Semantic Security for the Wiretap Channel Stefano Tessaro MIT - PowerPoint PPT Presentation

Semantic Security for the Wiretap Channel Stefano Tessaro MIT Joint work with Mihir Bellare (UCSD) Alexander Vardy (UCSD)

Cryptography today is (mainly) based on computational assumptions. We wish instead to base cryptography on a physical assumption. Presence of channel noise

Noisy channel assumption has been used previously to achieve oblivious transfer , commitments [CK88,C97] But we return to an older and more basic setting …

Wyner’s Wiretap Model [W75,CK78] 𝐷 𝐷′ 𝑁 𝐅𝐎𝐃 ChR 𝐄𝐅𝐃 𝑁′ ChA 𝑎(𝑁) Goals: Message privacy + correctness Assumption: ChA is “noisier” than ChR Encryption is keyless Security is information-theoretic Additional goal: Maximize rate 𝑆 = |𝑁|/|𝐷|

Channels A channel is a randomized map Ch: 0,1 → 0,1 Ch … , 𝑦 4 , 𝑦 3 , 𝑦 2 , 𝑦 1 𝑧 1 , 𝑧 2 , 𝑧 3 , 𝑧 4 , … 𝑧 1 = Ch(𝑦 1 ) We extend the domain of Ch to {0,1} ∗ via 𝑧 2 = Ch(𝑦 2 ) Ch 𝑦 1 𝑦 2 … 𝑦 𝑜 = Ch 𝑦 1 Ch 𝑦 2 … Ch 𝑦 𝑜 𝑧 3 = Ch(𝑦 3 ) 𝑧 4 = Ch(𝑦 4 ) Ch 𝑐 = 𝑐 Clear channel: Binary symmetric channel with error probability 𝒒: 𝑐 with prob. 1 − 𝑞 BSC 𝑞 𝑐 = 1 − 𝑐 with prob. 𝑞

Wyner’s Wiretap Model – More concretely 𝐷 BSC 𝑞 𝑁 𝐅𝐎𝐃 𝐄𝐅𝐃 𝑁′ BSC 𝑟 𝑎(𝑁) Assumption: 𝑞 < 𝑟 ≤ 1 2

Wiretap channel – Realization Increasing practical interest: Physical-layer security Very low power Very short distance 010110 … . e.g. credit card # Large distance Degraded signal

Wiretap Channel – Previous work 35 years of previous work: Hundreds of papers/books on wiretap security within the information theory & coding community Two major drawbacks: 1. Improper privacy notions Entropy-based notions Only consider random messages 2. No polynomial-time schemes with optimal rate Non-explicit decryption algorithms Weaker security This work: We fill both gaps

Our contributions 1. New security notions for the wiretap channel model:  Semantic security, distinguishing security following [GM82]  Mutual-information security  Equivalence among the three 2. Polynomial-time encryption scheme:  Semantically secure  Optimal rate

Outline 1. Security notions 2. Polynomial-time scheme

Prior work – Mutual-information security 𝐷 BSC 𝑞 𝐅𝐎𝐃 𝐄𝐅𝐃 𝑁′ 𝑁 𝑎(𝑁) BSC 𝑟 Uniformly distributed! 𝐈 𝑁|𝑎(𝑁) = 𝐈 𝑁 𝑎(𝑁) − 𝐈 𝑎(𝑁) Definition: 𝐉 𝑁; 𝑎(𝑁) = 𝐈 𝑁 − 𝐈 𝑁|𝑎(𝑁) Random Mutual-Information Security (MIS-R): 𝐉 𝑁; 𝑎(𝑁) = 𝐨𝐟𝐡𝐦 𝐈 𝑁 = P 𝑁 (𝑛) ∙ log 1 P 𝑁 (𝑛) 𝑛

Critique – Random messages 𝐷 BSC 𝑞 𝐅𝐎𝐃 𝐄𝐅𝐃 𝑁′ 𝑁 𝑎(𝑁) BSC 𝑟 Uniformly distributed! Common misconception: c.f. e.g. [CDS11] “[… ] the particular choice of the distribution on 𝑁 as a uniformly random sequence will cause no loss of generality . [ … ] the transmitter can use a suitable source-coding scheme to compress the source to its entropy prior to the transmission, and ensure that from the intruder’s point of view, 𝑁 is uniformly distributed. ” Wrong! No universal (source-independent) compression algorithm exists! We want security for arbitrary message distributions, following [GM82]!

Mutual-information security, revisited Random Mutual-Information Security (MIS-R) 𝐉 𝑁; 𝑎(𝑁) = 𝐨𝐟𝐡𝐦 New: Mutual-Information Security (MIS) max P 𝑁 𝐉 𝑁; 𝑎(𝑁) = 𝐨𝐟𝐡𝐦 Maximize over all message distributions Critique: Mutual information is hard to work with / interpret!

Semantic security Maximize over all functions + message distributions Semantic Security (SS) max 𝑔,P 𝑁 max Pr [𝑩(𝑎(𝑁)) = 𝑔(𝑁)] 𝑩 − max Pr [𝑻 = 𝑔(𝑁)] = 𝐨𝐟𝐡𝐦 𝑻 BSC 𝑟 𝑎(𝑁) 𝐅𝐎𝐃 𝑁 𝑻 𝑔 𝑁 = 𝑩 𝑍 𝑔(𝑁) 𝑔 = 𝑔(𝑁) 𝑍 0/1 0/1

Distinguishing security Uniform random bit 𝐶 Distinguishing Security (DS) 𝑩,𝑁 0 ,𝑁 1 Pr[𝑩 𝑁 0 , 𝑁 1 , 𝑎 𝑁 B max = B] = 1/2 + 𝐨𝐟𝐡𝐦 Fact: = B] = 1 𝐵,𝑁 0 ,𝑁 1 Pr[A 𝑁 0 , 𝑁 1 , 𝑎 𝑁 B max 2 + 𝐨𝐟𝐡𝐦 ⇔ max 𝑁 0 ,𝑁 1 𝐓𝐄 𝑎 𝑁 0 ; 𝑎 𝑁 1 = 𝐨𝐟𝐡𝐦. 𝐓𝐄 𝑌; 𝑍 = 1 2 P 𝑌 𝑤 − P 𝑍 𝑤 𝑤

Relations Theorem. MIS, DS, SS are equivalent. DS MIS MIS-R SS

Outline 1. Security notions 2. Polynomial-time scheme

Polynomial-time scheme 𝐷 BSC 𝑞 𝐅𝐎𝐃 𝐄𝐅𝐃 𝑁 𝑁′ BSC 𝑟 𝑎(𝑁) Goal: Polynomial-time 𝐅𝐎𝐃 and 𝐄𝐅𝐃 which satisfy: 1) Correctness: Pr 𝑁 ≠ 𝑁 ′ = 𝐨𝐟𝐡𝐦 2) Semantic security 3) Optimal rate  We observe that fuzzy extractors of [DORS08] can be used to achieve 1 + 2. (Also: [M92,…] )  [HM10,MV11] Constructions achieving 1 + 3 or 2 + 3. This work: First polynomial-time scheme achieving 1 + 2 + 3

What is the optimal rate? 𝐷 BSC 𝑞 𝐅𝐎𝐃 𝐄𝐅𝐃 𝑁 𝑁′ BSC 𝑟 𝑎(𝑁) Definition: Rate 𝑆 = 𝑁 /|𝐷| ℎ 𝑦 = −𝑦 log 𝑦 − (1 − 𝑦) log(1 − 𝑦) Previous work: [L77] No MIS-R secure scheme can have rate higher than ℎ 𝑟 − ℎ(𝑞) − 𝑝(1) . Our scheme: Rate ℎ 𝑟 − ℎ 𝑞 − 𝑝(1) Hence, ℎ 𝑟 − ℎ(𝑞) − 𝑝(1) is the optimal rate for all security notions!

Our encryption scheme 𝑛 ≤ 𝑙 − 1 − ℎ 𝑟 + 𝑝(1) 𝑜 𝐅𝐎𝐃 𝑇 (𝑁) 𝑛 bits 𝑙 − 𝑛 bits 𝑁 𝑙 bits GF 2 𝑙 multiplication 𝑇 ≠ 0 𝑙 𝑌 Public seed Poly-time + injective + linear 𝐅 𝐷 𝑜 bits

Our encryption scheme – Security Theorem. 𝐅𝐎𝐃 is semantically secure . 𝑁 𝑇 ≠ 0 Challenge: Ciphertext distribution 𝑌 depends on combinatorial properties of E . 𝐅 𝐷 Two steps: 1. Reduce semantic security to random-message security. 2. Prove random-message security.

Our encryption scheme – Decryptability and rate 𝑛 = 𝑙 − 1 − ℎ 𝑟 + 𝑝(1) 𝑜 𝐄𝐅𝐃 𝑇 (𝐷′) : 𝑛 𝐅𝐎𝐃 𝑇 (𝑁) : 𝑙 − 𝑛 𝑛 𝑜 = ℎ 𝑟 − ℎ 𝑞 − 𝑝(1) Optimal rate: 𝑁 𝐷′ 𝑇 ≠ 0 𝐄 𝑌 𝑌′ 𝐅 𝑇 −1 𝐷 𝑁′ 𝑜 Observation. If (𝐅, 𝐄) are encoder/decoder of ECC for BSC 𝑞 , then correctness holds. Optimal choice: Concatenated codes [F66] , polar codes [A09] : 𝑙 = 1 − ℎ 𝑞 − 𝑝(1) 𝑜

Concluding remarks Summary:  New equivalent security notions for the wiretap setting: DS, SS, MIS.  First polynomial-time scheme achieving these security notions with optimal rate.  Our scheme is simple, modular, and efficient.

Concluding remarks Summary:  New equivalent security notions for the wiretap setting: DS, SS, MIS.  First polynomial-time scheme achieving these security notions with optimal rate.  Our scheme is simple, modular, and efficient. Additional remarks:  We provide a general and concrete treatment.  Scheme can be used on larger set of channels.

Concluding remarks Summary:  New equivalent security notions for the wiretap setting: DS, SS, MIS.  First polynomial-time scheme achieving these security notions with optimal rate.  Our scheme is simple, modular, and efficient. Additional remarks:  We provide a general and concrete treatment.  Scheme can be used on larger set of channels. Thank you!