CS 120/CSCI E-177: Introduction to Cryptography
Salil Vadhan and Alon Rosen Sept. 21 & 26, 2006
Lecture Notes 3:
Private-Key Encryption: Perfect Secrecy
Recommended Reading.
•
KatzLindell, Chapter 2.
1 Private-Key (aka Symmetric) Encryption
•
The setting for private-key encryption is the following: two parties share a
secret key
and want
to exchange messages
privately
over insecure channel. For now, we will not worry about how
they came to share the secret key.
•
Kerchkho's Principle: Assume encryption/decryption algorithms are known to adversary.
Only thing secret is the
key
.
•
For now, insecure channel means that adversary can
listen
to all messages sent, but cannot
inject/alter messages, i.e.
passive
rather than
active
.
•
Denition 1
A
(private-key) encryption scheme
consists of three algorithms
(G, E, D)
, as
follows:
The
key generation
algorithm
G
is a randomized algorithm that returns a
key
k∈ K
; we
write
k
R
←G
.
The
encryption algorithm
E
is a randomized algorithm that takes a key
k∈ K
and a
plaintext
(aka
message
)
m∈ P
and outputs a ciphertext
c∈ C
; we write
c
R
←Ek(m)
.
The
decryption algorithm
D
is a deterministic algorithm that takes a key
k∈ K
and a
ciphertext
c∈ C
and returns a plaintext
m∈ P
.
The
message space
P
is often the set of strings of a given length. The ciphertext space
C
does
not have to equal the plaintext space. We require
Dk(Ek(m)) = m
for all
m∈ P
.
•
The denition describes the functionalities of the encryption scheme but does not take security
into account yet. For example:
•
Examples:
Shift cipher (cf. Caesar cipher). The key is a random number:
k
R
← {0, . . . , 25}
, the mes-
sage space is
P={A, . . . , Z}`
(strings of length
`
over the English alphabet) so we can
see the message as
m∈ {0, . . . , 25}`
.
Ek(m1m2· · · m`) = c1c2· · · c`
, where
ci=mi+k
(mod 26)
.
1
