PRF Security and Key-Randomness: Understanding the Connection - Prof. Mihir Bellare, Study notes of Computer Science

Download PRF Security and Key-Randomness: Understanding the Connection - Prof. Mihir Bellare and more Study notes Computer Science in PDF only on Docsity!

PSEUDO-RANDOM FUNCTIONS

Recall

We studied security of a block cipher against key recovery.

But we saw that security against key recovery is not sufficient to ensure that natural usages of a block cipher are secure.

We want to answer the question: What is a good block cipher? where “good” means that natural uses of the block cipher are secure.

We could try to define “good” by a list of necessary conditions:

• (^) Key recovery is hard
• Recovery of M from C = EK (M) is hard -...

But this is neither necessarily correct nor appealing.

Turing Intelligence Test

Q: What does it mean for a program to be “intelligent” in the sense of a human? Possible answers:

• (^) It can be happy
• (^) It recognizes pictures
• It can multiply
• (^) But only small numbers!

Turing Intelligence Test

Q: What does it mean for a program to be “intelligent” in the sense of a human? Possible answers:

• (^) It can be happy
• (^) It recognizes pictures
• It can multiply
• (^) But only small numbers!

Clearly, no such list is a satisfactory answer to the question.

Turing Intelligence Test

Behind the wall:

• Room 1: The program P
• (^) Room 0: A human

Turing Intelligence Test

Game:

• Put tester in room 0 and let it interact with object behind wall
• (^) Put tester in rooom 1 and let it interact with object behind wall
• Now ask tester: which room was which?

Turing Intelligence Test

Game:

• (^) Put tester in room 0 and let it interact with object behind wall
• Put tester in rooom 1 and let it interact with object behind wall
• (^) Now ask tester: which room was which? Clarification: Room numbers are in our head, not written on door!

Real versus Ideal

Notion Real object Ideal object Intelligence Program Human PRF Block cipher?

Random functions

A random function with L-bit outputs is implemented by the following box Fn, where T is initially ⊥ everywhere:

Fn

Caller

x (^) -

^ T[x]

If T[x] = ⊥ then T[x] ← {$ 0 , 1 }L Return T[x]

Random function

Game Rand{ 0 , 1 }L procedure Fn(x) if T[x] = ⊥ then T[x] ← {$ 0 , 1 }L return T[x]

Adversary A

• (^) Make queries to Fn
• Eventually halts with some output

We denote by Pr

[

RandA { 0 , 1 }l ⇒ d

]

the probability that A outputs d

Random function

Game Rand{ 0 , 1 } 3 procedure Fn(x) if T[x] = ⊥ then T[x] ← {$ 0 , 1 }^3 return T[x]

adversary A y ← Fn(01) return (y = 000)

Pr

[

RandA { 0 , 1 } 3 ⇒ true

]

= 2−^3

Random function

Game Rand{ 0 , 1 } 3 procedure Fn(x) if T[x] = ⊥ then T[x] ← {$ 0 , 1 }^3 return T[x]

adversary A y 1 ← Fn(00) y 2 ← Fn(11) return (y 1 = 010 ∧ y 2 = 011)

Pr

[

RandA { 0 , 1 } 3 ⇒ true

]

Random function

Game Rand{ 0 , 1 } 3 procedure Fn(x) if T[x] = ⊥ then T[x] ← {$ 0 , 1 }^3 return T[x]

adversary A y 1 ← Fn(00) y 2 ← Fn(11) return (y 1 ⊕ y 2 = 101)

Pr

[

RandA { 0 , 1 } 3 ⇒ true

]

Random function

Game Rand{ 0 , 1 } 3 procedure Fn(x) if T[x] = ⊥ then T[x] ← {$ 0 , 1 }^3 return T[x]

adversary A y 1 ← Fn(00) y 2 ← Fn(11) return (y 1 ⊕ y 2 = 101)

Pr

[

RandA { 0 , 1 } 3 ⇒ true

]

= 2−^3