MATH456 — Midterm I
Front: definitions and game rules
Four reminders
Public algorithm 6= insecure scheme.
Pseudorandom 6= exactly uniform.
Confidentiality 6= integrity or replay prevention.
Secure primitive + reduction ⇒ secure construction.
Foundations and classical ciphers
Kerckhoffs: algorithms public; only the key secret. Large key space
alone does not establish security.
Encryption Π = (Gen, Enc, Dec) must satisfy
Deck (Enck (m)) = m.
Correctness: every valid key/message and encryption randomness. n:
security parameter; 1n : unary input of length n.
Caesar: ci = (mi + k) mod 26; 26 keys. Substitution: 26! keys, but
letter frequencies and repetition patterns survive.
Vigenère: repeat a t-character key. Split ciphertext into interleaved
groups
ci , ci+t , ci+2t , . . . (i = 1, . . . , t).
Each group: one shift. Test 26 shifts by frequencies; try candidate t if
unknown.
Perfect secrecy
For every prior distribution and all m, c with Pr[C = c] > 0,
Pr[M = m | C = c] = Pr[M = m].
Ciphertext adds no information; priors need not be uniform. Equivalent
test: for all m0 , m1 , c,
Pr[EncK (m0 ) = c] = Pr[EncK (m1 ) = c].
Probabilities include key generation and encryption coins. Conditional
probability: Pr[A | B] = Pr[A ∩ B]/ Pr[B].
Pr[C = c | M = m] Pr[M = m]
Pr[M = m | C = c] =
.
Pr[C = c]
Disproof: different ciphertext distributions. Shift cipher: “aa” gives
equal letters; “ab” never does.
Small example: c = (m + k) mod 4, with Pr[K = 0] = 1/2 and other
keys 1/6. Then Pr[C = 0 | M = 0] = 1/2, but Pr[C = 0 | M = 1] = 1/6:
not perfectly secret.
OTP and Shannon
XOR: x ⊕ x = 0, x ⊕ 0 = x; associative and commutative. For independent uniform k ∈ {0, 1}L ,
c = m ⊕ k,
m = c ⊕ k.
For each (m, c), unique k = m ⊕ c, hence Pr[C = c | M = m] = 2−L :
perfect secrecy.
Pad reuse:
c1 ⊕ c2 = m1 ⊕ m2 ,
m2 = c1 ⊕ c2 ⊕ m1 .
Multiple uses require fresh independent pads.
Key-space bound: |K| ≥ |M|. Fixed c: each key gives at most
one decryption. Perfect secrecy requires every message remain possible.
Counting example: 4 keys, 8 messages. One fixed c decrypts to at
most 4 messages; at least 4 ruled out. Under uniform prior, a ruled-out
message changes from probability 1/8 to 0. For L-bit messages, n < L
gives 2n < 2L .
Shannon (deterministic lecture setting): if |M| = |K| = |C|, perfect
secrecy iff
• Gen chooses keys uniformly;
• every (m, c) has exactly one k with Enck (m) = c.
Modular pad: c = (m+k) mod N ; uniform k; unique k = (c−m) mod N .
Public algorithm allowed!
Computational security
PPT: probabilistic polynomial time. Exponential exhaustive search may
succeed without breaking computational security.
ε is negligible iff for every constant a > 0,
eventually ε(n) < n−a .
√
Negligible: 2−n , 2−n/2 , 2− n . Not: n−100 , 1/ log n, 0.01. Counterexample: choose a = 101 for n−100 : n−100 /n−101 = n → ∞. Polynomial
× negligible is negligible; finite sums are negligible; non-negligible minus
negligible remains non-negligible.
Encryption games: permissions
A chooses equal-length m0 , m1 ; challenger chooses uniform b ∈ {0, 1},
returns c∗ ← Enck (mb ); A guesses b0 . Same key throughout.
Pr[b0 = b] ≤ 12 + negl(n).
Game Oracle access
EAV
None
CPA
Encryption, before/after challenge
CCA Encryption + decryption, before/after
MAC Tag generation
Restriction / goal
Guess challenge bit.
May query m0 , m1 ; guess bit.
Never decrypt exact c∗ ; guess
bit.
Valid tag for unqueried message.
Encryption win bound: 1/2 + negl; MAC win bound: negl. Tag oracle
returns a tag, not accept/reject.
Multiple EAV: two lists; one b selects entire list; corresponding lengths
equal; same key, fresh coins. CPA queries may repeat either challenge
message; A does not choose encryption coins.
CCA ⇒ CPA ⇒ multiple EAV ⇒ single EAV.
Deterministic stateless CPA attack: query m0 to obtain c0 . Guess
b = 0 iff c∗ = c0 . Correctness separates distinct plaintexts; wins with
probability 1. Randomization defeats this comparison, but alone is not
a security proof.
PRG: strings that look uniform
Efficient deterministic generator
G : {0, 1}n → {0, 1}ℓ(n) ,
ℓ(n) > n
with polynomial stretch. Uniform secret seed, public G. For every PPT
D,
Pr[D(G(Un )) = 1] − Pr[D(Uℓ(n) ) = 1] ≤ negl(n).
Not truly uniform: at most 2n outputs. An unbounded range test can
enumerate seeds.
Distinguishing gap compares output-1 probabilities, not certainties.
Under equal source priors, guessing advantage is half this gap (orient the
test appropriately).
PRF: functions that look random
Efficient keyed family Fk : {0, 1}n → {0, 1}n . Oracle Fk for uniform
secret k is computationally indistinguishable from a uniformly sampled
function f :
Pr[DFk = 1] − Pr[Df = 1] ≤ negl(n).
Random function: assign each input an independent uniform output
once. Repeated input returns the same value. Distinct inputs may
collide:
x 6= x0 =⇒ Pr[f (x) = f (x0 )] = 2−n .
PRF outputs need not be exactly uniform; the guarantee is computational. Example: if f (0011) = 1010, querying 0011 again returns 1010.
A different input also returns 1010 with probability 1/16.
PRP and strong PRP
Each Pk is a bijection; forward and inverse efficiently computable. Forward oracle looks like random permutation π.
Strong PRP: still indistinguishable with both forward and inverse
oracles, in both worlds.
Distinct inputs never collide for a permutation. Function/permutation
distinguishing gap is O(q 2 /2n ); secure PRP can serve as PRF for polynomially many forward queries.
One-way functions
Easy polynomial evaluation. For uniform x, every PPT inverter given
f (x) finds any x0 with f (x0 ) = f (x) only negligibly often. Original x not
required.
OWFs exist ⇐⇒ PRGs exist ⇐⇒ PRFs exist.
Equivalence of existence claims, not unconditional existence. Largefactor multiplication/factoring is a candidate hardness assumption.
MATH456 — Midterm I
Back: constructions, attacks, and reductions
Construction comparison
Scheme
OTP
PRG enc.
PRF enc.
ECB
CBC enc.
PRF-MAC
CBC-MAC
Stateful
Purpose / guarantee
Perfect secrecy
Single EAV
CPA secrecy
Block encryption; not CPA
CPA secrecy
Fixed-input authentication
Fixed-ℓ authentication
stream:
distinct
counter
inputs
replace
Encryption constructions
PRG encryption: k ← Un , |m| = ℓ(n).
c = G(k) ⊕ m,
m = G(k) ⊕ c.
CPA query 0ℓ(n) reveals G(k). Multiple-EAV attack: lists (0L , 0L ) vs
(0L , 1L ); equality of ciphertexts reveals chosen list.
PRF encryption: k ← Un ; fresh r ← Un each call; |m| = n.
c = (r, Fk (r) ⊕ m) .
Deck (r, s) = s ⊕ Fk (r).
r public; oracle chooses it, not A. Repeat r: s1 ⊕ s2 = m1 ⊕ m2 . Samemessage ciphertexts match with probability 2−n .
Stateful stream: lecture example has secret s, |IV | = 3n/4, n/4-bit
counter:
zi = Fs (IV khiin/4 ),
i < 2n/4 .
XOR with message block, increment i. Never repeat input under same
key: avoid IV reuse/counter wraparound.
ECB versus CBC encryption
Pk acts on one n-bit block; a mode handles ℓ blocks. One key selects
one fixed permutation.
ECB: ci = Pk (mi ); decrypt Pk−1 (ci ). Equal blocks give equal ciphertexts. Distinguish xkx vs xky by block equality; success 1. No chaining.
Unused random IV does nothing.
CBC: fresh random c0 = IV ;
Randomness; failure
Fresh uniform full-length pad; reuse leaks.
Random seed/key; fixed pad reuse leaks.
Fresh random r each call; repeat r repeats pad.
Deterministic; repeated blocks visible.
Fresh unpredictable IV; poor IV use can break secrecy.
Random key; deterministic tags; no replay protection.
Random key, zero start; mixing lengths unsafe.
per-block
randomness;
IV
reuse/wraparound
repeats
Reduction logic: conclusion
Secure primitive ⇒ secure construction. Premise: primitive secure. Temporarily assume a PPT attacker with non-negligible success/advantage. Build a PPT distinguisher contradicting premise. Reject attacker assumption, conclude construction secure.
Memory aid: “If attacker existed, primitive would break. Primitive
assumed secure, so successful PPT attacker cannot exist.” Secure allows
negligible success, not zero. Reduction is a conditional guarantee.
1. PRG ⇒ EAV encryption
A’s goal: guess encrypted message. D receives: string y. D knows:
chosen b, not seed or source of y.
D receives y, either G(Un ) or Uℓ(n) . Run A to get m0 , m1 ; choose
uniform b; send
c = y ⊕ mb .
Output 1 iff b0 = b. D knows b because D chose it; seed unnecessary.
• Real: exact encryption game, success 1/2 + ε.
• Uniform: OTP, success exactly 1/2.
Gap ε; non-negligible gap contradicts PRG security.
2. PRF ⇒ CPA encryption
A’s goal: win CPA game. D receives: oracle O. D knows: its b, r
values, not key or oracle identity.
D gets oracle O = Fk or random f . Every encryption query: sample r,
return (r, O(r)⊕m). Challenge: choose b, r∗ and return (r∗ , O(r∗ )⊕mb ).
Continue queries; output 1 iff b0 = b.
Real: exact CPA simulation; success 1/2 + ε. Ideal: distinct inputs give
independent uniform pads; bad event is nonce collision. For q oracle
encryptions plus challenge,
ci = Pk (mi ⊕ ci−1 ).
mi = Pk−1 (ci ) ⊕ ci−1 .
Send (c0 , . . . , cℓ ). Public IV unknown when plaintext chosen. Chaining
alone not proof; pad partial blocks.
MACs and fixed-length CBC-MAC
Correctness: Vrfyk (m, Mack (m)) = 1.
Standard: valid tag for unqueried message; new tag for old message
does not win.
Strong: any new valid pair, including old message with different tag.
Replay can be accepted; not automatically prevented.
Example: queried “pay 10”; forge valid tag for unqueried “pay 100” ⇒
win, even if tag repeats. Replay “pay 10” with old tag ⇒ not a winning
forgery.
PRF-MAC: Mack (m) = Fk (m); accept iff t = Fk (m). Unique valid
tag per message makes standard/strong coincide for this construction.
CBC-MAC: exactly ℓ blocks;
t0 = 0 n ,
ti = Fk (ti−1 ⊕ mi ).
Output only tℓ . Verify length |m| = ℓn first; otherwise reject. Recompute and compare. Fixed-length theorem does not give variable-length
security.
pads.
δ≤
q+1
2
2n
=
q(q + 1)
.
2n+1
Union bound: count pairs; each matches with probability 2−n . Polynomial q makes δ negligible. Ideal success ≤ 1/2+δ; gap ≥ ε−δ contradicts
PRF security.
3. PRF ⇒ fixed-length MAC
A’s goal: fresh-message forgery. D receives: oracle O. D knows:
queried-message list, not key or oracle identity.
D has oracle O. Tag query m: return O(m), record m. Output 1 for
(m∗ , t∗ ) iff
m∗ unqueried and t∗ = O(m∗ ).
No secret key or separate Verify needed. Real output probability ε,
actual forgery success. Ideal fresh tag independent uniform: success
≤ 2−n (equal if always outputs fresh valid-domain message).
gap ≥ ε − 2−n .
Non-negligible forgery contradicts PRF security; MAC secure if F
secure.
Attack and distinction reminders
Bad PRG: sks, test equal halves. Real 1, uniform 2−n ; gap 1 − 2−n .
G(s)k0, test last bit zero: gap 1 − 1/2 = 1/2.
CPA does not imply integrity:
(r, s) 7→ (r, s ⊕ ∆)
⇒
m 7→ m ⊕ ∆.
Changing a bit need not reveal its original value.
Answer checklist: attack permissions, messages, guess rule, probability; distinguisher test and both probabilities; proof simulations, ideal
bound, gap, efficiency, conditional conclusion.