Acknowledge
3.1 Prove Proposition 3.6 .
看定義Definition 3.4 ，若函數f f f p ( ⋅ ) p(\cdot) p ( ⋅ ) N N N n > N n > N n > N f ( n ) < 1 / p ( n ) f(n) < 1 / p(n) f ( n ) < 1 / p ( n ) n e g l 1 \mathsf{negl}_1 n e g l 1 n e g l 2 \mathsf{negl}_2 n e g l 2 N 1 N_1 N 1 N 2 N_2 N 2 p ( ⋅ ) p(\cdot) p ( ⋅ ) n > N 1 n > N_1 n > N 1 n e g l 1 ( n ) < 1 / p ( n ) \mathsf{negl}_1(n) < 1 / p(n) n e g l 1 ( n ) < 1 / p ( n ) n > N 2 n > N_2 n > N 2 n e g l 2 ( n ) < 1 / p ( n ) \mathsf{negl}_2(n) < 1 / p(n) n e g l 2 ( n ) < 1 / p ( n ) N 1 N_1 N 1 N 2 N_2 N 2 N N N n > N n > N n > N n e g l 1 + n e g l 2 < 2 / p ( n ) \mathsf{negl}_1 + \mathsf{negl}_2 < 2 / p(n) n e g l 1 + n e g l 2 < 2 / p ( n )
3.3 Prove that Definition 3.8 cannot be satisfied if Π \Pi Π not restricted to output equal-length messages in experiment P r i v k A , Π e a v ( λ ) Privk^{eav}_{\mathcal{A}, \Pi}(\lambda) P r i v k A , Π e a v ( λ )
由於加密算法是公開的，查看代碼，推測Π \Pi Π p ( λ ) p(\lambda) p ( λ ) p ( λ ) = 8 p(\lambda) = 8 p ( λ ) = 8 p ( λ ) p(\lambda) p ( λ ) 2 1 + 2 2 + ⋅ + 2 p ( λ ) = 2 ⋅ ( 1 − 2 p ( λ ) ) 1 − 2 = 2 p ( λ ) + 1 − 2
2^1+2^2 + \cdot + 2^{p(\lambda)}= \frac{ 2 \cdot (1 - 2^{p(\lambda)})}{1 -2} = 2^{p(\lambda) + 1} - 2
2 1 + 2 2 + ⋅ + 2 p ( λ ) = 1 − 2 2 ⋅ ( 1 − 2 p ( λ ) ) = 2 p ( λ ) + 1 − 2 p ( λ ) p(\lambda) p ( λ ) A \mathcal{A} A ∣ m 0 ∣ = 1 |m_0|=1 ∣ m 0 ∣ = 1 ∣ m 1 ∣ = p ( λ ) + 1 |m_1|=p(\lambda)+1 ∣ m 1 ∣ = p ( λ ) + 1 ∣ c 0 ∣ ≤ p ( λ ) |c_0| \leq p(\lambda) ∣ c 0 ∣ ≤ p ( λ ) ∣ c 1 ∣ > p ( λ ) |c_1| > p(\lambda) ∣ c 1 ∣ > p ( λ ) b b b ∣ m 1 ∣ |m_1| ∣ m 1 ∣
通俗一點，若明文0和1被長度上界爲p ( λ ) p(\lambda) p ( λ ) A \mathcal{A} A ∣ m 1 ∣ > p ( λ ) |m_1|>p(\lambda) ∣ m 1 ∣ > p ( λ )
3.4 Say Π = ( G e n , E n c , D e c ) \Pi = (Gen, Enc, Dec) Π = ( G e n , E n c , D e c ) k ∈ { 0 , 1 } n k \in \{ 0, 1\}^n k ∈ { 0 , 1 } n E n c k Enc_k E n c k ℓ ( n ) \ell(n) ℓ ( n ) ℓ \ell ℓ Definition 3.8 even when the adversary is not restricted to output equal-length messages in experiment P r i v K A , Π e a v ( λ ) PrivK^{eav}_{\mathcal{A}, \Pi}(\lambda) P r i v K A , Π e a v ( λ )
有限定消息長度上界就好辦了，回顧題目3.3，假若密文長度上界爲p ( λ ) p(\lambda) p ( λ ) p ( λ ) p(\lambda) p ( λ ) A \mathscr{A} A 0 ℓ − ∣ m ∣ − 1 1 0^{\ell - |m| - 1}1 0 ℓ − ∣ m ∣ − 1 1 ℓ − ∣ m ∣ − 1 \ell - |m| - 1 ℓ − ∣ m ∣ − 1 m m m
假定Π ′ = ( G e n ′ , E n c ′ , D e c ′ ) \Pi' = (Gen', Enc', Dec') Π ′ = ( G e n ′ , E n c ′ , D e c ′ )
G e n ( 1 λ ) → k Gen(1^\lambda) \to k G e n ( 1 λ ) → k k ← G e n ′ ( 1 λ ) k \gets Gen'(1^\lambda) k ← G e n ′ ( 1 λ ) k k k E n c ( k , m ) → c Enc(k, m) \to c E n c ( k , m ) → c m ′ = 0 ℓ − ∣ m ∣ − 1 1 ∣ ∣ m m' = 0^{\ell - |m| - 1}1 || m m ′ = 0 ℓ − ∣ m ∣ − 1 1 ∣ ∣ m c ′ ← E n c ′ ( k , m ′ ) c' \gets Enc'(k, m') c ′ ← E n c ′ ( k , m ′ ) c : = c ′ c := c' c : = c ′ D e c ( k , c ) → m Dec(k, c) \to m D e c ( k , c ) → m m ′ : = D e c ′ ( k , c ) m' := Dec'(k, c) m ′ : = D e c ′ ( k , c ) 0 ℓ − ∣ m ∣ − 1 1 0^{\ell - |m| - 1}1 0 ℓ − ∣ m ∣ − 1 1 m m m m m m
利用規約，易證Π \Pi Π A \mathcal{A} A
3.7 Assuming the existence of a pseudorandom function, prove that there exists an encryption scheme that has indistinguishable multiple encryptions in the presence of an eavesdropper (i.e., is secure with respect to Definition 3.18 ), but is not CPA-secure (i.e., is not secure with respect to Definition 3.21 ).
我們基於Construction 3.24 來構造這麼一個滿足多次加密竊聽不可區分性、卻不滿足CPA安全的加密方案Π \Pi Π
G e n ( 1 λ ) → k Gen(1^\lambda) \to k G e n ( 1 λ ) → k 1 λ 1^\lambda 1 λ k 1 ← { 0 , 1 } λ k_1 \gets \{ 0, 1\}^\lambda k 1 ← { 0 , 1 } λ k 2 ← { 0 , 1 } λ k_2 \gets \{ 0, 1\}^\lambda k 2 ← { 0 , 1 } λ k = < k 1 , k 2 > k = \big<k_1, k_2\big> k = ⟨ k 1 , k 2 ⟩ E n c ( k , m ) → c Enc(k, m) \to c E n c ( k , m ) → c k = < k 1 , k 2 > k = \big<k_1, k_2\big> k = ⟨ k 1 , k 2 ⟩ m ∈ { 0 , 1 } λ m \in \{0, 1\}^\lambda m ∈ { 0 , 1 } λ r ← { 0 , 1 } λ r \gets \{0, 1\}^\lambda r ← { 0 , 1 } λ c : = { 1 , k 2 , r , F k 2 ( r ) ⊕ m , if m = k 1 0 , k 1 , r , F k 2 ( r ) ⊕ m , otherwise
c := \begin{cases}
1, k_2, r, F_{k_2}(r) \oplus m, ~ \text{if} ~ m = k_1 \\
0, k_1, r, F_{k_2}(r) \oplus m, ~ \text{otherwise}
\end{cases}
c : = { 1 , k 2 , r , F k 2 ( r ) ⊕ m , if m = k 1 0 , k 1 , r , F k 2 ( r ) ⊕ m , otherwise D e c ( k , c ) → m Dec(k, c) \to m D e c ( k , c ) → m k = < k 1 , k 2 > k = \big<k_1, k_2\big> k = ⟨ k 1 , k 2 ⟩ c = < c 1 , c 2 , c 3 , c 4 > c = \big<c_1, c_2, c_3, c_4\big> c = ⟨ c 1 , c 2 , c 3 , c 4 ⟩ m : = F k 2 ( c 3 ) ⊕ c 4 m := F_{k_2}(c_3) \oplus c_4 m : = F k 2 ( c 3 ) ⊕ c 4
易證該方案不滿足CPA安全，敵手A \mathcal{A} A m ← { 0 , 1 } λ m \gets \{ 0, 1\}^\lambda m ← { 0 , 1 } λ O E n c ( ⋅ ) \mathcal{O}_{Enc}(\cdot) O E n c ( ⋅ ) c = < c 1 , c 2 , c 3 , c 4 > c = \big<c_1, c_2, c_3, c_4\big> c = ⟨ c 1 , c 2 , c 3 , c 4 ⟩ m ′ = c 2 m' = c_2 m ′ = c 2 c ′ = < c 1 ′ , c 2 ′ , c 3 ′ , c 4 ′ > c' = \big<c'_1, c'_2, c'_3, c'_4\big> c ′ = ⟨ c 1 ′ , c 2 ′ , c 3 ′ , c 4 ′ ⟩ A \mathcal{A} A k : = < c 2 , c 2 ′ > k := \big<c_2, c'_2\big> k : = ⟨ c 2 , c 2 ′ ⟩ k : = < c 2 ′ , c 2 > k:= \big<c'_2, c_2 \big> k : = ⟨ c 2 ′ , c 2 ⟩ c 1 = ? 0 c_1 \overset{?}{=} 0 c 1 = ? 0
但是該方案滿足多次加密竊聽不可區分性，主要證明思路如下：嘗試攻破方案Π \Pi Π A \mathcal{A} A m 0 = { m 0 0 , m 0 1 , ⋯ , m 0 q ( λ ) } \bm{m}_0 = \{ m^0_0, m^1_0, \cdots, m^{q(\lambda)}_0 \} m 0 = { m 0 0 , m 0 1 , ⋯ , m 0 q ( λ ) } m 1 = { m 1 0 , m 1 1 , ⋯ , m 1 q ( λ ) } \bm{m}_1 = \{ m^0_1, m^1_1, \cdots, m^{q(\lambda)}_1 \} m 1 = { m 1 0 , m 1 1 , ⋯ , m 1 q ( λ ) } k 1 ∈ m 0 ∪ m 1 k_1 \in \bm{m}_0 \cup \bm{m}_1 k 1 ∈ m 0 ∪ m 1 A \mathcal{A} A k 2 k_2 k 2 2 q ( λ ) / 2 λ 2q(\lambda) / 2^\lambda 2 q ( λ ) / 2 λ A \mathcal{A} A Construction 3.24 的CPA安全挑戰遊戲，該事件發生的概率同樣是可忽略函數（注意0 , k 1 0,k_1 0 , k 1 m b m_b m b
3.10 Let G G G G ′ ( s ) G'(s) G ′ ( s ) G G G n n n ∣ s ∣ = n |s| = n ∣ s ∣ = n F k ( x ) = G ′ ( k ) ⊕ x F_k(x) = G'(k) \oplus x F k ( x ) = G ′ ( k ) ⊕ x
分辨器D \mathcal{D} D x x x x ′ x' x ′ y y y y ′ y' y ′ x ⊕ x ′ = ? y ⊕ y ′ x \oplus x' \overset{?}{=} y \oplus y' x ⊕ x ′ = ? y ⊕ y ′ O \mathcal{O} O x ⊕ x ′ = y ⊕ y ′ x \oplus x' = y \oplus y' x ⊕ x ′ = y ⊕ y ′ 1 / 2 λ 1 / 2^\lambda 1 / 2 λ O \mathcal{O} O F k ( ⋅ ) F_k(\cdot) F k ( ⋅ ) x ⊕ x ′ = y ⊕ y ′ x \oplus x' = y \oplus y' x ⊕ x ′ = y ⊕ y ′
3.14 Let F F F ( G e n , E n c , D e c ) (Gen, Enc, Dec) ( G e n , E n c , D e c ) m ∈ { 0 , 1 } n / 2 m \in \{0, 1\}^{n/2} m ∈ { 0 , 1 } n / 2 k ∈ { 0 , 1 } n k \in \{0, 1\}^n k ∈ { 0 , 1 } n E n c Enc E n c r ← { 0 , 1 } n / 2 r \gets \{0, 1\}^{n/2} r ← { 0 , 1 } n / 2 n / 2 n/2 n / 2 c : = F k ( r ∣ ∣ m ) c := F_k(r || m) c : = F k ( r ∣ ∣ m ) n / 2 n/2 n / 2 F F F strong pseudorandom permutation.) What are the advantages and disadvantages of this construction as compared to Construction 3.24 ?
假設F F F 高效的 、帶密鑰的置換函數，那麼存在概率多項式時間算法可以分別計算F k ( x ) F_k(x) F k ( x ) F k − 1 ( y ) F_k^{-1}(y) F k − 1 ( y )
G e n ( 1 λ ) → k Gen(1^\lambda) \to k G e n ( 1 λ ) → k 1 λ 1^\lambda 1 λ k ← { 0 , 1 } λ k \gets \{0, 1\}^\lambda k ← { 0 , 1 } λ E n c ( k , m ) → c Enc(k, m) \to c E n c ( k , m ) → c k k k m ∈ { 0 , 1 } λ / 2 m \in \{ 0, 1\}^{\lambda / 2} m ∈ { 0 , 1 } λ / 2 r ← { 0 , 1 } λ / 2 r \gets \{ 0, 1\}^{\lambda / 2} r ← { 0 , 1 } λ / 2 c : = F k ( r ∣ ∣ m ) c := F_k(r || m) c : = F k ( r ∣ ∣ m ) D e c ( k , c ) → m Dec(k ,c) \to m D e c ( k , c ) → m k k k c c c x : = F k − 1 ( c ) x := F^{-1}_k(c) x : = F k − 1 ( c ) λ / 2 \lambda / 2 λ / 2 m m m
（定理） 若F F F
證明. 記上述加密方案爲Π \Pi Π A \mathcal{A} A ε ( λ ) \varepsilon(\lambda) ε ( λ )
現引入一個證明用的加密方案Π ~ = ( G e n ~ , E n c ~ , D e c ~ ) \widetilde{\Pi} = (\widetilde{Gen}, \widetilde{Enc}, \widetilde{Dec}) Π = ( G e n , E n c , D e c )
G e n ~ ( 1 λ ) → k \widetilde{Gen}(1^\lambda) \to k G e n ( 1 λ ) → k 1 λ 1^\lambda 1 λ k ← { 0 , 1 } λ k \gets \{0, 1\}^\lambda k ← { 0 , 1 } λ E n c ~ ( k , m ) → c \widetilde{Enc}(k, m) \to c E n c ( k , m ) → c k k k m ∈ { 0 , 1 } λ / 2 m \in \{ 0, 1\}^{\lambda / 2} m ∈ { 0 , 1 } λ / 2 r ← { 0 , 1 } λ / 2 r \gets \{ 0, 1\}^{\lambda / 2} r ← { 0 , 1 } λ / 2 c : = f ( r ∣ ∣ m ) c := f(r || m) c : = f ( r ∣ ∣ m ) f f f D e c ~ ( k , c ) → m \widetilde{Dec}(k, c) \to m D e c ( k , c ) → m f f f f − 1 f^{-1} f − 1
當f f f c c c c c c A \mathcal{A} A Π ~ \widetilde{\Pi} Π 1 / 2 1 / 2 1 / 2
注意到ε ( λ ) \varepsilon(\lambda) ε ( λ ) 1 / 2 1/2 1 / 2 D \mathcal{D} D F k F_k F k f f f
當A \mathcal{A} A m m m r ← { 0 , 1 } λ / 2 r \gets \{0, 1\}^{\lambda/2} r ← { 0 , 1 } λ / 2 m ∣ ∣ r m || r m ∣ ∣ r O F k / f \mathcal{O}_{F_k / f} O F k / f c c c A \mathcal{A} A
當A \mathcal{A} A m 0 , m 1 m_0, m_1 m 0 , m 1 b ← { 0 , 1 } b \gets \{0, 1\} b ← { 0 , 1 } r ← { 0 , 1 } λ / 2 r \gets \{0, 1\}^{\lambda / 2} r ← { 0 , 1 } λ / 2 r ∣ ∣ m b r || m_b r ∣ ∣ m b C F k / f \mathcal{C}_{F_k / f} C F k / f c c c A \mathcal{A} A
與A \mathcal{A} A A \mathcal{A} A b ′ b' b ′ b = b ′ b = b' b = b ′ C F k / f \mathcal{C}_{F_k / f} C F k / f 1 1 1 C F k / f \mathcal{C}_{F_k / f} C F k / f 0 0 0
注意，Π \Pi Π Π ~ \widetilde{\Pi} Π A \mathcal{A} A F k / f F_k / f F k / f F k F_k F k A \mathcal{A} A b ′ b' b ′ A \mathcal{A} A Π \Pi Π b ′ b' b ′ O F k / f \mathcal{O}_{F_k / f} O F k / f F k F_k F k A \mathcal{A} A Π \Pi Π O F k / f \mathcal{O}_{F_k / f} O F k / f f f f A \mathcal{A} A Π ~ \widetilde{\Pi} Π ∣ 1 2 − ε ( λ ) ∣ > n e g l ( λ ) ，
\Big| \frac{1}{2} - \varepsilon(\lambda) \Big| > negl(\lambda)，
∣ ∣ ∣ 2 1 − ε ( λ ) ∣ ∣ ∣ > n e g l ( λ ) ， F k F_k F k Π \Pi Π
要證明CCA安全，就需要開放解密諭言機，注意強僞隨機置換 的定義，∣ P r [ D F k ( ⋅ ) , F k − 1 ( ⋅ ) ( 1 λ ) = 1 ] − P r [ D f ( ⋅ ) , f − 1 ( ⋅ ) ( 1 λ ) = 1 ] ∣ ≤ n e g l ( λ ) ，
\Big| Pr [\mathcal{D}^{F_k(\cdot), F^{-1}_k(\cdot)}(1^\lambda) = 1] - Pr [\mathcal{D}^{f(\cdot), f^{-1}(\cdot)}(1^\lambda) = 1] \Big| \leq negl(\lambda)，
∣ ∣ ∣ P r [ D F k ( ⋅ ) , F k − 1 ( ⋅ ) ( 1 λ ) = 1 ] − P r [ D f ( ⋅ ) , f − 1 ( ⋅ ) ( 1 λ ) = 1 ] ∣ ∣ ∣ ≤ n e g l ( λ ) ，
3.16 Consider a variant of CBC-mode encryption where the sender simply increments the I V IV I V 1 1 1 I V IV I V not CPA-secure.
這裏假設I V IV I V 0000 0000 0 0 0 0 A \mathcal{A} A m = 0000 m = 0000 m = 0 0 0 0 I V ⊕ m = 0000 IV \oplus m = 0000 I V ⊕ m = 0 0 0 0 c = F k ( 0 ) c = F_k(0) c = F k ( 0 ) I V = 0001 IV = 0001 I V = 0 0 0 1 A \mathcal{A} A m 0 = 0001 m_0 = 0001 m 0 = 0 0 0 1 m 1 = 0000 m_1 = 0000 m 1 = 0 0 0 0 c b c_b c b c = c b c = c_b c = c b b ′ = 0 b' = 0 b ′ = 0 b ′ = 1 b' = 1 b ′ = 1 F k ( r ) F_k(r) F k ( r ) r r r
3.21 Let Π 1 = ( G e n 1 , E n c 1 , D e c 1 ) \Pi_1 = (Gen_1, Enc_1, Dec_1) Π 1 = ( G e n 1 , E n c 1 , D e c 1 ) Π 2 = ( G e n 2 , E n c 2 , D e c 2 ) \Pi_2 = (Gen_2, Enc_2, Dec_2) Π 2 = ( G e n 2 , E n c 2 , D e c 2 ) Π \Pi Π Π 1 \Pi_1 Π 1 Π 2 \Pi_2 Π 2
加密方案Π \Pi Π
G e n ( 1 λ ) → k Gen(1^\lambda) \to k G e n ( 1 λ ) → k k 1 ← G e n 1 ( 1 λ ) k_1 \gets Gen_1(1^\lambda) k 1 ← G e n 1 ( 1 λ ) k 2 ← G e n 2 ( 1 λ ) k_2 \gets Gen_2(1^\lambda) k 2 ← G e n 2 ( 1 λ ) k : = ( k 1 , k 2 ) k := (k_1, k_2) k : = ( k 1 , k 2 ) E n c ( k , m ) → c Enc(k, m) \to c E n c ( k , m ) → c c ′ ← E n c 1 ( k 1 , m ) c' \gets Enc_1(k_1, m) c ′ ← E n c 1 ( k 1 , m ) c ← E n c 2 ( k 2 , c ′ ) c \gets Enc_2(k_2, c') c ← E n c 2 ( k 2 , c ′ ) D e c ( k , c ) → m Dec(k, c) \to m D e c ( k , c ) → m m : = D e c 1 ( k 1 , D e c 2 ( k 2 , c ) ) m := Dec_1(k_1, Dec_2(k_2, c)) m : = D e c 1 ( k 1 , D e c 2 ( k 2 , c ) )
易知，P r [ A wins ] ≤ P r [ A wins ∧ ( Π 1 is CPA-secure ) ] + P r [ A wins ∧ ( Π 2 is CPA-secure ) ] Pr[\mathcal{A} ~ \text{wins}] \leq Pr[\mathcal{A} ~ \text{wins} \land (\Pi_1 ~ \text{is CPA-secure})] + Pr[\mathcal{A} ~ \text{wins} \land (\Pi_2 ~ \text{is CPA-secure})] P r [ A wins ] ≤ P r [ A wins ∧ ( Π 1 is CPA-secure ) ] + P r [ A wins ∧ ( Π 2 is CPA-secure ) ] 規約 的人能夠很快地寫出安全性證明，這裏不再擴展。
3.22 Show that the CBC, OFB, and counter modes of encryption do not yield CCA-secure encryption schemes (regardless of F).
書中已經給出解釋：
Specifically, any encryption scheme that allows ciphertexts to be manipulated in any logical way cannot be CCA-secure.
直覺上，這些方案不能達到CPA安全是因爲解密諭言機造不出來（規約時無法使用邏輯方式 模擬出解密算法）。這裏詳細分析爲何這些方案不能達到CPA安全：
在CBC模式中，A \mathcal{A} A m 0 = 0 λ m_0 = 0^\lambda m 0 = 0 λ m 1 = 1 λ m_1 = 1^\lambda m 1 = 1 λ c b c_b c b c b c_b c b I V IV I V c ′ c' c ′ c ′ c' c ′ m ′ m' m ′ 0 λ − 1 ∣ ∣ 1 0^{\lambda-1} || 1 0 λ − 1 ∣ ∣ 1 1 λ − 1 ∣ ∣ 0 1^{\lambda-1} || 0 1 λ − 1 ∣ ∣ 0
在OFB和CTR模式中，A \mathcal{A} A c b ( 1 ) c_b^{(1)} c b ( 1 )
回顧題目3.14 的加密方案，它能夠達到CCA安全，注意翻轉c c c 第四章 中，則是通過引入消息鑑別碼（HMAC）來阻止敵手manipulates the ciphertexts in a logical way，從而使得方案達到CCA安全。
