Order-Revealing Encryption:
|
|
|
- Jack McCoy
- 5 years ago
- Views:
Transcription
1 Order-Revealing Encryption: How to Search on Encrypted Data Kevin Lewi and David J. Wu Stanford University
2 Searching on Encrypted Data The information accessed from potentially exposed accounts "may have included names, addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers "
3 Searching on Encrypted Data The database was discovered by MacKeeper researcher Chris Vickery on March 31, in the course of searching for random phrases on the domain s3.amazonaws.com. It's as bad as I expected, he tweeted. Bank-related. Plaintext passwords. Big name company. I've reached out to them.
4 Searching on Encrypted Data
5 Searching on Encrypted Data
6 Searching on Encrypted Data
7 Searching on Encrypted Data
8 Searching on Encrypted Data data breaches have become the norm rather than the exception
9 Why Not Encrypt? data breaches have become the norm rather than the exception
10 Why Not Encrypt? because it would have hurt Yahoo s ability to index and search messages to provide new user services ~Jeff Bonforte (Yahoo SVP)
11 Searching on Encrypted Data sk database ID Name Age Diagnosis 0 Alice Bob Charlie Inigo 45 4 client client holds a secret key (needed to encrypt + query the server) server stores encrypted database server
12 Security for Encrypted Search active adversary adversary sees encrypted database + queries and can interact with the database online attacks (e.g., active corruption) offline attacks (e.g., passive snapshots) snapshot adversary only sees contents of encrypted database adversary
13 Security for Encrypted Search adversary sees encrypted database + queries and can interact with the database online attacks (e.g., active corruption) offline attacks (e.g., passive snapshots) adversary only sees contents of encrypted database typical database breach: contents of database are stolen and dumped onto the web
14 client server Order-Revealing Encryption [BLRSZZ 15] secret-key encryption scheme Which is greater: the value encrypted by ct 1 or the value encrypted by ct 2? sk ct 1 = Enc(sk, 123) ct 2 = Enc(sk, 512) ct 3 = Enc(sk, 273) (legacy-friendly) range queries on encrypted data
15 Order-Revealing Encryption [BLRSZZ 15] given any two ciphertexts ct 1 = Enc(sk, x) ct 2 = Enc(sk, y) there is a public function for performing comparisons x > y OPE [BCLO 09]: comparison function is numeric comparison on ciphertexts
16 Order-Revealing Encryption [BLRSZZ 15] given any two ciphertexts ct 1 = Enc(sk, x) ct 2 = Enc(sk, y) best-possible security: reveal just the ordering and nothing more x > y in practice: constructions reveal some additional information
17 Inference Attacks [NKW 15, DDC 16, GSBNR 16] ID Name Age Diagnosis wpjoos 2wzXW8 SqX9l9 KqLUXE XdXdg8 y9gfps gwile3 MJ23b7 P6vKhW EgN0Jn S0pRJe ataejk orjre6 KQWy9U tpwf3m 4FBEO0 encrypted database + public information frequency and statistical analysis ID Name Age Diagnosis??? Alice ??? Bob ??? Charlie ?????? plaintext recovery
18 Inference Attacks [NKW 15, DDC 16, GSBNR 16] PPE schemes always reveal certain properties (e.g., equality, order) on ciphertexts and thus, are vulnerable to offline inference attacks Can we fully defend against offline inference attacks while remaining legacy-friendly?
19 This Work Can we fully defend against offline inference attacks while remaining legacy-friendly? Trivial solution: encrypt the entire database, and have client provide decryption key at query time Desiderata: an ORE scheme that enables: perfect offline security limited leakage in the online setting But zero online security!
20 ORE with Additional Structure Focus of this work: performing range queries on encrypted data Key primitive: order-revealing encryption scheme where ciphertexts have a decomposable structure Enc 101 Enc L 101 Enc R 100 ct L ct R ct L ct R ciphertexts naturally split into two components greater than
21 ORE with Additional Structure Enc L 101 Enc R 100 ct L ct R right ciphertexts provide semantic security! comparison can be performed between left ciphertext and right ciphertext robustness against offline inference attacks!
22 Encrypted Range Queries store right ciphertexts in sorted order ID Name Age Diagnosis 0 Alice Bob Charlie Inigo 45 4 Age Enc R (31) Enc R (41) Enc R (45) Enc R (47) build encrypted index ID Enc(0) Enc(2) Enc(3) Enc(1) record IDs encrypted under independent key Name Enc R (Alice) Enc R (Bob) Enc R (31) Enc R (Charlie) Enc R (41) Enc R (Inigo) Enc R (45) ID Enc(0) Age ID Enc(1) Enc(0) Diagnosis Enc(2) ID Enc(2) Enc R (2) Enc(3) Enc(2) Enc(3) Enc R (2) Enc(0) Enc(1) Enc R (3) Enc(1) Enc R (47) Enc R (4) Enc(3) separate index for each searchable column, and using independent ORE keys
23 Encrypted Range Queries Encrypted database: ID Name Age Diagnosis 0 Alice Bob Charlie Inigo 45 4 columns (other than ID) are encrypted using a semanticallysecure encryption scheme clients hold (secret) keys needed to decrypt and query database Name ID Enc R (Alice) Enc R (Bob) Enc R (31) Enc R (Charlie) Enc R (41) Enc R (Inigo) Enc R (45) Enc(0) Age ID Enc(1) Enc(0) Diagnosis Enc(2) ID Enc(2) Enc R (2) Enc(3) Enc(2) Enc(3) Enc R (2) Enc(0) Enc(1) Enc R (3) Enc(1) Enc R (47) Enc R (4) Enc(3) encrypted search indices
24 Encrypted Range Queries Query for all records where 40 age 45: sk Enc L (40) Enc L (45)
25 Encrypted Range Queries Query for all records where 40 age 45: Enc L (40) Enc L (45) Age Enc R (31) Enc R (41) Enc R (45) Enc R (47) ID Enc(0) Enc(2) Enc(3) Enc(1)
26 Encrypted Range Queries Query for all records where 40 age 45: Enc L (40) Enc L (45) Age Enc R (31) Enc R (41) Enc R (45) Enc R (47) ID Enc(0) Enc(2) Enc(3) Enc(1) use binary search to determine endpoints (comparison via ORE)
27 Encrypted Range Queries Query for all records where 40 age 45: Enc L (40) Enc L (45) Age Enc R (31) Enc R (41) Enc R (45) Enc R (47) ID Enc(0) Enc(2) Enc(3) Enc(1) use binary search to determine endpoints (comparison via ORE)
28 Encrypted Range Queries Query for all records where 40 age 45: Age ID Enc L (40) Enc L (45) Enc R (31) Enc R (41) Enc R (45) Enc R (47) Enc(0) Enc(2) Enc(3) Enc(1) return encrypted indices that match query use binary search to determine endpoints (comparison via ORE)
29 Encrypted Range Queries Query for all records where 40 age 45: sk Enc(2) Enc(3) client decrypts indices to obtain set of matching records
30 Encrypted Range Queries Query for all records where 40 age 45: sk Enc(2) Enc(3) Records 2, 3 Enc(r 2 ) Enc(r 3 )
31 Encrypted Range Queries Query for all records where 40 age 45: sk Enc(2) Enc(3) Records 2, 3 Enc(r 2 ) Enc(r 3 ) client decrypts to obtain records
32 Encrypted Range Queries Query for all records where 40 age 45: sk Enc(2) Enc(3) Records 2, 3 Enc(r 2 ) Enc(r 3 ) some online leakage: access pattern + ORE leakage
33 Encrypted Range Queries Encrypted database (view of the snapshot adversary): ID Name Age Diagnosis 0 Alice Bob Charlie Inigo 45 4 encrypted database is semantically secure! Perfect offline security Name ID Enc R (Alice) Enc R (Bob) Enc R (31) Enc R (Charlie) Enc R (41) Enc R (Inigo) Enc R (45) Enc(0) Age ID Enc(1) Enc(0) Diagnosis Enc(2) ID Enc(2) Enc R (2) Enc(3) Enc(2) Enc(3) Enc R (2) Enc(0) Enc(1) Enc R (3) Enc(1) Enc R (47) Enc R (4) Enc(3) encrypted search indices
34 Our New ORE Scheme small-domain ORE with best-possible security domain extension technique inspired by CLWW 16 large-domain ORE with some leakage first practical ORE construction that can provide best-possible offline security!
35 Small-Domain ORE with Best-Possible Security Suppose plaintext space is small: 1,2,, N 1 k 1 associate a key with each value 2 3 k 2 k 3 k 1,, k N is the secret key (can be derived from a PRF) N k N
36 Small-Domain ORE with Best-Possible Security Encrypting a value i Position i Invariant: all positions i have value 1 while all positions > i have value 0
37 Small-Domain ORE with Best-Possible Security Encrypting a value i k 1 k 2 k i k i+1 k N encrypt each slot with key for that slot To allow comparisons, also give out key for slot i k i k 1 k 2 k i k i+1 k N
38 Small-Domain ORE with Best-Possible Security Given two ciphertexts k i k 1 k i k i+1 k j k N 0 Decrypt to learn ordering k j k 1 k i k j k j+1 k N 0
39 Small-Domain ORE with Best-Possible Security Given two ciphertexts k i k 1 k i k i+1 k j k N But this reveals i 0 k j k 1 k i k j k j+1 k N 0
40 Small-Domain ORE with Best-Possible Security Solution: apply random permutation π (part of the secret key) to the slots k i k 1 k 2 k i k i+1 k N
41 Small-Domain ORE with Best-Possible Security Solution: apply random permutation π (part of the secret key) to the slots k π(i) k π(1) k π 2 k π(i) k π i+1 k π(n) includes index π(i) semantically secure (right ciphertext) Achieves best-possible security, but ciphertexts are big
42 Domain Extension for ORE Key idea: decompose message into smaller blocks and apply small-domain ORE to each block split into two 4-bit chunks b 1 b 2 b 3 b 4 b 5 b 6 b 7 b 8 k π(i) k π(1) k π 2 k π(i) k π i+1 k π(n) k π i k π k π 2 k π j k π j+1 k π N encrypt each chunk using an ORE instance with a secret key derived from the prefix
43 Domain Extension for ORE Key idea: decompose message into smaller blocks and apply small-domain ORE to each block split into two 4-bit chunks b 1 b 2 b 3 b 4 Keys b 5 derived b 6 bfrom 7 b 8 Keys derived from empty prefix k π(i) k π(1) k π 2 k π(i) k π i+1 k π(n) prefix b 1 b 2 b 3 b 4 k π i k π k π 2 k π j k π j+1 k π N encrypt each chunk using an ORE instance with a secret key derived from the prefix
44 Domain Extension for ORE b 1 b 2 b 3 b 4 b 5 b 6 b 7 b 8 k π(i) k π(1) k π 2 k π(i) k π i+1 k π(n) k π i k π k π 2 k π j k π j+1 k π N comparison proceeds block-by-block k π(i) k π(1) k π 2 k π(i) k π i+1 k π(n) k π i k π k π 2 k π j k π j+1 k π N Overall leakage: first block that differs
45 Domain Extension for ORE Same decomposition into left and right ciphertexts: k π(i) k π(1) k π 2 k π(i) k π i+1 k π(n) k π i k π k π 2 k π j k π j+1 k π N left ciphertext right ciphertext Right ciphertexts provide semantic security! Note: optimizations are possible if we apply this technique in a non-black-box way to the smalldomain ORE. See paper for details.
46 Performance Evaluation Scheme Encrypt (μs) Compare (μs) ct (bytes) OPE [BCLO 09] Practical ORE [CLWW 16] This work (4-bit blocks) This work (8-bit blocks) This work (12-bit blocks) Benchmarks taken for C implementation of different schemes (with AES-NI). Measurements for encrypting 32-bit integers.
47 Performance Evaluation Scheme Encrypt (μs) Compare (μs) ct (bytes) OPE [BCLO 09] Practical ORE [CLWW 16] This work (4-bit blocks) This work (8-bit blocks) This work (12-bit blocks) Encrypting byte-size blocks is 65x faster than OPE, but ciphertexts are 30x longer. Security is substantially better.
48 Conclusions Inference attacks render most conventional PPE-based constructions insecure However, ORE is still a useful building block for encrypted databases Introduced new paradigm for constructing ORE that enables range queries in a way that is mostly legacy-compatible and provides offline semantic security New ORE construction that is concretely efficient with strong security
49 Questions? Paper: Website: Code:
Order-Revealing Encryption:
Order-Revealing Encryption: How to Search on Encrypted Data Kevin Lewi and David J. Wu Stanford University Searching on Encrypted Data Searching on Encrypted Data Searching on Encrypted Data Searching
Order-Revealing Encryption:
Order-Revealing Encryption: How to Search on Encrypted Data David Wu Stanford University based on joint works with Nathan Chenette, Kevin Lewi, and Stephen A. Weis Searching on Encrypted Data The information
Order-Revealing Encryption:
Order-Revealing Encryption: New Constructions, Applications and Lower Bounds Kevin Lewi and David J. Wu Stanford University Searching on Encrypted Data Searching on Encrypted Data Searching on Encrypted
Security and Privacy through Modern Cryptography
Security and Privacy through Modern Cryptography David Wu Stanford University Cryptography in the 1970s How can two users who have never met before communicate securely with each other? m secrecy integrity
COMP4109 : Applied Cryptography
COMP4109 : Applied Cryptography Fall 2013 M. Jason Hinek Carleton University Applied Cryptography Day 4 (and 5 and maybe 6) secret-key primitives symmetric-key encryption security notions and types of
Homework 2: Symmetric Crypto Due at 11:59PM on Monday Feb 23, 2015 as a PDF via websubmit.
Homework 2: Symmetric Crypto February 17, 2015 Submission policy. information: This assignment MUST be submitted as a PDF via websubmit and MUST include the following 1. List of collaborators 2. List of
Encrypted databases. Tom Ristenpart CS 6431
Encrypted databases Tom Ristenpart CS 6431 Outsourced storage settings Client wants to store data up on Dropbox High availability, synch across devices Server includes much value-add functionality Keyword
Cryptography. Andreas Hülsing. 6 September 2016
Cryptography Andreas Hülsing 6 September 2016 1 / 21 Announcements Homepage: http: //www.hyperelliptic.org/tanja/teaching/crypto16/ Lecture is recorded First row might be on recordings. Anything organizational:
Feedback Week 4 - Problem Set
4/26/13 Homework Feedback Introduction to Cryptography Feedback Week 4 - Problem Set You submitted this homework on Mon 17 Dec 2012 11:40 PM GMT +0000. You got a score of 10.00 out of 10.00. Question 1
CSE 127: Computer Security Cryptography. Kirill Levchenko
CSE 127: Computer Security Cryptography Kirill Levchenko October 24, 2017 Motivation Two parties want to communicate securely Secrecy: No one else can read messages Integrity: messages cannot be modified
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Lecture 6 Michael J. Fischer Department of Computer Science Yale University January 27, 2010 Michael J. Fischer CPSC 467b, Lecture 6 1/36 1 Using block ciphers
Goals of Modern Cryptography
Goals of Modern Cryptography Providing information security: Data Privacy Data Integrity and Authenticity in various computational settings. Data Privacy M Alice Bob The goal is to ensure that the adversary
ENEE 459-C Computer Security. Message authentication
ENEE 459-C Computer Security Message authentication Data Integrity and Source Authentication Encryption does not protect data from modification by another party. Why? Need a way to ensure that data arrives
Network Security Technology Project
Network Security Technology Project Shanghai Jiao Tong University Presented by Wei Zhang zhang-wei@sjtu.edu.cn!1 Part I Implement the textbook RSA algorithm. The textbook RSA is essentially RSA without
Lecture 07: Private-key Encryption. Private-key Encryption
Lecture 07: Three algorithms Key Generation: Generate the secret key sk Encryption: Given the secret key sk and a message m, it outputs the cipher-text c (Note that the encryption algorithm can be a randomized
RSA. Public Key CryptoSystem
RSA Public Key CryptoSystem DIFFIE AND HELLMAN (76) NEW DIRECTIONS IN CRYPTOGRAPHY Split the Bob s secret key K to two parts: K E, to be used for encrypting messages to Bob. K D, to be used for decrypting
Lecturers: Mark D. Ryan and David Galindo. Cryptography Slide: 24
Assume encryption and decryption use the same key. Will discuss how to distribute key to all parties later Symmetric ciphers unusable for authentication of sender Lecturers: Mark D. Ryan and David Galindo.
Lectures 6+7: Zero-Leakage Solutions
Lectures 6+7: Zero-Leakage Solutions Contents 1 Overview 1 2 Oblivious RAM 1 3 Oblivious RAM via FHE 2 4 Oblivious RAM via Symmetric Encryption 4 4.1 Setup........................................ 5 4.2
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 6 January 25, 2012 CPSC 467b, Lecture 6 1/46 Byte padding Chaining modes Stream ciphers Symmetric cryptosystem families Stream ciphers
Cryptography: Symmetric Encryption [continued]
![Cryptography: Symmetric Encryption [continued]](/thumbs/86/93317133.jpg "Cryptography: Symmetric Encryption [continued]")
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography: Symmetric Encryption [continued] Fall 2016 Ada (Adam) Lerner lerner@cs.washington.edu Thanks to Franzi Roesner, Dan Boneh, Dieter Gollmann,
Cryptography Basics. IT443 Network Security Administration Slides courtesy of Bo Sheng
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Outline Basic concepts in cryptography systems Secret key cryptography Public key cryptography Hash functions 2 Encryption/Decryption
Symmetric Cryptography
CSE 484 (Winter 2010) Symmetric Cryptography Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials...
Cryptography (cont.)
CSE 484 / CSE M 584 (Autumn 2011) Cryptography (cont.) Daniel Halperin Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others
9/30/2016. Cryptography Basics. Outline. Encryption/Decryption. Cryptanalysis. Caesar Cipher. Mono-Alphabetic Ciphers
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng Basic concepts in cryptography systems Secret cryptography Public cryptography 1 2 Encryption/Decryption Cryptanalysis
CRYPTOLOGY KEY MANAGEMENT CRYPTOGRAPHY CRYPTANALYSIS. Cryptanalytic. Brute-Force. Ciphertext-only Known-plaintext Chosen-plaintext Chosen-ciphertext
CRYPTOLOGY CRYPTOGRAPHY KEY MANAGEMENT CRYPTANALYSIS Cryptanalytic Brute-Force Ciphertext-only Known-plaintext Chosen-plaintext Chosen-ciphertext 58 Types of Cryptographic Private key (Symmetric) Public
Syrvey on block ciphers
Syrvey on block ciphers Anna Rimoldi Department of Mathematics - University of Trento BunnyTn 2012 A. Rimoldi (Univ. Trento) Survey on block ciphers 12 March 2012 1 / 21 Symmetric Key Cryptosystem M-Source
Key Establishment and Authentication Protocols EECE 412
Key Establishment and Authentication Protocols EECE 412 1 where we are Protection Authorization Accountability Availability Access Control Data Protection Audit Non- Repudiation Authentication Cryptography
Privacy, Discovery, and Authentication for the Internet of Things
Privacy, Discovery, and Authentication for the Internet of Things David J. Wu Ankur Taly Asim Shankar Dan Boneh Stanford University Google Google Stanford University The Internet of Things (IoT) Lots of
Distributed ID-based Signature Using Tamper-Resistant Module
, pp.13-18 http://dx.doi.org/10.14257/astl.2013.29.03 Distributed ID-based Signature Using Tamper-Resistant Module Shinsaku Kiyomoto, Tsukasa Ishiguro, and Yutaka Miyake KDDI R & D Laboratories Inc., 2-1-15,
Secure Multiparty Computation
CS573 Data Privacy and Security Secure Multiparty Computation Problem and security definitions Li Xiong Outline Cryptographic primitives Symmetric Encryption Public Key Encryption Secure Multiparty Computation
Computer Security CS 526
Computer Security CS 526 Topic 4 Cryptography: Semantic Security, Block Ciphers and Encryption Modes CS555 Topic 4 1 Readings for This Lecture Required reading from wikipedia Block Cipher Ciphertext Indistinguishability
Privacy, Discovery, and Authentication for the Internet of Things
Privacy, Discovery, and Authentication for the Internet of Things David J. Wu Ankur Taly Asim Shankar Dan Boneh Stanford University Google Google Stanford University The Internet of Things (IoT) Lots of
Amorphic Encryption. Egger Mielberg
Amorphic Encryption Egger Mielberg egger.mielberg@gmail.com 27.01.2019 Abstract. As a symmetric as an asymmetric scheme requires a key (session or private) to be hidden. In this case, an attacker gets
Homework 2. Out: 09/23/16 Due: 09/30/16 11:59pm UNIVERSITY OF MARYLAND DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING
UNIVERSITY OF MARYLAND DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING ENEE 457 Computer Systems Security Instructor: Charalampos Papamanthou Homework 2 Out: 09/23/16 Due: 09/30/16 11:59pm Instructions
Security of Stateful Order-Preserving Encryption
Security of Stateful Order-Preserving Encryption Kee Sung Kim, Minkyu Kim, Dongsoo Lee, JeHong Park, Woo-Hwan Kim National Security Research Institute(NSR) Nov. 29, ICISC 2017 Introduction of OPE Introduction
ENEE 457: Computer Systems Security 09/12/16. Lecture 4 Symmetric Key Encryption II: Security Definitions and Practical Constructions
ENEE 457: Computer Systems Security 09/12/16 Lecture 4 Symmetric Key Encryption II: Security Definitions and Practical Constructions Charalampos (Babis) Papamanthou Department of Electrical and Computer
Information Security CS526
Information CS 526 Topic 3 Ciphers and Cipher : Stream Ciphers, Block Ciphers, Perfect Secrecy, and IND-CPA 1 Announcements HW1 is out, due on Sept 10 Start early, late policy is 3 total late days for
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 2.1 Introduction to Cryptography CSC 474/574 By Dr. Peng Ning 1 Cryptography Cryptography Original meaning: The art of secret writing Becoming a science that
Encrypted Data Deduplication in Cloud Storage
Encrypted Data Deduplication in Cloud Storage Chun- I Fan, Shi- Yuan Huang, Wen- Che Hsu Department of Computer Science and Engineering Na>onal Sun Yat- sen University Kaohsiung, Taiwan AsiaJCIS 2015 Outline
Cryptography [Symmetric Encryption]
![Cryptography [Symmetric Encryption]](/thumbs/89/100564864.jpg "Cryptography [Symmetric Encryption]")
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography [Symmetric Encryption] Spring 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin,
Cryptography 2017 Lecture 3
Cryptography 2017 Lecture 3 Block Ciphers - AES, DES Modes of Operation - ECB, CBC, CTR November 7, 2017 1 / 1 What have seen? What are we discussing today? What is coming later? Lecture 2 One Time Pad
ISA 562: Information Security, Theory and Practice. Lecture 1
ISA 562: Information Security, Theory and Practice Lecture 1 1 Encryption schemes 1.1 The semantics of an encryption scheme. A symmetric key encryption scheme allows two parties that share a secret key
COS433/Math 473: Cryptography. Mark Zhandry Princeton University Spring 2018
COS433/Math 473: Cryptography Mark Zhandry Princeton University Spring 2018 Previously on COS 433 Confusion/Diffusion Paradigm f 1 f 2 f 3 f 4 f 5 f 6 Round π 1 f 7 f 8 f 9 f 10 f 11 f 12 π 2 Substitution
Introduction. CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell
Introduction CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell 1 Cryptography Merriam-Webster Online Dictionary: 1. secret writing 2. the enciphering and deciphering
Lecture 6: Symmetric Cryptography. CS 5430 February 21, 2018
Lecture 6: Symmetric Cryptography CS 5430 February 21, 2018 The Big Picture Thus Far Attacks are perpetrated by threats that inflict harm by exploiting vulnerabilities which are controlled by countermeasures.
1.264 Lecture 27. Security protocols Symmetric cryptography. Next class: Anderson chapter 10. Exercise due after class
1.264 Lecture 27 Security protocols Symmetric cryptography Next class: Anderson chapter 10. Exercise due after class 1 Exercise: hotel keys What is the protocol? What attacks are possible? Copy Cut and
COMPOSABLE AND ROBUST OUTSOURCED STORAGE
SESSION ID: CRYP-R14 COMPOSABLE AND ROBUST OUTSOURCED STORAGE Christian Badertscher and Ueli Maurer ETH Zurich, Switzerland Motivation Server/Database Clients Write Read block 2 Outsourced Storage: Security
Analysing Access Pattern and Volume Leakage from Range Queries on Encrypted Data. Information Security Group
Analysing Access Pattern and Volume Leakage from Range Queries on Encrypted Data Kenny Paterson @kennyog based on joint work with Paul Grubbs, Marie-Sarah Lacharité, Brice Minaud Information Security Group
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Michael J. Fischer Lecture 4 September 11, 2017 CPSC 467, Lecture 4 1/23 Analyzing Confidentiality of Cryptosystems Secret ballot elections Information protection Adversaries
Introduction to Cryptography. Lecture 3
Introduction to Cryptography Lecture 3 Benny Pinkas March 6, 2011 Introduction to Cryptography, Benny Pinkas page 1 Pseudo-random generator seed s (random, s =n) Pseudo-random generator G Deterministic
What Can Be Proved About Security?
What Can Be Proved About Security? Palash Sarkar Applied Statistics Unit Indian Statistical Institute, Kolkata India palash@isical.ac.in Centre for Artificial Intelligence and Robotics Bengaluru 23 rd
Message Authentication ( 消息认证 )
Message Authentication ( 消息认证 ) Sheng Zhong Yuan Zhang Computer Science and Technology Department Nanjing University 2017 Fall Sheng Zhong, Yuan Zhang (CS@NJU) Message Authentication ( 消息认证 ) 2017 Fall
Symmetric Encryption 2: Integrity
http://wwmsite.wpengine.com/wp-content/uploads/2011/12/integrity-lion-300x222.jpg Symmetric Encryption 2: Integrity With material from Dave Levin, Jon Katz, David Brumley 1 Summing up (so far) Computational
CS 645 : Lecture 6 Hashes, HMAC, and Authentication. Rachel Greenstadt May 16, 2012
CS 645 : Lecture 6 Hashes, HMAC, and Authentication Rachel Greenstadt May 16, 2012 Reminders Graded midterm, available on bbvista Project 3 out (crypto) Hash Functions MAC HMAC Authenticating SSL Man-in-the-middle
Leakage-Resilient Chosen-Ciphertext Secure Public-Key Encryption from Hash Proof System and One-Time Lossy Filter
Leakage-Resilient Chosen-Ciphertext Secure Public-Key Encryption from Hash Proof System and One-Time Lossy Filter Baodong Qin and Shengli Liu Shanghai Jiao Tong University ASIACRYPT 2013 Dec 5, Bangalore,
Course Map. COMP 7/8120 Cryptography and Data Security. Learning Objectives. How to use PRPs (Block Ciphers)? 2/14/18
Course Map Key Establishment Authenticated Encryption Key Management COMP 7/8120 Cryptography and Data Security Lecture 8: How to use Block Cipher - many time key Stream Ciphers Block Ciphers Secret Key
Relaxing IND-CCA: Indistinguishability Against Chosen. Chosen Ciphertext Verification Attack
Relaxing IND-CCA: Indistinguishability Against Chosen Ciphertext Verification Attack Indian Statistical Institute Kolkata January 14, 2012 Outline 1 Definitions Encryption Scheme IND-CPA IND-CCA IND-CCVA
Securing Distributed Computation via Trusted Quorums. Yan Michalevsky, Valeria Nikolaenko, Dan Boneh
Securing Distributed Computation via Trusted Quorums Yan Michalevsky, Valeria Nikolaenko, Dan Boneh Setting Distributed computation over data contributed by users Communication through a central party
Authenticated Encryption
18733: Applied Cryptography Anupam Datta (CMU) Authenticated Encryption Online Cryptography Course Authenticated Encryption Active attacks on CPA-secure encryption Recap: the story so far Confidentiality:
Distributed Key Management and Cryptographic Agility. Tolga Acar 24 Feb. 2011
Distributed Key Management and Cryptographic Agility Tolga Acar 24 Feb. 2011 1 Overview Distributed Key Lifecycle Problem statement and status quo Distributed Key Manager Typical application scenario and
Lecture 8: Cryptography in the presence of local/public randomness
Randomness in Cryptography Febuary 25, 2013 Lecture 8: Cryptography in the presence of local/public randomness Lecturer: Yevgeniy Dodis Scribe: Hamidreza Jahanjou So far we have only considered weak randomness
Cryptographic Primitives A brief introduction. Ragesh Jaiswal CSE, IIT Delhi
Cryptographic Primitives A brief introduction Ragesh Jaiswal CSE, IIT Delhi Cryptography: Introduction Throughout most of history: Cryptography = art of secret writing Secure communication M M = D K (C)
COS433/Math 473: Cryptography. Mark Zhandry Princeton University Spring 2018
COS433/Math 473: Cryptography Mark Zhandry Princeton University Spring 2018 Identification Identification Identification To identify yourself, you need something the adversary doesn t have Typical factors:
Web Security 2 https://www.xkcd.com/177/ http://xkcd.com/1323/ Encryption basics Plaintext message key secret Encryp)on Func)on Ciphertext Insecure network Decryp)on Func)on Curses! Foiled again! key Plaintext
Lecture 1 Applied Cryptography (Part 1)
Lecture 1 Applied Cryptography (Part 1) Patrick P. C. Lee Tsinghua Summer Course 2010 1-1 Roadmap Introduction to Security Introduction to Cryptography Symmetric key cryptography Hash and message authentication
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 8 September 28, 2015 CPSC 467, Lecture 8 1/44 Chaining Modes Block chaining modes Extending chaining modes to bytes Public-key Cryptography
Cryptography CS 555. Topic 8: Modes of Encryption, The Penguin and CCA security
Cryptography CS 555 Topic 8: Modes of Encryption, The Penguin and CCA security 1 Reminder: Homework 1 Due on Friday at the beginning of class Please typeset your solutions 2 Recap Pseudorandom Functions
CS573 Data Privacy and Security. Cryptographic Primitives and Secure Multiparty Computation. Li Xiong
CS573 Data Privacy and Security Cryptographic Primitives and Secure Multiparty Computation Li Xiong Outline Cryptographic primitives Symmetric Encryption Public Key Encryption Secure Multiparty Computation
Security of Cryptosystems
Security of Cryptosystems Sven Laur swen@math.ut.ee University of Tartu Formal Syntax Symmetric key cryptosystem m M 0 c Enc sk (m) sk Gen c sk m Dec sk (c) A randomised key generation algorithm outputs
Crypto Background & Concepts SGX Software Attestation
CSE 5095 & ECE 4451 & ECE 5451 Spring 2017 Lecture 4b Slide deck extracted from Kamran s tutorial on SGX, presented during ECE 6095 Spring 2017 on Secure Computation and Storage, a precursor to this course
Strong Privacy for RFID Systems from Plaintext-Aware Encryption
Strong Privacy for RFID Systems from Plaintext-Aware Encryption Khaled Ouafi and Serge Vaudenay ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE http://lasec.epfl.ch/ supported by the ECRYPT project SV strong
Information Security
SE 4472b Information Security Week 2-2 Some Formal Security Notions Aleksander Essex Fall 2015 Formalizing Security As we saw, classical ciphers leak information: Caeser/Vigenere leaks letter frequency
Homework 3: Solution
Homework 3: Solution March 28, 2013 Thanks to Sachin Vasant and Xianrui Meng for contributing their solutions. Exercise 1 We construct an adversary A + that does the following to win the CPA game: 1. Select
Symmetric-Key Cryptography Part 1. Tom Shrimpton Portland State University
Symmetric-Key Cryptography Part 1 Tom Shrimpton Portland State University Building a privacy-providing primitive I want my communication with Bob to be private -- Alice What kind of communication? SMS?
Public-key Cryptography: Theory and Practice
Public-key Cryptography Theory and Practice Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Chapter 1: Overview What is Cryptography? Cryptography is the study of
COS433/Math 473: Cryptography. Mark Zhandry Princeton University Spring 2017
COS433/Math 473: Cryptography Mark Zhandry Princeton University Spring 2017 Identification Identification Identification To identify yourself, you need something the adversary doesn t have Typical factors:
Public-Key Cryptography. Professor Yanmin Gong Week 3: Sep. 7
Public-Key Cryptography Professor Yanmin Gong Week 3: Sep. 7 Outline Key exchange and Diffie-Hellman protocol Mathematical backgrounds for modular arithmetic RSA Digital Signatures Key management Problem:
Basic Concepts and Definitions. CSC/ECE 574 Computer and Network Security. Outline
CSC/ECE 574 Computer and Network Security Topic 2. Introduction to Cryptography 1 Outline Basic Crypto Concepts and Definitions Some Early (Breakable) Cryptosystems Key Issues 2 Basic Concepts and Definitions
Computer Security. 08. Cryptography Part II. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08. Cryptography Part II Paul Krzyzanowski Rutgers University Spring 2018 March 23, 2018 CS 419 2018 Paul Krzyzanowski 1 Block ciphers Block ciphers encrypt a block of plaintext at a
Introduction to Cryptography. Lecture 3
Introduction to Cryptography Lecture 3 Benny Pinkas March 6, 2011 Introduction to Cryptography, Benny Pinkas page 1 Pseudo-random generator seed s (random, s =n) Pseudo-random generator G Deterministic
Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu
HY-457 Information Systems Security
HY-457 Information Systems Security Recitation 1 Panagiotis Papadopoulos(panpap@csd.uoc.gr) Kostas Solomos (solomos@csd.uoc.gr) 1 Question 1 List and briefly define categories of passive and active network
CIS 4360 Introduction to Computer Security Fall WITH ANSWERS in bold. First Midterm
CIS 4360 Introduction to Computer Security Fall 2010 WITH ANSWERS in bold Name:.................................... Number:............ First Midterm Instructions This is a closed-book examination. Maximum
Anonymity. Assumption: If we know IP address, we know identity
03--4 Anonymity Some degree of anonymity from using pseudonyms However, anonymity is always limited by address TCP will reveal your address address together with ISP cooperation Anonymity is broken We
ASYMMETRIC (PUBLIC-KEY) ENCRYPTION. Mihir Bellare UCSD 1
ASYMMETRIC (PUBLIC-KEY) ENCRYPTION Mihir Bellare UCSD 1 Recommended Book Steven Levy. Crypto. Penguin books. 2001. A non-technical account of the history of public-key cryptography and the colorful characters
Unit 8 Review. Secure your network! CS144, Stanford University
Unit 8 Review Secure your network! 1 Basic Problem Internet To first approximation, attackers control the network Can snoop, replay, suppress, send How do we defend against this? Communicate securely despite
Cryptography & Key Exchange Protocols. Faculty of Computer Science & Engineering HCMC University of Technology
Cryptography & Key Exchange Protocols Faculty of Computer Science & Engineering HCMC University of Technology Outline 1 Cryptography-related concepts 2 3 4 5 6 7 Key channel for symmetric cryptosystems
Computer Security. 08r. Pre-exam 2 Last-minute Review Cryptography. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08r. Pre-exam 2 Last-minute Review Cryptography Paul Krzyzanowski Rutgers University Spring 2018 March 26, 2018 CS 419 2018 Paul Krzyzanowski 1 Cryptographic Systems March 26, 2018 CS
CSCI 454/554 Computer and Network Security. Topic 2. Introduction to Cryptography
CSCI 454/554 Computer and Network Security Topic 2. Introduction to Cryptography Outline Basic Crypto Concepts and Definitions Some Early (Breakable) Cryptosystems Key Issues 2 Basic Concepts and Definitions
Information Security CS526
Information Security CS 526 Topic 3 Cryptography: One-time Pad, Information Theoretic Security, and Stream CIphers 1 Announcements HW1 is out, due on Sept 11 Start early, late policy is 3 total late days
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 2.2 Secret Key Cryptography CSC 474/574 Dr. Peng Ning 1 Agenda Generic block cipher Feistel cipher DES Modes of block ciphers Multiple encryptions Message
Secure Multiparty Computation
Secure Multiparty Computation Li Xiong CS573 Data Privacy and Security Outline Secure multiparty computation Problem and security definitions Basic cryptographic tools and general constructions Yao s Millionnare
DataTraveler 5000 (DT5000) and DataTraveler 6000 (DT6000) Ultimate Security in a USB Flash Drive. Submitted by SPYRUS, Inc.
Submitted by SPYRUS, Inc. Contents DT5000 and DT6000 Technology Overview...2 Why DT5000 and DT6000 Encryption Is Different...3 Why DT5000 and DT6000 Encryption Is Different - Summary...4 XTS-AES Sector-Based
INSE 6110 Midterm LAST NAME FIRST NAME. Fall 2016 Duration: 80 minutes ID NUMBER. QUESTION Total GRADE. Notes:
A INSE 6110 Midterm Fall 2016 Duration: 80 minutes LAST NAME FIRST NAME ID NUMBER QUESTION 1 2 3 4 Total GRADE Notes: 1) Calculator (non-programming) allowed, nothing else permitted 2) Each page contains
Functional Encryption: Deterministic to Randomized Functions from Simple Assumptions. Shashank Agrawal and David J. Wu
Functional Encryption: Deterministic to Randomized Functions from Simple Assumptions Shashank Agrawal and David J. Wu Public-Key Functional Encryption [BSW11, O N10] x f(x) Keys are associated with deterministic
Outline. Cryptography. Encryption/Decryption. Basic Concepts and Definitions. Cryptography vs. Steganography. Cryptography: the art of secret writing
Outline CSCI 454/554 Computer and Network Security Basic Crypto Concepts and Definitions Some Early (Breakable) Cryptosystems Key Issues Topic 2. Introduction to Cryptography 2 Cryptography Basic Concepts
Defining Encryption. Lecture 2. Simulation & Indistinguishability
Defining Encryption Lecture 2 Simulation & Indistinguishability Roadmap First, Symmetric Key Encryption Defining the problem We ll do it elaborately, so that it will be easy to see different levels of
Cryptanalyzing the Polynomial Reconstruction based Public-Key System under Optimal Parameter Choice
Cryptanalyzing the Polynomial Reconstruction based Public-Key System under Optimal Parameter Choice Aggelos Kiayias - Moti Yung U. of Connecticut - Columbia U. (Public-Key) Cryptography intractability
COS433/Math 473: Cryptography. Mark Zhandry Princeton University Spring 2017
COS433/Math 473: Cryptography Mark Zhandry Princeton University Spring 2017 Previously on COS 433 Pseudorandom Permutations unctions that look like random permutations Syntax: Key space K (usually {0,1}
1 Achieving IND-CPA security
ISA 562: Information Security, Theory and Practice Lecture 2 1 Achieving IND-CPA security 1.1 Pseudorandom numbers, and stateful encryption As we saw last time, the OTP is perfectly secure, but it forces