The One-Time Pad (Vernam’s Cipher)

• In 1917, Vernam patented a cipher now called the one-time pad that obtains perfect secrecy. • There was no proof of this fact at the time. • 25 years later, Shannon introduced the notion of perfect secrecy and demonstrated that the one-time pad achieves this level of security. The One-Time Pad Scheme

1. Fix an integer ℓ > 0. Then the message space 푀, key space 퐾, and ciphertext space 퐶 are all equal to 0,1 ℓ. 2. The key-generation algorithm 퐺푒푛 works by choosing a string from 퐾 = 0,1 ℓ according to the uniform distribution. 3. Encryption 퐸푛푐 works as follows: given a key 푘 ∈ 0,1 ℓ, and a message 푚 ∈ 0,1 ℓ,output 푐 ≔ 푘 ⊕ 푚. 4. Decryption 퐷푒푐 works as follows: given a key 푘 ∈ 0,1 ℓ, and a ciphertext 푐 ∈ 0,1 ℓ, output 푚 ≔ 푘 ⊕ 푐. Security of OTP

Theorem: The one-time pad encryption scheme is perfectly secure. Proof

Proof: Fix some distribution over 푀 and fix an arbitrary 푚 ∈ 푀 and 푐 ∈ 퐶. For one-time pad: Pr 퐶 = 푐| 푀 = 푚 = Pr 푀 ⊕ 퐾 = 푐 | 푀 = 푚 1 = Pr 푚 ⊕ 퐾 = 푐 = Pr 퐾 = 푚 ⊕ 푐 = 2ℓ Since this holds for all distributions and all 푚, we have that for every probability distribution over 푀, every 푚0, 푚1 ∈ 푀 and every 푐 ∈ 퐶 1 Pr 퐶 = 푐 푀 = 푚 ] = = Pr 퐶 = 푐|푀 = 푚 0 2ℓ 1 Drawbacks of OTP

• Key length is the same as the message length. – For every bit communicated over a public channel, a bit must be shared privately. – We will see this is not just a problem with the OTP scheme, but an inherent problem in perfectly secret encryption schemes. • Key can only be used once. – You will see in the homework that this is also an inherent problem. Some Examples

• Is the following scheme perfectly secret? • Message space 푴 = {0,1, … , 푛 − 1}. Key space 푲 = {0,1, … , 푛 − 1}. • Gen() chooses a key 푘 at random from 푲.

• Enc푘 푚 returns 푚 + 푘. • 퐷푒푐푘 푐 returns 푐 − 푘.

Some Examples

• Is the following scheme perfectly secret? • Message space 푴 = {0,1, … , 푛 − 1}. Key space 푲 = {0,1, … , 푛 − 1}. • Gen() chooses a key 푘 at random from 푲.

• Enc푘 푚 returns 푚 + 푘 푚표푑 푛. • 퐷푒푐푘 푐 returns 푐 − 푘 푚표푑 푛.

Limitations of Perfect Secrecy

Theorem: Let (퐺푒푛, 퐸푛푐, 퐷푒푐) be a perfectly- secret encryption scheme over a message space 푴, and let 푲 be the key space as determined by 퐺푒푛. Then 푲 ≥ |푴|.

Proof

Proof (by contradiction): We show that if 푲 < |푴| then the scheme cannot be perfectly secret. • Assume 푲 < 푴 . Consider the uniform distribution over 푴 and let 푐 ∈ 푪. • Let 푴(푐) be the set of all possible messages which are possible decryptions of 푐.

푴 푐 ≔ 푚 푚 = 퐷푒푐푘 푐 푓표푟 푠표푚푒 푘 ∈ 푲} Proof

푴 푐 ≔ { 푚 | 푚 = 퐷푒푐푘 푐 푓표푟 푠표푚푒 푘 ∈ 푲} • 푴 푐 ≤ |푲|. Why? • Since we assumed 푲 < |푴|, this means that there is some 푚′ ∈ 푴 such that 푚′ ∉ 푴 푐 . • But then Pr 푀 = 푚′| 퐶 = 푐 = 0 ≠ Pr[푀 = 푚′] And so the scheme is not perfectly secret. Shannon’s Theorem

Let (퐺푒푛, 퐸푛푐, 퐷푒푐) be an encryption scheme with message space 푴, for which 푴 = 푲 = |푪|. The scheme is perfectly secret if and only if: 1. Every key 푘 ∈ 푲 is chosen with equal probability 1/|푲| by algorithm 퐺푒푛. 2. For every 푚 ∈ 푴 and every 푐 ∈ 푪, there exists a unique key 푘 ∈ 푲 such that 퐸푛푐푘(푚) outputs 푐. **Theorem only applies when 푴 = 푲 = |푪|. Some Examples

• Is the following scheme perfectly secret? • Message space 푴 = {0,1, … , 푛 − 1}. Key space 푲 = {0,1, … , 푛 − 1}. • Gen() chooses a key 푘 at random from 푲.

• Enc푘 푚 returns 푚 + 푘. • 퐷푒푐푘 푐 returns 푐 − 푘.

Some Examples

• Is the following scheme perfectly secret? • Message space 푴 = {0,1, … , 푛 − 1}. Key space 푲 = {0,1, … , 푛 − 1}. • Gen() chooses a key 푘 at random from 푲.

• Enc푘 푚 returns 푚 + 푘 푚표푑 푛. • 퐷푒푐푘 푐 returns 푐 − 푘 푚표푑 푛.

The Computational Approach to Security “An encryption scheme is secure if no adversary learns meaningful information about the plaintext after seeing the ciphertext”

How do you formalize learns meaningful information?

The Computational Approach to Security • Meaningful Information about plaintext m: – 푓(푚) for an efficiently computable function 푓 • Learn Meaningful Information from the ciphertext: – An efficient algorithm that can output 푓(푚) after seeing 푐 but could not output 푓 푚 before seeing 푐. • Learn Meaningful Information: – The change in probability that an efficient algorithm can output 푓(푚) after seeing 푐 and can output 푓 푚 before seeing 푐 is significant.

Note:

• The intuitive definition from the previous slide is known as “semantic security.” • We will first see a different, simpler definition known as indistinguishability. • Later we will see that the two definitions are provably equivalent. The Computational Approach

Two main relaxations: 1. Security is only guaranteed against efficient adversaries that run for some feasible amount of time. 2. Adversaries can potentially succeed with some very small probability. Security Parameter

• Integer valued security parameter denoted by n that parameterizes both the cryptographic schemes as well as all involved parties. • When honest parties initialize a scheme, they choose some value n for the security parameter. • Can think of security parameter as corresponding to the length of the key. • Security parameter is assumed to be known to any adversary attacking the scheme. • View run time of the adversary and its success probability as functions of the security parameter. Polynomial Time

• Efficient adversaries = Polynomial time adversaries – There is some polynomial 푝 such that the adversary runs for time at most 푝(푛) when the security parameter is 푛. – Honest parties also run in polynomial time. – The adversary may be much more powerful than the honest parties. Negligible

• Small probability of success = negligible probability – A function 푓 is negligible if for every polynomial 푝 and all sufficiently large values of 푛 it holds that 1 푓 푛 < . 푝(푛) – Intuition, 푓 푛 < 푛−푐 for every constant 푐, as 푛 goes to infinity. Negligible