PRPsandPRFs.pptVIP

PRPs and PRFs CS255: Winter 2008 PRPs and PRFs Pseudo Random Function (PRF) defined over (K,X,Y): F: K ? X ? Y such that exists “efficient” algorithm to eval. F(k,x) Pseudo Random Permutation (PRP) defined over (K,X): E: K ? X ? X such that: 1. Exists “efficient” algorithm to eval. E(k,x) 2. The func E( k, ? ) is one-to-one 3. Exists “efficient” algorithm for inverse D(k,x) Running example Example PRPs: 3DES, AES, … AES: K ? X ? X where K = X = {0,1}128 Functionally, any PRP is also a PRF. A PRP is a PRF where X=Y and is efficiently invertible. Secure PRFs Let F: K ? X ? Y be a PRF Funs[X,Y]: the set of all functions from X to Y SF = { F(k,?) s.t. k ? K } ? Funs[X,Y] Intuition: a PRF is secure if  a random function in Funs[X,Y] is indistinguishable from  a random function in SF Secure PRF: defintion For b=0,1 define experiment EXP(b) as: Def: F is a secure PRF if for all “efficient” A: PRF Adv[A,F] = |Pr[EXP(0)=1] – Pr[EXP(1)=1] | is “negligible.” Secure PRP For b=0,1 define experiment EXP(b) as: Def: E is a secure PRP if for all “efficient” A: PRP Adv[A,E] = |Pr[EXP(0)=1] – Pr[EXP(1)=1] | is “negligible.” Example secure PRPs Example secure PRPs: 3DES, AES, … AES: K ? X ? X where K = X = {0,1}128 AES PRP Assumption: All 280–time algs A have PRP Adv[A, AES] 2-40 PRF Switching Lemma Any secure PRP is also a secure PRF. Lemma: Let E be a PRP over (K,X)  Then for any q-query adversary A: | PRF Adv[A,E] - PRP Adv[A,E] | q2 / 2|X| ? Suppose |X| is large so that q2 / 2|X| is “negligible” Then PRP Adv[A,E] “negligible” ? PRF Adv[A,E] “negligible” Using PRPs and PRFs Goal: build “secure” encryption from a PRP. Security is always defined using two parameters: 1. What “power” does adversary have?