Homework 5 Solutions

Transcription

1 Homework 5 Solutions Due: March 1, 2018 CS 151: Intro. to Crptograph and Computer Securit 1 Fun with One-Wa Functions (Continued) a. f a (x) is a one-wa function. Assume for the sake of contradiction that we have a p.p.t. inverter A for f a (x) that, when given, outputs some x such that f a (x) = with nonnegligible probabilit. We want to use this A to construct an inverter for the one-wa function g(x). Let B be a p.p.t. algorithm that on input, runs A on to get back some value x, and then returns x. B A x x What happens when A succeeds? This means that the x that A returns is such that g( x) = f a (x) =. Therefore, the x that B returns is a preimage of. This means that when A succeeds, so does B, which further implies that the probabilit of B succeeding is at least the probabilit of A succeeding inside B. Since the input to A inside B is distributed identicall to the input to A in the wild, the probabilit of A succeeding inside B is equal to the probabilit of A succeeding in the wild. This probabilit is nonnegligible b assumption, so the probabilit of B succeeding is also nonnegligible. But this means that B is an inverter for the one-wa function g(x) that succeeds with nonnegligible probabilit, which is a contradiction. Thus, f a (x) must be a one-wa function. b. f b (x) is a one-wa function. Assume for the sake of contradiction that we have a p.p.t. inverter A for f b (x) that, when given, outputs some x such that f b (x ) = with nonnegligible probabilit. We want to use this A to construct an inverter for the one-wa function g(x). Let B be a p.p.t. algorithm that on input, runs A on to get back some value x = x 1 ( )x 2, and then returns x 1 x 2. Homework 5 Solutions Page 1 / 7

2 B A x = x 1 x 2 x 1 xor x 2 What happens when A succeeds? This means that the x that A returns is such that g(x 1 x 2 ) = f e (x ) =. Therefore, the x 1 x 2 that B returns is a preimage of. This means that when A succeeds, so does B, which further implies that the probabilit of B succeeding is at least the probabilit of A succeeding inside B. Since the input to A inside B is distributed identicall to the input to A in the wild, the probabilit of A succeeding inside B is equal to the probabilit of A succeeding in the wild. This probabilit is nonnegligible b assumption, so the probabilit of B succeeding is also nonnegligible. But this means that B is an inverter for the one-wa function g(x) that succeeds with nonnegligible probabilit, which is a contradiction. Thus, f b (x) must be a one-wa function. c. f c (x) is a one-wa function. As in parts (a) and (b), let s suppose we have a p.p.t. inverter A that on input w = f c (x), for random x, outputs x such that f c (x ) = w with nonnegligible probabilit. We wish to show that A succeeds with nonnegligible probabilit when the first half of x is all 0 s or has 2 or more 1 s, when w is of the form 0 x 1 g(x 2 ). Let us define a predicate singlebit1(x) that returns true if exactl one bit of x is set to 1, and false otherwise. We know that there exists a nonnegligible function ν(k) such that: ν(k) = Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x)] We wish to show that the following: Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x)) singlebit1(x 1 )] Homework 5 Solutions Page 2 / 7

3 is also non-negligible. We can see this b: ν(k) = Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x)] Then since: = (Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x) singlebit1(x 1 )] Pr[x {0, 1} k singlebit1(x 1 )]) +(Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x) singlebit1(x 1 )] Pr[x {0, 1} k singlebit1(x 1 )]) = Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x) singlebit1(x 1 )] (1 k Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x) singlebit1(x 1 )] k 2 1 Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x) singlebit1(x 1 )] 1 and k k/2 is negligible, Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x) singlebit1(x 1 )] k k/2 is negligible. It then follows that: Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x) singlebit1(x 1 )] (1 k k/2 ) = ν(k) Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x) singlebit1(x 1 )] k k/2 is nonnegligible, so the following is also nonnegligible: Pr[x {0, 1} k ; x A(1 k, f c, f c (x)) f c (x ) = f c (x) singlebit1(x 1 )] Therefore, A succeeds with nonnegligible probabilit on inputs of the form 0 x 1 g(x 2 ). We can now use this A to construct a p.p.t. inverter B for g. To start, B gets some input. B gives 0 as input to A. As we showed, with some nonnegligible probabilit, A returns an x such that 0 x 1 g(x 2 ) = f c(x ) = 0, so B can return x 2. 2 k 2 2 k 2 ) B A w=(0^ ) x = x 1 x 2 x 2 Homework 5 Solutions Page 3 / 7

4 As long as does not consist of all zeros, B succeeds whenever A succeeds. Therefore, if we can argue that will consist of all zeroes with negligible probabilit, then B succeeds with nonnegligible probabilit, which is a contradiction (thus impling that f c is one-wa). Suppose that does consist of all zeros with nonnegligible probabilit. That is, Pr[x {0, 1} k g(x) = 0 k ] = ε(k) where ε is nonnegligible. Then an inverter C that outputs a random x will succeed with nonnegligible probabilit: Pr[x {0, 1} k ; x C(1 k, g(x)) g(x) = g(x )] = Pr[x {0, 1} k ; x {0, 1} k g(x) = g(x )] Pr[x {0, 1} k g(x) = 0 k ] Pr[x {0, 1} k g(x ) = 0 k ] = ε(k) 2 which is non-negligible. Therefore if g is one-wa, then consists of all zeros with negligible probabilit. d. f d (x) is not a one-wa function. Consider an inverter A that outputs a string x of x ones when f d outputs 0 x. Consider the probabilit of A inverting f d : c A (k) = Pr[x {0, 1} k ; x A(1 k, f d, f d (x)) f d (x ) = f d (x)] = Pr[x {0, 1} k ; x A(1 k, f d, f d (x)) f d (x ) = f d (x) x 1 0 x 1 ] Pr[x {0, 1} k x 1 0 x 1 ] + Pr[x {0, 1} k ; x A(1 k, f d, f d (x)) f d (x ) = f d (x) x 1 = 0 x 1 ] Pr[x {0, 1} k x 1 = 0 x 1 ] = Pr[x {0, 1} k ; x A(1 k, f d, f d (x)) f d (x ) = f d (x) x 1 0 x 1 ] (1 1 2 k/2 ) + Pr[x {0, 1} k ; x A(1 k, f d, f d (x)) f d (x ) = f d (x) x 1 = 0 x 1 ] Let ν(k) be the probabilit of inverting the one-wa function g. Then: c A (k) = 1 (1 1 1 ) + ν(k) 2k/2 2 k/2 = ν(k) 2k/2 2 k 2 Thus, A can invert f d with nonnegligible probabilit. 1 2 k/2 2 Fun with the Discrete Logarithm Recall that Z p is a cclic group of order p 1, which means it is of order 2i for some i Z. We claim that for a cclic group of order 2i generated b some generator g and some Homework 5 Solutions Page 4 / 7

5 number = g x, where x is unknown, it is possible to find the least significant bit of x. We do this b checking the value of i : Case 1: If the least significant bit of x is 0, then x = 2m for some value of m. Therefore, i = (g 2m ) i = (g 2i ) m. Because the group has order 2i, we know that g 2i = 1, so i = 1 m = 1. Case 2: If the least significant bit of x is 1, then x = 2m+1 for some value of m. Therefore, i = (g 2m+1 ) i = (g 2i ) m g i = 1 m g i = g i. Because the group has order 2i and g is a generator, we know that g i 1. Therefore, we know that if i = 1, the least significant bit of x is 0, and if i 1 then the least significant bit of x is 1. We use a recursive algorithm, Alg, to recover x bit b bit. Alg takes in integers k and i, g (a generator for the subgroup of Z 2 k +1 of order 2i), and = gx. Alg, on input (k, i, g, = g x ): 1. If i = 1 2, output 0 because in a group of order 1, the discrete log of an element is If i > 0, find LSB(x) as above, taking our cclic group of order 2i as the subgroup of Z generated b g. 2 k +1 Case 1: LSB(x) = 0. Then = g 2m for some m, so = (g 2 ) m. g 2 generates a subgroup of Z of order i. Therefore, to obtain m, we can call 2 k +1 Alg(k, i/2, g 2, ). We then output x = 2m. Case 2: LSB(x) = 1. Then = g 2m+1 for some m. Now consider = g 1 = g 2m+1 g 1 = g 2m = (g 2 ) m. g 2 generates a subgroup of Z of order i. Therefore, to obtain m, we can call Alg(k, i/2, g 2, ). We then output x = 2m + 2 k Finall, in order to obtain x, we can call Alg(k, 2 k 1, g, ). 3 Paillier Crptosstem a. Following the decrption algorithm, we have: R c α (mod N) ((1 + N) m r N ) α (mod N) (1 + N) mα r Nα (mod N) Homework 5 Solutions Page 5 / 7

6 However, b construction we have that 1 + N 1 (mod N), so: R r Nα (mod N) The value α was chosen such that Nα 1 (mod ϕ(n)). Thus, we finall have that: R r (mod N) Turning to the calculation of z, we note that: (1 + N) m Using this, we can compute: m i=0 ( m i )N i (mod N 2 ) 1 + mn + N 2 m ( m i=2 i )N i 2 (mod N 2 ) 1 + mn (mod N 2 ). z cr N (mod N 2 ) (1 + N) m r N r N (mod N 2 ) (1 + N) m (mod N 2 ) 1 + mn (mod N 2 ). Since m < N, we know 1 + mn < N 2, so we can treat this as an integer. Thus: M = z 1 N = 1 + mn 1 N = m Therefore, Dec(pk, sk, Enc(pk, m)) = m, so the Paillier crptosstem is correct. b. First note that c i (1 + N) m i r N i (mod N 2 ). Therefore: c 1 c 2 (1 + N) m 1+m 2 (r 1 r 2 ) N (mod N 2 ) So, if we let m m 1 + m 2 (mod N) and let r r 1 r 2 (mod N 2 ), then we see b the argument in part (a) that Dec(pk, sk, c 1 c 2 ) m m 1 + m 2 (mod n) c. Without loss of generalit, let us start with c 1 and attempt to scale b m 2. We note that: c m 2 1 ((1 + N) m 1 r N ) m 2 (mod N 2 ) (1 + N) m 1m 2 r Nm 2 (mod N 2 ) Homework 5 Solutions Page 6 / 7

7 So, if we let c c m 2 1 (mod N 2 ) and let r r m 2 (mod N), we see that: Therefore, b the logic in part (a): B smmetr, we have: c (1 + N) m 1m 2 r N Dec(pk, sk, c ) m 1 m 2 (mod n) Dec(pk, sk, c m 1 2 (mod N 2 )) m 2 m 1 m 1 m 2 (mod N) 4 Attacking the RSA Trapdoor Permutation a. Given f N,e (x) x e (mod N), we calculate (for fixed c) that: f N,e (cx) (cx) e (mod N) c e x e (mod N) c e f N,e (x) (mod N) Thus, we can multipl b c e mod N to get f N,e (cx). b. WLOG, assume that N 1 < N 2 < N 3. Since N 1, N 2, and N 3 are relativel prime, we can use the CRT on our given values: v 1 a 3 (mod N 1 ) v 2 a 3 (mod N 2 ) v 3 a 3 (mod N 3 ) to find some v a 3 (mod N 1 N 2 N 3 ). However, b assumption, a < N 1, and thus: a 3 < N 3 1 < N 1 N 2 N 3 Our result v can therefore be treated as a normal integer, and its cube root is a. Bonus: Under the same assumptions as our problem (specificall, that a < min({n 1,..., N e })), we need exactl e values. Homework 5 Solutions Page 7 / 7