Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
Fragments of a chapter on Encryption Schemes
Extracts from Foundations of Cryptography in preparation
revised second p osted version
Oded Goldreich
Department of Computer Science and Applied Mathematics
Weizmann Institute of Science Rehovot Israel
June
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
I
to Dana
c
Copyright by Oded Goldreich
Permission to make copies of part or all of this work for p ersonal or classro om use
is granted without fee provided that copies are not made or distributed for pro t or
commercial advantage and that new copies b ear this notice and the full citation on the
rst page Abstracting with credit is p ermitted
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice. II
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
Preface
The current manuscript consists of fragments of a chapter on encryption schemes
which is supp ose to b e Chapter of the three volume work Foundations of Cryp
tography These fragments provide a draft of the rst three sections of this chap
ter covering the basic setting de nitions and constructions Also included is a
plan of the fourth section i e beyond eavesdropping security and fragments for
the Miscellaneous section of this chapter This manuscript subsumes a previous
version p osted in Dec
The bigger picture The current manuscript consists of fragments of a chap
ter on encryption schemes which is supp ose to constitute Chapter of the
three part work Foundations of Cryptography see Figure The three parts
of this work are Basic Tools Basic Applications and Beyond the Basics The
rst part containing Chapters has b een published by Cambridge University
Press in June The second part consists of Chapters regarding En
cryptioni Schemes Signatures Schemes and General Cryptographic Proto cols
resp ectively We hop e to publish the second part with Cambridge University
Press within a few years
Part Introduction and Basic Tools
Chapter Introduction
Chapter Computational Di culty One Way Functions
Chapter Pseudorandom Generators
Chapter Zero Knowledge Pro ofs
Part Basic Applications
Chapter Encryption Schemes
Chapter Signature Schemes
Chapter General Cryptographic Proto cols
Part Beyond the Basics
Figure Organization of this work III
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
IV
The partition of the work into three parts is a logical one Furthermore it
o ers the advantage of publishing the rst part without waiting for the comple
tion of the other parts Similarly we hop e to complete the second part within a
couple of years and publish it without waiting for the third part
Prerequisites The most relevant background for this text is provided by
basic knowledge of algorithms including randomized ones computability and
elementary probability theory Background on computational number theory
which is required for sp eci c implementations of certain constructs is not really
required here
Using this text The text is intended as part of a work that is aimed to serve
b oth as a textb o ok and a reference text That is it is aimed at serving b oth the
b eginner and the exp ert In order to achieve this aim the presentation of the
basic material is very detailed so to allow a typical CS undergraduate to follow
it An advanced student and certainly an exp ert will nd the pace in these
parts way to o slow However an attempt was made to allow the latter reader
to easily skip details obvious to him her In particular pro ofs are typically
presented in a mo dular way We start with a high level sketch of the main ideas
and only later pass to the technical details Passage from high level descriptions
to lower level details is typically marked by phrases such as details fol low
In a few places we provide straightforward but tedious details in in
dented paragraphs as this one In some other even fewer places such
paragraphs provide technical pro ofs of claims that are of marginal rele
vance to the topic of the b o ok
More advanced material is typically presented at a faster pace and with less
details Thus we hop e that the attempt to satisfy a wide range of readers will
not harm any of them
Teaching The material presented in the full three volume work is on one
hand way b eyond what one may want to cover in a course and on the other
hand falls very short of what one may want to know ab out Cryptography in
general To assist these con icting needs we make a distinction b etween basic
and advanced material and provide suggestions for further reading in the last
section of each chapter In particular sections subsections and subsubsections
marked by an asterisk are intended for advanced reading
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
Table of Contets
Preface III
Encryption Schemes
The Basic Setting
Private Key versus Public Key Schemes
The Syntax of Encryption Schemes
De nitions of Security
The actual de nitions
Further discussion of some de nitional choices
Indistinguishability of Encryptions
Equivalence of the Security De nitions
Pro of of Prop osition
Pro of of Prop osition
Multiple Messages
De nitions
The e ect on the public key mo del
The e ect on the private key mo del
A uniform complexity treatment
The de nitions
Equivalence of the multiple message de nitions
Single message versus multiple message
The gain of a uniform treatment
Constructions of Secure Encryption Schemes
Probabilistic Encryption
Stream Ciphers
Preliminaries Blo ck Ciphers
Private key encryption schemes
Public key encryption schemes
Simple schemes
An alternative scheme
Beyond eavesdropping security
Key dep endent passive attacks
Chosen plaintext attack V
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
Chosen ciphertext attack
Non malleable encryption schemes
Miscellaneous
Historical Notes
Suggestion for Further Reading
Op en Problems
Exercises
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
Part II
Basic Applications Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
Chapter
Encryption Schemes
Upto the s Cryptography was understo o d as the art of building encryption
schemes that is the art of constructing schemes allowing secret data exchange
over insecure channels Since the s other tasks e g signature schemes
have b een recognized as falling within the domain of Cryptography and even as
b eing at least as central to Cryptography Yet the construction of encryption
schemes remains and is likely to remain a central enterprise of Cryptography
In this chapter we review the well known notions of private key and public
key encryption schemes More imp ortantly we de ne what is meant by saying
that such schemes are secure It turns out that using randomness throughout
the encryption pro cess i e not only at the key generation phase is essential to
security We present some basic constructions of secure private key and public
key encryption schemes Finally we discuss dynamic notions of security
culminating in robustness against chosen ciphertext attacks
Author s Note Currently the write up contains only a rough draft for
the rst sections of this chapter Furthermore this write up was
NOT carefully pro ofread and may contain various hop efully minor
errors
Teaching Tip We assume that the reader is familiar with the material in
previous chapters and sp eci cally with Sections and
This familiarity is imp ortant not only b ecause we use some of the notions and
results presented in these sections but rather b ecause we use similar pro of tech
niques and do it while assuming that this is not the reader s rst encounter
with these techniques
The Basic Setting
Lo osely sp eaking encryption schemes are supp osed to enable private communi
cation b etween parties that communicate over an insecure channel Thus the
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
basic setting consists of a sender a receiver and an insecure channel that may
b e tapp ed by an adversary The goal is to allow the sender to transfer infor
mation to the receiver over the insecure channel without letting the adversary
gure out this information Thus we distinguish b etween the actual secret
information that the receiver wishes to transmit and the messages sent over the
insecure communication channel The former is called the plaintext whereas
the latter is called the ciphertext Clearly the ciphertext must di er from the
plaintext or else the adversary can easily obtain the plaintext by tapping the
channel Thus the sender must transform the plaintext into a ciphertext so
that the receiver can retrieve the plaintext from the ciphertext but the adver
sary cannot do so Clearly something must distinguish the receiver who is able
to retrieve the plaintext from the corresp onding ciphertext from the adversary
who cannot do so Sp eci cally the receiver know something that the adversary
do es not know This thing is called a key
An encryption scheme consists of a metho d of transforming plaintexts to ci
phertexts and vice versa using adequate keys These keys are essential to the
ability to e ect these transformations We stress that the encryption scheme it
self i e the encryption decryption algorithms may b e known to the adversary
and its security relies on the hypothesis that the adversary do es not know the
keys Formally we need to consider a third algorithm namely a probabilistic
algorithm used to generate keys This algorithm must b e probabilistic or else
by invoking it the adversary obtains the very same key used by the receiver
In accordance with the ab ove an encryption scheme consists of three algo
rithms These algorithms are public i e known to all parties The obvious
algorithms are the encryption algorithm which transforms plaintexts to cipher
texts and the decryption algorithm which transforms ciphertexts to plaintexts
By the discussion ab ove it is clear that the description algorithm must employ
a key that is known to the receiver but is not known to the adversary This
key is generated using a third algorithm called the key generator Furthermore
it is not hard to see that the encryption pro cess must also dep end on the key
or else messages sent to one party can b e read by a di erent party who is also
a p otential receiver Thus the key generation algorithm is used to pro duce a
pair of related keys one for encryption and one for decryption The encryption
algorithm given an encryption key and a plaintext pro duces a plaintext that
when fed to the decryption algorithm with the corresp onding decryption key
returns the original plaintext We stress that knowledge of the decryption key
is essential for the latter transformation
Private Key versus Public Key Schemes
A fundamental distinction b etween encryption schemes refers to the relation b e
tween the two keys mentioned ab ove The simpler and older notion assumes
that the encryption key equals the decryption key Such schemes are called
In fact in many cases the legitimate interest may b e served b est by publicizing the
scheme itself In our opinion this is the b est way to obtain an unbiased exp ert evaluation
of the security of the scheme
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
THE BASIC SETTING
private key or symmetric To use a private key scheme the legitimate parties
must rst agree on the secret key This can b e done by having one party generate
the key at random and send it to the other party using a channel that is assumed
to b e secure A crucial p oint is that the key is generated indep endently of the
plaintext and so it can b e generated and exchanged prior to the plaintext even
b eing determined Thus private key encryption is a way of extending a private
channel over time If the parties can use a private channel to day e g they are
currently in the same physical lo cation but not tomorrow then they can use
the private channel to day to exchange a secret key that they may use tomorrow
for secret communication A simple example of a private key encryption scheme
is the one time pad The secret key is merely a uniformly chosen sequence of
n bits and an n bit long ciphertext is pro duced by XORing the plaintext bit
by bit with the key The plaintext is recovered from the ciphertext in the same
way Clearly the one time pad provides absolute security However its usage
of the key is ine cient or put in other words it requires keys of length com
parable to the total length of data communicated In the rest of this chapter
we will only discuss encryption schemes where n bit long keys allow to securely
communicated data of length greater than n but still p olynomial in n
A new type of encryption schemes has emerged in the s In these
schemes called public key or asymmetric the decryption key di ers from the
encryption key Furthermore it is infeasible to nd the decryption key given the
encryption key These schemes enable secure communication without ever using
a secure channel Instead each party applies the key generation algorithm to
pro duce a pair of keys The party called P keeps the decryption key denoted
d secret and publishes the encryption key denoted e Now any party can
P P
send P private messages by encrypting them using the encryption key e Party
P
P can decrypt these messages by using the decryption key d but nob o dy else
P
can do so
The Syntax of Encryption Schemes
We start by de ning the basic mechanism of encryption schemes This de nition
says nothing ab out the security of the scheme which is the sub ject of the next
section
De nition encryption scheme An encryption scheme is a triple G E D
of probabilistic polynomial time algorithms satisfying the fol lowing two condi
tions
n
On input algorithm G called the key generator outputs a pair of bit
strings
n
For every pair e d in the range of G and for every f g
algorithms E encryption and D decryption satisfy
Pr D d E e
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
where the probability is taken over the internal coin tosses of algorithms E
and D
The integer n serves as the security parameter of the scheme Each e d in
n
the range of G constitutes a pair of corresponding encryption decryption
keys The string E e is the encryption of the plaintext f g using the
encryption key e whereas D d is the decryption of the ciphertext using
the decryption key d
We stress that De nition says nothing ab out security and so trivial in
def def
and D d Fur secure algorithms may satisfy it e g E e
thermore De nition do es not distinguish private key encryption schemes
from public key ones The di erence b etween the two types is introduced in the
security de nitions In a public key scheme the breaking algorithm gets the
encryption key i e e as an additional input and thus e d follows while
in private key schemes e is not given to the breaking algorithm and thus one
may assume without loss of generality that e d
We stress that the ab ove de nition requires the scheme to op erate for every
plaintext and sp eci cally for plaintext of length exceeding the length of the
encryption key This rules out the information theoretic secure one time pad
scheme mentioned ab ove
Notation In the rest of this text we write E instead of E e and D
e d
instead of D d Sometimes when there is little risk of confusion we drop
n n
these subscripts Also we let G resp G denote the rst resp
n n n n
second element in the pair G That is G G G Without
n n
loss of generality we may assume that jG j and jG j are p olynomially
related to n and that each of these integers can b e e ciently computed from
n n
the other In fact we may even assume that jG j jG j n see
Exercise
Comments De nition may b e relaxed in several ways without signif
icantly harming its usefulness For example we may relax Condition and
n
allow a negligible decryption error e g Pr D E Alterna
d e
tively one may p ostulate that Condition holds for all but a negligible measure
n
of the key pairs generated by G At least one of these relaxations is essential
for each of the p opular suggestions of encryption schemes
Another relaxation consists of restricting the domain of p ossible plaintexts
and ciphertexts For example one may restrict Condition to s of length
n where N N is some xed function Given a scheme of the latter type
with plaintext length we may construct a scheme as in De nition by
breaking plaintexts into blo cks of length n and applying the restricted scheme
separately to each blo ck For more details see Sections and
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
DEFINITIONS OF SECURITY
De nitions of Security
In this section we present two fundamental de nitions of security and prove their
equivalence The rst de nition called semantic security is the most natural
one Semantic security is a computational complexity analogue of Shannon s
de nition of p erfect privacy which requires that the ciphertext yields no in
formation regarding the plaintext Lo osely sp eaking an encryption scheme is
semantically secure if it is infeasible to learn anything ab out the plaintext from
the ciphertext i e imp ossibility is replaced by infeasibility The second def
inition has a more technical avor It interprets security as the infeasibility of
distinguishing b etween encryptions of a given pair of messages This de nition
is useful in demonstrating the security of a prop osed encryption scheme and for
the analysis of cryptographic proto cols that utilize an encryption scheme
We stress that the de nitions presented b elow go way b eyond saying that it
is infeasible to recover the plaintext from the ciphertext The latter statement
is indeed a minimal requirement from a secure encryption scheme but we claim
that it is way to o weak a requirement An encryption scheme is typically used in
applications where obtaining sp eci c partial information on the plaintext endan
gers the security of the application When designing an application indep endent
encryption scheme we do not know which partial information endangers the
application and which do es not Furthermore even if one wants to design an
encryption scheme tailored to one s own sp eci c applications it is rare to say
the least that one has a precise characterization of all p ossible partial informa
tion that endanger these applications Thus we require that it is infeasible to
obtain any information ab out the plaintext from the ciphertext Furthermore
in most applications the plaintext may not b e uniformly distributed and some
a priori information regarding it is available to the adversary We require that
the secrecy of all partial information is preserved also in such a case That is
even in presence of a priori information on the plaintext it is infeasible to obtain
any new information ab out the plaintext from the ciphertext b eyond what is
feasible to obtain from the a priori information on the plaintext The de nition
of semantic security p ostulates all of this
To simplify the exp osition we adopt a non uniform formulation Namely in
the security de nitions we expand the domain of e cient adversaries algorithms
to include p olynomial size circuits rather than only probabilistic p olynomial
time machines Likewise we make no computation restriction regarding the
probability distribution from which messages are taken nor regarding the a
priori information available on these messages We note that employing such a
non uniform formulation rather than a uniform one may only strengthen the
de nitions yet it do es weaken the implications proven b etween the de nitions
since these simpler pro ofs make free usage of non uniformity
Semantic Security
Lo osely sp eaking semantic security means that whatever can b e e ciently com
puted from the ciphertext can b e e ciently computed also without the cipher
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
text Thus an adversary gains nothing by intercepting ciphertexts sent b etween
communicating parties who use a semantically secure encryption scheme since
it could have obtained the same without intercepting these ciphertexts Indeed
this formulation follows the simulation paradigm lack of gain is captured by
asserting that whatever is learned from the ciphertext can b e learned within
related complexity also without the ciphertext
The actual de nitions
To b e somewhat more accurate semantic security means that whatever can b e
e ciently computed from the ciphertext can b e e ciently computed when given
only the length of the plaintext Note that this formulation do es not rule out the
p ossibility that the length of the plaintext can b e inferred from the ciphertext
Indeed some information ab out the length of the plaintext must b e revealed by
the ciphertext see Exercise We stress that other than information ab out
the length of the plaintext the ciphertext is required to yield nothing ab out the
plaintext
In the actual de nitions we consider only information regarding the plaintext
rather than anything which can b e obtained from the ciphertext Furthermore
we restrict our attention to functions applied to the plaintext We do so b ecause
of the intuitive app eal of this sp ecial case and are comfortable doing so b e
cause this sp ecial case implies the general one cf Exercise We augment
this formulation by requiring that the ab ove remains valid even in presence of
auxiliary partial information ab out the plaintext Namely whatever can b e e
ciently computed from the ciphertext and additional partial information ab out
the plaintext can b e e ciently computed given only the length of the plain
text and the same partial information In the actual de nition the information
regarding the plaintext that the adversary tries to obtain is captured by the
function f whereas the a priori partial information ab out the plaintext is cap
tured by the function h The ab ove is required to hold for any distribution of
plaintexts captured by the probability ensemble fX g
n
n N
Security holds only for plaintexts of length p olynomial in the security pa
rameter This is captured b elow by the restriction jX j p oly n Note that
n
we cannot hop e to provide computational security for plaintexts of unbounded
length in the security parameter see Exercise Likewise we restrict the func
tions f and h to b e polynomially bounded that is jf x j jh x j p oly jxj
The di erence b etween private key and public key encryption schemes is
manifested in the de nition of security In the latter the adversary which
is trying to obtain information on the plaintext is given the encryption key
whereas in the former it is not Thus the di erence b etween these schemes
amounts to a di erence in the adversary mo del considered in the de nition
of security We start by presenting the de nition for private key encryption
schemes
De nition semantic security private key An encryption scheme
G E D is semantically secure in the private key mo del if for every proba
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
DEFINITIONS OF SECURITY
bilistic polynomial time algorithm A there exists a probabilistic polynomial time
algorithm A so that for every ensemble fX g with jX j p oly n every
n n
n N
pair of polynomially bounded functions f h f g f g every polynomial
p and al l su ciently large n
h i
jX j
n
n
Pr A E X h X f X
n n n
G
1
h i
jX j
n
Pr A h X f X
n n
p n
The probability in the above terms is taken over X as wel l as over the internal
n
coin tosses of algorithms G E and either A or A
The function h provides b oth algorithms with partial information regarding the
plaintext X Furthermore h also makes the de nition implicitly non uniform
n
see further discussion b elow In addition b oth algorithms get the length of X
n
These algorithms then try to guess the value f X namely they try to infer
n
information ab out the plaintext X Lo osely sp eaking in semantically secure
n
encryption scheme the ciphertext do es not help in this inference task That
is the success probability of any e cient algorithm i e algorithm A that is
given the ciphertext can b e matched upto a negligible fraction by the success
probability of an e cient algorithm i e algorithm A that is not given the
ciphertext at all
De nition refers to private key encryption schemes To derive a def
inition of security for public key encryption schemes the encryption key i e
n
G should b e given to the adversaries as an additional input That is
De nition semantic security public key An encryption scheme G E D
is semantically secure in the public key mo del if for every probabilistic polynomial
time algorithm A there exists a probabilistic polynomial time algorithm A such
that for every fX g f h p and n as in De nition
n
n N
h i
n jX j
n
n
Pr A G E X h X f X
n n n
G
1
h i
n jX j
n
Pr A G h X f X
n n
p n
We comment that the encryption key can b e omitted from the input to A since
A may generate it by itself
Terminology For sake of simplicity we refer to an encryption scheme that is
semantically secure in the private key resp public key mo del as to a semantically
secure private key resp public key encryption scheme
The reader may note that a semantically secure public key encryption scheme
cannot employ a deterministic encryption algorithm that is E x must b e a
e
random variable rather than a xed string This is more evident with resp ect to
the equivalent De nition b elow See further discussion following De ni
tion
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
Further discussion of some de nitional choices
We discuss several secondary issues regarding De nitions and The
interested reader is also referred to Exercises and that present additional
variants of the de nition of semantic security
Implicit non uniformity of the de nitions The fact that h is not required
to b e computable makes the ab ove de nitions non uniform This is the case b e
cause b oth algorithms are given h X as auxiliary input and this may account
n
for arbitrary p olynomially b ounded advise For example letting h x a
jxj
means that b oth algorithms are supplied with non uniform advice as in one of
the p ossible formulations of non uniform p olynomial time see Section In
general the function h can co de b oth information regarding its input and non
uniform advice dep ending on its input length i e h x h x a Thus
jxj
the ab ove de nitions are equivalent to allowing A and A b e related families of
non uniform circuits where by related we mean that the circuits in the family
g can b e e ciently computed from the corresp onding circuits in A fA
n N
n
the family A fA g For further discussion see Exercise
n
n N
Lack of computational restrictions regarding the function f We do
not require that the function f is even computable This seems strange at
rst glance b ecause unlike the situation w r t h which co des a priori infor
mation given to the algorithms the algorithms are asked to guess the value
of f on a plaintext implicit in the ciphertext given only to A However as
we shall see in the sequel see also Exercise the meaning of semantic se
jX j
n
curity is essentially that the distribution ensembles E X h X and
n n
jX j jX j
n n
E h X are computationally indistinguishable and so whatever
n
A can compute can b e computed by A
Other mo di cations of no impact Actually inclusion of a priori informa
tion regarding the plaintext captured by the function h do es not a ect the
de nition of semantic security De nition remains intact if we restrict h
to only dep end on the length of the plaintext and so only provide non uniform
advice This can b e shown in various ways e g see Exercise Also the
function f can b e restricted to b e a Bo olean function having p olynomial size cir
cuits and the random variable X may b e restricted to b e very dull e g have
n
only two strings in its supp ort See pro of of Theorem On the other hand
De nition implies stronger forms discussed in Exercises and
Indistinguishability of Encryptions
The following technical interpretation of security states that it is infeasible to
distinguish the encryptions of two plaintexts of the same length That is such
ciphertexts are computationally indistinguishable as de ned in De nition
Again we start with the private key variant
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
DEFINITIONS OF SECURITY
De nition indistinguishability of encryptions private key An en
cryption scheme G E D has indistinguishable encryptions in the private key
mo del if for every polynomial size circuit family fC g every polynomial p al l
n
p oly n
su ciently large n and every x y f g i e jxj jy j
n n
jPr C E x Pr C E y j
n n
G G
1 1
p n
The probability in the above terms is taken over the internal coin tosses of algo
rithms G and E
Note that the p otential plaintexts to b e distinguished can b e incorp orated into
the circuit C Thus the circuit mo dels b oth the adversary s strategy and its
n
a priori information See Exercise
Again the security de nition for public key encryption schemes can b e de
n
rived by adding the encryption key i e G as an additional input to the
algorithm That is
De nition indistinguishability of encryptions public key An encryp
tion scheme G E D has indistinguishable encryptions in the public key mo del
if for every polynomial size circuit family fC g and every p n x and y as
n
in De nition
n n
n n
jPr C G E x Pr C G E y j
n n
G G
1 1
p n
Terminology For sake of simplicity we refer to an encryption scheme that has
indistinguishable encryptions in the private key resp public key mo del as to
a ciphertext indistinguishable private key resp public key encryption scheme
Failure of deterministic encryption algorithms A ciphertext indistinguishable
public key encryption scheme cannot employ a deterministic encryption algo
rithm i e E x cannot b e a xed string For a public key encryption scheme
e
with a deterministic encryption algorithm E given an encryption key e and a
pair of candidate plaintexts x y one can easily distinguish E x from E y
e e
by merely applying E to x and comparing the result to the given cipher
e
text In contrast in case the encryption algorithm itself is randomized the
same plaintext can b e encrypted in exp onentially many di erent ways under
the same encryption key Furthermore the probability that applying E twice
e
to the same message while using indep endent randomization in E results in
e
the same ciphertext may b e exp onentially vanishing Indeed as shown b e
low public key encryption scheme having indistinguishable encryptions can b e
constructed based on any trap do or p ermutations and these schemes employ
randomized encryption algorithms
Equivalence of the Security De nitions
The following theorem is stated and proven for private key encryption schemes
A similar result holds for public key encryption schemes see Exercise
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
Theorem equivalence of de nitions private key A private key en
cryption scheme is semantically secure if and only if it has indistinguishable
encryptions
Let G E D b e an encryption scheme We formulate a prop osition for each of
the two directions of the ab ove theorem Each prop osition is in fact stronger
than the corresp onding direction stated in Theorem The more useful
direction is stated rst it asserts that the technical interpretation of security in
terms of ciphertext indistinguishability implies the natural notion of semantic
security Thus the following prop osition yields a metho dology for designing
semantically secure encryption schemes design and prove your scheme to b e
ciphertext indistinguishable and conclude by applying the prop osition that
it is semantically secure The opp osite direction of Theorem establish
the completeness of the latter metho dology and more generally assert that
requiring an encryption scheme to b e ciphertext indistinguishable do es not rule
out schemes that are semantically secure
Prop osition useful direction indistinguishability implies security
Suppose that G E D is a ciphertext indistinguishable private key encryption
scheme Then G E D is semantically secure Furthermore the simulating
algorithm A which is used to establish semantic security captures the com
putation of a probabilistic polynomial time oracle machine that is given oracle
access to original adversary algorithm A
Prop osition opp osite direction security implies indistinguishabil
ity Suppose that G E D is a semantically secure private key encryption
scheme Then G E D has indistinguishable encryptions Furthermore the
conclusion holds even if the de nition of semantic security is restricted to the
special case satisfying the fol lowing four conditions
the random variable X is uniformly distributed over a set containing two
n
strings
the value of h depends only on the length of its input i e h x h jxj
the function f is Boolean and is computable by a polynomial size circuit
the algorithm A is deterministic
In addition no computational restrictions are placed on algorithm A and it can
be replaced by any function which may depend on fX g h f and A
n
n N
Observe that the ab ove four itemized conditions limit the scop e of the four
universal quanti ers in De nition whereas the last sentence removes a
restriction on the existential quanti er i e removes the complexity b ound on
A and allows the latter to dep end on all universal quanti ers Each of these
mo di cations makes the resulting de nition p otentially weaker Still combining
Prop ositions and it follows that a weak version of De nition
implies an even stronger version than the one stated in De nition
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
DEFINITIONS OF SECURITY
Pro of of Prop osition
Supp ose that G E D has indistinguishable encryptions We show that G E D
is semantically secure by constructing for every probabilistic p olynomial time
algorithm A a probabilistic p olynomial time algorithm A such that the fol
lowing holds for every fX g f and h algorithm A guesses f X from
n n
n N
jX j jX j
n n
h X essential ly as good as A guesses f X from E X h X
n n n n
jX j jX j
n n
Algorithm A merely invokes A on input E h X and returns
n
whatever A do es Intuitively the indistinguishability of encryptions implies that
A b ehaves as well when invoked by A and given a dummy encryption as when
given the encryption of X Details follow
n
Let A b e an algorithm that tries to infer partial information i e the value
jX j
n
f X from the encryption of the message X when also given and a
n n
j j
priori information h X Namely on input E and h algorithm
n
A tries to guess f We construct a new algorithm A that p erforms as well
without getting the input E The new algorithm consists of invoking A on
j j j j
n
input E and h and outputting whatever A do es That is
G
1
j j
on input h algorithm A pro ceeds as follows
n
A invokes the key generator G on input and obtains an encryption
n
key e G
A invokes the encryption algorithm with key e and dummy plaintext
j j j j
obtaining a ciphertext E
e
j j
A invokes A on input h and outputs whatever A do es
Observe that A is describ ed in terms of an oracle machine that makes a single
oracle call to any given A in addition to invoking the xed algorithms G
and E Furthermore the construction of A do es not dep end on the functions
h and f or on the distribution of messages to b e encrypted represented by
the probability ensembles fX g Thus A is probabilistic p olynomial time
n
n N
whenever A is probabilistic p olynomial time and regardless of the complexity
of h f and fX g
n
n N
Indistinguishability of encryptions will b e used to prove that A p erforms
essentially as well as A Sp eci cally the pro of will use a reducibility argument
Claim Let A b e as ab ove Then for every fX g f h and p as in
n
n N
De nition and all su ciently large n s
h i
jX j
n
n
Pr A E X h X f X
n n n
G
1
h i
jX j
n
Pr A h X f X
n n
p n
j j
Pro of To simplify the notations let us incorp orate into h Using the
de nition of A we can rewritten the claim as asserting
n
Pr A E X h X f X
n n n
G
1
h i
jX j
n
n
Pr A E h X f X
n n
G
1
p n
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
Intuitively this follows by the indistinguishability of encryptions by xing a
violating value of X and incorp orating the corresp onding values of h X and
n n
f X in a description of a circuit which will distinguish an encryption of this
n
jX j
n
value of X from an encryption of Details follow
n
Assume towards the contradiction that for some p olynomial p and in nitely
many n s the ab ove inequality is violated Then for each such n we have
E X p n where
n
h i
def
jxj
n n
x Pr A E x h x f x Pr A E h x f x
G G
1 1
We use an averaging argument to single out a string x in the supp ort of X
n n
p oly n
such that x X That is let x f g b e a string for which
n n n
the value of is maximum and so x p n Using this x we
n n
introduce a circuit C which incorp orates the xed values f x and h x
n n n
jx j
n
and distinguishes the encryption of x from the encryption of The circuit
n
C op erates as follows On input E the circuit C invokes A h x
n n n
and outputs if and only if A outputs the value f x Otherwise C outputs
n n
The ab ove circuit is indeed of p olynomial size b ecause it merely incorp orates
strings of p olynomial length i e f x and h x and emulates a p olynomial
n n
time computation i e of A Note that the circuit family fC g is indeed
n
non uniform since its de nition is based on a non uniform selection of x s as
n
well as on a hard wiring of p ossibly uncomputable corresp onding strings h x
n
and f x Clearly
n
n n
Pr C E Pr A E h x f x
n n n
G G
1 1
Combining Eq with the de nition of x we get
n
h i
jx j
n
n n
x Pr C E x Pr C E
n n n n
G G
1 1
p n
This contradicts our hypothesis that E has indistinguishable encryptions and
the claim follows 2
We have just shown that A p erforms essentially as well as A and so Prop osition
follows
Comments The fact that we deal with a non uniform mo del of computation
allows the ab ove pro of to pro ceed regardless of the complexity of f and h All
that our de nition of C requires is the hardwiring of the values of f and h on
n
a single string and this can b e done regardless of the complexity of f and h
provided that they are b oth p olynomially b ounded
When proving the public key analogue of Prop osition algorithm A is
j j
de ned so that it generates an encryption of relative to the encryption key
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
DEFINITIONS OF SECURITY
given to it as input rather than relative to an encryption key that it generates
by itself as done ab ove In addition the distinguishing circuit considered in
the analysis of the p erformance of A obtains the encryption key as part of its
input and passes it to algorithm A up on invoking it
Pro of of Prop osition
Here the entire pro of is by a reducibility argument We show that if G E D
has distinguishable encryptions then it is not semantically secure not even in
the restricted sense mentioned in the furthermore clause of the prop osition
Towards this end we assume that there exists a p olynomial p a p olynomial
size circuit family fC g such that for in nitely many n s there exists x y
n n n
p oly n
f g so that
n n
Pr C E x Pr C E y
n n n n
G G
1 1
p n
Using this sequence of C s x s and y s we de ne fX g f and h referred
n n n n
n N
to in De nition as follows
The probability ensembles fX g is de ned such that X is uniformly
n n
n N
distributed over fx y g
n n
The function f f g f g is de ned such that f x and f y
n n
for every n Note that f X with probability and is otherwise
n
The function h is de ned such that h X equals the description of the
n
circuit C Note that h X C with probability and thus reveals no
n n n
information on the value of X In the sequel we write h X h n
n n
C
n
Note that X f and h satisfy the restrictions stated in the furthermore clause
n
of the prop osition
We will present a deterministic p olynomial time algorithm A that given
C h X guesses the value of f X from the encryption of X and do es
n n n n
so signi cantly b etter that with probability This violates even the restricted
form of semantic security since no algorithm regardless of its complexity can
jX j
n
guess f X b etter than with probability when only given b ecause
n
jX j
n
given the constant values and h X the value of f X is uniformly
n n
distributed over f g Details follow
Let us assume without loss of generality that for in nitely many n s
n n
Pr C E x Pr C E y
n n n n
G G
1 1
p n
Claim There exists a deterministic p olynomial time algorithm A such
that for in nitely many n s
h i
jX j
n
n
Pr A E X h X f X
n n n
G
1
p n
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
Pro of Algorithm A uses C h X in a straightforward manner On input
n n
j j
E where is in the supp ort of X and h algorithm A
n
recovers C h n h invokes C on input and outputs if C outputs
n n n
otherwise C outputs
n
It is left to analyze the success probability of A Letting m jx j jy j we
n n
have
h i
jX j
n
n
Pr A E X h X f X
n n n
G
1
i h
jX j
n
n
Pr A E X h X f X j X x
n n n n n
G
1
i h
jX j
n
n
Pr A E X h X f X j X y
n n n n n
G
1
m m
n n
Pr A E x C Pr A E y C
n n n n
G G
1 1
n n
Pr C E x Pr C E y
n n n n
G G
1 1
p n
where the inequality is due to Eq 2
In contrast as observed ab ove no algorithm regardless of its complexity
jX j
n
can guess f X with success probability ab ove when given only and
n
h X That is we have
n
Fact For every n and every algorithm A
h i
jX j
n
Pr A h X f X
n n
jX j
n
Pro of Just observe that the output of A on its constant input values
and h X is sto chastically indep endent of the random variable f X which
n n
in turn is uniformly distributed in f g Eq follows and equality holds
in case A always outputs a value in f g 2
Combining Claim and Fact we reach a contradiction to the
hypothesis that the scheme is semantically secure even in the restricted sense
mentioned in the furthermore clause of the prop osition Thus the prop osition
follows
Comment When proving the public key analogue of Prop osition algo
rithm A is de ned as ab ove except that it passes the encryption key given to it
as part of its input to the circuit C The rest of the pro of remains intact
n
We comment that the output by C is an indication that is more likely to b e x
n n
whereas the output of A is a guess of f This p oint may b e b etter stressed by rede ning f
def
so that f x x and f x y if x x and having A output x if C outputs and
n n n n n n
output y otherwise n
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
DEFINITIONS OF SECURITY
Multiple Messages
The ab ove de nitions only refer to the security of an encryption scheme that
is used to encrypt a single plaintext p er a generated key Since the plain
text may b e longer than the key these de nitions are already non trivial and
an encryption scheme satisfying them even in the private key mo del implies
the existence of one way functions see Exercise Still in many cases it is
desirable to encrypt many plaintexts using the same encryption key Lo osely
sp eaking an encryption scheme is secure in the multiple message setting if anal
ogous de nitions to the ab ove hold also when p olynomially many plaintexts
are encrypted using the same encryption key
We show that in the public key model security in the single message set
ting discussed ab ove implies security in the multiple message setting de ned
b elow We stress that this is not necessarily true for the private key model
De nitions
t
For a sequence of strings x x x we let E x denote the sequence
e
of the t results that are obtained by applying the randomized pro cess E to the
e
t t
E x E x E x We t strings x x resp ectively That is
e e e
stress that in each of these t invocations the randomized pro cess E utilizes
e
indep endently chosen random coins For sake of simplicity we consider the en
cryption of p olynomially many strings of the same p olynomial length rather
than the encryption of strings of various lengths as discussed in Exercise
De nition semantic security multiple messages
For private key An encryption scheme G E D is semantically secure for
multiple messages in the private key mo del if for every polynomial t
and every probabilistic polynomial time algorithm A there exists a proba
bilistic polynomial time algorithm A such that for every ensemble f X
n
t n i
X X g with jX j p oly n every pair of functions f h
n n n
n N
f g f g every polynomial p and al l su ciently large n
h i
j X j
n
n
Pr A E X X f X h
n n n
G
1
h i
X j j
n
h Pr A X f X
n n
p n
For public key An encryption scheme G E D is semantically secure for
multiple messages in the public key mo del if for t A A fX g
n
n N
f h p and n as above
h i
n j X j
n
n
Pr A G E X X f X h
n n n
G
1
h i
n j X j
n
Pr A G X f X h
n n
p n
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
X are not necessarily indep endent they may We stress that the elements of
n
dep end on one another Note that the ab ove de nition also cover the case where
the adversary obtains some of the plaintexts themselves In this case it is still
infeasible for him her to obtain information ab out the missing plaintexts see
Exercise
De nition indistinguishability of encryptions multiple messages
For private key An encryption scheme G E D has indistinguishable en
cryptions for multiple messages in the private key mo del if for every poly
nomial t every polynomial size circuit family fC g every polynomial p
n
p oly n
al l su ciently large n and every x x y y f g
t n t n
n n
jPr C E x Pr C E y j
n n
G G
1 1
p n
where x x x and y y y
t n t n
For public key An encryption scheme G E D has indistinguishable encryp
tions for multiple messages in the public key mo del if for t fC g p n
n
and x x y y as above
t n t n
n n
n n
E x Pr C G E y j jPr C G
n n
G G
1 1
p n
The equivalence of De nitions and can b e established analogously to
the pro of of Theorem
Theorem equivalence of de nitions multiple messages A private
key resp public key encryption scheme is semantically secure for multiple mes
sages if and only if it has indistinguishable encryptions for multiple messages
Thus proving that single message security implies multiple message security for
one de nition of security yields the same for the other We may thus concentrate
on the ciphertext indistinguishability de nitions
The e ect on the public key mo del
We rst consider public key encryption schemes
Theorem single message security implies multiple message security
A public key encryption scheme has indistinguishable encryptions for multiple
messages i e satis es De nition in the public key model if and only if
it has indistinguishable encryptions for a single message i e satis es De ni
tion
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
DEFINITIONS OF SECURITY
Pro of Clearly multiple message security implies single message security as a
sp ecial case The other direction follows by adapting the pro of of Theorem
to the current setting
Supp ose towards the contradiction that there exist a p olynomial t a
p olynomial size circuit family fC g and a p olynomial p such that for in nitely
n
p oly n
many n s there exists x x y y f g so that
t n t n
n n
n n
Pr C G E x Pr C G E y
n n
G G
1 1
p n
where x x x and y y y Let us consider such a generic n
t n t n
and the corresp onding sequences x x and y y We use a hybrid
t n t n
argument de ne
def
i
h x x y y
i i
t n
def
n i i
n
G and H E h
G
n
1
t n
n n
n n
E y and H G E x it follows Since H G
n n
G G
1 1
that there exists an i f t n g so that
h i h i
i i
Pr C H Pr C H
n n
n n
t n p n
We show that Eq yields a p olynomial size circuit that distinguishes the
encryption of x from the encryption of y and thus derive a contradic
i i
tion to security in the single message setting Sp eci cally we construct a cir
cuit D that incorp orates the circuit C as well as the index i and the strings
n n
x x y y On input an encryption key e and corresp onding
i i
t n
ciphertext the circuit D op erates as follows
n
For every j i the circuit D generates an encryption of x using the
n j
encryption key e Similarly for every j i the circuit D generates
n
an encryption of y using the encryption key e
j
Let us denote the resulting ciphertexts by That is
i i
t n
E x for j i and E y for j i
j e j j e j
Finally D invokes C on input the encryption key e and the sequence of
n n
ciphertexts and outputs whatever C do es
i i n
t n
We stress that the construction of D relies in an essential way on the fact that
n
the encryption key is given to it as input
We now turn to the analysis of the circuit D Supp ose that is a ran
n
dom encryption of x with key e that is E x Then D e
i e i n
i
i
C e E h C H where X Y means that the random vari
n
n e n
ables X and Y are identically distributed Similarly for E y we have
e i
i
i
Thus by Eq we have D e C e E h C H
n
n n e n
n
n
D G E y Pr
n i
G
1
n
n
Pr D G E x
n i
G
1
t n p n
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
in contradiction to our hypothesis that G E D is a ciphertext indistinguishable
public key encryption scheme in the single message sense The theorem follows
Discussion The fact that we are in the public key mo del is essential to the
ab ove pro of It allows the circuit D to form encryptions relative to the same
n
encryption key used in the ciphertext given to it In fact as stated ab ove and
proven next the analogous result do es not hold in the private key mo del
The e ect on the private key mo del
In contrary to Theorem in the private key model ciphertext indistinguishability
for a single message do es not necessarily imply ciphertext indistinguishability
for multiple messages
Prop osition Suppose that there exist pseudorandom generators robust
against p olynomial size circuits Then there exists a private key encryption
scheme that satis es De nition but does not satisfy De nition
Pro of We start with the construction of the private key encryption scheme
The encryption decryption key for security parameter n is a uniformly dis
tributed n bit long string denoted s To encrypt a ciphertext x the encryption
algorithm uses the key s as a seed for a pseudorandom generator denoted g
that stretches seeds of length n into sequences of length jxj The ciphertext is
obtained by a bit by bit exclusive or of x and g s Decryption is done in an
analogous manner
We rst show that this encryption scheme satis es De nition Intu
itively this follow from the hypothesis that g is a pseudorandom generator and
jxj
the fact that x U is uniformly distributed over f g Sp eci cally supp ose
jxj
towards the contradiction that for some p olynomial size circuit family fC g a
n
p olynomial p and in nitely many n s
jPr C x g U Pr C y g U j
n n n n
p n
n
where U is uniformly distributed over f g and jxj jy j m p oly n On
n
the other hand
Pr C x U Pr C y U
n m n m
Thus without loss of generality
jPr C x g U Pr C x U j
n n n m
p n
Incorp orating x into the circuit C we obtain a circuit that distinguishes U
n m
from g U in contradiction to our hypothesis regarding the pseudorandomness
n
of g
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
DEFINITIONS OF SECURITY
Next we observe that the ab ove encryption scheme do es not satisfy De ni
tion Sp eci cally given the ciphertexts of two plaintexts one may easily
retrieve the exclusive or of the corresp onding plaintexts That is
E x E x x g s x g s x x
s s
This clearly violates De nition e g consider f x x x x as well
as De nition e g consider any x x x and y y y such that
x x y y Viewed in a di erent way note that any plaintext ciphertext
pair yields a corresp onding pre x of the pseudorandom sequence and knowledge
of this pre x violates the security of additional plaintexts That is given the
encryption of a known plaintext x along with the encryption of an unknown
plaintext x we can retrieve x On input the ciphertexts knowing that
the rst plaintext is x rst retrieves the pseudorandom sequence i e it is just
def
r x and next retrieves the second plaintext i e by computing r
Discussion The single message security of the ab ove scheme was proven by
considering an ideal version of the scheme in which the pseudorandom sequence
is replaced by a truly random sequence The latter scheme is secure in an in
formation theoretic sense and the security of the actual scheme followed by the
indistinguishability of the two sequences As we show in Section b elow
the ab ove construction can b e mo di ed to yield a private key stream cipher
that is secure for multiple message encryptions All that is needed is to make
sure that as opp osed to the construction ab ove the same p ortion of the pseu
dorandom sequence is never used twice
A uniform complexity treatment
As stated at the b eginning of this section the non uniform formulation was
adopted here for sake of simplicity In this subsection we sketch a uniform
complexity de nitional treatment of security We stress that by uniform or non
uniform complexity treatment of cryptographic primitives we merely refer to the
mo deling of the adversary The honest legitimate parties are always mo deled
by uniform complexity classes most commonly probabilistic p olynomial time
The notion of e ciently constructible ensembles de ned in Section
is central to the uniform complexity treatment Recall that an ensemble X
fX g is said to b e p olynomial time constructible if there exists a probabilistic
n
n N
n
p olynomial time algorithm S so that for every n the random variables S
and X are identically distributed
n
The de nitions
We present only the de nitions of security for multiple messages the single
message variant can b e easily obtained by setting the p olynomial t b elow to b e
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
identically Likewise we present the public key version and the private key
n
analogous can b e obtained by omitting G from the inputs to the various
algorithms
The uniformity of the following de nitions is re ected in the complexity of
the inputs given to the algorithms Sp eci cally the plaintexts are taken from
p olynomial time constructible ensembles and so are the auxiliary inputs given to
the algorithms For example in the following de nition we require the ensemble
X g to b e p olynomial time constructible and the function h to b e p olynomial f
n
time computable
De nition semantic security uniform complexity version An en
cryption scheme G E D is uniformly semantically secure in the public key
mo del if for every polynomial t and every probabilistic polynomial time algo
rithm A there exists a probabilistic polynomial time algorithm A such that for ev
t n
ery polynomial time constructible ensemble f X X X g with
n n
n
n N
i
jX j p oly n every polynomial time computable h f g f g every
n
f f g f g every positive polynomial p and al l su ciently large n s
h i
X j n j
n
n
h Pr A G E X X f X
n n n
G
1
i h
X j j
n
X f X h Pr A
n n
p n
def
t n t n
for is as in Def E x x E x E x x x where
n n n n
e e n e
inition
Again we stress that X is a sequence of random variables which may dep end
n
n
on one another Also the encryption key G was omitted from the input of
A since the latter may generate it by itself We stress that even here i e in
the uniform complexity setting no computational limitation are placed on the
function f
De nition indistinguishability of encryptions uniform complexity ver
sion An encryption scheme G E D has uniformly indistinguishable encryp
tions in the public key mo del if for every polynomial t every probabilistic polynomial
def
T fT time algorithm D every polynomial time constructible ensemble
n
t n t n i
X Y Z g with X X X Y Y Y and jX j
n n n n n
n n n n n
n N
i
j p oly n jY
n
n
n
E X jPr D Z G
n n
G
1
n
n
Pr D Z G E Y j
n n
G
1
p n
for every positive polynomial p and al l su ciently large n s
The random variable Z captures a priori information ab out the plaintexts for
n
which encryptions should b e distinguished A sp ecial case of interest is when
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
DEFINITIONS OF SECURITY
X Y Uniformity is captured in the requirement that D is a probabilistic Z
n n n
p olynomial time algorithm rather than a family of p olynomial size circuits and
that the ensemble f T X Y Z g b e p olynomial time constructible
n n n n
n N
Equivalence of the multiple message de nitions
We prove the equivalence of the uniform complexity de nitions presented ab ove
for multiple message security
Theorem equivalence of de nitions uniform treatment A public
key encryption scheme satis es De nition if and only if it satis es Def
inition Furthermore this holds even if De nition is restricted to
X Y and even if De nition is restricted to the special case where Z
n n n
the special case where f is polynomial time computable
An analogous result holds for the private key mo del The imp ortant direction of
the theorem holds also for the single message version this is quite obvious from
the pro of b elow In the other direction we seem to use the multiple message
version of semantic security in an essential way
Pro of Sketch Again we start with the more imp ortant direction that is
assuming that G E D has uniformly indistinguishable encryptions in the
X Y we show that it is uniformly semantically sp ecial case where Z
n n n
secure Our construction of algorithm A is analogous to the construction used
j j
n
in the non uniform treatment Sp eci cally on input algorithm h
n
j j
n
A generates a random encryption of a dummy sequence of message i e
feeds it to A and outputs whatever A do es That is
n j j j j j j
n n n
n
A G E h h A
n n
G
As in the non uniform case the analysis of algorithm A reduces to the following
claim
Claim For every p olynomial time constructible ensemble f X g
n
n N
t n i
X X X and jX j p oly n every p olynomial time com with
n n n
n
putable h every p ositive p olynomial p and all su ciently large n s
n
n
Pr A G E X h X f X
n n n
G
1
i h
X j j n
n
n
h E X f X Pr A G
n n
G
1
p n
Pro of sketch Analogously to the non uniform case assuming towards the con
tradiction that the claim do es not hold yields an algorithm that distinguishes
jX j
n
X from encryptions of Y when getting auxiliary in encryptions of
n n
jX j
n
formation Z X Y X Thus we derive contradiction to De ni
n n n n
tion even under the sp ecial case p ostulated in the theorem
We note that the auxiliary information that is given to the distinguishing
algorithm replaces the hard wiring of auxiliary information that was used in
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
the non uniform case and is not p ossible in the uniform complexity mo del
Sp eci cally rather than using a hard wired value of h at some non uniformly
xed sequence the distinguishing algorithm will use the auxiliary information
jX j
n
X in order to compute h X which it will pass to A Indeed we Z
n n n
rely on the hypothesis that h is e ciently computable
The actual pro of is quite simple in case the function f is also p olynomial
time computable which is not the case in general In this sp ecial case on input
jxj jxj
e z E where z x and fx g the distinguishing algorithm
e
computes u h x and v f x invokes A and outputs if and only if
jxj
E u v A e
e
xj j
We comment that in case we actually mean that is a
n
sequence of t n strings of the form where t and are as in x
t n n t n
x x f g
The pro of b ecomes more involved in case f is not p olynomial time computable
Again the solution is in realizing that indistinguishability of encryption p ostu
lates a similar output pro le in b oth cases and in particular no value can o ccur
non negligibly more in one case than in the other To clarify the p oint we de
n
n
x to b e the di erence b etween Pr A G E x h x v ne
n n n v
G
1
jx j n
n
n
E h x v We know that E X and Pr A G
n n
G
1
f X
n
p n but given x we cannot evaluate x since we do not have
n n
f x
n
def
x Instead we let x max f x g and observe that E X f
n n v v n n
E X p n Furthermore given x we can approximate x
n n n
X f
n
in p olynomial time and can nd in p olynomial time a value v such that
n
x x p n with probability at least
v n n
x etc By invoking algorithm A on O n p n sam On approximating
n
n n j x j
n
n n
ples of the distributions G E x h x and G E x h
n n n
G G
1 1
we obtain implicitly an approximation of all x s upto an additive
v n
n
deviation of p n with error probability at most The approxima
e
x denoted x is merely the di erence b etween the frac tion to
n v n v
tion of samples from b oth distributions on which algorithm A returned
Indeed most x s are approximated by but some x s
v n v n
may approximated by non zero values We just output v for which the
e
x is largest Thus if for some v it holds that approximated value
n v
n
x x then with probability at least we output v such
v n n
0
that
e
x x p n
n v n v
e
x p n
v n
0
x p n p n
v n
0
x x p n Thus
n n v
Unlike in the non uniform treatment here we cannot hardwire values such as the values
of h and f on go o d sequences into the algorithm D which is required to b e uniform
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
DEFINITIONS OF SECURITY
jxj
E where z x the new algorithm denoted D Thus on input e z
e
op erates in two stages
In the rst stage D ignores the ciphertext E Using z algorithm D
e
recovers x and computes u h x Using x and u algorithm D estimates
x and nds a v as ab ove
In the second stage using u and v found in the rst stage algorithm D
jxj
invokes A and outputs if and only if A e E u v
e
x b e the value found in the rst stage of algorithm A i e obliviously of Let V
the ciphertext E The reader can easily verify that
e
h i
n n X
n
n n
E X Pr D G Z E Pr D G Z
n n n
G G
1 1
h i
E X
n
X V
n
n n
X E
n
p n
E X
n
p n p n
Thus we have derived a probabilistic p olynomial time algorithm i e D that
jX j
n
distinguishes encryptions of X from encryptions of Y when getting
n n
j X j
n
X X g is p olynomial time By hypothesis f auxiliary information Z
n n n
constructible and it follows that so is fX Y Z g Thus we derive contradiction
n n n
to De nition even under the sp ecial case p ostulated in the theorem and
the claim follows 2
Having established the imp ortant direction we now turn to the opp osite
one That is we assume that G E D is uniformly semantically secure and
prove that it has uniformly indistinguishable encryptions Again the pro of is
by contradiction Supp ose without loss of generality that there exists a proba
bilistic p olynomial time algorithm D a p olynomial time constructible ensemble
def
T fT X Y Z g as in De nition a p ositive p olynomial p and
n n n n
n N
in nitely many n s so that
n
n
Pr D Z G E X
n n
G
1
n
n
Pr D Z G E Y j
n n
G
1
p n
X resp Y consists of t n strings each Let t n and n b e such that
n n
of length n Supp ose without loss of generality that jZ j m n n
n
m n
n m n
and parse Z into Z Z Z f g such that Z
n n
n n n
m n
Z Z We de ne an auxiliary p olynomial time constructible ensemble
n n
def
Q fQ g so that
n N
n
n
Z X Y with probability
n n n
Q
n
n
Z Y X with probability
n n n
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
Q is a sequence of m n t n strings each of length n that That is
n
contains Z X Y in addition to a bit provided in the n bit long pre x
n n n
indicating whether the order of X and Y is switched or not We de ne the
n n
function f so that to equal this switch indicator bit and the function h to
provide all information in Q except this switch bit That is we de ne f and h
n
as follows
The function f f g f g is de ned so that f returns the rst bit of
n l n m n t n
its input that is f abc for a b c f g
The function h f g f g is de ned so that h provides the in
formation in the su x without yielding information on the pre x that
n n
is h abc abc if and h abc acb otherwise Thus
Q Z X Y that is it returns T to its original order undoing the h
n n n n
n
p ossible switch employed in Q
n
We stress that b oth h and f are p olynomial time computable
We will show that the distinguishing algorithm D which distinguishes E X
n
from E Y when also given Z Z can b e transformed into a p olynomial
n n n
size algorithm A that guesses the value of f Q from the encryption of Q
n n
Q and do es so signi cantly b etter than with proba and the value of h
n
This violates semantic security since no algorithm regardless of its bility
running time can guess f Q b etter than with probability when only given
n
Q j Q j j j
n n
h since given h the value of f Q and Q and Q is uniformly
n n n
distributed over f g
j n l n m n t n j
On input e E where abc f g h
e
n n
equals either z x y or z y x algorithm A pro ceeds in two stages
E It rst extracts In the rst stage algorithm A ignores the ciphertext
e
x y and z ov z out of h z x y and approximates z x y which
is de ned to equal
n n
n n
Pr D z G E x Pr D z G E y
G G
1 1
Sp eci cally using O n p n samples algorithm A obtains an approx
e e
x y such that j z x y z x y j p n imation denoted z
n
with probability at least
e e
Algorithm A sets if z x y p n sets if z x y
e
p n and sets otherwise i e j z x y j p n
In case algorithm A halts with an arbitrary reasonable guess say a
randomly selected bit We stress that all this is done obliviously of the
E which is only used next ciphertext
e
In the second stage algorithm A extracts the last blo ck of ciphertexts i e
n
E c out of E E abc and invokes D on input z e E c
e e e e
where z is as extracted in the rst stage Using the value of as determined
in the rst stage algorithm A decides as follows
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
DEFINITIONS OF SECURITY
In case algorithm A outputs if and only if the output of D
is
In case algorithm A outputs if and only if the output of D
is
Q h f and A b e as ab ove Claim Let p
n
n
n
E Q h Q f Q Pr A G
G
n n n
1
p n
x y Pro of sketch We fo cus on the case in which the approximation of z
computed by the rst stage of A is within p n of the correct value Thus
in case the sign of concurs with the sign of z x y It follows that
x y such that it holds that z x y and the for every p ossible z
following holds
n
n
Pr A G E Q h Q f Q j Z X X z x y
n n n
G
n n n
1
i h
n n n
n
E z x y h z x y Pr A G
G
1
i h
n n n
n
E z y x h z y x Pr A G
G
1
n
n
E y Pr D z G
G
1
n
n
E x Pr D z G
G
1
x y z
Similarly for every p ossible z x y such that it holds that z x y
and the following holds
n
n
Pr A G E Q h Q f Q j Z X X z x y
n n n
G
n n n
1
i h
n n n
n
E z x y h z x y A G Pr
G
1
i h
n n n
n
E z y x h z y x Pr A G
G
1
n
n
E y Pr D z G
G
1
n
n
E x Pr D z G
G
1
x y z
Thus in b oth cases where algorithm A succeeds with probability
z x y x y j j z
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
x y and in case it succeeds with probability Recall that if z
X Y then Using the contradiction hypothesis that asserts that E Z
n n n
p n
we lower b ound Pr Z by Thus the overall suc X X
n n n
p n p n p n
cess probability of algorithm A is at least
p n
p n p n p n
and the claim follows 2
This completes the pro of of the opp osite direction
Discussion The pro of of the rst i e imp ortant direction holds also in the
single message setting In general for any function t in order to prove that
semantic security holds with resp ect to t long sequences of ciphertexts we just
use the hypothesis that t long message sequences have indistinguishable encryp
tions In contrast the pro of of the second i e opp osite direction makes an
essential use of the multiple message setting In particular in order to prove
that t long message sequences have indistinguishable encryptions we use the
hypothesis that semantic security holds with resp ect to m t long se
quences of ciphertexts where m dep ends on the length of the auxiliary input in
the claim of ciphertext indistinguishability Thus even if we only want to es
tablish ciphertext indistinguishability in the single message setting we do so by
using semantic security in the multiple message setting Furthermore we use the
fact that given a sequence of ciphertexts we can extract a certain subsequence
of ciphertexts
Single message versus multiple message de nitions
As in the non uniform case for the public key mo del single message security
implies multiple message security Again this implication do es not hold in the
private key mo del The pro ofs of b oth statements are analogous to the pro ofs
provided in the non uniform case Sp eci cally
For the public key mo del single message uniform indistinguishability of
encryptions imply multiple message uniform indistinguishability of encryp
tions which in turn implies multiple message uniform semantic security
In the pro of of this result we use the fact that all hybrids are p olynomial
time constructible and that we may select a random pair of neighboring
hybrids cf the pro of of Theorem We also use the fact that an
t n
ensemble of triplets f T X Y Z g with X X X
n n
n n n n
n N
n
t n
Y Y Y as in De nition induces an ensemble of
n n
n
triplets fT X Y Z g for the case t Sp eci cally we shall use
n n n n
n N
i i
X Y Z i where i is uniformly and Z Y Y X X
n n
n n n n n
n
distributed in f t n g
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CONSTRUCTIONS OF SECURE ENCRYPTION SCHEMES
For the private key mo del single message uniform indistinguishability of
encryptions do es not imply multiple message uniform indistinguishability
of encryptions The pro of is exactly as in the non uniform case
The gain of a uniform treatment
Supp ose that one is content with the uniform complexity level of security which
is what we advocate b elow Then the gain in using the uniform complexity
treatment is that a uniform complexity level of security can b e obtained using
only uniform complexity assumptions rather than non uniform complexity as
sumptions Sp eci cally the results presented in the next section are based on
non uniform assumptions such as the existence of functions that cannot b e in
verted by p olynomial size circuits rather than by probabilistic p olynomial time
algorithms These non uniform assumption are used in order to satisfy the
non uniform de nitions presented in the main text ab ove Using any of these
constructions while making the analogous uniform assumptions yields encryp
tion schemes with the analogous uniform complexity security We stress that
this is no coincidence but is rather an artifact of these results b eing proven by
a uniform reducibility argument
However something is lost when relying on these seemingly weaker uniform
complexity assumptions Namely the security we obtain is only against the
seemingly weaker uniform adversaries We b elieve that this loss in security
is immaterial Our b elief is based on the thesis that uniform complexity is the
right mo del of real world cryptography We b elieve that it is reasonable to
consider only ob jects i e inputs generated by uniform and e cient pro cedures
and the e ect that these ob jects have on uniformly and e cient observers i e
adversaries In particular schemes secure against probabilistic p olynomial time
adversaries can b e used in any setting consisting of probabilistic p olynomial time
machines with inputs generated by probabilistic p olynomial time pro cedures
We b elieve that the cryptographic setting is such a case
Constructions of Secure Encryption Schemes
In this subsection we present constructions of secure private key and public
key encryption schemes Here and throughout this section security means se
mantic security in the multiple message setting Recall that this is equivalent
to ciphertext indistinguishability in the multiple message setting Also recall
that for public key schemes it su ces to prove ciphertext indistinguishability in
the single message setting The main results of this section are
Using any non uniformly robust pseudorandom function one can con
struct secure private key encryption schemes Recall that the former can
b e constructed using any non uniformly strong one way function
Using any non uniform strong trap do or one way p ermutation one can
construct secure public key encryption schemes
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
In addition we review some p opular suggestions for private key and public key
encryption schemes
Probabilistic Encryption Before starting we recall that a secure public key
encryption scheme must employ a probabilistic i e randomized encryption al
gorithm Otherwise given the encryption key as additional input it is easy
to distinguish the encryption of the all zero message from the encryption of the
all ones message The same holds for private key encryption schemes when con
sidering the multi message setting For example using a deterministic private
key encryption algorithm allows the adversary to distinguish two encryptions
of the same message from the encryptions of a pair of di erent messages Thus
the common practice of using pseudorandom p ermutations as blo ck ciphers
see de nition b elow is not secure again one can distinguish two encryptions
of the same message from encryptions of two di erent messages This explains
the linkage b etween the ab ove robust security de nitions and randomized a k a
probabilistic encryption schemes Indeed all our encryption schemes will em
ploy randomized encryption algorithms
Stream Ciphers
It is common practice to use pseudorandom generators as a basis for private
key stream ciphers We stress that this is a very dangerous practice when the
pseudorandom generator is easy to predict such as the linear congruential
generator or some mo di cations of it that output a constant fraction of the
bits of each resulting number However this common practice b ecomes sound
provided one uses pseudorandom generators as de ned in Section Thus we
obtain a private key stream cipher that allows to encrypt a stream of plaintext
bits Note that such a stream cipher do es not conform with our formulation of
an encryption scheme i e as in De nition since for encrypting several
messages one is required to maintain a counter In other words we obtain a
encryption scheme with a variable state that is mo di ed after the encryption of
each message
We comment that constructions of secure and stateless encryption schemes
i e conforming with De nition are known and presented in Sections
and The traditional interest in stream ciphers is due to e ciency consid
erations We discuss this issue at the end of Section But b efore doing so
let us formalize the ab ove discussion
We note that the ab ove do es not hold with resp ect to private key schemes in the single
message setting Hint the private key can b e augmented to include a seed for a pseudorandom
generator the output of which can b e used to eliminate randomness from the encryption
algorithm Question why do es the argument fail in the public key setting and in the multi
message private key setting
The private key stream ciphers discussed in Section are an exception but as
we p oint out they do not adhere to our basic formulation of encryption schemes as in
De nition
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CONSTRUCTIONS OF SECURE ENCRYPTION SCHEMES
De nitions The following formalization extends De nition The key
generation algorithm remains unchanged but b oth the encryption and decryp
tion algorithm take an additional input and emit an additional output corre
sp onding to their state b efore and after the op eration The length of the state
is not allowed to grow by to o much during each application of the encryption
algorithm see Item b elow or else e ciency of the entire rep eated encryp
tion pro cess can not b e guaranteed The initial state of b oth algorithms is
the empty string For clarity the reader may consider of the sp ecial case in
which the state counts the number of times the scheme was invoked or the total
number of plaintext bits in such invocations
De nition state based cipher the mechanism A state based encryp
tion scheme is a triple G E D of probabilistic polynomial time algorithms
satisfying the fol lowing two conditions
n
On input algorithm G outputs a pair of bit strings
n
For every pair e d in the range of G every string s representing
a possible state every f g and every pair s in the range of
E e s it holds that D d s
That is given ciphertext and the decryption key along with the state of
the encryption pro cess b efore encrypting the current plaintext the decryp
tion algorithm retrieves the plaintext
There exists a polynomial p so that for every pair e d in the range of
n
G every string s representing a possible state every f g and
every pair s in the range of E e s it holds that js j jsj j j p n
That is as in De nition the encryption decryption pro cess op erates prop
erly i e the decrypted message equals the plaintext provided that the corre
sp onding algorithm get the corresp onding keys along with the same start state
However since the ab ove holds also for the empty string s it is not clear in
what sense the ab ove yields something novel Indeed the novelty is in the se
curity de nition that refers to the encryption of multiple messages and holds
only in case the state is prop erly maintained throughout the multiple message
encryption pro cess Below we present only the semantic security de nition for
private key schemes
De nition semantic security state based cipher For a state based
t
x x x we let E x encryption scheme G E D and any
e
t t
S C S C be the result of the fol lowing t step random pro
i i
cess where S is the empty string For i t we let S C
i i
E S x where each of the t invocations E utilizes independently cho
e e
sen random coins The scheme G E D is semantically secure in the state based
A stronger requirement which is achieved by the construction b elow is that D d s
s That is that the decryption algorithm can gure out the up dated state of the encryp
tion pro cess This extra prop erty is useful in applications where decryption is p erformed in
the same order as encryption e g in fifo communication
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
private key mo del if for every polynomial t and every probabilistic polynomial
time algorithm A there exists a probabilistic polynomial time algorithm A such
i t n
j p oly n g with jX X X X that for every ensemble f
n n n
n
n N
every pair of functions f h f g f g every polynomial p and al l
su ciently large n
h i
j X j
n
n
Pr A E X X f X h
n n n
G
1
h i
j X j
n
Pr A X f X h
n n
p n
Note that De nition di ers from De nition only in the pream
E x Furthermore De nition guaran ble de ning the random variable
e
tees nothing regarding an encryption pro cess in which the plaintext sequence
t t
x x is encrypted by E S x E S x E S x i e
e e e
the state is reset to S after each encryption Finally note that the secu
rity is preserved also when the adversary knows all intermediate values of the
encryption state This is required in applications since we need to pass these
intermediate states to the receiver in order to allow prop er decryption
A sound version of a common practice Lo osely sp eaking using any pseu
dorandom generator one can easily construct a secure state based private key
encryption scheme The state will hold the total number of bits encrypted so
th th
far and the i bit to b e encrypted is encrypted by xoring it with the i bit of
the pseudorandom generator A minor technicality arises since pseudorandom
generators were de ned to have an a priori xed number of output bits as a
function of the seed length whereas here we need an a priori unbounded p oly
nomial number of bits This technicality is resolved by using variable output
pseudorandom generators as de ned and studied in Section
Construction how to construct state based private key encryption schemes
N t
Let G f g f g so that jG r j t for every r f g and t N
n
key generation and initial state Uniformly select r f g and output the
key pair r r The initial state is viewed as t
encrypting plaintext x with key r and state t Let jxj and p be the bit suf
t
x of G r Then the ciphertext is x p and the new state is set to
t
decrypting ciphertext y with key r and state t Let jy j and p be the bit
t
su x of G r Then the ciphertext is y p
The reader may easily verify the following
The decryption algorithm can infer the state of the encryption algorithm i e t For
motivation see Footnote
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CONSTRUCTIONS OF SECURE ENCRYPTION SCHEMES
Prop osition Suppose that G is a variable output pseudorandom genera
tor with respect to polynomial size circuits Then Construction constitutes
a secure state based private key encryption scheme
Preliminaries Blo ck Ciphers
Many encryption schemes are more conveniently presented by rst presenting a
restricted type of encryption scheme that we call a block cipher In contrast
to encryption schemes as de ned in De nition blo ck ciphers de ned
b elow are only required to op erate on plaintext of a sp eci c length which is a
function of the security parameter As we shall see given a secure blo ck cipher
we can easily construct a general secure encryption scheme
De nition blo ck cipher A blo ck cipher is a triple G E D of prob
abilistic polynomial time algorithms satisfying the fol lowing two conditions
n
On input algorithm G outputs a pair of bit strings
There exists a polynomially bounded function N N called the blo ck
n
length so that for every pair e d in the range of G and for each
n
f g algorithms E and D satisfy
Pr D E
d e
Typically we use either n n or n Analogously to De ni
tion the ab ove de nition do es not distinguish private key encryption schemes
from public key ones The di erence b etween the two types is captured in the
security de nitions which are essentially as b efore with the mo di cation that
we only consider plaintexts of length n For example the analogue of De ni
tion reads
De nition semantic security private key blo ck ciphers A block cipher
G E D with block length is semantically secure in the private key mo del
if for every probabilistic polynomial time algorithm A there exists a probabilis
tic polynomial time algorithm A such that for every ensemble fX g with
n
n N
jX j n and f h p and n as in De nition
n
h i
jX j
n
n
Pr A E X h X f X
n n n
G
1
h i
jX j
n
Pr A h X f X
n n
p n
In using the term block cipher we abuse standard terminology by which a blo ck cipher
must in addition to op erating on plaintext of sp eci c length pro duce ciphertexts equal in
length to the length of the corresp onding plaintexts We comment that the latter cannot b e
semantically secure see Exercise
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
Transforming blo ck ciphers into a general encryption schemes There
are obvious ways of transforming a blo ck cipher into a general encryption scheme
The basic idea is to break the plaintexts for the resulting scheme into blo cks
and enco de each blo ck separately by using the blo ck cipher Thus the security
of the blo ck cipher in the multiple message settings implies the security of the
resulting encryption scheme The only technicality we need to deal with is how
to encrypt plaintexts of length that is not an integer multiple of the blo ck length
i e n This is easily resolved by padding the last blo ck while indicating
the end of the actual plaintext
Construction from blo ck ciphers to general encryption schemes Let
G E D be a block cipher with block length function We construct an en
cryption scheme G E D as fol lows The key generation algorithm G is
identical to G To encrypt a message with encryption key e generated under
security parameter n we break it into consecutive blocks of length n while
possibly augmenting the last block Let be the resulting blocks Then
t
def
E j j E E
e e t
e
To decrypt the ciphertext m with decryption key d we let
t i
D for i t and let the plaintext be the m bit long pre x of the con
d i
catenated string
t
The ab ove construction yields ciphertexts which reveal the exact length of the
plaintext Recall that this is not prohibited by the de nitions of security and
that we cannot hop e to entirely hide the length However we can easily construct
encryption schemes that hide some information ab out the length of the plaintext
see examples in Exercise Also note that the ab ove construction applies even
to the sp ecial case where is identically
Prop osition Let G E D and G E D be as in Construction
Suppose that the former a secure private key resp public key block cipher
Then the latter is a secure private key resp public key encryption scheme
Pro of Sketch The pro of is by a reducibility argument Assuming towards the
contradiction that the encryption scheme G E D is not secure we conclude
that neither is G E D contradicting our hypothesis Note that in case the
security of G E D is violated via t n messages of length L n p oly n
the security of G E D is violated via t n dL n n e messages of length
n Also the argument may utilize any of the two notions of security i e
semantic security or ciphertext indistinguishability
We choose to use a very simple indication of the end of the actual plaintext i e include
its length in the ciphertext In fact it su ces to include the length of the plaintext mo dulo
n j j mo d n
n Another natural alternative is to use a padding of the form while
observing that no padding is ever required in case n
Recall that throughout this section security means security in the multiple message setting
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CONSTRUCTIONS OF SECURE ENCRYPTION SCHEMES
Private key encryption schemes
Secure private key encryption schemes can b e easily constructed using any e
ciently computable pseudorandom function ensemble see Section Sp eci
cally we present a blo ck cipher with blo ck length n n The key generation
algorithm consists of selecting a seed denoted s for such a function denoted
n
f To encrypt a message x f g using key s the encryption algorithm
s
n
uniformly selects a string r f g and pro duces the ciphertext r x f r
s
To decrypt the ciphertext r y using key s the decryption algorithm just
computes y f r Formally we have
s
Construction a private key blo ck cipher based on pseudorandom func
tions Let F fF g be an e ciently computable function ensemble and let I
n
n
and V be the algorithms associated with it That is I selects a function with
distribution F and V i x returns f x where f is the function associated with
n i i
the string i We de ne a private key block cipher G E D with block length
n n as fol lows
n n
key generation G i i where i I
n
encrypting plaintext x f g E x r V i r x where r is uniformly
i
n
chosen in f g
decrypting ciphertext r y D r y V i r y
i
Below we assume that F is pseudorandom with respect to polynomial size cir
cuits meaning that no p olynomial size circuit having oracle gates can distin
guish the case the answers are provided by a random function from the case in
which the answers are provided by a function in F Alternatively one may con
sider probabilistic p olynomial time oracle machines that obtain a non uniform
p olynomially long auxiliary input That is
for every probabilistic polynomial time oracle machine M for every
pair of positive polynomial p and q for al l su ciently large n s and
p n
al l z f g
n
f f
I (1 )
Pr M z Pr M z
q n
n n
where f is a uniformly selected function mapping f g to f g
Recall that such non uniformly strong pseudorandom functions can b e con
structed using any non uniformly strong one way function
Prop osition Let F and G E D be as in Construction and sup
pose that F is pseudorandom with respect to polynomial size circuits Then
G E D is secure
Combining Prop ositions and with the ab ove we obtain
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
Theorem If there exist non uniformly strong one way functions then
there exist secure private key encryption schemes
The converse holds to o see Exercise
Pro of of Prop osition The pro of consists of two steps suggested as
a general metho dology in Section
Prove that an idealized version of the scheme in which one uses a uniformly
n n
selected function f f g f g rather than the pseudorandom func
tion f is secure in the sense of ciphertext indistinguishability
s
Conclude that the real scheme as presented ab ove is secure since other
wise one could distinguish a pseudorandom function from a truly random
one
t
Sp eci cally in the ideal version the messages x x are encrypted by
t t t i
r f r x r f r x where the r s are indep endently and
uniformly selected and f is a random function Thus with probability greater
n i i i
than t the r s are all distinct and so the values f r x are
i
indep endently and uniformly distributed regardless of the x s It follows that
the ideal version is ciphertext indistinguishable Now if the actual scheme is
i
not ciphertext indistinguishable then for some sequence of r s a p olynomial
i i i i
size circuit can distinguish the f r x s from the f r x s where
s
f is random and f is pseudorandom But this contradicts the hypothesis that
s
p olynomial size circuits cannot distinguish b etween the two
Discussion Note that we could have gotten rid of the randomization if we
had allowed the encryption algorithm to b e history dep endent as discussed in
Section ab ove Sp eci cally in such a case we could have used a counter in
the role of r Furthermore if the encryption scheme is used for fifo communica
tion b etween the parties and b oth can maintain the counter value then there is
no need for the sender to send the counter value However in the later case Con
struction is preferable b ecause the adequate pseudorandom generator may
b e more e cient than a pseudorandom function as used in Construction
We note that in case the encryption scheme is not used for fifo communication
and one may need to decrypt messages with arbitrary varying counter values it
is typically b etter to use Construction Furthermore in many cases it may
b e preferable to select a value i e r at random rather than rely on a counter
that must stored in a reliable manner b etween applications of the encryption
algorithm
The ciphertexts pro duced by Construction are longer than the corre
sp onding plaintexts This is unavoidable in case of secure history indep endent
encryption schemes see Exercise In particular the common practice of
using pseudorandom p ermutations as blo ck ciphers is not secure e g one
That is letting E x p x where p is the p ermutation asso ciated with the string i
i i i
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CONSTRUCTIONS OF SECURE ENCRYPTION SCHEMES
can distinguish two encryptions of the same message from encryptions of two
di erent messages
Public key encryption schemes
As mentioned ab ove randomization during the encryption pro cess can b e avoided
in private key encryption schemes that employ a varying state not allowed in
our basic De nition In case of public key encryption schemes random
ization during the encryption pro cess is essential even if the encryption scheme
employs a varying state Thus the randomized encryption paradigm plays an
even more pivotal role in the construction of public key encryption scheme To
demonstrate this paradigm we start with a very simple and quite wasteful con
struction But b efore doing so we recall the notion of trap do or p ermutations
Trapdo or p ermutations All our constructions employ a collection of trap
do or p ermutations as in De nition Recall that such a collection fp g
comes with four probabilistic p olynomial time algorithms denoted here by I S F
and B for index sample forward and backward such that the following syn
tactic conditions hold
n
On input algorithm I selects a random n bit long index of a p ermu
tation p along with a corresp onding trap do or
On input algorithm S samples the domain of p returning a random
element in it
For x in the domain of p given and x algorithm F returns p x i e
F x p x
n
For y in the range of p if is a p ossible output of I then given
y y i e B y p and y algorithm B returns p
The hardness condition refers to the di culty of inverting p on a random
element of its range when given only the range element and That is let
n n
I denote the rst element in the output of I i e the index then for
every p olynomial size circuit family fC g every p olynomial p and all su ciently
n
large n s
n n n
n
Pr C I p S I S I
n
I
1
p n
Namely C fails to invert p on p x where and x are selected by I and
n
S as ab ove Recall the ab ove collection can b e easily mo di ed to have a hard
core predicate cf Theorem For simplicity we continue to refer to the
collection as fp g and let b denote the corresponding hard core predicate
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
Simple schemes
We are now ready to present a very simple alas quite wasteful construction of
a secure public key encryption scheme It is a blo ck cipher with
Construction a simple public key blo ck cipher scheme Let fp g
I S F B and b be as above
key generation The key generation algorithm consists of selecting at random
a permutation p together with a trapdoor for it The permutation or
rather its description serves as the public key whereas the trapdoor serves
n n
as the private key That is G I which means that the index
trapdoor pair generated by I is associated with the key pair of G
encryption To encrypt a bit using the encryption key the encryption
algorithm randomly selects an element r in the domain of p and produces
the ciphertext p r b r That is E F r b r where
r S
decryption To decrypt the ciphertext y using the decryption key the de
cryption algorithm just computes b p y where the inverse is com
puted using the trapdoor of p That is D y b B y
Clearly for every p ossible output of G and for every f g it holds
that
D E b B F S b S
b p p S b S
b S b S
The security of the ab ove public key encryption scheme follows from the non
uniform one way feature of the collection fp g or rather from the hypothesis
that b is a corresp onding hard core predicate
Prop osition Suppose that b is a non uniformly strong hard core of
the collection fp g Then Construction constitute a secure public key
block cipher with block length
Pro of Recall that by the equivalence theorems i e Theorems and
it su ces to show single message ciphertext indistinguishability Furthermore
by Prop osition and the fact that here there are only two plaintexts i e
and it su ces to show that one cannot predict which of the two plaintexts
selected at random is b eing encrypted signi cantly b etter than with success
probability We conclude by noting that a guess for the plaintext
given the encryption key and the ciphertext E f r b r where
r S yields a guess b r for b r given f r The latter guess
is correct with probability equal to the probability that and contradicts
the hypothesis that b is a hard core of fp g Details follow
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CONSTRUCTIONS OF SECURE ENCRYPTION SCHEMES
Recall that by saying that b is a hard core of fp g we mean that for every
p olynomial size circuit family fC g every p olynomial p and all su ciently large
n
n s
n n n
n
Pr C I p S I b S I
n
I
1
p n
By Prop osition it su ces to show that for randomly chosen i e
n
I and uniformly distributed f g no p olynomial size circuit given the
encryption key and the ciphertext E can predict non negligibly b etter
than with success probability Supp ose towards the contradiction that there
exists a p olynomial size circuit family fC g a p olynomial p and in nitely many
n
n s such that
n
n
Pr C I E
I
n
1
p n
where is uniformly distributed in f g Recall that E p r b r
where r S is a random sample in p s domain and consider the following
probabilistic circuit C On input and y in the range of p the circuit
n
C uniformly selects f g invokes C on input y and outputs
n n
C y In the following analysis of the b ehavior of C we let
n n
n
I r S and consider uniformly distributed f g
Pr C p r b r Pr C p r b r
n n
Pr C p r b r
n
Pr C p r b r b r b r
n
Pr C E
n
p n
where the inequality is due to Eq Removing the randomization from C
n
i e by xing the b est p ossible choice we derive a contradiction to Eq
The prop osition follows
Using Prop ositions and and recalling that Theorem applies also
to collections of one way functions and to the non uniform setting we obtain
Theorem If there exist collections of non uniformly hard trapdoor per
mutations then there exist secure public key encryption schemes
A generalization As admitted ab ove Construction is quite wasteful
Sp eci cally it is wasteful in bandwidth that is the relation b etween the length of
the plaintext and the length of the ciphertext In Construction the relation
b etween these lengths equals the security parameter i e the length of descrip
tion of individual elements in the domain of the p ermutation However the
idea underlying Construction can yield e cient public key schemes pro
vided we use trap do or p ermutations having hard core functions with large range
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
see Section To demonstrate the p oint we use the following assumption
relating to the RSA collection of trap do or p ermutations cf Subsections
and
Large hard core conjecture for RSA The rst n least signi cant bits of
the argument constitute a non uniformly strong hard core function of the RSA
function when applied with n bit long moduli
We stress that the conjecture is not know to follow from the assumption that
the RSA collection is non uniformly hard to invert What can b e proved
under the latter assumption is only that the rst O log n least signi cant bits
of the argument constitute a non uniformly strong hard core function of RSA
with n bit long mo duli Still if the ab ove conjecture holds then one obtains
a secure public key encryption scheme with e ciency comparable to that of
plain RSA see discussion b elow Furthermore this scheme coincides with
the common practice of randomly padding messages using padding equal in
length to the message b efore encrypting them applying the RSA function That
is we consider the following scheme
Construction Randomized RSA a public key blo ck cipher scheme
This scheme employs the RSA collection of trapdoor permutations cf Subsec
tions and The fol lowing description is however self contained
key generation The key generation algorithm consists of selecting at random
two n bit primes P and Q setting N P Q selecting at random a
pair e d so that e d mo d P Q and outputting the
tuple N e N d where N e is the encryption key and N d is the
n
decryption key That is N e N d G where N e and d are
as speci ed above
Note that N is n bit long
encryption To encrypt an n bit string using the encryption key N e the
encryption algorithm randomly selects an element r f N g and
e
produces the ciphertext r mo d N lsb r where lsb r denotes the
e
n least signi cant bits of r That is E r mo d N lsb r
N e
n
decryption To decrypt the ciphertext y f N g f g using
the decryption key N d the decryption algorithm just computes
d
lsb y mo d N where lsb is as above That is D y
N d
d
lsb y mo d N
The bandwidth of the ab ove scheme is much b etter than in Construction
a plaintext of length n is encrypted via a ciphertext of length n On the
other hand Randomized RSA is almost as e cient as plain RSA or the RSA
function itself
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CONSTRUCTIONS OF SECURE ENCRYPTION SCHEMES
To see that Randomized RSA satis es the syntactic requirements of an en
n
cryption scheme consider any p ossible output of G denoted N e N d
n
and any f g Then it holds that
e
D E D r mo d N lsb r
N d N e N d
e d
lsb r lsb r mo d N mo d N
ed
lsb r lsb r mo d N
ed
where the last equality is due to r r mo d N The security of Random
ized RSA as a public key encryption scheme follows from the large hard core
conjecture for RSA analogously to the pro of of Prop osition
Prop osition Suppose that the large hard core conjecture for RSA does
hold Then Construction constitute a secure public key block cipher with
block length n n
Pro of Recall that by the equivalence theorems i e Theorems and
it su ces to show single message ciphertext indistinguishability Considering
e
any two strings x and y we need to show that r mo d N x lsb r and
e
r mo d N y lsb r are indistinguishable where N e and r are selected at
random as in the construction It su ces to show that for every x the distribu
e e
tions r mo d N x lsb r and r mo d N x s are indistinguishable where
n
s f g is uniformly distributed indep endently of anything else The latter
claim follows from the hypothesis that the n least signi cant bits are a hard core
function for RSA with mo duli of length n
Discussion We wish to stress that encrypting messages by merely applying
the RSA function to them without randomization yields an insecure encryption
scheme Unfortunately this pro cedure referred to ab out as plain RSA is
quite common in practice The fact that plain RSA is de nitely insecure is a
sp ecial case of the fact that any public key encryption scheme that employs a
deterministic encryption algorithm is insecure We warn that the fact that in
such deterministic encryption schemes one can distinguish encryptions of two
sp eci c messages e g the all zero message and the all one message is not
merely of theoretical concern it may seriously endanger some applications
In contrast Randomized RSA as de ned in Construction may be secure
provided a quite reasonable conjecture i e the large hard core conjecture for
RSA holds Thus the common practice of applying the RSA function to a
randomly padded version of the plaintext is way sup erior to using the RSA
function directly i e without randomization the randomized version is likely
to be secure whereas the non randomized or plain version is de nitely insecure
Recall that Construction or alternatively Construction gener
alizes to any collection of trap do or p ermutations having a corresp onding large
hard core function Supp ose that fp g is such a collection and h or rather
fh g is a corresp onding hard core function resp a corresp onding collection of
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
hard core functions such that any element in the domain of p is mapp ed to
an j j bit long string Then we can encrypt an j j bit long plaintext x
by p r h r x resp p r h r x where r S as in Construc
tion This yields a secure public key encryption scheme with bandwidth
that relates to the relation b etween j j and the length of a description of
individual elements in the domain of p
An alternative scheme
An alternative construction of a public key encryption scheme is presented b e
low Rather than encrypting each plaintext bit or blo ck of bits by an indep en
dently selected element in the domain of the trap do or p ermutation as done in
Construction we select only one such element for the entire plaintext
and generate an additional bit p er each bit of the plaintext These additional
bits are determine by successive applications of the trap do or p ermutation and
only the last result is included in the ciphertext In a sense the construction
of the encryption scheme b elow augments the construction of a pseudorandom
generator based on one way p ermutations i e Construction
Construction a public key encryption scheme Let fp g I S F B
i i
and b be as in Construction We use the notation p x p p x
i
i
x p and p x p
key generation The key generation algorithm consists of selecting at random a
permutation p together with a trapdoor exactly as in Construction
n n
That is G I which means that the index trapdoor pair generated
by I is associated with the key pair of G
encryption To encrypt a string using the encryption key the encryption
algorithm randomly selects an element r in the domain of p and produces
j j
the ciphertext p r G r where
def
j j
G r b r b p r b p r
j j
S G S That is E p
decryption To decrypt the ciphertext y using the decryption key the
j j
decryption algorithm just computes G p y where the inverse is
j j
computed using the trapdoor of p That is D y G p y
We stress that the ab ove encryption scheme is a full edged one rather than a
blo ck cipher Its bandwidth tends to with the length of the plaintext that
is a plaintext of length p oly n is encrypted via a ciphertext of length
m where m denotes the length of the description of individual elements
in the domain of p Clearly for every p ossible output of G it holds
that D E The security of the ab ove public key encryption scheme
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CONSTRUCTIONS OF SECURE ENCRYPTION SCHEMES
follows from the non uniform one way feature of the collection fp g but here
we restrict the sampling algorithm S to pro duce almost uniform distribution over
the domain so that this distribution is preserved under successive applications
of p
Prop osition Suppose that b is a non uniformly strong hard core of
the trapdoor collection fp g Furthermore suppose that this trapdoor collection
utilizes a domain sampling algorithm S so that the statistical di erence between
S and the uniform distribution over the domain of p is negligible in terms of
j j Then Construction constitute a secure public key encryption scheme
Pro of Again we prove single message ciphertext indistinguishability As in the
pro of of Prop osition it su ces to show that for every the distributions
j j j j
p S G S and p S s are indistinguishable where
j j
s f g is uniformly distributed indep endently of anything else The latter
claim holds by a minor extension to Prop osition the latter refers to the
case S is uniform over the domain of p but can b e extended to the case in
which there is a negligible statistical di erence b etween the distributions The
prop osition follows
An instantiation Assuming that factoring Blum Integers i e pro ducts of
two primes each congruent to mo d is hard one may use the mo dular
squaring function in role of the trap do or p ermutation ab ove see Section
This yields a secure public key encryption scheme presented b elow with e
ciency comparable to that of plain RSA Recall that plain RSA itself is not secure
as it employs a deterministic encryption algorithm whereas Randomized RSA
i e Construction is not known to b e secure under standard assumption
such as intractability of factoring or of inverting the RSA function
Construction The Blum Goldwasser Public Key Encryption Scheme
For simplicity we present a block cipher with arbitrary block length n
p oly n
key generation The key generation algorithm consists of selecting at random
two n bit primes P and Q each congruent to mod and outputting the
pair N P Q where N P Q
Actually for sake of e ciency the key generator also computes
n
d P mo d P in f P g
P
n
d Q mo d Q in f Q g
Q
c Q Q mo d P in f N Qg
P
c P P mo d Q in f N P g
Q
Recall that Randomized RSA is secure assuming that the n least signi cant bits con
stitute a hard core function for n bit RSA mo duli Even when assuming the intractability of
factoring we only know that the O log n least signi cant bits constitute a hard core function
for n bit mo duli
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
It outputs the pair N T where N serves as the encryption key and T
P Q N c d c d serves as decryption key
P P Q Q
n
encryption To encrypt the message f g using the encryption key N
Uniformly select s f N g
mo d N and b lsb s For i n compute s s
i i i
i
where lsb s is the least signi cant bit of s
The ciphertext is s where b b b
n n
decryption To decrypt of the ciphertext r using the decryption key T
P Q N c d c d one rst retrieves s and then computes the b s
P P Q Q i
as above Instead of extracting modular square roots successively n
n
times we extract the th root which can be done as e ciently as
extracting a single square root
d d
Q P
mo d Q mo d P and s r Let s r
Let s c s c s mo d N
P Q
For i n compute b lsb s and s s mo d N
i i i
i
The plaintext is b b b
n
Again one can easily verify that the ab ove construction constitutes an encryp
tion scheme the main fact to verify is that the value of s as reconstructed in
the decryption stage equals the value used in the encryption stage This fol
lows by combining the Chinese Reminder Theorem with the fact that for every
d
P
mo d P and quadratic residue s mo d N it holds that s s mo d N
d
Q
mo d Q similarly s s mo d N
Details Recall that for a prime P mo d and every integer i we
P
have i i mo d P Thus for every integer j we have
P
d
P
j mo d N j mo d N mo d P
P
j mo d P
j mo d P
d
Q
Similarly j j mo d N mo d Q Observing that c and c are as
P Q
in the Chinese Reminder Theorem i e i c i mo d P c i mo d Q
P Q
mo d N for every integer i we conclude that s as recovered in Step
of the decryption equals s as rst computed in Step of the encryption
Encryption amounts to n mo dular multiplications whereas decryption
amounts to n such multiplications and mo dular exp onentiations relative
to half sized mo duli Counting mo dular exp onentiations with resp ect to n
bit mo duli as O n i e at least n and at most n mo dular multiplications
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
BEYOND EAVESDROPPING SECURITY
with resp ect to n bit mo duli we conclude that the entire encryption decryption
pro cess requires work comparable to n n mo dular multiplications For
comparison to Randomized RSA note that encrypting decrypting n bit
messages amounts to d n ne mo dular exp onentiations and so the total work
is comparable to n n n n for general exp onent e or half that
much in case e
The security of the Blum Goldwasser scheme i e Construction fol
lows immediately from Prop osition and the fact that lsb is a hard core
for the mo dular squaring function Recalling that inverting the latter is compu
tationally equivalent to factoring we get
Corollary Suppose that factoring is infeasible in the sense that for every
polynomial size circuit fC g every positive polynomial p and al l su ciently large
n
n s
Pr C P Q P
n n n n
p n
where P and Q are uniformly distributed n bit long primes Then Construc
n n
tion constitutes a secure public key encryption scheme
Beyond eavesdropping security
Our treatment so far refers only to a passive attack in which the adversary
merely eavesdrops on the line over which ciphertexts are b eing sent Stronger
types of attacks culminating in the so called Chosen Ciphertext Attack may b e
p ossible in various applications Sp eci cally in some settings it is feasible for the
adversary to make the sender encrypt a message of the adversary s choice and in
some settings the adversary may even make the receiver decrypt a ciphertext of
the adversary s choice This gives rise to chosen message attacks and to chosen
ciphertext attacks resp ectively which are not covered by the ab ove security
de nitions Thus our main goal in this section is to provide a treatment to such
types of attacks In addition we also discuss the related notion of non malleable
encryption schemes We start with an overview of the type of attacks considered
in this section
Types of attacks The following mini taxonomy of attacks is certainly not
exhaustive
Passive attacks as captured in the de nitions ab ove In case of public key
schemes we distinguish two sub cases
a A key oblivious passive attack as captured in the de nitions ab ove
By key obliviousness we refer to the fact that the choice of plaintext
do es not dep end on the public key
b A key dependent passive attack in which the choice of plaintext may
dep end on the public key
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
X In De nition the choice of plaintext means the random variable
n
whereas in De nition it means the pair of sequences x y In b oth
n
n
these de nitions the choice of the plaintext is key oblivious
Chosen Plaintext Attacks Here the attacker may obtain the encryption of
any plaintext of its choice under the key b eing attacked
Indeed such an attack do es not add p ower in case of public key schemes
Chosen Ciphertext Attacks Here the attacker may obtain the decryption
of any ciphertext of its choice under the key b eing attacked That is the
attacker is given oracle access to the decryption function corresp onding to
the decryption key in use We distinguish two types of such attacks
a In an a priori chosen ciphertext attack the attacker is given this
oracle access prior to b eing presented the ciphertext that it should
attack i e the ciphertext for which it has to learn partial informa
tion That is the attack consists of two stages in the rst stage the
attacker is given the ab ove oracle access and in the second stage the
oracle is removed and the attacker is given a test ciphertext i e a
target to b e learned
b In an a posteriori chosen ciphertext attack after b eing given the
target ciphertext the oracle is not removed but the adversary s access
to it is restricted in that it is not allowed to make a query equal to
the target ciphertext
In b oth cases the adversary may make queries that do not corresp ond to
a legitimate ciphertext and the answer will b e accordingly i e a sp ecial
failure symbol Furthermore in b oth cases the adversary may e ect the
selection of the target ciphertext
Formal de nitions of all types of attacks listed ab ove are given in the following
corresp onding subsections Before presenting the actual de nitions we provide
an overview of the known results
Some known constructions As in the basic case the strongly secure
private key encryption schemes can b e constructed based on the existence of
one way functions whereas the strongly secure public key encryption schemes
are based on the existence of trap do or p ermutations In b oth cases withstand
ing a p osteriori chosen ciphertext attacks is harder than withstanding a priori
chosen ciphertext attacks We will present the following schemes
Private key schemes The private key encryption scheme based on pseudo
random functions i e Construction is secure also against a priori
chosen ciphertext attacks
Note that this scheme is not secure under an a p osteriori chosen ciphertext attack on
input a ciphertext r x f r we obtain f r by making the query r y where y
s s
x f r This query is answered with x so that y x f r
s s
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
BEYOND EAVESDROPPING SECURITY
It is easy to turn any passively secure private key encryption scheme into
a scheme secure under a posteriori chosen ciphertext attacks by using a
message authentication scheme on top of the basic encryption
Public key schemes Public key encryption schemes secure against a priori
chosen ciphertext attacks can b e constructed assuming the existence of
trap do or p ermutations and utilizing non interactive zero knowledge pro ofs
Recall that the latter pro of systems can b e constructed under the former
assumption
Public key encryption schemes secure against a p osteriori chosen cipher
text attacks can also b e constructed under the same assumption but this
construction is even more complex
Key dep endent passive attacks
Author s Note Applicable only to public key schemes
Author s Note Plan de ne and show that ab ove constructions sat
isfy the de nition
Chosen plaintext attack
Author s Note No a ect in case of public key schemes
Author s Note Plan de ne and show that ab ove constructions sat
isfy the de nition
Chosen ciphertext attack
Author s Note For private key refer also to a combined plaintext ciphertext
attack
Author s Note Plan
De ne the two types i e a priori and a p osteriori CCA
Prove that the PRF based private key scheme remains secure
under a priori CCA
Using MAC transform any passively secure private key scheme
into an a scheme secure under a p osteriori CCA
The NY framework for constructing CCA secure public key schemes
double encryption use of NIZK
a Apply the framework to obtain security under a priori CCA
NY
See de nition in Section
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
b Apply the framework to obtain security under a p osteriori
CCA DDN Amit
Author s Note Indeed my plans were mo di ed due to a recent result
of Amit Sahai further simpli ed by Yehuda Lindell This result
makes it feasible to present in the context of the current b o ok a
public key encryption scheme that is secure under a p osteriori CCA
Non malleable encryption schemes
Author s Note Tentative introductory test follows
So far our treatment has referred to an adversary that tries to extract explicit
information ab out the plaintext A less explicit attempt captured by the so
called notion of mal leability is to generate an encryption of a related plaintext
p ossibly without learning anything ab out the original plaintext
Thus we have a matrix of adversaries with one dimension parameter
b eing the type of attack and the second b eing its purpose So far we have
discussed the rst dimension i e the type of the attack We now turn to the
second i e the purp ose of the attack We make a distinction b etween the
following two notions or purp oses of attack
Standard security the infeasibility of obtaining information regarding the
plaintext As de ned ab ove such information must b e a function or a
randomized pro cess applied to the bare plaintext and may not dep end
on the encryption or decryption key
In contrast the notion of non mal leability refers to generating a string de
p ending on b oth the plaintext and the current encryption key Sp eci cally
one requires that it should b e infeasible for an adversary given a cipher
text to pro duce a valid ciphertext for a related plaintext For example
given a ciphertext of a plaintext of the form x it should b e infeasible to
pro duce a ciphertext to the plaintext x
We shall show b elow that with the exception of passive attacks on private key
schemes non malleability always implies security against attempts to obtain in
formation on the plaintext We shall also show that security and non malleability
are equivalent under a p osteriori chosen ciphertext attack
Author s Note Plan
discuss and de ne the notion of non malleable encryption
prove the following relations b etween de nitions
a With the exception of passive attacks on private key schemes
non malleability always implies security against attempts to
obtain information on the plaintext
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
MISCELLANEOUS
b Under a p osteriori chosen ciphertext attacks security and
non malleability are equivalent This is very intuitive and
the intuition can b e presented already in the de nitional
discussion ab ove
Derive the existence of non malleable encryption schemes as a
corollary to the ab ove
Miscellaneous
Author s Note The entire section is fragmented and tentative
Historical Notes
The notion of private key encryption scheme seems almost as ancient as the al
phab et itself Furthermore it seems that the development of encryption metho ds
went along with the development of communication media As the amounts of
communication grow more e cient and sophisticated encryption metho ds were
required Computational complexity considerations were explicitly introduced
into the arena by Shannon In his work Shannon considered the classi
cal setting where no computational considerations are present He showed that
in this information theoretic setting secure communication of information was
p ossible only as long as its entropy is lower than the entropy of the key He thus
concluded that if one wishes to have an encryption scheme which is capable of
handling messages with total entropy exceeding the length of the key then one
must settle for a computational relaxation of the secrecy condition That is
rather than requiring that the ciphertext yields no information on the plaintext
one has to require that such information cannot b e e ciently computed from the
ciphertext The latter requirement indeed coincides with the ab ove de nition of
semantic security
The notion of public key encryption scheme was introduced by Di e and
Hellman First concrete candidates were suggested by Rivest Shamir and
Adleman and by Merkle and Hellman However satisfactory de
nitions of security were presented only a few years afterwards by Goldwasser
and Micali The two de nitions presented in Section originate in
where it was shown that ciphertext indistinguishability implies semantic secu
rity The converse direction is due to
Regarding the seminal pap er of Goldwasser and Micali a few additional
comments are due Arguably this pap er is the basis of the entire rigorous
approach to cryptography presented in the current b o ok It introduced general
notions such as computational indistinguishability de nitional approaches such
as the simulation paradigm and techniques such as the hybrid argument The
pap er s title Probabilistic Encryption is due to the authors realization that
public key encryption schemes in which the encryption algorithm is deterministic
cannot b e secure in the sense de ned in their pap er Indeed this led the authors
to explicitly introduce and justify the paradigm of randomizing the plaintext
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
as part of the encryption pro cess Technically sp eaking the pap er only presents
security de nitions for public key encryption schemes and furthermore some
of these de nitions are syntactically di erent from the ones we have presented
ab ove yet all these de nitions are equivalent Finally the term ciphertext
indistinguishability used here replaces the generic term p olynomial security
used in Some of our mo di cations have already app eared in which is
also the main source of our uniform complexity treatment
The rst construction of a secure public key encryption scheme based on
a simple complexity assumption was given by Goldwasser and Micali
Sp eci cally they constructed a public key encryption scheme assuming that de
ciding Quadratic Residiousity mo dulo comp osite numbers is intractable The
condition was weaken by Yao who prove that any trap do or p ermutation
will do The e cient public key encryption scheme of Construction is
due to Blum and Goldwasser The security is based on the fact that the
least signi cant bit of the mo dular squaring function is a hard core predicate
provided that factoring is intractable a result mostly due to
For decades it has b een common practice to use pseudorandom generators
in the design of stream ciphers As p ointed out by Blum and Micali this
practice is sound provided that one uses pseudorandom generators as de ned
in Chapter The construction of private key encryption schemes based on
pseudorandom functions is due to
We comment that it is indeed p eculiar that the rigorous study of the security
of private key encryption schemes has legged b ehind the corresp onding study
of public key encryption schemes This historical fact may b e explained by the
very thing that makes it p eculiar that is private key encryption schemes are
less complex that public key ones and hence the problematics of their security
when applied to p opular candidates is less obvious In particular the need
for a rigorous study of the security of public key encryption schemes arose
from observations regarding their concrete applications e g doubts raised by
Lipton concerning the security of the mental p oker proto col of which
used plain RSA as an encryption scheme In contrast the need for a rigorous
study of the security of private key encryption schemes arose later and by
analogy to the public key case
Author s Note The rest of this subsection is yet to b e written The
following notes are merely place holders
Author s Note The NY framework for constructing public key en
cryption schemes secure under Chosen Ciphertext Attacks double
encryption NIZK Naor and Yung Its original application
to the case of a priori Chosen Ciphertext Attacks Its appli
cation to the case of a priori Chosen Ciphertext Attacks Sahai
following Dolev Dwork and Noar Refer to NIZK works such
as
Recall that plain RSA is not secure whereas Randomized RSA is based on the Large
Hard Core Conjecture for RSA which is less app ealing that the standard conjecture referring
to the intractability of inverting RSA
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
MISCELLANEOUS
Author s Note The study of non malleability of the encryption schemes
was initiated by Dolev Dwork and Noar Security and non
malleability are equivalent under a p osteriori chosen ciphertext at
tack cf
Suggestion for Further Reading
Author s Note This subsection is yet to b e written The following
notes are merely place holders
Author s Note On the gap b etween private key and public key en
cryption the former is p ossible under OWF whereas Impagliazzo and
Rudich indicate the this is unlikely for the latter
Author s Note For discussion of Non Malleable Cryptography which
actually transcends the domain of encryption see
Author s Note For a detailed discussion of the relationship among
the various notions of secure private key and public key encryption
the reader is referred to and resp ectively
Op en Problems
Secure public key encryption schemes exist if there exist collections of non
uniformly hard trap do or p ermutations cf Theorem It is not known
whether the converse holds although secure public key encryption schemes eas
ily imply one way function The few to feature of the function collection is
imp ortant see
Randomized RSA i e Construction is commonly b elieved to b e a
secure public key encryption scheme It would b e of great practical imp ortance
to gain additional supp ort for this b elief As shown in Prop osition the
security of Randomized RSA follows from the Large Hard Core Conjecture for
RSA but the latter is not known to follow from a more standard assumption
such as that RSA is hard to invert This is indeed the third place in this b o ok
where we suggest the establishment of the latter implication as an imp ortant
op en problem
Both constructions of public key encryption schemes secure against chosen
ciphertext attacks presented in Section are to b e considered as plausibil
ity results which also o er some useful construction paradigms Presenting
reasonably e cient public key encryption schemes that are secure against a
p osteriori chosen ciphertext attacks under widely b elieved assumptions is an
imp ortant op en problem We comment that the reasonably e cient scheme
of is based on a very strong assumption regarding the Di e Hel lman Key
Exchange Sp eci cally it is assumed that for a prime P and primitive element
x y z
g given P g g mo d P g mo d P g mo d P it is infeasible to decide
whether z xy mo d P
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
Exercises
Author s Note The following are but a tentative collection of exercises
that o ccurred to me while writing the main text
Exercise Encryption schemes imply one way function Show that the
existence of a secure private key encryption scheme i e as in De ni
tion implies the existence of one way functions
Guideline Recall that by Exercise of Chapter it su ces to prove
that the former implies the existence of a pair of p olynomial time con
structible probability ensembles that are statistically far apart and still
are computationally indistinguishable To prove the existence of such en
sembles consider the encryption of n bit plaintexts relative to a ran
dom n bit long key denoted K Sp eci cally let the rst ensemble b e
n
x and the second ensem f U E U g where E x E
n n
K
n
n N
ble b e f U E U g where U and U are indep endently
n n n n
n N
distributed It is easy to show that these ensembles are computationally
indistinguishable and are b oth p olynomial time constructible The more
interesting part is to show that these ensembles are statistically far apart
To prove this fact assume towards the contradiction that for all but a negli
n
gible fraction of the p ossible x s the distribution of E x is statistically
close to a single distribution Y and show that this do es not allow correct
n
decryption since there are only p ossible keys
Exercise Encryption schemes with unbounded length plaintext Supp ose that
the de nition of semantic security is mo di ed so that no b ound is placed
on the length of plaintexts Prove that in such a case there exists no
semantically secure public key encryption scheme Hint A plaintext of length
exp onential in the security parameter allows the adversary to nd the decryption key
by exhaustive search
Exercise Encryption schemes must leak information about the length of the
plaintext Supp ose that the de nition of semantic security is mo di ed so
that the algorithms are not given the length of the plaintext Prove that
in such a case there exists no semantically secure encryption scheme
n
Guideline First show that for some p olynomial p jE j p n
p n
whereas for some x f g it holds that Pr jE x j p n
Exercise Hiding partial information about the length of the plaintext Using
an arbitrary encryption scheme construct an encryption scheme that hides
the exact length of the plaintext In particular construct an encryption
scheme that reveals only the following function h of the length of the
plaintext
h m dm ne n where n is the security parameter
dlog me
2
h m
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
MISCELLANEOUS
Hint Just use an adequate padding convention making sure that it always allows
correct deco ding
Exercise Length parameters Assuming the existence of a secure public key
resp private key encryption scheme prove the existence of such scheme
in which the length of keys equal the security parameter Furthermore
show that without loss of generality the length of ciphertexts may b e a
xed p olynomial in the length of the plaintext
Exercise Deterministic encryption schemes Prove that in order to b e se
mantically secure a public key encryption scheme must have a probabilistic
encryption algorithm Hint Otherwise one can distinguish the encryptions of two
candidate plaintexts by computing the unique ciphertext for each of them
Exercise Prove that the following de nition in which we use non uniform
families of p olynomial size circuits rather than probabilistic p olynomial
time algorithms is equivalent to De nition
There exists a probabilistic p olynomial time transformation T
such that for every p olynomial size circuit family fC g and
n
n N
for every fX g f h f g f g p and n as in
n
n N
De nition
h i
jX j
n
n
Pr C E X h X f X
n n n n
G
1
h i
jX j
n
Pr C h X f X
n n
n
p n
T C and the probability is also taken over the where C
n
n
internal coin tosses of T
Same for public key encryption
Guideline The alternative view of non uniformity discussed in Sec
tion is useful here That is we can view a circuit family as a sequence of
advices given to a universal machine Thus the ab ove de nition states that
advices for a machine that gets the ciphertext can b e e ciently transformed
into advices for a machine that do es not get the ciphertext However we
can incorp orate the probabilistic transformation program into the second
universal algorithm which then b ecome probabilistic Consequently the
advices are identical for b oth machines and can b e incorp orated in the
auxiliary input h X used in De nition Viewed this way the ab ove
n
de nition is equivalent to asserting that for some universal deterministic
p olynomial time algorithm U there exists a probabilistic p olynomial time
algorithm U and for every fX g f h f g f g p and n
n
n N
as in De nition
jX j
n
Pr U E n X h X f X
n n n
G
1
jX j
n
Pr U h X f X
n n
p n
Still a gap remains b etween the ab ove de nition and De nition
the ab ove condition refers only to one p ossible deterministic algorithm
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
U whereas De nition refers to all probabilistic p olynomial time al
gorithms To close the gap we rst observe that by Prop ositions
and De nition is equivalent to a form in which one only quan
ti es over deterministic p olynomial time algorithms A We conclude by
observing that one can co de any algorithm A and p olynomial time b ound
referred to by De nition in the auxiliary input i e h X given to
n
U
Exercise In continuation to Exercise consider a de nition in which the
transformation T of the circuit family fC g to the circuit family
n
n N
fC g is not required to even b e computable Clearly the new
n N
n
de nition is not stronger than the one in Exercise Show that the two
de nitions are in fact equivalent
Guideline Use the furthermore clause of Prop osition to show that
the new de nition implies indistinguishability of encryptions and conclude
by applying Prop osition and invoking Exercise
Exercise Prove that De nition remains unchanged when supplying the
circuit with auxiliary input That is an encryption scheme satis es De
nition if and only if
for every p olynomial size circuit family fC g every p olynomial
n
p oly n
p all su ciently large n and every x y f g i e jxj
p oly n
jy j and z f g
n n
jPr C z E x Pr C z E y j
n n
G G
1 1
p n
Hint incorp orate z in the circuit C
n
Exercise Equivalence of the security de nitions in the public key model
Prove that a public key encryption scheme is semantically secure if and
only if it has indistinguishable encryptions
Exercise The technical contents of semantic security The following ex
plains the lack of computational requirements regarding the function f
in De nition Prove that an encryption scheme G E D is se
mantically secure in the private key mo del if and only if the following
holds
There exists a probabilistic p olynomial time algorithm A so
that for every fX g and h f g f g as in Def
n
n N
inition the following two ensembles are computationally
indistinguishable
jX j
n
n
fE X h X g
n n
G
n N
1
Equivalently one may require that for any p olynomial size circuit family fC g there
n
n N
exists a p olynomial size circuit family fC g satisfying the ab ove inequality
n
n N
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
MISCELLANEOUS
jX j
n
fA h X g
n
n N
Formulate and prove an analogous claim for the public key mo del
Guideline We care mainly ab out the easy to establish fact by which
the ab ove implies semantic security The other direction can b e proven
analogously to the pro of of Prop osition
Exercise Prove that De nition remains unchanged if we may restrict
the function h to dep end only on the length of its input i e h x h jxj
for some h N f g
Guideline It su ces to prove that this sp ecial case i e obtained by the
restriction on h is equivalent to the general one This follows by combining
Prop ositions and
Exercise A variant on Exercises and Prove that an encryption
scheme G E D is semantically secure in the private key mo del if
and only if the following holds
For every probabilistic p olynomial time algorithm A there ex
ists a probabilistic p olynomial time algorithm A such that for
every ensemble fX g with jX j p oly n and p olynomi
n n
n N
ally b ounded h the following two ensembles are computationally
indistinguishable
jX j
n
n
fA E X h jX j g
n n
G
n N
1
jX j
n
fA h jX j g
n
n N
Indeed since jX j is constant so is h jX j So an equivalent form is
n n
obtained by replacing h jX j with a p oly n bit long string v
n n
Formulate and prove an analogous claim for the public key mo del
Guideline Again we care mainly ab out the fact that the ab ove im
plies semantic security The easiest pro of of this direction is by applying
Prop ositions and A more interesting pro of is obtained by using
Exercise Indeed the current formulation is a sp ecial case of the formu
lation in Exercise and so we need to prove that it implies the general
case The latter is proven by observing that otherwise using an averag
ing argument we derive a contradiction in one of the residual probability
spaces de ned by conditioning on h X i e X jh X v for some v
n n n
Exercise Another equivalent de nition of security The following exercise
is interesting mainly for historical reasons In the de nition of semantic
security app earing in the term max fPr f X v jh X u g
u v n n
jX j
n
app ears instead of the term Pr A h X f X That is it is
n n
required that
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
for every probabilistic p olynomial time algorithm A every en
semble fX g with jX j p oly n every pair of p olynomially
n n
n N
b ounded functions f h f g f g every p olynomial p
and all su ciently large n
h i
jX j
n
n
Pr A E X h X f X
n n n
G
1
max fPr f X v jh X u g
n n
u v
p n
Prove that the ab ove formulation is in fact equivalent to De nition
Guideline First note that the ab ove de nition implies De nition
n
since max fPr f X v jh X u g Pr A h X jX j f X
u v n n n n n
for every algorithm A Next note that in the special case in which X sat
n
is es Pr f X jh X u Pr f X jh X u for all u s
n n n n
the ab ove terms are equal since A can easily achieve success probability
by simply always outputting Finally combining Prop ositions
and infer that it su ces to consider only the latter sp ecial case
Exercise Yet another equivalent de nition of security The following syn
tactic strengthening of semantic security is imp ortant in some applications
Its essence is in considering information related to the plaintext in the
form of a related random variable rather than partial information ab out
the plaintext in the form of a function of it Prove that an encryption
scheme G E D is semantically secure in the private key mo del if
and only if the following holds
For every probabilistic p olynomial time algorithm A there ex
ists a probabilistic p olynomial time algorithm A such that for
every f X Z g with j X Z j p oly n where Z may
n n n n n
n N
dep endent arbitrarily on X and f p and n as in De ni
n
tion
h i
jX j
n
n
Pr A E X Z f X
n n n
G
1
h i
jX j
n
Pr A Z f X
n n
p n
That is the auxiliary input h X of De nition is replaced by the
n
random variable Z Formulate and prove an analogous claim for the
n
public key mo del
Guideline De nition is clearly a sp ecial case of the ab ove On
the other hand the pro of of Prop osition extends easily to the ab ove
seemingly stronger formulation of semantic security
Exercise Extended Semantic Security suggested by Boaz Barak Con
sider an extended de nition of semantic security in which in addition
to the regular inputs the algorithms have oracle access to a function
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
MISCELLANEOUS
H f g f g instead of b eing given the value h x The func
x
tion H s have to b e restricted to have p olynomial in jxj size circuit
x
That is an encryption scheme G E D is extended semantically secure
in the private key mo del For every probabilistic polynomial time algo
rithm A there exists a probabilistic polynomial time algorithm A such that
for every ensemble fX g with jX j p oly n every polynomially
n n
n N
bounded function f f g f g every family of polynomial sized
circuits fH g every polynomial p and al l su ciently large n
x
x f g
h i
H jX j
X n
n
n
Pr A E X f X
n n
G
1
h i
H
X
jX j
n
n
Pr A f X
n
p n
The de nition of public key security is analogous
Show that if G E D has indistinguishable encryptions then it is
extended semantically secure
Show that if no restriction are placed on the H s then no scheme can
x
b e extended semantically secure in this unrestricted sense
Guideline for Part The pro of is almost identical to the pro of
jX j
n
of Prop osition The algorithm A forms an encryption of and
invokes A on it Indistinguishability of encryptions is used in order to es
H
H
jX j
X
n X
n
n
p erforms essentially as well as A E X tablish that A
n
jx j
n
Otherwise we obtain a distinguisher of E x from E for some in
n
nite sequence of x s In particular the oracle H b eing implementable
n x
n
by a small circuit can b e incorp orated into a distinguisher
Guideline for Part In such a case H may b e de ned so that
x
when queried ab out a ciphertext it reveals the decryption key in use par
tial information ab out the corresp onding plaintext This is obvious in case
of public key schemes but is also doable in some private key schemes e g
supp ose that the ciphertext always contains a commitment to the private
key Such an oracle allows A which is given a ciphertext to recover the
jX j
n
corresp onding plaintext but do es not help A which is given nd
any information ab out the value of X
n
Exercise Multiple messages of varying lengths In continuation to Sec
tion generalize the treatment to encryption of multiple messages
of varying lengths Provide adequate de nitions and analogous results
Guideline For example a generalization of the rst item of De ni
tion p ostulates that for every pair of p olynomials t and and
every probabilistic p olynomial time algorithm A there exists a probabilis
tic p olynomial time algorithm A such that for every ensemble f X
n
t n i
X X g with jX j n every pair of functions f h
n n n
n N
f g f g every p olynomial p and all su ciently large n
i h
(t(n)) (1)
j j jX jX
n n
h E n X X f X Pr A
n n n
G
1
h i
(1) (t(n))
jX j jX j
n n
Pr A h X f X
n n
p n
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
CHAPTER ENCRYPTION SCHEMES
Exercise Known plaintext attacks Lo osely sp eaking in a known plaintext
attack on a private key resp public key encryption scheme the adver
sary is given some plaintext ciphertext pairs in addition to some extra
ciphertexts without corresp onding plaintexts Semantic security in this
setting means that whatever can b e e ciently computed ab out the missing
plaintexts can b e also e ciently computed given only the length of these
plaintexts
Provide formal de nitions of security for private key public key in
b oth the single message and multiple message settings
Prove that any secure public key encryption scheme is also secure in
the presence of known plaintext attack
Prove that any private key encryption scheme that is secure in the
multiple message setting is also secure in the presence of known plain
text attack
Guideline for Part Consider a function h in the multiple message
setting that reveals some of the plaintexts
Exercise The standard term of block cipher A standard blo ck cipher is a
triple G E D of probabilistic p olynomial time algorithms that satis es
De nition as well as jE j n for every pair e d in the range
e
n n
of G and every f g
Prove that a standard blo ck cipher cannot b e semantically secure in
the multiple message mo del Furthermore show that any seman
tically secure encryption scheme must employ ciphertexts that are
longer than the corresp onding plaintexts
Present a state based version of a standard blo ck cipher and note that
Construction satis es it
Guideline for Part Consider the encryption of a pair of two iden
tical messages versus the encryption of a pair of two di erent messages
n
and use the fact that E must b e a p ermutation of f g Extend the
e
argument to any encryption scheme in which plaintexts of length n are
encrypted by ciphertexts of length n O log n observing that otherwise
most plaintexts have only p oly n many ciphertexts under E
e
Exercise The Blum Goldwasser public key encryption scheme was presented
in Construction as a blo ck cipher with arbitrary blo ck length Pro
vide an alternative presentation of this scheme as a full edged encryption
scheme rather than a blo ck cipher and prove its security under the
factoring assumption
Author s Note First draft written mainly in Ma jor revision
completed in Dec Further signi cant revisions were conducted
in May June
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
Index
non uniform see non uniform com Author Index
plexity
Adleman L
oracle machines see oracle ma
Blum M
chines
Di e W
probabilistic machines see prob
Goldwasser S
abilistic machines
Hellman M E
Lipton R
Discrete Logarithm Problem see DLP
Merkle R C
function
Micali S
DLP see DLP function
Rivest R L
Shamir A
Encryption Schemes
Shannon C E
asymmetric
Yao A C
Basic Setting
Blo ck Ciphers
Arguments see Interactive Pro ofs
De nitions
Averaging Argument see Techniques
indistinguishability of encryptions
Chinese Reminder Theorem
p erfect privacy
Claw free Pairs see One Way Func
Private Key
tions
Collision Free Hashing see Hashing
Public Key
Complexity classes
Randomized RSA
PCP see Probabilistically Check
Semantic Security
able Pro ofs
Stream Ciphers
Comp osite numbers
symmetric
Blum integers see Blum inte
the mechanism
gers
Computational Di culty see One
Factoring integers
Way Functions
Fiat Shamir Identi cation Scheme
Computational Indistinguishability
see Identi cation Schemes
by circuits
Hard Core Predicates see One Way
Computational mo dels
Functions
Hashing interactive machines see inter
active machines
Universal see Hashing functions
Hybrid Argument see Techniques non determinism see non determinism
Extracted from a working draft of Goldreich's FOUNDATIONS OF CRYPTOGRAPHY. See copyright notice.
INDEX
Random Oracle Mo del see Random Interactive Pro ofs
Oracle Metho dology Zero Knowledge see Zero Knowledge
Reducibility Argument see Techniques
IP
RSA function
as a class see Complexity classes
hard core function
the notion see Interactive Pro ofs
Signatures see Signature Schemes
Message authentication
Simulation paradigm see Techniques
NIZK see Zero Knowledge
Techniques
Non Interactive Zero Knowledge see
Averaging Argument
Zero Knowledge
Hybrid Argument
non uniform complexity
Reducibility Argument
NP
as a class see Complexity classes
the simulation paradigm
as a pro of system see Interac
tive Pro ofs
Trapdo or Permutations see One Way
versus P see P vs NP Question
Permutations
One Way Functions
Zero Knowledge
non uniform hardness
Pro ofs of Knowledge see Pro ofs
One Way Permutations
of Knowledge
hard core
Witness Hiding see Witness Hid
mo dular squaring
ing
RSA
Witness Indistinguishability see
with trap do or
Witness Indistinguishabil
ity
PCP see Probabilistically Checkable
ZK
Pro ofs
as a class see Complexity classes
Probability ensembles
the notion see Zero Knowledge
e ciently constructible
ZKIP see Zero Knowledge
Pro ofs of Identity see Identi cation
Schemes
Pro ofs of Knowledge
Ability see Pro ofs of Ability
Proto cols see Cryptographic Proto
cols
Pseudorandom Functions
non uniform hardness
Pseudorandom Generators
Computational Indistinguishabil
ity see Computational In
distinguishability
non uniform hardness
Rabin function
hard core