2201-COL759

IIT Delhi Lecture 4 Venkata K

1 Last Lecture
In the last lecture, we discussed that any encryption scheme (Enc, Dec) with key space K and
message space M that satisfies perfect correctness and perfect secrecy (as per Definition 02.04
in Lecture 02) must have |K| ≥ |M|.
Next, we discussed that a reasonable relaxation of the security definition is to require security
against efficient adversaries, instead of requiring security against ALL adversaries. To define
security against efficient adversaries, we introduce a security parameter — an integer n that
indicates how secure the system will be. We introduced a special key generation algorithm
KeyGen that takes the security parameter as input, and outputs the secret key. All algorithms
(KeyGen, Enc and Dec) as well as the adversary, must have running time bounded by poly(n).
We then formulated security in terms of a security game between a challenger and an adver-
sary. Security games in general, capture two things:

• what information is the adversary receiving?

• what is the adversary trying to achieve using this information?
Below, we define a security game for the attack scenario where the adversary receives a single
ciphertext, and wants to learn some information about the underlying message.

No-Query-Semantic-Security

1. Adversary sends two messages m0 , m1 to the challenger.

2. The challenger chooses a bit b ← {0, 1}, key k ← K and sends Enc(mb , k) to the adversary.
3. The adversary sends its guess b′ , and wins the security game if b = b′ .

Figure 1: The No-Query Semantic Security Game

Intuitively, if an encryption scheme is secure, then for any probabilistic1 polynomial time
algorithm A, the probability of A winning the above security game should be small. How small
do we want this probability to be? Clearly, if we require that this probability is too small (say
close to 0), then even the best encryption scheme will not satisfy this definition. Consider an
adversary that outputs a random bit b′ in the final step of the security game. This adversary
wins with probability 1/2 (and the adversary is an efficient algorithm). Our security definition
will along these lines, but we need to figure out the correct threshold.

2 An efficient adversary that wins with probability p > 1/2

Let K = {0, 1}n and M = {0, 1}ℓ , where ℓ > n. We will now present an adversary that can
win the security game with probability p > 1/2. The adversary sets message m0 = 0n , chooses
m1 uniformly at random, and sends them to the challenger. On receiving a ciphertext ct, the
adversary picks a uniformly random key k ′ ← K, and checks if Dec(ct, k ′ ) = m0 or m1 . If the
decryption is equal to either m0 or m1 , then the adversary outputs 0 or 1 accordingly. If the
decryption outputs neither m0 nor m1 , then the adversary simply outputs a uniformly random
bit b′ .
1 A probabilistic algorithm A takes the input x, samples a random string r and performs some computation

that depends on x and r. In this course, all security games will involve prob. algorithms. Therefore, in the
analysis, we should also take the algorithm’s randomness into consideration.
 In this security game (and most security games that we’ll see from now on) the adversary can
‘guess’ the key used by the challenger, and this guess is correct with some non-zero probability.
The crucial issue here is that the adversary must somehow ‘check’ whether its guess is correct
or not (in order to decide whether to go with the decryption, or to output a random bit). This
checking makes the analysis a bit complicated. In our case, the adversary, in order to check if
the guessed key is the same as the one chosen by the challenger, tries to decrypt the challenge
ciphertext. If the decryption outputs neither m0 nor m1 , then the adversary concludes that its
guessed key is not same as the challenger’s key, and it outputs a random bit. If the decryption
was either m0 or m1 , the adversary concludes that its guess is correct, and outputs 0 or 1
accordingly. Note that this conclusion may be wrong – maybe the challenge ciphertext was an
encryption of m0 using key k0 (chosen by the challenger), but the adversary chose a key k1 such
that the challenge ciphertext is also an encryption of m1 under k1 . In this case, the adversary
will (wrongly) conclude that its guessed key is the correct key. However, we will see below that
the adversary still wins the game with probability strictly greater than 1/2 (albeit only slightly
greater than 1/2).
1
Claim 04.01. The success probability of the above described adversary is at least 2 + Ω( 21n ).

Proof. We present our analysis only for the case ℓ > 3n. The analysis for the general case is left
as an exercise.
Recall m0 = 0n . Fix the challenger’s key k. We will prove that for any choice of key k,
h i
Pr A wins the No-Query-Semantic-Security game ≥ 1/2 + Ω(1/2n )

where, the probability is taken over the random choices of: message m1 (chosen by A), bit b
(chosen by the challenger), key k ′ (chosen by A), and bit b′ (chosen by A). If the above inequality
holds for all keys k, it will hold even if k was chosen at random.

For this proof, we consider the following bad event:

BadEventk := the randomly chosen message m1 is such that there exists a key k ′ satisfying
Enc(m0 , k) = Enc(m1 , k ′ ).
This event captures the ‘bad event’ where decrypting Enc(m0 , k) (using a different key k ′ ) can
output message m1 . The probability of this bad event (where the probability is over the choice of
m1 ) is very small since |K| ≪ |M|. In particular, since m0 and k are fixed, let ct = Enc(m0 , k).
Then note that there are at most |K| messages that map to ct (using the perfect correctness of
encryption scheme). Therefore,

Pr[BadEventk ] ≤ |K|/|M| ≤ 2−2n .

Let us now compute the success probability of A. We have,

h i h i h i
Pr A wins ∧ ¬BadEventk = Pr A wins |¬BadEventk · Pr ¬BadEventk (1)
h i h i
Let us focus on Pr A wins | ¬BadEventk , since Pr ¬BadEventk is close to 1. If the bad
event does not happen, and the adversary’s key k ′ is not equal to k, then the decryption cannot
output m1 . This observation is used to simplify the probability of A winning, conditioned on
¬BadEventk .
 h i h i h i
Pr A wins | ¬BadEventk = Pr A wins | k = k ′ ∧ ¬BadEventk · Pr k = k ′ | ¬BadEventk
h i h i
+ Pr A wins | k ̸= k ′ ∧ ¬BadEventk · Pr k ̸= k ′ | ¬BadEventk

Here, note the following:

h i
(∗) Pr A wins | k = k ′ ∧ ¬BadEventk = 1 (A definitely wins if k = k ′ )
h i
(∗) Pr A wins | k ̸= k ′ ∧ ¬BadEventk ≥ 1/2 (A sends random guess b′ )
h i
(∗) Pr k = k ′ | ¬BadEventk = 1/2n (k ′ and m1 are independently chosen)
h i
Therefore, Pr A wins | ¬BadEventk ≥ 1/2n + 1/2(1 − 1/2n ) = 1/2 + 1/2n+1 .

Finally, we get that

h i h i
Pr A wins ≥ Pr A wins ∧ ¬BadEventk ≥ (1/2 + 1/2n+1 )(1 − 1/22n ) ≥ 1/2 + Ω(1/2n ).

3 Defining security against efficient adversaries

In the previous section we saw an efficient adversary that wins the game with probability slightly
greater than 1/2. However, note that 1/2n (and more generally, poly(n)/2n ) is a very small
quantity, and therefore, the adversary’s guess is almost like a uniformly random guess. For all
practical purposes, we do not need to worry about such rare attacks. Consider, on the other
hand, an adversary that can win the game with probability 1/2 + 1/poly(n). Such adversaries
can be dangerous in real world scenarios.

Therefore, for an encryption scheme to be secure, for any probabilistic polynomial time
adversary, the probability of winning the security game must be at most 1/2 + f (n), where f (n)
is eventually smaller than any inverse polynomial function. We call such functions negligible
functions.

Definition 04.01. A function µ : N → [0, 1] is said to be negligible if, for any polynomial p(·),
there exists n0 ∈ N such that for all n > n0 , µ(n) < 1/p(n).

Examples of negligible functions:

µ(n) = 1/2n/2 , µ(n) = 1/nlog n , µ(n) = 1/n!

An example of non-negligible function:

(
1/n if n is prime
µ(n) =
1/2n otherwise
 Question 04.01. Consider the following function:

µ(n) = 1/ni for all n ∈ [2i , 2i+1 ]

Is this function negligible?

4 A formal security definition for security against efficient

adversaries
Given the notion of negligible functions, we are now ready to present our first security definition
for efficient adversaries. 2

Definition 04.02. An encryption scheme (KeyGen, Enc, Dec) is said to satisfy no-query-
semantic-security if, for any probabilistic polynomial time adversary A, there exists a negligible
function µ(·) such that for all n,
h i
Pr A wins the No-Query-Semantic-Security game ≤ 1/2 + µ(n)

where the No-Query-Semantic-Security game is defined in Figure 1.

5 Security proofs
Armed with the above security definition, we are ready to see our first security proof. Suppose
you are given an encryption scheme E = (KeyGen, Enc, Dec) with M = C = {0, 1}ℓ that satisfies
Definition 04.02. Consider the following modified encryption scheme E ′ = (KeyGen′ , Enc′ , Dec′ ):
• KeyGen′ = KeyGen
 
• Enc′ (m, k) = reverse Enc(reverse(m), k)
 
• Dec′ (ct, k) = reverse Dec(reverse(ct), k)

We will show that E ′ also satisfies Definition 04.02, assuming E does. We will prove this
statement by taking the contrapositive. Suppose, there exists a prob. poly. time adversary A
that breaks security of E ′ . Then we will show a prob. poly. time adversary B (that using A)
breaks the security of E.

More formally, suppose there exists a non-negligible function ϵA (·) such that for infinitely
many n,
h i
Pr A wins the No-Query-Semantic-Security game against E ′ ≥ 1/2 + ϵA (n).

Note: the probability is over the choice of bit b and key k chosen by the challenger, as well as any
randomness that the adversary might use. Also, in the probability event, we specify the security
game (No-Query-Semantic-Security), as well as the encryption scheme E ′ .

We will use A and the non-negl. function ϵA to break the security of E as follows:
2A common template for defining security via security games (in this course) is to first define a security game,
and then identify the trivial winning strategy in this game. A construction is secure (w.r.t. this security game)
if no prob. poly. time adversary can win the game with probability significantly larger than the trivial winning
probability.
 • build a prob. poly. time adversary B that uses A as a black-box.
• propose a non-negligible function ϵB that depends on ϵA
h i
• show that Pr B wins the No-Query-Semantic-Security game against E ≥ 1/2 + ϵB (n)

Reductions will be the bread-and-butter of this course, so please make sure you
understand all the details here.

Description of Reduction Algorithm

The reduction algorithm B interacts with the adversary A and the challenger for E.

1. First, B uses the adversary A to choose two messages m′0 , m′1 .

2. B sets m0 = reverse(m′0 ), m1 = reverse(m′1 ) and sends m0 , m1 to the challenger for E.
3. The challenger sends a ciphertext ct (which is either an encryption of m0 or m1 ).
4. B computes ct′ = reverse(ct) and sends it to A.

5. A finally sends its guess b′ to B, and B forwards it to the challenger for E.

Note that B, together with the adversary A, act as an adversary that wants to break the
security of E. From the viewpoint of the challenger for E, it is interacting with an adversary that
wants to win the game against E.

Before proceeding with the formal proof, think about the following questions:
• what happens if B sets m0 = m′0 , m1 = m′1 (instead of reversing the messages m′0 , m′1 )?

• what happens if B sets ct′ = ct (instead of reversing the ciphertext ct)?

Claim 04.02.
h i
Pr B wins the No-Query-Semantic-Security game against E
h = i
Pr A wins the No-Query-Semantic-Security game against E ′ .

Proof. Let us consider the LHS probability.

h i
Pr B wins the No-Query-Semantic-Security game against E

This probability is over the choice of bit b, key k by the challenger, and the randomness of A.
Expanding the above probability, we get the following:

m′0 , m′1
 
A chooses
 
 ′
Pr  ct = reverse Enc(reverse(mb ), k) 

b←{0,1},k←K
rand. of A A, on receiving ct′ outputs b
 Now, note that this is identical to

A chooses m′0 , m′1

 
′
Pr  ct′ = Enc (mb , k) 
b←{0,1},k←K ′
rand. of A A, on receiving ct outputs b

and this is the probability that A wins the No-Query-Semantic-Security security game against
E ′.

6 Exercises
You are strongly advised to attempt the following problems before the next class.

Question 04.02. Let E = (KeyGen, Enc, Dec) be an encryption scheme that satisfies Definition
04.02. Consider the following modified encryption scheme (KeyGen′ , Enc′ , Dec′ ):
• KeyGen′ = Run KeyGen twice, and let k1 , k2 be the two output keys. Output k = (k1 , k2 )
as the key.
• Enc′ (m, k = (k1 , k2 )) = (Enc(m, k1 ), Enc(m, k2 ))
• Dec′ (ct = (ct1 , ct2 ), k = (k1 , k2 )) = Dec(ct1 , k1 )
Show that E ′ satisfies Definition 04.02, assuming E does.

Question 04.03. Security proofs can also be used for studying the relationship between various
security definitions. Let E = (KeyGen, Enc, Dec) be an encryption scheme with message space
M.
1. Propose a security game (and a security definition) to capture the following ‘intuitive
definition’: an encryption scheme is secure against message recovery attacks if no adver-
sary can recover the message, given the encryption of a uniformly random message using
a uniformly random key.
Hint: there exist prob. poly. time adveraries that can win the above game with probability
1/|M|.
2. Show that if an encryption scheme E satisfies No-Query-Semantic-Security, then it also
satisfies security against message recovery attacks.

Question 04.04 (*). Can you modify the above definition to allow the adversary to choose a
message distribution that it wants to attack? Would the same reduction work?

7 Summary and Additional References

This lecture concludes our discussion related to perfect security, and provides an introduction to
computational security. Key points to remember from Lectures 02-04:
• There are multiple ways of defining perfect secrecy. The simplest definition (Definition
02.04) is equivalent to the other definitions.
 • If an encryption scheme satisfies perfect secrecy, then the key space must be as large as the
message space (Theorem 03.01).
• Therefore, we relax the security requirements. Instead of seeking perfect secrecy, we aim
for computational security: security against efficient adversaries. These security definitions
are formalized using security games. (Definition 04.02)

• Security proofs via reductions are useful for proving security of a cryptographic construc-
tion, assuming the security of the underlying building blocks. They can also be used to
compare security definitions (that is, whether one definition is stronger/weaker than the
other).

Relevant sections from textbook [Boneh-Shoup]: 2.3.1, 2.3.2, 2.3.3.1 (this subsection discusses
Question 04.03), 2.4.