CIS 5371 Cryptography
3b. Pseudorandomness
Based on: Jonathan Katz and Yehuda Lindell Introduction to Modern Cryptography
1
Pseudorandomness
An introduction
• A distribution D is pseudorandom if no PPT
distinguisher can detect if it a string sampled
according to D or chosen uniformly at random.
• This is formalized by requiring that every PPT
algorithm outputs 1 with almost the same
probability when given a truly random string
as when given a pseudorandom string.
2
Pseudorandomness
An introduction
• A pseudorandom generator is a
deterministic algorithm that given a short
truly random seed of length n will stretch
it to into a longer string of length 𝑙(𝑛)
that is pseudorandom.
3
Existence of pseudorandom
generators
• We cannot prove that pseudorandom
generators exist!
• We believe that such generators can be
constructed from one-way functions.
• There are some long-standing problems
that have no efficient solution and it is
believed that they are unsolvable in
polynomial time.
4
Pseudorandom generators
informal definition
• A distribution D is pseudorandom if no PPT
distinguisher can detect if it is given a string
sampled according to D or a string chosen
uniformly at random.
• This can be formalized by requiring that a PPT
distinguisher D outputs 1 with almost the
same probability when given a truly random
string and when given a pseudorandom string.
5
Pseudorandomness
Definition
Let 𝑙(∙) be a polynomial and 𝐺 a deterministic
polynomial-time algorithm that for any 𝑛 and any
input 𝑠 𝜖 {0,1}𝑛 will output string of length 𝑙(𝑛).
𝐺 is a pseudorandom generator if:
• 𝑙 𝑛 >𝑛
• ∀ PPT distinguishers 𝐷, ∃ 𝑎 negl function with:
| Pr 𝐷 𝑟 = 1 − Pr 𝐷 𝐺 𝑠 = 1 ≤ negl(n)
where 𝑟 is uniform random string of length 𝑙 𝑛 , 𝑠 𝑖𝑠
is uniform random of length 𝑛 and the probabilities
are taken over the coins used by 𝐷 and the choices
of 𝑟, 𝑠.
6
Stream Ciphers
A stream cipher is a deterministic algorithm
(Init, GetBits) where,
•
•
Init takes as input a seed 𝑠 and an optional
initialization vector 𝐼𝑉 and outputs a state 𝑠𝑡0 .
GetBits takes as input 𝑠𝑡𝑖 and outputs a bit 𝑦
and state 𝑠𝑡𝑖+1
7
Algorithm 3.16
Construct 𝐺𝑙 from (Init, GetBits)
Input: Seed 𝑠 and optional 𝐼𝑉.
Output: 𝑦1 , … , 𝑦𝑙
𝑠𝑡0 ≔ Init(𝑠, 𝐼𝑉)
for 𝑖 = 1 to 𝑙:
𝑦𝑖 , 𝑠𝑡𝑖 ≔ GetBits 𝑠𝑡𝑖−1
return 𝑦1 , … , 𝑦𝑙
8
A secure fixed length
encryption scheme
𝑘
𝑝𝑠𝑒𝑢𝑑𝑜𝑟𝑎𝑛𝑑𝑜𝑚
𝑔𝑒𝑛𝑒𝑟𝑎𝑡𝑜𝑟
𝑝𝑎𝑑
𝑝𝑙𝑎𝑖𝑛𝑡𝑒𝑥𝑡
𝑋𝑂𝑅
𝑐𝑖𝑝ℎ𝑒𝑟𝑡𝑒𝑥𝑡
9
A secure fixed length encryption
Protocol Π
Let 𝐺 be a pseudorandom generator with expansion
factor 𝑙. Define a private-key encryption scheme
for messages of length 𝑙 as follows
• Gen: on input 1𝑛 choose 𝑘  {0,1}𝑛 uniformly at
random and output 𝑘 as key.
• Enc: on input a key 𝑘  {0,1}𝑛 and a message
𝑚{0,1}𝑙(𝑛) output the ciphertext
𝑐 ≔G 𝑘 𝑚.
• Dec: on input a key 𝑘  {0,1}𝑛 and a ciphertext
c{0,1}𝑙(𝑛) output the plaintext
𝑚 ≔G 𝑘 𝑐.
10
A secure fixed length encryption
Theorem
If 𝐺 be a pseudorandom generator then
protocol  is a fixed-length private-key
encryption scheme that has
indistinguishable encryptions in the
presence of an eavesdropper.
11
A secure fixed length encryption
Reduction
Adversary A’
(Distinguisher D)
Adversary A (Protocol )
1𝑛
𝑤
choose a random bit 𝑏
compute 𝑐𝑏 : = w  𝑚𝑏
1 if 𝑏 ′ = 𝑏
0 if 𝑏 ′  𝑏
𝑚0 , 𝑚1
𝑐𝑏
Suppose that A
succeeds with
probability 𝜀(𝑛)
𝑏′
12
A secure fixed length encryption
Proof
•
when 𝑤 is uniform random we have
Pr 𝐷 𝑤 = 1 = Pr
•
PrivK eav (𝐴, 
𝑛 =1 =
1
.
2
when 𝑤 = 𝐺(𝑘) we have
Pr 𝐷 𝐺 𝑘
= 1 = Pr PrivK eav (𝐴,  𝑛 = 1
Since 𝐺 is a pseudorandom generator
| Pr 𝐷 𝑤 = 1 - Pr 𝐷 𝐺 𝑘
= 1 | ≤ negl
Therefore
|
1
2
− Pr PrivK eav 𝐴,  𝑛 = 1 | ≤ negl.
13
Stream ciphers
• We can easily modify the earlier construction
for the encryption scheme  for variable
output length PRG.
• In this case,
• 𝑐 ≔ G 𝑘, 1 𝑚  𝑚 .
• 𝑚 ≔ G 𝑘, 1|𝑐|  𝑐 .
14
Discussion
• We use the term
• stream cipher
for the PR stream generator,
• not the encryption algorithm.
• There are a number of practical
constructions of stream ciphers that are
extraordinarily fast, such as the stream
cipher RC4.
15
Discussion
• The WEP encryption protocol for 802.11
used RC4 and was broken.
• But since then it is fixed---and the standard
updated.
• If RC4 has to be used the first 1024 bits or
so should be discarded.
16
Discussion
• From a security point of view it is
advocated to use block cipher constructions
for constructing secure encryption
schemes.
• This disadvantage is that this approach is
less efficient when compared to using a
dedicated stream cipher.
17
Multi-message eavesdropping
mult
experiment PrivK
(𝐴,)(𝑛)
1. The adversary 𝐴 is given input 1𝑛 and outputs a pair
of vectors of messages 𝑚10 , … , 𝑚0𝑡 and 𝑚11 , … , 𝑚1𝑡
witℎ |𝑚0𝑖 = |𝑚1𝑖 for all 𝑖.
2. A key 𝑘 is generated runnng 𝐺𝑒𝑛 1𝑛 and a random bit
𝑏  0,1 is chosen. For all 𝑖 the ciphertext 𝑐𝑏𝑖  En𝑐𝑘 𝑚𝑏𝑖
is computed and the vector of ciphertexts 𝑐𝑏1 , … , 𝑐𝑏𝑡
is given to 𝐴.
3. .𝐴 outputs a bit 𝑏 ′ .
4. The output of the experiment i𝑠 1 if 𝑏 = 𝑏 ′ and 0 otherwise.
18
Definition
A private-key encryption scheme =(Gen,Enc,Dec)
that has indistinguishable multiple encryptions in
the presence of an eavesdropper satisfies:
 PPT Adversary 𝐴,  a negligible function negl:
Pr[PrivK
mult
(𝐴, ) 𝑛 = 1] ≤
1
2
+ negl 𝑛 ,
where the probability is taken over the random
coins of 𝐴, and the experiment.
19
Indistinguishable single encryptions vs
indistinguishable multi encryptions
• The secure fixed length encryption Protocol Π
presented earlier is deterministic and cannot
be used as a construction for a
indistinguishable multi encryptions.
• To see why use the experiment PrivK mult for
the pair of vector messages (0𝑛 , 0𝑛 ) and
0𝑛 , 1𝑛 .
20
Secure multiple encryptions using a
stream-cipher mode of operation
• Synchronized mode
• Communicating parties use a different
part of the stream cipher output to
encrypt a message.
𝐸𝑛𝑐𝑘 𝑚 ≔ 𝐺∞ 𝑠, 1|𝑚|  𝑚
• Useful for parties communicating in the
same session.
• Communicating parties must maintain
state between encryptions.
21
Secure multiple encryptions
stream-cipher mode of operation
Unsynchronized mode
 Encryptions are carried out independently
of one another.
 Communicating parties are not required to
maintain state between encryptions.
 𝐸𝑛𝑐𝑘 𝑚 ≔ 𝐼𝑉, 𝐺∞ 𝑠, 𝐼𝑉, 1|𝑚|  𝑚
where the initial vector 𝐼𝑉  {0,1}𝑛 is
chosen at random.
22
Security against ChosenPlaintext Attack (CPA)
 We now consider a more powerful adversary
that is active.
 The adversary can ask for the encryptions of
some specific plaintext messages, as well as
eavesdrop.
23
The CPA indistinguishability
experiment PrivK cpa (𝐴,)(𝑛)
1.
A key 𝑘 is generated runnng Gen 1𝑛 .
2.
The adversary 𝐴 is given input 1𝑛 and oracle access to En𝑐𝑘 ∙ ,
and outputs a pair of messages 𝑚0 , 𝑚1 of equal length.
3. A random bit 𝑏  0,1 is chosen and a ciphertext
c  En𝑐𝑘 𝑚𝑏 is computed and given to 𝐴.
4. Adversary 𝐴 continues to have oracle access to En𝑐𝑘 ∙ , and
outputs a bit 𝑏 ′ .
5. The output of the experiment i𝑠 1 if 𝑏 = 𝑏 ′ and 0 otherwise.
24
Indistinguishable encryptions under CPA
Definition
A private-key encryption scheme  = Gen, Enc, Dec
has indistinguishable encryptions under CPA if
∀ PPT adversaries 𝐴, ∃ a negl function such that,
Pr[PrivKcpa
𝐴, 
𝑛 = 1] ≤
1
2
+ negl 𝑛 ,
where the probability is taken over the coins of A
and those of the experiment.
25
CPA security for multiple encryptions
 As for single encryption, extend the experiment
to PrivK cpa in which the adversary outputs a
pair of vectors of plaintext.
 Any private-key encryption scheme that has
indistinguishable encryptions under CPA also
has indistinguishable multiple encryptions
under CPA
26