170 likes | 303 Views
CIS 5371 Cryptography. 2. Perfect Secret Encryption B ased on: Jonathan Katz and Yehuda Lindel Introduction to Modern Cryptography. Encryption. encryption key decryption key. Encryption. Plaintext. Ciphertext. Decryption. Encryption schemes (ciphers). x. Encryption schemes.
E N D
CIS 5371 Cryptography 2. Perfect Secret Encryption Based on: Jonathan Katz and Yehuda Lindel Introduction to Modern Cryptography
Encryption encryption key decryption key Encryption Plaintext Ciphertext Decryption
Encryption schemes Definition An encryption scheme (Gen,Enc,Dec)over message space M is perfectly secret if for every probability distribution over M, every message mM, and every ciphertextcCfor which Pr[C = c] 0: Pr[M = m | C = c] = Pr[M = m] Convention: We consider only probability distributions over M, C that assign non-zero probabilities to all mM and cC.
Encryption schemes Lemma 1 An encryption scheme (Gen,Enc,Dec)over message space M is perfectly secret if and only if for every probability distribution over M, every message mM, and every ciphertext cC: Pr[C = c | M = m] = Pr[C = c]
Encryption schemes An equivalent definition for perfect secrecy
Shannon’s Theorem Theorem Let (Gen,Enc,Dec)be an encryption scheme over a message space M for which |M|= |K|=|C|. The scheme is perfectly secret if and only if: • Every key kK is chosen with equal probability 1/|K| by algorithm Gen. • For every mM and every cCthere is a unique key kK such that Enck(m) outputs c
Shannon’s Theorem Proof. We have Pr[C=c|M=m]=Pr[K=k] where c=mk, for any c,m, since the key k. Since the keys are chosen uniformly at random: Pr[C=c|M=m]=1/|K| for any mM. It follows that: Pr[C=c|M=m1] =Pr[C=c|M=m2], for any m1,m2 M
One-time pad Theorem The one time pad encryption scheme is perfectly secret.
One-time pad Proof (use Lemma 2) For any c C and m1, m2 M we have: Pr[C=c|M=m1]=Pr[k=k1]=1/|K| Pr[C=c|M=m2]=Pr[k=k2]=1/|K| It follows that: Pr[C=c|M=m1]=Pr[C=c|M=m2]
Limitations to perfect secrecy Theorem Let (Gen,Enc,Dec) be a perfectly secret encryption scheme over message space M, and let K be the key space as determined by Gen. Then |K| |M| .