A Study of Luby-Rackoff Ciphers by Zulfikar Amin Ramzan Submitted to the Department of Electrical Engineering and Computer Science in partial fulfillment of the requirements for the degree o f BARKER Doctor of Philosophy SSACHUSETTS INSTITUTE OF TECHNOLOGY at the [ APR 2 4 MASSACHUSETTS INSTITUTE OF TECHNOLOGY 2001 January 2001 LIBRARIES @ Massachusetts Institute of Technology 2001. All rights reserved. A uthor ................ .............. o. .E.l..c.t.r.a. ..... Department of Electrical Engineering and Computer Science January 10, 2001 A1 Certified by. ............................................ I .. ............. ... I. .... Ronald L. Rivest Andrew and Erna Viterbi Professor of Electrical Engineering and Computer Science Thesis Supervisor Accepted by.................... 'a a Arthur C. Smith Chairman, Departmental Committee on Graduate Students 2 A Study of Luby-Rackoff Ciphers by Zulfikar Amin Ramzan Submitted to the Department of Electrical Engineering and Computer Science on January 10, 2001, in partial fulfillment of the requirements for the degree of Doctor of Philosophy Abstract In their ground-breaking paper, Luby and Rackoff [88] formally model the notion of a secure block cipher, and realize this notion under standard cryptographic assumptions. Ciphers based on their original techniques are termed Luby-Rackoff ciphers. This dissertation en- gages in a deeper study of such ciphers in order to better understand their security properties and make them more practical. First, we present a new, more practical, Luby-Rackoff cipher. The construction is effi- cient in terms of computation and key length. We also consider an alternate security analysis of this construction where we make a weaker but more practical underlying assumption, and arrive at a weaker security claim. Second, we consider modifying the algebraic structure over which some of the cipher operations work. This paradigm shift offers new lines of research, and leads to several interesting results. In particular, we construct a provably-secure cipher, operating over various finite groups, that has better time/space complexity, and uses less key material than previously considered Luby-Rackoff ciphers. Surprisingly, the cipher is insecure when these operations are performed over additive groups attached to finite fields of characteristic two. We also discuss the security of other Luby-Rackoff ciphers in this more general setting. Third, we propose a more refined notion of security for symmetric-key cryptographic primitives. The model uses the fact that many such primitives involve iterating simpler constructs for some number of rounds, and may be used to gain insight into the security of these constructions. We completely characterize the security of various Luby-Rackoff ciphers under this new model. We surprisingly show that even if an adversary is allowed black-box access to some internal components of the cipher, it still remains secure. Fourth, we show how to efficiently construct A-universal hash functions, which are used in many of the ciphers we consider. We present the square hash function which involves two novel ideas in the construction of such functions. Square hash performs quite well on modern microprocessors. We substantiate our claims via a hand-optimized assembly lan- guage implementation. Beyond their use in block cipher design, A-universal hash functions are useful for message authentication. Thesis Supervisor: Ronald L. Rivest Title: Andrew and Erna Viterbi Professor of Electrical Engineering and Computer Science Acknowledgments It is with a great sense of anticipation and trepidation that I begin to write, what I consider to be, one of the most important pieces of my dissertation. There are great number of people who helped me over the years, and I know that it is impossible to thank all of them. But I will try my best to thank as many as I can, and sincerely apologize to those I missed. First and foremost I would like to thank my advisor, Professor Ronald L. Rivest. Ron has been an invaluable source of help and support over the years. I have greatly benefited from his vast knowledge and perspicacity. Ron was always quick to suggest interesting and relevant research directions and references, and encouraged me to think independently about interesting areas to work on. He has helped me not only with understanding technical matters, but with both the proper written and oral communication of these ideas. For all of his help, I will always be grateful. Next I would like thank the other faculty with the Cryptography and Information se- curity group at MIT: Professors Shafi Goldwasser, Silvio Micali, and Madhu Sudan. I especially thank Silvio and Madhu for agreeing to serve as thesis readers on my committee. I had the pleasure of taking the introductory graduate course in cryptography taught by Silvio. His incremental approach to helping us carefully understand cryptographic prim- itives, and why concepts are defined as they are, has been invaluable. Shafi Goldwasser taught an advanced graduate cryptography class which I also had the pleasure of taking. Her ability to capture the essence of intricate ideas, and pick out the gaps in understanding that need to be filled in, is truly phenomenal. In addition, I took a class on Algebra and Computation from Madhu. His ability to truly engage the class, and create an interactive environment, are remarkable. The research I present in this thesis has been the result of collaborative work with a number of people. In particular, I would like to thank Mark Etzel, Sarvar Patel, Leonid Reyzin, and Ganesh Sundaram for our fruitful collaborations. Sarvar and Ganesh have worked with me extensively from the time I was in the nascent stages of my career as a cryptographer. We learned many of these concepts together. Chapters 3 and 4 were the results of collaborations with Sarvar and Ganesh. I thank Mark Etzel for a number of fruitful discussions on issues related to assembly language implementation, and chapter 6 is the result of collaboration with him and Sarvar. Leo and I started together as graduate students at MIT. We first met while eating "food truck" lunches in the third floor lounge during our first week as graduate students. Interestingly enough, during our third year as graduate students, a brief lunch discussion at nearly the same spot eventually led to the results of chapter 5. Moreover, working with Leo impacted my understanding of the results in many other parts of this thesis. Beyond the results presented in this dissertation, I had the opportunity to engage in fruitful research collaborations with Anna Lysyanskaya and Matthias Ruhl, both of whom are graduate students at MIT. My research was financially supported by a National Science Foundation fellowship, by Darpa grant DABT-63-96-C-0018, and by a grant from Merrill Lynch. There are also a number of people I would like to thank for fun and interesting research discussions that enhanced my understanding of cryptography. Some of these discussions were based on my papers, talks, and thesis drafts, whereas others were discussions of var- ious random research problems. In particular, I would like to thank John Black, Daniel Bleichenbacher, Anand Desai, Rosario Gennaro, Shai Halevi, Markus Jakobsson, Ari Juels, Stefan Lucks, Kazuo Ohta, Rohit Prasankumar, Omer Reingold, Phil Rogaway, Serge Vau- denay, David Wagner, and Peter Winkler. I'm sure I must be missing a number of people on this list - for that I truly apologize. I also thank the various anonymous referees, who've read my papers, for their many insightful comments. Beyond the people who've helped me learn about cryptography, I would like to thank the people who got me excited about computer science. To start with, I thank Bob Saenger, for a very well-taught computer science class at Bronx Science. It helped spark my decision to pursue an undergraduate CS degree. Next, I thank Professor S.S. Ravi for being a great teacher and mentor. He has always been a fountain of wonderful advice on various aspects of research and learning. I'll always be thankful to Ronitt Rubinfeld for introducing me to formal computer science research. Her enthusiasm was incredibly infectious, and she always seemed to believe in me - even when I didn't. She helped make my undergraduate experience thoroughly enjoyable and rewarding; for that I can't thank her enough. While at MIT, I had the opportunity to interact with a number of truly brilliant and talented students. It almost felt as if I could always find someone to help me out with a particular question or technical point (or in most cases, give me a million other questions to think about). In particular, I want to thank Ben Adida, Victor Boyko, Dwaine Clarke, Yev- geniy Dodis, John Dunagan, Jon Feldman, Kevin Fu, Venkatesan Guruswami, Helen Hong, Raj Iyer, Stas Jarecki, Adam Klivans, Eric Lehman, David Liben-Nowell, Moses Liskov, Anna Lysyanskaya, Tal Malkin, Danielle Micciancio, Alantha Newman, Sofya Raskhod- nikova, Leonid Reyzin, Matthias Ruhl, Amit Sahai, Sudipta Sengupta, Abhi Shelat, Adam Smith, Nati Srebro, Nitin Thaper, Salil Vadhan, and Yoav Yerushalmi. They made the theory group, and the Lab for Computer Science, in general, an exciting and intellectually stimulating place to be. Another important member of the theory group also deserves special thanks: Be Black- burn. Her seemingly infinite supply of chocolate, hot popcorn, and other goodies helped get me through many long days and nights on the third floor. One of Be's many talents is knowing how to make red tape disappear, which definitely made life much easier in a number of circumstances. Besides those who helped make MIT a wonderful place to learn computer science, I want to thank the many, many wonderful life-long friends I made while I was here. They have made these past few years incredibly fun. I would like to mention all of them by name, but I know I'd most likely forget someone.