Hard Core Predicates: How to encrypt? Recap

Transcription

1 Hard Core Predcates: How to ecrypt? Debdeep Mukhopadhyay IIT Kharagpur Recap A ecrypto scheme s secured f for every probablstc adversary A carryg out some specfed kd of attack ad for every polyomal p(.), there exsts a teger N s.t. the probablty that A succeeds ths attack s less tha /p() for every >N

2 If f :{0,} Hard Core Predcates {0,}, ad bjectve, a poly() computable B:{0,} {0,} s ( t, ε ) hp for f f for every A wth rug tme t(), Pr X [A(f(X))=B(X)] + () Oe-way fuctos ad Trapdoors They are class of fuctos whch are easy to compute oe drecto (poyomal tme), but hard to vert (caot be verted polyomal tme) But ca be easly verted wth a secret formato, called the trap-door formato.

3 Example wth RSA y=x e mod(pq) [Easy to compute] Gve y, e ad N=pq, we do ot kow effcet techques to compute x. But f we have a trap-door d=e - mod(p-)(q-) t becomes easy to compute x ad hece vert the fucto. Hard Core Predcate of trapdoor permutatos ( GFI,, ) s a famly of trapdoor permutatos, G chooses (k, t ) F(., k) s bjectve I(., t, k) s verse of F(., k) k k st, G,F,I ca be doe poly() tme ad vertg F wthout t s hard. k 3

4 HP for trap-door permutatos If ( G, F, I) s a famly of trapdoor permutatos, the polyomal tme oe bt output BXk (, ) s a hard-core predcate f for every A rug tme t(), Pr ( kt, ) ( )[A(F(X,k),k)=B(X,k)] + () k G ε Goldrech-Lev Theorem If there s a famly of trapdoor permutatos, the there s a famly wth a hard core predcate. 4

5 Ecryptg a bt b Gve (G,F,I),t k ad a hardcore predcate B Key Geerato: G Retur (k,t k ) Ecrypto: E(b,t k ) Pck radom X Є {0,} Retur F( X, k), b B( X, k) Decrypto: D((z,c),k,t k ) X=I(z,t k ) Retur c B( X, k) ( kt, k ) G( ) X {0,} b {0,} The Ecrypto s MI secure Pr [ A( F( X, k), b B( X, k), k) = b] + ε ( ) Proof: Suppose ths ecrypto s ot ( t, ε ) MI secure. Pr [ A( F( X, k), b B( X, k), k) = b] > + ε ( ) ( kt, k ) G( ) X {0,} b {0,} Cosder algorthm A'(y,k) Pck radom c {0,} Retur c A(y,c,k) Thus, Pr [ A'( F( X, k), k) = B( X, k)] X {0,} = Pr [ AF ( ( X, k), ck, ) = BX (, k) c] ( kt, k ) G ( ) X {0,} c {0,} = Pr [ A( F( X, k), b B( X, k), k) = b] > + ε ( ) ( kt, k ) G ( ) X {0,} b {0,} 5

6 Example for RSA B(X,(N,e))=X mod s a hp for RSA that s gve (N,e), X e mod N t s hard to guess X mod wth a o-eglgbly large probablty tha ½ Ecrypt bє{0,} wth RSA Pck X Є{0,} Compute, X e mod N, XOR(b,Xmod ) How to ecrypt loger strgs? Gve (G,F,I),t k ad a hardcore predcate B Key Geerato: G Retur (k,t k ) Ecrypto: E GM (m,k), mє{0,} for = to Pck radom X Є {0,} Retur F( X, k), m[ ] B( X, k) Decrypto: D((z,c),k,t k ) X=I(z,t k ) for = to Retur d [] BX (, k) 6

7 Proof of MI secured For every m, m' for every A rug tme t() Pr[ AE ( ( mk, ), k) = ] Pr[ AE ( ( m', k), k) = ] ε GM If we cotradct ths supposto, we have Amm,, 's.t. Pr[ AE ( ( mk, ), k) = ] Pr[ AE ( ( m', k), k) = ] > ε GM GM GM Cotd. Cosder the followg hybrd costructo: Pr[A(E(m[])E(m[])...E(m[]))=]=p Pr[A(E(m'[])E(m[])...E(m[]))=]=p... Pr[A(E(m'[])E(m'[])...m'[]m[+]...E(m[]))=]=p Pr[A(E(m'[])E(m'[])...m'[] m'[+]...e(m[]))=]=p+... Pr[A(E(m'[])E(m[])...E(m'[-])E(m[]))=]=p Pr[A(E(m[])E(m[])...E(m'[-]E(m'[]))=]=p 0-7

8 Cotd. So, from our cotradcto we have: p p > ε 0 or, ( p p ) > ε = 0 + ε or, :( p p+ ) > e, Pr[A(E(m'[])E(m'[])...m'[]m[+]...E(m[]))=] ε -Pr[A(E(m'[])E(m'[])...m'[]m'[+]...E(m[]))=] > Cotd. Cosder algorthm A'(c,k) Compute, c = E( m'[0])... c = E( m'[ ]) c + = E( m[ + ])... c = E( m[ ]) Retur Ac (,..., c, cc,, +..., c ) 8

9 cotd. Pr[ A'( c, k) = ] Pr[ A'( c, k) = ] = Pr[ Ac (,..., c, cc,,..., c)] Pr[ Ac (,..., c, cc,,..., c)] + + ε > Ths cotradcts the fact that oe bt ecrypto was MI secure. A Hard Core Predcate for ay oeway fucto Let (G,F,I) be a famly of trap-door permutatos. Cosder (G,F',I'), whch s also a famly of trap-door permutatos. I'(( z, r), tk) = I( z, tk), r ad F'(( x, r), k) =< F( x, k), r > The Bxr (, ) = xr. mod s a hard core predcate for (G',F',I'). 9

10 Proof Let us drop the varables k ad t k for smplcty. The proof s uchaged wth them. Assume that there s a polyomal tme algorthm A, that always correctly computes B(x,r) gve F (x)=(f(x),r) we shall show that easy to compute x from f(x). Ths cotradcts our assumpto that F s oe-way. Detals Let A be a PPT algorthm whch computes the value of B(x,r) from F (x,r)=f(x),r Pr [ ( ( ), ) (, )] AF x r = Bxr = x,r {0,} Now we shall frame a expermet A, whch vokes A for =,,,. The argumets beg passed to A are x ad e e deotes a strg wth the th bt ad rest 0. Sce, A computes the term B(x,e )=x wth probablty, the etre x s retreved by A by executg A umber of tmes. Note that the ru tme of A s also polyomal ad also has a probablty of. 0

11 But that s ot all! The G-L Theorem says that the probablty of computg B(x,r) from F (X,r)=(F(x),r) should be greater tha ½ by a eglgble quatty So, assumg a probablty of s a weak case. Slghtly more volved case (ad more closer to the proof) wll be f the probablty s sgfcatly greater tha ¾. Why the prevous proofs does ot work? It may be that A ever succeeds computg B(x,r) correctly whe r=e The algorthm A has o meas of uderstadg that A has succeeded or ot? So, what does A do ths case to crease hs chace? (repeat the expermet of A)

12 Two mportat observatos B( xr, ) Bxr (, e) = Bxe (, ) = x ote that A s voked wth radom puts. There s o way to uderstad whe A gves a correct aswer. So, ru A multple tmes ad take the majorty. A prelmary step would be to prove that for may x s, the probablty that A aswers both the predcate queres correctly s very hgh. Clam 3 If, Pr [ AF ( ( x), r) = Bxr (, )] + ε ( ). xr, {0,} 4 The there exsts a set S {0,} of sze at least ε ( ), where for every x S : 3 ε ( ) Pr [ AF ( ( x), r) = Bxr (, )] + r {0,} 4

13 xr, Proof Defe, sx ( ) = Pr [ AFx ( ( ), r) = Bxr (, )] r {0,} ε ( ) We have to show that S Pr [ AF ( ( x), r) = Bxr (, )] = Pr [ AF ( ( x), r) = Bxr (, ) x S]Pr [ x S] xr, x + Pr [ AF ( ( x), r) = Bxr (, ) x S]Pr [ x S] xr, x Pr [ x S ] + Pr [ A( F( x), r) = B( xr, ) x S] x x, r Pr [ x S ] Pr [ A( F( x), r) = B( x, r)] x x, r Pr [ AF ( ( x), r) = Bxr (, ) x S] xr, 3 3 () ().e. P r x[ x S] + ()-( + )= 4 4 () Thus, S must be of sze at least x s uformly dstrbuted { 0,} ) (because r {0,} Clam 3 If, Pr [ AF ( ( x), r) = Bxr (, )] + ε ( ). xr, {0,} 4 The there exsts a set S {0,} of sze at least ε ( ), where for every x S ad every t holds that: Pr [ A( F( x), r) = B( x, r) A( F( x), r e) = B( x, r e) ] +ε ( ) 3

14 Proof We kow for x S : ε ( ) Pr [ AF ( ( x), r) Bxr (, )] < r {0,} 4 Fxg ay, f r s uformly dstrbuted so, s r e. So, ε ( ) Pr [ AF ( ( x), r) Bxr (, e)] r {0,} < 4 We wsh to upper-boud the probablty that at least oe of the two predcates are wrogly computed. From the theory of probablty, ths s atmost: ε( ) ε( ) ( ) + ( ) = ε ( ) 4 4 So, A s correct o both the queres wth probablty at least + ε ( ). The strategy of A For =,...,. Choose a radom r {0,} ad guess that the value x = A( y, r) A( y, r e).. Repeat ths procedure for a large umber of cases, (oly the umber of trals has to be polyomal ) ad retur the majorty as the correct guess. 4

15 Ca ths proof be exteded to the geeral case? Sce t volves two computatos of B(), the error probablty s doubled. for the actual proof (ad eve whe the error probablty s exactly ¼ ths wll ot help vertg F wth a sgfcat prob) Istead, we guess oe B ad compute the other. m=poly() ad set l=log (m+) Ca ths proof be exteded to the geeral case? Choose l strgs uformly ad depedetly {0,} ad deote them by s,,s l. The guess B(x,s ),,B(x,s l ) ad call them σ,,σ l. Probablty that all of them are correct s / l =/poly() j Fx as a subset of {,,l} ad defe r = j s It may be show that the r s are parwse depedet ad uformly dstrbuted {0,} 5

16 Ca ths proof be exteded to the geeral case? Note that: j j B( xr, ) = Bx (, s) = Bxs (, ) j j So, our guess for B(x,r ) s ρ = j j σ A s expermet: The Actual Proof. Geerate ad depedetly set l l s,..., s {0,} ad σ,..., σ {0,}. For every o-empty subset of, {,...,l} computes a strg, r = s ad a bt ρ = σ j j j j 3. For every {,..,} ad every o-empty subset of, {,...,l} computes, z = ρ A( y, r + e) 4. For every {,..,} t sets z to be the majorty of the 5. It outputs z = z... z z values. 6

17 Aalyss Next, we show that f for all jє{,,l}, σ j s are equal to B(x,s j ), the: z = Bxr (, ) AFx ( ( ), r e) has a majorty equal to x for all Є{,,} Clam For every x S ad every, l Pr[ { : B( x, r ) A( F( X), r e ) = x} > ( )] >- 7

18 Proof For every defe a 0- r.v M whch equals, ff Bxr (, ) AFX ( ( ), r e) = Bxe (, ) = x M = ff A( F( X), r e ) = B( x, r e ) Thus, M = wth probablty at least ε ( ) +,as x S. Note that Bxr (, ) AFX ( ( ), r ff M = for majorty of j's, j. Thus, Pr[ M ] =? m e ) = x Chebyshev s Iequalty Let X be a r.v ad δ > 0 Var( X ) Pr[ X E( X) δ ] δ 8

19 Pr[ M ] Pr[ ( ) ] Note, E( M )=( ) Var ( M ) ( )( ) Pr[ M ] Pr[ ( ) ] m ε ( ) ε ( ) M + m m ε ( ) + m ε( ) ε( ) m = m + < 4 m ε( ) ε( ) M + m m m/4 = ( ε( )/) ε( ) m m Let, m =, we have: ε ( ) m Pr[ M ] m Pr[ M > ] Ths completes the proof of the clam. Thus the probablty that A' s wrog for a partcular value of s at most (t occurs whe M m). Thus, the probablty that A' returs a wrog result for at least oe value of s atmost =. Thus the probablty that t s correct for all the values s at least. Remder, ths was uder the assumpto that the l guesses were -l all correct probablty of whch s. Hece f x S, A' verts F(x) wth a probablty of -l. = = m + + ε ( ) ε ( ) Also, we kow Pr x[ x S]= Thus, the probablty that A' s able to vert F(x) ε ( ) s at least = p( ) + p( ) ε ( ) whch s a cotradcto to the assumpto that F(x) s a oe-way fucto. 9