DOCSLIB.ORG

Lecture 1: Class Introduction Instructor: Brent Waters TA: Sara Krehbiel

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Lecture 1: Class Introduction Instructor: Brent Waters TA: Sara Krehbiel CS 388H Introduction to Cryptography 26-Aug-2009 Lecture 1: Class Introduction Instructor: Brent Waters TA: Sara Krehbiel 1 Class Overview This course reviews the foundations of Cryptography and will cover topics such as formal notions of security, encryption, signatures, complexity assumptions, zero knowledge, and multi-party computation. Most of the material will be based on ”Introduction to Modern Cryptography” by Katz and Lindell. ”Foundations of Cryptography: Volume I” is optional and more theoretical. See course syllabus for grading policies and course schedule. 2 Foundations of Cryptography 1. Crypto concepts: public key crypto, zero knowledge, signatures 2. Foundation approach: this course will emphasize precision and rigor For example: What does it mean if someone says they use a cryptographic hash function? Does it imply the system is secure? Two notions of what makes a hash function cryptographic: (a) Hard to invert: Given y, hard to find an x st f(x) = y. (b) Hard to find collisions: Given f, hard to find x = x st f(x ) = f(x ). 1 6 2 1 2 Are these different? How would you show that hardness of invertability doesn’t imply hardness of finding collisions? By counterexample: Create a function that is hard to invert but easy to find col- lisions. A good start is to consider a compressing function like f : 0, 1 2n 0, 1 n, { } → { } which will necessarily have collisions. Now suppose some f˜ : 0, 1 2n 1 0, 1 n is hard to invert (by some unstated defi- { } − → { } nition of ”hard to invert”). We don’t need assumptions about whether it is collision- resistant. 1-1 For x 0, 1 2n, let x be the last 2n 1 bits. Now define f : 0, 1 2n 0, 1 n ∈ { } 0 − { } → { } where f(x) = f˜(x0). f is a counterexample to the claim that for any function that is hard to invert, it is hard to find collisions because: f easy to invert would contradict the assumption that f˜ is hard to invert, and • it is easy to find collisions with f: for any t 0, 1 2n 1, t = 0 t collides with • ∈ { } − 0 | t = 1 t. 1 | 3. Foundational underpinnings: number theory, general assumptions Why do we generally prove statements that are implications rather than absolutes? (eg If factorization is hard, then this system exhibits some property.) Proofs of abso- lute statements often reduce to a proof of P = NP . 6 3 Perfect Secrecy: Too good to be true? Let be the cipher text space, let be the key space, and let be the message space. A C K M basic encryption system has three algorithms (may be randomized): 1. Gen k → ∈ K 2. Enc(m, k) c → ∈ C 3. Dec(c, k) m → ∈ M What is perfect secrecy? Let C =Enc(m, k) for some m and k . A system ∈ M ∈ K exhibits perfect secrecy if P r[C = c m = m ] = P r[C = c m = m ] for all m , m , c | 0 | 1 0 1 ∈ M ∈ over the distribution of specified by Gen (actual value of k is unknown to attacker). C K 3.1 One-Time Pad Encryption Let , , = 0, 1 l. The one-time pad is as follows: M C K { } 1. Gen k chosen uniformly at random from 0, 1 l → { } 2. Enc(m, k) = m k = c ⊕ 3. Dec(c, k) = c k = m ⊕ Correctness is established by verifying that (m k) k = m. ⊕ ⊕ Perfect secrecy is established by showing that P r[C = c m] = ( 1 )l for all m , c . | 2 ∈ M ∈ C 1-2 3.2 Limitations The one-time pad strategy is limited in that even if Adam and Brent get a chance to agree on some k = 0, 1 l, the message that can be sent can be length at most l. ∈ K { } This limitation that messages cannot be longer than keys generalizes to any perfectly secret system. Suppose > . (Note that there are more unique messages than unique keys |M| |K| if and only if the messages are longer than the keys.) 1. Let c be a cipher text that occurs with non-zero probability. 2. Then m,˜ k˜ st Enc(m, ˜ k˜) = c with non-zero probability. ∃ 3. If the decryption algorithm is correct, then at most messages m are such that |K| Enc(m, k) = c. (Otherwise, there would not be enough keys to uniquely decrypt the cipher text.) 4. Then (because > ) m st k Enc(m , k) = c. |M| |K| ∃ 0 ∀ ∈ K 0 6 In the definition for perfect secrecy, use m =m ˜ and m = m . P r[C = c m˜ ] > 0 = P r[C = 0 1 0 | 6 c m ] = 0, which violates perfect secrecy. Therefore, no system in which keys are shorter | 0 than messages can be perfectly secret. 4 Handouts Three handouts were given in class: 1. CS 388H Course syllabus (2 pages) 2. Very basic number theory fact sheet, Part I (4 pages) 3. Basic number theory fact sheet, Part II (4 pages) 1-3 CS 388H Introduction to Cryptography 31-Aug-2009 Lecture 2: Introduction to Number Theory Instructor: Brent Waters TA: Sara Krehbiel Recall the major limitation of perfect secrecy that messages can be no longer than keys. Instead, we verify the security of more practical encryption systems with complexity asser- tions, often substantiated by number theory. To do that, we want to be able to make sense of a description like: ”Group G of prime order p with generator g”. Note: Most of the material from this lecture can be found in the ”Very basic number theory fact sheet (Part I)” handout passed out at the first lecture. Sections 7.1-7.3 of Katz and Lindell is another reference. 1 Announcements 1. Professor office hours: M 12-1, ACES 3.438 2. TA office hours: W 2-3, ENS basement, desk 1; F 11-12, ENS basement, desk 4 3. Number theory review: Instead of regular OH this Friday (9/4), Sara will hold a number theory review in ACES 3.116. We will cover the main points from this week’s lectures and the number theory handouts, and we’ll spend the bulk of the time going over points of confusion. Please come with questions. 4. Labor day: No class or OH next Monday (9/7) 2 Basic Number Theory Facts Z denotes the set of integers • Fundamental theorem of arithmetic: Any integer a can be uniquely expressed as a • ei product of primes. Ie a = pi with pi a prime and ei a positive integer for all i. Yi a b means a divides b ( c Z st c a = b). • | ∃ ∈ · For any positive integers a and b, a can be uniquely written as a = q b + r with • · q, r Z and 0 r < b. ∈ ≤ Greatest common divisors: Define gcd(a, b) to be the largest integer d st d a and d b. • | | Note that gcd(a, b) 1 a, b Z. ≥ ∀ ∈ 2-1 3 Modular Arithmetic Let a =p b denote that a = b mod p. In the equations below, let q Z and 0 r < p. ∈ ≤ Zp = 0, 1, ..., p 1 for some prime p. • { − } Note: Small primes are used as instructive examples, but the prime numbers typically used in cryptography are on the order of 300 digits (1024 bits). Addition: m + g = r for r st m + g = qp + r. Eg 5 + 6 mod 7 = 4. • p Multiplication: m g = r for r st m g = qp + r. Eg 5 6 mod 7 = 2. • · p · · Exponentiation: mg = r for r st mg = qp + r. Eg 56 mod 7 = 1. • p Why can that particular last problem be determined without actually computing 56? 4 Fermat’s Little Theorem p 1 Theorem 4.1 For all g = 0 in Zp, g is such that g − =p 1. 6 Proof. Consider the set S = g, 2g, ..., (p 1)g . Assume that the S contains fewer than { − } p 1 distinct elements. In other words, there exist some r, s Z∗ with r = s and rg =p sg. − ∈ p 6 Then (r s)g = 0. Even in modular arithmetic, ab = 0 iff a = 0 or b = 0. g = 0 by − p 6 definition, so it must be that r s = 0. But this contradicts r = s, establishing that all − p 6 p 1 elements of S are distinct. − g = 0 means each element of S is in Z∗ = 1, 2, ..., p 1 , which is just Zp 0 , so S 6 p { − } \{ } constitutes a reordering of Zp∗. The product of the elements of S should equal the product of the elements of Zp∗: p 1 − p 1 ig =p i=1− i i=1 Yp 1 Q (p 1)!g − =p (p 1)! − p 1 − g − = 1 2 This theorem allows you to more quickly compute exponents: 512 = 56 56 = 1 mod 7. · 5 Inverses, Generators, and Orders 1 Definition: The inverse of x Zp is a Zp st a x =p 1 and is denoted x− . • ∈ ∈ · Inversion algorithm: x 1 = xp 2 by Fermat’s little theorem (xp 1 = xp 2 x = 1). • − p − − − · p The Euclidean algorithm also provides inverses and will be discussed later. Z∗ = 1, 2, ..., p 1 is the set of invertible elements in Zp. • p { − } 2-2 Z∗ is a cyclic group. In general, group G is cyclic iff there exists a generator g G st • p ∈ G = 1, g, g2, g3, ..., g G 1 . { | |− } Not every element of Z∗ is a generator. (Note that g is a generator in a different • p sense here than in the proof of Fermat’s little theorem – multiplicative vs additive.) 2 3 4 5 Observe that 3 generates Z∗ because < 3 >= 1, 3, 3 = 2, 3 = 6, 3 = 4, 3 = 5 but 7 { } 2 does not because < 2 >= 1, 2, 4, 1, 2, 4 .
Load more

Recommended publications
  • GMR-1 and GMR-2) and finally a Widely Deployed Digital Locking System
    PRACTICAL CRYPTANALYSIS OF REAL-WORLD SYSTEMS An Engineer’s Approach DISSERTATION zur Erlangung des Grades eines Doktor-Ingenieurs der Fakultät für Elektrotechnik und Informationstechnik an der Ruhr-Universität Bochum Benedikt Driessen Bochum, July 2013 Practical Cryptanalysis of Real-World Systems Thesis Advisor Prof. Christof Paar, Ruhr-Universität Bochum, Germany External Referee Prof. Ross Anderson, University of Cambridge, England Date of submission May 22, 2013 Date of defense July 9, 2013 Date of last revision July 16, 2013 To Ursula and Walter, my parents. iii Abstract This thesis is dedicated to the analysis of symmetric cryptographic algorithms. More specifically, this doc- ument focuses on proprietary constructions found in four globally distributed systems. All of these con- structions were uncovered by means of reverse engineering, three of them while working on this thesis, but only one by the author of this document. The recovered designs were subsequently analyzed and attacked. Targeted systems range from the GSM standard for mobile communication to the two major standards for satellite communication (GMR-1 and GMR-2) and finally a widely deployed digital locking system. Surpris- ingly, although much progress has been made in the area of specialized cryptography, our attacks on the newly reverse engineered systems show that even younger designs still suffer from severe design flaws. The GSM stream ciphers A5/1 and A5/2 were reverse engineered and cryptanalyzed more than a decade ago. While the published attacks can nowadays be implemented and executed in practice, they also inspired our research into alternative, more efficient hardware architectures. In this work, we first propose a design to solve linear equation systems with binary coefficients in an unconventional, but supposedly fast way.
    [Show full text]
  • TS 101 377-3-10 V1.1.1 (2001-03) Technical Specification
    ETSI TS 101 377-3-10 V1.1.1 (2001-03) Technical Specification GEO-Mobile Radio Interface Specifications; Part 3: Network specifications; Sub-part 10: Security Related Network Functions; GMR-2 03.020 GMR-2 03.020 2 ETSI TS 101 377-3-10 V1.1.1 (2001-03) Reference DTS/SES-002-03020 Keywords GMR, GSM, GSO, interface, MES, mobile, MSS, network, radio, satellite, security, S-PCN ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.:+33492944200 Fax:+33493654716 Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88 Important notice Individual copies of the present document can be downloaded from: http://www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http://www.etsi.org/tb/status/ If you find errors in the present document, send your comment to: [email protected] Copyright Notification No part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media.
    [Show full text]
  • NTRU Cryptosystem: Recent Developments and Emerging Mathematical Problems in Finite Polynomial Rings
    XXXX, 1–33 © De Gruyter YYYY NTRU Cryptosystem: Recent Developments and Emerging Mathematical Problems in Finite Polynomial Rings Ron Steinfeld Abstract. The NTRU public-key cryptosystem, proposed in 1996 by Hoffstein, Pipher and Silverman, is a fast and practical alternative to classical schemes based on factorization or discrete logarithms. In contrast to the latter schemes, it offers quasi-optimal asymptotic effi- ciency and conjectured security against quantum computing attacks. The scheme is defined over finite polynomial rings, and its security analysis involves the study of natural statistical and computational problems defined over these rings. We survey several recent developments in both the security analysis and in the applica- tions of NTRU and its variants, within the broader field of lattice-based cryptography. These developments include a provable relation between the security of NTRU and the computa- tional hardness of worst-case instances of certain lattice problems, and the construction of fully homomorphic and multilinear cryptographic algorithms. In the process, we identify the underlying statistical and computational problems in finite rings. Keywords. NTRU Cryptosystem, lattice-based cryptography, fully homomorphic encryption, multilinear maps. AMS classification. 68Q17, 68Q87, 68Q12, 11T55, 11T71, 11T22. 1 Introduction The NTRU public-key cryptosystem has attracted much attention by the cryptographic community since its introduction in 1996 by Hoffstein, Pipher and Silverman [32, 33]. Unlike more classical public-key cryptosystems based on the hardness of integer factorisation or the discrete logarithm over finite fields and elliptic curves, NTRU is based on the hardness of finding ‘small’ solutions to systems of linear equations over polynomial rings, and as a consequence is closely related to geometric problems on certain classes of high-dimensional Euclidean lattices.
    [Show full text]
  • 11 Digital Signatures
    This is a Chapter from the Handbook of Applied Cryptography, by A. Menezes, P. van Oorschot, and S. Vanstone, CRC Press, 1996. For further information, see www.cacr.math.uwaterloo.ca/hac CRC Press has granted the following specific permissions for the electronic version of this book: Permission is granted to retrieve, print and store a single copy of this chapter for personal use. This permission does not extend to binding multiple chapters of the book, photocopying or producing copies for other than personal use of the person creating the copy, or making electronic copies available for retrieval by others without prior permission in writing from CRC Press. Except where over-ridden by the specific permission above, the standard copyright notice from CRC Press applies to this electronic version: Neither this book nor any part may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, microfilming, and recording, or by any information storage or retrieval system, without prior permission in writing from the publisher. The consent of CRC Press does not extend to copying for general distribution, for promotion, for creating new works, or for resale. Specific permission must be obtained in writing from CRC Press for such copying. c 1997 by CRC Press, Inc. Chapter 11 Digital Signatures Contents in Brief 11.1 Introduction :::::::::::::::::::::::::::::425 11.2 A framework for digital signature mechanisms ::::::::::426 11.3 RSA and related signature schemes :::::::::::::::::433 11.4 Fiat-Shamir signature schemes :::::::::::::::::::447 11.5 The DSA and related signature schemes ::::::::::::::451 11.6 One-time digital signatures :::::::::::::::::::::462 11.7 Other signature schemes ::::::::::::::::::::::471 11.8 Signatures with additional functionality ::::::::::::::474 11.9 Notes and further references ::::::::::::::::::::481 11.1 Introduction This chapter considers techniques designed to provide the digital counterpart to a handwrit- ten signature.
    [Show full text]
  • State of the Art in Lightweight Symmetric Cryptography
    State of the Art in Lightweight Symmetric Cryptography Alex Biryukov1 and Léo Perrin2 1 SnT, CSC, University of Luxembourg, [email protected] 2 SnT, University of Luxembourg, [email protected] Abstract. Lightweight cryptography has been one of the “hot topics” in symmetric cryptography in the recent years. A huge number of lightweight algorithms have been published, standardized and/or used in commercial products. In this paper, we discuss the different implementation constraints that a “lightweight” algorithm is usually designed to satisfy. We also present an extensive survey of all lightweight symmetric primitives we are aware of. It covers designs from the academic community, from government agencies and proprietary algorithms which were reverse-engineered or leaked. Relevant national (nist...) and international (iso/iec...) standards are listed. We then discuss some trends we identified in the design of lightweight algorithms, namely the designers’ preference for arx-based and bitsliced-S-Box-based designs and simple key schedules. Finally, we argue that lightweight cryptography is too large a field and that it should be split into two related but distinct areas: ultra-lightweight and IoT cryptography. The former deals only with the smallest of devices for which a lower security level may be justified by the very harsh design constraints. The latter corresponds to low-power embedded processors for which the Aes and modern hash function are costly but which have to provide a high level security due to their greater connectivity. Keywords: Lightweight cryptography · Ultra-Lightweight · IoT · Internet of Things · SoK · Survey · Standards · Industry 1 Introduction The Internet of Things (IoT) is one of the foremost buzzwords in computer science and information technology at the time of writing.
    [Show full text]
  • A Low Data Complexity Attack on the GMR-2 Cipher Used in the Satellite Phones
    A Low Data Complexity Attack on the GMR-2 Cipher Used in the Satellite Phones Ruilin Li, Heng Li, Chao Li, Bing Sun National University of Defense Technology, Changsha, China FSE 2013, Singapore 11th ~13th March, 2013 Outline • Backgrounds and the GMR-2 Cipher • Revisit the Component of the GMR-2 Cipher • The Low Data Complexity Attack • Experimental Result • Conclusion 2 Outline • Backgrounds and the GMR-2 Cipher • Revisit each Component of the GMR-2 Cipher • The Low Data Complexity Attack • Experimental Result • Conclusion 3 Backgrounds and the GMR-2 Cipher • Mobile communication systems have revolutionized the way we interact with each other – GSM, UMTS, CDMA2000, 3GPP LTE • When do we need satellite based mobile system? – In some special cases • researchers on a field trip in a desert • crew on ships on open sea • people living in remote areas or areas that are affected by a natural disaster 4 Backgrounds and the GMR-2 Cipher • What is GMR? – GMR stands for GEO-Mobile Radio – GEO stands for Geostationary Earth Orbit – Design heavily inspired from GSM 5 Backgrounds and the GMR-2 Cipher • Two major GMR Standards – GMR-1 (de-facto standard, Thuraya etc) – GMR-2 (Inmarsat and AcES) • How to protect the security of the communication in GMR system? – Using symmetric cryptography – Both the authentication and encryption are similar as that of GSM A3/A5 algorithms. 6 Backgrounds and the GMR-2 Cipher • Encryption Algorithms in GMR – Stream ciphers – Reconstructed by Driessen et al. • GMR-1 Cipher – Based on A5/2 of GSM – Totally broken by ciphertext-only
    [Show full text]
  • DIGITAL SIGNATURES IntroducOn > Whoami WHOAMI
    DAVID ACLAND - DIGITAL SIGNATURES Introduc6on > whoami WHOAMI David Acland @davidacland Introduc6on > whoami Introduc6on > About this talk ABOUT THIS TALK Introduc6on > About this talk > Progress Progress Bar Where are we? Introduc6on > About this talk > What WHAT WE’RE TALKING ABOUT Cryptology Cryptography Cryptanalysis Asymmetric Symmetric Encrypon Digital Signatures Introduc6on > About this talk > Why WHY WE’RE TALKING ABOUT IT DNSSEC Signed Packages Gatekeeper TCC Secure boot SSL DKIM AutoPkg SSH Kernel Extensions Introduc6on > About this talk > Why WHY WE’RE TALKING ABOUT IT Introduc6on > About this talk > Why WHY WE’RE TALKING ABOUT IT Trusted signatures are becoming a requirement Introduc6on > About this talk > Contents CONTENTS ▸ Introduc6on to digital signatures ▸ Underlying technologies ▸ Prac6cal usage Introduc6on > About this talk > Warning THERE’S MATHS IN HERE (sorry) Introduc6on > About this talk > Follow along IT’S INTERACTIVE https://bit.ly/2TR6y9a Introduc6on > Introduc6on to digital signatures INTRODUCTION TO DIGITAL SIGNATURES Introduc6on > Introduc6on to digital signatures WHAT IS A SIGNATURE? Introduc6on > Introduc6on to digital signatures > What’s a signature? WHAT’S A SIGNATURE? Introduc6on > Introduc6on to digital signatures > What’s a signature? WHAT DO THEY GIVE YOU? ▸ Authen6ca6on ▸ Integrity Security Services ▸ Non-repudia6on Introduc6on > Introduc6on to digital signatures > Paper Signatures ARE PAPER SIGNATURES EFFECTIVE? Introduc6on > Introduc6on to digital signatures > Paper Signatures ARE PAPER SIGNATURES
    [Show full text]
  • The Early Days of RSA -- History and Lessons Ronald L. Rivest MIT Lab for Computer Science
    The Early Days of RSA -- History and Lessons Ronald L. Rivest MIT Lab for Computer Science ACM Turing Award Lecture Lessons Learned Try to solve “real-world” problems … using computer science theory … and number theory. Be optimistic: do the “impossible”. Invention of RSA. Moore’s Law matters. Do cryptography in public. Crypto theory matters. Organizations matter: ACM, IACR, RSA Try to solve real-world problems Diffie and Hellman published “New Directions in Cryptography” Nov ’76: “We stand today at the brink of a revolution in cryptography.” Proposed “Public-Key Cryptosystem” . (This remarkable idea developed jointly with Merkle.) Introduced even more remarkable notion of digital signatures. Good cryptography is motivated by applications. (e-commerce, mental poker, voting, auctions, …) … using computer science theory In 1976 “complexity theory” and “algorithms” were just beginning… Cryptography is a “theory consumer”: it needs – easy problems (such as multiplication or prime-finding, for the “good guys”) and – hard problems (such as factorization, to defeat an adversary). …and number theory Diffie/Hellman used number theory for “key agreement” (two parties agree on a secret key, using exponentiation modulo a prime number). Some algebraic structure seemed essential for a PKC; we kept returning to number theory and modular arithmetic… Difficulty of factoring not well studied then, but seemed hard… Be optimistic: do the “impossible” Diffie and Hellman left open the problem of realizing a PKC: D(E(M)) = E(D(M)) = M where E is public, D is private. At times, we thought it impossible… Since then, we have learned “Meta-theorem of Cryptography”: Any apparently contradictory set of requirements can be met using right mathematical approach… Invention of RSA Tried and discarded many approaches, including some “knapsack-based” ones.
    [Show full text]
  • Draft Lecture Notes
    CS-282A / MATH-209A Foundations of Cryptography Draft Lecture Notes Winter 2010 Rafail Ostrovsky UCLA Copyright © Rafail Ostrovsky 2003-2010 Acknowledgements: These lecture notes were produced while I was teaching this graduate course at UCLA. After each lecture, I asked students to read old notes and update them according to the lecture. I am grateful to all of the students who participated in this massive endeavor throughout the years, for asking questions, taking notes and improving these lecture notes each time. Table of contents PART 1: Overview, Complexity classes, Weak and Strong One-way functions, Number Theory Background. PART 2: Hard-Core Bits. PART 3: Private Key Encryption, Perfectly Secure Encryption and its limitations, Semantic Security, Pseudo-Random Generators. PART 4: Implications of Pseudo-Random Generators, Pseudo-random Functions and its applications. PART 5: Digital Signatures. PART 6: Trapdoor Permutations, Public-Key Encryption and its definitions, Goldwasser-Micali, El-Gamal and Cramer-Shoup cryptosystems. PART 7: Interactive Proofs and Zero-Knowledge. PART 8: Bit Commitment Protocols in different settings. PART 9: Non-Interactive Zero Knowledge (NIZK) PART 10: CCA1 and CCA2 Public Key Encryption from general Assumptions: Naor-Yung, DDN. PART 11: Non-Malleable Commitments, Non-Malleable NIZK. PART 12: Multi-Server PIR PART 13: Single-Server PIR, OT, 1-2-OT, MPC, Program Obfuscation. PART 14: More on MPC including GMW and BGW protocols in the honest-but-curious setting. PART 15: Yao’s garbled circuits, Efficient ZK Arguments, Non-Black-Box Zero Knowledge. PART 16: Remote Secure Data Storage (in a Cloud), Oblivious RAMs. CS 282A/MATH 209A: Foundations of Cryptography °c 2006-2010 Prof.
    [Show full text]
  • Cryptography from Worst-Case Complexity Assumptions
    Cryptography from worst-case complexity assumptions Daniele Micciancio UC San Diego LLL+25 June 2007 (Caen, France) Outline ● Introduction – Lattices and algorithms – Complexity and Cryptography ● Lattice based cryptography – Lattice based hash functions – Other cryptographic primitives ● Conclusion / Open Problems – Choosing security parameters – Using lattices with special properties Outline ● Introduction – Lattices and algorithms – Complexity and Cryptography ● Lattice based cryptography – Lattice based hash functions – Other cryptographic primitives ● Conclusion / Open Problems – Choosing security parameters – Using lattices with special properties Point Lattices ● Set of all integer linear combinations of n basis vectors B = [b1,...,bn] ⊂ R ● n n L(B)={Bx: x Z } ⊂ span(B)={Bx: x R } b1+3b2 B b1 b2 Successive Minima ● For every n-dimensional lattice L, and i=1,...,n, the ith successive minimum (L) is li the smallest radius r such that Ball(0,r) contains i linearly independent lattice vectors l1 l2 Lattice problems ● Shortest Vector Problems (SVP) – Given a lattice L, find the nonzero lattice vector v closest to the origin (||v||£ g l1(L)) ● Shortest Independent Vect. Prob. (SIVP) – Given a lattice L, find n lin. independent vectors v1,...,vn of length maxi ||vi|| £ g ln(L) ● Approximation factor g(n) usually a function of the lattice dimension n. Lattice Reduction Algorithms O(n) ● [LLL] solves SVP and SIVP for g = 2 g g – Still useful in many algorithmic applications ● [Sch,NS] Improve polynomial running time of LLL ● [Sch,AKS]
    [Show full text]
  • Time for a Paradigm Shift in Our Disciplinary Culture?
    Time for a Paradigm Shift in Our Disciplinary Culture? Neal Koblitz Department of Mathematics, University of Washington [email protected] 1 Introduction The well-known KISS principle of engineering | Keep It Simple, Stupid! | is also of value in cryptography. In certain subfields, such as lattice-based crypto and indistinguishability obfuscation, the proposed constructions pay little heed to the KISS principle. Even the descriptions of the proper functioning of the protocols are frightfully complicated (by comparison with RSA or ECC, for example), and the security analyses and guidelines for parameter selection are even more problematic. But even something as wonderful as the KISS principle can be taken too far, as I learned to my chagrin during my early years of work in cryptography. In the late 1980s, when I wrote or spoke about ECC, I wanted to use the simplest possible examples, and these were the supersingular curves. For instance, just take the equation y2 = x3 − x over a field of p elements with p ≡ 3 (mod 4) or else y2 = x3 − 1 with p ≡ 2 (mod 3), where p is chosen so that respectively (p + 1)=4 or (p + 1)=6 is prime. As long as log2 p ≥ 163 we would have 80 bits of security, which at the time was enough. A few years later, Menezes{Okamoto{Vanstone [14] showed that the discrete log problem (DLP) on such a curve can be reduced to the DLP in the finite field of p2 elements, and even in the early 1990s this was insecure. A short time later, when I proposed Hyperelliptic Curve Cryptography (HCC), I again made a very erroneous judgment about parameter selection.
    [Show full text]
  • International Airport Codes
    Airport Code Airport Name City Code City Name Country Code Country Name AAA Anaa AAA Anaa PF French Polynesia AAB Arrabury QL AAB Arrabury QL AU Australia AAC El Arish AAC El Arish EG Egypt AAE Rabah Bitat AAE Annaba DZ Algeria AAG Arapoti PR AAG Arapoti PR BR Brazil AAH Merzbrueck AAH Aachen DE Germany AAI Arraias TO AAI Arraias TO BR Brazil AAJ Cayana Airstrip AAJ Awaradam SR Suriname AAK Aranuka AAK Aranuka KI Kiribati AAL Aalborg AAL Aalborg DK Denmark AAM Mala Mala AAM Mala Mala ZA South Africa AAN Al Ain AAN Al Ain AE United Arab Emirates AAO Anaco AAO Anaco VE Venezuela AAQ Vityazevo AAQ Anapa RU Russia AAR Aarhus AAR Aarhus DK Denmark AAS Apalapsili AAS Apalapsili ID Indonesia AAT Altay AAT Altay CN China AAU Asau AAU Asau WS Samoa AAV Allah Valley AAV Surallah PH Philippines AAX Araxa MG AAX Araxa MG BR Brazil AAY Al Ghaydah AAY Al Ghaydah YE Yemen AAZ Quetzaltenango AAZ Quetzaltenango GT Guatemala ABA Abakan ABA Abakan RU Russia ABB Asaba ABB Asaba NG Nigeria ABC Albacete ABC Albacete ES Spain ABD Abadan ABD Abadan IR Iran ABF Abaiang ABF Abaiang KI Kiribati ABG Abingdon Downs QL ABG Abingdon Downs QL AU Australia ABH Alpha QL ABH Alpha QL AU Australia ABJ Felix Houphouet-Boigny ABJ Abidjan CI Ivory Coast ABK Kebri Dehar ABK Kebri Dehar ET Ethiopia ABM Northern Peninsula ABM Bamaga QL AU Australia ABN Albina ABN Albina SR Suriname ABO Aboisso ABO Aboisso CI Ivory Coast ABP Atkamba ABP Atkamba PG Papua New Guinea ABS Abu Simbel ABS Abu Simbel EG Egypt ABT Al-Aqiq ABT Al Baha SA Saudi Arabia ABU Haliwen ABU Atambua ID Indonesia ABV Nnamdi Azikiwe Intl ABV Abuja NG Nigeria ABW Abau ABW Abau PG Papua New Guinea ABX Albury NS ABX Albury NS AU Australia ABZ Dyce ABZ Aberdeen GB United Kingdom ACA Juan N.
    [Show full text]