Security Proofs ---- Asymmetric Encryption Introduction without - PDF document

Summary Summary Security Proofs ---- Asymmetric Encryption Introduction without Redundancy Provable Security Asymmetric Encryption Rennes – January 2004 New Schemes Joint work with Duong Hieu Phan David Pointcheval David Pointcheval David Pointcheval David Pointcheval David Pointcheval CNRS-ENS, Paris, France CNRS-ENS, Paris, France CNRS-ENS, Paris, France CNRS-ENS, Paris, France CNRS-ENS, Paris, France David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy Encryption / decryption Encryption / decryption Summary Summary attack attack Granted Bob’s public key, r e t y s e c M Alice can lock the safe, s i with the message inside . . … / . ( encrypt the message ) Introduction Provable Security Asymmetric Encryption New Schemes David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy Encryption / decryption Encryption / decryption Encryption / decryption Encryption / decryption attack attack attack attack Granted Bob’s public key, Granted Bob’s public key, e t e t s e c r s e c r M y M y Alice can lock the safe, Alice can lock the safe, s s i i with the message inside with the message inside . . … / . . … / . . ( encrypt the message ) ( encrypt the message ) Excepted Bob, granted his private key (Bob can decrypt) Alice sends the safe to Bob Alice sends the safe to Bob no one can unlock it no one can unlock it ( impossible to break ) ( impossible to break ) David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy

Kerckhoffs’ Principles (1) Kerckhoffs’ Principles (1) Kerckhoffs’ Principles (2) Kerckhoffs’ Principles (2) In 1883, in “La Cryptographie Militaire” Il faut qu’il n’exige pas le secret, et qu’il puisse Kerckhoffs wrote: sans inconvénient tomber entre les mains de Le système doit être matériellement, sinon l’ennemi mathématiquement, indéchiffrable Compromise of the system should not inconvenience The system should be, if not theoretically the correspondents unbreakable, unbreakable in practice David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy Symmetric Encryption Symmetric Encryption Kerckhoffs’ Principles (3) Kerckhoffs’ Principles (3) Principles 2 and 3 define the concept of the symmetric cryptography: La clef doit pouvoir en être communiquée et Encryption Algorithm, � Decryption Algorithm, � retenue sans le secours de notes écrites, et être k k changée ou modifiée au gré des correspondants the key should be rememberable without notes and � � c m m should be easily changeable Security : heuristic Security = secrecy: etc … 1 st Principle impossible to recover m from c only (without k ) David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy Integer Factoring and RSA Asymmetric Cryptography Asymmetric Cryptography Integer Factoring and RSA secrecy One-Way Multiplication/Factorization: Alice Bob Extends 2 nd principle Function authenticity p, q � n = p.q easy (quadratic) Diffie-Hellman 1976 n = p.q � p, q difficult (super-polynomial) Asymmetric Encryption: Bob owns two “keys” A public key (encryption k e ) known by everybody ⇒ (included Alice) so that anybody can encrypt a message for him A private key (decryption k d ) ⇒ known by Bob only to help him to decrypt David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy

Integer Factoring and RSA Integer Factoring and RSA Integer Factoring and RSA Integer Factoring and RSA One-Way One-Way Multiplication/Factorization: Multiplication/Factorization: Function Function p, q � n = p.q easy (quadratic) p, q � n = p.q easy (quadratic) n = p.q � p, q difficult (super-polynomial) n = p.q � p, q difficult (super-polynomial) RSA Function, from � n in � n (with n=pq ) RSA Function, from � n in � n (with n=pq ) for a fixed exponent e Rivest-Shamir-Adleman 1978 for a fixed exponent e Rivest-Shamir-Adleman 1978 x � x e mod n easy (cubic) x � x e mod n easy (cubic) y=x e mod n � x difficult (without p or q ) y=x e mod n � x difficult (without p or q ) RSA Problem x = y d mod n where d = e -1 mod � ( n ) x = y d mod n where d = e -1 mod � ( n ) encryption David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy Integer Factoring and RSA Integer Factoring and RSA Integer Factoring and RSA Integer Factoring and RSA One-Way One-Way Multiplication/Factorization: Multiplication/Factorization: Function Function p, q � n = p.q easy (quadratic) p, q � n = p.q easy (quadratic) n = p.q � p, q difficult (super-polynomial) n = p.q � p, q difficult (super-polynomial) RSA Function, from � n in � n (with n=pq ) RSA Function, from � n in � n (with n=pq ) for a fixed exponent e for a fixed exponent e Rivest-Shamir-Adleman 1978 Rivest-Shamir-Adleman 1978 x � x e mod n easy (cubic) x � x e mod n easy (cubic) y=x e mod n � x difficult (without p or q ) y=x e mod n � x difficult (without p or q ) trapdoor x = y d mod n where d = e -1 mod � ( n ) x = y d mod n where d = e -1 mod � ( n ) difficult key decryption to break David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy Algorithmic Assumptions Algorithmic Assumptions Summary Summary necessary necessary RSA Encryption n=pq : public � ( m ) = m e mod n modulus e : public exponent � ( c ) = c d mod n Introduction d=e -1 mod � ( n ) : private Provable Security Asymmetric Encryption If the RSA problem is easy, New Schemes secrecy is not satisfied: anybody may recover m from c David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy

� � Algorithmic Assumptions Algorithmic Assumptions Proof by Reduction Proof by Reduction sufficient? sufficient? Reduction of a problem �� to an attack Atk : Let � be an adversary that breaks the scheme Security proofs give the guarantee that the Then � can be used to solve � assumption is enough for secrecy: if an adversary can break the secrecy one can break the assumption � “reductionist” proof Extends the 1 st Principle David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy Provably Secure Scheme Provably Secure Scheme Practical Security Practical Security Algorithm Adversary against � To prove the security of a cryptographic scheme, within t one has to make precise within t’ = T ( t ) the algorithmic assumptions some have been presented the security notions to be guaranteed Complexity theory: T polynomial depends on the scheme Exact Security: T explicit a reduction: Practical Security: T small (linear) an adversary can help to break the assumption David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy David Pointcheval – CNRS - ENS Security Proofs and Asymmetric Encryption without Redundancy