Shannon s Theory. Objectives

Transcription

1 Shannon Theory Debdeep Mukhopadhyay IIT Kharagpur Objective Undertand the definition of Perfect Secrecy Prove that a given crypto-ytem i perfectly ecured One Time Pad Entropy and it computation Ideal Cipher Equivocation of Key

2 Unconditional Security Concern the ecurity of cryptoytem when the adverary ha unbounded computational power, that i ha infinite reource. Cipher-text only Attack: Attack the cipher uing the cipher text only. When i a cipher i unconditionally ecured? A priori and A poteriori Probabilitie The plain-text ha a probability ditribution p P (x): A priori probability of a plain text The key alo ha a probability ditribution p K (K): A priori probability of the key. The cipher text i generated by applying the encryption function. Thu y=e K (x) i the cipher text. Note, that the plain text and the key are independent ditribution.

3 Attacker want to compute a poteriori probability of plain text The probability ditribution on P and K, induce a probability ditribution on C, the cipher text. For a key K, C K (x)={e K (x): x Є P} Doe the cipher text leak information about the plain text? Given, the cipher text y, we hall compute the a poteriori probability of the plain text, ie. p P (x y) and ee whether it matche with that of the a priori probability of the plain text. Example a K a b b K K 3 K K 3 K K 3 K 3 4 K P={a,b}; p P (a)=/4, p P (b)=3/4 K={K,K }, p K (K )=/, p K (K )= p K (K 3 )=/4 C={,,3,4}. What the a poteriori probabilitie of the plain text, given the cipher text from C? 3

4 b a Example K K K 3 K K 3 K P={a,b}; p P (a)=/4, p P (b)=3/4 K={K,K }, p K (K )=/, p K (K )= p K (K 3 )=/4 3 4 p C ()=p P (a)p K (K ) =(/4).(/)=/8 p C (3)=p P (a)p K (K 3 ) +p P (b) p K (K ) =(/4)(/4)+(3/4)(/4)=/ 6+3/6=/4 Likewie I can compute the other probabilitie b a Example K K K 3 K K 3 K P={a,b}; p P (a)=/4, p P (b)=3/4 K={K,K }, p K (K )=/, p K (K )= p K (K 3 )=/4 3 4 p P (a )=;p P (b )=0 p P (a )=? The can come when the plain text wa a and the key wa K or when the plain text wa b and the key wa K Given, we need to compute the probability that it came from a. I it that of chooing K? No. 4

5 b a Example K K K 3 K K 3 K P={a,b}; p P (a)=/4, p P (b)=3/4 K={K,K }, p K (K )=/, p K (K )= p K (K 3 )=/4 3 4 Given, we need to compute the probability that it came from a. The can appear with a probability: by having a a the PT and K a the key: (/4)(/4)=/6 by having b a the PT and K a the key: (3/4)(/)=6/6 p P (a )=(/6)/(7/6)=/7 Generalization of the Example p P ( x y) = p () x p ( K) P { Ky : C( K)} Kx : = d ( y) K K p ( K) p ( d ( y)) K P K 5

6 Perfect Secrecy A Cryptoytem ha perfect ecrecy if p P (x y)=p P (x) for all x Є P, y Є C. That i the a poteriori probability that the plaintext i x, given that the cipher text y i oberved, i identical to the a priori probability that the plaintext i x. Shift Cipher ha perfect ecrecy Suppoe the 6 key in the Shift Cipher are ued with equal probability /6. Then for any plain text ditribution, the Shift Cipher ha perfect ecrecy. Note that P=K=C=Z 6 and for 0 K 5 Encryption function: y=e K (x)=(x+k)mod 6 6

7 Perfect Secrecy p P ( x y) = pp( x) pc( y x) p ( y) p ( y) = p ( K) p ( d ( y)) C K P K K Z 6 = pp ( y K) = 6 6 K Z 6 p ( y x) = P ( y x mod 6) C K = 6 Hence Proved C Theorem Suppoe (P,C,K,E,D) be a cryptoytem, where K = C = P. The cryptoytem offer perfect ecrecy if and only if every key i ued with probability / K, and for every xєp and every y ЄC, there i a unique key, uch that y=e K (x). Perfect Secrecy (equivalent): p C (y x)=p C (y) Thu if Perfect Secret, a cheme ha to follow the above equation. 7

8 Cryptographic Propertie p C (y x)>0 Thi mean that for every cipher text, there i a key, K, t. y=e K (x) Thu K C. In our cae, K = C Thu, there i no cipher text, y, for which there are two key which take them to the ame plaintext. There i exactly one key, uch that y=e K (x) One-time Pad e= h=00 i=00 k=0 l=00 r= = t= Encryption: Plaintext Key = Ciphertext h e i l h i t l e r Plaintext: Key: Ciphertext: r l h t h r 8

9 One-time Pad Suppoe a wrong key i ued to decrypt: r l h t h r Ciphertext: key : Plaintext : k i l l h i t l e r e= h=00 i=00 k=0 l=00 r= = t= One-time Pad And thi i the correct key: r l h t h r Ciphertext: Key : Plaintext : h e l i k e i k e e= h=00 i=00 k=0 l=00 r= = t= 9

10 Unconditionally ecured cheme For a given ciphertext of ame ize a the plaintext, there i a equi-probable key that produce it. Thu the cheme i unconditionally ecured. Practical Problem Large quantitie of random key are neceary. Increae the problem of key ditribution. Thu we will continue to earch for cipher where one key can be ued to encrypt a large tring of data and till provide computational ecurity. Like DES (Data Encryption Standard) 0

11 One-time Pad Summary Provably ecure, when ued correctly Cipher-text provide no information about plaintext All plaintext are equally likely Pad mut be random, ued only once Pad i known only by ender and receiver Pad i ame ize a meage No aurance of meage integrity Why not ditribute meage the ame way a the pad? Entropy Reviited P={a,b}; p P (a)=/4, p P (b)=3/4 K={K,K,K 3 }, p K (K )=/, p K (K )= p K (K 3 )=/4 What i H(P)? H(P)=(/4)log (4)+(3/4)log (4/3) 0.8 H(K).5 H(C).85

12 Huffman Encoding Conider S: a dicrete ource of ymbol The meage from S: {,,,k} Can we encode thee meage uch that their average length i a hort a poible, and hopefully equal to H(S)? Huffman Code provide an optimal olution to thi problem. Informal Decription The meage et X ha a probability ditribution. Arrange them in acending order: p(x) p(x) p(x3) p(xj) Initially the code of each element are empty. Chooe the two element with minimum probabilitie Merge them into a new letter, ay x with probability a the um of x and x. Encode the maller letter 0 and the larger. When only one element remain, the code of each letter can be contructed by reading the equence backward.

13 Example X={a,b,c,d,e} p(a)=.05, p(b)=.0, p(c)=., p(d)=.3, p(e)=.6 a Illutration of the encoding b c d e c x a b f(x) d e 0 0 3

14 Some more reult on Entropy X and Y are random variable. H(X,Y) H(X)+H(Y) When X and Y are independent: H(X,Y)=H(X)+H(Y) Conditional Entropy: H(X Y)=-Σp(x y)log p(x y) H(X,Y)=H(Y)+H(X Y) H(X Y) H(X) When X and Y are independent: H(X Y)=H(X) Theorem Let (P,C,K,D,E) be an encryption algorithm. Then H(K C)=H(K)+H(P)-H(C) Proof: H(P,K)=H(C,K) [why?] or, H(P)+H(K) = H(K C)+H(C) or, H(K C)=H(K)+H(P)-H(C) Equivocation (ambiguity) of key given the ciphertext 4

15 Perfect v Ideal Cipher H(P)=H(C), then we have H(K C)=H(K) That i the uncertainty of the key given the cryptogram i the ame a that of the key without the cryptogram. Such kind of cipher are called ideal cipher For perfect cipher, we had H(P)=H(P C) or, equivalently H(C)=H(C P) Perfect v Ideal Cipher For perfect cipher, the key ize i infinite if the meage ize i infinite. however if a horter key ize i ued then the cipher can be attacked by omeone with infinite computational power. Thu, H(K C) give u thi idea of ecurity (or, inecurity) 5

16 Unicity and Brute Force Attack Q: How to protect data againt a brute force attacker with infinite computation power? Shannon defined unicity ditance (we hall call it unicity), a the leat amount of plaintext which can be deciphered uniquely from the correponding ciphertext: given unbounded reource by the attacker. Often meaured in unit of byte, letter, ymbol. An Important Point A common miconception: any cipher can be attacked by exhautively trying all poible key : Thu DES which ha a 56 bit key can alo be broken by brute force. But if the cipher i ued within it unicity then even DES i theoretically ecured, like the One Time Pad (OTP). 6

17 Spuriou Key Thu, H(K C) i the amount of uncertainty that remain of the key after the cipher text i revealed. We know, it i called the key equivocation Attacker to gue the key from the ciphertext hall gue the key and decrypt the cipher. He check whether the plaintext obtained i meaningful Englih. If not, he rule out the key. But due to the redundancy of language more than one key will pa thi tet. Thoe key, apart from the correct key, are called puriou. Entropy of Plain Text H L : meaure of the amount of information per letter of meaningful tring of plaintext. A random tring of plaintext formed uing Englih letter ha an entropy of log But Englih letter have a probability ditribution. 7

18 Frequency of Englih letter A firt order entropy of the Englih text i H(P) 4.76 In general Succeive letter have correlation, which reduce the entropy. Define P L to be the random variable that ha a probability ditribution of n-gram of plaintext Define H L a the entropy of a natural language L: H L = lim n H( Pn ) n 8

19 Fraction of exce letter Redundancy R L HL = log P For Englih Language, H L.5. Conidering H L =.5, and P =6, R L Englih Language i 75% redundant. Entropy of the language Entropy of the random language A lower Bound of equivocation of key P n : r.v repreenting n-gram plaintext C n : r.v repreenting n-gram ciphertext H(K C n )=H(K)+H(P n )-H(C n ) H(P n ) nh L (auming large n) =n(-r L )log P H(C n ) nlog C If P = C, H(K C n ) H(K)-nR L log P 9

20 Poible Key Define, K(y)={poible key given that y i the ciphertext} that i K(y) i the et of thoe key for which y i the ciphertext for meaningful plaintext When y i the ciphertext, number of key i K(y) Out of them, only one i correct. Ret are puriou. So, number of puriou key= K(y) - Expected number of puriou key Expected number of puriou key=average number of puriou key over all poible ciphertext i denoted by n. = p( y)( K( y) ) n n y C =( py ( ) Ky ( ) ) n y C 0

21 Computing the upper bound of equivocation of key n HKC ( ) = pyhk ( ) ( y) n y C n y C n y C pyhky ( ) ( ( )) py ( )log ( Ky ( ) ) log ( py ( ) Ky ( ) ) = log ( + ) n y C n Lower Bound of puriou key Combining the previou reult: HK ( ) nrllog P log ( n+ ) log ( n+ ) HK ( ) nrllog P If the key are choen equi-probably: H(K)=log K. Hence, we have: n K nrl P

22 Unicity Ditance Thu increaing n, reduce the number of puriou key. Unicity Ditance i the number of ciphertext, n 0 for which the number of puriou key i reduced to zero. n n = 0 log K R log P L Thi calculation may not be accurate for large value of n Unicity Ditance for Subtitution Cipher P =6 K =6! 4 x 0 6, R L =0.75 n 0 =5 (approx) Given a ciphertext tring of length 5, it i poible to predict the correct key uniquely Thu key ize alone doe not guarantee ecurity, if brute force i poible to an attacker with infinite computational power.

23 Aignment Let n be a poitive integer. A Latin quare of order n i an nxn array L with integer,,,n uch that every integer occur exactly once in each row and column. An example for n=3 i: Aignment Given any Latin quare of order n, we can define a related cryptoytem, e i (j)=l(i,j), where i,j n. Prove from the computation of probabilitie that the Latin quare cryptoytem achieve perfect ecrecy. Deadline for ubmiion: Pleae ubmit hand written proof. 3