170 likes | 318 Vues
This document explores perfect secret encryption schemes as defined by Jonathan Katz and Yehuda Lindell in "Introduction to Modern Cryptography". It delves into the mechanics of encryption systems, discussing essential concepts such as plaintext, ciphertext, and key generation. The paper outlines Shannon's theorem, which establishes criteria for perfect secrecy, emphasizing equal probability key selection and the uniqueness of keys for message-ciphertext pairs. It also addresses limitations of these systems, ensuring a comprehensive understanding of perfect secrecy within cryptography.
E N D
CIS 5371 Cryptography 2. Perfect Secret Encryption Based on: Jonathan Katz and Yehuda Lindel Introduction to Modern Cryptography
Encryption encryption key decryption key Encryption Plaintext Ciphertext Decryption
Encryption schemes Definition An encryption scheme (Gen,Enc,Dec)over message space M is perfectly secret if for every probability distribution over M, every message mM, and every ciphertextcCfor which Pr[C = c] 0: Pr[M = m | C = c] = Pr[M = m] Convention: We consider only probability distributions over M, C that assign non-zero probabilities to all mM and cC.
Encryption schemes Lemma 1 An encryption scheme (Gen,Enc,Dec)over message space M is perfectly secret if and only if for every probability distribution over M, every message mM, and every ciphertext cC: Pr[C = c | M = m] = Pr[C = c]
Encryption schemes An equivalent definition for perfect secrecy
Shannon’s Theorem Theorem Let (Gen,Enc,Dec)be an encryption scheme over a message space M for which |M|= |K|=|C|. The scheme is perfectly secret if and only if: • Every key kK is chosen with equal probability 1/|K| by algorithm Gen. • For every mM and every cCthere is a unique key kK such that Enck(m) outputs c
Shannon’s Theorem Proof. We have Pr[C=c|M=m]=Pr[K=k] where c=mk, for any c,m, since the key k. Since the keys are chosen uniformly at random: Pr[C=c|M=m]=1/|K| for any mM. It follows that: Pr[C=c|M=m1] =Pr[C=c|M=m2], for any m1,m2 M
One-time pad Theorem The one time pad encryption scheme is perfectly secret.
One-time pad Proof (use Lemma 2) For any c C and m1, m2 M we have: Pr[C=c|M=m1]=Pr[k=k1]=1/|K| Pr[C=c|M=m2]=Pr[k=k2]=1/|K| It follows that: Pr[C=c|M=m1]=Pr[C=c|M=m2]
Limitations to perfect secrecy Theorem Let (Gen,Enc,Dec) be a perfectly secret encryption scheme over message space M, and let K be the key space as determined by Gen. Then |K| |M| .