An introduction to probabilistic encryption is given, presenting the first probabilistic cryptosystem by Goldwasser and Micali. Furthermore, the required number-theoretic concepts are discussed and the notion of semantic security is presented in an informal
way. The article should be comprehensible to students with basic mathematical knowledge

G. J Fuchsbauer

Hrčak - Portal of scientific journals of Croatia

Osjecˇki matematicˇki list 6(2006), 37–44 37An Introduction to Probabilistic EncryptionGeorg J. Fuchsbauer∗Abstract. An introduction to probabilistic encryption is given,presenting the first probabilistic cryptosystem by Goldwasser and Mi-cali. Furthermore, the required number-theoretic concepts are discussedand the notion of semantic security is presented in an informal way.The article should be comprehensible to students with basic mathemati-cal knowledge.Key words: probabilistic encryption, cryptosystem1. IntroductionHistorically, encryption schemes were the first central area of interest in cryptog-raphy.1 They deal with providing means to enable private communication over aninsecure channel. A sender wishes to transmit information to a receiver over aninsecure channel, that is a channel which may be tapped by an adversary.Thus, the information to be communicated, which we call the plaintext, mustbe transformed (encrypted) to a ciphertext, a form not legible by anybody otherthan the intended receiver. The latter must be given some way to decrypt theciphertext, i.e. retrieve the original message, while this must not be possible foran adversary. This is where keys come into play; the receiver is considered tohave a key at his disposal, enabling him to recover the actual message, a fact thatdistinguishes him from any adversary.An encryption scheme consists of three algorithms: The encryption al-gorithm transforms plaintexts into ciphertexts while the decryption algorithmconverts ciphertexts back into plaintexts. A third algorithm, called the key gener-ator, creates pairs of keys: an encryption key, input to the encryption algorithm,and a related decryption key needed to decrypt. The encryption key relates en-cryptions to the decryption key. The key generator is considered to be a proba-bilistic algorithm (see below), which prevents an adversary from simply running thekey generator to get the decryption key for an intercepted message. The followingconcept is crucial to probabilistic cryptography:Definition 1 [Probabilistic Algorithm]. A probabilistic algorithm is an al-gorithm with an additional command RANDOM that returns “0” or “1”, each with∗e-mail: fuchsbauer@gmx.net1For a profound introduction to cryptography, see [3].38 Georg J. Fuchsbauerprobability 1/2. In the literature, these random choices are often referred to as coinflips.2Private-Key vs. Public-KeyThe first encryption schemes had only one key for encryption and decryption, whichtherefore was to be kept private. We call them private-key or symmetric encryp-tion schemes. Before using the scheme, the key must once be exchanged securely,hence private-key encryption is a “way of extending a private channel over time”.In the 1970s Diffie and Hellman [1] introduced a new concept, called public-key or asymmetric encryption: The encryption key differs from the decryption key,moreover, given the former it must be infeasible to find the latter. That is why theseschemes provide secure communication without ever requiring any private channel;the receiver creates a pair of keys, gives the encryption key (that can be publiclyknown) to the sender, but keeps the decryption key secret. The sender can thenuse the encryption key to encrypt messages, which can only be decrypted by thereceiver. In this context, the encryption and the decryption key are often referredto as the public and the private key, respectively.An analogy illustrating the difference between the two notions of encryption isthe problem of sending a confidential parcel by postal delivery: Private-key encryp-tion corresponds to sending the secret content in a locked box. The drawback isthat the recipient must be given the key to the box. A secure channel, e.g. a courier,is thus required. The idea to avoid this is not to send the key to the receiver, butrather let him send a padlock to the sender and keep the key. The sender locks thesecret content and the receiver is the only one able to open the box. Interceptingthe padlock is of no use to an adversary—assuming that it does not help in forgingthe key.2. Probabilistic Public-Key EncryptionThe first public-key cryptosystems (such as RSA [4]) were deterministic algorithmsbased on trapdoor functions. These are functions that are easy to compute buthard to invert—unless some information called the trapdoor is known. So, whileeverybody can use the function to encrypt messages, only the legal receiver knowsthe trapdoor, which serves as a decryption key.3According to [2], the two main drawbacks of encryption schemes based on trap-door functions are:1. Inverting may be easy for plaintexts of some special form.42. It could be easy to compute at least partial information of the plaintext.2More formally, probabilistic algorithms can be defined by Turing machines having an addi-tional infinite read-only tape containing random bits.3The trapdoor function used for RSA is exponentiation to the power of the public key in Zn,where n = pq is the product of two large primes. That is, the encryption of a plaintextm ∈ Z∗n isc := me mod n. The prime factors of n can be considered as the trapdoor.4RSA, for example, always encrypts the messages 1 and 0 to themselves.An Introduction to Probabilistic Encryption 39Furthermore, for deterministic schemes it is easy to detect if a message is senttwice. These points inspired the development of probabilistic public-key encryp-tion schemes by Goldwasser and Micali [2]. They substituted the notion of trapdoorfunctions by what they introduced as (unapproximable) trapdoor predicates: Apredicate B is trapdoor and unapproximable if anyone can select an x such thatB(x) = 0 or y such that B(y) = 1, but only those who know the trapdoor infor-mation can, given z, compute the value of B(z). Goldwasser and Micali used thepredicate “is quadratic residue modulo composite n” (see Section 4.).Their scheme uses bitwise encryption, which depends on a sequence of randombits. However, messages are always uniquely decryptable. Two properties are:1. Decoding is easy for the legal receiver of a message, who knows the trapdoorinformation, but provably hard for an adversary.2. No information about the plaintext can be obtained from the ciphertext byan adversary.Definition 2 [Probabilistic Public-Key Bit-Encryption Scheme]. Aprobabilistic public-key bit-encryption scheme (K, E ,D) with security pa-rameter n consists of:• K, the key generator: A probabilistic algorithm that on input n outputs apair (e, d), where e is the public key and d is the private key.• E , the encryption function, with three inputs: the public key e, the plaintextbit b ∈ {0, 1}, and a random string r of length p(n) for some polynomial p(·).We will write Ee(b, r).• D, the decryption function, with two inputs: the private key d and theciphertext c. Again, we will write Dd(c).Moreover, decryption of any encryption of a bit yields the encrypted bit, i.e.∀n ∈ N ∀ (e, d) ∈ K(1n) ∀ b ∈ {0, 1} ∀ r ∈ {0, 1}p(n) : Dd((Ee(b, r)))= b3. Semantic SecurityA minimal requirement for an encryption scheme is that it must be impossible toretrieve an encrypted plaintext for anybody not knowing the decryption key. How-ever, as already pointed out, this condition may be too weak—in some applicationseven partial information gained from the plaintext could endanger security. Thisis why we demand it to be “infeasible to learn anything about the plaintext fromthe ciphertext” or, in other words, “whatever an eavesdropper can compute aboutthe cleartext given the ciphertext, he can also compute without the ciphertext”[2].Schemes fulfilling this requirement, such as the Goldwasser-Micali scheme, are calledsemantically secure.Since the actual definition of semantic security in [2] is rather technical, we settlefor giving some intuitive notions.40 Georg J. FuchsbauerLet M be the set of all possible messages, and for all m ∈ M , let pm be theprobability that m is sent. In a semantically secure cryptosystem, even if the adver-sary knows these probabilities, it must be hard for him to extract any informationabout messages from their encryption.Let f : M → V be a function defined on M that represents such informationabout messages. Let vM be a value for f(m) that has maximal probability pM tooccur when m is chosen at random.5 Consider the following two games: (Note thatwe assume that the adversary knows the public key e)Game 1. Randomly pick m ∈M and ask the adversary to guess the value of f(m)without telling him m. The best the adversary can do, is always guess vM ;thus, the probability of being right is pM .Game 2. Let the adversary choose a function f defined on M . Randomly pickm ∈M . Compute an encryption of m and give it to the adversary. Now askthe adversary to guess f(m).Informally, a cryptosystem is semantically secure if the adversary cannot win Game2 with higher probability than Game 1.4. The Quadratic Residuosity ProblemIn this section we present number-theoretical results that underlie the Goldwasser-Micali encryption scheme. For the sake of readability, proofs are not given here;the interested reader is referred to the appendix.By Z∗n := {a ∈ N | 1 ≤ a ≤ n− 1 ∧ gcd(a, n) = 1} we denote the multiplicativegroup of Zn, i.e. all numbers less than n that have multiplicative inverses modulon.Definition 3 [Quadratic Residues]. An element a ∈ Z∗n is said to be aquadratic residue ( square) modulo n if there exists an x ∈ Z∗n, such that x2 ≡ a(mod n). Every such x is called a square root of a modulo n. If no such x exists,then a is called a quadratic non-residue modulo n. We denote the set of allquadratic residues modulo n by Qn, the set of all quadratic non-residues by Qn.Lemma 1. Let p be a prime. Then |Qp| = |Qp| = 12 |Z∗p| = p−12 .Lemma 2. Let p and q be odd primes, n := pq, a ∈ Z∗n. Then a ∈ Qn if andonly if a ∈ Qp and a ∈ Qq. For n = pq, we have |Qn| = 14(p − 1)(q − 1).Definition 4 [Legendre Symbol]. Let p be an odd prime, a an integer, s.t.gcd(a, p) = 1. The Legendre Symbol is defined to be(ap)={1, if a ∈ Qp−1, if a ∈ QpLemma 3. Let p be an odd prime, a, b ∈ Z∗p. Then(ap)(bp)=(abp).The Jacobi symbol is an extension of the Legendre symbol for compositen = pq: (an):=(ap)(aq)5That is, vM is a value in V with probability pM := maxv∈V (∑m∈f−1(v) pm).An Introduction to Probabilistic Encryption 41By definition, Lemma 3 obviously holds for composite n instead of p, too.We now turn to the question of computing the Legendre (Jacobi) symbol. Forprime p this can easily be done by the following criterion, which therefore yields analgorithm for deciding quadratic residuosity in Z∗p.Proposition 1 [Euler’s Criterion]. Let p be an odd prime. Then a ∈ Z∗p is aquadratic residue modulo p if and only if a(p−1)/2 ≡ 1 (mod p)For composite n = pq, there also exist efficient algorithms to compute the Jacobisymbol of a number a, even if the prime factorization of n is not known.However, in contrast to the case Z∗p , this does not yield a tool for decidingquadratic residuosity in Z∗n: A quarter of the numbers in Z∗n are quadratic residueswhile half of them have Jacobi symbol 1. The numbers having Jacobi symbol 1while being quadratic non-residues are called pseudosquares.Definition 5 [Quadratic Residuosity Problem (QRP)]. Given a compositeinteger n = pq and a ∈ Z∗n with ( an ) = 1, decide whether or not a is a quadraticresidue modulo n.There is no efficient procedure known for solving the Quadratic ResiduosityProblem if the factorization of n is unknown. The Quadratic Residuosity As-sumption states that for sufficiently large primes p and q, for every real-life algo-rithm it is infeasible to solve QRP.However, if the factorization n = pq is known, it is easy to solve QRP bycomputing (ap), since a is a pseudosquare if and only if (ap) = (aq) = −1. It isthese two facts that Goldwasser and Micali have based the first semantically securecryptosystem upon.5. The Goldwasser-Micali Encryption SchemeWe present the three algorithms K, E and D of the Goldwasser-Micali encryptionscheme as given in [3].Algorithm 1 [Key Generation K].1. Select two large random primes p and q, p 6= q.2. Set n← pq.3. Select a pseudosquare y ∈ Zn (i.e. y is quadratic non-residue and ( yn) = 1).4. The public key is (n, y), the private key is (p, q).Algorithm 2 [Encryption E ]. Let message m be a binary stringm = m1m2 . . .m`,let (n, y) be the public key.1. For i = 1 . . . ` do:(a) Select x ∈ Z∗n at random.(b) If mi = 0, set ci ← x2 mod n; otherwise set ci ← yx2 mod n.2. The ciphertext is c = (c1, c2, . . . , c`).Algorithm 3 [Decryption D]. Let c = (c1, c2, . . . , c`) be a ciphertext and(p, q) the private key.42 Georg J. Fuchsbauer1. For i = 1 . . . ` do:(a) Compute ei = ( cip ) using Proposition 1.(b) If ei = 1, set mi ← 0; otherwise set mi ← 1.2. The decrypted message is m = (m1,m2, . . . ,m`).Remark 1.Key Generation: The pseudosquare y required in Step 3 can be found by a proba-bilistic algorithm that picks y at random until (yp) = (yq) = −1.Encryption: If mi = 0, then it is encrypted to a random quadratic residue modulon, while for mi = 1 a random pseudosquare is chosen. In fact, according toLemma 4 and multiplicativity of the Jacobi symbol, a pseudosquare times aquadratic residue yields a pseudosquare.Decryption: Knowing the factors of n, it is easy to decide whether a ci is aquadratic residue or not: ( cip) = 1 if and only if ci is a quadratic residue,which is the case if and only if mi = 0.Remark 2 [Security of the scheme]. Assuming the hardness of QRP (Def-inition 5), the Goldwasser-Micali encryption scheme is semantically secure: Forx ∈ Z∗n is picked at random, x2 is a random quadratic residue and yx2 is a randompseudosquare modulo n. So, in order to decrypt a single bit of the ciphertext, anattacker would have to solve the quadratic residuosity problem. For a detailed proofbased on mathematical definitions, see [2].The Goldwasser-Micali cryptosystem was the first system based upon the con-cept of probabilistic encryption and furthermore the first system proven to be se-mantically secure (assuming the intractability of the quadratic residuosity problem).It is, nevertheless, not a practicable scheme since in general, one plaintext-bit is ex-panded into n bits of ciphertext.A ProofsThis appendix contains the proofs of the results stated in Section 4..Lemma 4. Let a be a quadratic residue modulo n, b a quadratic non-residuemodulo n. Then ab is a quadratic non-residue modulo n.Proof. Since a is a quadratic residue, there exists c ∈ Z∗n s.t. c2 ≡ a (mod n).Assume ab were a quadratic residue, too; let d ∈ Z∗n be s.t. d2 ≡ ab (mod n). Thisimplies b ≡ d2a−1 ≡ (dc−1)2 (mod n). So dc−1 would be a root of b, contradictingits assumed non-residuosity. 2Proof.[Proof of Lemma 1] We show that for p prime, half of the elements ofZ∗p are quadratic residues.Since Z∗p is cyclic, it has a generator. Let g be s.t. Z∗p = {gi | 0 ≤ i ≤ p − 1}.We show that g is a quadratic non-residue modulo p : Assume that there is someAn Introduction to Probabilistic Encryption 43a ∈ Z∗p s.t. a2 ≡ g (mod p). Thus g(p−1)/2 ≡ ap−1 ≡ 1 (mod p) (by Fermat’s LittleTheorem6), which contradicts the fact that the order of the generator g is p− 1.g2, g4, . . . , gp−1 are distinct quadratic residues, while g, gg2, . . . , ggp−1, beingproducts of g and a quadratic residue, are quadratic non-residues by Lemma 4. 2Proof. [Proof of Lemma 2] We show that for n = pq, a is a quadratic residuemodulo n if and only if it is a quadratic residue both modulo p and modulo q.“⇒” Let a ∈ Qn. There exists c ∈ Z∗n, s.t. c2 ≡ a (mod n). Therefore7, c2 ≡ a(mod p); thus, c is a square root of a modulo p. Analogously, c is a square root ofa modulo q.“⇐” Let a ∈ Qp and a ∈ Qq. There exist cp and cq, s.t. c2p ≡ a (mod p) and c2q ≡ a(mod q). By the Chinese Remainder Theorem there is one solution x < n to thefollowing system of congruences:x ≡ cp (mod p)x ≡ cq (mod q)Thus x2 ≡ a (mod p) and x2 ≡ a (mod q), therefore x2 ≡ a (mod n).8 2Proof. [Proof of Lemma 3] We show that for a, b ∈ Z∗p, we have (ap ) ( bp ) =(abp). As in the proof of Lemma 1, let g be a generator of Z∗p and let i be s.t. a ≡ gi(mod p). We know that (ap ) = 1 if and only if i is even. Let j be s.t. b ≡ gj(mod p). Thus ab ≡ gi+j (mod p) and i+ j is even if and only if neither or both ofi and j are even. 2Proposition 2 [Euler’s Criterion]. Let p be an odd prime. Then for everya ∈ Z (ap)= 1 if and only if a(p−1)/2 ≡ 1 mod pProof. The map ϕ : Z∗p → Z∗p, a 7→ a(p−1)/2 is a group homomorphism.9 Letψ : Z∗p → {±1}, a 7→ (ap ). By Lemma 3, this is a group homomorphism, too. Ifa ∈ ker(ψ), then a = c2 for some c ∈ Z∗p, so10ϕ(a) = a(p−1)/2 = (c2)(p−1)/2 = cp−1 = 1by Fermat’s Little Theorem. Thus ker(ψ) ⊂ ker(ϕ). By Lemma 3, ker(ψ) has index2 in Z∗p, i.e. it contains half of the elements of Z∗p , so either ker(ϕ) = ker(ψ) orϕ(a) = 1 for all a. In the latter case, the polynomial x(p−1)/2 − 1 would have p− 1roots11 in the field Z∗n, so ker(ϕ) = ker(ψ). 26Fermat’s Little Theorem states the following: For p prime and a ∈ Z∗p, we have ap−1 ≡ 1(mod p).7Per definitionem c2 ≡ a (mod n) iff n | c2 − a, so obviously p | c2 − a.8If two distinct primes p and q divide x2− a, then they both appear in the prime factorizationof x2 − a, thus also their product pq = n divides x2 − a.9Since Z∗p is an abelian group, we have: ϕ(a)ϕ(b) = a(p−1)/2 b(p−1)/2 = (ab)(p−1)/2 = ϕ(ab).10The kernel ker(ϕ) of a group homomorphism ϕ : G → H is a subgroup of the domain Gcontaining exactly those elements that are mapped to the neutral element in H , i.e. ker(ψ) :={a ∈ G |ϕ(a) = 1}.11A basic result from field theory is the following: A polynomial of degree d over a field canhave at most d roots.44 Georg J. FuchsbauerLiteratura[1] W. Diffie, M. Hellman, New Directions in Cryptography, IEEE Transac-tions on Informations Theory, IT-22(6), pp. 644–654, 1976[2] S. Goldwasser, S. Micali, Probabilistic Encryption, Journal of Computerand System Sciences, 28, pp. 270–299, 1984[3] A. J. Menezes, P. C. van Oorschot, S. A. Vanstone, Handbook ofApplied Cryptography, CRC Press, Boca Raton, FL, 1996[4] R. Rivest, A. Shamir, L. Adleman, A Method for Obtaining Digital Sig-nature and Public Key Cryptosystems, Communications of the ACM, 21(2),pp. 120–126, 1978

An Introduction to Probabilistic Encryption

Abstract

Similar works

Full text

Available Versions

Hrčak - Portal of scientific journals of Croatia