the one time pad
DESCRIPTION
Online Cryptography Course Dan Boneh. Stream ciphers. The One Time Pad. Symmetric Ciphers: definition. Def : a cipher defined over is a pair of “efficient” algs ( E , D ) where E is often randomized. D is always deterministic. - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/1.jpg)
Dan Boneh
Stream ciphers
The One Time Pad
Online Cryptography Course Dan Boneh
![Page 2: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/2.jpg)
Dan Boneh
Symmetric Ciphers: definitionDef: a cipher defined over
is a pair of “efficient” algs (E, D) where
• E is often randomized. D is always deterministic.
![Page 3: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/3.jpg)
Dan Boneh
The One Time Pad (Vernam 1917)
First example of a “secure” cipher
key = (random bit string as long the message)
![Page 4: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/4.jpg)
Dan Boneh
The One Time Pad (Vernam 1917)
msg: 0 1 1 0 1 1 1
key: 1 0 1 1 0 1 0
CT:
⊕
![Page 5: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/5.jpg)
Dan Boneh
You are given a message (m) and its OTP encryption (c).
Can you compute the OTP key from m and c ?
No, I cannot compute the key.
Yes, the key is k = m ⊕ c.
I can only compute half the bits of the key.
Yes, the key is k = m ⊕ m.
![Page 6: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/6.jpg)
Dan Boneh
The One Time Pad (Vernam 1917)
Very fast enc/dec !! … but long keys (as long as plaintext)
Is the OTP secure? What is a secure cipher?
![Page 7: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/7.jpg)
Dan Boneh
What is a secure cipher?Attacker’s abilities: CT only attack (for now)
Possible security requirements: attempt #1: attacker cannot recover secret key
attempt #2: attacker cannot recover all of plaintext
Shannon’s idea: CT should reveal no “info” about PT
![Page 8: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/8.jpg)
Dan Boneh
Information Theoretic Security (Shannon 1949)
Def: A cipher (E, D) over () has perfect secrecy if
![Page 9: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/9.jpg)
Dan Boneh
Information Theoretic Security Def: A cipher (E, D) over () has perfect secrecy if
(|) and
Pr[ E(k, m0) = c] = Pr[ E(k, m1) = c] where R
![Page 10: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/10.jpg)
Dan Boneh
Lemma: OTP has perfect secrecy.Proof:
![Page 11: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/11.jpg)
Dan Boneh
Let and .
How many OTP keys map to ?
None
12
Depends on
![Page 12: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/12.jpg)
Dan Boneh
Lemma: OTP has perfect secrecy.Proof:
![Page 13: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/13.jpg)
Dan Boneh
The bad news …
Thm: perfect secrecy ⇒
![Page 14: The One Time Pad](https://reader035.vdocuments.net/reader035/viewer/2022062517/56812ce5550346895d91ac41/html5/thumbnails/14.jpg)
Dan Boneh
End of Segment