DOCSLIB.ORG

Pseudorandom Functions and Permutations

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Pseudorandom Functions and Permutations Introduction Informally, a Pseudorandom function family Pseudorandom functions and (PRF) is a collection of functions which are permutations indistinguishable from random functions. PRFs are enormously useful for cryptography. But they are also useful for several algorithmic applications. 15-859I We’ll show two equivalent characterizations Spring 2003 of PRFs, and give a construction of a PRF from a secure PRG. (Thus we will have that if OWFs exist, then PRFs exist) Notations PRFs: Statistical Test formulation A collection of functions is a set {ƒs}s∈{0,1}* An efficiently computable collection ƒs is p(|s|) q(|s|) where each ƒs:{0,1} → {0,1} , for statistical-test pseudorandom if for every polynomials p(.), q(.). ƒ is efficiently probabilistic polynomial time oracle TM T, computable if there exists a PPT F such that f k g k p(|s|) Adv(T,k) = | Pr[T (1 ) = 1] – Pr[T (1 ) = 1] | F(s,x) = ƒs(x) for all s, x∈{0,1} . is negligible, where f denotes an oracle for ƒ We denote by Fp,q the set of all functions from s p q {0,1} → {0,1} . for s ← Uk and g denotes an oracle drawn Given a PRG G: {0,1}k → {0,1}2k we define uniformly from Fp(k),q(k). k k G0, G1 : {0,1} →{0,1} so that G(x) = We call Adv(T,k) the advantage of T. G0(x),G1(x). PRFs: Polynomial inference formulation Equivalence Consider an experiment with t+1 stages: Theorem: ƒ cannot be polynomially inferred First, choose s←U . if and only if it is statistical-test k pseudorandom. Stage 1: A produces a query x1. Stage j, 1<j<t+1: A is given x ,ƒ (x ), for 0 < i < j, Proof: both directions in the contrapositive: i s i (a) if ƒ can be Q(k) inferred, then there is a statistical and produces query xj≠xi. test T which distinguishes between ƒS and Fp,q Stage t+1: Choose b←U1. Choose y1-b←Uq(k). with advantage 1/Q(k). Let yb = ƒs(xt). A is given xi, ƒs(xi), xt,y0,y1. (b) if there is a statistical test T for ƒ that has We say that PPTM A Q(k)-infers ƒif advantage 1/Q(k) and makes P(k) queries then ƒ can be 2P(k)Q(k) inferred. Pr[A(ƒs(x1),…,ƒs(xt-1),y0,y1) = b] > ½ + 1/Q(k) 1 Proof of (a) Proof of (b) Let A be the algorithm that Q-infers ƒ. Then the Suppose there is a statistical test T that has O oracle PPTM TA works as follows: advantage 1/Q(k) against ƒ and makes P(k) Stage 1: run A to get query x , respond with O(x ). 1 1 (wlog, distinct) oracle queries. We will Stage j: Let xj = A(O(x1)…O(xj-1)). construct an algorithm AT that 2P(k)Q(k) Stage t+1: Choose b←U , let y =O(x ), draw y ←U . If 1 b t 1-b q(k) infers ƒ. A(O(x1)…O(xt-1),y0,y1) = b, output 1, else output 0. g k Notice that Pr[TA (1 ) = 1] = ½ f k But since A Q(k)-infers ƒ, Pr[TA (1 )=1] > ½ + 1/Q(k). So TA has advantage 1/Q(k) as claimed. Definition of AT Proof that this works: Choose j {0,1,…P(k)-1} ∈U Consider doing an (k,j,ƒs) experiment: Run T, Stage i < j: Respond to T’s query qi-1 with ƒs(xi-1); run and on query qi, respond with: T until it makes query qi and return xi=qi. ƒs(qi), if i < j. Stage j: Respond to T’s query qj-1 with ƒs(xi-1). Run T yi ← Uq(k) otherwise. to get query qj. Return xj ← Up(k). Let pj(k) denote the probability that T outputs Stage i, j<i<P(k): Return xi ← Up(|s|). 0 1 in an (k,j,ƒs) experiment. Then p (k) = Stage P(k): Return x = q . P(k) j Pr[Tg(1k) = 1] and pP(k)(k) = Pr[Tf(1k) = 1]. Stage P(k)+1: Run T with y as O(q ) Respond to 0 j j j-1 additional queries from T with uniform bits, until T So we also have Σj(p (k) – p (k)) = Adv(T,k) outputs bit b’. Return 1-b’. … … Recap Then Pr[1-b’ = b] So a function family is statistical test = ΣiPr[j=i]Pr[1-b’ = b | j=i] pseudorandom iff it is polynomially uninferrable. (Proof by Hybrid method!) = 1/P(k) Σi Pr[1-b’ = b | j=i] = 1/P(k) Σi (Pr[b=1|j=i] Pr[b’=0|y0←Uq(k)&j=i] From now on, we will just say that a function family is pseudorandom if it is statistical test + Pr[b=0|j=i] Pr[b’=1|y0=ƒs(qi)&j=i]) pseudorandom. = 1/P(k) Σi (½ Pr[T outputs 0 in (k,i,ƒs) exp] That is, a pseudorandom function family +½ Pr[T outputs 1 in (k,i+1,ƒs) exp]) i i+1 (PRF) is a function family which is statistical = 1/2P(k) Σi ((1-p (k)) + p (k)) = ½ + 1/2P(k)Q(k), QED. test pseudorandom. 2 Constructing PRFs from PRGs Proof of Theorem… k 2k Let G:{0,1} → {0,1} be a PRG. Define a sequence of PPTs A0…Ak. k k A : Define ƒs: {0,1} → {0,1} by i Let L be an associative array. ƒs(x1x2…xk) = Gxk(Gxk-1(…(Gx2(Gx1(s)))…)) Run T, responding to queries (y1…yk): Theorem: ƒ is a PRF. s If (y1…yi) ∈L, let r = L(y1…yi) Proof: Suppose that there is a statistical test Else choose r←Uk and set L(y1…yi) = r respond with ƒ (y …y ) T that makes Q(k) queries and has Adv(T,k) r i+1 k Return output of T. = 1/P(k). We will construct a distinguisher for f k Notice: Pr[A0 = 1] = Pr[T (1 ) = 1], Pr[Ak = 1] = G with advantage 1/kQ(k)P(k). g k Pr[T (1 ) = 1]; Ei[Ai –Ai-1] = 1/kP(k) Proof, continued Properties of AT 2k Construct adversary AT(r1,…rQ(k)) (ri∈{0,1} ): Notice that Pr[A (U ) = 1] – Pr[A (G(U ))] = AT(r1,…,rQ(k))= T 2kq(k) T kq(k) E [A -A ] = 1/kP(k) Choose i∈U {0,…k-1}. Let L be as in Aj. Set j = 0. i i i-1 Run T, responding to queries (y1,…,yk): That is, if T distinguishes ƒs from Fp,q with If (y1…yi+1) ∈ L, Let r = L(y1…yi+1). advantage 1/P(k), AT distinguishes Q(k) Else: increment j; samples of G(Uk) from q(k) samples of U2k L(y1…yi0) = Left-Half(rj);L(y1…yi1) = Right-Half(rj) with advantage at least 1/kP(k). r = L(y1…yi+1) But then A can distinguish between a single Respond with ƒ (y …y ) T r i+2 k sample of G(U ) and U with advantage Return output of T. k 2k 1/kQ(k)P(k), QED. Pseudorandom permutations Notation, definitions A Pseudorandom Permutation family (PRP) is a Let ΠL denote the uniform distribution on PRF where every element ƒs is a bijection on {0,1}p(|s|). (PRPs have inverses) permutations on {0,1}L. k L(k) L(k) Typically for P: {0,1} × {0,1} →{0,1} there is an Define the Advantage of A against efficient algorithm to compute l(k) -1 permutation family P on {0,1} by: PK (x), given K. P(K,.) k Π k A Strong Pseudorandom Permutation family (SPRP) Adv(A,k) = |Pr[A (1 ) = 1] – Pr[A l(k)(1 )=1]| is a PRP which remains pseudorandom even when For any function f: {0,1}k→{0,1}k, define the the adversary is given access to an oracle for PK -1 2k and PK . permutation Df: {0,1} by Df(l,r) = (r, l⊕f(r)) k Naor and Reingold show that given a PRF ƒs: {0,1} -1 k 2k Note that Df is easy to compute. → {0,1} we can construct a SPRP Pƒ on {0,1} . 3 Intuition behind construction Construction: SPRP Let ƒ1, ƒ2 be chosen from a PRF family on Let h1,h2 be chosen from a pairwise- k 2k {0,1} . Then P = Dƒ2◦ Dƒ1 is indistinguishable independent family of permutations on {0,1} from a random permutation on uniformly k k Let ƒ1, ƒ2 :{0,1} →{0,1} be chosen from a chosen inputs. PRF family. There is a distinguisher for P on chosen Define the permutation P = h -1◦ D ◦ D ◦h . inputs: Left-half(P(L ,R) ⊕ P(L ,R)) = L ⊕L 2 ƒ2 ƒ1 1 1 2 1 2 SPRP Lemma: If ƒ , ƒ are chosen according whereas this holds with probability only 2-n for 1 2 to Fk,k, then P is statistically close to a a random permutation. random permutation. But if we can insure that the inputs to P, P-1 SPRP Theorem: P is a SPRP. are unique (whp), then we get what we need. Proof tools Proof tools, cont’d. Let M be a deterministic, unbounded oracle Call σ = {(x1,y1)…(xm,ym)} a possible M machine. M makes two types of queries: transcript if for every 1< i < m, (+,x): Querying G(x) -1 (-, y): Querying G (y) CM[{(x1,y1),…,(xi-1,yi-1)}] ∈{(+,xi),(-,yi)} th Denote the i query-answer pair of M by (xi,yi).
Load more

Recommended publications
  • Balanced Permutations Even–Mansour Ciphers
    Article Balanced Permutations Even–Mansour Ciphers Shoni Gilboa 1, Shay Gueron 2,3 ∗ and Mridul Nandi 4 1 Department of Mathematics and Computer Science, The Open University of Israel, Raanana 4353701, Israel; [email protected] 2 Department of Mathematics, University of Haifa, Haifa 3498838, Israel 3 Intel Corporation, Israel Development Center, Haifa 31015, Israel 4 Indian Statistical Institute, Kolkata 700108, India; [email protected] * Correspondence: [email protected]; Tel.: +04-824-0161 Academic Editor: Kwangjo Kim Received: 2 February 2016; Accepted: 30 March 2016; Published: 1 April 2016 Abstract: The r-rounds Even–Mansour block cipher is a generalization of the well known Even–Mansour block cipher to r iterations. Attacks on this construction were described by Nikoli´c et al. and Dinur et al. for r = 2, 3. These attacks are only marginally better than brute force but are based on an interesting observation (due to Nikoli´c et al.): for a “typical” permutation P, the distribution of P(x) ⊕ x is not uniform. This naturally raises the following question. Let us call permutations for which the distribution of P(x) ⊕ x is uniformly “balanced” — is there a sufficiently large family of balanced permutations, and what is the security of the resulting Even–Mansour block cipher? We show how to generate families of balanced permutations from the Luby–Rackoff construction and use them to define a 2n-bit block cipher from the 2-round Even–Mansour scheme. We prove that this cipher is indistinguishable from a random permutation of f0, 1g2n, for any adversary who has oracle access to the public permutations and to an encryption/decryption oracle, as long as the number of queries is o(2n/2).
    [Show full text]
  • Definition of PRF 4 Review: Security Against Chosen-Plaintext Attacks
    1 Announcements – Paper presentation sign up sheet is up. Please sign up for papers by next class. – Lecture summaries and notes now up on course webpage 2 Recap and Overview Previous lecture: – Symmetric key encryption: various security defintions and constructions. This lecture: – Review definition of PRF, construction (and proof) of symmetric key encryption from PRF – Block ciphers, modes of operation – Public Key Encryption – Digital Signature Schemes – Additional background for readings 3 Review: Definition of PRF Definition 1. Let F : f0; 1g∗ × f0; 1g∗ ! f0; 1g∗ be an efficient, length-preserving, keyed function. We say that F is a pseudorandom function if for all probabilistic polynomial-time distinguishers D, there exists a negligible function neg such that: FSK (·) n f(·) n Pr[D (1 ) = 1] − Pr[D (1 ) = 1] ≤ neg(n); where SK f0; 1gn is chosen uniformly at random and f is chosen uniformly at random from the set of functions mapping n-bit strings to n-bit strings. 4 Review: Security Against Chosen-Plaintext Attacks (CPA) The experiment is defined for any private-key encryption scheme E = (Gen; Enc; Dec), any adversary A, and any value n for the security parameter: cpa The CPA indistinguishability experiment PrivKA;E (n): 1. A key SK is generated by running Gen(1n). n 2. The adversary A is given input 1 and oracle access to EncSK(·) and outputs a pair of messages m0; m1 of the same length. 3. A random bit b f0; 1g is chosen and then a ciphertext C EncSK(mb) is computed and given to A. We call C the challenge ciphertext.
    [Show full text]
  • Cs 255 (Introduction to Cryptography)
    CS 255 (INTRODUCTION TO CRYPTOGRAPHY) DAVID WU Abstract. Notes taken in Professor Boneh’s Introduction to Cryptography course (CS 255) in Winter, 2012. There may be errors! Be warned! Contents 1. 1/11: Introduction and Stream Ciphers 2 1.1. Introduction 2 1.2. History of Cryptography 3 1.3. Stream Ciphers 4 1.4. Pseudorandom Generators (PRGs) 5 1.5. Attacks on Stream Ciphers and OTP 6 1.6. Stream Ciphers in Practice 6 2. 1/18: PRGs and Semantic Security 7 2.1. Secure PRGs 7 2.2. Semantic Security 8 2.3. Generating Random Bits in Practice 9 2.4. Block Ciphers 9 3. 1/23: Block Ciphers 9 3.1. Pseudorandom Functions (PRF) 9 3.2. Data Encryption Standard (DES) 10 3.3. Advanced Encryption Standard (AES) 12 3.4. Exhaustive Search Attacks 12 3.5. More Attacks on Block Ciphers 13 3.6. Block Cipher Modes of Operation 13 4. 1/25: Message Integrity 15 4.1. Message Integrity 15 5. 1/27: Proofs in Cryptography 17 5.1. Time/Space Tradeoff 17 5.2. Proofs in Cryptography 17 6. 1/30: MAC Functions 18 6.1. Message Integrity 18 6.2. MAC Padding 18 6.3. Parallel MAC (PMAC) 19 6.4. One-time MAC 20 6.5. Collision Resistance 21 7. 2/1: Collision Resistance 21 7.1. Collision Resistant Hash Functions 21 7.2. Construction of Collision Resistant Hash Functions 22 7.3. Provably Secure Compression Functions 23 8. 2/6: HMAC And Timing Attacks 23 8.1. HMAC 23 8.2.
    [Show full text]
  • An In-Depth Analysis of Various Steganography Techniques
    International Journal of Security and Its Applications Vol.9, No.8 (2015), pp.67-94 http://dx.doi.org/10.14257/ijsia.2015.9.8.07 An In-depth Analysis of Various Steganography Techniques Sangeeta Dhall, Bharat Bhushan and Shailender Gupta YMCA University of Science and Technology [email protected], [email protected], [email protected] Abstract The Steganography is an art and technique of hiding secret data in some carrier i.e. image, audio or video file. For hiding data in an image file various steganography techniques are available with their respective pros and cons. Broadly these techniques are classified as Spatial domain techniques, Transform domain techniques, Distortion techniques and Visual cryptography. Each technique is further classified into different types depending on their actual implementation. This paper is an effort to provide comprehensive comparison of these steganography techniques based on different Performance Metrics such as PSNR, MSE, MAE, Intersection coefficient, Bhattacharyya coefficient, UIQI, NCD, Time Complexity and Qualitative analysis. For this purpose a simulator is designed in MATLAB to implement above said techniques. The techniques are compared based on performance metrics. Keywords: Steganography, Classification of Steganography Techniques, Performance Metrics and MATLAB 1. Introduction "Steganography is the art and science of communicating in a way which hides the existence of the communication. In contrast to Cryptography, where the enemy is allowed to detect, intercept and modify messages without being able to violate certain security premises guaranteed by the cover message with the embedded cryptosystem. The goal of Steganography is to hide messages inside other harmless messages in a way that does not allow any enemy to even detect that there is a second message present"[1].
    [Show full text]
  • Cryptography
    Cryptography Jonathan Katz, University of Maryland, College Park, MD 20742. 1 Introduction Cryptography is a vast subject, addressing problems as diverse as e-cash, remote authentication, fault-tolerant distributed computing, and more. We cannot hope to give a comprehensive account of the ¯eld here. Instead, we will narrow our focus to those aspects of cryptography most relevant to the problem of secure communication. Broadly speaking, secure communication encompasses two complementary goals: the secrecy and integrity of communicated data. These terms can be illustrated using the simple example of a user A attempting to transmit a message m to a user B over a public channel. In the simplest sense, techniques for data secrecy ensure that an eavesdropping adversary (i.e., an adversary who sees all communication occurring on the channel) cannot learn any information about the underlying message m. Viewed in this way, such techniques protect against a passive adversary who listens to | but does not otherwise interfere with | the parties' communication. Techniques for data integrity, on the other hand, protect against an active adversary who may arbitrarily modify the information sent over the channel or may inject new messages of his own. Security in this setting requires that any such modi¯cations or insertions performed by the adversary will be detected by the receiving party. In the cases of both secrecy and integrity, two di®erent assumptions regarding the initial set-up of the communicating parties can be considered. In the private-key setting (also known as the \shared-key," \secret-key," or \symmetric-key" setting), which was the setting used exclusively for cryptography until the mid-1970s, parties A and B are assumed to have shared some secret information | a key | in advance.
    [Show full text]
  • Security Levels in Steganography – Insecurity Does Not Imply Detectability
    Electronic Colloquium on Computational Complexity, Report No. 10 (2015) Security Levels in Steganography { Insecurity does not Imply Detectability Maciej Li´skiewicz,R¨udigerReischuk, and Ulrich W¨olfel Institut f¨urTheoretische Informatik, Universit¨atzu L¨ubeck Ratzeburger Allee 160, 23538 L¨ubeck, Germany [email protected], [email protected], [email protected] Abstract. This paper takes a fresh look at security notions for steganography { the art of encoding secret messages into unsuspicious covertexts such that an adversary cannot distinguish the resulting stegotexts from original covertexts. Stegosystems that fulfill the security notion used so far, however, are quite inefficient. This setting is not able to quantify the power of the adversary and thus leads to extremely high requirements. We will show that there exist stegosystems that are not secure with respect to the measure considered so far, still cannot be detected by the adversary in practice. This indicates that a different notion of security is needed which we call undetectability. We propose different variants of (un)-detectability and discuss their appropriateness. By constructing concrete ex- amples of stegosystems and covertext distributions it is shown that among these measures only one manages to clearly and correctly differentiate different levels of security when compared to an intuitive understanding in real life situations. We have termed this detectability on average. As main technical contribution we design a framework for steganography that exploits the difficulty to learn the covertext distribution. This way, for the first time a tight analytical relationship between the task of discovering the use of stegosystems and the task of differentiating between possible covertext distributions is obtained.
    [Show full text]
  • Pseudorandom Functions from Pseudorandom Generators
    Lecture 5: Pseudorandom functions from pseudorandom generators Boaz Barak We have seen that PRF’s (pseudorandom functions) are extremely useful, and we’ll see some more applications of them later on. But are they perhaps too amazing to exist? Why would someone imagine that such a wonderful object is feasible? The answer is the following theorem: The PRF Theorem: Suppose that the PRG Conjecture is true, then there n exists a secure PRF collection {fs}s∈{0,1}∗ such that for every s ∈ {0, 1} , fs maps {0, 1}n to {0, 1}n. Proof: If the PRG Conjecture is true then in particular by the length extension theorem there exists a PRG G : {0, 1}n → {0, 1} that maps n bits into 2n bits. Let’s denote G(s) = G0(s)◦G1(s) where ◦ denotes concatenation. That is, G0(s) denotes the first n bits and G1(s) denotes the last n bits of G(s). n For i ∈ {0, 1} , we define fs(i) as Gin (Gin−1 (··· Gi1 (s))). This might be a bit hard to parse and is easier to understand via a figure: By the definition above we can see that to evaluate fs(i) we need to evaluate the pseudorandom generator n times on inputs of length n, and so if the pseudorandom generator is efficiently computable then so is the pseudorandom function. Thus, “all” that’s left is to prove that the construction is secure and this is the heart of this proof. I’ve mentioned before that the first step of writing a proof is convincing yourself that the statement is true, but there is actually an often more important zeroth step which is understanding what the statement actually means.
    [Show full text]
  • Efficient and Provably Secure Steganography
    Efficient and Provably Secure Steganography Ulrich W¨olfel Dissertation Universit¨at zu Lubeck¨ Institut fur¨ Theoretische Informatik Aus dem Institut fur¨ Theoretische Informatik der Universit¨at zu Lubeck¨ Direktor: Prof. Dr. Rudiger¨ Reischuk Efficient and Provably Secure Steganography Inauguraldissertation zur Erlangung der Doktorwurde¨ der Universit¨at zu Lubeck¨ Aus der Sektion Informatik / Technik vorgelegt von Ulrich W¨olfel aus Kiel Lubeck,¨ Januar 2011 1. Berichterstatter: PD Dr. Maciej Li´skiewicz 2. Berichterstatter: Prof. Dr. Matthias Krause Tag der mundlichen¨ Prufung:¨ 05. Mai 2011 Zum Druck genehmigt. Lubeck,¨ den 06. Mai 2011 Danksagung An erster Stelle m¨ochte ich mich bei Maciej Li´skiewicz bedanken, der mich als mein Doktorvater auf dem Weg zur Promotion begleitet hat. In zahlreichen angeregten Diskussionen half er mir immer wieder, meine vielen unscharfen Ideen exakt zu formulieren und die einzelnen Ergebnisse zu einem koh¨arenten Ganzen zu schmieden. Ganz besonders m¨ochte ich auch Rudiger¨ Reischuk danken, der zusammen mit Maciej Li´skiewicz und mir Forschungsarbeiten durchgefuhrt¨ hat, deren Resultate den Kapiteln 5 und 6 zugrun- deliegen. Durch seine Bereitschaft, mich fur¨ das Jahr 2009 kurzfristig auf einer halben Stelle als wissenschaftlichen Mitarbeiter zu besch¨aftigen, konnte ich die Arbeit an der Dissertation gut voranbringen. Dafur¨ an dieser Stelle nochmals meinen herzlichen Dank. Ferner danke ich der Universit¨at zu Lubeck¨ und dem Land Schleswig-Holstein fur¨ die Gew¨ahrung eines Promotionsstipendiums, das ich vom 01. Januar 2005 bis 31. Juli 2005, in der Anfangsphase meines Promotionsvorhabens, in Anspruch nehmen konnte. Meinen Vorgesetzten und Kollegen im BSI und AMK m¨ochte ich fur¨ die sehr angenehme und freundliche Arbeitsatmosph¨are danken und dafur,¨ daß mir ausreichend Freiraum fur¨ die Anfertigung dieser Dissertation gegeben wurde.
    [Show full text]
  • Block Ciphers and Modes of Operation Table of Contents
    Introduction Pseudorandom permutations Block Ciphers Modes of Operation Block ciphers And modes of operation Foundations of Cryptography Computer Science Department Wellesley College Fall 2016 Introduction Pseudorandom permutations Block Ciphers Modes of Operation Table of contents Introduction Pseudorandom permutations Block Ciphers Modes of Operation Introduction Pseudorandom permutations Block Ciphers Modes of Operation Keyed permutations: Some definitions Definition. Let F : 0, 1 0, 1 0, 1 be an efficient, { }⇤ ⇥ { }⇤ ! { }⇤ length-preserving, keyed function. We call F a keyed permutation if for every k, the function F ( )isone-to-one. k · Definition. We say that a keyed permutation is efficient if there is a polynomial time algorithm computing Fk (x) given k and x,aswell 1 as a polynomial-time algorithms computing Fk− (x) given k and x. Remark. The input and output lengths, called the block size are the same, but the key length may be smaller or larger than the block size. Introduction Pseudorandom permutations Block Ciphers Modes of Operation Pseudorandom permutations Definition. Let F : 0, 1 0, 1 0, 1 an efficient keyed { }⇤ ⇥ { }⇤ ! { }⇤ permutation. We say that F is a pseudorandom permutation if for all probabilistic polynomial-time distinguishers D,thereexistsa negligible function negl such that: F ( ) n f ( ) n Pr[D k · (1 ) = 1] Pr[D · (1 ) = 1] negl(n), − where k 0, 1 n is chosen uniformly at random and f is chosen { } uniformly at random from the set of permutations mapping n-bit strings to n-bit strings. Introduction Pseudorandom permutations Block Ciphers Modes of Operation Pseudorandom functions and permutations are polynomially indistinguishable Theorem 3.27. If F is a pseudorandom permutation then it is also a pseudorandom function.
    [Show full text]
  • Steganography
    Steganography Dr. Natarajan Meghanathan Associate Professor of Computer Science Jackson State University, Jackson MS 39217 E-mail: [email protected] Steganography • Steganography is the science of hiding information by embedding the hidden (secret) message within a cover media (for example, an image, audio or video carrier file) in such a way that the hidden information cannot be easily perceived to exist for the unintended recipients of the cover media. • Steganography hides the fact that the secret communication does not exist. • Different from Cryptography: – Cryptography techniques have been widely used to encrypt the plaintext data, transfer the ciphertext over the Internet and decrypt the ciphertext to extract the plaintext at the receiver side. – However, with the ciphertext not really making much sense when interpreted as it is, a hacker or an intruder can easily perceive that the information being sent on the channel has been encrypted and is not the plaintext. – This can naturally raise the curiosity level of a malicious hacker or intruder to conduct cryptanalysis attacks on the ciphertext (i.e., analyze the ciphertext vis-à-vis the encryption algorithms and decrypt the ciphertext completely or partially). Steganography: Hiding Model • Steganography takes advantage of the redundancy of data in the cover media to insert the “extra” information so that there could be no perceptible change to the cover media. Encryption Key, other keys Steganography Cover Media Embedding Stego Media Algorithm Information to Hide Steganography: Extraction Model • The extraction process should be possible without the cover. • The extraction algorithm can also be applied on any cover, whether or not it contains a secret message.
    [Show full text]
  • Notes #5: Block Ciphers Contents 5.1 Introduction to Block Ciphers
    CMSC 28400 Introduction to Cryptography Autumn 2019 Notes #5: Block Ciphers Instructor: David Cash Contents 5.1Introduction to Block Ciphers 1 5.1.1 Security of Block Ciphers . .2 5.2Exhaustive Key Search 3 5.3Double Encryption 3 5.3.1 Meet-in-the-Middle Attack on Double Encryption . .4 Along with stream ciphers, block ciphers are a very widely-deployed type of algorithm used for encryption and other cryptographic purposes. These notes cover some basic definitions of 5.1 Introduction to Block Ciphers Let's start with the definition. Definition 5.1. A cipher E : K × M ! C is called a block cipher if M = C = f0; 1g` for some positive integer `. The integer ` is called the block length or block size of E. When E is a block cipher, then for each k 2 K, E(k; ·) must actually be computing a permutation on f0; 1g`. In practice we will always have K = f0; 1gn for some positive integer n, and we say that n is the key-length of E. We will sometimes want to evaluate E−1, the decryption algorithm. Thus all practical block ciphers, like DES and AES that follow, support efficient decryption. Example 5.1. The DES blockcipher, described in Boneh-Shoup Chapter 3 and many other places, is a function DES : f0; 1g56 × f0; 1g64 ! f0; 1g64: The key length is 56 and the block length is 64. As we will see, both of these lengths are a major limitation. The replacement for DES is a family of three blockciphers, often called AES128, AES192, and AES256, which have a common block length of 128 and key lengths of 128; 192, and 256 respectively.
    [Show full text]
  • XOR of Prps in a Quantum World
    XOR of PRPs in a Quantum World Bart Mennink1;2 and Alan Szepieniec3 1 Digital Security Group, Radboud University, Nijmegen, The Netherlands [email protected] 2 CWI, Amsterdam, The Netherlands 3 imec-COSIC KU Leuven, Belgium [email protected] Abstract. In the classical world, the XOR of pseudorandom permuta- tions Ek1 ⊕ · · · ⊕ Ekr for r ≥ 2 is a well-established way to design a pseudorandom function with \optimal" security: security up to approx- imately minfjKj; jXjg queries, where K and X are the key and state space of the block cipher E. We investigate security of this construction against adversaries who have access to quantum computers. We first present a key recovery attack in jKjr=(r+1) complexity. The attack re- lies on a clever application of a claw-finding algorithm and testifies of a significant gap with the classical setting where 2 pseudorandom per- mutations already yield optimal security. Next, we perform a quantum security analysis of the construction, and prove that it achieves secu- rity up to minfjKj1=2=r; jXjg queries. The analysis relies on a generic characterization of classical and quantum distinguishers and a universal transformation of classical security proofs to the quantum setting that is of general interest. Keywords: XOR of pseudorandom permutations, classical, quantum, claw-finding, proof transformation. 1 Introduction PRP to PRF Conversion. Block ciphers are omnipresent in cryptographic literature, and their security is usually measured in the degree to which they approximate a pseudorandom permutation (PRP). However, in many cases, one prefers to reason with pseudorandom functions instead. A simple example of this is the counter mode encryption.
    [Show full text]