Introduction to Modern Cryptography Mihir Bellare1 Phillip Rogaway2 May 11, 2005 1 Department of Computer Science and Engineering, University of California at San Diego, La Jolla, CA 92093, USA. [email protected], http://www-cse.ucsd.edu/users/mihir 2 Department of Computer Science, Kemper Hall of Engineering, University of California at Davis, Davis, CA 95616, USA; and Department of Computer Science, Faculty of Science, Chiang Mai University, Chiang Mai, 50200 Thailand. [email protected], http://www.cs.ucdavis.edu/∼rogaway 2 Preface This is a set of class notes that we have been developing jointly for some years. We use them for cryptography courses that we teach at our respective institutions. Each time one of us teaches the class, he takes the token and updates the notes a bit. The process has resulted in an evolving document that has lots of gaps, as well as plenty of “unharmonized” parts. One day it will, with luck, be complete and cogent. The viewpoint taken throughout these notes is to emphasize the theory of cryptography as it can be applied to practice. This is an approach that the two of us have pursued in our research, and it seems to be a pedagogically desirable approach as well. We would like to thank the following students of past versions of our courses who have pointed out errors and made suggestions for changes: Andre Barroso, Keith Bell, Kostas Bimpikis, Alexan- dra Boldyreva, Dustin Boswell, Brian Buesker, Michael Burton, Chris Calabro, Sashka Davis, Alex Gantman, Bradley Huffaker, Hyun Min Kang, Vivek Manpuria, Chanathip Namprempre, Adriana Palacio, Wenjing Rao, Fritz Schneider, Juliana Wong. We welcome further corrections, comments and suggestions. Mihir Bellare San Diego, California USA Phillip Rogaway Davis, California USA c Mihir Bellare and Phillip Rogaway, 1997–2005. Contents 1 Introduction 7 1.1Goalsandsettings..................................... 7 1.2 Other goals . ................................... 13 1.3Whatcryptographyisabout................................ 16 1.4 Approaches to the study of cryptography . ....................... 18 1.5WhatbackgrounddoIneed?............................... 25 1.6Problems.......................................... 25 2 Classical Encryption 29 2.1 Substitution ciphers . ................................... 29 2.2One-time-padencryption.................................. 33 2.3Problems.......................................... 36 3 Blockciphers 39 3.1Whatisablockcipher?................................... 39 3.2DataEncryptionStandard(DES)............................. 40 3.3 Key recovery attacks on blockciphers ........................... 45 3.4Iterated-DESandDESX.................................. 47 3.5AdvancedEncryptionStandard(AES).......................... 50 3.6 Limitations of key-recovery based security . ....................... 54 3.7Problems.......................................... 55 4 Pseudorandom Functions 59 4.1 Function families . ................................... 59 4.2 Random functions and permutations ........................... 60 4.3 Pseudorandom functions . ............................... 64 4.4Pseudorandompermutations............................... 67 4.5Modelingblockciphers................................... 69 4.6Exampleattacks...................................... 71 4.7 Security against key recovery ............................... 73 4.8 The birthday attack . ................................... 77 4.9ThePRP/PRFswitchinglemma............................. 78 4.10 Unix one-way function ................................... 82 4.11Historicalnotes....................................... 87 4.12Problems.......................................... 87 3 4 CONTENTS 5 Symmetric Encryption 93 5.1Symmetricencryptionschemes.............................. 93 5.2Somesymmetricencryptionschemes........................... 95 5.3Issuesinprivacy......................................100 5.4 Indistinguishability under chosen-plaintext attack . ...................102 5.5Examplechosen-plaintextattacks.............................106 5.6Semanticsecurity......................................109 5.7SecurityofCTRmodes..................................111 5.8SecurityofCBCwitharandomIV............................123 5.9 Indistinguishability under chosen-ciphertext attack ...................127 5.10Examplechosen-ciphertextattacks............................129 5.11Historicalnotes.......................................132 5.12Problems..........................................133 6 Hash Functions 139 6.1 The hash function SHA1 . ...............................139 6.2 Collision-resistant hash functions . ...........................141 6.3 Collision-finding attacks . ...............................144 6.4 One-wayness of collision-resistant hash functions . ...................147 6.5TheMDtransform.....................................149 7 Message Authentication 155 7.1Thesetting.........................................155 7.2 Privacy does not imply authenticity ...........................158 7.3 Syntax for message authentication . ...........................159 7.4Definitionsofsecurity...................................160 7.5Examples..........................................164 7.6 The PRF-as-a-MAC paradigm . ...........................167 7.7TheCBCMAC.......................................168 7.8Theuniversal-hashingapproach..............................171 7.9Problems..........................................172 8 Authenticated Encryption 177 9 Computational Number Theory 179 9.1Thebasicgroups......................................179 9.2Algorithms.........................................181 9.3Cyclicgroupsandgenerators...............................186 9.4Squaresandnon-squares..................................190 9.5Groupsofprimeorder...................................195 9.6HistoricalNotes.......................................196 9.7 Exercises and Problems . ...............................196 CONTENTS 5 10 Number-Theoretic Primitives 197 10.1 Discrete logarithm related problems ...........................197 10.2Thechoiceofgroup....................................201 10.3TheRSAsystem......................................204 10.4Historicalnotes.......................................208 10.5 Exercises and Problems . ...............................208 11 Asymmetric Encryption 211 11.1Asymmetricencryptionschemes..............................211 11.2Notionsofsecurity.....................................213 11.3Oneencryptionqueryormany?..............................216 11.4Hybridencryption.....................................220 11.5ElGamalschemeanditsvariants.............................231 12 Digital signatures 237 12.1Digitalsignatureschemes.................................237 12.2Anotionofsecurity....................................238 12.3RSAbasedsignatures...................................240 13 Authenticated Key Exchange 257 14 The Asymptotic Approach 259 15 Interactive Proofs and Zero Knowledge 261 15.1Introduction.........................................261 15.2 Interactive functions and the accepting probability ...................265 15.3Proofsoflanguage-membership..............................267 15.4 NP proof-systems.....................................271 15.5 Exercises and Problems . ...............................272 A The Birthday Problem 273 B Information-Theoretic Security 275 6 CONTENTS Chapter 1 Introduction Historically, cryptography arose as a means to enable parties to maintain privacy of the information they send to each other, even in the presence of an adversary with access to the communication channel. While providing privacy remains a central goal, the field has expandeded to encompass many others, including not just other goals of communication security, such as guaranteeing in- tegrity and authenticity of communications, but many more sophisticated and fascinating goals. Once largely the domain of the military, cryptography is now in widespread use, and you are likely to have used it even if you don’t know it. When you shop on the Internet, for example to buy abookatwww.amazon.com, cryptography is used to ensure privacy of your credit card number as it travels from you to the shop’s server. Or, in electronic banking, cryptography is used to ensure that your checks cannot be forged. Cryptography has been used almost since writing was invented. For the larger part of its history, cryptography remained an art, a game of ad hoc designs and attacks. Although the field retains some of this flavor, the last twenty-five years have brought in something new. The art of cryptography has now been supplemented with a legitimate science. In this course we shall focus on that science, which is modern cryptography. Modern cryptography is a remarkable discipline. It is a cornerstone of computer and communi- cations security, with end products that are imminently practical. Yet its study touches on branches of mathematics that may have been considered esoteric, and it brings together fields like number theory, computational-complexity theory, and probabiltity theory. This course is your invitation to this fascinating field. 1.1 Goals and settings Modern cryptography addresses a wide range of problems. But the most basic problem remains the classical one of ensuring security of communication across an insecure medium. To describe it, let’s introduce the first two members of our cast of characters: our sender, S, and our receiver, R. (Sometimes people call these characters Alice, A, and Bob, B. Alice and Bob figure in many works on cryptography. But we’re going to want the