MIT 6.875 & Berkeley CS276 Foundations of Cryptography Lecture - - PowerPoint PPT Presentation

MIT 6.875 & Berkeley CS276

Lecture 10 Foundations of Cryptography

Today: Constructions of Public-Key Encryption

1: Trapdoor Permutations (RSA) 2: Quadratic Residuosity/Goldwasser-Micali 3: Diffie-Hellman/El Gamal 4: Learning with Errors/Regev

composite N/factoring composite N/factoring prime p/discrete log small numbers, large dimensions

F

domain range Easy to compute Hard to invert Easy to invert given a trapdoor

Trapdoor One-way Functions

range

Trapdoor One-way Permutations

Domain = Range

Review: Number Theory

Let’s review some number theory from L7-8. Let 𝑂 = 𝑞𝑟 be a product of two large primes. Fact: 𝑎!

∗ = {𝑏 ∈ 𝑎!: gcd a, N = 1} is a group.

• group operation is multiplication mod 𝑂.
• inverses exist and are easy to compute (how so?)
• the order of the group is ϕ 𝑂 = 𝑞 − 1 (𝑟 − 1)

Lecture 8: The map 𝐺 𝑦 = 𝑦# mod 𝑂 is a 4-to-1 trapdoor function, as hard to invert as factoring 𝑂.

The RSA Trapdoor Permutation

Today: Let 𝑓 be an integer with gcd 𝑓, ϕ(𝑂) = 1. Then, the map 𝐺

!,% 𝑦 = 𝑦% mod 𝑂 is a trapdoor permutation.

{𝐺

!,%: gcd 𝑓, 𝑂 = 1}

Key Fact: Given 𝑒 such that 𝑓𝑒 = 1 mod ϕ 𝑂 , it is easy to compute 𝑦 given 𝑦%. Proof: (𝑦%)& = 𝑦'( ! )* = (𝑦( ! )' = 𝑦 = 𝑦 mod 𝑂

(for some integer k)

This gives us the RSA trapdoor permutation collection. Trapdoor for inversion: 𝑒 = 𝑓+*mod ϕ 𝑂 .

The RSA Trapdoor Permutation

Today: Let 𝑓 be an integer with gcd 𝑓, ϕ(𝑂) = 1. Then, the map 𝐺

!,% 𝑦 = 𝑦% mod 𝑂 is a trapdoor permutation.

Hardness of inversion without trapdoor = RSA assumption We know that if factoring is easy, RSA is broken (and that’s the only known way to break RSA) Major Open Problem: Are factoring and RSA equivalent? given 𝑂, 𝑓 (as above) and 𝑦% mod N, hard to compute 𝑦.

The RSA Trapdoor Permutation

Today: Let 𝑓 be an integer with gcd 𝑓, ϕ(𝑂) = 1. Then, the map 𝐺

!,% 𝑦 = 𝑦% mod 𝑂 is a trapdoor permutation.

Hardcore bits (galore) for the RSA trapdoor one-way perm:

• The Goldreich-Levin bit GL 𝑠; 𝑠, =

𝑠, 𝑠′ mod 2

• The least significant bit LSB 𝑠
• The “most significant bit” 𝐼𝐵𝑀𝐺

! 𝑠 = 1 iff 𝑠 < 𝑂/2

• In fact, any single bit of 𝑠 is hardcore.

RSA Encryption

• 𝐻𝑓𝑜 1- : Let 𝑂 = 𝑞𝑟 and 𝑓, 𝑒 be such that

𝑓𝑒 = 1 𝑛𝑝𝑒 𝜚(𝑂). Let 𝑞𝑙 = (𝑂, 𝑓) and let 𝑡𝑙 = 𝑒.

• 𝐹𝑜𝑑 𝑞𝑙, 𝑐 where 𝑐 is a bit: Generate random 𝑠 ∈

𝑎!

∗ and output 𝑠% mod 𝑂 and LSB 𝑠 ⨁𝑛.

• 𝐸𝑓𝑑 𝑡𝑙, 𝑑 : Recover 𝑠 via RSA inversion.

IND-secure under the RSA assumption: given 𝑂, 𝑓 (as above) and 𝑠% mod N, hard to compute 𝑠.

Today: Constructions of Public-Key Encryption

1: Trapdoor Permutations (RSA) 2: Quadratic Residuosity/Goldwasser-Micali 3: Diffie-Hellman/El Gamal 4: Learning with Errors/Regev

Quadratic Residuosity

Let’s review some more number theory from L7-8. Let 𝑂 = 𝑞𝑟 be a product of two large primes. 𝐾𝑏𝑑+* 𝐾𝑏𝑑)* 𝑎!

∗

{𝑦: 𝑦 𝑂 = −1} {𝑦: 𝑦 𝑂 = +1}

Jacobi symbol .

! = . / . 0 is +1 if 𝑦 is a square mod

both 𝑞 and 𝑟 or a non-square mod both 𝑞 and 𝑟.

Quadratic Residuosity

Let’s review some more number theory from L7-8. Let 𝑂 = 𝑞𝑟 be a product of two large primes. 𝐾𝑏𝑑+* 𝐾𝑏𝑑)* 𝑎!

∗

{𝑦: 𝑦 𝑂 = −1} {𝑦: 𝑦 𝑂 = +1}

Surprising fact: Jacobi symbol .

! = . / . 0 is

computable in poly time without knowing 𝑞 and 𝑟.

Quadratic Residuosity

Let’s review some more number theory from L7-8. Let 𝑂 = 𝑞𝑟 be a product of two large primes. 𝐾𝑏𝑑)* 𝑅𝑆! is the set of squares mod 𝑂 and 𝑅𝑂𝑆! is the set

• f non-squares mod 𝑂 with Jacobi symbol +1.

𝑅𝑆! 𝑅𝑂𝑆!

So: 𝑅𝑆! = {𝑦:

" # = " $ = +1}

𝑅𝑂𝑆! = {𝑦:

" # = " $ = −1}

Quadratic Residuosity

Let’s review some more number theory from L7-8. Let 𝑂 = 𝑞𝑟 be a product of two large primes. Quadratic Residuosity Assumption (QRA) Let 𝑂 = 𝑞𝑟 be a product of two large primes. No PPT algorithm can distinguish between a random element of 𝑅𝑆! from a random element of 𝑅𝑂𝑆! given only 𝑂.

Goldwasser-Micali (GM) Encryption

𝐻𝑓𝑜 1- : Generate random 𝑜-bit primes 𝑞 and 𝑟 and let 𝑂 = 𝑞𝑟. Let 𝑧 ∈ 𝑅𝑂𝑆! be some quadratic non- residue with Jacobi symbol +1. Let 𝑞𝑙 = (𝑂, 𝑧) and let 𝑡𝑙 = (𝑞, 𝑟). 𝐹𝑜𝑑 𝑞𝑙, 𝑐 where 𝑐 is a bit: Generate random 𝑠 ∈ 𝑎!

∗ and output 𝑠# mod 𝑂 if

𝑐 = 0 and 𝑠#𝑧 mod 𝑂 if 𝑐 = 1. 𝐸𝑓𝑑 𝑡𝑙, 𝑑 : Check if c ∈ 𝑎!

∗ is a quadratic residue

using 𝑞 and 𝑟. If yes, output 0 else 1.

Goldwasser-Micali (GM) Encryption

𝐹𝑜𝑑 𝑞𝑙, 𝑐 where 𝑐 is a bit: Generate random 𝑠 ∈ 𝑎!

∗ and output 𝑠# mod 𝑂 if

𝑐 = 0 and 𝑠#𝑧 mod 𝑂 if 𝑐 = 1. IND-security follows directly from the quadratic residuosity assumption.

GM is a Homomorphic Encryption

𝐹𝑜𝑑 𝑞𝑙, 𝑐 where 𝑐 is a bit: Generate random 𝑠 ∈ 𝑎!

∗ and output 𝑠#𝑧< mod 𝑂.

Given a GM-ciphertext of 𝑐 and a GM-ciphertext of 𝑐′, I can compute a GM-ciphertext of 𝑐 + 𝑐,𝑛𝑝𝑒 2. without knowing anything about 𝒄 or 𝒄′! Claim: 𝐹𝑜𝑑 𝑞𝑙, 𝑐 = 𝐹𝑜𝑑(𝑞𝑙, 𝑐,) is an encryption of 𝑐⨁𝑐, = 𝑐 + 𝑐,𝑛𝑝𝑒 2.

Today: Constructions of Public-Key Encryption

1: Trapdoor Permutations (RSA) 2: Quadratic Residuosity/Goldwasser-Micali 3: Diffie-Hellman/El Gamal 4: Learning with Errors/Regev

Diffie-Hellman Key Exchange

(𝑕.)= = (𝑕=). Commutativity in the exponent: So, you can compute 𝑕.= given either 𝑕. and 𝑧, or 𝑕= and 𝑦. Hard to compute 𝑕.= given only 𝑕, 𝑕. and 𝑕= Diffie-Hellman Assumption (DHA): (where 𝑕 is an element of some group)

Diffie-Hellman Key Exchange

Hard to compute it given only 𝑕, 𝑕. and 𝑕= Diffie-Hellman Assumption (DHA): We know that if discrete log is easy, DHA is false. Major Open Problem: Are discrete log and DHA equivalent?

Diffie-Hellman Key Exchange

Pick a random number 𝑦 ∈ 𝑎/+* 𝑕. mod 𝑞 𝑞, 𝑕: Generator of our group 𝑎!

∗

Pick a random number y ∈ 𝑎/+* 𝑕= mod 𝑞 Shared key K = 𝑕.= mod 𝑞 = (𝑕=). mod 𝑞 Shared key K = 𝑕.= mod 𝑞 = (𝑕.)= mod 𝑞

Diffie-Hellman/El Gamal Encryption

• 𝐻𝑓𝑜 1- : Generate an 𝑜-bit prime 𝑞 and a generator

𝑕 of 𝑎/

∗. Choose a random number 𝑦 ∈ 𝑎/+*

Let 𝑞𝑙 = (𝑞, 𝑕, 𝑕.) and let 𝑡𝑙 = 𝑦.

• 𝐹𝑜𝑑 𝑞𝑙, 𝑛 where 𝑛 ∈ 𝑎/

∗: Generate random 𝑧 ∈

𝑎/+* and output (𝑕=, 𝑕.= = 𝑛)

• 𝐸𝑓𝑑 𝑡𝑙 = 𝑦, 𝑑 : Compute 𝑕.= using 𝑕= and 𝑦 and

divide the second component to retrieve 𝑛.

Is this Secure?

The Problem

Claim: Given p, g, 𝑕. mod 𝑞 and 𝑕= mod 𝑞, adversary can Corollary: Therefore, additionally given 𝑕.= = 𝑛 mod 𝑞, the adversary can determine whether 𝑛 is a square mod 𝑞, violating “IND-security”. compute some information about 𝑕.= mod 𝑞. determine if 𝑕.= mod 𝑞 is a square mod 𝑞.

The Problem

Claim: Given p, g, 𝑕. mod 𝑞 and 𝑕= mod 𝑞, adversary can determine if 𝑕.= mod 𝑞 is a square mod 𝑞. 𝑕.= mod 𝑞 is a square ⟺ 𝑦𝑧 (mod 𝑞 − 1) is even ⟺ 𝑦𝑧 is even ⟺ 𝑦 is even or 𝑧 is even ⟺ 𝑦 (𝑛𝑝𝑒 𝑞 − 1) is even or 𝑧 (mod p − 1) is even ⟺ 𝑕. 𝑛𝑝𝑒 𝑞 or 𝑕= 𝑛𝑝𝑒 𝑞 is a square This can be checked in poly time!

Diffie-Hellman Encryption

Claim: Given p, g, 𝑕. mod 𝑞 and 𝑕= mod 𝑞, adversary can Lesson: Best to work over a group of prime order. Such groups have no subgroups. More generally, dangerous to work with groups that have non-trivial subgroups (in our case, the subgroup of all squares mod p) An Example: Let 𝑞 = 2𝑟 + 1 where 𝑟 is a prime itself. Then, the group of squares mod 𝑞 has order

/+* #

= 𝑟. determine if 𝑕.= mod 𝑞 is a square mod 𝑞.

Diffie-Hellman/El Gamal Encryption

• 𝐻𝑓𝑜 1- : Generate an 𝑜-bit “safe” prime 𝑞 = 2𝑟 + 1

and a generator 𝑕 of 𝑎/

∗ and let ℎ = 𝑕#mod 𝑞 be a

generator of 𝑅𝑆/ . Choose a random number 𝑦 ∈ 𝑎0 . Let 𝑞𝑙 = (𝑞, ℎ, ℎ.) and let 𝑡𝑙 = 𝑦.

• 𝐹𝑜𝑑 𝑞𝑙, 𝑛 where 𝑛 ∈ 𝑅𝑆/ : Generate random 𝑧 ∈

𝑎0 and output (𝑕=, 𝑕.= = 𝑛)

• 𝐸𝑓𝑑 𝑡𝑙 = 𝑦, 𝑑 : Compute 𝑕.= using 𝑕= and 𝑦 and

divide the second component to retrieve 𝑛.

Decisional Diffie-Hellman Assumption

Hard to distinguish between 𝑕.= and a uniformly random group element, given 𝑕, 𝑕. and 𝑕= Decisional Diffie-Hellman Assumption (DDHA): That is, the following two distributions are computationally indistinguishable: (𝑕, 𝑕., 𝑕=, 𝑕.=) ≈ (𝑕, 𝑕., 𝑕=, 𝑣) DH/El Gamal is IND-secure under the DDH assumption.

Today: Constructions of Public-Key Encryption

1: Trapdoor Permutations (RSA) 2: Quadratic Residuosity/Goldwasser-Micali 3: Diffie-Hellman/El Gamal 4: Learning with Errors/Regev (post-quantum secure, as far as we know)

Solving Linear Equations

Find 𝒕𝟐 𝒕𝟑

𝒕𝟐 𝒕𝟑 𝟔 𝟐 𝟒 𝟕 𝟑 𝟐 = 11 3 9

Find ⃗ 𝑡 How about:

(e1,e2,e3) are “small” numbers Easy!

𝒕𝟐 𝒕𝟑 𝟔 𝟐 𝟒 𝟕 𝟑 𝟐 + 𝑓* 𝑓# 𝑓@ = 11 3 9

Very hard! in large dimensions

Solving Noisy Linear Equations

Learning with Errors (LWE)

Find 𝒕

(A, 𝒕A+e)

𝒇 ∈ 𝑎!

": random “small” error vector)

Decisional LWE: LWE:

(A, b) (A, sA+𝑓)

(b uniformly random)

≈

c

(A ∈ 𝑎!

"#$

s ∈ 𝑎!

" random “small” secret vector

[Regev05, following BFKL93, Ale03]

“Decisional LWE is as hard as LWE”.

very hard!

Basic (Secret-key) Encryption

• Secret key sk = Uniformly random vector s Î 𝑎%

&

• Encryption Encs(m): // mÎ {0,1}

– Sample uniformly random a Î 𝑎%

&, “short” noise e Î 𝑎

– The ciphertext c = (a, b = áa, sñ + e + m 𝑟/2 )

n = security parameter, q = “small” prime [Regev05]

• Decryption Decsk(c): Output Roundq/2(b − áa, sñ mod q)

// correctness as long as |e| < q/4

Basic (Secret-key) Encryption

[Regev05]

This is an incredibly cool scheme. In particular, additively homomorphic.

𝒅 = (a, b = áa, sñ + e + m 𝑟/2 ) 𝒅′ = (a′ , b′ = áa′, sñ + e′ + m′ 𝑟/2 ) 𝒅 + 𝒅′ = (a+a′ , b+ b′ = á a +a′, sñ + (e+e′) + (m+m′) 𝑟/2 )

+ In words: 𝑑 + 𝑑′ is an encryption of m+m′ (mod 2)

Public-key Encryption

[Regev05]

Here is a crazy idea. Public key has an encryption of 0 (call it 𝑑A) and an encryption of 1 (call it 𝑑*). If you want to encrypt 0, output 𝑑A and if you want to encrypt 1, output 𝑑*. Well, turns out to be a crazy bad idea. If only we could produce fresh encryptions of 0 or 1 given just the pk…

Public-key Encryption

[Regev05]

Here is another crazy idea. Public key has many encryptions of 0 and an encryption

• f 1 (call it 𝑑*).

This one turns out to be a crazy good idea. If you want to encrypt 0, output a random linear combination of the 0-encryptions. If you want to encrypt 1, output a random linear combination of the 0-encryptions plus 𝑑*.

Public-key Encryption

• Secret key sk = Uniformly random vector s Î 𝑎%

& [Regev05]

• Public key pk: for 𝑗 𝑔𝑠𝑝𝑛 1 𝑢𝑝 𝑙 = 𝑞𝑝𝑚𝑧(𝑜)

𝒅𝟏 = (𝒃𝟏, 𝒃𝟏, 𝒕 + 𝑓( + 𝑟 2 ), 𝒅𝒋 = (𝒃𝒋, 𝒃𝒋, 𝒕 + 𝑓*) Security: decisional LWE + “Leftover Hash Lemma”

• Encrypting a bit 𝑛: pick 𝑙 random bits 𝑠

+, … , 𝑠,

D

*-+ ,

𝑠*𝒅𝒋 + 𝑛 E 𝒅𝟏 Correctness: additive homomorphism

We saw: Constructions of Public-Key Encryption

1: Trapdoor Permutations (RSA) 2: Quadratic Residuosity/Goldwasser-Micali 3: Diffie-Hellman/El Gamal 4: Learning with Errors/Regev

Practical Considerations

I want to encrypt to Bob. How do I know his public key? Public-key Infrastructure: a directory of identities together with their public keys. Needs to be “authenticated”:

• therwise Eve could replace Bob’s pk with her own.

Practical Considerations

Public-key encryption is orders of magnitude slower than secret-key encryption.

• 1. We just showed how to encrypt bit-by-bit! Super-

duper inefficient.

• 2. Exponentiation takes 𝑃(𝑜#) time as opposed to

typically linear time for secret key encryption (AES).

• 3. The 𝑜 itself is large for PKE (RSA: 𝑜 ≥ 2048)

compared to SKE (AES: 𝑜 = 128). Can solve problem 1 and minimize problems 2&3 using hybrid encryption.

Hybrid Encryption

To encrypt a long message 𝑛 (think 1 GB): Pick a random key K (think 128 bits) for a secret- key encryption Encrypt K with the PKE: 𝑄𝐿𝐹. 𝐹𝑜𝑑(𝑞𝑙, 𝐿) Encrypt m with the SKE: SKE. 𝐹𝑜𝑑(𝐿, 𝑛) To decrypt: recover 𝐿 using 𝑡𝑙. Then using 𝐿, recover 𝑛

Next Lecture: Digital Signatures