REU 2015: Complexity Across Disciplines. Introduction to Cryptography

Transcription

1 REU 2015: Complexity Across Disciplines Introduction to Cryptography

2 Symmetric Key Cryptosystems

3 Iterated Block Ciphers Definition Let KS : K K s be a function that produces a set of subkeys k i K, 1 i s from any key k K. A block cipher Π for which the encryption functions ɛ k are of the form T [k s ] T [k s 1 ] T [k s 2 ] T [k 1 ] is called an iterated block cipher and T [k i ] is called ith-round function.

4 Hash Functions Definition A hash function is a function H : X Y where X is a set of strings of arbitrary length, Y is a finite set of strings of a fixed length and X > Y. 1 Computationally Infeasible means solving the underlying problem is not possible within polynomial time

5 Hash Functions Definition A hash function is a function H : X Y where X is a set of strings of arbitrary length, Y is a finite set of strings of a fixed length and X > Y. A hash function H is one-way hash function for any y Y it is computationally infeasible 1 to find x X such that H(x) = y. 1 Computationally Infeasible means solving the underlying problem is not possible within polynomial time

6 Hash Functions Definition A hash function is a function H : X Y where X is a set of strings of arbitrary length, Y is a finite set of strings of a fixed length and X > Y. A hash function H is one-way hash function for any y Y it is computationally infeasible 1 to find x X such that H(x) = y. A hash function H is second-preimage resistant or weakly-collision free if for a given x X it is computationally infeasible to find x x such that H(x) = H(x ). 1 Computationally Infeasible means solving the underlying problem is not possible within polynomial time

7 Hash Functions Definition A hash function is a function H : X Y where X is a set of strings of arbitrary length, Y is a finite set of strings of a fixed length and X > Y. A hash function H is one-way hash function for any y Y it is computationally infeasible 1 to find x X such that H(x) = y. A hash function H is second-preimage resistant or weakly-collision free if for a given x X it is computationally infeasible to find x x such that H(x) = H(x ). A hash function H is first-preimage resistant or strongly-collision free if it is computationally infeasible to find x, x X such that x x and H(x) = H(x ). 1 Computationally Infeasible means solving the underlying problem is not possible within polynomial time

8 Groups Generated by Encryption Functions Let T Π = {ɛ k : k K} be the set of all possible encryption transformations. In a cryptosystem the mapping ɛ is a permutation of M. T Π S M

9 Groups Generated by Encryption Functions Let T Π = {ɛ k : k K} be the set of all possible encryption transformations. In a cryptosystem the mapping ɛ is a permutation of M. T Π S M Definition The group G = T Π is called the group generated by the cipher.

10 Groups Generated by Encryption Functions Let T Π = {ɛ k : k K} be the set of all possible encryption transformations. In a cryptosystem the mapping ɛ is a permutation of M. T Π S M Definition The group G = T Π is called the group generated by the cipher. If T Π = G then the set of permutations T Π forms a group (the cipher is a group).

11 Groups Generated by Encryption Functions Let T Π = {ɛ k : k K} be the set of all possible encryption transformations. In a cryptosystem the mapping ɛ is a permutation of M. T Π S M Definition The group G = T Π is called the group generated by the cipher. If T Π = G then the set of permutations T Π forms a group (the cipher is a group). For such a cipher, multiple encryption doesn t offer better security than single encryption.

12 Groups Generated by Encryption functions Group generated by T [k]: G τ = T [k] k K

13 Groups Generated by Encryption functions Group generated by T [k]: G τ = T [k] k K Group generated by an arbitrary composition of s-round functions with independent keys k 1, k 2,, k s K:

14 Groups Generated by Encryption functions Group generated by T [k]: G τ = T [k] k K Group generated by an arbitrary composition of s-round functions with independent keys k 1, k 2,, k s K: G s τ = T [k s ]T [k s 1 ] T [k 1 ] k i K Group generated by any composition of s-round functions permitted by the key schedule KS : K K s (group generated by the cipher):

15 Groups Generated by Encryption functions Group generated by T [k]: G τ = T [k] k K Group generated by an arbitrary composition of s-round functions with independent keys k 1, k 2,, k s K: G s τ = T [k s ]T [k s 1 ] T [k 1 ] k i K Group generated by any composition of s-round functions permitted by the key schedule KS : K K s (group generated by the cipher): G = T [k s ]T [k s 1 ] T [k 1 ] KS(k) = (k 1, k 2,, k s )

16 Groups Generated by Encryption functions Group generated by T [k]: G τ = T [k] k K Group generated by an arbitrary composition of s-round functions with independent keys k 1, k 2,, k s K: G s τ = T [k s ]T [k s 1 ] T [k 1 ] k i K Group generated by any composition of s-round functions permitted by the key schedule KS : K K s (group generated by the cipher): G = T [k s ]T [k s 1 ] T [k 1 ] KS(k) = (k 1, k 2,, k s ) Lemma For every s N, G s τ is a normal subgroup of G τ.

17 Example: Merkle-Damgård Hash Function Let W (k, m) denote a block cipher that encrypts given plaintext m using a key k.

18 Example: Merkle-Damgård Hash Function Let W (k, m) denote a block cipher that encrypts given plaintext m using a key k. The hash functions based on the Merkle-Damgård scheme use a block cipher as a compression function.

19 Example: Merkle-Damgård Hash Function Let W (k, m) denote a block cipher that encrypts given plaintext m using a key k. The hash functions based on the Merkle-Damgård scheme use a block cipher as a compression function. Given a message m consisting of blocks m 1, m 2, m 3,, m t, the hash function is defined as H i = W (H i 1, m i ) m i H i 1, 0 i t (1) where H 0 is some initial value.

20 Algebraic Properties of a Cipher Small cardinality. If the cardinality of the group G is smaller than the cardinality of the key space, then the time for the key search can reduced to O(K). Intransitivity. Let l, n denote natural numbers such that 0 < l n. A group G S n is called l-transitive if, for any pair (a 1, a 2,..., a l ) and (b 1, b 2,..., b l ) with a i a j, b i b j for i j, there is a permutation g G with g(a i ) = b i for all i {1, 2,..., l}. A 1-transitive permutation group is called transitive. The group that is not transitive is called intransitive.

21 Algebraic Properties of a Cipher Imprimitivity. A subset B X is called a block of G if for each g G either g(b) = B or g(b) B =. A block B is said to be trivial if B {, X } or B = {x} where x X. The group G S n is called imprimitive if there is a non-trivial block B X of G; otherwise G is called primitive.