Online Cryptography Course Dan Boneh Odds and ends Determinis0c Encryp0on Construc0ons: SIV and wide PRP Dan Boneh Determinis0c encryp0on Needed for maintaining an encrypted database index • Lookup records by encrypted index Determinis0c CPA security: • Security if never encrypt same message twice using same key: the pair (key , msg) is unique Formally: we defined determinis0c CPA security game Dan Boneh Construc0on 1: Synthe0c IV (SIV) Let (E, D) be a CPA-‐secure encryp0on E(k, m ; r) ⟶ c Let F:K × M ⟶ R be a secure PRF Define: Edet( (k1,k2) , m) = Thm: Edet is sem sec under det CPA Proof sketch: dis0nct msgs ⇒ all r’s are indist from random Well suited for messages longer than one AES block (16 bytes) Dan Boneh Ensuring ciphertext integrity Goal: det CPA security and ciphertext integrity ⇒ DAE: determinis=c authen=cated encryp=on Consider a SIV special case: SIV-‐CTR SIV where cipher is counter mode with rand IV k1 PRF F message CTR mode with PRF Fctr k2 Fctr(k2, IV) ll Fctr(k2, IV+1) ll … ll Fctr(k2, IV+L) IV ciphertext Dan Boneh Det Auth Enc (DAE) for free Decryp=on: IV k1 PRF F if ≠IV output ⊥ ciphertext CTR mode with PRF Fctr k2 Fctr(k2,IV) ll Fctr(k2, IV+1) ll … ll Fctr(k2,IV+L) message Thm: if F is a secure PRF and CTR from Fctr is CPA-‐secure then SIV-‐CTR from F, Fctr provides DAE Dan Boneh Construc0on 2: just use a PRP Let (E, D) be a secure PRP E: K × X ⟶ X Thm: (E,D) is sem sec under det CPA Proof sketch: let f: X ⟶ X be a truly random inver0ble func in EXP(0) adv sees: f(m1,0), …, f(mq,0) q random values in X in EXP(1) adv sees: f(m1,1), …, f(mq,1) Using AES: Det CPA secure encryp0on for 16 byte messages Longer messages?? Need PRPs on larger msg spaces … Dan Boneh EME: construc0ng a wide block PRP Let (E, D) be a secure PRP E: K × {0,1}n ⟶ {0,1}n EME: a PRP on {0,1}N for N ⨠ n x[0] x[1] x[2] ⨁ ⨁ ⨁ E E E ⨁ ⨁ E E E ⨁ ⨁ ⨁ y[0] y[1] y[2] E ⨁ Performance: • can be 2x slower then SIV Dan Boneh PRP-‐based Det Authen0cated Enc Goal: det CPA security and ciphertext integrity ⇒ DAE: determinis=c authen=cated encryp=on Encryp=on: message E(k, ⋅) ciphertext 80 00000 Decryp=on: ciphertext D(k, ⋅) message if ≠080 output ⊥ ……… Dan Boneh PRP-‐based Det Authen0cated Enc Let (E, D) be a secure PRP E: K × (X×{0,1}n) ⟶ X×{0,1}n Thm: 1/2n is negligible ⇒ PRP-‐based enc provides DAE Proof sketch: suffices to prove ciphertext integrity x1, … , xq ∈ X Chal π⟵Perms[X×{0,1}n] π (x1 0n), …, π(xq 0n) Adv c ∉ { π (x1 0n), …, π(xq 0n) } But then Pr[ LSBn( π-‐1(c) ) = 0n ] ≤ 1/2n Dan Boneh End of Segment Dan Boneh