Probabilistic Encryption & How To Play Mental Poker Keeping Secret All Partial Information Shaft Goldwasser * and Silvio Micali ** Computer Science Department University of California - Berkeley I. Introduction We would like to point out two basic weaknesses of this approach: This paper proposes an Encryption Scheme 1) The fact that f is a trapdoor function does that possess the following property: not rule out the possibility of computing x An adversary, who knows the encryption from ff (x) when x is of a special form. algorithm and is given the cyphertext, can- Usually messages do not consist of numbers not obtain any information about the clear- chosen at random but possess more struc- text. ture. Such structural information may help Any implementation of a Public Key Cryptosys- in decoding. For example, a function f, tem, as proposed by Diffie and Hellman in [8], which is hard to invert on a generic input, should possess this property. could conceivably be easy to invert on the ASCII representations of English sentences. Our Encryption Scheme follows the ideas in 2) The fact that f is a trapdoor function does the number theoretic implementations of a not rule out the possibility of easily com- Public Key Cryptosystem due to Rivest, Shamir puting some partial information about z and Adleman [13], and Rabin [12]. (even every other bit of x) from f (z). The danger in the case that z is the ASCII Security is based on Complexity Theory and representation of an English sentence is the intractability of some problems in number self evident. Encrypting messages in a way theory such as factoring, index finding and that ensures the secrecy of all partial infor- deciding whether numbers are quadratic resi- mation is an extremely important goal in dues with respect to composite mvduli is Cryptography. The importance of this point assumed. In this context, impossibility means of view is particularly apparent if we want computational infeasibility and proving that a to use encryption to play card games over problem is hard means to show it equivalent to the telephone. If the suit or color of a card one of the above mentioned problems. could be compromised the whole game could be invalid. The key idea in both the RSA scheme and the Rabin scheme is the selection of an Though no one knows how to break the RSA or appropriate trapdoor function; an easy to the Rabin scheme, in none of these schemes is evaluate function f such that x is not easily it proved that decoding is hard without any computable from f(x), unless some extra assumptions made on the message space. Rabin information is known. To encrypt a message shows that, in his scheme, decoding is hard for m, one simply evaluates f (m). an adversary if the set of possible messages has some density property. The novelty of our contribution consists of Thin research was supported by * NSF Grant MCS-79-037667 1. The notion of Trapdoor Functions is ** fellowship from Consiglio Nazionale delle Ricerche - replaced by Probabilistic Encryption. To Italy and in part by NSF Grant MCS-79-037667 encrypt each message we make use of a fair coin. The encoding of each message will depend on the message plus the result of a Permission to copy without fee all or part of this material is granted provided that the copies are not made or distributed for direct sequence of coin tosses. Consequently, commercial advantage, the ACM copyright notice and the title of the there are many possible encodings for each publication and its date appear, and notice is given that copying is by message, llowever, messages are always permission of the Association for Computing Machinery. To copy uniquely decodable.~ otherwise, or to republish, requires a fee and/or specific permission. IProbabilistic Encryption is completely different from the technique of apl~eDcling random bits to a message as © 1982 ACM0-89791-067-2/82/005/0365 $00.75 suggested in U?.] and [16]. 365 2. Decoding is easy for the legal receiver of a ingenious paper [8]. Let M be a finite message message, but provably hard for an adver- space, A, B,... be users, and let m e M denote a sary. Therefore the spirit of a trapdoor message. Let EA:M~M be A's encryption func- function is maintained. In addition, in our tion, which is ideally bijective, and D A be A's scheme, without imposing any restrictions decryption function such that DA(EA(m)) = m on the message space, we can prove that for all m e M. In a Public Key Cryptosystem E A decoding is equivalent to deciding qua- is placed in a public file, and user A keeps DA dratic residuosity modulo composite private. D A should be difficult to compute numbers. knowing only E A. To send message m to A, B takes E A from the public file, computes EA(m ) 3. No Partial Information about an encrypted and sends this message to A. A easily computes message could be obtained by an adver- DA(EA(m)) to obtain m. sary. Assume that the message space has an associated probability distribution and that, with respect to this distribution, an 2.2 The RSA scheme and the Rabin scheme easy to compute predicate P (such as "the The two implementations of a Public Key exclusive or of all the bits in the message is Cryptosystem most relevant and inspiring for 1") has probability p to be true. Let p ~ .5 this paper are the RSA scheme [13], due to without any loss of generality. Then, Rivest, Shamir and Adleman, and its particular- without any special ability, an adversary, ization suggested by Rabin [ 12]. given the cyphertext~ can always guess that P is true for the cleartext, and be The key idea in both the RSA scheme and correct with probabilityp. the Rabin scheme consists in the selection of an appropriate number theoretic trapdoor Based on the assumption that deciding qua- function. In the RSA scheme, user A selects/,~, dratic residuosity modulo composite the product of two large primes p I and p 2 and a numbers is hard, we prove that an adver- number s such that s and 9(N) are relatively sary cannot guess correctly with probabil- prime , where ~ is the Euler totient function. A ity p+e,from the cyphertext, whether the puts N and s in a public file and keeps the fac- cleartext satisfies the predicate P, where e torization of N private. Let ZN'= ~ z I is a non negligible positive real number. i ~ z ~ N-i and z and N are relatively primel. For every message m eZN', EA(rn)=m s mod Probabilistic Encryption has been useful for the N. Clearly, the ability to take s th roots rood N solution of Mental Poker. The problem whether implies the ability to decode. A, who knows the it is possible to play a "fair" game of Mental factorization of N, can easily take s th roots mod Poker has been raised by Robert Floyd. N. No efficient way to take sth roots rood Nis Shamir, Rivest and Adleman proposed an known when the factorlzation of N is unknown. elegant solution to this problem in [14] using commutative encryption functions, but they About the RSA scheme aabin remarks that, could not prove that partial information could for all we know, inverting the function z ~ rood not be compromised using their scheme. N may be a hard problem in general, and yet Indeed, several problems in the implementa- easy for a large percentage of the z's. tion of their scheme have been pointed out by He suggests to modify the RSA scheme by Lipton in [ 10]. choosing s=2. Thus, for all users A, EA(Z ) = z 2 rood N. Notice that E A is a 4-1 function because We present a solution for Mental Poker, for our N is the product of two primes. In fact, which we can prove, based on the assumption every quadratic residue rood N, i.e every q that factoring and deciding quadratic such that q~z 2 mod N for some z eZN', has residuosity modulo composite numbers is hard, four square roots mod N: ±z mod N and ±y that not a single bit of information about a card rood N. As A knows the factorization of N, upon which should remain hidden can be discovered. receiving the encrypted message m 2 mod N, he Our solution does not use commutative encryp- could compute its four square roots and get the tion functions. message rn. The ambiguity in decoding could be eliminated, for example, by sending the first 2. The ,Security of a Public Key Cryptosystem. 20 digits of rn in addition to m 2 rood N. Such All the number theoretic notation used in extra information cannot effectively help in this section will be defined in section 3.1. decoding: we could always guess the first 20 digits of m. 2.1 What is a Public Key Cryptosystem? The following theorem shows how hard is it The concept of a Public Key Cryptosystem to invert Rabin's function z 2 mod N. was introduced by Diffie and Hellman in their Theorem (Rabin): If for i~ of the q's quadratic 366 residues mod N one could find one square root in ZN*, the ability to decode 1% of all messages of q, then one could factor N in Random Poly- does not yield a random polynomial time algo- nomial Time. rithm for factoring. The theorem follows from the following By "sparse" we mean that for a randomly lemma that we state without proof.