120/CSCI CS E-177: Introduction to Cryptography Salil Vadhan and Alon Rosen Nov. 16, 2006
Lecture Notes 15: Public-Key Encryption in Practice
Recommended Reading.
1
KatzLindell, Sections 9.4, 9.5.3
Public-Key Encryption in Practice
All known public-key encryption schemes much slower than private-key ones and have much larger keys.
e.g. Plain RSA:
1000
slower than DES in hardware, and
100
slower in software (for
512-bit modulus).
Mainly used to exchange a session key for a private-key encryption scheme
encryption (see KatzLindell 9.4)
hybrid
RSA overwhelmingly most popular (despite not having security equivalent to factoring like Rabin):
Plain RSA: insecure Padding a 1-bit message with random bits: provably secure Padding longer mesages with random bits (PKCS #1 v 1.5 RSA): unproven but conjectured to be secure. Use a 88-bit random pad for 512-bit messages.
More sophisticated padding using cryptographic hash functions (PKCS #1 v 2, OAEP):
G is a PRG and H is a hash function. The encryption of m using a random pad R is (m G(R)||R H(m G(R)))e mod N . This can be proven to be secure (even against
chosen-ciphertext attack) in Random Oracle Model, which models the hash function as a random function, which it is not, so this is only a heuristic argument.
Encryption exponent 3: (change RSA assumption accordingly)
Discrete Log Based Schemes used in practice
DieHellman Key Exchange
Standardized in ANSI X9.42 Widely used in protocols to establish temporary keys for network communication, including SSH, HTTPS (SSL), and others.
ElGamal
No patent restrictions (RSA was patented) Used in free products, e.g. GNU Privacy Guard, PGP
1
Used in threshold crypto applications requiring distributed key generation (we may cover this later)
CramerShoup Encryption
Standardized in ISO 18033-2 Similar in spirit to ElGamal Requires a collision-resistant cryptographic hash function to be discussed later in the course Uses extra math (ciphertext and keys are longer) to achieve security under CCA (1998: rst practical algorithm to do so based on a standard complexity assumption; the earlier Dolev-Dwork-Naor work using trapdoor permutations requires random oracles.)
2
Malleability
Informally, an encryption scheme is malleable if given a ciphertext plaintext
c
that is an encryption of a
m
(and the public key), one can eciently generate a ciphertext
c
that is an encryption
of a transformation of of
m, that is, c E(f (m)).
(We recall that in a probabilistic encryption scheme
a message may have many valid encryptions.) In particular this can be done without any knowledge
m or the secret key.
Thus, it does not contradict the encryption scheme being secure in the sense
of having indistinguishable encryptions. Nevertheless, in some applications, malleability is a weakness. For example, in the context of a sealed-bid auction, an adversary observing another bid encrypted with a malleable algorithm could construct a more competitive bid without breaking the scheme or learning anything about the other bid. Many of the public-key encryption schemes we have seen are trivially malleable:
ElGamal: Encryption of
m
transform a ciphertext
(c1 , c2 ) = (g y , m hy ), with G, g G, h public encrypting m into an encryption of f (m) = 2m,
is
and
y
random. To
calculate
(c1 , c2 ) =
(c1 , 2 c2 ).
RSA, Rabin: Semantically secure encryption uses the hardcore bits of the a randomly selected
trapdoor permutation outputs
fk with c = (fk (x), bk (x) m)
trapdoor using
R t; pk = k, sk = t. Encryption chooses x Dk the hardcore bits bk (x). How is this malleable?
and
Plain RSA, Rabin: These are sometimes used directly in practice but they are not semantically
secure. Encryption is
c = me mod n,
with
n = p q; n
is public and
p, q
secret.
(Rabin
encryption is not equivalent to RSA with public exponent 2, but this attack applies to Rabin encryption: set
3m,
calculate
e = 2.) To transform a ciphertext encrypting m into an encryption of f (m) = c = 3e c mod n (3 m)e mod n.
It is no coincidence that ElGamal, RSA and Rabin encryption are all insecure under chosen ciphertext attack: any malleable encryption scheme allows an adversary to succeed in a chosen ciphertext attack by applying the transformation to the challenge setting, the adversary computes recover
c = E(m).
In one informal
f (m),
then nally inverts
c = f (c) = E(f (m)), f (m) to recover m.
queries the decryption oracle on
c
to
2
3
Homomorphic Encryption
It turns out that the properties that make encryption schemes malleable have an interesting benet: parties may want to compute valid encryptions of values that are a function of other encrypted values.
Denition 1 A homomorphic encryption scheme is dened by three polynomial-time algorithms
(G, E, D),
together with at least one pair of polynomial-time computable binary operations
,
on the plaintext space
P
and the ciphertext space
C,
respectively.
The key generation algorithm as input and returns a pair R n write (pk , sk ) G(1 ).
G is a randomized algorithm that takes a security parameter 1n (pk , sk ), where pk is the public key and sk is the secret key; we
is a stateless randomized algorithm that takes the public key
The encryption algorithm
value
E
pk
and a plaintext (aka message)
m
and outputs a ciphertext
c = Epk (m).
When a random help
r
is used in the encryption, we write
c = Epk (m, r). sk
or
or the random help value
The decryption algorithm ciphertext input.
D
is a deterministic algorithm (or pair of algorithms) that takes a
c = E(m, r)
and either the secret key
r
(if applicable)
and returns a plaintext
m.
We write
m = Dsk (c)
m = Dr (c),
respectively, depending on its
The encryption algorithm ciphertext space
E
is a homomorphism between the plaintext space
C
in the sense that if
c1 = E(m1 ) and c2 = E(m2 ), m
then
P and the c1 c2 E(m1 m2 ). c
can verify
The scheme must also satisfy the property that a verier who knows a ciphertext
c is a valid c = E(m, r).
that
encryption of
m,
given
and any random help value
r
in the encryption
We observe that our denition is slightly dierent from ordinary public-key encryption schemes by the explicit introduction of the random help value used in the probabilistic encryption and its function as a means for decryption. Exercise (think about this after the end of the lecture): Why don't we consider homomorphic private-key encryption schemes?
3.1
Homomorphic Schemes We Know
Of the public key encryption schemes we have already seen, their homomorphic properties correspond to the malleability weaknesses we described above:
ElGamal: Encryption of
m is (c1 , c2 ) = (g y , m hy ), with G, g G, h public and y random. Then y y y y y +y2 , m m hy1 +y2 ), given ciphertexts (g 1 , m1 h 1 ), (g 2 , m2 h 2 ), their pairwise product is (g 1 1 2 an encryption of m1 m2 .
Given ciphertexts
Plain RSA, Rabin: Encryption is
c = me mod n, with n = p q ; n is public and p, q secret. c1 = me , c2 = me , their product is (m1 m2 )e mod n, an encryption of 1 2 E(a) E(b) E(a b).
Cer-
m1 m2 .
We observe that these schemes are multiplicatively homomorphic: is standard addition and tainly this is useful, but it would be nice to have an additively homomorphic scheme such that
E(a) E(b) E(a + b)
for some operation
.
3
4
Paillier Encryption
Paillier's trapdoor function is an isomorphism
bN
mod
N 2 , where
eciently
f : ZN Z Z 2 given by f (a, b) = (1 + N )a N N N = pq for distinct odd primes p, q of equal length. This function f can be computed but inverting it is believed to be dicult without the factorization of N under a
be the message
the Composite Residuosity Assumption. One can encrypt directly using this trapdoor function by letting random help value
r.
Our scheme is thus dened by three polynomial-time algorithms
m and b the (G, E, D):
G: E: D:
Pick two Let
n-bit
primes
p, q .
Set
pk = N = p q , sk = (N ) = (p 1) (q 1).
help value
m ZN be the message to encrypt and obtain random EN (m, r) = (1 + N )m rN (1 + m N )rN mod N 2 . c
using
R r Z . N
Set
c =
To decrypt
c = c(N ) (1 + N )m(N ) (1 + m (N ) N ) mod N 2 c1 2 (by Fermat's Little Theorem). Then compute m = (N ) mod N and recover m = m /N . 2 2 (We cannot divide by N modulo N because N , which divides N , has no inverse.) N mod N 2 , then recover m = ( 1)/N . To decrypt c using r , compute c = c r c N 1 mod (N ) mod N . Anyone who knows the secret key sk can recover r from c; r = c (N ),
compute
4.1
The Decisional Composite Residuosity Assumption; Security of Paillier's Scheme
N c a random element of Z 2 . That is, (N, R ) (N, S), where N is a random Paillier modulus, N R, R are random elements of Z , and S, S are random elements of ZN 2 . N
Then, we observe the following three facts:
The DCRA assumption says a random
N th residue is computationally indistinguishable from
(N, (1 + N )m0 S) (N, (1 + N )m1 S ) c (pk , Epk (m0 )) (N, (1 + N )m0 RN (N, ) (1 + N )m0 S) c (pk , Epk (m1 )) (N, (1 + N )m1 R N ) (N, (1 + N )m1 S ).
These imply that
c
(pk , Epk (m0 )) (N, (1+N )m0 RN ) (N, (1+N )m1 R N ) (pk , Epk (m1 )),
c
that is, the Paillier scheme is semantically secure under the DCRA. This argument uses the general fact that multiplying a xed element of a group by a uniformly random element gives you a uniformly random element of the group.
Paillier made a related argument that a successful CPA attacker can break the DCRA. Specifically, assume m0 and m1 are two known messages and c is a ciphertext of either m0 or m1 . c E(m0 ) if and only if c (1 + N )m0 mod N 2 (which the adversary can compute) is an N th residue. Thus if an adversary has algorithm A(c, m0 ) that can identify whether c is an encryption of m0 with nonnegligible probability, he can use A to decide composite residuosity.
4
4.2
Homomorphic Properties of Paillier Encryption
One of the most attractive properties of the Paillier system is that it is additively homomorphic over plaintexts and also allows for multiplication of plaintexts by a constant. All of these primitives can be performed by anyone.
Addition:
Multiplication by a constant:
k Z (equivalent to mulN 1 mod N ). One can subtract two plaintexts via their ciphertexts c = E(m , r ), c = tiplying by k 1 1 1 2 E(m2 , r2 ). c1 c1 E(m1 m2 , r1 /r2 ) (mod N 2 ). 2 Even more complex primitives are possible. Given c1 = E(m1 , r1 ), c2 = E(m2 , r2 ), anyone who has the random help values r1 , r2 or the secret key sk can prove the following facts to a verier who has only c1 and c2 , revealing minimal information about m1 or m2 . (In your homework, you will be asked to show that the Equality proof reveals nothing about m1 and m2 by proving that any two
With these primitives, one can divide the plaintext by any constant pairs of ciphertexts are indistinguishable given only the quotient of their random help values.)
Equality: Since
verier veries that Range:
m1 m2 = 0, the Dr (c1 /c2 ) = m
for constant
prover reveals the single integer by checking that
r = r1 /r2 mod N . The (c1 /c2 ) (1 + N )0 rN rN (mod N 2 ).
m 1 < 2t < N
t
(see next subsection) (see papers cited below)
Product of Two Plaintexts: Inequality:
c3 = E(m1 m2 , r3 )
First prove
m1 m2 m1 , m2 < 2t where t is chosen so 2t < N/2. Then compute c3 = c1 /c2 = E(m1 m2 , r1 /r2 ), and prove, using c3 and the Range primitive, that (m1 m2 ) < 2t < N/2. This implies m1 m2 , because if not (m1 m2 ) would wrap around mod N and we could t t not prove (m1 m2 ) < 2 . (This necessarily reveals that m1 , m2 < 2 but nothing else.)
Some of these primitives and others are explored in detail in a paper A Generalisation, a Simplication and some Applications of Paillier's Probabilistic Public-Key System by Dmgard and Jurik (2001); other formulations are presented in Practical Secrecy-Preserving, Veriably Correct and Trustworthy Auctions by Parkes, Rabin, Shieber and Thorpe (2006).
4.2.1
Proof of Range
(This section is derived from the Parkes et al. paper cited above.) Given ciphertext need to prove that
c = E(m, r)
we
m < 2t
for some constant
t.
= E(m, r) is an encryption of a number x < 2t is a set of 2t randomly ordered encryptions, S = {G1 = E(u1 , s1 ), . . . , G2t = E(u2t , s2t )}, where t1 } appears among the u exactly once and the remaining t each of the powers of 2 {1, 2, . . . , 2 i values uj are all 0.
Denition 2 A valid test set
S
for the assertion c
5
S , the prover can prove that x < 2t as follows: t t be the representation of m, a sum of distinct powers of 2. The prover Let m = 2 1 + . . . + 2 t t selects randomly ordered encryptions Gj1 , . . . , Gj of 2 1 , . . . , 2 , and further t encryptions Gj +1 , . . . , Gjt of 0. The prover hands over these t encrypted bits, {Gj1 , . . . , Gjt }, to the verier. The prover also hands over the random help value that proves that the sum of the bits is equal to m, i.e., the original 2 random help value r divided (mod N ) by the product of all the random help values in these t bits' t encryptions: r = r/( i=1 sji ). The verier can now calculate the sum of the bits m by computing the product of the ent cryptions: c = E(m , s) = i=1 Gji and verifying that m = m by calculating and checking N (mod N 2 ). c/c E(m m , r/s) r
By use of such a test set This reveals nothing to the verier because she cannot tell whether particular bits represent 0 or 1, and the order given to her is random. However, there is a slight problem in that the verier cannot be sure that the test set containing the large number
2t
encryptions of 0 and 1 is well-formed.
To get around this, we employ what is called a cut and choose protocol. The prover creates a
2k
of sample test sets; the verier then asks the prover to unlock half (k ) of them The verier
by revealing the random help values used to encrypt each element in each test set. checks that each test set contains exactly from
t
encryptions of 0 and
t
encryptions of the powers of 2
20 . . . 2t1 . k
test sets that the verier chose to be revealed
The only way that the prover can cheat is if the were valid and the
k
remaining ones were invalid. The probability of such an unfortuitous choice is
2k 1 . For k
k = 20,
that probability is about
20 240
<
8 by Sterling's Theorem. 1012
5
5.1
Applications of Homomorphic Cryptography
Auctions
Gi...