Symmetric Encryption

1
 High-Level
High-Level View
View

• Previously we talked about:

– unconstrained adversary

– achieving perfect secrecy by means of one-time pad

– using entropy to measure information leakage

• In this lecture we:

– take a computational approach

– break the bounds of information-theoretic analysis

– learn about modern design of encryption algorithms

 Symmetric
Symmetric Encryption
Encryption

• Information-theoretic or perfect security builds on the fact that an

attacker doesn’t have enough information to recover the message
– all messages can still happen with original probabilities

• Computational security provides security only in the presence of

“practical” adversaries
– given unlimited resources, such algorithms can be broken

• There are two differences from our previous definition of security:

– security only holds against adversaries that run in a feasible amount

of time
– adversaries can potentially succeed with a very small probability
 Computational
Computational Security
Security

• Security of a cipher can often be defined in one of the following ways:

– exact numbers
• a scheme is (t, ε)-secure if an adversary running for time at most t
has probability of most ε in breaking the security of the scheme
– what values of t and ε are reasonable today?
• (t, ε)-security does not imply security in general
 Computational
Computational Security
Security

• Security of a cipher can be defined in one of the following ways:

– asymptotic approach
• cipher is described using a security parameter n
• a scheme is secure if an efficient adversary has only negligible
probability in breaking its security
– adversary runs in probabilistic polynomial time (PPT)

– honest parties must be polynomial time as well

• security guarantees hold only for sufficiently large values of n
– an adversary running for 2 2 5 · n 3 cycles can break security with

probability 2 2 0 · 2 − n / 4

• Which approach is more common or better?

 More on poly
More on and negl
(n) and
poly(n) negl(n)
(n)

• We distinguish between polynomial and super-polynomial functions and

normally are not very concerned with the exact complexity
– any super-polynomial function can be made sufficiently large by
appropriately setting the security parameter n
– a negligible function is then the inverse of any super-polynomial
function
• such function can diminish with drastically different rates and should
only be used with sufficiently large values of n
• we assume that events occurring with negligible probability are
so unlikely that they can be ignored
 More on poly
More on and negl
(n) and
poly(n) negl(n)
(n)

• We will use the following closure properties:

– let f 1 and f 2 be two arbitrary functions of the same type (polynomial,

super-polynomial, or negligible)

– function f 3 ( n ) = f 1 ( n ) + f 2 ( n ) has the same type as f 1 and f 2

– also, function f 4 ( n ) = f 1 ( n ) · p ( n ) has the same type as f 1 for any

polynomial p ( n )
 String
String Length
Length and
and Running
Running Time
Time

• By polynomial-time algorithms we mean functions running in

polynomial time in the length of their inputs
– i.e., on input x, f (|x|) = f ( n ) must be poly-time

– since n = |x| = log x, if f ( n ) takes time x, it is exponential in n

– if we want poly (n) and there are no other inputs, we write f ( 1 n )

– example:

– the same applies to the complexity of all other algorithms

 String
String Length
Length and
and Running
Running Time
Time

• By probabilistic algorithms we mean functions that can make unbiased

coin tosses
– choose a bit to be 0 with probability 1/2 and 1 with probability 1/2

– flip as many coins as necessary

• How do we generate randomness in practice, without a coin?

• Is output of C function rand() random? function random()?

 Computationally-Secure
Computationally-Secure Encryption
Encryption

• We now define a computationally secure symmetric key encryption scheme

– a private-key encryption scheme consists of polynomial-time

algorithms (Gen, Enc, Dec) such that

1. Gen: on input the security parameter 1 n , outputs key k

2. Enc: on input a key k and a message m ∈ {0, 1} ∗ , outputs

ciphertext
c

3. Dec: on input a key k and ciphertext c, outputs plaintext m

– we write k ← Gen (1 n ), c ← Enc k (m), and m : = Dec k (c)

• this notation means that Gen and Enc are probabilistic and Dec
is deterministic
 Symmetric
Symmetric Encryption
Encryption

• The above definition allows us to encrypt message of any length

• In practice, there are two types of symmetric key algorithms:

– block ciphers
• the key has a fixed size
• prior to encryption, the message is partitioned into blocks of
certain size
• each block is encrypted and decrypted on its own
– stream ciphers
• the message is processed as a stream
• pseudo-random generator is used to produce a long key stream from
a short fixed-length key
 Computationally-Secure
Computationally-Secure Encryption
Encryption

• Correctness requirement is the same as before

• Definition of security now differs

– we first model a very weak adversary that observes only one

ciphertext
– recall that we model security using eavesdropping indistinguishability
experiment PrivKeav
A ,E
– there are three differences in the computational setting:
1.

2.

3.
 Computationally-Secure
Computationally-Secure Encryption
Encryption

• Experiment PrivKea
A ,E ( n )
v
1. A is given 1 n and chooses two messages m 0 , m 1 of the same length
2. random key k is generated by Gen (1 n ), and random bit b ← {0, 1 } is
chosen

3. ciphertext c ← Enc k (m b ) is computed and given to A

4. A outputs bit bJ as its guess for b

5. experiment outputs 1 if bJ = b ( A wins) and 0 otherwise

 Computationally-Secure
Computationally-Secure Encryption
Encryption

• A private-key encryption scheme E = (Gen, Enc, Dec) has

indistinguishable encryptions in the presence of an eavesdropper if for
every PPT adversary A there exists a negligible function negl such that
1
Pr[PrivKea
A ,E ( n ) = 1] ≤ + negl( n )
v 2
• The default notion of secure encryption does not hide information about
the plaintext length

– in some cases, we want the length to be protected

 Towards
Towards Computationally-Secure
Computationally-Secure Encryption
Encryption

• How do we meet this definition?

– idea: substitute randomness with pseudorandomness

• What is pseudorandomness?

– it refers to a distribution of strings rather than a single string

– given a string, a polynomial-time adversary shouldn’t be able to tell

whether it was sampled using a distribution of pseudorandom strings
or uniformly at random

• Pseudorandom strings are produced using a pseudorandom generators

(PRG)
– a PRG takes a fixed-length key, or seed, and produces a longer string
 Pseudorandom
Pseudorandom Generator
Generator

• Let G be a (deterministic) algorithm that on input n-bit string s outputs

a string of length l ( n )

• G is a pseudorandom generator if the following is true:

1. (expansion) for any n, output is longer than input: l ( n ) > n

2. (pseudorandomness) any PPT distinguisher D can’t tell the difference

with non-negligible probability:

| P r [ D ( r ) = 1] − P r [ D ( G ( s ) ) = 1]| ≤ negl(n)
where r and s are random strings of size l ( n ) and n
– this property completely fails if D is computationally unbounded

• The seed s must be treated similar to a key

Pseudorandom
Pseudorandom Generator
Generator Exercises
Exercises
 Secure
Secure Encryption
Encryption Scheme
Scheme

• Private-key encryption scheme for messages from M = {0, 1 } l

– let PRG G have expansion factor l

– Gen: on input 1 n , randomly choose key k ← {0, 1 } n

– Enc: on input key k ∈ {0, 1 } n and message m ∈ {0, 1 } l ( n ) ,

output ciphertext c : = G ( k ) ⊕ m

– Dec: on input key k ∈ {0, 1 } n and ciphertext c ∈ {0, 1 } l ( n ) ,

output message m = G ( k ) ⊕ c

• Theorem: The above scheme has indistinguishable encryptions in

the presence of an eavesdropper, assuming that G is a PRG
 Proof Technique: Reduction

• Reductions are commonly used to prove that a problem is hard

– suppose problem X is known or believed to belong to a class of

“hard” problems
– we want to prove that Y is also “hard” to solve

– we construct an “efficient” algorithm to use a solution to problem Y to

solve problem X
• this algorithm is called reduction
– this implies that Y is “at least as hard” as X and must be within the
same class of hard problems
– example:
 Proofs
Proofs by
by Reduction
Reduction

• The actual proof can proceed as proof by contradiction:

– assume to the contrary that Y can be solved efficiently

– we use reduction from X to Y to solve X efficiently

– this is impossible because X is hard ⇒ contradiction

– the assumption that Y can be solved efficiently must be wrong

• In our computational setting

– hard means “cannot be solved by a polynomial-time adversary with

more than negligible probability”
– efficient means polynomial time
 Proofs
Proofs by
by Reduction
Reduction

• Claim: Assuming that no PPT adversary can break construction X with

non-negligible probability, our construction Y is secure (cannot be broken
by any PPT adversary except with negligible probability)

• Security proof by reduction:

1. suppose some PPT adversary A has advantage ε ( n ) at breaking

our scheme Y

2. we construct efficient adversary A J that tries to solve X using A as a

sub-routine

– A J simulates environment for A on an instance of problem X

– if A successfully breaks Y , we want A J to break X at least

with probability 1/p( n )
 Proof
Proof by
by Reduction
Reduction

• Security proof by reduction (cont.)

3. if ε ( n ) is not negligible, X is broken by A J with non-

negligible probability ε ( n ) / p ( n ) ⇒ contradiction

4. it must be that ε ( n ) is negligible for any A

• In our private-key encryption scheme

– security of X :

– security of Y :
 Proving
Proving Security
Security of
of Our
Our Encryption
Encryption Scheme
Scheme

• To build a proof, we need to construct a distinguisher designed to break

the PRG

– the distinguisher must draw its “security breaking abilities” from

an adversary A attacking our encryption scheme

• Once this is done, we analyze its success and relate it to that of A’s success
in breaking encryption experiment
 Beyond
Beyond Simplified
Simplified Model
Model

• How do we encrypt

– variable-length messages

– multiple messages

• Variable-length messages

– generate pseudorandom string of desired length

– use variable output-length PRG

• Handling multiple messages is trickier

– straightforward usage of one-message encryption schemes fails to

achieve security
– what is the definition “security” now?
 Multiple
Multiple Encryptions
Encryptions Security
Security

• Multiple message eavesdropping experiment PrivKmult

A ,E ( n )

1. A is given 1 n and chooses two vectors of t messages M 0 and M 1

2. random key k is generated by Gen (1 n ), and random bit b ← {0, 1 } is

chosen

3. ciphertext vector C is computed from M b and is given to A

4. A outputs bit bJ as its guess for b

5. experiment outputs 1 if bJ = b ( A wins) and 0 otherwise

• Similar to before, we want mult 1

Pr[PrivKA ,E ( n ) = 1] ≤ + negl( n )
2
 Multiple
Multiple Encryptions
Encryptions Security
Security

• Any deterministic encryption algorithm fails this definition of security

• There are two common ways to achieve multiple encryption security

– use different portions of the stream for different messages

• drawback: requires synchronization
– make PRG take another randomizing parameter as G ( k , I V )
• drawback: requires stronger security properties from the PRG
 Stream
Stream Ciphers
Ciphers

• Stream cipher algorithms

– Linear Feedback Shift Registers (LFSR)

– RC4

• Security of practical stream cipher algorithms is less understood

than security of block ciphers

• Some implementations also incorrectly use them