Encryption

An encryption scheme consists of four efficient algorithms: Setup Setup, key generation KeyGen,encryption Enc and decryption Dec.

Definition 2.11. An encryption ENC scheme is determined by four algorithms:

• Setup: On input of a security parameter τ, this algorithm outputs a set P of public parameters that will be used by following algorithms, together with a key space K, a message space M and a ciphertext space C.

• KeyGen: On input of the public parameters P and the key space K, this algorithm outputs a pair of random keys (Ke, Kd)∈ K, where Ke is the encryption key and Kd is the corresponding decryption key.

• Enc: On input of a message m∈ Mand the encryption key K_e, this algorithm outputs a ciphertext c∈ C.

• Dec: On input of a ciphertext c∈ C and the decryption key K_d, this algorithm outputs a message m∈ M if the decryption succeeds; otherwise it outputs ⊥.

An encryption has to satisfy the following:

c=EncKe(m)⇔m=DecK_d(c)

2. CRYPTOGRAPHY FUNDAMENTALS

Definition 2.12. A symmetric-key encryption schemeENC_symis an encryption scheme where Ke=Kd.

Definition 2.13. A public-key encryption scheme ENC_pub is an encryption scheme where Ke 6= Kd. Ke is called public key and usually denoted pk and Kd is called secret key and usually denoted sk.

Note that public key encryption schemes enable any partyA to send encrypted messages to another party B that only B can decrypt, without any prior agreement. Contrary to symmetric key encryption schemes where the parties A and B have to agree beforehand on an encryption key.

Next, we review the definitions of secure encryption that will be referenced in the remain-der of this manuscript.

As proposed by Bellare et al. (11), we organize definitions by considering first the adver-sarial goal and then the attack model. As a result, security definitions are obtained as“a pairing of a particular adversarial goal and a particular attack model”(11).

Given an encryption scheme ENC and a challenge ciphertext c encrypted using the en-cryption keyKe, we consider two adversarial goals:

• One-wayness OW: The goal of an adversaryAis to decryptcwithout having access to the decryption keyKd.

• Indistinguishability IND: The goal of an adversary A is to tell whether a challenge ciphertextcencrypts a messagem0 or whether it encrypts a messagem1 with a proba-bility significantly larger than one half, wherem₀ and m₁ are two messages inMthat were chosen byA. Indistinguishability formalizes the inability of adversaryA to learn any information about the plaintextm underlying the ciphertextc.

In addition to the adversarial goals, we consider two attack models depending on the information provided to the adversary A. In order of increasing strength, these are: chosen plaintext attack andchosen ciphertext attack.

• Chosen plaintext attack CPA: An adversary A can encrypt any message of his choice.

To this effect, A has access to an encryption oracle O^Enc, that when given a plaintext m and an encryption keyK_e returns c=Enc_Ke(m).

• Chosen ciphertext attack CCA: Besides being able to query the encryption oracleOEnc

with messages of his choice, adversaryA has access to a decryption oracle ODec, that when given a ciphertextcand a decryption keyKdreturnsm=Dec_Kd(c). AdversaryA is allowed to queryODec with ciphertexts of his choice except for the challenge ciphertext c.

14

2.2 Cryptographic Primitives If adversary A uses the decryption oracle only before obtaining the challenge cipher-textc, then the attack model is called non-adaptive chosen ciphertext attack (CCA1).

Otherwise, the attack model is called adaptive chosen ciphertext attack (CCA2).

Consequently, we obtain six security models: OW-CPA, OW-CCA1, OW-CCA2, IND-CPA, IND-CCA1 and IND-CCA2. These security models are defined using interactive games in accordance with the work of Bellare et al. (11):

Definition 2.14. Let ENC = (Setup,KeyGen,Enc,Dec) be an encryption scheme, and let A(re, rd, se, sd, ǫ) be an adversary against the one wayness ofENC.

The OW-ATK∈ {OW-CPA, OW-CCA1, OW-CCA2}game consists of four phases:

• Learning-1: Adversary A makes a polynomial number of queries re to the encryption oracle OEnc and r_d queries to the decryption oracle ODec.

• Challenge: ChallengerCpicks at random a messagem∈ Mand returns the challenge ciphertext c=Enc_Ke(m) to adversary A.

• Learning-2: Adversary A makes a polynomial number of queries s_e to the encryption oracle OEnc and sd queries to the decryption oracle ODec, with the restriction that he cannot query the decryption oracle ODec with the challenge ciphertext c.

• Guess: Adversary A outputs a guess m^′.

Adversary A is said to win the OW-ATK game if m=m^′, where OW-ATK= OW-CPA, ifr_d=s_d= 0.

OW-ATK= OW-CCA1, if r_d6= 0 and s_d= 0.

OW-ATK= OW-CCA2, if s_d6= 0.

The advantage ǫof adversary A in winning the OW-ATK game is defined as:

ǫ=Pr(A wins)

Definition 2.15. An encryption ENC = (Setup,KeyGen,Enc,Dec) is said to be OW-ATK secure, iff for any adversary A(re, se, r_d, s_d, ǫ), the advantage ǫ in winning the OW-ATK game is negligible.

Definition 2.16. Let ENC= (Setup,KeyGen,Enc,Dec) be an encryption scheme, and let A (r_e, r_d, s_e, s_d, ǫ) be an adversary against the indistinguishability of ENC.

The IND-ATK∈ {IND-CPA, IND-CCA1, IND-CCA2} game consists of four phases:

• Learning-1: Adversary A makes a polynomial number of queries re to the encryption oracle O^Enc and r_d queries to the decryption oracle O^Dec.

• Challenge: Adversary A provides challenger C with two messages m₀ and m₁ in M. Challenger C flips a fair coin b ∈ {0,1}, then returns the challenge ciphertext c_b = Enc_Ke(mb) to adversary A.

2. CRYPTOGRAPHY FUNDAMENTALS

• Learning-2: Adversary A makes a polynomial number of queries s_e to the encryption oracle OEnc and sd queries to the decryption oracle ODec, with the restriction that he cannot query the decryption oracle ODec with the challenge ciphertext c_b.

• Guess: Adversary A outputs a guessb^′.

Adversary A is said to win the IND-ATK game if b=b^′, where IND-ATK = IND-CPA, if r_d=s_d= 0.

IND-ATK = IND-CCA1, ifrd6= 0 and sd= 0.

IND-ATK = IND-CCA2, ifsd6= 0.

The advantage ǫ of adversaryA in winning the IND-ATK game is defined as:

ǫ=Pr(A wins)−1