Foundations of Cryptography Teaching Notes Oded Goldreich Department of Computer Science Weizmann Institute of Science Israel Email odedwisdomweizmannaci l Fall I c Copyright by Oded Goldreich Permission to make copies of part or all of this work for p ersonal or classro om use is granted without fee provided that copies are not made or distributed for prot or commercial advantage and that new copies b ear this notice and the full citation on the rst page Abstracting with credit is p ermitted II Preface These teaching notes were initially intended for myself as an aid for preparing the lectures in the course Foundations of Cryptography given at Weizmann Institute at the Fall of It then o ccurred to me that these notes may also serve as suggestions to others as to how such a course can b e taught and the notes were slightly adapted accordingly The course was based on the rst two volumes of my work Foundations of Cryptography The rst volume entitled Foundations of Cryptography Basic Tools has app eared with Cambridge University Press in June The second volume entitled Foundations of Cryptography Basic Applications will hop efully b e completed in a couple of years Preliminary versions of the chapters of the second volume are available from the webpage httpwwwwisdomweizmannacilodedfocbookhtml You may want to check this website for various up dates and notices concerning the entire work These teaching notes refer to the ab ove work Sp ecically they merely summarize and annotate the parts of the work that was taught in class The detailed material is to b e found in the b o ok itself and the b oxes ushed to the right as the example b elow refer to the sections in the b o ok in which the relevant material is to b e found Example State and usage of these notes Unfortunately Ive stopp ed writing these notes at the middle of the semester Thus the current notes only cover the rst lectures out of the planned lectures I hop e to complete the missing notes next time I teach this course which may b e next year Unlike the ab ovementioned work these teaching notes were not carefully pro ofread I ap ologize for the various errors that they may contain and hop e that nevertheless these notes will b e useful Needless to say the teaching pace should and do es dep end on the sp ecic class In fact I often pro ceeded in pace dierent than the one I have originally planned omitting or adding material onthey III IV From the preface of Volume It is p ossible to build a cabin with no foundations but not a lasting building Eng Isidor Goldreich Cryptography is concerned with the construction of schemes that withstand any abuse Such schemes are constructed so to maintain a desired functionality even under malicious attempts aimed at making them deviate from their prescrib ed functionality The design of cryptographic schemes is a very dicult task One cannot rely on intuitions regarding the typical state of the environment in which the system op erates For sure the adversary attacking the system will try to manipulate the environment into untypical states Nor can one b e content with countermeasures designed to withstand sp ecic attacks since the adversary which acts after the design of the system is completed will try to attack the schemes in ways that are typically dierent from the ones the designer had envisioned The validity of the ab ove assertions seems selfevident still some p eople hop e that in practice ignoring these tautologies will not result in actual damage Exp erience shows that these hop es rarely come true cryptographic schemes based on makebelieve are broken typically so oner than later In view of the ab ove we b elieve that it makes little sense to make assumptions regarding the sp ecic strategy that the adversary may use The only assumptions that can b e justied refer to the computational abilities of the adversary Furthermore it is our opinion that the design of cryptographic systems has to b e based on rm foundations whereas adho c approaches and heuristics are a very dangerous way to go A heuristic may make sense when the designer has a very go o d idea ab out the environment in which a scheme is to op erate yet a cryptographic scheme has to op erate in a maliciously selected environment which typically transcends the designers view This b o ok is aimed at presenting rm foundations for cryptography The foundations of cryp tography are the paradigms approaches and techniques used to conceptualize dene and provide solutions to natural security concerns We will present some of these paradigms approaches and techniques as well as some of the fundamental results obtained using them Our emphasis is on the clarication of fundamental concepts and on demonstrating the feasibility of solving several central cryptographic problems Solving a cryptographic problem or addressing a security concern is a twostage pro cess con sisting of a denitional stage and a constructive stage First in the denitional stage the function ality underlying the natural concern is to b e identied and an adequate cryptographic problem has to b e dened Trying to list all undesired situations is infeasible and prone to error Instead one should dene the functionality in terms of op eration in an imaginary ideal mo del and require a candidate solution to emulate this op eration in the real clearly dened mo del which sp ecies the adversarys abilities Once the denitional stage is completed one pro ceeds to construct a system V VI that satises the denition Such a construction may use some simpler to ols and its security is proven relying on the features of these to ols In practice of course such a scheme may need to satisfy also some sp ecic eciency requirements This b o ok fo cuses on several archetypical cryptographic problems eg encryption and signature schemes and on several central to ols eg computational diculty pseudorandomness and zero knowledge pro ofs For each of these problems resp to ols we start by presenting the natural concern underlying it resp its intuitive ob jective then dene the problem resp to ol and nally demonstrate that the problem may b e solved resp the to ol can b e constructed In the latter step our fo cus is on demonstrating the feasibility of solving the problem not on providing a practical solution As a secondary concern we typically discuss the level of practicality or impracticality of the given or known solution Computational Diculty The sp ecic constructs mentioned ab ove as well as most constructs in this area can exist only if some sort of computational hardness exists Sp ecically all these problems and to ols require either explicitly or implicitly the ability to generate instances of hard problems Such ability is captured in the denition of oneway functions see further discussion in Section Thus one way functions is the very minimum needed for doing most sorts of cryptography As we shall see they actually suce for doing much of cryptography and the rest can b e done by augmentations and extensions of the assumption that oneway functions exist Our current state of understanding of ecient computation do es not allow us to prove that oneway functions exist In particular the existence of oneway functions implies that NP is not contained in BPP P not even on the average which would resolve the most famous op en problem of computer science Thus we have no choice at this stage of history but to assume that oneway functions exist As justication to this assumption we may only oer the combined b elieves of hundreds or thousands of researchers Furthermore these b elieves concern a simply stated assumption and their validity is supp orted by several widely b elieved conjectures which are central to some elds eg the conjecture that factoring integers is hard is central to computational number theory As we need assumptions anyhow why not just assume what we want ie the existence of a solution to some natural cryptographic problem Well rst we need to know what we want as stated ab ove we must rst clarify what exactly do we want that is go through the typically complex denitional stage But once this stage is completed can we just assume that the denition derived can b e met Not really the mere fact that a denition was derived do es not mean that it can b e met and one can easily dene ob jects that cannot exist without this fact b eing obvious in the denition The way to demonstrate that a denition is viable and so the intuitive security concern can b e satised at all is to construct a solution based on a better understood assumption ie one that is more common and widely b elieved For example lo oking at the denition of zero knowledge pro ofs it is not apriori clear that such pro ofs exist at all in a nontrivial sense The nontriviality of the notion was rst demonstrated by presenting a zeroknowledge pro of system for statements regarding Quadratic Residuosity which are b elieved to b e hard to verify without extra information Furthermore in contrary to prior b eliefs it was later shown in that the existence of oneway functions implies that any NPstatement can b e proven in zeroknowledge Thus facts that were not known at all to hold and even b elieved to b e false were shown to hold by reduction to widely b elieved assumptions without which most of mo dern cryptography collapses anyhow To summarize not all assumptions are equal and so reducing a complex new and doubtful assumption VI I to a widelyb elieved simple or even merely simpler assumption is of great value Furthermore reducing the solution of a new task to the assumed security of