CS 4803
Computer and Network Security
Alexandra (Sasha) Boldyreva
Hard problems for public-key crypto.
Discrete log.
1
•As no encryption scheme besides the
OneTimePad is unconditionally secure, we need
to find some building blocks - hard problems
(assumptions about hardness of some
problems) to base security of our new
encryption schemes on.
•Block ciphers and their PRF security is not an
option since now we don’t have shared keys in
the public-key (asymmetric-key) setting.
•Let’s consider the discrete log related problems
and the RSA problem.
2
Discrete-log related problems
•Let G be a cyclic group and let m = |G|. The discrete
logarithm function DLogG,g(a): G ! Zm takes a G and returns
i Zm such that gi = a.
•There are several computational problems related to this
function:
•Discrete-logarithm (DL) problem
•Computational Diffie-Hellman (CDH) problem
•Decisional Diffie-Hellman (DDH) problem
2NUMBER-THEORETIC PRIMITIVES
Problem Given Figure out
Discrete logarithm (DL) gxx
Computational Diffie-Hellman (CDH) gx, gygxy
Decisional Diffie-Hellman (DDH) gx, gy, gzIs z≡xy (mod |G|)?
Figure 10.1: An informal description of three discrete logarithm related problems over a cyclic
group Gwith generator g. For each problem we indicate the input to the attacker, and what the
attacker must figure out to “win.” The formal definitions are in the text.
One might imagine “encrypting” a message x∈Zmby letting gxbe the ciphertext. An
adversary wanting to recover xis then faced with solving the discrete logarithm problem to do so.
However, as a form of encryption, this has the disadvantage of being non-functional, because an
intended recipient, namely the person to whom the sender is trying to communicate x, is faced
with the same task as the adversary in attempting to recover x.
The Diffie-Hellman (DH) problems first appeared in the context of secret key exchange. Suppose
two parties want to agree on a key which should remain unknown to an eavesdropping adversary.
The first party picks x$
←Zmand sends X=gxto the second party; the second party correspond-
ingly picks y$
←Zmand sends Y=gyto the first party. The quantity gxy is called the DH-key
corresponding to X, Y . We note that
Yx=gxy =Xy.(10.1)
Thus the first party, knowing Y, x, can compute the DH key, as can the second party, knowing X,y .
The adversary sees X, Y , so to recover the DH-key the adversary must solve the Computational
Diffie-Hellman (CDH) problem, namely compute gxy given X=gxand Y=gy. Similarly, we will
see later a simple asymmetric encryption scheme, based on Equation (10.1), where recovery of the
encrypted message corresponds to solving the CDH problem.
The obvious route to solving the CDH problem is to try to compute the discrete logarithm of
either Xor Yand then use Equation (10.1) to obtain the DH key. However, there might be other
routes that do not involve computing discrete logarithms, which is why CDH is singled out as a
computational problem in its own right. This problem appears to be computationally intractable
in a variety of groups.
We have seen before that security of a cryptographic scheme typically demands much more than
merely the computational intractability of recovery of some underlying key. The computational
intractability of the CDH problem turns out to be insufficient to guarantee the security of many
schemes based on DH keys, including the secret key exchange protocol and encryption scheme
mentioned above. The Decisional Diffie-Hellman (DDH) problem provides the adversary with a
task that can be no harder, but possibly easier, than solving the CDH problem, namely to tell
whether or not a given group element Zis the DH key corresponding to given group elements X, Y .
This problem too appears to be computationally intractable in appropriate groups.
We now proceed to define the problems more formally. Having done that we will provide more
specific discussions about their hardness in various different groups and their relations to each
other.
3
DL problem
•Def. Let G be a cyclic group and let m = |G|. Let g be a
generator. Consider the following experiment associated with
an adversary A.
•
•
•
•The dl-advantage of A is defined as the probability of the
above experiment outputting 1.
•
•The discrete logarithm problem is said to be hard in G if the
dl-advantage of any adversary with reasonable resources is
small.
Bellare and Rogaway 3
10.1.2 The discrete logarithm problem
The description of the discrete logarithm problem given above was that the adversary is given as
input some group element X, and is considered successful if it can output DLogG,g(X). We would
like to associate to a specific adversary Asome advantage function measuring how well it does in
solving this problem. The measure adopted is to look at the fraction of group elements for which
the adversary is able to compute the discrete logarithm. In other words, we imagine the group
element Xgiven to the adversary as being drawn at random.
Definition 10.1 Let Gb e a cyclic group of order m, let gbe a generator of G, and let Abe an
algorithm that returns an integer in Zm. We consider the following experiment:
Experiment Expdl
G,g(A)
x$
←Zm;X←gx
x←A(X)
If gx=Xthen return 1 else return 0
The dl-advantage of Ais defined as
Advdl
G,g(A) = Pr !Expdl
G,g(A) = 1".
Recall that the discrete exponentiation function takes input i∈Zmand returns the group element
gi. The discrete logarithm function is the inverse of the discrete exponentiation function. The
definition above simply measures the one-wayness of the discrete exponentiation function according
to the standard definition of one-way function. It is to emphasize this that certain parts of the
experiment are written the way they are.
The discrete logarithm problem is said to hard in Gif the dl-advantage of any adversary of
reasonable resources is small. Resources here means the time-complexity of the adversary, which
includes its code size as usual.
10.1.3 The Computational Diffie-Hellman problem
As above, the transition from the informal description to the formal definition involves considering
the group elements X, Y to be drawn at random.
Definition 10.2 Let Gb e a cyclic group of order m, let gbe a generator of G, and let Abe an
algorithm that returns an element of G. We consider the following experiment:
Experiment Expcdh
G,g(A)
x$
←Zm;y$
←Zm
X←gx;Y←gy
Z←A(X, Y )
If Z=gxy then return 1 else return 0
The cdh-advantage of Ais defined as
Advcdh
G,g(A) = Pr !Expcdh
G,g(A) = 1".
Again, the CDH problem is said to be hard in Gif the cdh-advantage of any adversary of reasonable
resources is small, where the resource in question is the adversary’s time complexity.
4
