CS255: Cryptography and Computer Security Winter 1998

Assignment #1

Due: Friday, January 23rd, 1998.

1. Consider the following encryption scheme for n-letter messages. The secret key π corresponds to a permutation on n locations. Given a message M = m_{1}m_{2} ⋯ m_{n}, one computes its encryption E_{π}(M) by

E_{π}(M) = m_{π(1)}, …, m_{π(n)}.

For example, suppose that π = ( \begin{matrix}1 & 2 & 3 \\ 3 & 1 & 2 \end{matrix} ). That is π(1) = 3, π(2) = 1 and π(3) = 2. Then

the encryption E_{π}(“Dan”) would be “nDa”.

A. How does the security of this scheme vary according to the message size?

B. What information is leaked by a single encryption using this scheme? That is, given E_{π}(M), what can we determine about M. Now let’s try to break this scheme completely given multiple encryptions E_{π}(M_{1}), …, E_{π}(M_{k}) for a fixed key π. We assume that we don’t know M_{1}, …, M_{k} a priori but that they are in english.

C. For a given i and j, how might we determine whether π^{−1}(i) = π^{−1}(j) + 1, given enough messages? That is, can we determine if letters i and j of the ciphertext correspond to consecutive letters of the plaintext.

D. Using the answer to Part 3, show how to reconstruct π.

E. Suppose that M_{1}, …, M_{k} were not english but instead were just random strings. Could we find π given the ciphertext only?

2. Data compression is often used in data storage or transmission. Suppose you want to use data compression in conjunction with encryption. Does it make more sense to

A. Compress the data and then encrypt the result, or

B. Encrypt the data and then compress the result.

Justify your answer. Try to give at least two reasons.

3. Before DESX was invented, the researchers at RSA Labs came up with DESV and DESW, defined by

DESV_{kk_{1}}(M) = DES_{k}(M) ⊕ k_{1} and
DESW_{kk_{1}}(M) = DES_{k}(M ⊕ k_{1})

As with DESX, |k| = 56 and |k_{1}| = 64. Show that both these proposals do not increase the work needed to break the cryptosystem using brute-force key search. That is, show how to break these schemes using on the order of 2^{56} DES encryptions/decryptions. You may assume that you have a moderate number of plaintext-ciphertext pairs, C_{i} = DES{V/W }_{kk_{1}}(M_{i}).

4. Given a cryptosystem E_{k}, define the randomized cryptosystem F_{k} by

F_{k}(M) = (E_{k}(R), R ⊕ M),

where R is a random bit string of the same size as the message. That is, the output of F_{k}(M) is the encryption of a random one-time pad along with the original message XORed with the random pad. A new independent random pad R is chosen for every encryption.

We consider two attack models. The goal of both models is to reconstruct the actual secret key k.^{1}

• In the key-reconstruction chosen plaintext attack (KR-CPA), the adversary is allowed to generate strings M_{1}, M_{2}, … and for each M_{i} learn a corresponding ciphertext.

• In the key-reconstruction random plaintext attack (KR-RPA), the adversary receives random plaintext/ciphertext pairs.

Note that for the case of F_{k} the opponent has no control over the random pad R used in the creation of the given plaintext/ciphertext pairs.

Prove that if E_{k} is secure against KR-RPA attacks then F_{k} is secure against KR − CPA attacks.

[Hint: It is easiest to show the contrapositive. Given an algorithm A that executes a successful KR − CPA attack against F_{k}, exhibit an algorithm B (using A as a “subroutine”) that executes a successful KR − RPA attack against E_{k}.]

1This is a very strong goal - one might be able to decrypt messages without ever learning k.