Provably Secure against Adaptive Chosen. Ciphertext Attack. Ronald Cramer
|
|
- Everett Stafford
- 5 years ago
- Views:
Transcription
1 A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack Ronald Cramer Institute for Theoretical Computer Science, ETH Zurich, 809 Zurich, Switzerland Victor Shoup IBM Zurich Research Laboratory, Saumerstr. 4, 8803 Ruschlikon, Switzerland May 998 Abstract A new public key cryptosystem is proposed and analyzed. The scheme is quite practical, and is provably secure against adaptive chosen ciphertext attack under standard intractability assumptions. There appears to be no previous cryptosystem in the literature that enjoys both of these properties simultaneously. Introduction In this paper, we present and analyze a new public key cryptosystem that is provably secure against adaptive chosen ciphertext attack (as dened by Racko and Simon [0]). The scheme is quite practical, requiring just a few exponentiations over a group. Moreover, the proof of security relies only on a standard intractability assumption, namely, the hardness of the Die- Hellman decision problem in the underlying group.
2 The hardness of the Die-Hellman decision problem is essentially equivalent to the semantic security of the basic El Gamal encryption scheme []. Thus, with just a bit more computation, we get security against adaptive chosen ciphertext attack, whereas the basic El Gamal scheme is completely insecure against adaptive chosen ciphertext attack. Actually, the basic scheme we describe also requires a universal one-way hash function. In a typical implementation, this can be eciently constructed without extra assumptions; however, we also present a hash-free variant as well. While there are several provably secure encryption schemes in the literature, they are all quite impractical. Also, there are several practical cryptosystems that have been proposed, but none of them has been proven secure under standard intractability assumptions. The signicance of our contribution is that it provides a scheme that is provably secure and practical at the same time. There appears to be no other encryption scheme in the literature that enjoys both of these properties simultaneously. Chosen Ciphertext Security Semantic security, dened by Goldwasser and Micali [4], captures the intuition that an adversary should not be able to obtain any partial information about a message given its encryption. However, this guarantee of secrecy is only valid when the adversary is completely passive, i.e., can only eavesdrop. Indeed, semantic security oers no guarantee of secrecy at all if an adversary can mount an active attack, i.e., inject messages into a network or otherwise inuence the behavior of parties in the network. To deal with active attacks, Racko and Simon [0] dened the notion of security against an adaptive chosen ciphertext attack. If an adversary can inject messages into a network, these messages may be encryptions, and the adversary may be able to extract partial information about the corresponding cleartexts through its interactions with the parties in the network. Racko and Simon's denition models this type of attack by simply allowing an adversary to obtain decryptions of its choice, i.e., the adversary has access to a \decryption oracle." Now, given an encryption of a message the \target" ciphertext we want to guarantee that the adversary cannot obtain any partial information about the message. To achieve this, we have to restrict the adversary's behavior in some way, otherwise the adversary could simply submit the target ciphertext itself to the decryption oracle. The restriction
3 proposed by Racko and Simon is the weakest possible: the adversary is not allowed to submit the target ciphertext itself to the oracle; however, it may submit any other ciphertext, including ciphertexts that are related to the target ciphertext. A dierent notion of security against active attacks, called nonmalleability, was proposed by Dolev, Dwork, and Naor [9]. Here, the adversary also has access to a decryption oracle, but his goal is not to obtain partial information about the target ciphertext, but rather, to create another encryption of a dierent message that is related in some interesting way to the original, encrypted message. For example, for a non-malleable encryption scheme, given an encryption of n, it should be infeasible to create an encryption of n +. It turns out that non-malleability and security against adaptive chosen ciphertext attack are equivalent [0]. A cryptosystem secure against adaptive chosen ciphertext attack is a very powerful cryptographic primitive. It is essential in designing protocols that are secure against active adversaries. For example, this primitive is used in protocols for authentication and key exchange [, 0, ] and in protocols for escrow, certied , and more general fair exchange [, ]. The practical importance of this primitive is also highlighted by the adoption of Bellare and Rogaway's OAEP scheme [4] (a practical but only heuristically secure scheme) as an internet encryption standard and for use in the SET protocol for electronic commerce. There are also intermediate notions of security, between semantic security and adaptive chosen ciphertext security. Naor and Yung [9] propose an attack model where the adversary has access to the decryption oracle only prior to obtaining the target ciphertext, and the goal of the adversary is to obtain partial information about the encrypted message. Naor and Yung called this type of attack a chosen ciphertext attack; it has also been called a \lunch-time" or \midnight" attack. In this paper, we will always use the phrase adaptive chosen ciphertext attack for Racko and Simon's denition, to distinguish it from Naor and Yung's denition. Previous Work Provably Secure Schemes. Naor and Yung [9] presented the rst scheme provably secure against lunch-time attacks. Subsequently, Dolev, Dwork, and Naor [9] presented a scheme that is provably secure against adaptive 3
4 chosen ciphertext attack. Racko and Simon [0] present and prove the security of an encryption scheme, but their scheme is actually not a public key scheme in the traditional sense: in their scheme, all users both senders and receivers require public keys, and moreover, a trusted center is required to perform certain functions. In contrast, all other schemes mentioned in this paper, including our own, are traditional public key systems: encryption is a probabilistic function of the message and the receiver's public key, decryption is a function of the ciphertext and the receiver's secret key, and no trusted center is required. This distinction can be important: adding extra system requirements as in the Racko and Simon scheme can greatly restrict the range of application of the scheme. All of the previously known schemes provably secure under standard intractability assumptions are completely impractical (albeit polynomial time), as they rely on general and expensive constructions for non-interactive zeroknowledge proofs. This includes non-standard schemes like Racko and Simon's as well. Practical Schemes. Damgard [8] proposed a practical scheme that he conjectured to be secure against lunch-time attacks; however, this scheme is not known to be provably secure, and is in fact demonstrably insecure against adaptive chosen ciphertext attack. Zheng and Seberry [4] proposed practical schemes that are conjectured to be secure against chosen ciphertext attack, but again, no proof based on standard intractability assumptions is known. Lim and Lee [6] also proposed practical schemes that were later broken by Frankel and Yung [3]. Bellare and Rogaway [3, 4] have presented practical schemes for which they give heuristic proofs of adaptive chosen ciphertext security; namely, they prove security in an idealized model of computation, the so-called random oracle model, wherein a hash function is represented by a random oracle. Shoup and Gennaro [] also give El Gamal-like schemes that are secure against adaptive chosen ciphertext attack in the random oracle model, and that are also amenable to ecient threshold decryption. We stress that although a security proof in the random oracle model is of some value, it is still only a heuristic proof. In particular, these types of proofs do not rule out the possibility of breaking the scheme without breaking the underlying intractability assumption. Nor do they even rule out the 4
5 possibility of breaking the scheme without nding some kind of weakness in the hash function, as recently shown by Canetti, Goldreich, and Halevi [7]. Outline of paper In x we review the basic denitions that we need for security and intractability assumptions. In x3 we outline our basic scheme, and in x4 we prove its security. In x5 we discuss some implementation details and variations on the basic scheme. Denitions. Security against adaptive chosen ciphertext attack We recall Racko and Simon's denition. Security is dened via the following game played by the adversary. First, the encryption scheme's key generation algorithm is run, with a security parameter as input. Next, the adversary makes arbitrary queries to a \decryption oracle," decrypting ciphertexts of his choice. Next the adversary chooses two messages, m 0 ; m, and sends these to an \encryption oracle." The encryption oracle chooses a bit b f0; g at random, and encrypts m b. The corresponding ciphertext is given to the adversary (the internal coin tosses of the encryption oracle, in particular b, are not in the adversary's view). After receiving the ciphertext from the encryption oracle, the adversary continues to query the decryption oracle, subject only to the restriction that the query must be dierent than the output of the encryption oracle. At the end of the game, the adversary outputs b 0 f0; g, which is supposed to be the adversary's guess of the value b. If the probability that b 0 = b is = +, then the adversary's advantage is dened to be. The cryptosystem is said to be secure against adaptive chosen ciphertext attack if the advantage of any polynomial-time adversary is negligible (as a function of the security parameter). 5
6 . The Die-Hellman Decision Problem There are several equivalent formulations of the Die-Hellman decision problem. The one that we shall use is the following. Let G be a group of large prime order q, and consider the following two distributions: the distribution R of random quadruples (g ; g ; u ; u ) G 4 ; the distribution D of quadruples (g ; g ; u ; u ) G 4, where g ; g are random, and u = g r and u = g r for random r Z q. An algorithm that solves the Die-Hellman decision problem is a statistical test that can eectively distinguish these two distributions. That is, given a quadruple coming from one of the two distributions, it should output 0 or, and there should be a non-negligible dierence between (a) the probability that it outputs a given an input from R, and (b) the probability that it outputs a given an input from D. The Die-Hellman decision problem is hard if there is no such polynomial-time statistical test. This formulation of the Die-Hellman decision problem is equivalent to several others. First, making the substitution g! g; g! g x ; u! g y ; u! g xy ; one sees that this is equivalent to distinguishing Die-Hellman triples (g x ; g y ; g xy ) from non-die-hellman triples (g x ; g y ; g z ). Note that by a trivial random self-reducibility property, it does not matter if the base g is random or xed. Second, although we have described it as a problem of distinguishing two distributions, the Die-Hellman decision problem is equivalent to the worst-case decision problem: given (g x ; g y ; g z ), decide with negligible error probability if z = xy mod q. This equivalence follows immediately from a random self-reducibility property rst observed by Stadler [3] and later by Naor and Reingold [7]. Related to the Die-Hellman decision problem is the Die-Hellman problem (given g, g x and g y, compute g xy ), and the discrete logarithm problem (given g and g x, compute x). There are obvious polynomial-time reductions from the Die-Hellman decision problem to the Die-Hellman problem, and from the Die-Hellman 6
7 problem to the discrete logarithm problem, but reductions in the reverse direction are not known. Moreover, these reductions are essentially the only known methods of solving the Die-Hellman or Die-Hellman decision problems. All three problems are widely conjectured to be hard, and have been used as assumptions in proving the security of a variety of cryptographic protocols. Some heuristic evidence for the hardness of all of these problems is provided in [], where it is shown that they are hard in a certain natural, structured model of computation. See [3, 7, 6] for further applications and discussion of the Die-Hellman decision problem. Note that the hardness of the Die-Hellman decision problem is equivalent to the semantic security of the basic El Gamal encryption scheme. Recall that in the basic El Gamal scheme, we encrypt a message m G as (g r ; h r m), where h is the public key of the recipient. On the one hand, if the Die-Hellman decision problem is hard, then the group element h r could be replaced by a random group element without changing signicantly the behavior of the attacker; however, if we perform this substitution, the message m is perfectly hidden, which implies security. On the other hand, if the Die-Hellman decision problem can be eciently solved, then an attacker can break El Gamal as follows. The attacker chooses two messages m 0 ; m, giving these to an encryption oracle. The encryption oracle produces an encryption (u; e) = (g r ; h r m b ), where b f0; g is chosen at random. The attacker's task is to determine b, which he can do by simply determining which of (u; h; e=m 0 ) and (u; h; e=m ) is a Die-Hellman triple. Note that the basic El Gamal scheme is completely insecure against adaptive chosen ciphertext attack. Indeed, given an encryption (u; e) of a message m, we can feed the (u; g e) to the decryption oracle, which gives us g m..3 Collision-resistant Hash Functions A family of hash functions is said to be collision resistant if upon drawing a function H at random from the family, it is infeasible for an adversary to nd two dierent inputs x and y such that H(x) = H(y). A weaker notion is that of a universal one-way family of hash functions [8]. Here, it should be infeasible for an adversary to choose an input x, draw a random hash function H, and then nd a dierent input y such that H(x) = H(y). Such hash function families are also called target collision 7
8 resistant. See [5] for recent results and further discussion. 3 The Basic Scheme We assume that we have a group G of prime order q, where q is large. We also assume that cleartext messages are (or can be encoded as) elements of G (although this condition can be relaxed see x5.). We also use a universal one-way family of hash functions that map long bit strings to elements of Z q (although we can do without this see x5.3). Key Generation. The key generation algorithm runs as follows. Random elements g ; g G are chosen, and random elements x ; x ; y ; y ; z Z q are also chosen. Next, the group elements c = g x gx ; d = gy gy ; h = gz are computed. Next, a hash function H is chosen from the family of universal one-way hash functions. The public key is (g ; g ; c; d; h; H), and the private key is (x ; x ; y ; y ; z). Encryption. Given a message m G, the encryption algorithm runs as follows. First, it chooses r Z q at random. Then it computes The ciphertext is u = g r ; u = g r ; e = hr m; = H(u ; u ; e); v = c r d r : (u ; u ; e; v): Decryption. Given a ciphertext (u ; u ; e; v), the decryption algorithm runs as follows. It rst computes = H(u ; u ; e), and tests if u x +y u x +y = v: If this condition does not hold, the decryption algorithm outputs \reject"; otherwise, it outputs m = e=u z : 8
9 We rst verify that this is an encryption scheme, in the sense that the decryption of an encryption of a message yields the message. Since u = g r and u = g, r we have u x ux = g rx g rx = c r : Likewise, u y uy = d r and u z = hr Therefore, the test performed by the decryption algorithm will pass, and the output will be e=h r = m. 4 Proof of Security In this section, we prove the following theorem. Theorem The above cryptosystem is secure against adaptive chosen ciphertext attack assuming that () the hash function H is chosen from a universal one-way family, and () the Die-Hellman decision problem is hard in the group G. To prove the theorem, we will assume that there is an adversary that can break the cryptosystem, and that the hash family is universal one-way, and show how to use this adversary to construct a statistical test for the Die-Hellman decision problem. For the statistical test, we are given (g ; g ; u ; u ) coming from either the distribution R or D. At a high level, our construction works as follows. We build a simulator that simulates the joint distribution consisting of adversary's view in its attack on the cryptosystem, and the hidden bit b generated by the generated oracle (which is not a part of the adversary's view). We will show that if the input comes from D, the simulation will be nearly perfect, and so the adversary will have a non-negligible advantage in guessing the hidden bit b. We will also show that if the input comes from R, then the adversary's view is essentially independent of b, and therefore the adversary's advantage is negligible. This immediately implies a statistical test distinguishing R from D: run the simulator and adversary together, and if the simulator outputs b and the adversary outputs b 0, the distinguisher outputs if b = b 0, and 0 otherwise. We now give the details of the simulator. The input to the simulator is (g ; g ; u ; u ). The simulator runs the following key generation algorithm, 9
10 using the given g ; g. The simulator chooses at random, and computes x ; x ; y ; y ; z ; z Z q c = g x gx ; d = gy gy ; h = gz gz : The simulator also chooses a hash function H at random. The public key that the adversary sees is (g ; g ; c; d; h; H). The simulator knows (x ; x ; y ; y ; z ; z ). Note that the simulator's key generation algorithm is slightly dierent from the key generation algorithm of the actual cryptosystem; in the latter, we essentially x z = 0. The simulator answers decryption queries as in the actual attack, except that it computes m = e=(u z uz ). We now describe the simulation of the encryption oracle. Given m 0 ; m, the simulator chooses b f0; g at random, and computes and outputs e = u z uz m b; = H(u ; u ; e); v = u x +y u x +y ; (u ; u ; e; v): That completes the description of the simulator. As we will see, when the input to the simulator comes from D, the output of the encryption oracle is a perfectly legitimate ciphertext; however, when the input to the simulator comes from R, the output of the decryption oracle will not be legitimate, in the sense that log g u 6= log g u. This is not a problem, and indeed, it is crucial to the proof of security. The theorem now follows immediately from the following two lemmas. Lemma When the simulator's input comes from D, the joint distribution of the adversary's view and the hidden bit b is is statistically indistinguishable from that in the actual attack. Consider the joint distribution of the adversary's view and the bit b when the input comes from the distribution D. Say u = g r and u = g. r It is clear in this case that the output of the encryption oracle has the right distribution, since u x ux = c r, u y uy = d r, and u z uz = h r ; indeed, 0
11 these equations imply that e = m b h r and v = c r d r, and itself is already of the right form. To complete the proof, we need to argue that the output of the decryption oracle has the right distribution. Let us call (u 0 ; ; u0 ; v e0 0 ) G 4 a valid ciphertext if log g u 0 = log g. u0 Note that if a ciphertext is valid, with u 0 = gr0 and u 0 =, then gr0 h = r0 (u 0 )z (u 0 )z ; therefore, the decryption oracle outputs e=h, just as it r0 should. Consequently, the lemma follows immediately from the following: Claim. The decryption oracle in both an actual attack against the cryptosystem and in an attack against the simulator rejects all invalid ciphertexts, except with negligible probability. We now prove this claim by considering the distribution of the point P = (x ; x ; y ; y ) Z 4 q, conditioned on the adversary's view. Let log() denote log g (), and let w = log g. From the adversary's view, P is a random point on the plane P formed by intersecting the hyperplanes and log c = x + wx () log d = y + wy : () These two equations come from the public key. The output from the encryption oracle does not constrain P any further, as the hyperplane dened by log v = rx + wrx + ry + rwy (3) contains P. Now suppose the adversary submits an invalid ciphertext (u 0 ; u0 ; v0 ; e 0 ) to the decryption oracle, where log u 0 = r 0 and log u 0 = wr 0, with r 0 6= r 0. The decryption oracle will reject, unless P happens to lie on the hyperplane H dened by log v 0 = r 0 x + wr 0 x + 0 r 0 y + 0 r 0 wy ; (4) where 0 = H(u 0 ; u0 ; e0 ): But it is clear that the equations (), (), and (4) are linearly independent, and so H intersects the plane P at a line. It follows that the rst time the adversary submits an invalid ciphertext, the decryption oracle rejects with probability?=q. This rejection actually
12 constrains the point P, puncturing the plane H at a line. Therefore, for i = ; ; : : :, the ith invalid ciphertext submitted by the adversary will be rejected with probability at least? =(q? i + ). From this it follows that the decryption oracle rejects all invalid ciphertexts, except with negligible probability. Lemma When the simulator's input comes from R, the distribution of the hidden bit b is (essentially) independent from the adversary's view. Let u = g r and u = g wr. We may assume that r 6= r, since this occurs except with negligible probability. The lemma follows immediately from the following two claims. Claim. If the decryption oracle rejects all invalid ciphertexts during the attack, then the distribution of the hidden bit b is independent of the adversary's view. To see this, consider the point Q = (z ; z ) Z q. At the beginning of the attack, this is a random point on the line log h = z + wz ; (5) determined by the public key. Moreover, if the decryption oracle only decrypts valid ciphertexts (u 0 ; ; u0 ; v e0 0 ), then the adversary obtains only linearly dependent relations r 0 log h = r 0 z + r 0 wz (since (u 0 )z (u 0 )z = g z r0 g z r0 = h ). Thus, no further information about r0 Q is leaked. Consider now the output (u ; u ; e; v) of the simulator's encryption oracle. We have e = m b, where = u z uz. Now, consider the equation log = r z + wr z : (6) Clearly, (5) and (6) are linearly independent, and so the conditional distribution of conditioning on b and everything in the adversary's view other than e is uniform. In other words, is a perfect one-time pad. It follows that b is independent of the adversary's view. Claim. The decryption oracle will reject all invalid ciphertexts, except with negligible probability.
13 As in the proof of Lemma, we study the distribution of P = (x ; x ; y ; y ) Z 4 q, conditioned on the adversary's view. From the adversary's view, this is a random point on the line L formed by intersecting the hyperplanes (), (), and log v = r x + wr x + r y + wr y : (7) Equation (7) comes from the output of the encryption oracle. Now assume that the adversary submits an invalid ciphertext (u 0 ; ; u0 ; v e0 0 ) 6= (u ; u ; e; v), where log u 0 = r 0 and log u 0 = wr, 0 with r 0 6= r. 0 Let 0 = H(u 0 ; ; u0 ). e0 There are three cases we consider. Case. (u 0 ; ; u0 ) = (u e0 ; u ; e). In this case, the hash values are the same, but v 0 6= v implies that the decryption oracle will certainly reject. Case. (u 0 ; u0 ; e0 ) 6= (u ; u ; e) and 0 6=. The decryption oracle will reject unless the point P lies on the hyperplane H dened by (4). However, the equations (), (), (7), and (4) are linearly independent. This can be veried by observing that det 0 B@ w w r wr r wr r 0 wr 0 0 r 0 0 wr 0 CA = w (r? r )(r 0? r0 )(? 0 ) 6= 0: Thus, H intersects the line L at a point, from which it follows (as in the proof of Lemma ) that the decryption oracle rejects, except with negligible probability. Case 3. (u 0 ; ; u0 ) 6= (u e0 ; u ; e) and 0 =. We argue that if this happens with nonnegligible probability, then in fact, the family of hash functions is not universal one-way a contradiction. Note that if we made the stronger assumption of collision resistance, there would be essentially nothing to prove, but with the weaker universal one-way assumption, an argument is needed. We use the adversary to break the universal one-way hash function as follows. We modify the encryption oracle in the simulator, so that it outputs (u ; u ; e; v) as before, except that now, e G is simply chosen completely at random. Up until such time that a collision occurs, the adversary's view in this modied simulation is statistically indistinguishable from the view 3
14 in the original simulation, and so the adversary will also nd a collision with nonnegligible probability in the modied simulation. But the argument (u ; u ; e) to H is independent of H, and in particular, we can choose it before choosing H. 5 Implementation Details and Variations In this section, we briey discuss some implementation details and possible variations of the basic encryption scheme. 5. A simple implementation We choose a large prime p such that p? = q, where q is also prime. The group G is the subgroup of order q in Z p. We restrict a message to be an element of the set f; : : : ; qg, and \encode" it by squaring it modulo p, giving us an element in G. We can recover a message from its encoding by computing the unique square root of its encoding modulo p that is in the set f; : : : ; qg. For the hash function, one could use a function like SHA-, or possibly some keyed variant, and make the appropriate collision-resistance assumption. However, it is only marginally more expensive to do the following, which is based only on the hardness of discrete logarithms in G. Say we want to hash a bit string to an integer mod q. Write the bit string as a sequence (a ; : : : ; a k ), with each a i f0; : : : ; q? g. To dene the hash function, choose h ; : : : ; h k in G at random. The hash of (a ; : : : ; a k ) is then the Z p, where the sign is chosen so that this value is in f; : : : ; qg. This hash function is collision resistant, provided computing discrete logarithms in G is hard. To see this, note that from a collision, we obtain a nonzero sequence (a ; : : : ; a k ) mod q such that least non-negative residue of h a h a k k h a ha k k f;?g \ G = fg: Using a standard argument, it is easy to see that nding such a relation is equivalent to computing discrete logarithms. Note that the group elements g ; g and h ; : : : ; h k can be system-wide parameters, used by all users of the system. 4
15 5. A hybrid implementation It would be more practical to work in a smaller subgroup, and it would be nice to have a more exible and ecient way to encode messages. To do this, assume we have a symmetric-key cipher C with a key length of l bits. Now choose a large prime p such that p? = qm, where q is a 3l-bit prime. The group G is the subgroup of order q in Z p. A message in this scheme is just an arbitrary bit string. To encrypt a message m, we modify our encryption algorithm, computing e = C K (m), where the encryption key K is computed by hashing h r to an l-bit string with a public -universal hash function. For the hash function H used in the encryption scheme, something like SHA-, possibly keyed, would be appropriate. The security of this variant is easily proved using the techniques of this paper, along with the left-over hash lemma [5], assuming the cipher C is semantically secure. 5.3 A hash-free variant We can actually eliminate the hash function H from the scheme, so that the security can be based strictly on the Die-Hellman decision problem for an arbitrary group G. Suppose the strings we need to hash in the original scheme are of the form (a ; : : : ; a k ), where 0 a i < p. In the modied scheme, we replace the group element d in the public key by d ; : : : ; d k. For i k, we have d i = g y i gy i, where y i and y i are random elements of Z q included in the secret key. When encrypting, we compute v = c r and when decrypting, we verify that ky i= d a ir i ; v = u x +P k i= a iy i u x +P k i= a iy i : Using the same proof techniques as for the basic scheme, it is straightforward to prove that this modied version is secure against adaptive chosen ciphertext attack, assuming the Die-Hellman decision problem in G is hard. 5
16 5.4 A \lite" version secure against lunch-time attacks To achieve security against lunch-time attacks only, one can simplify the basic scheme signicantly, essentially by eliminating d, y, y, and the hash function H. When encrypting, we compute v = c r, and when decrypting, we verify that v = u x ux. Acknowledgments We would like to thank Moni Naor for his very useful comments on an earlier draft of this paper, and in particular, for pointing out that a universal oneway hash function is sucient to prove the security of our basic scheme, and for suggesting the hash-free variant in x5.3. References [] N. Asokan, V. Shoup, and M. Waidner. Optimistic fair exchange of digital signatures. In Advances in Cryptology{Eurocrypt '98, 998. [] M. Bellare, R. Canetti, and H. Krawczyk. A modular approach to the design and analysis of authentication and key exchange protocols. In 30th Annual ACM Symposium on Theory of Computing, 998. [3] M. Bellare and P. Rogaway. Random oracles are practical: a paradigm for designing ecient protocols. In First ACM Conference on Computer and Communications Security, pages 6{73, 993. [4] M. Bellare and P. Rogaway. Optimal asymmetric encryption. In Advances in Cryptology Crypto '94, pages 9{, 994. [5] M. Bellare and P. Rogaway. Collision-resistant hashing: towards making UOWHFs practical. In Advances in Cryptology{Crypto '97, 997. [6] D. Boneh and R. Venkatesan. Hardness of computing the most signicant bits of secret keys in Die-Hellman and related schemes. In Advances in Cryptology{Crypto '96, pages 9{4,
17 [7] R. Canetti, O. Goldreich, and S. Halevi. The random oracle model, revisted. In 30th Annual ACM Symposium on Theory of Computing, 998. To appear. [8] I. Damgard. Towards practical public key cryptosystems secure against chosen ciphertext attacks. In Advances in Cryptology{Crypto '9, pages 445{456, 99. [9] D. Dolev, C. Dwork, and M. Naor. Non-malleable cryptography. In 3rd Annual ACM Symposium on Theory of Computing, pages 54{55, 99. [0] D. Dolev, C. Dwork, and M. Naor. Non-malleable cryptography, 998. Manuscript (updated, full length version of STOC paper). [] C. Dwork and M. Naor. Method for message authentication from nonmalleable cryptosystems, 996. U. S. Patent No [] T. El Gamal. A public key cryptosystem and signature scheme based on discrete logarithms. IEEE Trans. Inform. Theory, 3:469{47, 985. [3] Y. Frankel and M. Yung. Cryptanalysis of immunized LL public key systems. In Advances in Cryptology{Crypto '95, pages 87{96, 995. [4] S. Goldwasser and S. Micali. Probabilistic encryption. Journal of Computer and System Sciences, 8:70{99, 984. [5] R. Impagliazzo, L. Levin, and M. Luby. Pseudo-random number generation from any one-way function. In st Annual ACM Symposium on Theory of Computing, pages {4, 989. [6] C. H. Lim and P. J. Lee. Another method for attaining security against adaptively chosen ciphertext attacks. In Advances in Cryptology{Crypto '93, pages 40{434, 993. [7] M. Naor and O. Reingold. Number-theoretic constructions of ecient pseudo-random functions. In 38th Annual Symposium on Foundations of Computer Science,
18 [8] M. Naor and M. Yung. Universal one-way hash functions and their cryptographic applications. In st Annual ACM Symposium on Theory of Computing, 989. [9] M. Naor and M. Yung. Public-key cryptosystems provably secure against chosen ciphertext attacks. In nd Annual ACM Symposium on Theory of Computing, pages 47{437, 990. [0] C. Racko and D. Simon. Noninteractive zero-knowledge proof of knowledge and chosen ciphertext attack. In Advances in Cryptology{Crypto '9, pages 433{444, 99. [] V. Shoup. Lower bounds for discrete logarithms and related problems. In Advances in Cryptology{Eurocrypt '97, 997. [] V. Shoup and R. Gennaro. Securing threshold cryptosystems against chosen ciphertext attack. In Advances in Cryptology{Eurocrypt '98, 998. [3] M. Stadler. Publicly veriable secrete sharing. In Advances in Cryptology{Eurocrypt '96, pages 90{99, 996. [4] Y. Zheng and J. Seberry. Practical approaches to attaining security against adaptively chosen ciphertext attacks. In Advances in Cryptology{Crypto '9, pages 9{304, 99. 8
A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack
A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack Ronald Cramer 1 Victor Shoup 2 1 Institute for Theoretical Computer Science, ETH Zurich, 8092 Zurich cramer~inf,
MTAT Research Seminar in Cryptography IND-CCA2 secure cryptosystems
MTAT.07.006 Research Seminar in Cryptography IND-CCA2 secure cryptosystems Dan Bogdanov October 31, 2005 Abstract Standard security assumptions (IND-CPA, IND- CCA) are explained. A number of cryptosystems
Lecture 14 Alvaro A. Cardenas Kavitha Swaminatha Nicholas Sze. 1 A Note on Adaptively-Secure NIZK. 2 The Random Oracle Model
CMSC 858K Advanced Topics in Cryptography March 11, 2004 Lecturer: Jonathan Katz Lecture 14 Scribe(s): Alvaro A. Cardenas Kavitha Swaminatha Nicholas Sze 1 A Note on Adaptively-Secure NIZK A close look
Securely Combining Public-Key Cryptosystems
Securely Combining Public-Key Cryptosystems Stuart Haber Benny Pinkas STAR Lab, Intertrust Tech. 821 Alexander Road Princeton, NJ 08540 {stuart,bpinkas}@intertrust.com Abstract It is a maxim of sound computer-security
IND-CCA2 secure cryptosystems, Dan Bogdanov
MTAT.07.006 Research Seminar in Cryptography IND-CCA2 secure cryptosystems Dan Bogdanov University of Tartu db@ut.ee 1 Overview Notion of indistinguishability The Cramer-Shoup cryptosystem Newer results
PSEC{3: Provably Secure Elliptic Curve. Encryption Scheme { V3. (Submission to P1363a)
PSEC{3: Provably Secure Elliptic Curve Encryption Scheme { V3 (Submission to P1363a) Tatsuaki Okamoto 1 and David Pointcheval 2 1 NTT Labs, 1-1 Hikarinooka, Yokosuka-shi 239-847 Japan. E-mail: okamoto@isl.ntt.co.jp.
CS408 Cryptography & Internet Security
CS408 Cryptography & Internet Security Lectures 16, 17: Security of RSA El Gamal Cryptosystem Announcement Final exam will be on May 11, 2015 between 11:30am 2:00pm in FMH 319 http://www.njit.edu/registrar/exams/finalexams.php
Secure Multiparty Computation
CS573 Data Privacy and Security Secure Multiparty Computation Problem and security definitions Li Xiong Outline Cryptographic primitives Symmetric Encryption Public Key Encryption Secure Multiparty Computation
New Public Key Cryptosystems Based on the Dependent RSA Problems
New Public Key Cryptosystems Based on the Dependent RSA Problems David Pointcheval LIENS CNRS, École Normale Supérieure, 45 rue d Ulm, 75230 Paris Cedex 05, France. David.Pointcheval@ens.fr http://www.dmi.ens.fr/
On the Diculty of Software Key Escrow. Abstract. At Eurocrypt'95, Desmedt suggested a scheme which allows individuals to encrypt
On the Diculty of Software Key Escrow Lars R. Knudsen Katholieke Universiteit Leuven Dept. Elektrotechniek-ESAT Kardinaal Mercierlaan 94 B-3001 Heverlee Torben P. Pedersen y Cryptomathic Arhus Science
RSA. Public Key CryptoSystem
RSA Public Key CryptoSystem DIFFIE AND HELLMAN (76) NEW DIRECTIONS IN CRYPTOGRAPHY Split the Bob s secret key K to two parts: K E, to be used for encrypting messages to Bob. K D, to be used for decrypting
CS 395T. Formal Model for Secure Key Exchange
CS 395T Formal Model for Secure Key Exchange Main Idea: Compositionality Protocols don t run in a vacuum Security protocols are typically used as building blocks in a larger secure system For example,
2 Secure Communication in Private Key Setting
CSA E0 235: Cryptography January 11, 2016 Instructor: Arpita Patra Scribe for Lecture 2 Submitted by: Jayam Modi 1 Discrete Probability Background Probability Distribution -A probability distribution over
ISA 562: Information Security, Theory and Practice. Lecture 1
ISA 562: Information Security, Theory and Practice Lecture 1 1 Encryption schemes 1.1 The semantics of an encryption scheme. A symmetric key encryption scheme allows two parties that share a secret key
CS573 Data Privacy and Security. Cryptographic Primitives and Secure Multiparty Computation. Li Xiong
CS573 Data Privacy and Security Cryptographic Primitives and Secure Multiparty Computation Li Xiong Outline Cryptographic primitives Symmetric Encryption Public Key Encryption Secure Multiparty Computation
Random Oracles - OAEP
Random Oracles - OAEP Anatoliy Gliberman, Dmitry Zontov, Patrick Nordahl September 23, 2004 Reading Overview There are two papers presented this week. The first paper, Random Oracles are Practical: A Paradigm
Brief Introduction to Provable Security
Brief Introduction to Provable Security Michel Abdalla Département d Informatique, École normale supérieure michel.abdalla@ens.fr http://www.di.ens.fr/users/mabdalla 1 Introduction The primary goal of
Formal Methods and Cryptography
Formal Methods and Cryptography Michael Backes 1, Birgit Pfitzmann 2, and Michael Waidner 3 1 Saarland University, Saarbrücken, Germany, backes@cs.uni-sb.de 2 IBM Research, Rueschlikon, Switzerland, bpf@zurich.ibm.com
1 A Tale of Two Lovers
CS 120/ E-177: Introduction to Cryptography Salil Vadhan and Alon Rosen Dec. 12, 2006 Lecture Notes 19 (expanded): Secure Two-Party Computation Recommended Reading. Goldreich Volume II 7.2.2, 7.3.2, 7.3.3.
Part VI. Public-key cryptography
Part VI Public-key cryptography Drawbacks with symmetric-key cryptography Symmetric-key cryptography: Communicating parties a priori share some secret information. Secure Channel Alice Unsecured Channel
Attribute-based encryption with encryption and decryption outsourcing
Edith Cowan University Research Online Australian Information Security Management Conference Conferences, Symposia and Campus Events 2014 Attribute-based encryption with encryption and decryption outsourcing
Lecture 18 - Chosen Ciphertext Security
Lecture 18 - Chosen Ciphertext Security Boaz Barak November 21, 2005 Public key encryption We now go back to public key encryption. As we saw in the case of private key encryption, CPA security is not
Digital Signatures. KG November 3, Introduction 1. 2 Digital Signatures 2
Digital Signatures KG November 3, 2017 Contents 1 Introduction 1 2 Digital Signatures 2 3 Hash Functions 3 3.1 Attacks.................................... 4 3.2 Compression Functions............................
Proofs for Key Establishment Protocols
Information Security Institute Queensland University of Technology December 2007 Outline Key Establishment 1 Key Establishment 2 3 4 Purpose of key establishment Two or more networked parties wish to establish
Cryptographic Hash Functions
ECE458 Winter 2013 Cryptographic Hash Functions Dan Boneh (Mods by Vijay Ganesh) Previous Lectures: What we have covered so far in cryptography! One-time Pad! Definition of perfect security! Block and
Introduction to Cryptography Lecture 7
Introduction to Cryptography Lecture 7 Public-Key Encryption: El-Gamal, RSA Benny Pinkas page 1 1 Public key encryption Alice publishes a public key PK Alice. Alice has a secret key SK Alice. Anyone knowing
2 What does it mean that a crypto system is secure?
Cryptography Written by: Marius Zimand Notes: On the notion of security 1 The One-time Pad cryptosystem The one-time pad cryptosystem was introduced by Vernam and Mauborgne in 1919 (for more details about
Improved Efficiency for CCA-Secure Cryptosystems Built Using Identity-Based Encryption
Improved Efficiency for CCA-Secure Cryptosystems Built Using Identity-Based Encryption Dan Boneh 1 and Jonathan Katz 2 1 Computer Science Department, Stanford University, Stanford CA 94305 dabo@cs.stanford.edu
Imperfect Decryption and an Attack on the NTRU Encryption Scheme
Imperfect Decryption and an Attack on the NTRU Encryption Scheme John A. Proos University of Waterloo, Waterloo, Canada japroos@math.uwaterloo.ca January 7, 2003 Abstract A property of the NTRU public-key
2 Handout 20: Midterm Quiz Solutions Problem Q-1. On-Line Gambling In class, we discussed a fair coin ipping protocol (see lecture 11). In it, Alice a
Massachusetts Institute of Technology Handout 20 6.857: Network and Computer Security November 18, 1997 Professor Ronald L. Rivest Midterm Quiz Solutions PLEASE READ ALL THE INSTRUCTIONS These are the
A public key encryption scheme secure against key dependent chosen plaintext and adaptive chosen ciphertext attacks
A public key encryption scheme secure against key dependent chosen plaintext and adaptive chosen ciphertext attacks Jan Camenisch 1, Nishanth Chandran 2, and Victor Shoup 3 1 IBM Research, work funded
The most important development from the work on public-key cryptography is the digital signature. Message authentication protects two parties who
1 The most important development from the work on public-key cryptography is the digital signature. Message authentication protects two parties who exchange messages from any third party. However, it does
CSC 5930/9010 Modern Cryptography: Digital Signatures
CSC 5930/9010 Modern Cryptography: Digital Signatures Professor Henry Carter Fall 2018 Recap Implemented public key schemes in practice commonly encapsulate a symmetric key for the rest of encryption KEM/DEM
Verifiably Encrypted Signature Scheme with Threshold Adjudication
Verifiably Encrypted Signature Scheme with Threshold Adjudication M. Choudary Gorantla and Ashutosh Saxena Institute for Development and Research in Banking Technology Road No. 1, Castle Hills, Masab Tank,
This chapter continues our overview of public-key cryptography systems (PKCSs), and begins with a description of one of the earliest and simplest
1 2 3 This chapter continues our overview of public-key cryptography systems (PKCSs), and begins with a description of one of the earliest and simplest PKCS, Diffie- Hellman key exchange. This first published
CSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong, Spring and 6 February 2018
CSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong, Spring 2018 5 and 6 February 2018 Identification schemes are mechanisms for Alice to prove her identity to Bob They comprise a setup
Efficient Re-Keyed Encryption Schemes for Secure Communications
I J E E E C International Journal of Electrical, Electronics ISSN No. (Online): 2277-2626 and Computer Engineering 3(2): 132-137(2014) Efficient Re-Keyed Encryption Schemes for Secure Communications Md
Introduction to Cryptography Lecture 7
Introduction to Cryptography Lecture 7 El Gamal Encryption RSA Encryption Benny Pinkas page 1 1 Public key encryption Alice publishes a public key PK Alice. Alice has a secret key SK Alice. Anyone knowing
What Can Be Proved About Security?
What Can Be Proved About Security? Palash Sarkar Applied Statistics Unit Indian Statistical Institute, Kolkata India palash@isical.ac.in Centre for Artificial Intelligence and Robotics Bengaluru 23 rd
Definitions and Notations
Chapter 2 Definitions and Notations In this chapter, we present definitions and notation. We start with the definition of public key encryption schemes and their security models. This forms the basis of
On the Strength of the Concatenated Hash Combiner when All the Hash Functions are Weak
On the Strength of the Concatenated Hash Combiner when All the Hash Functions are Weak Jonathan J. Hoch and Adi Shamir Department of Computer Science and Applied Mathematics, The Weizmann Institute of
Parallel Coin-Tossing and Constant-Round Secure Two-Party Computation
Parallel Coin-Tossing and Constant-Round Secure Two-Party Computation Yehuda Lindell Department of Computer Science and Applied Math, Weizmann Institute of Science, Rehovot, Israel. lindell@wisdom.weizmann.ac.il
A Proposal for an ISO Standard for Public Key Encryption
A Proposal for an ISO Standard for Public Key Encryption Victor Shoup IBM Zurich Research Lab, Säumerstr. 4, 8803 Rüschlikon, Switzerland sho@zurich.ibm.com February 13, 2001 Abstract This document should
Introduction. CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell
Introduction CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell 1 Cryptography Merriam-Webster Online Dictionary: 1. secret writing 2. the enciphering and deciphering
ASYMMETRIC (PUBLIC-KEY) ENCRYPTION. Mihir Bellare UCSD 1
ASYMMETRIC (PUBLIC-KEY) ENCRYPTION Mihir Bellare UCSD 1 Recommended Book Steven Levy. Crypto. Penguin books. 2001. A non-technical account of the history of public-key cryptography and the colorful characters
symmetric cryptography s642 computer security adam everspaugh
symmetric cryptography s642 adam everspaugh ace@cs.wisc.edu computer security Announcement Midterm next week: Monday, March 7 (in-class) Midterm Review session Friday: March 4 (here, normal class time)
Immunizing Encryption Schemes from Decryption Errors
Immunizing Encryption Schemes from Decryption Errors Cynthia Dwork 1, Moni Naor 2, and Omer Reingold 2 1 Microsoft Research, SVC 1065 L Avenida Mountain View, CA 94043 dwork@microsoft.com 2 Weizmann Institute
Provable Partial Key Escrow
Provable Partial Key Escrow Kooshiar Azimian Electronic Research Center, Sharif University of Technology, and Computer Engineering Department, Sharif University of Technology Tehran, Iran Email: Azimian@ce.sharif.edu
Lecture 22 - Oblivious Transfer (OT) and Private Information Retrieval (PIR)
Lecture 22 - Oblivious Transfer (OT) and Private Information Retrieval (PIR) Boaz Barak December 8, 2005 Oblivious Transfer We are thinking of the following situation: we have a server and a client (or
Cryptanalyzing the Polynomial Reconstruction based Public-Key System under Optimal Parameter Choice
Cryptanalyzing the Polynomial Reconstruction based Public-Key System under Optimal Parameter Choice Aggelos Kiayias - Moti Yung U. of Connecticut - Columbia U. (Public-Key) Cryptography intractability
ASYMMETRIC (PUBLIC-KEY) ENCRYPTION. Mihir Bellare UCSD 1
ASYMMETRIC (PUBLIC-KEY) ENCRYPTION Mihir Bellare UCSD 1 Recommended Book Steven Levy. Crypto. Penguin books. 2001. A non-technical account of the history of public-key cryptography and the colorful characters
Threshold Cryptosystems Secure against Chosen-Ciphertext Attacks
Threshold Cryptosystems Secure against Chosen-Ciphertext Attacks Pierre-Alain Fouque, David Pointcheval To cite this version: Pierre-Alain Fouque, David Pointcheval. Threshold Cryptosystems Secure against
COMP4109 : Applied Cryptography
COMP4109 : Applied Cryptography Fall 2013 M. Jason Hinek Carleton University Applied Cryptography Day 2 information security cryptographic primitives unkeyed primitives NSA... one-way functions hash functions
Relaxing IND-CCA: Indistinguishability Against Chosen. Chosen Ciphertext Verification Attack
Relaxing IND-CCA: Indistinguishability Against Chosen Ciphertext Verification Attack Indian Statistical Institute Kolkata January 14, 2012 Outline 1 Definitions Encryption Scheme IND-CPA IND-CCA IND-CCVA
1 Achieving IND-CPA security
ISA 562: Information Security, Theory and Practice Lecture 2 1 Achieving IND-CPA security 1.1 Pseudorandom numbers, and stateful encryption As we saw last time, the OTP is perfectly secure, but it forces
Secure Multiparty Computation
Secure Multiparty Computation Li Xiong CS573 Data Privacy and Security Outline Secure multiparty computation Problem and security definitions Basic cryptographic tools and general constructions Yao s Millionnare
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Michael J. Fischer Lecture 4 September 11, 2017 CPSC 467, Lecture 4 1/23 Analyzing Confidentiality of Cryptosystems Secret ballot elections Information protection Adversaries
From semantic security to chosen ciphertext security
Graduate Theses and Dissertations Graduate College 2010 From semantic security to chosen ciphertext security Sahnghyun Cha Iowa State University Follow this and additional works at: http://lib.dr.iastate.edu/etd
Improvement of Camenisch-Neven-Shelat Oblivious Transfer Scheme
Improvement of Camenisch-Neven-Shelat Oblivious Transfer Scheme Zhengjun Cao and Hanyue Cao Department of Mathematics, Shanghai University, Shanghai, China caozhj@shu.edu.cn Abstract. In 2007, Camenisch,
Introduction to Cryptography and Security Mechanisms: Unit 5. Public-Key Encryption
Introduction to Cryptography and Security Mechanisms: Unit 5 Public-Key Encryption Learning Outcomes Explain the basic principles behind public-key cryptography Recognise the fundamental problems that
Distributed ID-based Signature Using Tamper-Resistant Module
, pp.13-18 http://dx.doi.org/10.14257/astl.2013.29.03 Distributed ID-based Signature Using Tamper-Resistant Module Shinsaku Kiyomoto, Tsukasa Ishiguro, and Yutaka Miyake KDDI R & D Laboratories Inc., 2-1-15,
Symmetric-Key Cryptography Part 1. Tom Shrimpton Portland State University
Symmetric-Key Cryptography Part 1 Tom Shrimpton Portland State University Building a privacy-providing primitive I want my communication with Bob to be private -- Alice What kind of communication? SMS?
Cryptography: More Primitives
Design and Analysis of Algorithms May 8, 2015 Massachusetts Institute of Technology 6.046J/18.410J Profs. Erik Demaine, Srini Devadas and Nancy Lynch Recitation 11 Cryptography: More Primitives 1 Digital
Applied Cryptography and Computer Security CSE 664 Spring 2018
Applied Cryptography and Computer Security Lecture 13: Public-Key Cryptography and RSA Department of Computer Science and Engineering University at Buffalo 1 Public-Key Cryptography What we already know
CSC 5930/9010 Modern Cryptography: Public Key Cryptography
CSC 5930/9010 Modern Cryptography: Public Key Cryptography Professor Henry Carter Fall 2018 Recap Number theory provides useful tools for manipulating integers and primes modulo a large value Abstract
Computer Security CS 526
Computer Security CS 526 Topic 4 Cryptography: Semantic Security, Block Ciphers and Encryption Modes CS555 Topic 4 1 Readings for This Lecture Required reading from wikipedia Block Cipher Ciphertext Indistinguishability
Other Systems Using Timing Attacks. Paul C. Kocher? EXTENDED ABSTRACT (7 December 1995)
Cryptanalysis of Die-Hellman, RSA, DSS, and Other Systems Using Timing Attacks Paul C. Kocher? EXTENDED ABSTRACT (7 December 1995) Since many existing security systems can be broken with timing attacks,
Introduction to Cryptography. Lecture 6
Introduction to Cryptography Lecture 6 Benny Pinkas page 1 1 Data Integrity, Message Authentication Risk: an active adversary might change messages exchanged between Alice and Bob M Alice M M M Bob Eve
RSA (Rivest Shamir Adleman) public key cryptosystem: Key generation: Pick two large prime Ô Õ ¾ numbers È.
RSA (Rivest Shamir Adleman) public key cryptosystem: Key generation: Pick two large prime Ô Õ ¾ numbers È. Let Ò Ô Õ. Pick ¾ ½ ³ Òµ ½ so, that ³ Òµµ ½. Let ½ ÑÓ ³ Òµµ. Public key: Ò µ. Secret key Ò µ.
1. Diffie-Hellman Key Exchange
e-pgpathshala Subject : Computer Science Paper: Cryptography and Network Security Module: Diffie-Hellman Key Exchange Module No: CS/CNS/26 Quadrant 1 e-text Cryptography and Network Security Objectives
Research Statement. Yehuda Lindell. Dept. of Computer Science Bar-Ilan University, Israel.
Research Statement Yehuda Lindell Dept. of Computer Science Bar-Ilan University, Israel. lindell@cs.biu.ac.il www.cs.biu.ac.il/ lindell July 11, 2005 The main focus of my research is the theoretical foundations
Lecture 19 - Oblivious Transfer (OT) and Private Information Retrieval (PIR)
Lecture 19 - Oblivious Transfer (OT) and Private Information Retrieval (PIR) Boaz Barak November 29, 2007 Oblivious Transfer We are thinking of the following situation: we have a server and a client (or
On the Security of a Certificateless Public-Key Encryption
On the Security of a Certificateless Public-Key Encryption Zhenfeng Zhang, Dengguo Feng State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences, Beijing 100080,
6 Pseudorandom Functions
6 Pseudorandom Functions A pseudorandom generator allows us to take a small amount of uniformly sampled bits, and amplify them into a larger amount of uniform-looking bits A PRG must run in polynomial
T Cryptography and Data Security
T-79.4501 Cryptography and Data Security Lecture 10: 10.1 Random number generation 10.2 Key management - Distribution of symmetric keys - Management of public keys Stallings: Ch 7.4; 7.3; 10.1 1 The Use
Authentication, Enhanced Security and Error Correcting Codes. (Extended Abstract) Yonatan Aumann t and Michael O. Rabin 2
Authentication, Enhanced Security and Error Correcting Codes (Extended Abstract) Yonatan Aumann t and Michael O. Rabin 2 1 Department of Mathematics and Computer Science, Bar Ilan University, Ramat-Gan,
Some Stuff About Crypto
Some Stuff About Crypto Adrian Frith Laboratory of Foundational Aspects of Computer Science Department of Mathematics and Applied Mathematics University of Cape Town This work is licensed under a Creative
Source Anonymous Message Authentication and Source Privacy using ECC in Wireless Sensor Network
Source Anonymous Message Authentication and Source Privacy using ECC in Wireless Sensor Network 1 Ms.Anisha Viswan, 2 Ms.T.Poongodi, 3 Ms.Ranjima P, 4 Ms.Minimol Mathew 1,3,4 PG Scholar, 2 Assistant Professor,
Introduction to Security Reduction
springer.com Computer Science : Data Structures, Cryptology and Information Theory Springer 1st edition Printed book Hardcover Printed book Hardcover ISBN 978-3-319-93048-0 Ca. $ 109,00 Planned Discount
Efficient chosen ciphertext secure PKE scheme with short ciphertext
Efficient chosen ciphertext secure PKE scheme with short ciphertext Xianhui Lu 1, Xuejia Lai 2, Dake He 1, Guomin Li 1 Email:lu xianhui@gmail.com 1:School of Information Science & Technology, SWJTU, Chengdu,
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 7 January 30, 2012 CPSC 467b, Lecture 7 1/44 Public-key cryptography RSA Factoring Assumption Computing with Big Numbers Fast Exponentiation
SIGNCRYPTION WITH NON-INTERACTIVE NON-REPUDIATION
SIGNCRYPTION WITH NONINTERACTIVE NONREPUDIATION JOHN MALONELEE ABSTRACT Signcryption [35] is a public key primitive that achieves the functionality of both an encryption scheme and a signature scheme simultaneously
Provably Secure Public-Key Encryption for Length-Preserving Chaumian Mixes
Technical Report TI-5/02 (9th August 2002) TU Darmstadt, Fachbereich Informatik Provably Secure Public-Key Encryption for Length-Preserving Chaumian Mixes Bodo Möller Technische Universität Darmstadt,
Modelling the Security of Key Exchange
Modelling the Security of Key Exchange Colin Boyd including joint work with Janaka Alawatugoda, Juan Gonzalez Nieto Department of Telematics, NTNU Workshop on Tools and Techniques for Security Analysis
1 Defining Message authentication
ISA 562: Information Security, Theory and Practice Lecture 3 1 Defining Message authentication 1.1 Defining MAC schemes In the last lecture we saw that, even if our data is encrypted, a clever adversary
Ecient Broadcast Time-Stamping (Extended Abstract) Abstract Even using an authenticated synchronous broadcast model, the task of unforgeably time-stam
Ecient Broadcast Time-Stamping (Extended Abstract) Josh Benaloh Clarkson University Michael de Mare Clarkson University April 21, 1992 Ecient Broadcast Time-Stamping (Extended Abstract) Abstract Even using
Lecture 6: ZK Continued and Proofs of Knowledge
600.641 Special Topics in Theoretical Cryptography 02/06/06 Lecture 6: ZK Continued and Proofs of Knowledge Instructor: Susan Hohenberger Scribe: Kevin Snow 1 Review / Clarification At the end of last
REMOVE KEY ESCROW FROM THE IDENTITY-BASED ENCRYPTION SYSTEM
REMOVE KEY ESCROW FROM THE IDENTITY-BASED ENCRYPTION SYSTEM Zhaohui Cheng, Richard Comley Luminita Vasiu School of Computing Science, Middlesex University White Hart Lane, London N17 8HR, United Kingdom
A Designer s Guide to KEMs. Errata List
A Designer s Guide to KEMs Alexander W. Dent Information Security Group, Royal Holloway, University of London, Egham Hill, Egham, Surrey, U.K. alex@fermat.ma.rhul.ac.uk http://www.isg.rhul.ac.uk/~alex/
Entity Authentication. Surrey, TW20 0EX, United Kingdom. asymmetric (public-key) techniques to solve two problems: entity
Entity Authentication and Authenticated Key Transport Protocols Employing Asymmetric Techniques? (August 28 1997) Simon Blake-Wilson 1?? and Alfred Menezes 2 1 Dept. of Mathematics, Royal Holloway, University
Homework 3: Solution
Homework 3: Solution March 28, 2013 Thanks to Sachin Vasant and Xianrui Meng for contributing their solutions. Exercise 1 We construct an adversary A + that does the following to win the CPA game: 1. Select
Plaintext Awareness via Key Registration
Plaintext Awareness via Key egistration Jonathan Herzog, Moses Liskov, and Silvio Micali MIT Laboratory for Computer Science Abstract. In this paper, we reconsider the notion of plaintext awareness. We
q are the private key. Their product, pq = n, is the public key. As we know, the diculty tond the private key from the public key is due to the dicult
LECTURE NOTES ON PART II OF INTRODUCTION TO CRYPTOGRAPHY COURSE: COT6421, SPRING 1998 INSTRUCTOR: DR. RAKESH SINHA PRESENTER: KONSTANTIN BEZNOSOV 1. Probabilistic Encryption 1 The notion of probabilistic
RSA (Rivest Shamir Adleman) public key cryptosystem: Key generation: Pick two large prime Ô Õ ¾ numbers È.
RSA (Rivest Shamir Adleman) public key cryptosystem: Key generation: Pick two large prime Ô Õ ¾ numbers È. Let Ò Ô Õ. Pick ¾ ½ ³ Òµ ½ so, that ³ Òµµ ½. Let ½ ÑÓ ³ Òµµ. Public key: Ò µ. Secret key Ò µ.
Information Security CS526
Information CS 526 Topic 3 Ciphers and Cipher : Stream Ciphers, Block Ciphers, Perfect Secrecy, and IND-CPA 1 Announcements HW1 is out, due on Sept 10 Start early, late policy is 3 total late days for
Lecture 8. 1 Some More Security Definitions for Encryption Schemes
U.C. Berkeley CS276: Cryptography Lecture 8 Professor David Wagner February 9, 2006 Lecture 8 1 Some More Security Definitions for Encryption Schemes 1.1 Real-or-random (rr) security Real-or-random security,
An Uninstantiable Random-Oracle-Model Scheme for a Hybrid-Encryption Problem
An Uninstantiable Random-Oracle-Model Scheme for a Hybrid-Encryption Problem Mihir Bellare, Alexandra Boldyreva and Adriana Palacio Dept. of Computer Science & Engineering, University of California, San
Related-key Attacks on Triple-DES and DESX Variants
Related-key Attacks on Triple-DES and DESX Variants Raphael C.-W. han Department of Engineering, Swinburne Sarawak Institute of Technology, 1st Floor, State Complex, 93576 Kuching, Malaysia rphan@swinburne.edu.my
Paper presentation sign up sheet is up. Please sign up for papers by next class. Lecture summaries and notes now up on course webpage
1 Announcements Paper presentation sign up sheet is up. Please sign up for papers by next class. Lecture summaries and notes now up on course webpage 2 Recap and Overview Previous lecture: Symmetric key
T Cryptography and Data Security
T-79.159 Cryptography and Data Security Lecture 10: 10.1 Random number generation 10.2 Key management - Distribution of symmetric keys - Management of public keys Kaufman et al: Ch 11.6; 9.7-9; Stallings: