything else, whereas in the real execution c j equals
642
(7.21)
Using its input (a2 , b2 ), Party 2 sets the receivers input (in the OT41 ) to equal 1 +
2a2 + b2 {1, 2, 3, 4}.
643
Thus, the receivers output will be the (1 + 2a2 + b2 )th element in Eq. (7.21), which
in turn equals f a2 ,b2 (a1 , b1 , c1 ). That is:
Input of Party 2
(i.e., (a2 , b2 ))
(0, 0)
(0, 1)
(1, 0)
(1, 1)
644
functions f y : {0, 1}k {0, 1}, for y {0, 1} (when in Construction 7.3.7 = 2 (and
k = 3)). Then, privately computing (x, y) (, f y (x)) is reduced to 1-out-of-2 Oblivious Transfer by letting the rst party play the sender with input set to the 2 -tuple
( f 0 (x), ..., f 1 (x)) and the second party play the receiver with input set to the index of
y among the -bit long strings.
propagated through such gates in the natural manner (i.e., each outgoing wire holds
the sum or multiple of the values of the incoming wires of the gate). Vertices with no
incoming edges are called sources, and vertices with no outgoing edges are called
sinks. Without loss of generality, each source has a single outgoing edge, which
is called an input-wire of the circuit, and each sink has a single incoming edge,
which is called an output-wire of the circuit. When placing Boolean values on the
input-wires of the circuit, the propagation of values through the gates determines
values to all output-wires. The function from input values to output values dened
this way is called the function computed by the circuit.
A tedious comment: For the sake of simplicity, we do not provide the circuit with
constant values (i.e., 0 and 1). The constant 0 can be easily produced by adding
any GF(2) value to itself, but omitting the constant 1 weakens the power of such
circuits (because this constant is essential to the computation of non-monotone
functions). However, the evaluation of any circuit that uses the constant 1 can be
privately reduced to the evaluation of a corresponding circuit that does not use the
constant 1.29
29
Given a circuit C that uses the constant 1, we derive a circuit C that lacks constant inputs by introducing an
auxiliary variable that is to be set to 1 (and replacing any occurrence of the constant 1 by an occurrence of
the new auxiliary variable). Thus, C(x) = C (x, 1) (or rather C(x 1 , x2 ) = C (1x1 , x 2 ), for any {0, 1}).
Clearly, the private evaluation of C (on the input pair (x1 , x 2 )) is reducible to the private evaluation of C (e.g.,
by a single oracle call that asks for the evaluation of C , say, on the input (1x1 , 0x2 )).
645
We will consider an enumeration of all wires in the circuit. The input-wires of the
circuit, n per each party, will be numbered 1, 2...., 2n so that, for j = 1, ..., n, the j-th
input of party i corresponds to the (i 1) n + j-th wire. The wires will be numbered
so that the output-wires of each gate have a larger numbering than its input wires.
The output-wires of the circuit are clearly the last ones. For the sake of simplicity we
assume that each party obtains n output bits, and that the output bits of the second party
correspond to the last n wires of the circuit.
Construction 7.3.9 (reducing the evaluation of any circuit to the emulation of a
multiplication gate): For simplicity, we assume that the circuit is either xed or can be
determined in poly(n)-time as a function of n, which denotes the length of the input to
each party.30
Inputs: Party i holds the bit string xi1 xin {0, 1}n , for i = 1, 2.
Step 1 Sharing the Inputs: Each party (splits and) shares each of its input bits with
the other party. That is, for every i = 1, 2 and j = 1, ..., n, Party i uniformly sej
lects a bit ri and sends it to the other party as the other partys share of the input
wire (i 1) n + j. Party i sets its own share of the (i 1) n + j th input wire
j
j
to xi + ri .
Step 2 Circuit Emulation: Proceeding by the order of wires, the parties use their
shares of the two input-wires to a gate in order to privately compute shares for the
output-wire(s) of the gate. Suppose that the parties hold shares to the two input-wires
of a gate; that is, Party 1 holds the shares a1 , b1 and Party 2 holds the shares a2 , b2 ,
where a1 , a2 are the shares of the rst wire and b1 , b2 are the shares of the second
wire. We consider two cases.31
Emulation of an addition gate: Party 1 just sets its share of the output-wire of the
gate to be a1 + b1 , and Party 2 sets its share of the output-wire to be a2 + b2 .
Emulation of a multiplication gate: Shares of the output-wire of the gate are obtained
by invoking the oracle for the functionality of Eq. (7.17) (7.18), where Party 1
supplies the input (query part) (a1 , b1 ), and Party 2 supplies (a2 , b2 ). When the
oracle responds, each party sets its share of the output-wire of the gate to equal
its part of the oracle answer. Recall that, by Eq. (7.18), the two parts of the oracle
answer sum up to (a1 + b1 ) (a2 + b2 ).
Step 3 Recovering the Output Bits: Once the shares of the circuit-output wires are
computed, each party sends its share of each such wire to the party with which the
wire is associated. That is, the shares of the last n wires are sent by Party 1 to Party 2,
30
Alternatively, we may let the circuit be part of the input to both parties, which essentially means that the protocol
is computing the universal circuit-evaluation function.
31 In the text, we implicitly assume that each gate has a single output wire, but this assumption is immaterial and
the treatment extends easily to the case that the gates have several output wires. In the case of a multiplication
gate, both the natural possibilities (which follow) are ne. The rst (more natural) possibility is to invoke the
oracle once per each multiplication gate and have each party use the same share for all output wires. The second
possibility is to invoke the oracle once per each output-wire (of a multiplication gate).
646
whereas the shares of the preceding n wires are sent by Party 2 to Party 1. Each
party recovers the corresponding output bits by adding up the two shares, that is,
the share it had obtained in Step 2 and the share it has obtained in the current step.
Outputs: Each party locally outputs the bits recovered in Step 3.
For starters, let us verify that the output is indeed correct. This can be shown by induction
on the wires of the circuits. The induction claim is that the shares of each wire sum up
to the correct value of the wire. The base case of the induction are the input-wires of the
j
j
circuits. Specically, the (i 1) n + j-th wire has value xi , and its shares are ri and
j
j
j
ri + xi (indeed, summing up to xi ). For the induction step we consider the emulation
of a gate. Suppose that the values of the input-wires (to the gate) are a and b, and that
their shares a1 , a2 and b1 , b2 indeed satisfy a1 + a2 = a and b1 + b2 = b. In the case
of an addition gate, the shares of the output-wire were set to be a1 + b1 and a2 + b2 ,
indeed satisfying
(a1 + b1 ) + (a2 + b2 ) = (a1 + a2 ) + (b1 + b2 ) = a + b
In the case of a multiplication gate, the shares of the output-wire were set to be c1 and
c2 such that c1 + c2 = (a1 + a2 ) (b1 + b2 ). Thus, c1 + c2 = a b as required.
Privacy of the Reduction. We now turn to show that Construction 7.3.9 indeed
privately reduces the computation of a circuit to the multiplication-gate emulation.
That is,
Proposition 7.3.10 (privately reducing circuit evaluation to multiplication-gate emulation): Construction 7.3.9 privately reduces the evaluation of arithmetic circuits over
GF(2) to the functionality of Eq. (7.17) (7.18).
Proof Sketch: Note that since we are dealing with a deterministic functionality, we
may use the special (simpler) form of Denition 7.2.1 and only refer to simulating
the view of each party. Recall that these simulators should produce the view of the
party in an oracle-aided execution (i.e., an execution of Construction 7.3.9, which is an
oracle-aided protocol). Without loss of generality, we present a simulator for the view
of Party 1. This simulator gets the partys input x11 , ..., x1n , as well as its output, denoted
y 1 , ..., y n . It operates as follows:
j
1. The simulator uniformly selects r11 , ..., r1n and r21 , ..., r2n , as in Step 1. (The r1 s will
be used as the coins of Party 1, which are part of the view of the execution, whereas
j
the r2 s will be used as the message Party 1 receives at Step 1.) For each j n, the
j
j
simulator sets x 1 + r1 as the partys share of the value of the j-th wire. Similarly,
j
for j n, the partys share of the n + j-th wire is set to r2 .
This completes the computation of the partys shares of all the 2n circuit-input wires.
2. The partys shares for all other wires are computed, iteratively gate by gate, as
follows:
r The partys share of the output-wire of an addition gate is set to be the sum of the
partys shares of the input-wires of the gate.
647
Alternatively, one may avoid relying on the transitivity of privacy reductions by successively applying the Composition Theorem to derive private protocols rst for the multiplication functionality, then for any deterministic
functionality, and nally for any functionality. That is, in the rst application we use Propositions 7.3.8 and 7.3.6,
648
Theorem 7.3.12: Suppose that there exist collections of enhanced trapdoor permutations. Then any functionality can be privately computable (in the semi-honest
model).
For the sake of future usage (in Section 7.4), we point out a property of the protocols
underlying the proof of Theorem 7.3.12.
Denition 7.3.13 (canonical semi-honest protocols): A protocol for privately computing the functionality f is called canonical if it proceeds by executing the following
two stages:
Stage 1: The parties privately compute the functionality (x, y) ((r1 , r2 ), (s1 , s2 )),
where the ri s and si s are uniformly distributed among all possibilities that satisfy
(r1 s1 , r2 s2 ) = f (x, y).
Stage 2: Party 2 sends s1 to Party 1, which responds with r2 . Each party computes its
own output; that is, Party i outputs ri si .
Indeed, the protocols underlying the proof of Theorem 7.3.12 are canonical. Hence,
Theorem 7.3.14: Suppose that there exist collections of enhanced trapdoor permutations. Then any functionality can be privately computable by a canonical protocol.
We present two alternative proofs of Theorem 7.3.14: The rst proof depends on the
structure of the protocols used in establishing Theorem 7.3.11, whereas the second
proof is generic and uses an additional reduction.
First Proof of Theorem 7.3.14: Recall that the oracle-aided protocol claimed in Theorem 7.3.11 is obtained by composing the reduction in Proposition 7.3.4 with Constructions 7.3.9 and 7.3.7. The high-level structure of the resulting protocol is induced
by the circuit-evaluation protocol (of Construction 7.3.9), which is clearly canonical
(with Step 3 tting Stage 2 in Denition 7.3.13). Indeed, it is important that in Step 3
exactly two messages are sent and that Party 1 sends the last message. The fact that the
said oracle-aided protocol is canonical is also preserved when replacing the OT41 oracle
by an adequate sub-protocol.
Second Proof of Theorem 7.3.14: Using Theorem 7.3.12, we can rst derive a protocol
for privately computing the functionality of Stage 1 (in Denition 7.3.13). Augmenting this protocol by the trivial Stage 2, we derive a canonical protocol for privately
computing the original functionality (i.e., f itself).
in the second we use Proposition 7.3.10 and the protocol resulting from the rst application, and in the last
application we use Proposition 7.3.4 and the protocol resulting from the second application.
649
651
to the sender. The functionality guarantees that either the corresponding (next-step)
message is delivered or the designated receiver detects cheating.
In order to allow a modular presentation of the compiled protocols, we start by dening
an adequate notion of reducibility (where here the oracle-aided protocol needs to be
secure in the malicious model rather than in the semi-honest one). We next turn to
constructing secure protocols for several basic functionalities, and use the latter to
construct secure protocols for the three main functionalities mentioned here. Finally,
we present and analyze the actual compiler.
r As in Denition 7.3.2, an oracle-aided protocol is said to be using the oraclefunctionality f if the oracle answers are according to f . However, in accordance
with the denition of the ideal model (for the invoked functionality), the oracle does
not answer both parties concurrently, but rather answers rst the real-model party
that requested this specic oracle call (in the oracle-aided protocol). When receiving
its part of the oracle answer, this party (i.e., the real-model party that requested the
oracle call) instructs the oracle whether or not to respond to the other party.
We consider only protocols in which the length of each oracle-query is a polynomialtime computable function of the length of the initial input to the protocol. Furthermore, as in Denition 7.3.2, the length of each query must be polynomially related
to the length of the initial input.
We consider executions of such a protocol by a pair of parties, with strategies represented by probabilistic polynomial-time algorithms A1 and A2 , such that one of the
parties follows the oracle-aided protocol. Such a pair is called admissible. Analogously to Denition 7.2.5, the joint execution of an oracle-aided protocol with
oracle f under A = (A1 , A2 ) in the real model (on input pair (x, y) and auxiliary
f
input z), denoted real, A(z) (x, y), is dened as the output pair resulting from the
interaction between A1 (x, z) and A2 (y, z), where oracle calls are answered using f .
We stress that here the real model corresponds to an execution of an oracle-aided
protocol.
r An oracle-aided protocol using the oracle-functionality f is said to securely
compute g if a condition analogous to the one in Denition 7.2.6 holds. That is, the
652
effect of any admissible real-model strategies as in the previous item can be simulated
by admissible strategies for the ideal model, where the ideal model for computing g
is exactly as in Denition 7.2.4.
More specically, the oracle-aided protocol (using oracle f ) is said to securely
compute g (in the malicious model) if for every probabilistic polynomial-time
pair A = (A1 , A2 ) that is admissible for the real model of the oracle-aided computation, there exists a probabilistic polynomial-time pair B = (B1 , B2 ) that is
admissible for the ideal model (of Denition 7.2.4) such that
c
{idealg, B(z) (x, y)}x, y,z {real, A(z) (x, y)}x, y,z
where x, y, z {0, 1} such that |x| = |y| and |z| = poly(|x|).
r Party i (i.e., A ) is not necessarily the party that plays the i-th party in f (i.e.,
i
Party 1 is not necessarily the party in g| f that requests this particular oracle call
to f ). Furthermore, the identity of the party (in f ) played by Ai is not xed,
but is rather determined by the history of the execution of (which is given to
Ai as auxiliary input). In contrast, our denitions refer to adversaries that play a
predetermined party. This technical discrepancy can be overcome by considering
two versions of Ai , denoted Ai,1
and Ai,2
, such that Ai, j in used (instead of Ai ) in
case Party i is the party that plays the j-th party in f . Indeed, Ai, j is always used
to plays the j-th party in f .
r A minor problem is that Ai may have its own auxiliary input, in which case the
resulting Ai will have two auxiliary inputs (i.e., the rst identical to the one of
Ai , and the second representing a partial execution transcript of ). Clearly, these
two auxiliary inputs can be combined into a single auxiliary input. (This fact holds
generically, but more so in this specic setting in which it is anyhow natural to
incorporate the inputs to an adversary in its view of the execution transcript.)
r The last problem is that it is not clear what initial input should be given to the
adversary Ai toward its current execution of f (i.e., the input that is supposed to be
used for computing f ). However, this problem (which is more confusing than real)
has little impact on our argument, because what matters is the actual actions of Ai
during the current execution of f , and these are determined based on its (actual)
auxiliary input (which represent the history of the execution of ). Still, the initial
inputs for the executions of f have to be dened so that they can be passed to
the ideal-model adversary that we derive from Ai . We may almost set these initial
inputs arbitrarily, except that (by our conventions regarding functionalities) we must
33
The simpler alternative of deriving a different pair of (real-model) strategies for each invocation of f would
have sufced for handling oracle-aided protocols that make a constant number of oracle calls. The point is
that the corresponding ideal-model strategies (with respect to f ) need to be combined into a single real-model
strategy for g| f .
654
set them to strings of correct length (i.e., equal to the length of the other partys
f -input). Here we use the hypothesis that this length can be determined from the
length of the input to itself.34
Thus, we have obtained an (admissible) ideal-adversary pair B = (B1 , B2 ) corresponding to f such that
c
(7.22)
We comment that when applying Eq. (7.22), we set the input of the honest party to
equal the value on which the sub-protocol (or functionality) was invoked, and set the
auxiliary input to equal the current execution transcript of the high-level protocol (as
seen by the adversary). (As explained earlier, the setting of the primary input to the
dishonest party is immaterial, because the latter determines its actions according to its
auxiliary input.)
Our next step is to derive from A = (A1 , A2 ) a pair of strategies A = (A1 , A2 ) that
represents the behavior of A during the g| f -part of . Again, the honest Ai induces
a corresponding Ai that just behaves according to g| f . Turning to the dishonest Ai ,
we derive Ai by replacing the (real) actions of Ai that take place in Ai by simulated
actions of the ideal-model Bi . That is, the adversary Ai runs machine Ai locally, while
interacting with the actual other party of g| f , obtaining the messages that Ai would
have sent in a real execution of , and feeding Ai with messages that it expects to
receive (i.e., messages that Ai would have received in a real execution of ). The
handling of Ai s messages depends on whether they belong to the g| f -part or to one
of the invocations of f . The key point is the handling of the latter messages.
Handling Messages of g| f : These messages are forwarded to/from the other party
without change. That is, Ai uses Ai in order to determine the next message to be
sent, and does so by feeding Ai with the history of the execution so far (which
contains g| f -part messages that Ai has received before, as well as the f parts that it has generated so far by itself). In particular, if Ai aborts, then so
does Ai .
Handling Messages of f : Upon entering a new invocation of f , the adversary Ai
sets h i to record the history of the execution of so far. Now, rather than executing
f using Ai (h i ) (as Ai would have done), the adversary Ai invokes Bi (h i ), where
Bi is the ideal-model adversary for f (derived from Ai , which in turn was derived
from Ai ). Recall that Bi sends no messages and makes a single oracle-query (which it
views as sending a message to its imaginary trusted party). The real-model adversary
Ai (for the oracle-aided protocol g| f ) forwards this query to its own oracle (i.e.,
34
We comment that when using the alternative conventions discussed at the end of Section 7.2.1.1, we may waive
the requirement that the query length be determined by the input length. Instead, we postulate that all oracle
calls made by the oracle-aided program use the same security parameter as the one with which the program is
invoked. On the other hand, under the current conventions, when trying to extend the composition theorem to
partial functionalities (or when removing the length determination hypothesis), we run into trouble because
we need to determine some f -input that ts the unknown f -input of the other party. (This problem can be
resolved by introducing an adequate interface to oracle calls.)
655
f ), and feeds Bi with the oracle answer. At some point Bi terminates, and Ai uses
its output to update the simulated history of the execution of . In particular, oraclestopping events caused by Bi (h i ) (in case Party i requested this specic oracle call)
and -answers of the oracle (in the other case) are handled in the straightforward
manner.
On stopping the oracle and -answers: Suppose rst that Party i has requested this specic oracle call. In this case, after receiving the oracle answer
(which it views as the answer of its trusted party), the ideal-model adversary Bi
may stop its trusted party. If this happens, then machine Ai instructs its own
oracle (i.e., f ) not to respond to the other party. Next, suppose that Party i is
the party responding to this specic oracle call (rather than requesting it). In this
case, it may happen that the oracle is stopped by the other party (i.e., the oracle
is not allowed to answer Party i). When notied of this event (i.e., receiving a
-answer from its oracle), machine Ai feeds as answer to Bi .
When Ai halts with some output, Ai halts with the same output. Note that A = (A1 , A2 )
is admissible as a real-model adversary for the oracle-aided protocol g| f (which
computes g with oracle to f ). Thus, we can derive from A a corresponding ideal
model adversary for g, denoted B = (B1 , B2 ), by employing the second guaranteed
transformation, such that
c
f
(x,
g| f , A (z)
y)}x, y,z
(7.23)
{idealg, B(z) (x, y)}x, y,z {real, A(z) (x, y)}x, y,z
(7.24)
Note that the left-hand side of Eq. (7.24) equals the left-hand side of Eq. (7.23), so
it sufces to show that their corresponding right-hand sides are computationally inf
distinguishable. But real, A(z) (x, y) differs from real g| f (x, y) only in that the
, A (z)
f - invocations in the former are replaced in the latter by ideal calls to f . However,
by Eq. (7.22), each f invocation is computationally indistinguishable from an ideal
call to f , where computational indistinguishability holds also with respect to auxiliary
inputs (which are used here to represent the execution transcript upto the point of the
current invocation). Using a hybrid argument (corresponding to a gradual substitution
f
of f -invocations by ideal calls to f ), one can show that {real g| f (x, y)}x, y,z
, A (z)
and {real, A(z) (x, y)}x, y,z are computationally indistinguishable.35 This establishes
Eq. (7.24), and the theorem follows.
35
Here we use the hypothesis that the query lengths are polynomially related to the length of the input. The issue is
that in Eq. (7.22), computational indistinguishability is with respect to the length of the queries (to f ), whereas
we need computational indistinguishability with respect to the length of the initial inputs. We also highlight the
key role of the auxiliary inputs to A and B in this argument (cf. the analysis of the sequential composition of
zero-knowledge [i.e., proof of Lemma 4.3.11]).
656
Security Reduction of General Functionalities to Deterministic Ones. The following reduction will not be used in our compiler, because the compiler refers to protocols
(rather to functionalities), and we have already obtained protocols for privately computing general functionalities (by privately reducing them to deterministic ones). Still,
we consider it of interest to state that the reduction presented in Proposition 7.3.4 is, in
fact, secure in the malicious model.
Proposition 7.4.4 (securely reducing a randomized Functionality to a Deterministic
One): Let g be a randomized functionality, f be as dened in Eq. (7.19), and be the
oracle-aided protocol for g using the oracle f as presented in Proposition 7.3.4. Then
securely computes g.
Proof Sketch: Suppose, without loss of generality, that Party 1 is malicious, and denote
by (x1 , r1 ) the query it makes to f . Denoting by xi the initial input of Party i (in ), it
follows that the oracle answer is f ((x1 , r1 ), (x2 , r2 )), where r2 is uniformly distributed
(because Party 2 is honest). Recalling that f ((x1 , r1 ), (x2 , r2 )) = g(r1 r2 , (x1 , x2 )), it
follows that the oracle answer is distributed identically to g(x1 , x 2 ). Furthermore, by
the denition of , all that Party 1 gets is f 1 ((x 1 , r1 ), (x2 , U|r1 | )) g1 (x1 , x2 ). This is
easily simulated by a corresponding ideal-model adversary that sets x1 according to the
real-model adversary, and sends x1 to the trusted third party (which answers according
to g).
Remark 7.4.5 (reductions to a set of functionalities): We extend the notion of security reductions to account for protocols that use several oracles rather than one.
Specically, g is securely reducible to a set of functionalities F = { f 1 , ..., f t } if there
exists an oracle-aided protocol that securely computes g when given oracles f 1 , ..., f t .
Theorem 7.4.3 also extends to assert that if g is securely reducible to F, and each
functionality in F can be securely computed, then so can g. We comment that the
entire remark is a matter of semantics, because one can pack the set F in one funcdef
tionality f (e.g., f ((i, x), (i, y)) = f i (x, y)).
ORDER OF PRESENTATION
Commitment
schemes
ZK proofs
ZK POKs
TOOLS
COIN
TOSSING
restricted
AUTH. C.
IMAGE
TRANS.
COMMIT
INPUT
AUG.
COIN
4
AUTH.
Comput.
r Commitment schemes (as dened in Denition 4.4.1). For the sake of simplicity, we
will use a non-interactive commitment scheme (as in Construction 4.4.2). We assume,
for simplicity, that on security parameter n, the commitment scheme utilizes exactly
n random bits. We denote by Cr (b) the commitment to the bit b using (security
parameter n and) randomness r {0, 1}n , and by C(b) the value of Cr (b) for a
uniformly distributed r {0, 1}n (where n is understood from the context).
r Zero-knowledge proofs of NP-assertions. We rely on the fact (cf. Theorem 4.4.11)
that there exist such proof systems in which the prover strategy can be implemented
in probabilistic polynomial-time, when given an NP-witness as auxiliary input. We
stress that by this we mean (zero-knowledge) proof systems with negligible soundness error. Furthermore, we rely on the fact that these proof systems have perfect
completeness (i.e., the verier accepts a valid statement with probability 1).
658
7.4.3.1. Coin-Tossing
We start our assembly of functionalities that are useful for the compiler by presenting
and implementing a very natural functionality, which is of independent interest. Specifically, we refer to the coin-tossing functionality (1n , 1n ) (b, b), where b is uniformly
distributed in {0, 1}. This functionality allows a pair of distrustful parties to agree on a
common random value.36
36
Actually, in order to conform with the convention that the functionality has to be dened for any input pair, we
may consider the formulation (x, y) (b, b).
659
Denition 7.4.6 (coin-tossing into the well, basic version): A coin-tossing-into-thewell protocol is a two-party protocol for securely computing (in the malicious model) the
randomized functionality (1n , 1n ) (b, b), where b is uniformly distributed in {0, 1}.
That is, in spite of malicious behavior by any one party, a non-aborting execution of a
coin-tossing-into-the-well protocol ends with both parties holding the same uniformly
distributed bit, b. Recall that our denition of security allows (b, ) to appear as output
in case Party 1 aborts. (It would have been impossible to securely implement the cointossing functionality if the denition had not allowed this slackness; see Section 7.7.1.1.)
The coin-tossing functionality will not be used directly in the compiled protocols, but
it will be used to implement an augmented notion of coin-tossing (see Section 7.4.3.5),
which in turn will be used directly in these protocols.
Construction 7.4.7 (a coin-tossing-into-the-well protocol): For every r , let Cr :
{0, 1} {0, 1} .
Inputs: Both parties get security parameter 1n .
def
Step C1: Party 1 uniformly selects {0, 1} and s {0, 1}n , and sends c = Cs ( ) to
Party 2.
To simplify the exposition, we adopt the convention by which failure of Party 1 to
send a message (i.e., aborting) is interpreted as an arbitrary bit string, say C0n (0).
Step C2: Party 2 uniformly selects {0, 1}, and sends to Party 1.
Similarly, any possible response of Party 2, including abort, will be interpreted by
Party 1 as a bit.37
Step C3: Party 1 outputs the value , and sends (, s) to Party 2.
Step C4: Party 2 checks whether or not c = Cs ( ). It outputs if c = Cs ( ) and
halts with output otherwise.
In contrast to Steps C1C2, here any illegal answer is interpreted as abort.
def
These two conventions prevent the parties from aborting the execution before Step C3.
660
two cases corresponding to the identity of the honest party. Recall that we may assume,
for simplicity, that the adversary is deterministic (see discussion toward the end of the
preamble of Section 7.4.3). Also, for simplicity, we omit the input 1n in some places.
The following schematic depiction of the information ow in Construction 7.4.7 may
be useful toward the following analysis:
C1
Party 1
selects (, s)
c Cs ( )
Party 2
c
C2
C3
b
output
selects {0, 1}
(, s)
b or
(depending on whether c = Cs ( ))
We start with the case where the rst party is honest. In this case, B1 is determined
(by the protocol), and we transform the real-model adversary A2 into an ideal-model
adversary B2 . Machine B2 will run machine A2 locally, obtaining the single message that
A2 would have sent in a real execution of the protocol (i.e., {0, 1}) and feeding A2
with the messages that it expects to receive. Recall that A2 expects to see the messages
Cs ( ) and (, s) (and that B2 gets input 1n ).
1. B2 sends 1n to the trusted party and obtains an answer (bit), denoted b, which is
uniformly distributed. (Recall that b is also handed to Party 1.)
2. B2 tries to generate an execution view (of A2 ) ending with output b. This is done by
repeating the following steps at most n times:
def
(a) B2 uniformly select {0, 1} and s {0, 1}n , and feeds A2 with c = Cs ( ).
Recall that A2 always responds with a bit, denoted , which may depend on c
(i.e., A2 (c)).
(b) If = b, then B2 feeds A2 with the execution view (c, (, s)), and outputs
whatever A2 does. Otherwise, it continues to the next iteration.
In case all n iterations were completed unsuccessfully (i.e., without output), B2
outputs a special failure symbol.
We need to show that for the coin-tossing functionality, denoted f , and for Construction 7.4.7, denoted , it holds that
c
1
1
Pr[A2 (C(0)) = b] + Pr[A2 (C(1)) = b 1]
2
2
1 1
= + (Pr[A2 (C(0)) = b] Pr[A2 (C(1)) = b])
2 2
Using the hypothesis that C is a commitment scheme, the second term is a negligible
function in n, and so our claim regarding the probability that B2 outputs failure
follows. Letting denote an appropriate negligible function, we state the following for
future reference:
1
(7.25)
Pr,s [A2 (Cs ( )) = b ] = (n)
2
Next, we show that conditioned on B2 not outputting failure, the distribution
ideal f, B (1n , 1n ) is statistically indistinguishable from the distribution real, A (1n , 1n ).
Both distributions have the form (b , A2 (Cs ( ), (, s))), with b = A2 (Cs ( )), and
thus both are determined by the (, s)-pairs. In real, A (1n , 1n ), all (, s)-pairs are
equally likely (i.e., each appears with probability 2(n+1) ); whereas (as proven next) in
ideal f, B (1n , 1n ), each pair (, s) appears with probability
1
1
2 |S A2 (Cs ( )) |
(7.26)
def
where Sb = {(x, y) {0, 1} {0, 1}n : x A2 (C y (x)) = b} is the set of pairs that pass
the condition in Step 2b (with respect to the value b obtained in Step 1). To justify
Eq. (7.26), observe that the pair (, s) appears as output if and only if it is selected
in Step 2a and the trusted party answers with A2 (Cs ( )), where the latter event
occurs with probability 1/2. Furthermore, the successful pairs, selected in Step 2a and
passing the condition in Step 2b, are uniformly distributed in S A2 (Cs ( )) , which justies
Eq. (7.26). We next show that |Sb | 2n , for every b {0, 1}. By Eq. (7.25), for every
xed b {0, 1} and uniformly distributed (, s) {0, 1} {0, 1}n , the event (, s) Sb
(i.e., A2 (Cs ( )) = b) occurs with probability that is negligibly close to 1/2, and
so |Sb | = (1 (n)) 12 2n+1 , where is a negligible function. Thus, for every pair
(, s), it holds that |S A2 (Cs ( )) | {|S0 |, |S1 |} resides in the interval (1 (n)) 2n . It
follows that the value of Eq. (7.26) is (1 (n)) 2(n+1) , and so real, A (1n , 1n ) and
ideal f, B (1n , 1n ) are statistically indistinguishable.
We now turn to the case where the second party is honest. In this case, B2 is determined, and we transform A1 into B1 (for the ideal model). On input 1n , machine
B1 runs machine A1 locally, obtaining the messages that A1 would have sent in a real
execution of the protocol and feeding A1 with the single message (i.e., {0, 1}) that
it expects to receive.
1. B1 invokes A1 (on input 1n ). Recall that by our conventions, A1 always sends a message in Step C1. Let us denote this message (which is supposedly a commitment
662
We comment that whenever B1 is determined to abort, it need not invoke the trusted party at all, because it (i.e.,
B1 ) can simulate the trusted partys answer by itself. The only reason to invoke the trusted party is to provide
Party 2 with an answer that is related to the output of B1 .
663
(7.27)
We assume, for simplicity, that h is length preserving. Otherwise, the denition may
be modied to consider the functionality ((, 1|h()| ) , (h(), 1|| )) (, f ()). To
39
Recall that, in this case, and are determined by the Step C1 message.
664
facilitate the implementation, we assume that the function h is one-to-one, as is the case
in typical applications. This allows us to use (ordinary) zero-knowledge proofs, rather
than strong (zero-knowledge) proofs-of-knowledge. The issue is further discussed in
Section 7.4.3.3.
The functionality of Eq. (7.27) is implemented by having Party 1 send f () to
Party 2, and then prove in zero-knowledge the correctness of the value sent (with
respect to the common input h()). Note that this statement is of the NP type and
that Party 1 has the corresponding NP-witness. Actually, the following protocol is the
archetypical application of zero-knowledge proof systems.
Construction 7.4.10 (authenticated computation protocol, partial version): Let L be
the set of pairs (u, v) satisfying Eq. (7.28) to follow, and (P, V ) be an interactive proof
for L. Furthermore, suppose that P can be implemented in probabilistic polynomialtime when given an adequate auxiliary-input (i.e., an NP-witness for membership of
the common input in L).
Inputs: Party 1 gets input {0, 1} , and Party 2 gets input u = h().
def
(7.28)
(Each party locally determines the common input (u, v) according to its own view of
the execution so far.)40 In case the verier rejects the proof, Party 2 halts with output
(otherwise the output will be v).
(Any possible response including abort of Party 2 during the execution of this
step will be interpreted by Party 1 as a canonical legitimate message.)
Outputs: In case Party 2 has not halted with output (indicating improper behavior of
Party 1), Party 2 sets its local output to v. (Party 1 has no output [or, alternatively,
always outputs ].)
Observe that the specied strategies are indeed implementable in polynomial-time. In
particular, in Step C2, Party 1 supplies the prover subroutine with the NP-witness such
that Eq. (7.28) is satised with x = . Also, using the perfect completeness condition
of the proof system, it follows that if both parties are honest, then neither aborts and
the output is as required.
Proposition 7.4.11: Suppose that the function h is one-to-one and that (P, V ) is
a zero-knowledge interactive proof (with negligible soundness error) for L. Then,
Construction 7.4.10 securely computes (in the malicious model) the h-authenticated
f -computation functionality of Eq. (7.27).
40
In particular, Party 1 sets (u, v) = (h(), f ()), whereas Party 2 sets u according to its own input and v according
to the message received in Step C1.
665
We stress that Proposition 7.4.11 refers to the security of a protocol for computing a
partial functionality, as discussed in Remark 7.2.7. In the case of Eq. (7.27), this means
that the ideal-model adversary is not allowed to modify its input (i.e., it must pass its
initial input to the trusted party), because its initial input is the unique value that ts
the other partys input.
Proof Sketch: Again, we need to transform any admissible pair, (A1 , A2 ), for the real
model into a corresponding pair, (B1 , B2 ), for the ideal model. We treat separately each
of the two cases, corresponding to the identity of the honest party.
We start with the case where the rst party is honest. In this case, B1 is determined,
and we transform (the real-model adversary) A2 into (an ideal-model adversary) B2 ,
which uses A2 as a subroutine. Recall that B2 gets input u = h(), where is the input
of the honest Party 1.
1. B2 sends u to the trusted party and obtains the value v, which equals f () for
handed by (the honest) Party 1 to the trusted party. Thus, indeed, B2 does not modify
its input and (u, v) L. (Recall that Party 1 always obtains from the trusted party.)
2. B2 invokes the simulator guaranteed for the zero-knowledge proof system (P, V ), on
input (u, v), using (the residual) A2 as a possible malicious verier.41 Note that we are
simulating the actions of the prescribed prover P, which in the real protocol is played
by the honest Party 1. Denote the obtained simulation transcript by S = S(u, v),
where (indeed) A2 is implicit in the notation.
3. Finally, B2 feeds A2 with the alleged execution view (v, S), and outputs whatever A2
does.
We need to show that for the functionality, denoted F, of Eq. (7.27) and for Construction 7.4.10, denoted , it holds that
c
(7.29)
Let R() denote the veriers view of the real interaction with P on common input
(h(), f ()) and provers auxiliary input , where the verier is played by A2 . Then,
real, A (, h()) = ( , A2 (h(), f (), R()))
ideal F, B (, h()) = ( , A2 (h(), f (), S(h(), f ())))
However, by the standard formulation of zero-knowledge, it follows that {R()}{0,1}
and {S(h(), f ())}{0,1} are computationally indistinguishable (also when given
as auxiliary input), and so Eq. (7.29) follows.
We now turn to the case where the second party is honest. In this case, B2 is determined, and we transform (real-model) A1 into (ideal-model) B1 , which uses A1 as a
subroutine. Recall that B1 gets input {0, 1}n .
1. B1 invokes A1 on input . As (implicit) in the protocol, any action of A1 in Step C1
(including abort) is interpreted as sending a string. Let us denote by v the message
sent by A1 (i.e., v A1 ()).
41
The case in which A2 executes Step C2 with respect to a different common input is just a special case of a
malicious behavior.
666
(7.30)
Actually, we will show that these two ensembles are statistically indistinguishable,
where the statistical difference is due to the case where the real adversary A1 succeeds
in convincing the verier (played by the honest Party 2) that (u, v) satises Eq. (7.28),
and yet this claim is false. By the soundness of the proof system, this event happens only
with negligible probability. On the other hand, in case (u, v) satises Eq. (7.28), we show
that ideal F, B (, h()) and real, A (, h()) are identically distributed. Details follow.
One key observation is that the emulation of the proof system (with prover strategy
A1 ()) performed in Step 2 by B1 is distributed identically to the real execution of the
proof system that takes place in Step C2 of .
def
def
Fixing any , recall that v = A1 () need not equal f (), and that u = h() uniquely
determines (because h is 1-1). We denote by p the probability that A1 () (playing a
possibly cheating prover) convinces the verier (played in Step C2 by Party 2) that (u, v)
satises Eq. (7.28). (Since A1 is deterministic, v = A1 () is xed and the probability
is only taken over the moves of Party 2.) We consider two cases corresponding to the
42
In particular, if A1 aborts the execution of Step C2, then the honest verier will not be convinced.
Alternatively, machine B1 may invoke the trusted party but prevent it from answering Party 2. The difference
is immaterial, because Party 1 gets nothing from the trusted party. What matters is that (in either case) Party 2
will get an abort symbol (i.e., ).
44 We comment that even if h were not 1-1 but a strong proof-of-knowledge (rather than an ordinary proof system)
was used in Step C2, then one could have inferred that Party 1 knows an so that h( ) = u and v = f ( ),
whereas does not necessarily equal . Sending to the trusted party in the next (emulation) step, we would
have been ne, as it would have (also) meant that the trusted partys response to Party 2 is v.
43
667
relation between p and the soundness error-bound function associated with the proof
system (P, V ).45
1. Suppose p > (n). In this case, by the soundness condition, it must be the
case that A1 () = v = f (), because in this case (u, v) satises Eq. (7.28) and
so v = f (h 1 (u)) = f (h 1 (h())) = f (). Thus, in both the real and the ideal
model, with probability p, the joint execution view is non-aborting and equals
(A1 (, T ), A1 ()) = (A1 (, T ), f ()), where T represents the provers view of the
execution of Step C2 (on common input (h(), f ()), where the prover is played by
A1 (), and the verier is honest). On the other hand, in both models, with probability 1 p, the joint execution is aborting and equals (A1 (, T ), ), where T is as
before (except that here it is a rejecting execution transcript). Thus, in this case, the
distributions in Eq. (7.30) are identical.
We call the readers attention to the reliance of our analysis on the fact that the
emulation of the proof system (with prover A1 ()) that is performed in Step 2 by B1
is distributed identically to the real execution of the proof system that takes place in
Step C2 of .
2. Suppose that p (n). Again, in both models, aborting executions are identical
and occur with probability 1 p. However, in this case, we have no handle on
the non-aborting executions in the real model (because it is no longer guaranteed
that A1 () = f (h 1 (u)) holds in the real non-aborting execution, whereas in the
ideal model it still holds that in non-aborting executions, Party 2 outputs f () =
f (h 1 (u))). But we do not care, because (in this case) these non-aborting executions
occur with negligible probability (i.e., p (n)). Thus, in this case, the distribution
ensembles in Eq. (7.30) are statistically indistinguishable.
The proposition follows.
We comment that this treatment can be extended to the case that h is a randomized
process, rather than a function (as long as the image of h uniquely determines its preimage). Details are omitted in view of the fact that a much more general treatment will
be provided in Section 7.4.3.4.
(7.31)
where (as in Section 7.4.3.2) the function f is polynomial-time computable.46 In contrast to Section 7.4.3.2, the value f () is not veriable (with respect to a value h()
45
We stress that an explicit error-bound can be associated with all standard zero-knowledge proof systems, and
that here we use a system for which is negligible. Furthermore, we may use a proof system with error-bound
def
46
(n) = 2n .
Actually, in order to conform with the convention that the functionality has to be dened for any input pair, we
may consider the formulation (, ) (, f ()).
668
that is known to the second party and uniquely determines ). In other words, the value
output by Party 2 is only required to be an image of f (corresponding to a pre-image of
a given length). Thus, at rst glance, one may think that securely computing Eq. (7.31)
should be easier than securely computing Eq. (7.27), especially in case f is onto (in
which case any string is an f -image). This impression is wrong, because securely computing Eq. (7.31) means emulating an ideal model in which Party 1 knows the string
it sends to the trusted party. That is, in a secure protocol for Eq. (7.31), whenever
Party 2 outputs some image (of f ), Party 1 must know a corresponding pre-image
(under f ).47 Still, proving knowledge of a pre-image (and doing so in zero-knowledge)
is what a zero-knowledge proof-of-knowledge is all about. Actually, in order to avoid
expected probabilistic polynomial-time adversaries, we use zero-knowledge strongproof-of-knowledge (as dened and constructed in Section 4.7.6). We will show that
Construction 7.4.10 can be easily adapted in order to yield a secure implementation
of Eq. (7.31). Specically, all that is needed is to use (in Step C2) a zero-knowledge
strong-proof-of-knowledge (rather than an ordinary zero-knowledge proof), and set h
to be a constant function.
Proposition 7.4.12: Suppose that (P, V ) is a zero-knowledge strong-proof-ofdef
knowledge for the relation R = {(v, w) : v = f (w)}, and let h be a constant function.
Then, Construction 7.4.10 securely computes (in the malicious model) the functionality
of Eq. (7.31).
Proof Sketch: Recall that P is postulated to be implemented in probabilistic
polynomial-time when given an adequate auxiliary-input (i.e., a pre-image under f
of the common input). For clarity, we reproduce the modied protocol, omitting all
mention of the (constant) function h.
Inputs: Party 1 gets input {0, 1} , and Party 2 gets input 1|| .
def
We comment that the same also holds with respect to Eq. (7.27). But there, the knowledge of a pre-image (of
the output v under f ) is guaranteed by the fact that security implies that the pre-image of v under f must be
consistent with h(), whereas the only such pre-image is itself, which in turn is the initial input of Party 1
and thus known to it.
669
Let us rst justify why the treatment of the case in which Party 1 is honest is
exactly as in the proof of Proposition 7.4.11. In this case, we can use exactly the
same transformation of the real-model adversary A2 into an ideal-model adversary B2 ,
because what this transformation does is essentially invoke the simulator associated
with (the residual prover) A 2 on input the string v = f () that it obtains from the
trusted party. Furthermore, the adequateness of this transformation is established by
only referring to the adequateness of the (zero-knowledge) simulator, which holds also
here.
We now turn to the case where the second party is honest. In this case, B2 is determined, and we transform (real-model) A1 into (ideal-model) B1 , which uses A1 as a
subroutine. Recall that B1 gets input {0, 1}n :
1. B1 invokes A1 on input . As (implicit) in the protocol, any action of A1 in Step C1
(including abort) is interpreted as sending a string. Let us denote by v the message
sent by A1 (i.e., v A1 ()).
2. Machine B1 tries to obtain a pre-image of v under f . Toward this end, B1 uses the
(strong) knowledge-extractor associated with the proof system of Step C2. Specifically, providing the strong knowledge-extractor with oracle access to (the residual
prover) A1 (), machine B1 tries to extract (from A1 ) a string w such that f (w) = v.
def
def
In case the extractor succeeds, B1 sets = w. Otherwise, B1 sets = .
3. Machine B1 now emulates an execution of Step C2. Specically, it lets A 1 () play
the prover and emulates by itself the (honest) verier interacting with A1 () (i.e., B1
behaves like A2 ).
r In case the emulated verier rejects, machine B1 aborts (without invoking the
trusted party), and outputs whatever A1 does (when fed with this emulated proof
transcript).
r Otherwise (i.e., the emulated verier accepts), if = , then B1 sends to the
trusted party and allows it to respond to Party 2. (The response will be f ( ),
which by Step 2 must equal v.) In case = , this sub-step will fail, and B1
aborts as in the case that the emulated verier rejects.
4. Finally, B1 feeds A1 with the execution view, which consists of the provers view of
the emulation of Step C2 (produced in Step 3), and outputs whatever A1 does.
Denoting the functionality of Eq. (7.31) by F, we now show that
c
(7.32)
Actually, we will show that these two ensembles are statistically indistinguishable, where
the statistical difference is due to the case where the real-model adversary A1 succeeds
in convincing the knowledge-verier (played by the honest A2 ) that it knows a preimage of v under f , and yet the knowledge-extractor failed to nd such a preimage. By
denition of strong knowledge-veriers, such an event may occur only with negligible
probability. Loosely speaking, ignoring the rare case in which extraction fails although
the knowledge-verier (played by A2 ) is convinced, it can be shown that the distributions
ideal f, B ((, r ), 1n ) and real, A ((, r ), 1n ) are identical. Details follow.
670
Fixing any , recall that v = A1 () need not be an image of f (let alone that it may
not equal f ()). We denote by p the probability that A1 (), playing a possibly cheating
prover, convinces the knowledge-verier (played in Step C2 by Party 2) that it knows a
pre-image of v under f . We consider two cases corresponding to the relation between
p and the error-bound function referred to in Denition 4.7.13:
1. Suppose that p > (n). In this case, by Denition 4.7.13, with probability at least
1 (n), machine B1 has successfully extracted a pre-image (of v = A1 () under
f ). In the real model, with probability p, the joint execution ends up non-aborting.
By the aforementioned extraction property, in the ideal model, a joint execution is
non-aborting with probability p (n) (actually, the probability is at least p (n)
and at most p). Thus, in both models, with probability p (n), a joint execution is
non-aborting and equals ( A1 (, T ), A1 ()) = (A1 (, T ), f ( )), where T represents
the provers view of an execution of Step C2 (on common input f ( ) = v = A1 (),
where the role of the prover is played by the residual strategy A1 () and the verier is
honest). On the other hand, in both models, with probability 1 p (n), the joint
execution is aborting and equals (A1 (, T ), ), where T is as before (except that
here it is a rejecting execution transcript). Thus, the statistical difference between the
two models is due only to the difference in the probability of producing an aborting
execution in the two models, which in turn is negligible.
We call the readers attention to the reliance of our analysis on the fact that the
emulation of the proof system (with prover A1 ()) performed in Step 2 by B1 is
distributed identically to the real execution of the proof system that takes place in
Step C2 of .
2. Suppose that p (n). Again, in the real model the non-aborting probability is p,
which in this case is negligible. Thus, we ignore these executions and focus on the
aborting executions, which occur with probability at least 1 p 1 (n) in both
models. Recalling that aborting executions are identically distributed in both models,
we conclude that the statistical difference between the two models is at most (n).
Thus, in both case, the distribution ensembles in Eq. (7.32) are statistically indistinguishable. The proposition follows.
( , f ())
if = h()
(, )
(7.33)
( , (h(), f ())) otherwise
In the intended applications of the h-authenticated f -computation functionality, Party 2
is supposed to input = h(), and so the rst case in Eq. (7.33) holds, provided
that both parties are honest. Indeed, if Party 2 is honest, then either it gets the correct value of f () (i.e., which ts h() known to it) or it gets an indication that
Party 1 is cheating. The specic form of the second case was designed to facilitate the implementation, while not causing any harm.48 What matters is that the
outputs in the two cases are different, and so Party 2 can tell whether or not it received the correct value of f (). We stress that in the intended applications, Party 2
knows h() and is supposed to obtain f (), and so it causes no harm to provide
Party 2 with both of them (even in case Party 2 misbehaves and enters an input other
than h()).
We assume again, for simplicity, that h is length preserving, which again can be
enforced by considering = (, 1|h()| ) and h ( ) = (h(), 1|| ). However, we make
no further assumptions concerning the function h, and thus Eq. (7.31) is essentially a
special case (obtained by setting h() = 1|| ).
The functionality of Eq. (7.33) is implemented by having Party 1 use the imagetransmission functionality to send the pair (h(), f ()) to Party 2, which compares
the rst element to its own input and acts accordingly. That is, we use the following
(oracle-aided) protocol:
Construction 7.4.14 (authenticated computation protocol, general version):
Inputs: Party 1 gets input {0, 1} , and Party 2 gets input {0, 1}|| .
def
Step C1: Party 1 uses the image-transmission functionality to send the pair (u, v) =
(h(), f ()) to Party 2. That is, the parties invoke the functionality of Eq. (7.31) with
def
respect to the function g() = (h(), f ()), where Party 1 enters the input and
Party 2 is to obtain g().
Step C2: Assuming that Step C1 was not aborted by Party 1 and that Party 2 receives
the pair (u, v) in Step C1, Party 2 outputs v if u = and (u, v) otherwise.
Outputs: If not aborted (with output ), Party 2 sets its local output as directed in
Step C2. (Party 1 has no output.)
We stress that in the oracle invocation (of Step C1), Party i plays the i-th party (with
respect to the oracle call). Recall that (unlike Party 2), Party 1 may abort and in particular
48
In contrast, even privately computing the more natural functionality (, ) ( , v), where v = f () if =
h() and v = otherwise, is signicantly harder than (securely or privately) implementing Eq. (7.33); see
Exercise 12. The difference is that Eq. (7.33) allows for revealing h() to Party 2 (specically in case h() = ),
whereas the more natural functionality does not allow this.
672
do so during Step C1. Since Step C1 consists of an oracle invocation, aborting during
Step C1 means instructing the oracle not to answer Party 2.
Proposition 7.4.15: Construction 7.4.14 securely reduces the h-authenticated f computation functionality of Eq. (7.33) to the image-transmission functionality of
Eq. (7.31).
Proof Sketch: We need to transform any admissible pair, (A 1 , A2 ), for the real oracleaided model into a corresponding pair, (B1 , B2 ), for the ideal model. We start by assuming that the rst party is honest and by transforming the real-model adversary A 2 (for
the oracle-aided execution) into a corresponding ideal-model adversary B2 . On input
, the latter proceeds as follows:
def
1. Machine B2 sends to the trusted party and obtains the answer, which equals v =
def
f () if = h() and (u, v) = (h(), f ()) otherwise, where is the (unknown
def
to B2 ) input of Party 1.49 In the rst case, B2 sets u = , and so in both cases
(u, v) = (h(), f ()).
2. Machine B2 emulates the protocol, by feeding A2 with and the pair (u, v),
which A2 expects to get in Step C1, and outputting whatever the latter outputs (in
Step C2).
Note that both the ideal execution under (B1 , B2 ) and the real execution (in the oracleaided model) under ( A1 , A2 ) yield the output pair ( , A2 (, (h(), f ()))). Thus, the
ideal and real ensembles are identical.
We now turn to the case where the second party is honest and transform the realmodel adversary A1 into a corresponding ideal-model adversary B1 . On input ,
the latter proceeds as follows:
1. Machine B1 emulates Step C1 of the protocol, by obtaining from A1 the input
A1 () (that A1 wishes to transmit via Eq. (7.31)) and feeding A1 with the expected
answer .
2. If A1 instructs the oracle not to answer Party 2, then B1 halts without invoking the
trusted party. Otherwise, B1 sends to the trusted party and lets it answer Party 2.
In both cases, B1 halts with output equal to the corresponding output of A1 .
Note that if h( ) = , where is the (unknown to B1 ) input of Party 2, then the
trusted party answers Party 2 with f ( ), and otherwise it answers Party 2 with
(h( ), f ( )).
Note that both the ideal execution under (B1 , B2 ) and the real execution (in the oracleaided model) under ( A1 , A2 ) yield the output pair ( A1 (, , ) , ) if A1 (, ) =
and (A1 (, ) , F(A1 (), ) otherwise, where F( , ) is as in Eq. (7.33); that is,
49
Recall that, in either case, the trusted party will send Party 1 the answer . Also note that the emulation will
remain valid regardless of which ||-bit long string B2 sends to the trusted party (because, for any such choice,
B2 will [explicitly] receive f (), as well as [explicitly or implicitly] receive h()).
673
(7.34)
def
Indeed, Denition 7.4.6 is a special case (obtained by setting (n) = 1 and g(r ) = r ).
The augmented coin-tossing functionality (mentioned in Section 7.4.1) will be derived
as a special case (see Proposition 7.4.19). But rst we show that Eq. (7.34) can be
securely reduced to the set of functionalities presented earlier (see discussion of this
notion of a reduction in Remark 7.4.5). That is, we present an oracle-aided protocol that
uses two of the latter functionalities (i.e., basic coin-tossing and general authenticated
computation), as well as a commitment scheme C. The protocol can be viewed as
a robust version of Construction 7.4.7 (i.e., simple operations, such as sending a
commitment to a value and tossing a coin, are replaced by corresponding functionalities
that prevent various abuses).
Construction 7.4.16 (an oracle-aided protocol for Eq. (7.34)): For r1 , ..., r {0, 1}n
and 1 , ..., {0, 1}, we let C r1 ,...,r (1 , ..., ) = (Cr1 (1 ), ..., Cr ( )).
def
Step C4: Party 1 sets r = r r , and uses the authenticated-computation functionality to send g(r ) to Party 2. Specically, Party 1 enters Eq. (7.33) with input (r , s, r ),
674
def
Party 2 enters with input (c, r ), where (c, r ) is supposed to equal h (C4) (r , s, r ) =
def
(C s (r ), r ), and Party 2 is supposed to obtain f (C4) (r , s, r ) = g(r r ). In case
Party 1 aborts or Party 2 obtains an answer of a different format, which happens if
the inputs to the functionality do not match, Party 2 halts with output (indicating
that Party 1 misbehaved).
We comment that r = r r is uniquely determined by c and r .
Outputs: Party 1 outputs r , and Party 2 outputs the value determined in Step C4, which
is either g(r ) or .
We stress that, in all oracle calls, Party 1 is the party initiating (requesting) the call. We
comment that more efcient alternatives to Construction 7.4.16 do exist; it is just that
we nd Construction 7.4.16 easiest to analyze.
Proposition 7.4.17: Let F be the set of functionalities dened in Denition 7.4.6 and
Eq. (7.33), respectively. Then Construction 7.4.16 constitutes a security reduction from
the generalized coin-tossing functionality of Eq. (7.34) to F.
Proof Sketch: We start by assuming that the rst party is honest and by transforming
the real-model adversary A2 (for the oracle-aided execution) into a corresponding idealmodel adversary B2 . On input 1n , the latter proceeds as follows:
1. Machine B2 emulates the local actions of the honest Party 1 in Step C1 of the protocol,
by uniformly selecting r {0, 1} and s {0, 1}n .
def
2. Machine B2 emulates Step C2 of the protocol, by feeding A2 with c = C s (r ). (Recall
that by our convention, A2 never aborts.)
3. Machine B2 emulates Step C3 of the protocol, by uniformly selecting r {0, 1}
and feeding A2 with it.
4. Machine B2 invokes the trusted party with input 1n and obtains the answer g(r ),
for a uniformly distributed r {0, 1} that is handed to Party 1.50 Next, machine
B2 obtains the input (or query) of A2 to the functionality of Step C4. If this input
(i.e., A2 (, C s (r ), r ), where represents the Step 1 emulation of Step C1) does not
equal the pair of values (C s (r ), r ) fed to A2 in Steps 23, then B2 halts with output
A2 (, c, r , ((c, r ), g(r ))). Otherwise, B2 halts with output A2 (, c, r , g(r )).
Note that in both cases, the output of B2 corresponds to the output of A2 when
fed with the corresponding emulation of Steps C1C4. In particular, B2 emulates
Step C4 by feeding A2 either with g(r ) or with (h (C4) (r , s, r ), g(r )), where the
decision depends on whether or not A2 (, C s (r ), r ) = (C s (r ), r ). (Recall that
(C s (r ), r ) = h (C4) (r , s, r ).) Indeed, B2 is cheating (in the emulation of Step C4),
because A2 expects to get either f (C4) (r , s, r ) = g(r r ) or (h (C4) (r , s, r ), g(r
r )), but (as we shall see) this cheating is undetectable.
Let us rst assume that the input entered by A2 to the functionality of Step C4
does t its view of Steps C2 and C3, an event that occurs with equal probability
50
Indeed, this part of the current step could also take place at an earlier stage.
675
in both models (because the emulation of Steps C2C3 is perfect). In this case,
the ideal-model execution under (B1 , B2 ) yields the pair (r , A2 (, C(r ), r , g(r ))),
where r , r , r are uniformly and independently distributed. On the other hand, the
real-model execution (in the oracle-aided model) under (A1 , A2 ) yields the pair
(r r , A2 (, C(r ), r , g(r r ))), where r and r are as before, which (for
r = r r ) is distributed identically to (r , A2 (, C(r r ), r , g(r ))). However, due
to the hiding property of C, the two ensembles are computationally indistinguishable. In case the input entered by A2 to the functionality of Step C4 does not t
its view of Steps C2 and C3, the ideal-model execution under (B1 , B2 ) yields the
pair (r , A2 (, C(r ), r , ((C(r ), r ), g(r )))), whereas the real-model execution under
(A1 , A2 ) yields the pair (r r , A2 (, C(r ), r , ((C(r ), r ), g(r r )))), which is
distributed identically to (r , A2 (, C(r r ), r , ((C(r r ), r ), g(r )))). Again, the
two ensembles are computationally indistinguishable.
We now turn to the case where the second party is honest and transform the realmodel adversary A1 into a corresponding ideal-model adversary B1 . On input 1n , the
latter proceeds as follows:
1. Machine B1 emulates Step C1 of the protocol, by obtaining (r , s) A1 (1n ), which
is the query that A1 will use in Step C2.
2. Machine B1 emulates Step C2 by doing nothing.
Note that the real-model adversary A1 would have made the oracle query (r , s) and
would have obtained as an answer.
3. Machine B1 invokes the trusted party (on input 1n ) and obtains a uniformly distributed
r {0, 1} . We stress that at this time, B1 does not instruct the trusted party whether
def
or not to answer Party 2. Machine B1 emulates Step C3, by feeding r = r r to
A1 .
4. Machine B1 starts its emulation of Step C4, by checking whether or not the query
that A1 wishes to make (i.e., A1 (1n , , r )) ts the tuple (r , s, r ) in the sense
def
that it yields the same value (C s (r ), r ). That is, let (q , q, q ) = A1 (1n , , r ). If
(C q (q ), q ) = (C s (r ), r ), then B1 instructs the trusted party to answer Party 2,
or else B1 instructs the trusted party to stop (without answering Party 2).51 Finally,
B1 outputs whatever A1 does (i.e., A1 (1n , , r , ), where the four inputs of A 1
correspond to its view in each of the four steps).
Note that the output of Party 1 in both the real model (under the Ai s) and the ideal model
(under the Bi s) equals A1 (1n , , r , ), where r is uniformly distributed (in both models). The issue is the correlation of this output to the output of Party 2, which is relevant
only if Party 2 does have an output. Recall that Party 2 obtains an output (in both models)
only if the corresponding Party 1 does not abort (or stops the trusted party). Furthermore,
in both models, an output is obtained if and only if (C q (q ), q ) = (C s (r ), r ) holds,
def
def
In particular, if (in contrary to our simplifying assumption) A1 aborts before Step C4, then the sequence
(q , q, q ) equals and does not t (C s (r ), r ).
676
(7.35)
(7.36)
Certainly, the naive protocol of just letting Party 1 send Party 2 a commitment to x does
not constitute a secure implementation of Eq. (7.36): This naive suggestion does not
guarantee that the output is in the range of the commitment scheme, let alone that it is a
random commitment for which Party 1 knows a corresponding decommitment. Thus,
677
the naive protocol must be augmented by mechanisms that address all these concerns.
We show that Eq. (7.36) can be securely reduced to the set of functionalities presented
in previous subsections.
Construction 7.4.20 (an oracle-aided protocol for Eq. (7.36)):
Inputs: Party 1 has input x {0, 1}n , whereas Party 2 gets input 1n .
Step C1: Party 1 selects uniformly r {0, 1}n .
2
def
def
Indeed, this part of the current step could also take place at an earlier stage.
In fact, the said ensembles are computationally indistinguishable even when r and s are xed, rather than being
random. That is, the ensembles {(C(0|x| ), C(s), C r (x))}x,r,s and {(C(x), C(r ), C r (x))}x,r,s are computationally
indistinguishable, where (as usual) the distributions index (x, r, s) is also given to the potential distinguisher.
This follows from the computational indistinguishability of {(C(0|x| ), C(s))}x,r,s and {(C(x), C(r ))} x,r,s , which
in turn follows from the hiding property of C.
679
We now turn to the case where the second party is honest and transform the realmodel adversary A1 into a corresponding ideal-model adversary B1 . On input x, the
latter proceeds as follows:
1. Machine B1 emulates Step C1 of the protocol, by obtaining r from A1 (x). Actually,
B1 obtains (x , r ) A1 (x), which is the query that A1 will use in Step C2.
2. Machine B1 emulates Step C2 by doing nothing.
Note that the real-model adversary A1 would have made the oracle query (x , r ) and
would have obtained as an answer.
3. Machine B1 invokes the trusted party on input x , and obtains a uniformly distributed
2
r {0, 1}n . We stress that at this time, B1 does not instruct the trusted party whether
or not to answer Party 2. Machine B1 emulates Step C3, by uniformly selecting
3
r {0, 1}n and feeding (r, r ) to A1 .
4. Machine B1 starts its emulation of Step C4, by checking whether or not the query that
A1 wishes to make (i.e., A1 (x, , (r, r ))) ts the tuple (x , r, r , r ) in the sense that it
def
yields the same value (C r (x ), C r (r )). That is, let (q1 , q2 , s1 , s2 ) = A1 (x, , (r, r )).
If (C s1 (q1 ), C s2 (q2 )) = (C r (x ), C r (r )), then B1 instructs the trusted party to answer
Party 2; otherwise B1 instructs the trusted party to stop (without answering Party 2).
Finally, B1 outputs whatever A1 does (i.e., A1 (x, , (r, r ), ), where the four inputs
of A1 correspond to its view in each of the four steps).
Note that the output of Party 1 in both the real model (under the Ai s) and the ideal model
2
3
(under the Bi s) equals A1 (x, , (r, r ), ), where r {0, 1}n and r {0, 1}n are uniformly and independently distributed (in both models). The issue is the correlation of
this output to the output of Party 2, which is relevant only if Party 2 does have an output.
Recall that Party 2 obtains an output (in both models) only if the corresponding Party 1
does not abort (or stops the trusted party). Furthermore, in both models, an output is obtained if and only if (C s1 (q1 ), C s2 (q2 )) = (C r (x ), C r (r )), where (x , r ) = A1 (x) and
(q1 , q2 , s1 , s2 ) = A1 (x, , (r, r )). In particular, (C s1 (q1 ), C s2 (q2 )) = (C r (x ), C r (r ))
implies that (q1 , q2 ) = (x , r ) and that the inputs entered in Step C4 do match (i.e.,
h (C4) (q1 , q2 , s1 , s2 ) = (C r (x ), C r (r ))), which means that in the real model, the output
of Party 2 is f (C4) (q1 , q2 , s1 , s2 ) = f (C4) (x , r, s1 , s2 ) = C r (x ) (exactly as in the ideal
model). We conclude that the ideal model perfectly emulates the real model, and the
proposition follows.
7.4.3.7. Summary
Combining Proposition 7.4.8 (resp., Proposition 7.4.12) with suitable results regarding
the underlying primitives, we conclude that coin-tossing (resp., image transmission
as in Eq. (7.31)) can be securely implemented based on any 1-1 one-way function.
Combining Proposition 7.4.15 (resp., Proposition 7.4.19) [resp., Proposition 7.4.21]
with the previous results, by using the Composition Theorem (i.e., Theorem 7.4.3 or
Remark 7.4.5), we obtain secure implementations of the authenticated-computation
functionality (resp., augmented coin-tossing) [resp., input-commitment functionality].
The 1-1 restriction can be waived by using a slightly more cumbersome construction that
680
utilizes the commitment scheme of Construction 4.4.4 (instead of the simple scheme
of Construction 4.4.2). We thus state the following for future reference:
Proposition 7.4.22: Assuming the existence of (non-uniformly strong) one-way functions, the following three functionalities can be securely computed:
1. The input-commitment functionality as dened in Eq. (7.36).
2. The augmented coin-tossing functionality as dened in Eq. (7.35).
3. The authenticated-computation functionality as dened in Eq. (7.33).
Specically, we are talking about two invocations of Eq. (7.36). In the rst invocation,
Party 1 wishing to commit to x, plays the role of the rst party in Eq. (7.36), and
2
obtains a uniformly distributed 1 {0, 1}n , whereas Party 2 (which plays the role
def
of the second party in Eq. (7.36)) obtains 1 = C 1 (x). Likewise, in the second
invocation, Party 2, wishing to commit to y, plays the role of the rst party in
2
Eq. (7.36), and obtains a uniformly distributed 2 {0, 1}n , whereas Party 1 (which
def
plays the role of the second party in Eq. (7.36)) obtains 2 = C 2 (y).
Coin-Generation Phase: Each of the parties generates a random-tape for the emulation of , by invoking the augmented coin-tossing functionality of Eq. (7.35). Recall
that this functionality maps the input pair (1n , 1n ) to the output pair ((r, s), C s (r )),
where (r, s) is uniformly distributed in {0, 1}(n) {0, 1}n(n) . Thus, each party
681
obtains the random-tape to be held by it, whereas the other party obtains a commitment to this value. The party holding the random-tape also obtains the randomization
used in the corresponding commitment, which it will use in performing its role in the
protocol-emulation phase.
Specically, we are talking about two invocations of Eq. (7.35). In the rst (resp.,
second) invocation, Party 1 (resp., Party 2) plays the role of the rst party in
Eq. (7.35), and obtains a uniformly distributed (r 1 , 1 ) {0, 1}(n) {0, 1}n(n)
(resp., (r 2 , 2 ) {0, 1}(n) {0, 1}n(n) ), whereas Party 2 (resp., Party 1) which plays
def
def
the other role, obtains 1 = C 1 (r 1 ) (resp., 2 = C 2 (r 2 )).
Protocol-Emulation Phase: The parties use the authenticated-computation functionality of Eq. (7.33) in order to emulate each step of protocol . Recall that, for
predetermined functions h and f , this functionality maps the input pair (, ) to
the output pair (, f ()) if = h() and to ( , (h(), f ())) otherwise, where the
second case is treated as abort.
The party that is supposed to send a message plays the role of the rst (i.e., initiating)
party in Eq. (7.33), and the party that is supposed to receive the message plays the
role of the second party. Suppose that the current message in is to be sent by
def
def
Party j, and let u = x if j = 1 and u = y otherwise. Then the functions h, f and
the inputs , , for the functionality of Eq. (7.33), are set as follows:
Aborting: In case any of the functionalities invoked in any of these phases terminates in
an abort state, the party (or parties) obtaining this indication aborts the execution,
and sets its output to . Otherwise, outputs are as follows.
Outputs: At the end of the emulation phase, each party holds the corresponding output
of the party in protocol . The party just locally outputs this value.
Clearly, in case both parties are honest, the inputoutput relation of is identical
to that of . (We will show that essentially the same also holds in general.) We note
that the transformation of to can be implemented in polynomial-time. Finally,
replacing the oracle calls by the sub-protocols provided in Proposition 7.4.22 yields a
standard protocol for the malicious model.
54
Indeed, Theorem 7.4.1 will follow as a special case of the general analysis of the compiler (as provided later).
See further discussion following the statement of Proposition 7.4.25.
683
Output: At the end of the interaction, the party produces an output depending on its
entire view of the interaction. We stress that the view consists of the initial input u,
the selected random-tape, and all messages received so far.
A pair of probabilistic polynomial-time strategies, C = (C 1 , C2 ), is admissible with
respect to in the augmented semi-honest model if one strategy implements and
the other implements an augmented semi-honest behavior with respect to .
The augmented semi-honest model extends the ordinary semi-honest model in allowing
adversaries to modify their initial input and to abort the execution at an arbitrary time.
The augmented semi-honest model is arguably more appealing than the semi-honest
model because in many settings, input modication and aborting can also be performed
at a high level, without modifying the prescribed program. In contrast, implementing
an effective malicious adversary may require some insight into the original protocol,
and it typically requires substitution of the programs code.
Intuitively, the compiler transforms any protocol into an (oracle-aided) protocol
, such that executions of in the malicious model correspond to executions of
in the augmented semi-honest model. That is:
Proposition 7.4.25 (general analysis of the two-party compiler): Let be the (oracleaided) protocol produced by Construction 7.4.23 when given the protocol , and let G
denote the set of the three oracle functionalities that are used by protocol . Then, for
every pair of probabilistic polynomial-time strategies A = (A1 , A2 ) that are admissible
(with respect to ) for the (real) malicious model (of Denition 7.4.2),55 there exists a
pair of probabilistic polynomial-time strategies B = (B1 , B2 ) that are admissible with
respect to for the augmented semi-honest model (of Denition 7.4.24), such that
c
G
{real, B(z) (x, y)}x, y,z {real
, A(z) (x, y)} x, y,z
Recall the denition of real-model adversaries for an oracle-aided protocol (i.e., Denition 7.4.2) extends the
denition of real-model adversaries for ordinary protocols (i.e., Denition 7.2.5).
684
hon commits
to its input, machine Bmal generates a dummy commitment (supposedly to the
input of Partyhon ) and feeds it to Amal , which expects to get a commitment (as
2
answer from the oracle). Specically, Bmal uniformly selects hon {0, 1}n , and
def
computes the commitment hon = C hon (0n ), where 0n is an arbitrary (dummy)
value (which replaces the unknown input of Partyhon ). Machine Bmal feeds Amal
with hon (as if hon were the oracle answer).
r In the invocation of the input-committing functionality in which Party commal
mits to its input, machine Bmal tries to obtain the committed value (provided by
Partymal ) and feeds Amal with decommitment information (which it expects to
get). Specically, Bmal obtains the query, denoted u , that Amal makes to the input2
committing functionality, and feeds it with a uniformly selected mal {0, 1}n .
We stress that Bmal will use this u as its modied input in its (augmented semihonest) execution of .
In case Amal has aborted this oracle call, machine Bmal aborts (i.e., does not enter
the execution of ).
685
In case Bmal did not abort, it enters protocol with input u . Note that this entire
step is implemented in polynomial-time, and the resulting u depends only on u (the
initial input of Bmal ).
Selection of random-tape: Bmal selects its random-tape uniformly in {0, 1}(n) (as specied by ), and emulates the execution of the coin-generation phase of ending
with this outcome, so as to place Amal in the appropriate state toward the protocolemulation phase. To achieve the latter goal, machine Bmal supplies Amal with the
oracle answers that it expects to see. Again, we distinguish between the two oracle
calls (to the augmented coin-tossing functionality) made during the coin-generation
phase of :
hon obtains the outcome of the coin-toss, machine Bmal generates a dummy commitment
(supposedly to the random-tape of Partyhon ) and feeds it to Amal , which expects
to get a commitment (as answer from the oracle). Specically, Bmal uniformly sedef
lects hon {0, 1}n(n) , and computes the commitment hon = C hon (0(n) ), where
0(n) is an arbitrary (dummy) value (which replaces the unknown random-tape of
Partyhon ). Machine Bmal feeds Amal with hon (as if hon were the oracle answer).
r In the invocation of the augmented coin-tossing functionality in which Party
mal
obtains the outcome of the coin-toss, machine Bmal rst selects uniformly r mal
{0, 1}(n) and mal {0, 1}n(n) , and feeds Amal with the pair (r mal , mal ). Machine
Bmal will use r mal as its random-tape in its (augmented semi-honest) execution of
. If Amal aborts this oracle call, then Bmal aborts.
In case Bmal did not abort, it will use r mal as its random-tape in the subsequent steps
of protocol . Note that this entire step is implemented in polynomial-time, and that
r mal is selected uniformly in {0, 1}(n) independent of anything else.
Subsequent steps message transmission: Machine Bmal now enters the actual execution of . It proceeds in this real execution along with emulating the corresponding oracle answers of the authenticated-computation functionality. In a messagetransmission step by Partyhon (in ), machine Bmal obtains from Partyhon (in the
real execution of ) a message, and emulates the answer given to Partymal by the
authenticated-computation functionality. In a message-transmission step by Partymal
in , machine Bmal computes the message to be sent to Partyhon (in ) as instructed
by , based on the input u determined earlier, the random-tape r mal selected earlier,
and the messages obtained so far from Partyhon (in ). It then checks if Amal makes
the correct oracle-query, in which case it sends Partyhon the message just computed,
and otherwise it aborts. Details follow:
from Partyhon (in the real execution of ) a message, denoted msg. Next, machine Bmal obtains from Amal the query that Amal makes to the authenticatedcomputation functionality. Let us denote this query by = (q1 , q2 , q3 ). If
(q1 , q2 ) = ( hon , hon ) and q3 equals the sequence of messages sent so far (by
Bmal to Partyhon ), then Bmal feeds Amal with the received message msg. Otherwise, Bmal feeds Amal with (( hon , hon , 3 ), msg), where 3 is the sequence of
686
messages sent so far (by Bmal to Partyhon ). (The latter case means that Amal is
cheating, but Partyhon does not detect this fact (because it obtains no answer from
the authenticated-computation functionality).)
r In a message-transmission step by Party (in ), machine Bmal rst computes
mal
the message, denoted msg, that it should send (according to ) on input u (as determined earlier), random-tape r mal (as recorded earlier), and the messages received so far (from Partyhon in execution of ). Next, machine Bmal obtains
from Amal the query that Amal makes to the authenticated-computation functionality. Let us denote this query by ((u , ), (r , ), 3 ). If C (u ) = C mal (u ),
C (r ) = C mal (r mal ), and 3 equals the sequence of messages received so far
(from Partyhon ), then Bmal sends the message msg to Partyhon . Otherwise, Bmal
aborts . (The latter case means that Amal is cheating in , and Partyhon detects
this fact and treats it as if Partymal has aborted in .)
Output: Machine Bmal just outputs, whatever machine Amal outputs, given the execution
history (in ) emulated earlier.
Clearly, machine Bmal (as described) implements an augmented semi-honest behavior
with respect to . It is left to show that
c
G
{real
, A(z) (x, y)} x, y,z {real, B(z) (x, y)}x, y,z
(7.37)
There is only one difference between the two ensembles referred to in Eq. (7.37): In
G
the rst distribution (i.e., real
, A(z) (x, y)), the commitments obtained by A mal in the
input-commitment and coin-generation phases are to the true input and true randomtape of Partyhon . On the other hand, in the second distribution (i.e., real, B(z) (x, y)),
the emulated machine Amal is given commitments to dummy values (and the actions of Bmal are determined accordingly). We stress that, other than this difference, Bmal perfectly emulates Amal . However, the difference is undetectable (i.e.,
computationally indistinguishable) due to the hiding property of the commitment
scheme.
Composing the oracle-aided protocols produced by the compiler with secure implementations of these oracles (as provided by Proposition 7.4.22), and using the Composition Theorem and Proposition 7.4.25, we obtain:
Corollary 7.4.26 (compilation of two-party protocols): Assuming the existence of
(non-uniformly strong) one-way functions, any two-party protocol can be efciently
transformed into a two-party protocol such that the following holds. For every pair
of probabilistic polynomial-time strategies A = (A1 , A2 ) that are admissible (with respect to ) for the (real) malicious model (of Denition 7.2.5), there exists a pair of
probabilistic polynomial-time strategies B = (B1 , B2 ) that are admissible with respect
to for the augmented semi-honest model (of Denition 7.4.24), such that
c
{real, B(z) (x, y)}x, y,z {real , A(z) (x, y)}x, y,z
where x, y, z {0, 1} such that |x| = |y| and |z| = poly(|x|).
687
{real, B(z) (x, y)}x, y,z {ideal f,C(z) (x, y)}x, y,z
where x, y, z {0, 1} such that |x| = |y| and |z| = poly(|x|).
We comment that the statement of Proposition 7.4.27 implicitly introduces a notion of
security in the augmented semi-honest model. Indeed, if the real-model adversary is
allowed augmented semi-honest behavior, then it is natural to allow a corresponding
behavior in the ideal model, which then coincides with the ideal malicious model.
Viewed in these terms, Proposition 7.4.27 asserts that canonical protocols are secure
in the augmented semi-honest model.
688
Proof Sketch: Recall that canonical protocols (cf. Denition 7.3.13) proceed in two
stages, where the rst stage yields no information at all (to any semi-honest party) and
the second phase consists of the exchange of a single pair of messages (i.e., each party
sends a single message). We use the fact that canonical protocols admit a two-stage
simulation procedure (for the view of a semi-honest party). Such two-stage simulators
act as follows:
Input to simulator: A pair (u, v), where u is the initial input of the semi-honest party
and v the corresponding local output.
Simulation Stage 1: Based (only) on u, the simulator generates a transcript corresponding to the view of the semi-honest party in the rst stage of the canonical
protocol .
Recall that this is a truncated execution of , where the execution is truncated just
before the very last message is received by the semi-honest party. We stress that this
truncated view, denoted T , is produced without using v.
Simulation Stage 2: Based on T and v, the simulator produces a string corresponding
to the last message received by the semi-honest party. The simulator then outputs the
concatenation of T and this (last) message.
The reader may easily verify that any canonical protocol has two-stage simulators.
Loosely speaking, a simulator as required in Stage 1 is implicit in the denition of
a canonical protocol (cf. Denition 7.3.13), and the simulation of Stage 2 is trivial
(because Stage 1 in a canonical protocol ends with the parties holding shares of the
desired outputs, and Stage 2 consists of each party sending the share required by the
other party).
Next, for any protocol having two-stage simulators, given a pair (B1 , B2 ) that is
admissible with respect to for the augmented semi-honest model, we construct a
pair, (C1 , C2 ) that is admissible for the ideal malicious model. We distinguish two
cases, corresponding to the identity of the honest party. The difference between these
cases amounts to the possibility of (meaningfully) aborting the execution after receiving
the last message (and just before sending the last message). This possibility exists for
a dishonest Party 1 but not for a dishonest Party 2 (see Figure 7.3).
We start with the case where Party 1 is honest (and Party 2 is dishonest). In this
case, C1 is determined (by ), and we need to transform the augmented semi-honest
real adversary B2 into a malicious ideal-model adversary C 2 . The latter operates as
follows, using the two-stage simulator, denoted S2 , provided for the view of Party 2 in
semi-honest executions of (which privately computes f ). Recall that C2 gets input
y {0, 1}n .
1. Machine C2 rst determines the input y to be sent to the trusted party, where y
is determined according to the behavior of B2 during the entire emulation of the
(canonical) protocol . In addition, C2 emulates the messages sent and received by
689
Party 1
Party 2
Stage 1
(r1,r2)
(s1,s2)
Stage 2
s1
meaningful
abort
r2
r1 + s1
r2+ s2
B2 during the rst phase of , and also determines the last message of B2 (i.e., its
single Stage 2-message). This is done as follows:
(a) First, C2 computes the substituted input with which (the augmented semi-honest
adversary) B2 enters . That is, y B2 (y). In case B2 aborts, machine C 2 sets
y = (so as to conform with the [simplifying] convention that the ideal-model
adversary always sends input to the trusted party).
(b) Next, C 2 invokes the rst stage of the simulator S2 in order to obtain the view of
the execution of the rst stage of as seen by a semi-honest party having input
y . Denote this view by T , and note that T includes y . Machine C2 extracts from
T the random-tape, denoted r , of Party 2. This random-tape will be xed for the
use of B2 .
(c) Using T , machine C 2 emulates the execution of B2 on input y and random-tape
r , up to the point where Party 2 is to receive the last message (in ). We stress
that this point is just after Party 2 has sent its last message. Thus, the last message
of Party 2 (in ) is determined at this step. To perform the emulation, C 2 feeds
B2 with input y and random-tape r , and iteratively feeds B2 with the sequence
of (incoming) messages as appearing in the corresponding locations in T . We
stress that although T is only the transcript of Stage 1 in , it determines all
messages of Party 2 in (including its single Stage 2 message).
Note that the augmented semi-honest strategy B2 may abort in such an execution,
but in case it does not abort, the messages it sends t the transcript T . Consequently, the view of (the augmented semi-honest adversary) B2 in an execution
of the rst stage of is emulated by a prex of T (which in turn represents the
simulated view of a semi-honest party on input y ).
690
In case B2 has aborted the execution (even just before sending the last message,
which belongs to Stage 2), machine C 2 resets y to .
We stress that y is determined based only on y, and that C 2 never aborts.
2. Machine C2 invokes the trusted party with input y and obtains a response, denoted v.
(Since the trusted party answers Party 1 rst, Party 2 does not have the option of
stopping the trusted party before it answers Party 1. But this option is not needed
because Party 2 cannot meaningfully abort after receiving the last message in it.
That is, if B2 has not aborted so far, then it cannot (meaningfully) abort now, because
it has already sent (or rather determined) its last message.)
3. Finally, C 2 determines its output as follows:
(a) C2 invokes the second stage of the simulator S2 in order to obtain the last message
sent to Party 2. That is, C 2 supplies the simulator with the rst-stage transcript
T and the output v, and obtains the last message, denoted msg.
(b) C2 now emulates the last step of B2 (i.e., its output computation) by supplying
it with the message msg.
(Note that the last message of B2 was already determined in Step 1, and so the
execution of C 2 ends here.)
The output of C 2 is set to be the output of B2 , regardless if B2 has aborted or completed
the execution.
We need to show that
c
{real, B(z) (x, y)}x, y,z {ideal f,C(z) (x, y)}x, y,z
(7.38)
{(B1 (S1 (B1 (x), f 1 (B1 (x), y))) , f 2 (B1 (x), y))}x, y
{(C1 (x, f 1 (C1 (x), y)) , f 2 (C1 (x), y))}x, y
{ideal f,C (x, y)}x, y
Next, suppose that B1 always aborts after receiving the last message, and before sending
its last message to Party 2. In this case, we have
{real, B (x, y)}x, y {(B1 (view
1 (B1 (x), y)) , )} x, y
c
{real , A(z) (x, y)}x, y,z {real, B(z) (x, y)}x, y,z
c
Veriable Secret Sharing (VSS), in order to effectively prevent minority parties from
aborting the protocol prematurely. Actually, we shall compile protocols secure in the
rst malicious model into protocols secure in the second malicious model.
Our treatment touches upon a variety of issues that were ignored (or are inapplicable)
in the two-party case. These issues include the communication model (i.e., the type of
communication channels), the consideration of an external adversary, and the way the
latter selects dishonest parties (or corrupts parties). In particular, in some models (i.e.,
postulating private channels and a majority of honest participants), it is possible to obtain
secure protocols without relying on any intractability assumptions: See Section 7.6.
Teaching Tip. We strongly recommend reading Sections 7.27.4 before reading the
current section. In many places in the current section, motivating discussions and
technical details are omitted, while relying on the fact that analogue elaboration has
appeared in the treatment of the two-party case (i.e., in Sections 7.27.4).
7.5.1. Denitions
A multi-party protocol problem is cast by specifying a random process that maps sequences of inputs (one input per each party) to corresponding sequences of outputs.
Let m denote the number of parties. It will be convenient to think of m as being xed,
yet one can certainly think of it as an additional parameter. An m-ary functionality, denoted f : ({0, 1} )m ({0, 1} )m , is thus a random process mapping sequences of the
form x = (x1 , ..., xm ) into sequences of random variables, f (x) = ( f 1 (x), ..., f m (x)).
The semantics is that for every i, the i-th party, initially holds an input xi , and wishes to
obtain the i-th element in f (x1 , ..., x m ), denoted fi (x1 , ..., xm ). For example, consider
deterministic functionalities for computing the maximum, average, or any other statistics of the individual values held by the parties (and see more examples in Exercises 14
and 15). The discussions and simplifying conventions made in Section 7.2.1 apply in
the current context, too. Most importantly, we assume throughout this section that all
parties hold inputs of equal length; that is, |x i | = |x j |.
Conventions Regarding the Number of Parties. For simplicity of exposition, we
assume throughout our exposition that m is xed. From time to time, we comment
on what is needed in order to derive denitions (and constructions) for the case that
m is a parameter. We comment that it is natural to discuss multi-party functionalities
that are uniform, in the sense that there exist (uniform) algorithms for computing
them for each value of m (and of course each m-sequence). One such functionality
is the universal functionality that is given a description of a circuit, as well as a
corresponding sequence of inputs. (For example, the circuit may be part of the input of
each party, and in case these circuits are not identical, the value of the functionality is
dened as a sequence of s.) Indeed, a universal functionality is natural to consider
also in the two-party case, but here (in view of the extra parameter m) its appeal is
enhanced.
694
Indeed, the case in which the adversary controls all parties is of no interest, and is often ignored.
695
over the standard model (i.e., providing secret communication) is well understood,
and can be (easily) decoupled from the main treatment. Specically, protocols secure in
the private-channel model can be compiled to withstand wire-tapping adversaries (by
using encryption schemes). Similarly, we assume that messages sent between honest
parties arrive intact, whereas one may want to consider adversaries that may inject messages on the communication line between honest parties. Again, this can be counteracted
by the use of well-understood paradigms, in this case, the use of signature schemes.
I = {i 1 , ..., i t }, we let view
I (x) = (I, viewi 1 (x), ..., viewi t (x)).
(7.39)
r (general case) We say that privately computes f if there exists a probabilistic polynomial-time algorithm, denoted S, such that for every I [m], it holds
that
{(S(I, (xi1 , ..., xit ), f I (x)) , f (x))}x({0,1} )m
(7.40)
{(view
I (x) , output (x))}x({0,1} )m
where output (x) denotes the output sequence of all parties during the execution
represented in view
I (x).
57
As in Section 7.2, by saying that computes (rather than privately computes) f , we mean that the output
distribution of the protocol (when played by honest or semi-honest parties) on the input sequence (x 1 , ..., xm )
is distributed identically to f (x 1 , ..., xm ).
696
Eq. (7.40) asserts that the view of the parties in I can be efciently simulated based
solely on their inputs and outputs. Note that view
I (x) includes only the local views of
parties in I , and does not include the messages sent between pairs of honest parties.
Thus, Denition 7.5.1 refers to the case in which the semi-honest parties do not (or
cannot) wire-tap the channels between honest parties (and, hence, is labeled without
wire-tapping), which is equivalent to assuming the existence of private channels.
To deal with the case of wire-tapping, one just needs to augment view
I (x) with the
transcript of the messages sent between all the pairs of honest parties. In this case, it is
more natural to consider an external adversary that obtains the views of all parties in
I , as well as all messages sent over all channels.
Denition 7.5.1 can be easily adapted to deal with a varying parameter m, by taking
advantage of the current order of quantiers (i.e., there exists an algorithm S such that
for every I ).58 We also note that the simulator can certainly handle the trivial cases in
which either I = [m] or I = . (The case I = [m] is always trivial, whereas the case
I = is trivial only because here we consider the case of no wire-tapping.)
As in the two-party case, Denition 7.5.1 is equivalent to a denition that can
be derived by following the real-vs.-ideal paradigm (analogously to the treatment in
Section 7.2.2.2).
Note that for a xed m, it may make as much sense to reverse the order of quantiers (i.e., require that for
every I there exists an algorithm S I ).
59 As we shall see, the assumption that malicious parties are in a minority opens the door to effectively preventing
them from aborting the protocol immaturely. This will be achieved by letting the majority parties have (together!)
enough information so as to be able to emulate the minority parties in case the latter abort.
697
ideal-vs.-real emulation paradigm introduced and used in the previous sections. The
difference between the two malicious models is reected in a difference in the corresponding ideal models, which captures the different types of benign behaviors that a
secure protocol is aimed at achieving. Another difference is in the number of malicious
parties considered in each model.
The rst malicious model. Following the discussion in Section 7.2.3, we conclude
that three things cannot be avoided in the rst malicious model:
1. Malicious parties may refuse to participate in the protocol (when the protocol is rst
invoked). Actually, as explained in Section 7.2.3, this behavior may be viewed as a
special case of input substitution (as discussed in the next item).
2. Malicious parties may substitute their local inputs (and enter the protocol with inputs
other than the ones provided to them from the outside).
3. Malicious parties may abort the protocol prematurely (e.g., before sending their last
message).
Accordingly, the ideal model is derived by a straightforward generalization of Denition 7.2.4. In light of this similarity, we allow ourselves to be quite terse. To simplify
the exposition, we assume that for every I , rst the trusted party supplies the adversary
with the I -part of the output (i.e., the value of f I ), and only next is it possibly allowed
(at the adversarys discretion) to answer the other parties. Actually, as in the two-party
case, the adversary has the ability to prevent the trusted party from answering all parties
only in the case where it controls Party 1.60
Denition 7.5.2 (the ideal model rst malicious model): Let f : ({0, 1} )m
def
({0, 1} )m be an m-ary functionality. For I = {i1 , ..., i t } [m] = {1, ..., m}, let I =
[m] \ I and (x 1 , ..., x m ) I = (x i1 , ..., xit ). A pair (I, B), where I [m] and B is a probabilistic polynomial-time algorithm, represents an adversary in the ideal model. The
joint execution of f under (I, B) in the ideal model (on input x = (x1 , ..., xm ) and
(1)
auxiliary input z), denoted ideal f, I, B(z) (x), is dened by uniformly selecting a random(1)
def
tape r for the adversary, and letting ideal f, I, B(z) (x) = (x, I, z, r ), where (x, I, z, r )
is dened as follows:
(7.41)
where x = (x1 , ..., xm ) such that x i = B(x I , I, z, r )i for i I and xi = xi otherwise.
r In case Party 1 is not honest (i.e., 1 I ), (x, I, z, r ) equals
def
(7.42)
(7.43)
As in the two-party case, this convention is rather arbitrary; see the discussion at the end of Section 7.2.3.1.
698
where, in both cases, x = (x1 , ..., xm ) such that xi = B(x I , I, z, r )i for i I and
xi = xi otherwise.
def
In all cases, the trusted party is invoked with possibly substituted inputs, denoted
x = (x 1 , ..., xm ), where xi = xi only if i I . Eq. (7.42) represents the case where
the trusted party is stopped right after supplying the adversary with the I -part of the
output (i.e., f I (x )). This case is allowed only when 1 I , and so Party 1 can always
be blamed when this happens.61 Equations (7.41) and (7.43) represent the cases
where the trusted party is invoked with possibly substituted inputs, but is allowed to
answer all parties. We stress that either all honest parties get their output or all are
notied that the trusted party was stopped by the adversary. As usual, the denition of
security is obtained by requiring that for every feasible adversary in the real model,
there exists a corresponding adversary in the ideal model that achieves the same effect.
Specically, in the real model, the adversary may tap all communication lines and
determine (adaptively) all the outgoing messages of all dishonest parties.
Denition 7.5.3 (Security in the rst malicious model): Let f be as in Denition 7.5.2,
and be an m-party protocol for computing f .
r The joint execution of under (I, A) in the real model (on input a sequence
x = (x1 , ..., xm ) and auxiliary input z), denoted real, I, A(z) (x), is dened as the
output sequence resulting from the interaction between the m parties, where the
messages of parties in I are computed according to A(x I , I, z) and the messages of
def
parties in I = [m] \ I are computed according to .62 Specically, the messages of
malicious parties (i.e., parties in I ) are determined by the adversary A based on the
initial inputs of the parties in I , the auxiliary input z, and all messages sent so far
by all parties (including messages received by the honest parties [i.e., parties in I]).
r Protocol is said to securely compute f (in the rst malicious model) if for every probabilistic polynomial-time algorithm A (representing a real-model adversary
strategy), there exists a probabilistic polynomial-time algorithm B (representing an
ideal-model adversary strategy), such that for every I [m]
(1)
In fact, in the protocols presented in this work, early abort is always due to malicious behavior of Party 1. By
Denition 7.5.3, this translates to malicious behavior of Party 1 in the ideal model.
62 To t the format used in Denition 7.5.2, the outputs of the parties (in real
, I, A(z) (x)) are arranged such that
the outputs of the honest parties appear on the left-hand side.
699
case I = , which is non-trivial because it refers to an adversary that may wire-tap the
communication channel.) In order to derive a denition for the private-channel model,
one should modify the denition of real, I, A(z) (x), such that As actions may depend
only on the messages received by parties in I .
The Second Malicious Model. In the second model, where malicious parties are in
a strict minority, the early-abort, phenomena can be effectively prevented. Thus, in
this case, there is no need to tolerate early-abort, and consequently our denition of
security requires proper termination of executions. This is reected in the denition
of the ideal model, which actually becomes simpler.63
Denition 7.5.4 (security in the second malicious model, assuming an honest
majority): Let f and be as in Denition 7.5.3:
r The ideal-model adversary is dened as in Denition 7.5.2, except that the abort
case captured by Eq. (7.42) is not allowed. The corresponding joint computation in
(2)
the ideal model, under (I, B), is denoted by ideal f, I, B(z) (x).
r The real-model adversary is dened exactly as in Denition 7.5.3. However, we will
only consider the case where such adversary controls strictly less than m/2 parties.
r Protocol is said to securely compute f (in the second malicious model) if for every probabilistic polynomial-time algorithm A (representing a real-model adversary
strategy), there exists a probabilistic polynomial-time algorithm B (representing an
ideal-model adversary strategy), such that for every I [m] such that |I | < m/2, it
holds that
(2)
In this case, the denition extends the one presented in Section 7.2.3.2.
700
i=1
(7.44)
(7.45)
i=1
Thus, all that we need to do on top of Section 7.3 is to provide a private m-party
computation of this functionality. This is done by privately reducing, for arbitrary m,
the computation of Eq. (7.44) (7.45) to the computation of the same functionality for
the case m = 2, which in turn coincides with Eq. (7.17) (7.18). But rst we need to
dene an appropriate notion of a reduction. Indeed, the new notion of a reduction is
merely a generalization of the notion presented in Section 7.3.1.
may send a special oracle-request message to all other parties. The oracle-request
message contains a sequence of k distinct parties, called the request sequence, that
are to supply queries in the current oracle call. In response, each party specied in the
request sequence writes a string, called its query, on its own write-only oracle-tape, and
responds to the requesting party with an oracle-call message. At this point, the oracle
is invoked and the result is that a string, not necessarily the same, is written by the
oracle on the read-only oracle-tape of each of the k specied parties. This k-sequence
of strings is called the oracle answer.
One may assume, without loss of generality, that the party who invokes the oracle is
the one who plays the role of the rst party in the reduction (i.e., the rst element in
the request sequence is always the identity of the party that requests the current oracle
call).
Denition 7.5.6 (multi-party privacy reductions):
computing g is derived by starting with g| f , and replacing each invocation of the
oracle by an execution of f . Clearly, computes g. We need to show that it privately
computes g (as per Denition 7.5.1).
We consider an arbitrary (non-trivial) set I [m] of semi-honest parties in the
execution of , where the trivial cases (i.e., I = and I = [m]) are treated (differently)
in a straightforward manner. Note that for k < m (unlike the situation in the twoparty case), the set I may induce different sets of semi-honest parties in the different
executions of f (replacing different invocations of the oracle). Still, our uniform
denition of simulation (i.e., uniform over all possible sets of semi-honest parties)
keeps us away from trouble. Specically, let S g| f and S f be the simulators guaranteed
for g| f and f , respectively. We construct a simulation S, for , in the natural
manner. On input (I, x I , f I (x)), we rst run S g| f (I, x I , f I (x)), and obtain the view
of the semi-honest coalition I = in g| f . This view includes the sequence of all
oracle-call requests made during the execution, which in turn consists of the sequence
of parties that supply query-parts in each such call. The view also contains the queryparts supplied by the parties in I , as well as the corresponding answer-parts. For each
such oracle call, we denote by J the subset of I that supplied query-parts in this
call and invoke S f , providing it with the subset J , as well as with the corresponding
J -parts of the queries and answers. Thus, we ll up the view of I in the current
execution of f . (Recall that S f can also handle the trivial cases in which either |J | = k
or |J | = 0.)
It is left to show that S indeed generates a distribution indistinguishable from the
view of semi-honest parties in actual executions of . As in the proof of Theorem 7.3.3,
this is done by introducing a hybrid distribution, denoted H . This hybrid distribution
represents the view of the parties in I (and output of all parties) in an execution of g| f
that is augmented by corresponding invocations of S f . In other words, H represents
the execution of , with the exception that the invocations of f are replaced by
simulated transcripts. Using the guarantees regarding S f (resp., S g| f ), we show that
the distributions corresponding to H and (resp., H and S) are computationally
indistinguishable. The theorem follows.
i
ci = (
ai ) (
bi )
We now turn to the m-ary functionality dened in Eq. (7.44) (7.45). Recall that the
arithmetic is that of GF(2), and so 1 = +1, and so forth. The key observation is that
m
m
m
ai
bi =
ai bi +
ai b j + a j bi
(7.46)
i=1
i=1
i=1
1i< jm
= (1 (m 1))
m
ai bi +
i=1
=m
m
i=1
ai bi +
1i< jm
703
(ai + a j ) (bi + b j )
1i< jm
(ai + a j ) (bi + b j )
(7.47)
where the last equality relies on the specics of GF(2). Now, looking at Eq. (7.47),
we observe that each party, i, can compute (by itself) the term m ai bi , whereas each
2-subset, {i, j}, can privately compute shares to the term (ai + a j ) (bi + b j ) by invoking the two-party functionality of Eq. (7.17) (7.18). This leads to the following
construction:
Construction 7.5.8 (privately reducing the m-party computation of Eq. (7.44) (7.45)
to the two-party computation of Eq. (7.17) (7.18)):
Inputs: Party i holds (ai , bi ) {0, 1} {0, 1}, for i = 1, ..., m.
Step 1 Reduction: Each pair of parties, (i, j), where i < j, invokes the 2-ary functionality of Eq. (7.17)(7.18). Party i provides the input pair, (ai , bi ), whereas Party j
{i, j}
provides (a j , b j ). Let us denote the oracle response to Party i by ci , and the re{i, j}
sponse to Party j by c j .
{i, j}
Step 2: Party i sets ci = mai bi + j=i ci .
Indeed, mai bi = 0 if m is even and mai bi = ai bi otherwise.
Outputs: Party i outputs ci .
We rst observe that this reduction is valid; that is, the output of all parties indeed sum
up to what they should. It is also easy to see that the reduction is private. That is,
Proposition 7.5.9: Construction 7.5.8 privately reduces the computation of the m-ary
functionality given by Eq. (7.44)(7.45) to the computation of the 2-ary functionality
given by Eq. (7.17)(7.18).
Proof Sketch: We construct a simulator, denoted S, for the view of the parties in the
oracle-aided protocol, denoted , of Construction 7.3.7. Given a set of semi-honest
parties, I = {i 1 , ..., i t } (with t < m), and a sequence of inputs (ai1 , bi1 ), ...., (ait , bit )
and outputs ci1 , ..., ci t , the simulator proceeds as follows:
{i, j}
1. For each pair, (i, j) I I where i < j, the simulator uniformly selects ci
{i, j}
{i, j}
{0, 1} and sets c j = ci + (ai + a j ) (bi + b j ).
def
2. Let I = [m] \ I , and let be the largest element in I. (Such an [m] exists since
|I | < m).
{i, j}
(a) For each i I and each j I \ {}, the simulator uniformly selects ci
{0, 1}.
{i, j}
(b) For each i I , the simulator sets ci{i,} = ci + mai bi + j{i,} ci , where the
{i, j}
latter ci
3. The simulator outputs all ci s generated here. That is, it outputs the sequence of
{i, j}
ci s corresponding to all i I and j [m] \ {i}.
We claim that the output of the simulator is distributed identically to the view of the
parties in I during the execution of the oracle-aided protocol. Furthermore, we claim
704
that for every such I , every x = ((a1 , b1 ), ..., (am , bm )), and every possible outcome
(c1 , ..., cm ) of the functionality f of Eq. (7.44)(7.45), it holds that the conditional
distribution of S(I, x I , f I (x)) is distributed identically to the conditional distribution
of view
I (x).
To prove this claim, we rst note that f (x) is uniformly distributed over the m
def
bit, long sequences that sum up to c = ( i ai ) ( i bi ). The same holds also for
the outputs of the parties in protocol , because the sequence of the outputs of Parties 1, ..., m 1 is uniformly distributed over {0, 1}m1 (due to the contribution of
{i,m}
ci
to the output of Party i), whereas the sum of all m outputs equals c. Turning to
the conditional distributions (i.e., conditioning on f (x) = (c1 , ..., cm ) = output (x)),
{i, j}
we show that the sequence of ci s (for i I ) is distributed identically in both distributions (i.e., in the execution view and in the simulation). Specically, in both cases,
{i, j}
the sequence (ci )iI, j[m]\{i} is uniformly distributed among the sequences satisfy
{i, j}
{i, j}
{i, j}
=
ing ci + c j = (ai + a j ) (bi + b j ) (for each i I and j = i) and j=i ci
ci + mai bi (for each i I ).
{i, j}
As in the two-party case, one can easily verify that the output of the protocol is indeed
correct. Specically, by using induction on the wires of the circuits, one can show that
the shares of each wire sum up to the correct value of the wire. Indeed, for m = 2, Construction 7.5.10 coincides with Construction 7.3.9. The privacy of Construction 7.5.10
is also shown by extending the analysis of the two-party case; that is, analogously to
Proposition 7.3.10, one can show that Construction 7.5.10 privately reduces the computation of a circuit to the multiplication-gate emulation.
Proposition 7.5.11: Construction 7.5.10 privately reduces the evaluation of arithmetic
circuits over GF(2), representing an m-ary deterministic functionality, to the functionality of Eq. (7.44) (7.45).
706
Proof Sketch: Just follow the proof of Proposition 7.3.10, treating the parties in I
analogously to the way that Party 1 is treated there. In treating the output wires of
parties in I (i.e., Step 3 in the simulation), note that the shares of parties in I and the
known output value uniquely determine the shares received in Step 3 of the protocol
only if |I | = m 1 (as was the case in the proof of Proposition 7.3.10). Otherwise (i.e.,
for |I | < m 1), the shares sent (in Step 3 of the protocol) by parties in I should be
selected uniformly among all sequences that (together with the shares of parties in I )
add up to the given output value.
m
ri , (x1 , ..., x m ))
f ((x 1 , r1 ), ..., (xm , rm )) = g(i=1
(7.48)
where g(r, x) denotes the value of g(x) when using coin-tosses r {0, 1}poly(|x|)
(i.e., g(x) is the randomized process consisting of uniformly selecting r
{0, 1}poly(|x|) , and deterministically computing g(r, x)). Combining this fact with Propositions 7.5.11, 7.5.9, and 7.3.8 (and using the transitivity of privacy reductions),
we obtain:
Theorem 7.5.12: Any m-ary functionality is privately reducible to OT41 .
Combining Theorem 7.5.12 and Proposition 7.3.6 with the Composition Theorem (Theorem 7.5.7), we conclude that if enhanced trapdoor permutations exist, then any m-ary
functionality is privately computable. As in the two-party case, we wish to highlight a
useful property of the protocols underlying the latter fact. Indeed, we refer to a notion
of canonical m-party computation that extends Denition 7.3.13.
Denition 7.5.13 (canonical semi-honest multi-party protocols): A protocol for
privately computing the m-ary functionality f is called canonical if it proceeds by
executing the following two stages:
Stage 1: The parties privately compute the functionality x ((r11 , ..., rm1 ), ...,
(r1m , ..., rmm )), where the r ij s are uniformly distributed among all possibilities that
m
m
r1i , ..., i=1
rmi ) = f (x).
satisfy (i=1
Stage 2: For i = 2, ..., m and j [m] \ {i}, Party i sends r ij to Party j. Next, Party 1
sends r 1j to Party j, for j = 2..., m. Finally, each party computes its own output; that
m
r ij .
is, for j = 1..., m, Party j outputs i=1
707
Indeed, the protocols underlying the proof of Theorem 7.5.12 are essentially
canonical.64 Hence,
Theorem 7.5.14: Suppose that there exist collections of enhanced trapdoor permutations. Then any functionality can be privately computable by a canonical protocol.
We comment that the said protocols happen to maintain their security even if the adversary can wire-tap all communication lines. This follows from the fact that privacy with
respect to wire-tapping adversaries happens to hold for all privacy reductions presented
in the current section, as well as for the protocols presented in Section 7.3.
This assertion depends on the exact implementation of Step 3 of Construction 7.5.10, and holds provided that
Party 1 is the last party to send its shares to all other parties.
65 That is, we assume that each party has generated a pair of keys for a signature scheme and has publicized its
verication-key (so that it is known to all other parties). This set-up assumption can be avoided if the network
is augmented with a broadcast channel.
708
Recall that our goal is to transform protocols that are secure in the semi-honest
point-to-point model into protocols that are secure in the two malicious broadcast
models. Starting with (semi-honestly secure) protocols that operate in the point-topoint communication model, we rst derive equivalent protocols for the broadcastchannel model, and only next we apply the two compilers, where each compiler takes
and produces protocols in the broadcast-channel model (which are secure with respect
to a corresponding type of adversaries). Thus, the full sequence of transformations
establishing Theorem 7.5.15 (based on Theorem 7.5.14) is as follows:
r We rst use the pre-compiler (of Section 7.5.3.1) to transform a protocol 0 that
privately computes a functionality f in the (private-channel) point-to-point model
into a protocol 0 that privately computes f in the broadcast model (where no private
point-to-point channels exist).
Note that, since we refer to semi-honest behavior, we do not gain by having a broadcast channel, and we may only lose by the elimination of the private point-to-point
channels (because this allows the adversary to obtain all messages sent). However,
the protocols presented in Section 7.5.2 happen to be secure in the semi-honest
broadcast model,66 and so this pre-compiler is actually not needed (provided we
start with these specic protocols, rather than with arbitrary semi-honestly secure
protocols).
r Using the rst compiler (of Section 7.5.4), we transform (which is secure in
0
the semi-honest model) into a protocol 1 that is secure in the rst malicious
model.
We stress that both 0 and 1 operate and are evaluated for security in a communication model consisting of a single broadcast channel. The same holds also for 2
mentioned next.
r Using the second compiler (of Section 7.5.5), we transform (which is secure in
1
the rst malicious model) into a protocol 2 that is secure in the second malicious
model.
r Finally, we use the post-compiler (of Section 7.5.3.2) to transform each of the protocols 1 and 2 , which are secure in the rst and second malicious models when
communication is via a broadcast channel, into corresponding protocols, 1 and 2 ,
for the standard point-to-point model. That is, 1 (resp., 2 ) securely computes f
in the rst (resp., second) malicious model in which communication is via standard
point-to-point channels.
We stress that security holds even if the adversary is allowed to wire-tap the (pointto-point) communication lines between honest parties.
We start by discussing the security denitions for the broadcast communication model
and by presenting the aforementioned pre-compiler and the post-compiler. Once this is
66
As noted at the very end of Section 7.5.2, these protocols also happen to be secure against semi-honest adversaries
that do wire-tape all communication channels. These protocols can be trivially converted to work in the broadcast
model by letting the honest parties ignore broadcast messages that are not intended for them. Indeed, in the
resulting protocol, the adversary receives all messages (including those intended for other parties), but it could
also obtain these messages in the original protocol by wire-tapping all point-to-point channels.
709
done, we turn to the real core of this section: the two compilers (which are applied to
protocols that operate in the broadcast model).
Denitions. Indeed, security in the broadcast model was not dened so far. However,
the three relevant denitions for the broadcast communication model are easily derived from the corresponding denitions given in Section 7.5.1, where a point-to-point
communication model was used. Specically, in dening security in the semi-honest
model, one merely includes the entire transcript of the communication over the (single)
broadcast channel in each partys view. Similarly, when dening security in the two
malicious models, one merely notes that the real execution model (i.e., real, I, A )
changes (since the protocol is now executed over a different communication media),
(1)
(2)
whereas the ideal model (i.e., ideal f, I, B or ideal f, I, B ) remains intact.
The analysis of the latter simulator combines the guarantee given for the point-topoint simulator and the guarantee that the encryption scheme is secure. That is, the
ability to distinguish the output of the broadcast-model simulator from the execution
view (in the broadcast model) yields either (1) the ability to distinguish the output of
the point-to-point simulator from the execution view (in the point-to-point model) or
(2) the ability to distinguish encryptions under the public-key encryption scheme being
used. In both cases we reach contradiction to our hypothesis.
Observe that when Party 1 follows the protocol with input v, at Phase 1 it sends a
(v, 1)-authentic message to each party. For every i 2, if (v, s p1 , ..., s pi ) is (v, i)authentic, then (v, s p1 , ..., s pi1 ) is (v, i 1)-authentic.
67
Such a signature scheme can be constructed given any one-way function. In particular, one may use Construction 6.4.30. Maintaining short signatures is important in this application, because we are going to iteratively
sign messages consisting of (the concatenation of an original message and) prior signatures.
711
Phase i = 2, ..., m: Each honest party (other than Party 1) inspects the messages it
has received at Phase i 1, and forwards signed versions of the (, i 1)-authentic
messages that it has received. Specically, for every v {0, 1}, if Party j has received
a (v, i 1)-authentic message (v, s p1 , ..., s pi1 ) such that all pk s are different from
j, then it appends its signature to the message and sends the resulting (v, i)-authentic
message to all parties.
We stress that for each value of v, Party j sends at most one (v, i)-authentic message
to all parties. Actually, it may refrain from sending (v, i)-authentic messages if it has
already sent (v, i )-authentic messages for some i < i.
Termination: Each honest party (other than Party 1) evaluates the situation as follows:
1. If, for some i 0 , i 1 [m] (which are not necessarily different), it has received both
a (0, i 0 )-authentic message and a (1, i 1 )-authentic message, then it decides that
Party 1 is malicious and outputs an error symbol, say .
2. If, for a single v {0, 1} and some i, it has received a (v, i)-authentic message,
then it outputs the value v.
3. If it has never received a (v, i)-authentic message, for any v {0, 1} and i, then
it decides that Party 1 is malicious and outputs an error symbol, say .
We comment that in the Distributed Computing literature, an alternative presentation
is preferred in which if a party detects cheating by Party 1 (i.e., in Cases 1 and 3),
then the party outputs a default value, say 0, rather than the error symbol .
The protocol can be easily adapted to handle non-binary input values. For the sake of
efciency, one may instruct honest parties to forward at most two authentic messages
that refer to different values (because this sufces to establish that Party 1 is malicious).
Proposition 7.5.18: Assuming that the signature scheme in use is unforgeable, Construction 7.5.17 satises the following two conditions:
1. It is infeasible to make any two honest parties output different values.
2. If Party 1 is honest, then it is infeasible to make any honest party output a value
different from the input of Party 1.
The claim holds regardless of the number of dishonest parties and even if dishonest
parties abort the execution.
In other words, Proposition 7.5.18 asserts that Construction 7.5.17 is essentially a
secure implementation of the (broadcast) functionality (v, , ..., ) (v, v, ..., v).
In particular, the case in which the honest parties output can be accounted for by
the abort of an ideal-model adversary playing Party 1. We note that security as used
here is incomparable to security in either of the two malicious models. On the one
hand, we do not provide security with respect to an external adversary that only taps
the communication lines while not controlling any of the parties. That is, we do not
provide secrecy with respect to an external adversary, and indeed, this feature is not
required by the post-compiler (presented in the proof of Proposition 7.5.19). On the
other hand, we do provide security in the (stronger) sense of the second malicious model
712
but do so without limiting the number of dishonest parties. That is, for any number of
dishonest parties, the protocol effectively prevents dishonest parties from aborting (because abort is treated as sending some illegal message). In particular, the case in which
Party 1 does not even enter the execution is treated as the case in which it sent illegal
messages.
Proof Sketch: Fixing any j and v, suppose that in Phase i 1, Party j receives a
(v, i 1)-authentic message, and assume that i is the smallest integer for which this
happens. For this event to happen, it must be that i m, because the message must
contain i 1 signatures from different parties (other than Party j itself).68 In such
a case, if Party j is honest, then it will send an authentic (v, i)-message in Phase i
(i m), and so all parties will receive an authentic (v, i)-message in Phase i. Thus, for
every v, if an honest party sees a (v, )-authentic message, then so do all other honest
parties, and Part 1 follows. Part 2 follows by observing that if Party 1 is honest and has
input v, then all honest parties see a (v, 1)-authentic message. Furthermore, none can
see a (v , i)-authentic message, for v = v and any i.
Proposition 7.5.19 (post-compiler): Suppose that one-way functions exist. Then any
m-ary functionality that is securely computable in the rst (resp., second) malicious
broadcast model is also securely computable in the rst (resp., second) malicious pointto-point model, provided that a public-key infrastructure exists in the network.
Proof Sketch: The idea is to replace any broadcast message sent in the original protocol
by an execution of the Authenticated Byzantine Agreement (AuthBA) protocol. This
idea needs to be carefully implemented because it is not clear that the security of
AuthBA is preserved under multiple executions, and thus applying Proposition 7.5.18
per se will not do. The problem is that the adversary may use authenticated messages
sent in one execution of the protocol in order to fool some parties in a different execution.
This attack can be avoided in the current context by using identiers (which can be
assigned consistently by the higher-level protocol) for each of the executions of the
AuthBA protocol. That is, authentic messages will be required to bear the distinct
identier of the corresponding AuthBA execution (and all signatures will be applied to
that identier as well). Thus, authentic messages of one AuthBA execution will not be
authentic in any other AuthBA execution. It follows that the proof of Proposition 7.5.18
can be extended to our context, where sequential executions of AuthBA (with externally
assigned distinct identiers) take place.
The proof of security transforms any real-model adversary for the point-to-point
protocol to a real-model adversary for the broadcast-channel protocol. In particular,
the latter determines the messages posted on the broadcast channel exactly as an honest party determines the values delivered by the various executions of AuthBA. In
the transformation, we assume that each instance of the AuthBA sub-protocol satises the conditions stated in Proposition 7.5.18 (i.e., it delivers the same value to all
68
Note that the said message cannot contain a signature of Party j due to the minimality of i: If the (v, i 1)authentic message had contained a signature of Party j, then for some i < i, Party j would have received a
(v, i 1)-authentic message in Phase i 1.
713
honest parties, and this value equals the one entered by the honest sender). In case the
assumption does not hold, we derive a forger for the underlying signature scheme.
oracle-aided protocol (i.e., Denition 7.5.5), but require such a protocol to be secure
in the rst malicious model (rather than be secure in the semi-honest model). As in the
two-party case, we require that the length of each oracle-query can be determined from
the length of the initial input to the oracle-aided protocol.
Denition 7.5.20 (Security Reductions in the First Malicious Model):
r As in Denition 7.5.6, an m-party oracle-aided protocol is said to be using the kparty oracle-functionality f if the oracle answers are according to f . However, in
accordance with the denition of the (rst) ideal model (for the invoked functionality),
the oracle does not answer all parties concurrently, but rather answers rst the realmodel party that requested this specic oracle call (in the oracle-aided protocol).
When receiving its part of the oracle answer, the party that requested the oracle call
instructs the oracle whether or not to respond to the other parties.
We consider only protocols in which the length of each oracle-query is a polynomialtime computable function of the length of the initial input to the protocol. Furthermore, the length of each query must be polynomially related to the length of the
initial input.
Theorem 7.5.21 (Composition Theorem for the rst multi-party malicious model):
Suppose that the m-ary functionality g is securely reducible to the k-ary functionality
f and that there exists a k-party protocol for securely computing f . Then there exists
an m-party protocol for securely computing g.
Recall that the syntax of oracle-aided protocols disallows concurrent oracle calls, and
thus Theorem 7.5.21 is actually a sequential composition theorem. As in the twoparty case, the Composition Theorem can be generalized to yield transitivity of secure
reductions and to account for reductions that use several oracles rather than one.
Proof Sketch: Analogously to the proof of previous composition theorems, we are given
an oracle-aided protocol, denoted g| f , that securely reduces g to f , and an ordinary
protocol f that securely computes f . Again, we construct a protocol for computing
g in the natural manner; that is, starting with g| f , we replace each invocation of the
oracle (i.e., of f ) by an execution of the protocol f . Clearly, computes g, and
we need to show that securely computes g. This is proven by merely generalizing
the proof of Theorem 7.4.3 (i.e., the two-party case). The only point that is worthwhile
stressing is that the real-model adversary for f , derived from the real-model adversary
for , is constructed obliviously of the set of parties I that the adversary controls.69 As
in the proof of Theorem 7.5.7, we determine the set of parties for every such invocation
of f , and rely on the fact that security holds with respect to adversaries controlling
any subset of the k parties participating in an execution of f . In particular, the security
of an invocation of f by parties P = { p1 , ..., pk } holds also in case I P = , where
it means that a real-model adversary (which controls no party in P) learns nothing by
merely tapping the broadcast channel.70
(7.49)
At rst glance, it seems that Eq. (7.49) is trivially implementable by Party 1 posting on
the broadcast channel. This solution is secure as long as the (real-model) adversary
controls a non-empty set of parties, but fails in case the adversary controls none of
the parties and yet can tap the broadcast channel. That is, the trivial solution does
not provide secrecy with respect to an external adversary (which taps the channel but
controls none of the parties and thus is not supposed to learn the value sent by Party 1 to
all other parties). Note that secrecy with respect to an external adversary also arises in a
subtle way when we do not care about it a priori (e.g., see the proof of Theorem 7.5.21).
Proposition 7.5.22: Assuming the existence of trapdoor permutations, there exists a
secure implementation of Eq. (7.49) in the rst malicious model.
69
70
Unlike in the two-party case, here we cannot afford to consider a designated adversary for each subset of parties.
Security holds also in the other extreme case, where I P = P, but it is not meaningful in that case.
716
Proof Sketch: The rst idea that comes to mind is to let each party generate a pair of
keys for a public-key encryption scheme and broadcast the encryption-key, and then let
Party 1 broadcast the encryption of its input under each of these encryption-keys. The
problem with this protocol is that it is no longer guaranteed that all parties receive the
same value. One solution is to let Party 1 provide zero-knowledge proofs (to each of
the parties) that the posted ciphertexts are consistent (i.e., encrypt the same value), but
the implementation of this solution is not straightforward (cf. Construction 7.5.24). An
alternative solution, adopted here, is to use the encryption scheme in order to emulate a
set of private (point-to-point) channels, as in Section 7.5.3.1, and run an authenticated
Byzantine Agreement on this network. Since we have an ordinary broadcast channel at
our disposal, we do not need to assume an initial set-up that corresponds to a public-key
infrastructure, but can rather generate it on the y. The resulting protocol is as follows:
1. Each party generates a pair of keys for a signature scheme and posts the vericationkey on the broadcast channel. This establishes the public-key infrastructure as relied
upon in Construction 7.5.17.
2. Each party generates a pair of keys for a public-key encryption scheme and posts
the encryption-key on the broadcast channel. This effectively establishes a network
of private (point-to-point) channels to be used in Step 3.
3. The parties invoke the authenticated Byzantine Agreement protocol of Construction 7.5.17 in order to let Party 1 broadcast its input to all other parties. All messages
of this protocol are sent in encrypted form, where each message is encrypted using
the encryption-key posted in Step 2 by the designated receiver.
Combining the ideas underlying the proofs of Propositions 7.5.16 and 7.5.18 (and considering two cases corresponding to whether I is empty or not), the current proposition
follows.
(7.50)
def
Indeed, an alternative multi-party generalization may require that all vi s equal f () if 2 = = m = h()
and equal (h(), f ()) otherwise. However, this alternative generalization seems harder to implement, whereas
Eq. (7.50) sufces for our application.
717
Note that the obvious reduction of Eq. (7.50) to the two-party case (i.e., to Eq. (7.33))
does not work (see Exercise 16). As in the two-party case, we will securely reduce
Eq. (7.50) to an adequate multi-party generalization of the image-transmission functionality and provide a secure implementation of the latter. We start by implementing the
adequate multi-party generalization of the image-transmission functionality, dened as
follows:
(, 1|| , ..., 1|| ) (, f (), ..., f ())
(7.51)
Indeed, Eq. (7.51) is essentially a special case of Eq. (7.50). We stress that in a secure
implementation of Eq. (7.51), either all parties obtain the same f -image or they all
obtain an indication that Party 1 has misbehaved. Thus, the honest parties must be in
agreement regarding whether or not Party 1 has misbehaved, which makes the generalization of the two-party protocol less obvious than it may seem. In particular, the fact
that we use a proof system of perfect completeness plays a central role in the analysis of
the multi-party protocol. The same holds with respect to the fact that all messages are
sent using (secret) broadcast (and so the honest parties agree on their value). Together,
these two facts imply that any party can determine whether some other party has justiably rejected some claim, and this ability enables the parties to reach agreement
regarding whether or not Party 1 has misbehaved.
def
Step C1: Party 1 secretly broadcasts v = f (). That is, Party 1 invokes Eq. (7.49) with
n
input v, whereas each other party enters the input 1| f (1 )| and receives the output v.
Step C2: For i = 2, ..., m, Parties 1 and i invoke a zero-knowledge strong-proof-ofknowledge system for R such that Party 1 plays the prover and Party i plays the
verier. The common input to the proof system is v, the prover gets as auxiliary
input, and its objective is to prove that it knows a w such that (v, w) R (i.e.,
v = f (w)). In case the verier rejects the proof, Party i sends the coins used by the
verier so that all other parties can be convinced of its justiable rejection, where the
latter corresponds to the view of the verier in a rejecting interaction. All messages
of the proof system are sent using the secret broadcast functionality.
Outputs: For i = 2, ..., m, if Party i sees some justiable rejection, then it outputs ;
otherwise it outputs v. (Party 1 has no output.)
Agreement on whether or not Party 1 has misbehaved is reduced to the decision whether
or not some verier has justiably rejected in Step C2, where of the latter decision
depends on information available to all parties. A key observation is that if Party 1
is honest, then no party can justiably reject its proof in Step C2, because the proof
system has perfect completeness (which means that there exists no random-tape that
makes the verier reject a claim by an honest prover). Note that Construction 7.5.24 is
718
actually an oracle-aided protocol, using the secret broadcast oracle. Consequently, if the
real-model adversary controls none of the parties, then it learns nothing (as opposed
to what might have happened if we were to use an ordinary broadcast in Steps C1
or C2).
Proposition 7.5.25: Suppose that the proof system, (P, V ), used in Step C2 is indeed a
zero-knowledge strong-proof-of-knowledge for the relation R. Then Construction 7.5.24
securely reduces Eq. (7.51) to Eq. (7.49).
Proof Sketch: The proof extends the two-party case treated in Proposition 7.4.12. Here,
we transform any real-model adversary A into a corresponding ideal-model adversary
B, where both get the set I as auxiliary input. The case I = is handled by relying
on the secret broadcast functionality (which implies that in this case, the real-model
adversary, which refers to an oracle-aided protocol in which all messages are sent using
Eq. (7.49), gets nothing). Otherwise, the operation of B depends on whether or not
1 I , which corresponds to the cases handled in the two-party case.
As in the two-party case, when transforming real-model adversaries to ideal-model
adversaries, we sometimes allow the latter to halt before invoking the trusted party.
This can be viewed as invoking the trusted party with a special abort symbol, where in
this case, the latter responds to all parties with a special abort symbol.
We start with the case where the rst party is honest, which means here that 1 I .
In this case, the input to B consists essentially of 1n , where n = ||, and it operates as
follows (assuming I = ):
1. Acting on behalf of each party in I , the ideal-model adversary B sends 1|| to
the trusted party and obtains the answer v, which equals f () for handed (to
the trusted party) by (the honest) Party 1. Thus, indeed, (v, ) R. (Recall that
Party 1 always obtains from the trusted party, but the other parties in I = [m] \ I
obtain v.)
2. For i = 2, ..., m, machine B invokes the simulator guaranteed for the zero-knowledge
proof system (P, V ), on input v, using (the residual) A as a possible malicious verier.
Note that we are simulating the actions of the prescribed prover P, which in the real
protocol is played by the honest Party 1. Once one simulation is nished, its transcript
becomes part of the history fed to A in subsequent simulations. Denote the obtained
sequence of simulation transcripts by S = S(v).
3. Finally, B feeds A with the alleged execution view (v, S) and outputs whatever A
does.
The computational indistinguishability of the output of the real-model adversary under
(A, I ) and the output of the ideal-model adversary under (B, I ) follows from the guaranteed quality of the zero-knowledge simulator. In addition, we need to consider the
outputs of the honest parties (i.e., the parties in I), and specically the outputs of parties
in I \ {1} (since Party 1 has no output). (Indeed, this is an issue only if I \ {1} = ,
which is the reason that this issue did not arise in the two-party case.) In the ideal-model
execution, each party in I \ {1} outputs v = f (), and we have to prove that the same
719
occurs in the real-model execution (when Party 1 is honest). This follows from the
perfect completeness of (P, V ), as discussed earlier.
We now turn to the case where the rst party is dishonest (i.e., 1 I ). In this
case, the input to B includes , and it operates as follows (ignoring the easy case
I = [m]):
1. B invokes A on input , and obtains the Step C1 message, denoted v, that A instructs
Party 1 to send (i.e., v = A()). As (implicit) in the protocol, any action of A in
Step C1 (including abort) is interpreted as sending a string.
2. B tries to obtain a pre-image of v under f . Toward this end, B uses the (strong)
knowledge-extractor associated with (P, V ). Specically, providing the strong
knowledge-extractor with oracle access to (the residual prover) A(), machine B
tries to extract (from A) a string w such that f (w) = v. This is done for each of the
| I| executions of the proof system in which the verier is played by an honest party,
while updating the history of A accordingly.72 In case the extractor succeeds (in one
def
def
of these | I| attempts), machine B sets = w. Otherwise, B sets = .
3. B now emulates an execution of Step C2. Specically, for each i I, machine B lets
the adequate residual A play the prover, and emulates by itself the (honest) verier
interacting with A (i.e., B behaves as a honest Party i). (The emulation of the proofs
given to parties in I is performed in the straightforward manner.) Next, B decides
whether or not to invoke the trusted party and let it respond to the honest parties.
This decision is based on all the m 1 emulated proofs.
If necessary (i.e., | I| = {2, ..., | I| + 1}), we also emulate the interleaved proofs that are given to parties in I .
This is performed in the straightforward manner (i.e., by letting A emulate both parties in the interaction).
720
Securely Reducing Authenticated Computation to Image Transmission. Analogously to the two-party case, we securely reduce Eq. (7.50) to Eq. (7.51).
Construction 7.5.26 (multi-party authenticated computation, oracle-aided protocol):
Inputs: Party 1 gets input {0, 1} , and Party i = 1 gets input i {0, 1}|| .
Step C1: Party 1 uses the (multi-party) image-transmission functionality to send the
def
pair (u, v) = (h(), f ()) to the other parties. That is, the parties invoke the functionality of Eq. (7.51), where Party 1 enters the input and Party i is to obtain
def
g() = (h(), f ()).
Step C2: Assuming that Step C1 was not aborted by Party 1 and that Party i receives
the pair (u, v) in Step C2, Party i outputs v if u = i and (u, v) otherwise.
Outputs: If not aborted (with output ), Party i = 1 sets its local output as directed in
Step C2. (Party 1 has no output.)
Extending the proof of Proposition 7.4.15 (to apply to Construction 7.5.26), and using
Propositions 7.5.25 and 7.5.22, we obtain:
Proposition 7.5.27: Assuming the existence of trapdoor permutations, the hauthenticated f -computation m-party functionality of Eq. (7.50) can be securely implemented in the rst malicious model.
Proof Sketch: We focus on the analysis of Construction 7.5.26, which extends the
proof of Proposition 7.4.15. As in the proof of Proposition 7.5.25, when extending
the proof of the two-party setting, the two cases (in the proof) correspond to whether
or not Party 1 is honest (resp., 1 I or 1 I ). Again, we discard the case I = ,
where here the justication is that the oracle-aided protocol does not use the broadcast
channel at all (and so no information is available to the real-model adversary in this
case). The case 1 I = is handled exactly as the case that Party 1 is honest in the
proof of Proposition 7.4.15 (i.e., B sends the i s it holds to the trusted party, obtains
h() (either explicitly or implicitly) and f (), where is the input of Party 1, and
uses (h(), f ()) to emulate the real execution). In case 1 I , we need to extend the
two-party treatment a little, because we also have to emulate the oracle answer given (in
Step C1) to dishonest parties (different from Party 1, which gets no answer). However,
this answer is determined by the query made in Step C1 by Party 1, and indeed, we
merely need to feed A with the corresponding oracle answer (h( ), f ( )). The rest of
the treatment is exactly as in the two-party case. The proposition follows.
Comment: Pure Oracle-Aided Protocols. Note that Construction 7.5.26 makes no
direct use of its communication channel, but is rather conned to the invocation of
oracles and local computations. Such an oracle-aided protocol is called pure. Note that
most oracle-aided protocols presented in Section 7.4 are pure. An important property
of pure oracle-aided protocols is that an adversary that controls none of the parties
and only wire-taps the communication channel gets no information, and so this case
721
can be discarded (as done in the proof of Proposition 7.5.27).73 In fact, Construction 7.5.24 is also a pure oracle-aided protocol (by virtue of its use of the secret broadcast
functionality).
(7.52)
where r is uniformly distributed in {0, 1}(n) . We securely reduce Eq. (7.52) to the multiparty authenticated-computation functionality. We note that the following construction
is different from the one used in the two-party case:
Construction 7.5.28 (an oracle-aided protocol for Eq. (7.52)): Let C be a commitment
scheme and C r1 ,...,r (1 , ..., ) = (Cr1 (1 ), ..., Cr ( )) be as in Construction 7.4.16.
def
Recall that in Section 7.4 we did not consider such external adversaries, and thus the notion of pure oracle-aided
protocols was neither discussed nor used.
722
m
For j = 1, ..., m, Party j sets r j = i=2
ri . Note that in case Party j did not halt,
j
m
m
ri = r 1 . Thus, i=1
ri1 =
it holds that ri = ri (for every i [m]), and so r j = i=2
r1 r 1 .
def
Party 1 sets r = r1 r 1 and uses the authenticated-computation functionality to send g(r ) to all parties. Specically, Party 1 enters Eq. (7.50) with input (r1 , s1 , r 1 ); each (other) Party j enters with input (c1 , r j ), where (c1 , r j )
def
is supposed to equal h (C4) (r1 , s1 , r 1 ) = (C s1 (r1 ), r 1 ), and is supposed to obtain
(C4)
1 def
1
f (r1 , s1 , r ) = g(r1 r ), which equals g(r ). In case Party 1 aborts or Party j obtains an answer of a different format, which happens if the inputs to the functionality
do not match, Party j halts with output (indicating that Party 1 misbehaved).
Outputs: Unless halted in Step C3 (with output ), Party 1 outputs r , and Party j = 1
outputs the value determined in Step C4, which is either g(r ) or .
In case m = 2, Construction 7.5.28 yields an alternative protocol for Eq. (7.34), that
is, a protocol that is fundamentally different from the one in Construction 7.4.16.
Proposition 7.5.29: Construction 7.5.28 securely reduces Eq. (7.52) to Eq. (7.50).
Proof Sketch:74 We transform any real-model adversary A (for the oracle-aided execution) into a corresponding ideal-model adversary B. The operation of B depends on
whether or not Party 1 is honest (i.e., 1 I), and we ignore the trivial cases of I =
and I = [m]. In case 1 I (i.e., Party 1 is honest), machine B proceeds as follows:
1. Machine B emulates the local actions of the honest parties in Step C1. In particular,
it uniformly selects (ri , si ) for each i I (including i = 1).
2. For every i I, machine B emulates the i-th sub-step of Step C2 by feeding A with
the corresponding ci = C si (ri ) (as if it were the answer of the i-th oracle call). For
every i I , machine B obtains the input (ri , si ) that A enters (on behalf of Party i)
to the i-th oracle call of Step C2, and feeds A with adequate emulations of the oracle
answers (to other parties in I ).
3. For every i I \ {1}, machine B emulates the i-th sub-step of Step C3 by feeding A
with a sequence in {ri , (ci , ri )}|I | that corresponds to whether or not each Party j I
has entered the input ci (dened in Step 2). For every i I , machine B obtains the
input (ri , si ) that A enters (on behalf of Party i) to the i-th oracle call of Step C3,
records whether or not C si (ri ) = C si (ri ), and feeds A with adequate emulations of
the oracle answers.
74
As in the proof of Proposition 7.5.25, we sometimes present ideal-model adversaries that halt before invoking
the trusted party. This can be viewed as invoking the trusted party with a special abort symbol.
723
For every i I, machine B sets ri1 = ri . For every i I , machine B sets ri1 = ri if
C si (ri ) = C si (ri ) and aborts otherwise (while outputting whatever A outputs [when
Party 1 halts in Step C3]). Note that for every i, this setting of ri1 agrees with the
setting of ri1 in the protocol. In particular, B aborts if and only if (the honest) Party 1
would have halted in the corresponding (emulated) execution of Step C3.75
4. In case B did not abort, it invokes the trusted party with input 1n and obtains the
answer g(r ), where r is the uniformly distributed -bit string handed to Party 1.
Next, machine B emulates Step C4 by feeding each dishonest party with either
def
m
ri1 . The choice is determined by whether
g(r ) or ((c1 , r 1 ), g(r )), where r 1 = i=2
or not (in Step C4) this party has entered the input (c1 , r 1 ). (Note that we cheat in
the emulation of the oracle answer in Step C4; specically, we use g(r ) rather than
g(r1 r 1 ).) Finally, machine B outputs whatever A does.
We stress that in this case (i.e., 1 I ), machine B may possibly abort only before
invoking the trusted party (which satises the security denition). Observe that the
only difference between the ideal-model execution, under B and the real-model execution under A is that in the ideal-model execution, an independently and uniformly
distributed r {0, 1} is used (in the emulation of Step C4), whereas in the real-model
m
execution, r (as used in Step C4) is set to i=1
ri1 = r1 r 1 . That is, in the ideal-model,
1
r1 is independent of r and r , whereas in the real-model, r1 = r r 1 , where g(r ) and
r 1 = r i (for every i) are known to the adversary (and r appears in the joint-view). Thus,
in addition to its possible affect on r (in the real model), the only (other) affect that r 1
has on the joint-view is that the latter contains c1 = C(r1 ). In other words, (the jointviews in) the real model and the ideal model differ only in whether c1 is a commitment
to r r 1 or to a uniformly and independently distributed string, where r and r 1 are
explicit in the joint-view. By the hiding property of C, this difference is undetectable.
We now turn to the case that 1 I (i.e., Party 1 is dishonest). The treatment of this
case differs in two main aspects. First, unlike in the previous case, here the real-model
adversary (which controls Party 1) obtains all ri s, and so we must guarantee that in the
m
ri . Second,
ideal-model execution, the trusted partys answer (to Party 1) equals i=1
unlike in the previous case, here the real-model adversary may effectively abort Step C4
(i.e., abort after obtaining the outcome), but this is easy to handle using the idealmodel adversarys ability to instruct the trusted party not to respond the honest parties.
Returning to the rst issue, we present a different way of emulating the real-model
execution.76 Specically, we will cheat in our emulation of the honest parties and use (in
Step 12) commitments to the value 0 , rather than commitments to the corresponding
ri s, which will be determined only at the end of Step 2. Details follow:
1. Machine B starts by invoking the trusted party and obtains a uniformly distributed
r {0, 1} . At this time, B does not decide whether or not to allow the trusted party
to answer the honest parties.
75
Indeed, in Step C3, Party 1 halts if and only if for some i, the input that Party 1 enters to the i-th sub-step (which
in turn equals the value ci = C si (ri ) that Party 1 has obtained in the i-th sub-step of Step C2) does not t the
input (ri , si ) that is entered by Party i (i.e., iff ci = C s (ri )).
i
76 We comment that the alternative emulation strategy can also be used in case Party 1 is honest.
724
In addition, B emulates the local actions of the honest parties in Step C1 by uniformly
selecting only the si s, for each i I.
2. For every i I, machine B emulates the i-th sub-step of Step C2 by feeding A with
ci = C si (0 ). For every i I , machine B obtains the input (ri , si ) that A enters (on
behalf of Party i) to the i-th oracle call of Step C2. Finally, B uniformly selects
m
all other ri s (i.e., for is in I) such that i=1
ri = r holds; for example, for each
m
ri ).
i I \ {1}, select ri {0, 1} uniformly, and set r1 = r (i=2
3. For every i I , machine B emulates the i-th sub-step of Step C3 by feeding A with
a sequence in {ri , (ci , ri )}|I | that corresponds to whether or not each Party j I has
entered the input ci . Note that the fact that ci is unlikely to be a commitment to ri is
irrelevant here. The rest of this step (i.e., the determination of the ri1 s) is as in the
case that Party 1 is honest. In particular, we let B halt if some Party i I behaves
improperly (i.e., invokes the corresponding oracle with input that does not t ci as
recorded in the emulation of Step C2).
The next step is performed only in case B did not abort. In this case, ri1 = ri holds
m
for every i = 2, ..., m, and r = r1 (i=2
ri1 ) follows.
4. Next, machine B emulates Step C4 and determines whether or not A instructs Party 1
to abort its oracle call (in Step C4). The decision is based on whether or not the oracle
query (q1 , q2 , q3 ) of Party 1 (in Step C4) matches the oracle query (ri , si ) it made
m
in Step C2 and the value of i=2
ri1 as determined in Step 3 (i.e., whether or not
m
C q2 (q1 ) = C si (ri ) and q3 = i=2ri1 ). If Party 1 aborts, then B prevents the trusted
party from answering the honest parties, and otherwise B allows the trusted party to
answer. (Indeed, in case the trusted party answers Party i = 1, the answer is g(r )). In
addition, B emulates the answers of the Step C4 oracle call to the dishonest parties
(as in the case that Party 1 is honest). Finally, machine B outputs whatever A does.
Observe that the only difference between of the ideal-model execution under B and the
real-model execution under A is that in the former, commitments to 0 (rather than to
the ri s, for i I) are delivered in Step C2. However, by the hiding property of C, this
difference is undetectable.
An Important Special Case. An important special case of Eq. (7.52) is the case that
g(r, s) = C s (r ), where |s| = n |r |. This special case will be called the augmented
(m-party) coin-tossing functionality. That is, for some xed commitment scheme, C,
and a positive polynomial , we consider the m-ary functionality:
(1n , ..., 1n ) ((r, s), C s (r ), ..., C s (r ))
(7.53)
where (r, s) is uniformly distributed in {0, 1}(n) {0, 1}(n)n . Combining Propositions 7.5.27 and 7.5.29, we get:
Proposition 7.5.30: Assuming the existence of trapdoor permutations, the augmented
coin-tossing functionality of Eq. (7.53) can be securely implemented in the rst malicious model.
725
(7.54)
where r is uniformly distributed in {0, 1}|x| . By combining a straightforward generalization of Construction 7.4.20 with Propositions 7.5.27 and 7.5.30, we get:
2
Proposition 7.5.31: Assuming the existence of trapdoor permutations, the inputcommitment functionality of Eq. (7.54) can be securely implemented in the rst malicious model.
Proof Sketch: Starting from Construction 7.4.20, we replace each oracle call to a twoparty functionality by a call to the corresponding multi-party functionality. That is, in
Step C2 Party 1 uses the image-transmission (or rather the authenticated-computation)
def
functionality to send c = C r (x) to all other parties, in Step C3 an augmented cointossing is used to provide Party 1 with a random pair (r, r ) whereas each other party gets
def
c = C r (r ), and in Step C4 Party 1 uses the authenticated-computation functionality
to send C r (x) to all other parties. Each of the other parties acts exactly as Party 2 acts
in Construction 7.4.20.
The security of the resulting multi-party oracle-aided protocol is established as in the
two-party case (treated in Proposition 7.4.21). As in the previous analysis of multi-party
protocols that generalize two-party ones, the two cases here are according to whether
or not Party 1 is honest (resp., 1 I or 1 I ). Finally, composing the oracle-aided
protocol with secure implementations of the adequate multi-party functionalities (as
provided by Propositions 7.5.27 and 7.5.30), the proposition follows.
compiler produces the following oracle-aided m-party protocol, denoted , for the
rst malicious model:
Inputs: Party i gets input x i {0, 1}n .
Input-Commitment Phase: Each of the parties commits to its input by using the inputcommitment functionality of Eq. (7.54). That is, for i = 1, ..., m, Party i invokes
Eq. (7.54), playing the role of the rst party with input x i , and obtains the output i ,
def
party obtains i = C i (r i ).
Protocol-Emulation Phase: The parties use the authenticated-computation functionality of Eq. (7.50) in order to emulate each step of protocol . The party that
is supposed to send (i.e., broadcast) a message plays the role of the rst party in
Eq. (7.50), and the other parties play the other roles. Suppose that the current message in is to be sent by Party j. Then the functions h, f and the inputs , 2 , ..., m ,
for the functionality of Eq. (7.50), are set as follows (analogously to their setting in
Construction 7.4.23):
Aborting: In case any of the functionalities invoked in any of the above phases terminates in an abort state, the parties obtaining this indication abort the execution and
set their output to . Otherwise, outputs are as follows.
Outputs: At the end of the emulation phase, each party holds the corresponding output
of the party in protocol . The party just locally outputs this value.
We note that both the compiler and the protocols produced by it are efcient, and that
their dependence on m is polynomially bounded.
semi-honest model can be emulated in the (rst) malicious ideal model of Denition 7.5.2. This part is analogous to Proposition 7.4.27, and its proof is analogous to
the proof presented in the two-party case.
Thus, given any m-ary functionality f , we rst (use Theorem 7.5.14 to) obtain a
canonical protocol that privately computes f . (Actually, we use the version of
that operates over a single broadcast channel, as provided by the pre-compiler [i.e.,
Proposition 7.5.16].) Combining the two parts, we conclude that when feeding to
the compiler of Construction 7.5.32, the result is an oracle-aided protocol such that
executions of in the (rst) malicious real model can be emulated in the ideal model
of Denition 7.5.2. Thus, securely computes f in the rst malicious model.
We are almost done, but there are two relatively minor issues to address. First,
is an oracle-aided protocol rather than an ordinary one. However, an ordinary protocol
that securely computes f can be derived by using secure implementations of the oracles
used by (as provided by Propositions 7.5.27, 7.5.30, and 7.5.31). Second, operates
in the broadcast-channel communication model, whereas we claimed a protocol in the
point-to-point communication model. This gap is bridged by using the post-compiler
(i.e., Proposition 7.5.19).
In our application, we feed the current compiler with a protocol generated by the rst compiler. Still, the randomtape and protocol actions mentioned here refer to the secure protocol compiled by the rst compiler, not to the
semi-honest protocol from which it was derived.
729
Intuitively, the malicious parties (which are in a strict minority) are effectively prevented from aborting the protocol by the following conventions:
r If a party aborts the execution prior to completion of the sharing phase, then the
honest parties (which are in the majority) will set its input and random-tape to
some default value and will carry out the execution (on its behalf).
r If a party aborts the execution after the completion of the sharing phase, then
the honest (majority) parties will reconstruct its input and random-tape and will
carry out the execution (on its behalf). The ability of the majority parties to
reconstruct the partys input and random-tape relies on the properties of VSS.
The fact that communication is conducted over a broadcast channel, as well as the
abovementioned conventions, guarantee that the (honest) majority parties will always
be in consensus as to which parties have aborted (and what messages were sent).
Protocol-emulation phase: The parties emulate the execution of the original protocol
with respect to the input and random-tapes shared in the rst phase. This will be done
using a secure (in the rst malicious model) implementation of the authenticatedcomputation functionality of Eq. (7.50).
We start by dening and implementing the only new tool needed; that is, Veriable
Secret Sharing.
pairs in [m] {0, 1} into a single bit, where [m] = {1, ..., m}.
The recovery condition: For any {0, 1}, any sequence (s1 , ..., sm ) in the range of
G m,t ( ), and any t-subset {i 1 , ..., i t } [m], it holds that
Rm,t ((i 1 , si1 ), ..., (i t , sit )) =
The secrecy condition: For any (t 1)-subset I [m], the distribution of the I components of G m,t ( ) is independent of . That is, for any I = {i 1 , ..., i t1 } [m],
let g I ( ) be dened to equal ((i1 , si1 ), ..., (i t1 , sit1 )), where (s1 , ..., sm ) G m,t ( ).
78
At this point, we place no computational requirements on G m,t and Rm,t . Typically, when m is treated as a
parameter, these algorithms will operate in time that is polynomial in m.
730
Then we require that for any such I , the random variables g I (0) and g I (1) are
identically distributed.
Indeed, an m-out-of-m secret-sharing scheme is implicit in the construction presented
in Section 7.5.2: To share a bit , one just generates m random bits that sum up to
(mod 2). Efcient t-out-of-m secret-sharing schemes do exist for any value of t m.
The most popular one, which uses low-degree polynomials over nite elds, is presented
next.
Construction 7.5.35 (Shamirs t-out-of-m secret-sharing scheme): Find the smallest
prime number, denoted p, that is bigger than m, and consider arithmetic over the nite
eld GF( p).79 The share-generating algorithm consists of uniformly selecting a degree
t 1 polynomial over GF( p) with free term equal to , and setting the i-th share
to be the value of this polynomial at i. The recovering algorithm consists of nding
(by interpolation) the unique degree t 1 polynomial that ts the given values and
outputting its free term.
Construction 7.5.35 is analyzed in Exercise 17. Getting back to our subject matter, we
derive the basic denition of veriable secret sharing.
Denition 7.5.36 (Veriable Secret Sharing, basic version): A veriable secret sharing (VSS) scheme with parameters (m, t) is an m-party protocol that implements
(i.e., securely computes in the rst malicious model) the share-generation functionality of some t-out-of-m secret-sharing scheme. That is, let G m,t be a sharegeneration algorithm of some t-out-of-m secret-sharing scheme. Then the corresponding share-generation functionality that the VSS securely computes (in the rst malicious
model) is
((, 1n ), 1n , ..., 1n ) G m,t ( )
(7.55)
By the Fundamental Theorem of Number Theory, p 2m. Thus, p can be found by merely (brute-force)
factoring all integers between m + 1 and 2m.
731
def
n-bit long strings; that is, G m,t (1 , ..., n ) = (s1 , ..., sm ), where si = si,1 si,n
and (s1, j , ..., sm, j ) G m,t ( j ) for every i = 1, ..., m and j = 1, ..., n. Suppose
that G m,t () ({0, 1}(||) )m , and let C be a commitment scheme and C be as
in Construction 7.5.28. Consider the corresponding (augmented) share-generation
functionality
(, 1|| , ..., 1|| ) ((s, ), (s2 , 2 , c), ..., (sm , m , c))
def
(7.56)
(7.57)
is uniformly distributed,
def
(7.58)
(7.59)
Then any m-party protocol that securely computes Eq. (7.56) (7.59) in the rst malicious model is called a veriable secret sharing (VSS) scheme with parameters
(m, t).
Observe that each party may demonstrate (to each other party) the validity of its
primary share (i.e., the si ) with respect to the globally held c, by revealing the
corresponding i . We shall be particularly interested in VSS schemes with parameters (m, m/2); that is, t = m/2. The reason for this focus is that we assume
throughout this section that the malicious parties are in strict minority. Thus, by the
secrecy requirement, setting t m/2 guarantees that the (less than m/2) dishonest
parties are not able to obtain any information about the secret from their shares. On
the other hand, by the recovery requirement, setting t m/2 guarantees that the
(more than m/2) honest parties are able to efciently recover the secret from their
shares. Thus, in the sequel, whenever we mention VSS without specifying the parameters, we mean the VSS with parameters (m, m/2), where m is understood from the
context.
Clearly, by Theorem 7.5.33, veriable secret sharing schemes exist, provided that
enhanced trapdoor permutations exist. Actually, to establish the existence of VSS, we
merely need to apply the rst compiler to the straightforward protocol that privately
computes Eq. (7.56) (7.59); see Exercise 10. For the sake of subsequent reference, we
state the latter result.
Proposition 7.5.38: Suppose that trapdoor permutations exist. Then for every t m,
there exists a veriable secret-sharing scheme with parameters (m, t).
Note that the assumption used in Proposition 7.5.38 is (merely) the one needed for the
operation of the rst compiler, which amounts to the assumption needed for implementing the functionalities used in Construction 7.5.32.
732
Construction 7.5.39 (The second multi-party compiler): Let t = m/2. Given an mparty protocol, , for the rst malicious model, the compiler produces the following
m-party protocol, denoted , for the second malicious model.
Inputs: Party i gets input x i {0, 1}n .
Random-Tape: Party i uniformly selects a random-tape, denoted r i {0, 1}c(n) , for
the emulation of .
The Sharing Phase: Each party shares its input and random-tape with all the parties,
using a Veriable Secret Sharing scheme. That is, for i = 1, ..., m, Party i invokes
the VSS scheme playing the rst party with input x i r i , while the other parties play
the roles of the other parties in Eq. (7.56) (7.59) with input 1n+c(n) .
Regarding the i-th VSS invocation,81 we denote the output that Party i obtains by (s i , i ), and the outputs that each other Party j obtains by (s ij , ij , ci ),
where s i = (s1i , ..., smi ) G m,t (x i r i ), i = (1i , ..., mi ) is uniformly distributed,
ci = (c1i , ..., cmi ), and cki = C ki (ski ). Note that either all honest parties get the correct
outcome or they all detect that Party i is cheating and set their outcome to .
Handling Abort: If Party i aborts the i-th VSS invocation, which means that all honest
parties received the outcome , then the honest parties set its input and random-tape
to some default value; that is, they set their record of the input and random-tape of
Party i (which are otherwise unknown to them) to some default value. Note that by
denition, the VSS scheme is secure in the rst malicious model, and thus all honest
parties agree on whether or not the VSS initiator (i.e., Party i) has aborted.82
80
For this reason, we cannot utilize a composition theorem for the second malicious model. We comment that such
a composition theorem would anyhow be more restricted than Theorem 7.5.21. One issue is that the second malicious model depends on a bound on the fraction of dishonest parties. Thus, if the m-party oracle-aided protocol invokes a k-ary functionality with k < m, then the bound (on the fraction of dishonest parties) may be violated in the
sub-protocol that replaces the latter. For this reason, when dealing with the second malicious model, one should
conne the treatment to m-party oracle-aided protocols that use m-ary (rather than k-ary) functionalities.
81 Indeed, this notation is slightly inconsistent with the one used in Denition 7.5.37. Here, Party i plays the rst
party in the VSS, and being consistent with Denition 7.5.37 would required calling its share s1i rather than sii .
Consequently, the share of Party j in this invocation would have been denoted si i ( j) , where i ( j) is the role that
Party j plays in this invocation. However, such notation would have made our exposition more cumbersome.
82 This is reected in the corresponding ideal-model adversary that either makes all honest parties detect abort
(i.e., output ) or allows all of them to obtain (and output) the corresponding entries in a valid m-sequence.
733
We stress that in case Party i aborts the i-th VSS invocation, its (default) input and
random-tape become known to all parties. Since the entire execution takes place
over a broadcast channel, each party can determine by itself what messages Party i
should send in a corresponding execution of . Thus, there is actually no need to
send actual messages on behalf of Party i.
Protocol-Emulation Phase: The parties emulate the execution of protocol with respect to the input and random-tapes shared in the rst phase. This will be done by
using a secure (in the rst malicious model) implementation of the authenticatedcomputation functionality of Eq. (7.50).
That is, Party i, which is supposed to send a message in , plays the role of the rst
party in Eq. (7.50), and the other parties play the other roles. The inputs , 2 , ..., m
and the functions h, f , for the functionality of Eq. (7.50), are set as follows:
We note that the completion of the sharing phase (and the denition of VSS) guarantee
that the majority parties hold shares that yield the input and random-tape of any party.
Furthermore, the correct shares are veriable by each of the other parties, and so
reconstruction of the initial secret is efciently implementable whenever a majority
of parties wishes to do so.
734
Outputs: At the end of the emulation phase, each party holds the corresponding output
of the party in protocol . The party just locally outputs this value.
Note that the VSS scheme is implicitly used as a commitment scheme for the value
of x i r i ; that is, ci = (c1i , ..., cmi ) serves as a commitment to the sequence of shares
(s1i , ..., smi ), which in turn determine x i r i . Actually, the main steps in the emulation
phase only refer to this aspect of the VSS, whereas only the abort-handling procedure
refers to the additional aspects (e.g., the fact that Party j holds the value of the share s ij
that is determined by the commitment cij , as well as the corresponding decommitment
information).
Comment. Applying the two (multi-party protocol) compilers one after the other is
indeed wasteful. For example, we enforce proper emulation (via the authenticatedcomputation functionality) twice: rst with respect to the semi-honest protocol, and
next with respect to the protocol resulting from the rst compiler. Indeed, more efcient protocols for the second malicious model could be derived by omitting the
authenticated-computation protocols generated by the rst compiler (and having the
second compiler refer to the actions of the semi-honest protocol). Similarly, one can
omit the input-commit phase in the rst compiler. In general, feeding the second compiler with protocols that are secure in the rst malicious model is an overkill; see further
discussion subsequent to Proposition 7.5.42.
This model is applicable both when the communication is via a single broadcast channel and when the communication is via point-to-point channels that can be wire-tapped by the adversary.
736
model (of Denition 7.5.4). Thus, Theorem 7.5.40 will follow. We start by establishing
Proposition 7.5.42:
Proof Sketch: Given a real-model adversary A (for ), we present a corresponding
adversary B that is admissible with respect to for the second augmented semi-honest
model. We stress two points. First, whereas A may abort some parties, the adversary B
may not do so (as per Denition 7.5.41). Second, we may assume that the number of
parties controlled by A (and thus by B) is less than m/2 (because nothing is required
otherwise).
Machine B will use A as well as the ideal-model adversaries derived (as per Definition 7.5.3) from the behavior of A in the various sub-protocols invoked by . We
stress that these ideal-model adversaries are of the rst malicious model. Furthermore,
machine B will also emulate the behavior of the trusted party in these ideal-model emulations (without communicating with any trusted party; there is no trusted party in the
augmented semi-honest model). Thus, the following description contains an implicit
special-purpose composition theorem (in which sub-protocols that are secure in the
rst malicious model are used to implement the oracles of an oracle-aided protocol that
is secure in the second malicious model):
Entering the execution and selecting a random-tape: B invokes A (on the very input
supplied to it) and decides with what input and random-tape to enter the execution
of . Toward this end, machine B emulates the execution of the sharing phase of
, using A (as subroutine). Machine B supplies A with the messages it expects to
see, thus emulating the honest parties in , and obtains the messages sent by the
parties in I (i.e., those controlled by A). We stress that this activity is internal to B
and involves no real interaction (of B in ).
Specically, B emulates the executions of the VSS protocol in an attempt to obtain
the values that the parties in I share with all parties. The emulation of each such
VSS-execution is done by using the ideal-model adversary derived from (the residual
real-model malicious adversary) A. We stress that in accordance with the denition
of VSS (i.e., security in the rst malicious model), the ideal-model adversary derived
from (the residual) A is in the rst malicious model and may abort some parties.
Note that (by Denitions 7.5.3 and 7.5.2) this may happen only if the initiator of
the VSS is dishonest. In case the execution initiated by some party aborts, its input
and random-tape are set to the default value (as in the corresponding abort-handling
procedure of ). Details follow:
737
party of the VSS is honest, this ideal-model adversary (i.e., A ) cannot abort any
party.
Invoking the ideal-model adversary A , and emulating both the honest (idealmodel) parties and the trusted party, machine B obtains the outputs of all parties
(i.e., and in particular, the output of the initiating party). That is, machine B emulates the sharing of value 0n+c(n) by the initiating party and emulates the response
of the trusted oracle (i.e., by setting s G m,t (0n+c(n) ), uniformly selecting of
adequate length, and computing the outputs as in Eq. (7.56) (7.59)).
r In an execution of VSS initiated by a party in I (i.e., a dishonest party plays the
role of the rst party in VSS), machine B obtains the corresponding input and
random-tape of the initiator, as well as the randomization used in the commitment
to it. As before, machine B uses the derived ideal-model adversary, denoted A ,
to emulate the execution of the VSS. Recall that A emulates the behavior of A in
the corresponding execution of the VSS.
Suppose that we are currently emulating the instance of VSS initiated by Party i,
where i I . Then B invokes A on input x i r i (i.e., the initial input and randomtape of Party i), and emulating both the honest (ideal-model) parties and the
trusted party, machine B obtains the outputs of all parties (including the VSSrandomization (i.e., (s i , i )) handed to Party i which is in I ). A key point is
that machine B has obtained, while emulating the trusted party, the input handed
by A to the trusted party. This value is recorded as the modied input and
random-tape of Party i .
In case the emulated machine did not abort the initiator (i.e., Party i), machine
B records the previous value, as well as the randomization used by B (as trusted
party) in the execution of VSS. Otherwise (i.e., A aborts Party i in the invocation
of VSS initiated by it), the input and random-tape of Party i are set to the default
value (as in ). In either case, B concatenates the emulation of the VSS to the
history of the execution of A.
Thus, inputs and random-tapes are determined for all parties in I , depending only
on their initial inputs. (All this is done before entering the actual execution of .)
Furthermore, the view of machine A in the sharing phase of has been emulated,
and the VSS-randomizations (i.e., the pairs (s i , i )) used in the sharing of all values
have been recorded by B. (Actually, it sufces to record the VSS-randomization
handed to dishonest parties and the commitments made on behalf of honest ones;
these will be used in the emulation of the message-transmission steps of ,
where the VSS-randomization will be used only in case the corresponding party
aborts.)
Subsequent steps message transmission: Machine B now enters the actual execution
of (with inputs and random-tapes for I -parties as determined earlier). It proceeds
in this real execution of , along with emulating the corresponding executions of
the authenticated computation of Eq. (7.50) (which are invoked in ).
In a message-transmission step by an honest party in , machine B obtains a message from this honest party (in the real execution of ) and emulates an execution
738
from this party (in the real execution of ) a message, denoted msg. This completes
all that is done in this step with respect to communication in .
Recall that = (ci , 2 ), where ci is the commitment produced by the VSS that was invoked by Party i, which
is assumed to be the sender in the current message-transmission step, and 2 equals the sequence of messages
sent so far in the emulated execution of .
739
Note that this emulation (of the corresponding authenticated-computation subprotocol of ) either produces the very same message msg (or a pair (, msg)
as above) or aborts the sender. In the latter case, we emulate the abort-handling
procedure of , by using the corresponding VSS-randomization (as recorded
in the sharing phase of ). In both cases, B concatenates the emulation of the
authenticated-computation protocol (and possibly also the abort-handling procedure) to the history of the execution of A.
Note that each message-transmission step is implemented in polynomial-time, and
each message posted is computed exactly as instructed by . (We stress again that
the emulation of an aborting event in does not result in aborting the execution of
any party in .)
Output: Machine B just outputs whatever machine A outputs given the execution history
composed (or actually emulated) as in the previous steps.
Clearly, machine B (described here) implements a second-augmented semi-honest behavior with respect to . It is left to show that
c
(7.60)
There are two differences between the two ensembles referred to in Eq. (7.60):
1. In the rst distribution (i.e., real ,(A, I ) (x)), secure (in the rst malicious model)
protocols implementing VSS and authenticated computation (of Eq. (7.56) (7.59)
and Eq. (7.50), respectively) are executed; whereas in the second distribution (i.e.,
real,(B, I ) (x)), these executions are emulated using the corresponding ideal-model
adversaries.
2. The emulation of Eq. (7.50) in real,(B, I ) (x) is performed with a potentially wrong
input, specically, with commitments to dummy values, rather than to the correct
values.
However, these differences are computationally undetectable.
740
Proof of Theorem 7.5.40: Given an m-ary functionality f , let be an m-party protocol, as guaranteed by Theorem 7.5.33, for securely computing f in the rst malicious
model. (Actually, we merely need a protocol operating in the broadcast channel [rather
than point-to-point] communication model.) We now apply the compiler of Construction 7.5.39 to and derive a protocol . By Proposition 7.5.42, for any efcient
real-model adversary A (for ), there exists an efcient admissible behavior (with
respect to ) in the second-augmented semi-honest model, denoted B, such that for
every I [m] with |I | < m/2
c
(7.61)
One key observation is that B constitutes a benign form of a real-model adversarial behavior with respect to (which is certainly allowed by the rst malicious
model). Specically, the malicious behavior of B amounts to replacing inputs and
random-tapes arbitrarily, and executing with these replaced values and without
aborting any party. Thus, by the security of (in the rst malicious model), the
real-model adversary B can be emulated by an ideal-model adversary C that operates in the rst ideal model (and so may potentially abort parties). However, since
B does not abort parties, then neither does C (except with negligible probability). It follows that C is essentially an admissible ideal-model adversary for the
second malicious party, or, more accurately, C behaves in a way that is statistically close to a second ideal-model adversary C (which behaves as C except that
it never aborts). Combining Eq. (7.61) with the latter observations, we obtain (for
every |I | < m/2)
c
(1)
(2)
7.6.1. Denitions
We consider both the semi-honest and the malicious models, where in both cases
we refer to explicit bounds on the number of dishonest parties. Furthermore, in both
cases, we consider a communication network consisting of point-to-point channels
that cannot be wire-taped by the adversary. Finally, in both models, we require the
relevant probability ensembles to be statistically indistinguishable, rather than (only)
computationally indistinguishable.
Security in the Semi-Honest Model. The following denition is derived from Denition 7.5.1 by restricting the number of dishonest parties and strengthening the indistinguishability requirement.
Denition 7.6.1 (t-privacy of m-party protocols): Let f be an m-ary functionality, and
be an m-party protocol for computing f . As in Denition 7.5.1, we denote the jointview of the parties in I [m] by view
I (x), and the corresponding output sequence
of all parties by output (x). We say that t-privately computes f if there exists
a probabilistic polynomial-time algorithm, denoted S, such that for every I [m] of
cardinality at most t, it holds that
{(S(I, x I , f I (x)) , f (x))}x({0,1} )m
s
{(view
I (x) , output (x))}x({0,1} )m
(7.62)
where x I and f I denote projections of the corresponding m-ary sequence on the coordinates in I . In case the ensembles in Eq. (7.62) are identically distributed, we say that
the emulation is perfect.
We stress that Eq. (7.62) requires statistical indistinguishability, whereas the analogue requirement in Denition 7.5.1 is of computational indistinguishability. As in
742
Denition 7.5.1, the view of parties in I does not include messages sent among parties
def
in I = [m] \ I .
Security in the Malicious Model. Analogously, the following denition is derived
from Denition 7.5.4 by restricting the number of dishonest parties, disallowing wiretapping, and strengthening the indistinguishability requirement. Recall that Denition 7.5.4 refers to security in the second malicious model, which is reected in the
choice of the ideal model. We further strengthen the denition by allowing computationally unbounded real-model adversaries, and by requiring the corresponding ideal-model
adversaries to be of comparable complexity (i.e., have polynomially related running
time). Specically, we say that algorithm B has comparable complexity to algorithm A
if there exists a polynomial p such that for every y, it holds that time B (y) p(time A (y)),
where time A (y) (resp., time B (y)) denotes the number of steps taken by A (resp., B) on
input y.
(2)
Denition 7.6.2 (t-security of m-party protocols): Let f , , and ideal f, I, B(z) (x) be
exactly as in Denition 7.5.4. The real-model adversary is dened as in Denitions 7.5.3
and 7.5.4, except that here, the real-model adversary A does not see messages sent
among honest parties (i.e., parties in I). We say that t-securely computes f if
for every probabilistic algorithm A (representing a real-model adversary strategy),
there exists a probabilistic algorithm of comparable complexity B (representing an
ideal-model adversary strategy), such that for every I [m] of cardinality at most t,
it holds that
(2)
(7.63)
In case the ensembles in Eq. (7.63) are identically distributed, we say that the emulation
is perfect.
We stress that Eq. (7.63) requires statistical indistinguishability, whereas the analogue
requirement in Denition 7.5.4 is of computational indistinguishability. More importantly, we make no computational restrictions regarding the real-model adversary, and
require the corresponding ideal-model adversary to be of comparable complexity. The
latter requirement is very important: It prevents obviously bad protocols (see Exercise 18), and it guarantees that Denition 7.6.2 is actually a strengthening of Denition 7.5.4 (see Exercise 19).
Here and in the following, when we say a degree d polynomial, we actually mean a polynomial of degree at
most d.
744
i=1
m
i
.)
m
3. For every j, Party j (locally) computes d j i=1
i qi ( j), where 1 , ..., m are
the extrapolation constants satisfying Eq. (7.64), and qi ( j) is the share that Party j
received from Party i in Step 2.
Output: Party i exits with output di .
It is quite clear that Construction 7.6.3 yields no information about u and v to any
coalition of t (or fewer) parties. The reason is that the only new information obtained
by t parties (i.e., t shares of each of the other ci s) yields no information about the
polynomials a and b (because it yields no information about these ci s). It is also clear
that every sequence of t of the di s is uniformly distributed (because the values of the
qi s at any t points are uniformly distributed). What is less clear is that the di s are indeed
admissible shares of the desired value (i.e., di = d(i) for some degree t polynomial d
having free term u v). This fact will be established next.
Fact 7.6.4: Let the di s be dened as in Construction 7.6.3, and t < m/2. Then there
exists a degree t polynomial, d, such that d(0) = a(0) b(0) and d(i) = di for i =
1, ..., m.
def m
i qi (z), where the qi s are the
Proof: Consider the formal polynomial q(z) = i=1
polynomials selected at Step 2. Since each qi
has degree t, this holds also for q. For
m
i qi ( j) = q( j), where the second
every j = 1, ..., m, by Step 3, we have d j = i=1
equality is due to the denition of q. Finally, note that
q(0) =
m
i qi (0)
i=1
m
i ci
i=1
m
i a(i) b(i)
i=1
= a(0) b(0)
where the second equality is by Step 2, the third equality is by Step 1, and the last
equality is by the Extrapolation Theorem (applied to the 2t m 1 degree polynomial
a(z) b(z)).
745
Conclusion. Using Fact 7.6.4, for t < m/2, one can show (see Exercise 23)
that Construction 7.6.3 constitutes a t-private computation of the (partial) m-ary
functionality
((a(1), b(1)), ..., (a(m), b(m))) (r (1), ..., r (m))
(7.65)
(7.66)
where c is a degree 2t polynomial and r is a uniformly distributed degree t polynomial with free term equal to c(0). We wish to t-securely compute Eq. (7.66). Let us
rst consider the related task of t-securely computing c(0). Construction 7.5.10 suggests that c(0) can be computed by extrapolation of the c(i)s, and that extrapolation
is a linear function, which (as such) can be t-privately computed (see Exercise 20).
However, when some parties are malicious, simple extrapolation will fail. What we
need is a robust extrapolation procedure, which corresponds to error correction
of Reed-Solomon codes, which in turn is a linear function of the given sequence.
746
7.7 MISCELLANEOUS
Specically, this task is to nd the free term of the unique degree 2t polynomial (i.e.,
c) that ts at least m t of the inputs (i.e., the correct c(i)s), and we can perform
this task in a t-secure manner. (The desired polynomial is indeed unique, because
otherwise we get two different degree 2t polynomials that agree on m 2t 2t + 1
of the inputs.) Finally, observe that the parties can t-securely generate shares of a
random degree t polynomial with free term equal to zero. Combining the two linear
computations, one obtains the desired t-secure implementation of Eq. (7.66), provided
that t < m/4.
In order to handle the case m/4 t < m/3, we have to work directly with Eq. (7.65),
rather than with Eq. (7.66); that is, we use the fact that the parties actually hold the
shares of two degree t polynomials, rather than only the product of these shares (which
corresponds to shares of a degree 2t polynomial).
7.7. Miscellaneous
7.7.1.* Three Deferred Issues
In this section, we briey discuss three important issues that were avoided (for the sake
of simplicity) in previous sections.
a functionality f , which without loss of generality satises | f 1 (x, y)| = | f 2 (x, y)|,
we may proceed in two stages:
1. The parties securely compute shares of the desired outputs of f . Specically, the
parties securely compute the functionality
(x, y) ((v1 s1 , s2 , r1 , c) , (s1 , v2 s2 , r2 , c))
where (v1 , v2 ) f (x, y), the si s are uniformly distributed in {0, 1}|vi | , and
2
c C r1 r2 (v1 , v2 ), for uniformly distributed r1 , r2 {0, 1}|v1 ,v2 | . Note that at this
stage, each individual party obtains no knowledge of the desired outputs, but together they hold (veriable) secrets (i.e., the vi si s and si s) that yield both
outputs.
2. The parties gradually exchange the secrets that they hold. That is, Party 1 reveals pieces of s2 in exchange for pieces of s1 (revealed by Party 2), where one
piece of s2 is revealed per one piece of s1 . The pieces are revealed by using
a secure computation of an adequate functionality. Suppose that Party i is supposed to obtain the piece i (si ), where i may be a (predetermined) Boolean
function or a randomized process. Then the parties securely compute the functionality that maps ((a1 , a2 , 1 , 1 ) , (b1 , b2 , 2 , 2 )) to (1 (b1 ), 2 (a2 )) if 1 =
2 = C 1 2 (a1 b1 , a2 b2 ) and to (, ) otherwise. Indeed, each party enters this secure computation with the input it has received in the rst stage;
that is, Party 1 (resp., Party 2) enters with input (v1 s1 , s2 , r1 , c) (resp.,
(s1 , v2 s2 , r2 , c)).
The entire approach (and, in particular, the gradual exchange of secrets) depends
on a satisfactory denition of a piece of a secret. Such a denition should satisfy
two properties: (1) Given sufciently many pieces of a secret, one should be able to
recover the secret, whereas (2) getting yet another piece of the secret contributes little
to the knowledge of the secret. We admit that we do not know of a denition (of a
piece of a secret) that is uncontroversially satisfactory; still, some suggestions (for
what these pieces of information may be) seem quite appealing. For example, consider
the randomized process that maps the n-bit long secret 1 n to the n-bit long
string 1 n , such that i = i with probability 12 + and i = 1 i otherwise, for
every i, independently.87 Then each piece carries O(n 2 ) bits of information, whereas
after seeing t such pieces of the secret, one can guess it with success probability at
least 1 n exp(t 2 ), which for t = O(n/ 2 ) means practically obtaining the secret.
However, if Party 1 knows that s1 {0n , 1n }, whereas Party 2 only knows that s2
{0, 1}n , then (s1 ) seems more meaningful to Party 1 than (s2 ) is to Party 2. Is it really
so or is the proposed exchange actually fair? Note that things are even more complex
(than they seem), because the uncertainty of the parties is actually not informationtheoretic but rather computational.
87
An alternative randomized process maps the n-bit string s to the random pair (r, b), such that r is uniformly
distributed in {0, 1}n and b {0, 1} equals the inner product (mod 2) of s and r with probability 12 + (and the
complementary value otherwise). In this case, each piece carries O( 2 ) bits of information about s, whereas
after seeing O(n/2 ) such pieces, one practically obtains s.
748
7.7 MISCELLANEOUS
The issue of adaptivity also arises, but in a more subtle way, in the case of two-party protocols.
The non-adaptive model can be viewed as a special case in which the adversary selects the parties that it controls
up-front, before learning any information regarding the current execution. But in general (in the adaptive model),
only the choice of the rst controlled party is oblivious of the execution.
749
t + 1 steps, which are partitioned into two main phases. In each step of the rst
phase, based on the information available to it, the adversary decides whether to
seize control of another party or to move to the second phase. In the rst case,
the adversary also determines the identity of the new party to be controlled and
obtains its local input. In the second case, the adversary invokes the trusted party
and supplies the trusted party with inputs of its choice corresponding to the parties
that it currently controls. At this point, the other parties supply the trusted party with
their original inputs, and the trusted party determines the corresponding outputs
and provides each party with its corresponding output, where the adversary receives
all the outputs of parties that it controls.90
In each step of the second phase, based on the information available to it, the
adversary decides whether or not to seize control of another party and if so also
determines its identity. Consequently, the adversary receives the local input and
output of this party. The joint computation in the ideal model, under an adaptive
adversary, is dened as the concatenation of the outputs of the uncontrolled parties,
the adversarys output, and the sequence of the parties on which the adversary gained
control.
A t-adaptive real-model adversary is a randomized strategy that corresponds to
an attack on the actual execution of the protocol. Such an adversary may adaptively
select up to t parties it wishes to control, obtain their current view of the execution
(as per Denition 7.2.1), and determine their actions. The adversary may select some
parties before the actual execution starts, some parties during the actual execution,
and some after it has terminated, as long as the total number of selected parties
is at most t. The joint computation in the real model, under an adaptive adversary, is dened as the concatenation of the outputs of the uncontrolled parties, the
adversarys output, and the sequence of the parties on which the adversary gained
control.
Protocol for computing f is called t-adaptively secure if for every feasible t-adaptive real-model adversary A, there exists a feasible t-adaptive idealmodel adversary B, such that the joint computation in the real model under A
is computationally indistinguishable from the joint computation in the ideal model
under B.
We stress that in the real model, when the adversary seizes control of a party, it gets
the partys view of the execution so far (where the partys view is as dened in Denition 7.2.1). In particular, the protocols possible instructions to erase certain data does
not affect the partys view, which always contains its input, its random-tape, and all
messages it has received so far. A weaker notion of security postulates that when the
adversary seizes control of a party, it only gets the current values of the partys local
variables as determined by the protocol (in which case, the adversary does not obtain
90
As in Denition 7.5.4 (and unlike in Denition 7.5.2), the trusted party always answers all parties; that is, the
adversary has no option of preventing the trusted party from answering the honest parties. Recall that here the
trusted party is invoked (by the adversary) at the time the adversary decides that it controls enough parties.
750
7.7 MISCELLANEOUS
data that was explicitly erased by an instruction of the protocol). Our denitional choice
is motivated by the fear that the past values of the partys local variables (i.e., the partys
view as per Denition 7.2.1) may be available somewhere on its computing system; see
analogous discussion in Section 7.2.2 (regarding the semi-honest model).
Theorem 7.7.2 (main results regarding adaptively secure protocols):
1. In the private channel model, any m-ary functionality can be computed in a
(m 1)/3 -adaptively secure manner. Furthermore, as in Theorem 7.6.6, the emulation is perfect.
2. Assuming the intractability of inverting RSA (or of the DLP), any m-ary functionality can be computed in a (m 1)/3 -adaptively secure manner, even when the
adversary can tap all communication lines.
Part 1 follows by extending the proof of Theorem 7.6.6, that is, by observing that the
protocols used toward proving the latter result are in fact adaptively secure. Proving
Part 2 is more problematic. In particular, a straightforward application of the precompiler described in Section 7.5.3.1 seems to fail. The source of trouble is that standard
encryption schemes, which may be used to emulate private (point-to-point) channels
over ordinary (point-to-point) channels, effectively commit to the single value that
was sent (which is a problem because of messages sent between honest parties that
are later corrupted by the adversary). Intuitively, the solution is to use non-standard
encryption schemes (i.e., non-committing ones). The latter can be constructed using
trapdoor permutations with certain additional properties.
r Parties are given inputs for the current iteration; that is, in the j-th iteration Party i is
( j)
given input xi . In addition, there is a global state: The global state at the beginning of
the j-th iteration is denoted s ( j) , where the initial global state is empty (i.e., s (1) = ).
r Depending on the current inputs and the global state, the parties are supposed to
compute outputs for the current iteration, as well as update the global state. That is,
91
As usual, the number of iterations (and the length of the inputs) must be polynomial in the security parameter.
Furthermore, the length of the global state (at any time) must also be polynomial in the security parameter.
751
the outputs in iteration j are determined by the xi s, for all is, and s ( j) . The new
( j)
global state, s ( j+1) , is determined similarly (i.e., also based on xi s and s ( j) ).
As it is an abstraction, one may think of the global state as being held by a trusted
party. In other words, reactive systems are captured by reactive functionalities in
which the trusted party maintains a state and interacts with the actual parties in iterations. Indeed, in each iteration, the trusted party obtains an input from each party,
responds (as directed by the reactive functionality) with corresponding outputs, depending also on its state, and updates its state. Note that the latter formulation ts
a denition of an ideal model (for computing the reactive functionality), whereas a
(real-model) reactive protocol must emulate this augmented notion of a trusted party.
Thus, the reactive protocol should emulate the iterative computation of outputs while
maintaining the state of the imaginary trusted party. Indeed, it is natural to have the
real-model parties use a secret-sharing scheme in order to maintain the latter state
(such that the state remains unknown to individual parties and even to a bounded number of dishonest parties). In fact, we need to use a veriable secret-sharing scheme (see
Section 7.5.5.1), because dishonest parties should be prevented from (illegally) modifying the (systems) state (except from the predetermined effect of the choice of their
own inputs).
This discussion suggests that the secure implementation of reactive functionalities
can be reduced to the secure implementation of ordinary (i.e., non-reactive) functionalities. For example, we refer to security in the second malicious model, as dened
in Denition 7.5.4 (for ordinary functionalities). That is, we postulate that a majority of the parties are honest and require that the dishonest parties cannot (effectively)
abort the execution. In such a case, we use a veriable secret-sharing scheme in which
only a majority of the pieces yield the secret. Once a veriable secret-sharing scheme
is xed and the (systems) state is shared using it, the computation of each iteration
of the reactive system can be cast as an ordinary functionality. The latter maps sequences of the form ((x1 , s1 ), ..., (xm , sm )), where xi denotes the current input of Party i
and si denotes its share of the current state, to the sequence ((y1 , r1 ), ..., (ym , rm )),
where yi denotes the next output of Party i and ri denotes its share of the updated
state.
We conclude that the results regarding secure computation of ordinary (i.e., nonreactive) computations can be extended to reactive systems (thus obtaining secure
implementations of the latter).
7.7 MISCELLANEOUS
7.7.2.1. Denitions
One may say that a protocol is concurrently secure if whatever the adversary may obtain by invoking and controlling parties in real concurrent executions of the protocol is
also obtainable by a corresponding adversary that controls corresponding parties making concurrent functionality calls to a trusted party (in a corresponding ideal model).
More generally, one may consider concurrent executions of many sessions of several
protocols, and say that a set of protocols is concurrently secure if whatever the adversary may obtain by invoking and controlling such real concurrent executions is also
obtainable by a corresponding adversary that invokes and controls concurrent calls to
a trusted party (in a corresponding ideal model). Consequently, a protocol is said to be
secure with respect to concurrent compositions if adding this protocol to any set of
concurrently secure protocols yields a set of concurrently secure protocols.
A much more appealing approach has been recently suggested by Canetti [51].
Loosely speaking, he suggests considering a protocol to be secure (hereafter referred
to as environmentally secure)92 only if it remains secure when executed within any
(feasible) environment. The notion of an environment is a generalization of the notion
of an auxiliary-input; in a sense, the environment is an auxiliary oracle (or rather a
state-dependent oracle) that the adversary may access. In particular, the environment
may represent other executions of various protocols that are taking place concurrently
(to the execution that we consider). We stress that the environment is not supposed to
assist the proper execution of the protocol (and, in fact, honest parties merely obtain
their inputs from it and return their outputs to it). In contrast, potentially, the environment may assist the adversary in attacking the execution. Following the simulation
paradigm, we say that a protocol is environmentally secure if any feasible real-model
adversary attacking the protocol, with the assistance of any feasible environment, can
be emulated by a corresponding ideal-model adversary that uses the same environment,
while making similar queries to the environment. In the following formulation, the environment is implemented by a (non-uniform) family of polynomial-size circuits, and
is also responsible for providing the parties with inputs and for trying to distinguish the
real-model execution from the ideal-model execution.
Denition 7.7.3 (Environmentally Secure Protocols, a rough sketch): Let f be an mary functionality and be an m-party protocol, and consider the following real and
ideal models:
The term used in [51] is Universally Composable, but we believe that a reasonable sense of universal composability is only a corollary of the suggested denition.
753
7.7.2.2. Constructions
The main positive result currently known is that environmentally secure protocols
for any functionality can be constructed for settings in which more than two-thirds
of the active parties are honest (cf. [51]). This holds unconditionally for the privatechannel model and under standard assumptions (e.g., allowing the construction of
public-key encryption schemes) for the standard model (i.e., without private channel).
93
Thus, the denition should actually specify an additional parameter bounding the number of parties that may
be controlled by the adversary.
754
7.7 MISCELLANEOUS
The immediate consequence of this result is that general environmentally secure multiparty computation is possible, provided that more than two-thirds of the parties are
honest.
In contrast, general environmentally secure two-party computation is not possible
(in the standard sense).94 Still, one can salvage general environmentally secure twoparty computation in the following reasonable model: Consider a network that contains
servers that are willing to participate (as helpers, possibly for a payment) in computations initiated by a set of (two or more) users. Now, suppose that two users wishing to
conduct a secure computation can agree on a set of servers such that each user believes
that more than two-thirds of the servers (in this set) are honest. Then, with the active
participation of this set of servers, the two users can compute any functionality in an
environmentally secure manner.
Another reasonable model where general environmentally secure two-party computation is possible is the shared random-string model [59]. In this model, all parties
have access to a universal random string (of length related to the security parameter).
We stress that the entity trusted to post this universal random string is not required to
take part in any execution of any protocol, and that all executions of all protocols may
use the same universal random string.
Of course, some specic two-party computations do have environmentally secure protocols. See [51] for several
important examples (e.g., key exchange).
755
chapters. In contrast to the impression given in other parts of this work, it is now obvious
that we cannot get all that we may want. Instead, we should study the alternatives and
go for the one that best suits our real needs.
Indeed, as stated in the preface, the fact that we can dene a cryptographic goal
does not mean that we can satisfy it as dened. In case we cannot satisfy the initial
denition, we should search for acceptable relaxations that can be satised. These
relaxations should be dened in a clear manner so that it would be obvious what
they achieve and what they fail to achieve. Doing so will allow a sound choice of
the relaxation to be used in a specic application. That is, the choice will have to be a
circumstantial rather than a generic one. This seems to be a good point at which to end the
current work.
A good compromise is one in which
the most important interests of all parties are satised.
Adv. Klara Goldreich-Ingwer (19122004)
7.7 MISCELLANEOUS
and [118, Sec. 5]. We comment that the original sources (i.e., [117, 118]) are very terse,
and that full details were only provided in [107]. Our treatment differs from [107] in
using a higher level of modularity, which is supported by composition theorems for the
malicious models.
As stated earlier, a satisfactory denitional treatment of secure multi-party computation was provided after the presentation of the constructions of [117, 118, 191]. The
basic approach was developed by Micali and Rogaway [157] and Beaver [10, 11],95 and
reached maturity in Canettis work [50], which provides a relatively simple, exible,
and comprehensive treatment of the (basic) denitions of secure multi-party computation. In particular, the composition theorems that we use are essentially taken
from [50].
A variety of cryptographic tools is used in establishing the main results of this chapter.
Firstly, we mention the prominent role of Oblivious Transfer in the protocols developed
for the semi-honest model.96 An Oblivious Transfer protocol was rst suggested by
Rabin [172], but our actual denition and implementation follow the ideas of Even,
Goldreich, and Lempel [84] (as further developed in the proceedings version of [117]).
Several ingredients play a major role in the compilation of protocols secure in the semihonest model into generally secure protocols (for the malicious models). These include
commitment schemes, zero-knowledge proofs-of-knowledge, veriable secret sharing
(introduced by Chor, Goldwasser, Micali, and Awerbuch [63]), and secure coin-ipping
(introduced by Blum [37]).
The Private Channel Model. In contrast to the bulk of this chapter (as well as the
bulk of the entire work), the private channel model (treated in Section 7.6) allows
the presentation of results that do not rely on intractability assumptions. These results (e.g., Theorem 7.6.6) were obtained by Ben-Or, Goldwasser, and Wigderson [34]
and Chaum, Crepeau, and Damgard [62]. These works were done after the results of
Yao [191] and Goldreich, Micali, and Wigderson [117, 118] were known, with the explicit motivation of obtaining results that do not rely on intractability assumptions. Our
presentation is based on [34] (cf. [97]). The essential role of the bound on the number of
dishonest parties (even in the semi-honest model) was studied in [64] and subsequent
works.
The approach of Goldwasser and Levin [121] is more general: It avoids the denition of security (with respect
to a given functionality) and denes instead a notion of protocol robustness. Loosely speaking, a protocol is
robust if whatever an arbitrary malicious adversary can obtain by attacking it can also be obtained by a very
benign adversarial behavior.
96 Subsequent results by Kilian [137] further demonstrate the importance of Oblivious Transfer in this context.
757
The aforementioned results were originally obtained using protocols that use a
polynomial number of rounds. In some cases, subsequent works obtained secure
constant-round protocols (e.g., in the case of multi-party computations with honest
majority [27], and in the case of two-party computations allowing abort [143]).
We have mentioned (e.g., in Section 7.7.1.1) the impossibility of obtaining fairness
in secure computations without an honest majority. These statements are backed by the
impossibility of implementing a fair two-party coin-toss, as proven in [65].
We have briey discussed the notion of adaptive adversaries. A more detailed discussion of the denitions is provided in [50], which builds on [49]. For a proof of
Theorem 7.7.2, the reader is referred to [49, 53]. For a study of adaptive versus nonadaptive security, the reader is referred to [52].
Our treatment of multi-party protocols assumes a synchronous network with pointto-point channels between every pair of parties. Results for asynchronous communication and arbitrary networks of point-to-point channels were presented in [33, 49]
and [78], respectively.
General secure multi-party computation in a model of transient adversarial behavior
was considered in [166]. In this model, the adversary may seize control of each party
during the protocols execution, but can never control more than (say) 10 percent of the
parties at any point in time. We comment that schemes secure in this model were later
termed proactive (cf., [57]).
Whenever we have restricted the adversarys control of parties, we have done so by
bounding the cardinality of the set of controlled parties. It is quite natural to consider
arbitrary restrictions on the set of controlled parties (i.e., that this set belongs to a
family of sets against which security is guaranteed). The interested reader is referred
to [131].
For further discussion of Byzantine Agreement, see any standard textbook on Distributed Computing (e.g., [3, 147]). We mention that whereas plain m-party Byzantine
Agreement can tolerate at most (m 1)/3 malicious parties, Authenticated Byzantine Agreement can tolerate any number of malicious parties (see Construction 7.5.17,
which follows [80]). The problems arising when composing Authenticated Byzantine
Agreement are investigated in [144].
7.7 MISCELLANEOUS
sufce).97 For further discussion of enhanced trapdoor permutations, see Section C.1
in Appendix C.
7.7.7. Exercises
Exercise 1: Oblivious sampling: Suppose that both parties hold a function (or circuit)
that denes a distribution in the natural way and wish to obtain a sample from
this distribution without letting any party learn the corresponding pre-image. Cast
this problem as one of securely computing a corresponding functionality, treating
differently the case in which the function (or circuit) is xed and the case in which it
is given as input to both parties. Consider also the case in which only the rst party
is to obtain the output.
Exercise 2: Oblivious signing: In continuation of Exercise 1, consider the case in
which the distribution to be sampled is determined by the inputs of both parties. For
example, consider the task of oblivious signing in which one party wishes to obtain
the signature of the second party to some document without revealing the document
to the signer (i.e., the document is the input of the rst party, whereas the signing-key
is the input of the second party).
Exercise 3: Privacy and Correctness: Referring to the discussion that follows Denition 7.2.6, consider the following denitions of (partial) privacy and correctness (with
respect to malicious adversaries). Partial privacy is dened as a restriction of Denition 7.2.6 to the adversarys component of the random variables real, A(z) (x, y)
and ideal f, B(z) (x, y), whereas partial correctness coincides with a restriction of
Denition 7.2.6 to the honest partys component of these random variables.
1. Show that both properties are implied by Denition 7.2.6, but that even their
combination does not imply Denition 7.2.6.
2. Why were both properties qualied by the term partial?
Guideline (Item 1): Note that computational indistinguishability of ensembles
of pairs implies computational indistinguishability of the ensembles resulting by
projection to each coordinate, but the converse does not necessarily hold.
Guideline (Item 2): This is related to the need to use the general formulation
of Denition 7.2.1 for randomized functionalities; see the discussion that follows
Denition 7.2.1.
Exercise 4: On the importance of the length convention: Show that if the equal-length
convention is omitted from denitions like Denition 7.2.1 and 7.2.6, then they
cannot be satised for many natural functionalities. That is, consider these denitions
when the ensembles are indexed by the set of all pairs of strings, rather than by the
set of pairs of equal-length strings.
97
Partial progress toward this goal is reported in Haitners work Implementing Oblivious Transfer using collection
of dense trapdoor permutations (proceedings of the rst Theory of Cryptography Conference, 2004).
759
Guideline: (Here, privacy and security refer to the notions obtained when
omitting the equal-length convention.) Show that the functionality (x, y)
def
def
( f (x, y), f (x, y)), where f (x, y) = 1 if |x| = |y| and f (x, y) = 0 otherwise, cannot be privately computed. Show that (x, y) (|y|, |x|) can be privately computed
but tthat he simple protocol in which Party 1 sends |x| to Party 2 (and Party 2 sends
|y| to Party 1) fails to securely compute it. Challenge: Try to show that the latter
functionality cannot be securely computed.
7.7 MISCELLANEOUS
communication protocol. Recall that the latter implies the existence of one-way
functions.
Guideline: To transmit a bit , the sender invokes the 1-out-of-2 Oblivious Transfer
with input (, 0), while the receiver sets its input to 1 and gets (i.e., the senders
rst bit in the OT). Observe that privacy with respect to the sender implies that
(the sender and thus also) the adversary cannot distinguish the case where the
receiver enters 1 from the case where it enters 2. Likewise, privacy with respect
to the receiver implies that, in the (ctitious) case where the receiver enters 2, the
adversary (like the receiver) cannot tell whether the sender enters (0, 0) or (1, 0).
Thus, also in the (real) case where the receiver enters 1, the adversary cannot tell
whether the sender enters (0, 0) or (1, 0).
Exercise 9: Alternative analysis of Construction 7.3.7: The said construction can be decoupled into two reductions. First, the functionality of Eq. (7.17) (7.18) is reduced to
the deterministic functionality ((a1 , b1 , c1 ), (a2 , b2 )) (, f a2 ,b2 (a1 , b1 , c1 )), where
def
f a,b (x, y, z) = z + (x + a) (y + b), and next the latter is reduced to OT41 . Present
each of these reductions and prove that each is a privacy reduction.
Guideline: When analyzing the second reduction, use the fact that it is used to compute a deterministic functionality and that thus, the simpler form of Denition 7.2.1
can be used.
Exercise 10: Some functionalities that are trivial to privately compute: Show that each
of the following types of functionalities has a trivial protocol for privately computing
it (i.e., using a single message):
1. Each deterministic functionality that only depends on the input of one party (i.e.,
(x, 1|x| ) ( f 1 (x), f 2 (x)) for arbitrary functions f 1 and f 2 ).
2. Each randomized functionality of the form (x, 1|x| ) (g(x), f (x, g(x))), where
g is any randomized process and f is a function.
Generalize these functionality types and their treatment to the multi-party case.
Exercise 11: In continuation of Exercise 10, show that all six functionalities introduced
in Section 7.4.3 are trivial to compute in a private manner.
Guideline: Note that the restricted authenticated-computation functionality of
Eq. (7.27) and the image-transmission functionality of Eq. (7.31) t Item 1,
whereas the basic and augmented coin-tossing functionalities, as well as the inputcommitment functionality, t Item 2. What about Eq. (7.33)?
761
Exercise 14: Voting, Elections, and Lottery: Write a specication for some social procedure (e.g., voting, elections, or lottery), and cast it as a multi-party functionality. Note that allowing appeals and various forms of interaction requires a reactive
functionality (see Section 7.7.1.3), which in turn can be reduced to a standard (nonreactive) functionality.
Exercise 15: Threshold Cryptography: Loosely speaking, Threshold Cryptography is
concerned with allowing a set of parties to share the ability to perform certain
(cryptographic) operations (cf. [74, 96]). For example, suppose that we wish m
parties to hold shares of a signing-key (with respect to some signature scheme), such
that every t of these parties (but not fewer) can generate signatures to documents of
their choice. Cast this example as a multi-party functionality. (The same holds for
other versions of Threshold Cryptography.)
Exercise 16: Failure of a simple protocol for multi-party authenticated computation:
Consider the m-party oracle-aided protocol for computing Eq. (7.50) in which, for
i = 2, ..., m, Parties 1 and i invoke Eq. (7.33), with Party 1 entering the input and
Party i entering the input i . Show that this oracle-aided protocol does not constitute
a secure implementation of Eq. (7.50).
Exercise 17: Analysis of Shamirs Secret-Sharing Scheme: Prove that Construction 7.5.35 satises the conditions of Denition 7.5.34.
Guideline: For every sequence (u 1 , v1 ), ..., (u , v ), where the u i s are distinct,
consider the set of degree d 1 polynomials q that satisfy q(u i ) = vi for
762
7.7 MISCELLANEOUS
Exercise 18: On the importance of comparable complexity in the denition of perfect security: Consider a modication of Denition 7.6.2 such that the ideal-model
adversary is not required to be of comparable complexity to the real-model adversary.
Present protocols that are deemed secure under the modied denition although
they are insecure under the original denition (as well as under Denition 7.5.4).
Guideline: Consider any protocol for computing the functionality
(x, 1|x| , ..., 1|x| ) ( f (x), f (x), ..., f (x)), where f is a one-way permutation.
Show that such a protocol, even the trivial (and bad) one in which Party 1 sends
its input (in the clear) to everybody, is deemed secure under the modied denition. In particular, an ideal-model adversary that does not control (resp., controls)
Party 1 can recover the input of Party 1 (resp., the substituted input of Party 1) in
exponential time by inverting f on any partys output.
Exercise 19: Perfect security implies ordinary security: Show that Denition 7.6.2
implies Denition 7.5.4.
Guideline: Observe that if A is polynomial-time and B has complexity comparable
to A, then B is polynomial-time.
Exercise 20: Private computation of linear functions: For any xed m-by-m matrix
M, over a nite eld, show that the m-ary functionality x x M can be m-privately
computed (as per Denition 7.6.1).
Guideline: For starters, consider rst the functionality (x1 , ..., x m )
m
ci x i , 0, ..., 0), where the ci s are xed constants. Show that the following
( i=1
protocol is m-private: First, each party shares its input with all other parties (by uniformly selecting shares that sum up to its input and sending a share to each party).
Next, each party computes the linear combination of the shares it has received.
Finally, each party sends the result to Party 1. Note that this computation would be
t-private if we were to use sharing via a degree t polynomial.
Exercise 21: Private generation of vectors in a linear subspace: For M as in Exercise 20, show that the m-ary functionality (, ..., ) r , such that r is a
random m-ary vector satisfying r M = 0m can be m-privately computed (as per
Denition 7.6.1).
Guideline: Consider the generating matrix, denoted G, of the subspace dened by
(the parity-check) matrix M. Suppose that G has rank k (i.e., G is a full-rank kby-m matrix). Show that, without loss of generality, the k-by-k left submatrix of G
equals the identity matrix. Privately reduce the generation task to the functionality
of Exercise 20.
763
Exercise 23: Analysis of Construction 7.6.3: For t < m/2, show that Construction 7.6.3 constitutes a protocol that t-privately computes Eq. (7.65).
Guideline: Consider, without loss of generality, I = {1, ..., t}. The simulator is
given an input sequence ((a1 , b1 ), ..., (at , bt )) and an output sequence (r1 , ..., rt ),
and needs to emulate the messages that the parties in I obtain at Step 2. This can
be done by randomly selecting degree t polynomials q j s that are consistent with
these sequences and letting the messages that Party i obtains equal q1 (i), ..., qm (i).
Specically, for i = 1, .., t, the polynomial qi is selected like qi (i.e., uniformly
among the t polynomials having free-term ai bi ); for i = t + 1, .., m 1, the polynomial qi is selected uniformly among all t polynomials, and qm is selected such
that mj=1 j q j (i) = ri holds for all i [t].
764
APPENDIX C
765
1
p(n)
(C.1)
Namely, A (resp., An ) fails to invert f on f (x), where and x are selected by I and
S as here. An equivalent way of writing Eq. (C.1) is
n
Pr[A(I1 (1n ), S (I1 (1n ), Rn )) = f I1
n (S (I 1 (1 ), Rn ))] <
1 (1 )
1
p(n)
(C.2)
1
p(n)
(C.3)
Here and in the following, we assume that sampling Z N , for a composite N , is trivial. However, sampling
Z N (or even Z N ) by using a sequence of unbiased coins is not that trivial. The straightforward sampler may
def
take = 2log2 N random bits, view them as an integer in i {0, 1, ..., 2 1}, and output i mod N . This
yields an almost uniform sample in Z N . Also note that given an element e Z N , one can uniformly sample an
i {0, 1, ..., 2 1} such that i e (mod N ). Thus, the actual sampler does not cause trouble with respect
to the enhanced hardness requirement.
766
767
An indirect construction may use the xed-length variant in order to obtain a one-way function, and then
construct the variable-length variant using this one-way function. Needless to say, this indirect construction is
very wasteful.
Recall that the (t, 1/t)-collision property means that for every n N and every x = y such that |x|, |y| t(n),
the probability that h r (x) = h r (y) is at most 1/t(n), where the probability is taken over all possible choices of
r {0, 1}n with uniform probability distribution.
We comment that the notion of strong witness indistinguishability was introduced by the author at a late stage
of writing [108].
768
Theorem 4.6.8 does not mention the public-coin condition, but the construction that is supposed to support it
is of the public-coin type. Note that constant-round zero-knowledge protocols are presented in Section 4.9, but
these are in relaxed models and are not of the public-coin type.
769
that (P, V ) is strong witness indistinguishable. Then for every two probability en1
1
1
2
2
2
j
j
j
sembles {(X n , Y n , Z n )}nN and {(X n , Y n , Z n )}nN such that X n = (X n,1 , ..., X n, Q(n) ),
j
Y n = (Yn,1 , ..., Yn, Q(n) ), and Z n = (Z n,1 , ..., Z n, Q(n) ), where (X n,i , Yn,i , Z n,i ) is inde
, Yn,k
, Z n,k
)k =i,{1,2} , the following holds:
pendent of (X n,k
1
C.3.3. Consequences
In view of the fact that we do not have constant-round public-coin strong witness
indistinguishable proofs with negligible error for N P, we suggest replacing the use of
such proofs with some cumbersome patches. A typical example is the construction of
non-oblivious commitment schemes (i.e., Theorem 4.9.4).
Non-Oblivious Commitment Schemes. We begin the discussion by noting that the
specic formulation appearing in Denition 4.9.3 is wrong. One should partition the
commit phase into two sub-phases, such that the second sub-phase is a proof-ofknowledge of the input and coins used by the sender at the rst sub-phase, which
in turn should constitute (by itself ) a commitment scheme. That is, the view in the relation displayed in Denition 4.9.3 should be the view of the rst sub-phase (rather than
the view of the entire commit phase). In fact, for the current implementation, we need a
relaxed denition in which one only proves knowledge of the input (but not of the coins)
used by the sender at the rst sub-phase. We stress that the input value proved to be
known must be such that it is impossible for the sender to later decommit to a different
value. Indeed, in the relaxed form, we do not require a later decommitment to be at all
possible; we only require that if decommitment takes place, then the outcome should
match the said input value. Note that this relaxed form sufces for the proof presented in
Section 4.9.2.2.
Next, we modify the construction used in the proof of Theorem 4.9.4 as follows.
First, rather than sending one ordinary commitment to the input, we send many such
(independent) commitments. Secondly, rather than using a (constant-round) proof-ofknowledge with negligible error, we use one that has constant error. The point is that
771
the family (i.e., an not in I ). In such a case, the function is not necessarily 1-1, and,
consequently, the soundness property may be violated. This concern can be addressed
by using a (simple) non-interactive (zero-knowledge) proof for establishing that the
function is typically 1-1 (or, equivalently, is almost onto the designated range).
The proof proceeds by presenting pre-images (under the function) of random elements
specied in the reference string. Note that for any xed polynomial p, we can only
prove that the function is 1-1 on at least a 1 (1/ p(n)) fraction of the designated range
(i.e., {0, 1}n ), yet this sufces for moderate soundness of the entire proof system (which
in turn can be amplied by repetitions). For further details, consult [32].
Although the known candidate trapdoor permutations can be modied to t this form,
we wish to further generalize the result such that any enhanced trapdoor permutation
(as in Denition C.1.1) can be used. This can be done by letting the reference string
consist of the coin sequences used by the domain-sampling algorithm (rather than of
elements of the functions domain). By virtue of the enhanced hardness condition (i.e.,
Eq. (C.3)), the security of the hard-core is preserved, and so is the zero-knowledge
property.
As stated at the end of Section C.1, in contrast to what was claimed in Remark 4.10.6,
we do not known how to extend the construction to arbitrary (rather than enhanced)
trapdoor permutations. This leads to the following open problem.
Open Problem. Under what intractability assumptions is it possible to construct noninteractive zero-knowledge proofs with efcient prover strategies for any set in N P? In
particular, does the existence of arbitrary collections of trapdoor permutations sufce?
We comment that the assumption used here affects the assumption used in (general)
constructions of public-key encryption schemes that are secure under chosen ciphertext
attacks (see, e.g., Theorem 5.4.31).
Recall that the distinguisher is also given the index of the distribution, which in this case is the triple t.
Indeed, here is where we use the fact that the corrected denition (see Denition 5.4.22) refers only to inputselection and witness-selection strategies that can be implemented by polynomial-size circuits.
774
that the simulator generates f -images by selecting random pre-images and applying
f to each of them, and so it knows the pre-images and can reveal them later. Next,
the simulator determines the input graph and the corresponding Hamiltonian cycle (by
using the abovementioned polynomial-size circuit) and acts as the real prover. Finally,
it feeds the original distinguisher with the corresponding output. Observe that in case
the given sequence of f (x)s satises b(x) = 0 (resp., b(x) = 1) for each f (x), the
b-value distinguisher produces outputs distributed exactly as in the simulation (resp.,
the real proof ).
Specically, one should reject the interpretation, offered in Section 4.5 (see Sections 4.5.0, 4.5.4.0, and 4.5.4.2),
by which negative results regarding black-box zero-knowledge indicate the inherent limitations of zeroknowledge.
775
honest parties in each execution are independent of the messages they received in other
executions. The adversary, however, may coordinate the actions it takes in the various
executions, and in particular, its actions in one execution may also depend on messages
it received in other executions.
Let us motivate the asymmetry between the postulate that honest parties act independently in different executions and the absence of such an assumption with respect
to the adversarys actions. Typically, coordinating actions in different executions is difcult but not impossible. Thus, it is desirable to use stand-alone protocols that preserve
security under composition (as dened earlier), rather than to use protocols that include inter-execution coordination actions. Note that at the very least, inter-execution
coordination requires users to keep track of all executions that they perform. Actually,
trying to coordinate honest executions is even more problematic than it seems, because
one may need to coordinate executions of different honest parties (e.g., all employees of
a big corporation or an agency under attack), which in many cases is highly unrealistic.
On the other hand, the adversary attacking the system may be willing to go to the extra
trouble of coordinating its attack in the various executions of the protocol.
For T {sequential, parallel, concurrent}, we say that a protocol is T -zeroknowledge if it is zero-knowledge under a composition of type T . The denitions of
T -zero-knowledge are derived from the standard denition by considering appropriate
adversaries (i.e., adversarial veriers), that is, adversaries that can initiate a polynomial
number of interactions with the prover, where these interactions are scheduled according
to the type T .10 The corresponding simulator (which, as usual, interacts with nobody) is
required to produce an output that is computationally indistinguishable from the output
of such a type T adversary.
Without loss of generality, we may assume that the adversary never violates the scheduling condition; it may
instead send an illegal message at the latest possible adequate time. Furthermore, without loss of generality, we
may assume that all the adversarys messages are delivered at the latest possible adequate time.
11 The preliminary version of Goldwasser, Micali, and Rackoff s work [124] uses the basic denition (i.e.,
Denition 4.3.2), whereas the nal version of that work as well as most subsequent works use the augmented
776
777
14
By non-trivial proof systems we mean ones for languages outside BPP, whereas by signicantly less than logarithmic we mean any function f : N N satisfying f (n) = o(log n/ log log n). In contrast, by almost logarithmic
we mean any function f satisfying f (n) = (log n).
778
The rate should be computed with respect to reasonable intervals of time; for example, for as dened next,
one may assume that a time period of units is measured as units of time on the local clock, where
/ .
779
780
In contrast to these conjectures (and to the reasoning underlying them), Barak showed
how to construct non-black-box simulators and obtained several results that were known
to be unachievable via black-box simulators [5]. In particular, under standard intractability assumptions (see also [7]), he presented constant-round public-coin zero-knowledge
arguments with negligible soundness error for any language in N P. (Moreover, the
simulator runs in strict polynomial-time, which is impossible for black-box simulators of non-trivial constant-round protocols [9].) Furthermore, these protocols preserve zero-knowledge under a xed16 polynomial number of concurrent executions,
in contrast to the result of [58] (regarding black-box simulators) that also holds in
that restricted case. Thus, Baraks result calls for the reevaluation of many common
beliefs. Most concretely, it says that results regarding black-box simulators do not
reect inherent limitations of zero-knowledge (but rather an inherent limitation of a
natural way of demonstrating the zero-knowledge property). Most abstractly, it says
that there are meaningful ways of using a program other than merely invoking it as a
black-box.
Does this means that a method was found to reverse-engineer programs or to
understand them? We believe that the answer is negative. Barak [5] is using the
adversarys program in a signicant way (i.e., more signicant than just invoking it),
without understanding it. So, how does he use the program?
The key idea underlying Baraks protocol [5] is to have the prover prove that either the
original NP-assertion is valid or that he (i.e., the prover) knows the veriers residual
strategy (in the sense that it can predict the next verier message). Indeed, in a real
interaction (with the honest verier), it is infeasible for the prover to predict the next
verier message, and so computational soundness of the protocol follows. However,
a simulator that is given the code of the veriers strategy (and not merely oracle
access to that code) can produce a valid proof of the disjunction by properly executing
the sub-protocol using its knowledge of an NP-witness for the second disjunctive. The
simulation is computational indistinguishable from the real execution, provided that one
cannot distinguish an execution of the sub-protocol in which one NP-witness (i.e., an
NP-witness for the original assertion) is used from an execution in which the second NPwitness (i.e., an NP-witness for the auxiliary assertion) is used. That is, the sub-protocol
should be a witness indistinguishable argument system (see Sections 4.6 and 4.8). We
warn the reader that the actual implementation of this idea requires overcoming several
technical difculties (cf. [5, 7]).
Perspective. In retrospect, taking a wide perspective, it should not come as a surprise
that the programs code yields extra power beyond black-box access to it. Feeding a
program with its own code (or part of it) is the essence of the diagonalization technique,
and this, too, is done without reverse engineering. Furthermore, various non-black-box
techniques have appeared before in the cryptographic setting, but they were used in the
more natural context of devising an attack on an (articial) insecure scheme (e.g., toward
16
The protocol depends on the polynomial that bounds the number of executions, and thus is not known to be
concurrent zero-knowledge (because the latter requires xing the protocol and then considering any polynomial
number of concurrent executions).
781
proving the failure of the Random Oracle Methodology [54] and the impossibility of
software obfuscation [8]). In contrast, in [5] (and [6]), the code of the adversary is being
used within a sophisticated proof of security. What we wish to highlight here is that
non-black-box usage of programs is also relevant to proving (rather than to disproving)
the security of systems.
In the general case, the generation protocol may generate an instance x in L , but it is infeasible for
the prover to obtain a corresponding witness (i.e., a w such that (x , w ) R ). In the second step,
the sub-protocol in use ought to be a proof-of-knowledge, and computational soundness of the main
protocol will follow (because otherwise, the prover, using a knowledge-extractor, can obtain a witness
for x L ).
782
is invoked with the corresponding NP-witness as auxiliary input (i.e., with (w, ),
where w is the NP-witness for x given to the main prover).
The computational soundness of this protocol follows by Property (a) of the generation protocol (i.e., with high probability x L , and so x L follows by the
soundness of the protocol used in Step 2). To demonstrate the zero-knowledge property, we rst generate a simulated transcript of Step 1 (with outcome x L ), along
with an adequate NP-witness (i.e., w such that (x , w ) R ), and then emulate
Step 2 by feeding the sub-prover strategy with the NP-witness (, w ). Combining
Property (b) of the generation protocol and the witness indistinguishability property of the protocol used in Step 2, the simulation is indistinguishable from the real
execution.
The identication is via the two mappings 1 and 2 mentioned in the original text. We stress that these mappings
only depend on the matrix M that contains H .
783
784
Bibliography
785
BIBLIOGRAPHY
[14] M. Bellare, R. Canetti, and H. Krawczyk. Keying Hash Functions for Message Authentication. In Crypto96, Springer Lecture Notes in Computer Science (Vol. 1109), 1996,
pages 115.
[15] M. Bellare, R. Canetti, and H. Krawczyk. Modular Approach to the Design and Analysis
of Authentication and Key Exchange Protocols. In 30th ACM Symposium on the Theory
of Computing, 1998, pages 419428.
[16] M. Bellare, A. Desai, D. Pointcheval, and P. Rogaway. Relations among Notions of Security
for Public-Key Encryption Schemes. In Crypto98, Springer Lecture Notes in Computer
Science (Vol. 1462), 1998, pages 2645.
[17] M. Bellare and O. Goldreich. On Dening Proofs of Knowledge. In Crypto92, SpringerVerlag Lecture Notes in Computer Science (Vol. 740), 1992, pages 390420.
[18] M. Bellare, O. Goldreich, and S. Goldwasser. Incremental Cryptography: The Case of
Hashing and Signing. In Crypto94, Springer-Verlag Lecture Notes in Computer Science
(Vol. 839), 1994, pages 216233.
[19] M. Bellare, O. Goldreich, and S. Goldwasser. Incremental Cryptography and Application to Virus Protection. In 27th ACM Symposium on the Theory of Computing, 1995,
pages 4556.
[20] M. Bellare, O. Goldreich, and H. Krawczyk. Stateless Evaluation of Pseudorandom Functions: Security Beyond the Birthday Barrier. In Crypto99, Springer Lecture Notes in
Computer Science (Vol. 1666), 1999, pages 270287.
[21] M. Bellare and S. Goldwasser. New Paradigms for Digital Signatures and Message Authentication Based on Non-Interative Zero-Knowledge Proofs. In Crypto89, Springer-Verlag
Lecture Notes in Computer Science (Vol. 435), 1990, pages 194211.
[22] M. Bellare, R. Guerin, and P. Rogaway. XOR MACs: New Methods for Message Authentication Using Finite Pseudorandom Functions. In Crypto95, Springer-Verlag Lecture Notes
in Computer Science (Vol. 963), 1995, pages 1528.
[23] M. Bellare, S. Halevi, A. Sahai, and S. Vadhan. Trapdoor Functions and Public-Key
Cryptosystems. In Crypto98, Springer Lecture Notes in Computer Science (Vol. 1462),
1998, pages 283298.
[24] M. Bellare, R. Impagliazzo, and M. Naor. Does Parallel Repetition Lower the Error in
Computationally Sound Protocols? In 38th IEEE Symposium on Foundations of Computer
Science, 1997, pages 374383.
[25] M. Bellare, J. Kilian, and P. Rogaway. The Security of Cipher Block Chaining. In Crypto94,
Springer-Verlag Lecture Notes in Computer Science (Vol. 839), 1994, pages 341358.
[26] M. Bellare and S. Micali. How to Sign Given Any Trapdoor Function. Journal of the ACM,
Vol. 39, 1992, pages 214233.
[27] D. Beaver, S. Micali, and P. Rogaway. The Round Complexity of Secure Protocols. In
22nd ACM Symposium on the Theory of Computing, 1990, pages 503513.
[28] M. Bellare and P. Rogaway. Random Oracles Are Practical: A Paradigm for Designing
Efcient Protocols. In 1st Conf. on Computer and Communications Security, ACM, 1993,
pages 6273.
[29] M. Bellare and P. Rogaway. Entity Authentication and Key Distribution. In Crypto93,
Springer-Verlag Lecture Notes in Computer Science (Vol. 773), 1994, pages 232249.
[30] M. Bellare and P. Rogaway. Provably Secure Session Key Distribution: The Three Party
Case. In 27th ACM Symposium on the Theory of Computing, 1995, pages 5766.
[31] M. Bellare and P. Rogaway. The Exact Security of Digital Signatures: How to Sign with
RSA and Rabin. In EuroCrypt96, Springer Lecture Notes in Computer Science (Vol. 1070),
1996, pages 399416.
[32] M. Bellare and M. Yung. Certifying Permutations: Noninteractive Zero-Knowledge Based
on Any Trapdoor Permutation. Journal of Cryptology, Vol. 9, 1996, pages 149166.
786
BIBLIOGRAPHY
787
BIBLIOGRAPHY
[51] R. Canetti. Universally Composable Security: A New Paradigm for Cryptographic Protocols. In 42nd IEEE Symposium on Foundations of Computer Science, 2001, pages 136
145. Full version (with different title) is available from Cryptology ePrint Archive, Report
2000/067.
[52] R. Canetti, I. Damgard, S. Dziembowski, Y. Ishai, and T. Malkin. On Adaptive Versus
Non-Adaptive Security of Multiparty Protocols. Journal of Cryptology, forthcoming.
[53] R. Canetti, U. Feige, O. Goldreich, and M. Naor. Adaptively Secure Multiparty Computation. In 28th ACM Symposium on the Theory of Computing, 1996, pages 639648.
[54] R. Canetti, O. Goldreich, and S. Halevi. The Random Oracle Methodology, Revisited. In
30th ACM Symposium on the Theory of Computing, 1998, pages 209218.
[55] R. Canetti, O. Goldreich, S. Goldwasser, and S. Micali. Resettable Zero-Knowledge. In
32nd ACM Symposium on the Theory of Computing, 2000, pages 235244.
[56] R. Canetti, S. Halevi, and A. Herzberg. How to Maintain Authenticated Communication
in the Presence of Break-Ins. Journal of Cryptology, Vol. 13, No. 1, 2000, pages 61106.
[57] R. Canetti and A. Herzberg. Maintaining Security in the Presence of Transient Faults. In
Crypto94, Springer-Verlag Lecture Notes in Computer Science (Vol. 839), 1994, pages
425439.
[58] R. Canetti, J. Kilian, E. Petrank, and A. Rosen. Black-Box Concurrent Zero-Knowledge
Requires (log
n) Rounds. In 33rd ACM Symposium on the Theory of Computing, 2001,
pages 570579.
[59] R. Canetti, Y. Lindell, R. Ostrovsky, and A. Sahai. Universally Composable Two-Party and
Multi-Party Secure Computation. In 34th ACM Symposium on the Theory of Computing,
2002, pages 494503.
[60] L. Carter and M. Wegman. Universal Hash Functions. Journal of Computer and System
Science, Vol. 18, 1979, pages 143154.
[61] D. Chaum. Blind Signatures for Untraceable Payments. In Crypto82. New York: Plenum
Press, 1983, pages 199203.
[62] D. Chaum, C. Crepeau, and I. Damgard. Multi-party Unconditionally Secure Protocols.
In 20th ACM Symposium on the Theory of Computing, 1988, pages 1119.
[63] B. Chor, S. Goldwasser, S. Micali, and B. Awerbuch. Veriable Secret Sharing and Achieving Simultaneity in the Presence of Faults. In 26th IEEE Symposium on Foundations of
Computer Science, 1985, pages 383395.
[64] B. Chor and E. Kushilevitz. A Zero-One Law for Boolean Privacy. SIAM J. on Disc. Math.,
Vol. 4, 1991, pages 3647.
[65] R. Cleve. Limits on the Security of Coin Flips When Half the Processors Are Faulty. In
18th ACM Symposium on the Theory of Computing, 1986, pages 364369.
[66] J. D. Cohen and M. J. Fischer. A Robust and Veriable Cryptographically Secure Election
Scheme. In 26th IEEE Symposium on Foundations of Computer Science, 1985, pages
372382.
[67] R. Cramer and I. Damgard. New Generation of Secure and Practical RSA-Based Signatures. In Crypto96, Springer Lecture Notes in Computer Science (Vol. 1109), 1996, pages
173185.
[68] R. Cramer and V. Shoup. A Practical Public-Key Cryptosystem Provably Secure Against
Adaptive Chosen Ciphertext Attacks. In Crypto98, Springer-Verlag Lecture Notes in Computer Science (Vol. 1462), 1998, pages 1325.
[69] C. Crepeau. Efcient Cryptographic Protocols Based on Noisy Channels. In EuroCrypt97,
Springer, Lecture Notes in Computer Science (Vol. 1233), 1997, pages 306317.
[70] I. Damgard. Collision Free Hash Functions and Public Key Signature Schemes. In
EuroCrypt87, Springer-Verlag Lecture Notes in Computer Science (Vol. 304), 1988,
pages 203216.
788
BIBLIOGRAPHY
[71] I. Damgard. A Design Principle for Hash Functions. In Crypto89, Springer-Verlag Lecture
Notes in Computer Science (Vol. 435), 1990, pages 416427.
[72] I. Damgard. Concurrent Zero-Knowledge in Easy in Practice: Theory of Cryptography
Library, 99-14, June 1999. http://philby.ucsd.edu/cryptolib. See also Efcient
Concurrent Zero-Knowledge in the Auxiliary String Model (in Eurocrypt00, 2000).
[73] A. De Santis, G. Di Crescenzo, R. Ostrovsky, G. Persiano, and A. Sahai. Robust Noninteractive Zero-Knowledge. In Crypto01, Springer Lecture Notes in Computer Science
(Vol. 2139), 2001, pages 566598.
[74] Y. Desmedt and Y. Frankel. Threshold Cryptosystems. In Crypto89, Springer-Verlag Lecture Notes in Computer Science (Vol. 435), 1990, pages 307315.
[75] W. Dife and M. E. Hellman. New Directions in Cryptography. IEEE Trans. on Info.
Theory, IT-22, Nov. 1976, pages 644654.
[76] H. Dobbertin. The Status of MD5 after a Recent Attack. In CryptoBytes, RSA Lab., Vol. 2,
No. 2, 1996, pages 16.
[77] D. Dolev, C. Dwork, and M. Naor. Non-Malleable Cryptography. In 23rd ACM Symposium
on the Theory of Computing, 1991, pages 542552. Full version available from authors.
[78] D. Dolev, C. Dwork, O. Waarts, and M. Yung. Perfectly Secure Message Transmission.
Journal of the ACM, Vol. 40 (1), 1993, pages 1747.
[79] D. Dolev and A. C. Yao. On the Security of Public-Key Protocols. IEEE Trans. on Inform.
Theory, Vol. 30, No. 2, 1983, pages 198208.
[80] D. Dolev and H. R. Strong. Authenticated Algorithms for Byzantine Agreement. SIAM
Journal on Computing, Vol. 12, 1983, pages 656666.
[81] C. Dwork and M. Naor. An Efcient Existentially Unforgeable Signature Scheme and Its
Application. Journal of Cryptology, Vol. 11 (3), 1998, pages 187208
[82] C. Dwork, M. Naor, and A. Sahai. Concurrent Zero-Knowledge. In 30th ACM Symposium
on the Theory of Computing, 1998, pages 409418.
[83] S. Even and O. Goldreich. On the Security of Multi-party Ping-Pong Protocols. In 24th
IEEE Symposium on Foundations of Computer Science, 1983, pages 3439.
[84] S. Even, O. Goldreich, and A. Lempel. A Randomized Protocol for Signing Contracts.
CACM, Vol. 28, No. 6, 1985, pages 637647.
[85] S. Even, O. Goldreich, and S. Micali. On-line/Off-line Digital Signatures. Journal of
Cryptology, Vol. 9, 1996, pages 3567.
[86] S. Even, A.L. Selman, and Y. Yacobi. The Complexity of Promise Problems with
Applications to Public-Key Cryptography. Information and Control, Vol. 61, 1984,
pages 159173.
[87] S. Even and Y. Yacobi. Cryptography and NP-Completeness. In Proceedings of 7th ICALP,
Springer-Verlag Lecture Notes in Computer Science (Vol. 85), 1980, pages 195207. See
[86].
[88] U. Feige, A. Fiat, and A. Shamir. Zero-Knowledge Proofs of Identity. Journal of Cryptology, Vol. 1, 1988, pages 7794.
[89] U. Feige, D. Lapidot, and A. Shamir. Multiple Non-Interactive Zero-Knowledge Proofs
under General Assumptions. SIAM Journal on Computing, Vol. 29 (1), 1999, pages 128.
[90] U. Feige and A. Shamir. Zero-Knowledge Proofs of Knowledge in Two Rounds.
In Crypto89, Springer-Verlag Lecture Notes in Computer Science (Vol. 435), 1990,
pages 526544.
[91] U. Feige and A. Shamir. Witness Indistinguishability and Witness Hiding Protocols. In
22nd ACM Symposium on the Theory of Computing, 1990, pages 416426.
[92] A. Fiat and A. Shamir. How to Prove Yourself: Practical Solution to Identication and
Signature Problems. In Crypto86, Springer-Verlag Lecture Notes in Computer Science
(Vol. 263), 1987, pages 186189.
789
BIBLIOGRAPHY
790
BIBLIOGRAPHY
791
BIBLIOGRAPHY
792
BIBLIOGRAPHY
[154] R. C. Merkle and M. E. Hellman. Hiding Information and Signatures in Trapdoor Knapsacks. IEEE Trans. Inform. Theory, Vol. 24, 1978, pages 525530.
[155] S. Micali, M. O. Rabin, and S. Vadhan. Veriable Random Functions. In 40th IEEE
Symposium on Foundations of Computer Science, 1999, pages 120130.
[156] S. Micali, C. Rackoff, and B. Sloan. The Notion of Security for Probabilistic Cryptosystems. SIAM Journal on Computing, Vol. 17, 1988, pages 412426.
[157] S. Micali and P. Rogaway. Secure Computation. In Crypto91, Springer-Verlag Lecture
Notes in Computer Science (Vol. 576), 1992, pages 392404.
[158] D. Micciancio. Oblivious Data Structures: Applications to Cryptography. In 29th ACM
Symposium on the Theory of Computing, 1997, pages 456464.
[159] National Bureau of Standards. Data Encryption Standard (DES). Federal Information
Processing Standards, Publ. 46, 1977.
[160] National Institute for Standards and Technology. Digital Signature Standard (DSS).
Federal Register, Vol. 56, No. 169, Aug. 1991.
[161] M. Naor. Bit Commitment Using Pseudorandom Generators. Journal of Cryptology,
Vol. 4, 1991, pages 151158.
[162] M. Naor and O. Reingold. From Unpredictability to Indistinguishability: A Simple Construction of Pseudorandom Functions from MACs. In Crypto98, Springer-Verlag Lecture
Notes in Computer Science (Vol. 1464), 1998, pages 267282.
[163] M. Naor and M. Yung. Universal One-Way Hash Functions and their Cryptographic Application. 21st ACM Symposium on the Theory of Computing, 1989,
pages 3343.
[164] M. Naor and M. Yung. Public-Key Cryptosystems Provably Secure Against Chosen Ciphertext Attacks. In 22nd ACM Symposium on the Theory of Computing, 1990, pages
427437.
[165] R. Ostrovsky, R. Venkatesan, and M. Yung. Secure Commitment Against Powerful Adversary: A Security Primitive Based on Average Intractability. In Proceedings of the 9th
Symposium on Theoretical Aspects of Computer Science (STACS92), 1992, pages 439
448.
[166] R. Ostrovsky and M. Yung. How to Withstand Mobile Virus Attacks. In 10th ACM Symposium on Principles of Distributed Computing, 1991, pages 5159.
[167] T. P. Pedersen and B. Ptzmann. Fail-Stop Signatures. SIAM Journal on Computing,
Vol. 26, No. 2, 1997, pages 291330. Based on several earlier works (see rst footnote in
the paper).
[168] B. Ptzmann. Digital Signature Schemes (General Framework and Fail-Stop Signatures).
Springer-Verlag Lecture Notes in Computer Science (Vol. 1100), 1996.
[169] M. Prabhakaran, A. Rosen, and A. Sahai. Concurrent Zero-Knowledge Proofs in Logarithmic Number of Rounds. In 43rd IEEE Symposium on Foundations of Computer Science,
2002, pages 366375.
[170] M. O. Rabin. Digitalized Signatures. In Foundations of Secure Computation, R. A.
DeMillo et al., eds. New York: Academic Press, 1977, pages 155168.
[171] M. O. Rabin. Digitalized Signatures and Public Key Functions as Intractable as Factoring.
TR-212, LCS, MIT, 1979.
[172] M. O. Rabin. How to Exchange Secrets by Oblivious Transfer. Tech. Memo TR-81, Aiken
Computation Laboratory, Harvard University, 1981.
[173] T. Rabin and M. Ben-Or. Veriable Secret Sharing and Multi-party Protocols with Honest
Majority. In 21st ACM Symposium on the Theory of Computing, 1989, pages 7385.
[174] C. Rackoff and D. R. Simon. Non-Interactive Zero-Knowledge Proof of Knowledge and
Chosen Ciphertext Attack. In Crypto91, Springer Verlag Lecture Notes in Computer
Science (Vol. 576), 1991, pages 433444.
793
BIBLIOGRAPHY
794
Index
Author Index
Subject Index
795
INDEX
796
INDEX
Hashing
collision-free, 512523, 542543, 558,
560561, 562, 575
based on claw-free permutations,
516519
via block-chaining, 519521
via tree-hashing, 521523
collision-resistent. See collision-free, 513
Universal. See Hashing functions
Universal One-Way, 513, 543, 560575,
588
Hashing functions, 527537, 563565, 596
AXU, 535537, 589
collision probability, 528531, 535
generalized, 530531, 589
Hybrid Argument. See Techniques
Interactive Proofs
perfect completeness, 658
Zero-Knowledge. See Zero-Knowledge
Message authentication, 423, 497537
attacks and security, 502507
basic mechanism, 501502
length-restricted, 507516
state-based, 531537, 548, 585
Techniques
Averaging Argument, 386
Hash and Sign, 513516, 526537,
542543, 571575, 576
Hybrid Argument, 391, 402, 429, 448449,
457, 459461, 467468, 479, 593,
637638, 703, 754
797
INDEX
Techniques (cont.)
Reducibility Argument, 385, 387, 402,
410, 510, 514, 518, 525, 540, 551,
564, 567, 569
the simulation paradigm, 379, 479, 601,
620
Trapdoor permutations. See One-way
permutations
798