introduction to cryptography - principles & applications, 2nd ed.

Information Security and Cryptography
Texts and Monographs
Series Editor
Ueli Maurer
Associate Editors
Martin Abadi
Ross Anderson
Mihir Bellare
Oded Goldreich
Tatsuaki Okamoto
Paul van Oorschot
Birgit Pfitzmann
Aviel D. Rubin
Jacques Stern
Hans Delfs
Helmut Knebl
Introduction
to Cryptography
Principles and Applications
Second Edition
Authors Series Editor
Library of Congress Control Number: 2007921676
ACM Computing Classification: E.3
ISBN-13 978-3-540-49243-6 Springer Berlin Heidelberg New York
This work is subject to copyright. All rights are reserved, whether the whole or part of the material
is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broad-
casting, reproduction on microfilm or in any other way, and storage in data banks. Duplication of
this publication or parts thereof is permitted only under the provisions of the German Copyright
Law of September 9, 1965, in its current version, and permission for use must always be obtained
from Springer. Violations are liable for prosecution under the German Copyright Law.

Springer is a part of Springer Science+Business Media
springer.com
© Springer-Verlag Berlin Heidelberg 2007
The use of general descriptive names, registered names, trademarks, etc. in this publication does not
imply, even in the absence of a specific statement, that such names are exempt from the relevant
protective laws and regulations and therefore free for general use.
Typesetting: Integra, India
Printed on acid-free paper SPIN: 11929970
ISSN 1619-7100
Cover design: KünkelLopka, Heidelberg
45/3100/Integra 543210
Prof. Dr. Hans Delfs
Georg-Simon-Ohm University
of Applied Sciences N
¨
urnberg
Department of Computer Science
Keßlerplatz 12
90489 N
¨
urnberg
Germany

Prof. Dr. Helmut Knebl
Georg-Simon-Ohm University
of Applied Sciences N
¨
urnberg
Department of Computer Science
Keßlerplatz 12

90489 N
¨
urnberg
Germany

Prof. Dr. Ueli Maurer
Inst. f
¨
ur Theoretische Informatik
ETH Z
¨
urich, 8092 Z
¨
urich
Switzerland
Preface to the Second, Extended Edition
New topics have been included in the second edition. They reflect recent
progress in the field of cryptography and supplement the material covered in
the first edition. Major extensions and enhancements are the following.
• A complete description of the Advanced Encryption Standard AES is given
in Chapter 2 on symmetric encryption.
• In Appendix A, there is a new section on polynomials and finite fields.
There we offer a basic explanation of finite fields, which is necessary to
understand the AES.
• The description of cryptographic hash functions in Chapter 3 has been
extended. It now also includes, for example, the HMAC construction of
message authentication codes.
• Bleichenbacher’s 1-Million-Chosen-Ciphertext Attack against schemes
that implement the RSA encryption standard PKCS#1 is discussed in
detail in Chapter 3. This attack proves that adaptively-chosen-ciphertext

attacks can be a real danger in practice.
• In Chapter 9 on provably secure encryption we have added typical secu-
rity proofs for public-key encryption schemes that resist adaptively-chosen-
ciphertext attacks. Two prominent examples are studied – Boneh’s simple-
OAEP, or SAEP for short, and Cramer-Shoup’s public key encryption.
• Security proofs in the random oracle model are now included. Full-domain-
hash RSA signatures and SAEP serve as examples.
Furthermore, the text has been updated and clarified at various points.
Errors and inaccuracies have been corrected.
We thank our readers and our students for their comments and hints, and
we are indebted to our colleague Patricia Shiroma-Brockmann and Ronan
Nugent at Springer for proof-reading the English copy of the new and revised
chapters.
N¨urnberg, December 2006 Hans Delfs, Helmut Knebl
Preface
The rapid growth of electronic communication means that issues in infor-
mation security are of increasing practical importance. Messages exchanged
over worldwide publicly accessible computer networks must be kept confiden-
tial and protected against manipulation. Electronic business requires digital
signatures that are valid in law, and secure payment protocols. Modern cryp-
tography provides solutions to all these problems.
This bo ok originates from courses given for students in computer science
at the Georg-Simon-Ohm University of Applied Sciences, N¨urnberg. It is in-
tended as a course on cryptography for advanced undergraduate and graduate
students in computer science, mathematics and electrical engineering.
In its first part (Chapters 1–4), it covers – at an undergraduate level – the
key concepts from symmetric and asymmetric encryption, digital signatures
and cryptographic protocols, including, for example, identification schemes,
electronic elections and digital cash. The focus is on asymmetric cryptography
and the underlying modular algebra. Since we avoid probability theory in

the first part, we necessarily have to work with informal definitions of, for
example, one-way functions and collision-resistant hash functions.
It is the goal of the second part (Chapters 5–10) to show, using prob-
ability theory, how basic notions like the security of cryptographic schemes
and the one-way property of functions can be made precise, and which as-
sumptions guarantee the security of public-key cryptographic schemes such
as RSA. More advanced topics, like the bit security of one-way functions,
computationally perfect pseudorandom generators and the close relation be-
tween the randomness and security of cryptographic schemes, are addressed.
Typical examples of provably secure encryption and signature schemes and
their security proofs are given.
Though particular attention is given to the mathematical foundations
and, in the second part, precise definitions, no special background in math-
ematics is presumed. An introductory course typically taught for beginning
students in mathematics and computer science is sufficient. The reader should
be familiar with the elementary notions of algebra, such as groups, rings and
fields, and, in the second part, with the basics of probability theory. Appendix
A contains an exposition of the results from algebra and number theory nec-
essary for an understanding of the cryptographic methods. It includes proofs
VI II Preface
and covers, for example, basics like Euclid’s algorithm and the Chinese Re-
mainder Theorem, but also more advanced material like Legendre and Jacobi
symbols and probabilistic prime number tests. The concepts and results from
probability and information theory that are applied in the second part of the
book are given in full in Appendix B. To keep the mathematics easy, we
do not address elliptic curve cryptography. We illustrate the key concepts of
public-key cryptography by the classical examples like RSA in the quotient
rings Z
n
of the integers Z.

The book starts with an introduction into classical symmetric encryption
in Chapter 2. The principles of public-key cryptography and their use for
encryption and digital signatures are discussed in detail in Chapter 3. The
famous and widely used RSA, ElGamal’s methods and the digital signature
standard, Rabin’s encryption and signature schemes serve as the outstand-
ing examples. The underlying one-way functions – modular exponentiation,
modular p owers and modular squaring – are used throughout the book, also
in the second part.
Chapter 4 presents typical cryptographic protocols, including key ex-
change, identification and commitment schemes, electronic cash and elec-
tronic elections.
The following chapters focus on a precise definition of the key concepts
and the security of public-key cryptography. Attacks are modeled by prob-
abilistic polynomial algorithms (Chapter 5). One-way functions as the basic
building blocks and the security assumptions underlying mo dern public-key
cryptography are studied in Chapter 6. In particular, the bit security of the
RSA function, the discrete logarithm and the Rabin function is analyzed in
detail (Chapter 7). The close relation between one-way functions and com-
putationally perfect pseudorandom generators meeting the needs of cryptog-
raphy is explained in Chapter 8. Provable security properties of encryption
schemes are the central topic of Chapter 9. It is clarified that randomness is
the key to security. We start with the classical notions of provable security
originating from Shannon’s work on information theory. Typical examples
of more recent results on the security of public-key encryption schemes are
given, taking into account the computational complexity of attacking algo-
rithms. A short introduction to cryptosystems, whose security can be proven
by information-theoretic methods without any assumptions on the hardness
of computational problems (“unconditional security approach”), supplements
the section. Finally, we discuss in Chapter 10 the levels of security of dig-
ital signatures and give examples of signature schemes, whose security can

be proven solely under standard assumptions like the factoring assumption,
including a typical security proof.
Each chapter (except Chapter 1) closes with a collection of exercises.
Answers to the exercises are provided on the Web page for this book:
www.informatik.fh-nuernberg.de/DelfsKnebl/Cryptography.
Preface IX
We thank our colleagues and students for pointing out errors and sug-
gesting improvements. In particular, we express our thanks to J¨org Schwenk,
Harald Stieber and Rainer Weber. We are grateful to Jimmy Upton for
his comments and suggestions, and we are very much indebted to Patricia
Shiroma-Brockmann for proof-reading the English copy. Finally, we would
like to thank Alfred Hofmann at Springer-Verlag for his support during the
writing and publication of this book.
N¨urnberg, December 2001 Hans Delfs, Helmut Knebl
Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1 Encryption and Secrecy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 The Objectives of Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.3 Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.4 Cryptographic Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.5 Provable Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2. Symmetric-Key Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.1 Stream Ciphers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.2 Block Ciphers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.2.1 DES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.2.2 AES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.2.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
3. Public-Key Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
3.1 The Concept of Public-Key Cryptography . . . . . . . . . . . . . . . . . 33
3.2 Modular Arithmetic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

3.2.1 The Integers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.2.2 The Integers Modulo n . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
3.3 RSA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
3.3.1 Key Generation and Encryption . . . . . . . . . . . . . . . . . . . . 41
3.3.2 Digital Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
3.3.3 Attacks Against RSA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
3.3.4 Probabilistic RSA Encryption . . . . . . . . . . . . . . . . . . . . . . 51
3.4 Cryptographic Hash Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
3.4.1 Security Requirements for Hash Functions . . . . . . . . . . . 54
3.4.2 Construction of Hash Functions . . . . . . . . . . . . . . . . . . . . 56
3.4.3 Data Integrity and Message Authentication . . . . . . . . . . 62
3.4.4 Hash Functions as Random Functions . . . . . . . . . . . . . . . 64
3.4.5 Signatures with Hash Functions . . . . . . . . . . . . . . . . . . . . 65
3.5 The Discrete Logarithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
3.5.1 ElGamal’s Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
3.5.2 ElGamal’s Signature Scheme . . . . . . . . . . . . . . . . . . . . . . . 72
3.5.3 Digital Signature Algorithm . . . . . . . . . . . . . . . . . . . . . . . 73
XI I Contents
3.6 Modular Squaring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
3.6.1 Rabin’s Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
3.6.2 Rabin’s Signature Scheme . . . . . . . . . . . . . . . . . . . . . . . . . 77
4. Cryptographic Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
4.1 Key Exchange and Entity Authentication . . . . . . . . . . . . . . . . . . 81
4.1.1 Kerberos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
4.1.2 Diffie-Hellman Key Agreement . . . . . . . . . . . . . . . . . . . . . 85
4.1.3 Key Exchange and Mutual Authentication . . . . . . . . . . . 86
4.1.4 Station-to-Station Protocol . . . . . . . . . . . . . . . . . . . . . . . . 88
4.1.5 Public-Key Management Techniques . . . . . . . . . . . . . . . . 89
4.2 Identification Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
4.2.1 Interactive Proof Systems . . . . . . . . . . . . . . . . . . . . . . . . . 91

4.2.2 Simplified Fiat-Shamir Identification Scheme . . . . . . . . . 93
4.2.3 Zero-Knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
4.2.4 Fiat-Shamir Identification Scheme . . . . . . . . . . . . . . . . . . 97
4.2.5 Fiat-Shamir Signature Scheme . . . . . . . . . . . . . . . . . . . . . 99
4.3 Commitment Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
4.3.1 A Commitment Scheme Based on Quadratic Residues . 101
4.3.2 A Commitment Scheme Based on Discrete Logarithms 102
4.3.3 Homomorphic Commitments . . . . . . . . . . . . . . . . . . . . . . . 103
4.4 Electronic Elections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
4.4.1 Secret Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
4.4.2 A Multi-Authority Election Scheme . . . . . . . . . . . . . . . . . 107
4.4.3 Proofs of Knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
4.4.4 Non-Interactive Proofs of Knowledge . . . . . . . . . . . . . . . . 112
4.4.5 Extension to Multi-Way Elections . . . . . . . . . . . . . . . . . . 112
4.4.6 Eliminating the Trusted Center . . . . . . . . . . . . . . . . . . . . 113
4.5 Digital Cash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
4.5.1 Blindly Issued Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
4.5.2 A Fair Electronic Cash System . . . . . . . . . . . . . . . . . . . . . 123
4.5.3 Underlying Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
5. Probabilistic Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
5.1 Coin-Tossing Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
5.2 Monte Carlo and Las Vegas Algorithms . . . . . . . . . . . . . . . . . . . 140
6. One-Way Functions and the Basic Assumptions . . . . . . . . . . . 147
6.1 A Notation for Probabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
6.2 Discrete Exponential Function . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
6.3 Uniform Sampling Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
6.4 Modular Powers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
6.5 Modular Squaring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
6.6 Quadratic Residuosity Property . . . . . . . . . . . . . . . . . . . . . . . . . . 162
6.7 Formal Definition of One-Way Functions . . . . . . . . . . . . . . . . . . 163

Contents XIII
6.8 Hard-Core Predicates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
7. Bit Security of One-Way Functions . . . . . . . . . . . . . . . . . . . . . . . 175
7.1 Bit Security of the Exp Family . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
7.2 Bit Security of the RSA Family . . . . . . . . . . . . . . . . . . . . . . . . . . 182
7.3 Bit Security of the Square Family . . . . . . . . . . . . . . . . . . . . . . . . 190
8. One-Way Functions and Pseudorandomness . . . . . . . . . . . . . . 199
8.1 Computationally Perfect Pseudorandom Bit Generators . . . . . 199
8.2 Yao’s Theorem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
9. Provably Secure Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
9.1 Classical Information-Theoretic Security . . . . . . . . . . . . . . . . . . . 216
9.2 Perfect Secrecy and Probabilistic Attacks . . . . . . . . . . . . . . . . . . 220
9.3 Public-Key One-Time Pads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
9.4 Passive Eavesdroppers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
9.5 Chosen-Ciphertext Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
9.5.1 A Security Proof in the Random Oracle Model . . . . . . . 236
9.5.2 Security Under Standard Assumptions . . . . . . . . . . . . . . 245
9.6 Unconditional Security of Cryptosystems . . . . . . . . . . . . . . . . . . 250
9.6.1 The Bounded Storage Model . . . . . . . . . . . . . . . . . . . . . . . 251
9.6.2 The Noisy Channel Model . . . . . . . . . . . . . . . . . . . . . . . . . 260
10. Provably Secure Digital Signatures . . . . . . . . . . . . . . . . . . . . . . 265
10.1 Attacks and Levels of Security . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
10.2 Claw-Free Pairs and Collision-Resistant Hash Functions . . . . . 268
10.3 Authentication-Tree-Based Signatures . . . . . . . . . . . . . . . . . . . . . 271
10.4 A State-Free Signature Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
A. Algebra and Number Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
A.1 The Integers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
A.2 Residues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
A.3 The Chinese Remainder Theorem. . . . . . . . . . . . . . . . . . . . . . . . . 299
A.4 Primitive Roots and the Discrete Logarithm . . . . . . . . . . . . . . . 301

A.5 Polynomials and Finite Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
A.5.1 The Ring of Polynomials . . . . . . . . . . . . . . . . . . . . . . . . . . 305
A.5.2 Residue Class Rings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
A.5.3 Finite Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
A.6 Quadratic Residues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
A.7 Modular Square Roots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
A.8 Primes and Primality Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
XIV Contents
B. Probabilities and Information Theory . . . . . . . . . . . . . . . . . . . . . 325
B.1 Finite Probability Spaces and Random Variables . . . . . . . . . . . 325
B.2 The Weak Law of Large Numbers . . . . . . . . . . . . . . . . . . . . . . . . 333
B.3 Distance Measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336
B.4 Basic Concepts of Information Theory . . . . . . . . . . . . . . . . . . . . 340
References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361
Notation
Page
M
∗
set of words m
1
m
2
. . .m
l
, l ≥ 0, over M
{0, 1}
∗
set of bit strings of arbitrary length
1

k
constant bit string 11 . . . 1 of length k 157
a ⊕b bitwise XOR of bit strings a, b ∈ {0, 1}
l
13
a||b concatenation of strings a and b
N set of natural numbers: {1, 2, . . .} 35
Z set of integers 35
Q set of rational numbers
R set of real numbers
ln(x) natural logarithm of a real x > 0
log(x) base-10 logarithm of a real x > 0
log
2
(x) base-2 logarithm of a real x > 0
log
g
(x) discrete base-g logarithm of x ∈ Z
∗
p
a |b a ∈ Z divides b ∈ Z 289
|x| absolute value of x ∈ R
|x| length of a bit string x ∈ {0, 1}
∗
|x| binary length of x ∈ N
|M| number of elements in a set M 296
g ◦ f composition of maps: g ◦ f(x) = g(f(x))
id
X
identity map: id

X
(x) = x for all x ∈ X
f
−1
inverse of a bijective map f
x
−1
inverse of a unit x in a ring 296
Z
n
residue class ring modulo n 295
Z
∗
n
units in Z
n
296
a div n integer quotient of a and n 290
a mod n remainder of a modulo n 290, 306
a ≡ b mod n a congruent b modulo n 295, 307
XVI Notation
Page
gcd(a, b) greatest common divisor of integers 289
ϕ(n) Euler phi function 296
F
q
, GF(q) finite field with q elements 309
ord(x) order of an element x in a group 301
QR
n

quadratic residues modulo n 311
QNR
n
quadratic non-residues modulo n 311

x
n

Legendre or Jacobi symbol 311, 312
J
+1
n
units in Z
n
with Jacobi symbol 1 313
[a, b] interval a ≤ x ≤ b in R
x greatest integer ≤ x 293
x smallest integer ≥ x 293
O(n) Big-O notation 293
Primes
k
set of primes of binary length k 157
P or P (X) positive polynomial 141
prob(E) probability of an event E 325
prob(x) probability of an element x ∈ X 325
prob(E, F) probability of E AND F 325
prob(E|F) conditional probability of E assuming F 327
prob(y |x) conditional probability of y assuming x 328
E(R) expected value of a random variable R 326
X  W

join of a set
X
with
W
= (
W
x
)
x∈X
328
XW joint probability space 327, 328
x
p
X
← X x randomly selected according to p
X
148, 329
x ← X x randomly selected from X 148, 329
x
u
← X x uniformly selected from X 148, 329
x ← X, y ← Y
x
first x, then y randomly selected 148, 330
prob(. . . : x ← X) probability of . . . for randomly chosen x 148, 329
{A(x) : x ← X} image of a distribution under A 139, 330
y ← A(x) y randomly generated by A on input x 149
dist(p, ˜p) statistical distance between distributions 336
H(X) uncertainty (or entropy) of X 340
H(X|Y ) conditional uncertainty (entropy) 342

I(X; Y ) mutual information 342
1. Introduction
Cryptography is the science of keeping secrets secret. Assume a sender re-
ferred to here and in what follows as Alice (as is commonly used) wants to
send a message m to a receiver referred to as Bob. She uses an insecure com-
munication channel. For example, the channel could be a computer network
or a telephone line. There is a problem if the message contains confidential
information. The message could be intercepted and read by an eavesdropper.
Or, even worse, the adversary, as usual referred to here as Eve, might be able
to modify the message during transmission in such a way that the legitimate
recipient Bob does not detect the manipulation.
One objective of cryptography is to provide methods for preventing such
attacks. Other objectives are discussed in Section 1.2.
1.1 Encryption and Secrecy
The fundamental and classical task of cryptography is to provide confidential-
ity by encryption methods. The message to be transmitted – it can be some
text, numerical data, an executable program or any other kind of information
– is called the plaintext. Alice encrypts the plaintext m and obtains the ci-
phertext c. The ciphertext c is transmitted to Bob. Bob turns the ciphertext
back into the plaintext by decryption. To decrypt, Bob needs some secret
information, a secret decryption key.
1
Adversary Eve still may intercept the
ciphertext. However, the encryption should guarantee secrecy and prevent
her from deriving any information about the plaintext from the observed
ciphertext.
Encryption is very old. For example, Caesar’s shift cipher
2
was introduced
more than 2000 years ago. Every encryption method provides an encryption

algorithm E and a decryption algorithm D. In classical encryption schemes,
both algorithms depend on the same secret key k. This key k is used for both
encryption and decryption. These encryption methods are therefore called
1
Sometimes the terms encipher and decipher are used instead of encrypt and
decrypt.
2
Each plaintext character is replaced by the character 3 to the right modulo 26,
i.e., a is replaced by d, b by e,. . ., x by a, y by b and z by c.
2 1. Introduction
symmetric. For example, in Caesar’s cipher the secret key is the offset 3 of
the shift. We have
D(k, E(k, m)) = m for each plaintext m.
Symmetric encryption and the important examples DES (data encryption
standard) and AES (advanced encryption standard) are discussed in Chap-
ter 2.
In 1976, W. Diffie and M.E. Hellman published their famous paper, New
Directions in Cryptography ([DifHel76]). There they introduced the revo-
lutionary concept of public-key cryptography. They provided a solution to
the long standing problem of key exchange and pointed the way to digital
signatures. The public-key encryption methods (comprehensively studied in
Chapter 3) are asymmetric. Each recipient of messages has his personal key
k = (pk, sk), consisting of two parts: pk is the encryption key and is made
public, sk is the decryption key and is kept secret. If Alice wants to send a
message m to Bob, she encrypts m by use of Bob’s publicly known encryption
key pk. Bob decrypts the ciphertext by use of his decryption key sk, which
is known only to him. We have
D(sk, E(pk, m)) = m.
Mathematically speaking, public-key encryption is a so-called one-way
function with a trapdoor. Everyone can easily encrypt a plaintext using the

public key pk, but the other direction is difficult. It is practically impossible
to deduce the plaintext from the ciphertext, without knowing the secret key
sk (which is called the trapdoor information).
Public-key encryption methods require more complex computations and
are less efficient than classical symmetric methods. Thus symmetric methods
are used for the encryption of large amounts of data. Before applying sym-
metric encryption, Alice and Bob have to agree on a key. To keep this key
secret, they need a secure communication channel. It is common practice to
use public-key encryption for this purpose.
1.2 The Objectives of Cryptography
Providing confidentiality is not the only objective of cryptography. Cryptog-
raphy is also used to provide solutions for other problems:
1. Data integrity. The receiver of a message should be able to check whether
the message was modified during transmission, either accidentally or de-
liberately. No one should be able to substitute a false message for the
original message, or for parts of it.
2. Authentication. The receiver of a message should be able to verify its
origin. No one should be able to send a message to Bob and pretend to
1.2 The Objectives of Cryptography 3
be Alice (data origin authentication). When initiating a communication,
Alice and Bob should be able to identify each other (entity authentica-
tion).
3. Non-repudiation. The sender should not be able to later deny that she
sent a message.
If messages are written on paper, the medium – paper – provides a certain se-
curity against manipulation. Handwritten personal signatures are intended to
guarantee authentication and non-repudiation. If electronic media are used,
the medium itself provides no security at all, since it is easy to replace some
bytes in a message during its transmission over a computer network, and it
is particularly easy if the network is publicly accessible, like the Internet.

So, while encryption has a long history,
3
the need for techniques provid-
ing data integrity and authentication resulted from the rapidly increasing
significance of electronic communication.
There are symmetric as well as public-key methods to ensure the integrity
of messages. Classical symmetric methods require a secret key k that is shared
by sender and receiver. The message m is augmented by a message authenti-
cation code (MAC). The code is generated by an algorithm and depends on
the secret key. The augmented message (m, MAC (k, m)) is protected against
modifications. The receiver may test the integrity of an incoming message
(m, m) by checking whether
MAC(k, m) = m.
Message authentication codes may be implemented by keyed hash functions
(see Chapter 3).
Digital signatures require public-key methods (see Chapter 3 for examples
and details). As with classical handwritten signatures, they are intended to
provide authentication and non-repudiation. Note that non-repudiation is an
indispensable feature if digital signatures are used to sign contracts. Digital
signatures depend on the secret key of the signer – they can be generated only
by him. On the other hand, anyone can check whether a signature is valid,
by applying a publicly known verification algorithm Verify, which dep ends
on the public key of the signer. If Alice wants to sign the message m, she
applies the algorithm Sign with her secret key sk and gets the signature
Sign(sk, m). Bob receives a signature s for message m , and may then check
the signature by testing whether
Verify(pk, s, m) = ok,
with Alice’s public key pk.
It is common not to sign the message itself, but to apply a cryptographic
hash function (see Section 3.4) first and then sign the hash value. In schemes

3
For the long history of cryptography, see [Kahn67].
4 1. Introduction
like the famous RSA (named after its inventors: Rivest, Shamir and Adle-
man), the decryption algorithm is used to generate signatures and the encryp-
tion algorithm is used to verify them. This approach to digital signatures is
therefore often referred to as the “hash-then-decrypt” paradigm (see Section
3.4.5 for details). More sophisticated signature schemes, like the probabilis-
tic signature scheme (PSS), require more steps. Modifying the hash value
by pseudorandom sequences turns signing into a probabilistic procedure (see
Section 3.4.5).
Digital signatures depend on the message. Distinct messages yield dif-
ferent signatures. Thus, like classical message authentication codes, digital
signatures can also be used to guarantee the integrity of messages.
1.3 Attacks
The primary goal of cryptography is to keep the plaintext secret from eaves-
droppers trying to get some information about the plaintext. As discussed
before, adversaries may also be active and try to modify the message. Then,
cryptography is expected to guarantee the integrity of the messages. Adver-
saries are assumed to have complete access to the communication channel.
Cryptanalysis is the science of studying attacks against cryptographic
schemes. Successful attacks may, for example, recover the plaintext (or parts
of the plaintext) from the ciphertext, substitute parts of the original mes-
sage, or forge digital signatures. Cryptography and cryptanalysis are often
subsumed by the more general term cryptology.
A fundamental assumption in cryptanalysis was first stated by A. Kerkhoff
in the nineteenth century. It is usually referred to as Kerkhoff’s Principle. It
states that the adversary knows all the details of the cryptosystem, includ-
ing algorithms and their implementations. According to this principle, the
security of a cryptosystem must b e entirely based on the secret keys.

Attacks on the secrecy of an encryption scheme try to recover plaintexts
from ciphertexts, or even more drastically, to recover the secret key. The fol-
lowing survey is restricted to passive attacks. The adversary, as usual we call
her Eve, does not try to modify the messages. She monitors the communica-
tion channel and the end points of the channel. So she may not only intercept
the ciphertext, but (at least from time to time) she may be able to observe
the encryption and decryption of messages. She has no information about
the key. For example, Eve might be the operator of a bank computer. She
sees incoming ciphertexts and sometimes also the corresponding plaintexts.
Or she observes the outgoing plaintexts and the generated ciphertexts. Per-
haps she manages to let encrypt plaintexts or decrypt ciphertexts of her own
choice.
The possible attacks depend on the actual resources of the adversary Eve.
They are usually classified as follows:
1.4 Cryptographic Protocols 5
1. Ciphertext-only attack. Eve has the ability to obtain ciphertexts. This
is likely to be the case in any encryption situation. Even if Eve cannot
perform the more sophisticated attacks described below, one must assume
that she can get access to encrypted messages. An encryption method
that cannot resist a ciphertext-only attack is completely insecure.
2. Known-plaintext attack. Eve has the ability to obtain plaintext-ciphertext
pairs. Using the information from these pairs, she attempts to decrypt a
ciphertext for which she does not have the plaintext. At first glance, it
might appear that such information would not ordinarily be available to
an attacker. However, it very often is available. Messages may be sent in
standard formats which Eve knows.
3. Chosen-plaintext attack. Eve has the ability to obtain ciphertexts for
plaintexts of her choosing. Then she attempts to decrypt a ciphertext
for which she does not have the plaintext. While again this may seem
unlikely, there are many cases in which Eve can do just this. For example,

she sends some interesting information to her intended victim which she
is confident he will encrypt and send out. This type of attack assumes
that Eve must first obtain whatever plaintext-ciphertext pairs she wants
and then do her analysis, without any further interaction. This means
that she only needs access to the encrypting device once.
4. Adaptively-chosen-plaintext attack. This is the same as the previous at-
tack, except now Eve may do some analysis on the plaintext-ciphertext
pairs, and subsequently get more pairs. She may switch between gather-
ing pairs and performing the analysis as often as she likes. This means
that she has either lengthy access to the encrypting device or can some-
how make repeated use of it.
5. Chosen- and adaptively-chosen-ciphertext attack. These two attacks are
similar to the above plaintext attacks. Eve can choose ciphertexts and
gets the corresponding plaintexts. She has access to the decryption de-
vice.
1.4 Cryptographic Protocols
Encryption and decryption algorithms, cryptographic hash functions or
pseudorandom generators (see Section 2.1, Chapter 8) are the basic building
blocks (also called cryptographic primitives) for solving problems involving
secrecy, authentication or data integrity.
In many cases a single building block is not sufficient to solve the given
problem: different primitives must be combined. A series of steps must be
executed to accomplish a given task. Such a well-defined series of steps is
called a cryptographic protocol. As is also common, we add another condition:
we require that two or more parties are involved. We only use the term
protocol if at least two people are required to complete the task.
6 1. Introduction
As a counter example, take a look at digital signature schemes. A typical
scheme for generating a digital signature first applies a cryptographic hash
function h to the message m and then, in a second step, computes the signa-

ture by applying a public-key decryption algorithm to the hash value h(m).
Both steps are done by one person. Thus, we do not call it a protocol.
Typical examples of protocols are protocols for user identification. There
are many situations where the identity of a user Alice has to be verified.
Alice wants to log in to a remote computer, for example, or to get access
to an account for electronic banking. Passwords or PIN numbers are used
for this purpose. This method is not always secure. For example, anyone
who observes Alice’s password or PIN when transmitted might be able to
impersonate her. We sketch a simple challenge-and-response protocol which
prevents this attack (however, it is not perfect; see Section 4.2.1).
The proto col is based on a public-key signature scheme, and we assume
that Alice has a key k = (pk, sk) for this scheme. Now, Alice can prove her
identity to Bob in the following way.
1. Bob randomly chooses a “challenge” c and sends it to Alice.
2. Alice signs c with her secret key, s := Sign(sk, c), and sends the “re-
sponse” s to Bob.
3. Bob accepts Alice’s proof of identity, if Verify(pk, s, c) = ok.
Only Alice can return a valid signature of the challenge c, because only she
knows the secret key sk. Thus, Alice proves her identity, without showing her
secret. No one can observe Alice’s secret key, not even the verifier Bob.
Suppose that an eavesdropper Eve observed the exchanged messages.
Later, she wants to impersonate Alice. Since Bob selects his challenge c at
random (from a huge set), the probability that he uses the same challenge
twice is very small. Therefore, Eve cannot gain any advantage by her obser-
vations.
The parties in a protocol can be friends or adversaries. Protocols can be
attacked. The attacks may be directed against the underlying cryptographic
algorithms or against the implementation of the algorithms and protocols.
There may also be attacks against a protocol itself. There may be passive
attacks performed by an eavesdropper, where the only purpose is to obtain

information. An adversary may also try to gain an advantage by actively
manipulating the protocol. She might pretend to be someone else, substitute
messages or replay old messages.
Important protocols for key exchange, electronic elections, digital cash
and interactive proofs of identity are discussed in Chapter 4.
1.5 Provable Security
It is desirable to design cryptosystems that are provably secure. Provably se-
cure means that mathematical proofs show that the cryptosystem resists cer-
1.5 Provable Security 7
tain types of attacks. Pioneering work in this field was done by C.E. Shannon.
In his information theory, he developed measures for the amount of informa-
tion associated with a message and the notion of perfect secrecy. A perfectly
secret cipher perfectly resists all ciphertext-only attacks. An adversary gets
no information at all about the plaintext, even if his resources in comput-
ing power and time are unlimited. Vernam’s one-time pad (see Section 2.1),
which encrypts a message m by XORing it bitwise with a truly random bit
string, is the most famous perfectly secret cipher. It even resists all the pas-
sive attacks mentioned. This can be mathematically proven by Shannon’s
theory. Classical information-theoretic security is discussed in Section 9.1;
an introduction to Shannon’s information theory may be found in Appendix
B. Unfortunately, Vernam’s one-time pad and all perfectly secret ciphers are
usually impractical. It is not practical in most situations to generate and
handle truly random bit sequences of sufficient length as required for perfect
secrecy.
More recent approaches to provable security therefore abandon the ideal
of perfect secrecy and the (unrealistic) assumption of unbounded computing
power. The computational complexity of algorithms is taken into account.
Only attacks that might be feasible in practice are considered. Feasible means
that the attack can be performed by an efficient algorithm. Of course, here
the question about the right notion of efficiency arises. Certainly, algorithms

with non-polynomial running time are inefficient. Vice versa algorithms with
polynomial running time are often considered as the efficient ones. In this
book, we also adopt this notion of efficiency.
The way a cryptographic scheme is attacked might be influenced by ran-
dom events. Adversary Eve might toss a coin to decide which case she tries
next. Therefore, probabilistic algorithms are used to model attackers. Break-
ing an encryption system, for example by a ciphertext-only attack, means that
a probabilistic algorithm with polynomial running time manages to derive in-
formation about the plaintext from the ciphertext, with some non-negligible
probability. Probabilistic algorithms can toss coins, and their control flow
may be at least partially directed by these random events. By using random
sources, they can be implemented in practice. They must not be confused
with non-deterministic algorithms. The notion of probabilistic (polynomial)
algorithms and the underlying probabilistic model are discussed in Chap-
ter 5.
The security of a public-key cryptosystem is based on the hardness of
some computational problem (there is no efficient algorithm for solving the
problem). For example, the secret keys of an RSA scheme could be easily
figured out if computing the prime factors of a large integer were possible.
4
4
What “large” means depends on the available computing power. Today, a 1024-
bit integer is considered as large.
8 1. Introduction
However, it is b elieved that factoring large integers is infeasible.
5
There are
no mathematical proofs for the hardness of the computational problems used
in public-key systems. Therefore, security proofs for public-key methods are
always conditional: they depend on the validity of the underlying assumption.

The assumption usually states that a certain function f is one way; i.e., f
can be computed efficiently, but it is infeasible to compute x from f(x). The
assumptions, as well as the notion of a one-way function, can be made very
precise by the use of probabilistic polynomial algorithms. The probability of
successfully inverting the function by a probabilistic polynomial algorithm
is negligibly small, and negligibly small means that it is asymptotically less
than any given polynomial bound (see Chapter 6, Definition 6.12). Important
examples, like the factoring, discrete logarithm and quadratic residuosity
assumptions, are included in this book (see Chapter 6).
There are analogies to the classical notions of security. Shannon’s perfect
secrecy has a computational analogy: ciphertext indistinguishability (or se-
mantic security). An encryption is perfectly secret if and only if an adversary
cannot distinguish between two plaintexts, even if her computing resources
are unlimited: if adversary Eve knows that a ciphertext c is the encryption of
either m or m

, she has no better chance than
1
/
2
of choosing the right one.
Ciphertext indistinguishability – also called polynomial-time indistinguisha-
bility – means that Eve’s chance of successfully applying a probabilistic poly-
nomial algorithm is at most negligibly greater than
1
/
2
(Chapter 9, Definition
9.14).
As a typical result, it is proven in Section 9.4 that public-key one-time

pads are ciphertext-indistinguishable. This means, for example, that the RSA
public-key one-time pad is ciphertext-indistinguishable under the sole as-
sumption that the RSA function is one way. A public-key one-time pad is
similar to Vernam’s one-time pad. The difference is that the message m is
XORed with a pseudorandom bit sequence which is generated from a short
truly random seed, by means of a one-way function.
Thus, one-way functions are not only the essential ingredients of public-
key encryption and digital signatures. They also yield computationally perfect
pseudorandom bit generators (Chapter 8). If f is a one-way function, it is not
only impossible to compute x from f(x), but certain bits (called hard-core
bits) of x are equally difficult to deduce. This feature is called the bit security
of a one-way function. For example, the least-significant bit is a hard-core bit
for the RSA function x → x
e
mod n. Starting with a truly random seed,
repeatedly applying f and taking the hard-core bit in each step, you get
a pseudorandom bit sequence. These bit sequences cannot be distinguished
from truly random bit sequences by an efficient algorithm, or, equivalently
(Yao’s Theorem, Section 8.2), it is practically impossible to predict the next
bit from the previous ones. So they are really computationally perfect.
5
It is not known whether breaking RSA is easier than factoring the modulus. See
Chapters 3 and 6 for a detailed discussion.
1.5 Provable Security 9
The bit security of important one-way functions is studied in detail in
Chapter 7 including an in-depth analysis of the probabilities involved.
Randomness and the security of cryptographic schemes are closely related.
There is no security without randomness. An encryption method provides se-
crecy only if the ciphertexts appear random to the adversary Eve. Vernam’s
one-time pad is perfectly secret, because, due to the truly random key string

k, the encrypted message m ⊕ k
6
is a truly random bit sequence for Eve.
The public-key one-time pad is ciphertext-indistinguishable, because if Eve
applies an efficient probabilistic algorithm, she cannot distinguish the pseudo-
random key string and, as a consequence, the ciphertext from a truly random
sequence.
Public-key one-time pads are secure against passive eavesdroppers, who
perform a ciphertext-only attack (see Section 1.3 above for a classification
of attacks). However, active adversaries, who perform adaptively-chosen-
ciphertext attacks, can be a real danger in practice – as demonstrated by Ble-
ichenbacher’s 1-Million-Chosen-Ciphertext Attack (Section 3.3.3). Therefore,
security against such attacks is also desirable. In Section 9.5, we study two ex-
amples of public-key encryption schemes which are secure against adaptively-
chosen-ciphertext attacks, and their security proofs. One of the examples,
Cramer-Shoup’s public key encryption scheme, was the first practical scheme
whose security proof is based solely on a standard number-theoretic assump-
tion and a standard assumption of hash functions (collision-resistance).
The ideal cryptographic hash function is a random function. It yields hash
values which cannot be distinguished from randomly selected and uniformly
distributed values. Such a random function is also called a random oracle.
Sometimes, the security of a cryptographic scheme can be proven in the
random oracle model. In addition to the assumed hardness of a computational
problem, such a proof relies on the assumption that the hash functions used
in the scheme are truly random functions. Examples of such schemes include
the public-key encryption schemes OAEP (Section 3.3.4) and SAEP (Section
9.5.1), the above mentioned signature scheme PSS and full-domain-hash RSA
signatures (Section 3.4.5). We give the random-oracle proofs for SAEP and
full-domain-hash signatures.
Truly random functions can not be implemented, nor even perfectly ap-

proximated in practice. Therefore, a proof in the random oracle model can
never be a complete security proof. The hash functions used in practice are
constructed to be good approximations to the ideal of random functions.
However, there were surprising errors in the past (see Section 3.4).
We distinguished different types of attacks on an encryption scheme. In a
similar way, the attacks on signature schemes can be classified and different
levels of security can be defined. We introduce this classification in Chap-
ter 10 and give examples of signature schemes whose security can be proven
solely under standard assumptions (like the factoring or the strong RSA as-
6
⊕ denotes the bitwise XOR operator, see page 13.
10 1. Introduction
sumption). No assumptions on the randomness of a hash function have to be
made, in contrast, for example, to schemes like PSS. A typical security proof
for the highest level of security is included. For the given signature scheme,
we show that not a single signature can be forged, even if the attacker Eve
is able to obtain valid signatures from the legitimate signer, for messages she
has chosen adaptively.
The security proofs for public-key systems are always conditional and de-
pend on (widely believed, but unproven) assumptions. On the other hand,
Shannon’s notion of perfect secrecy and, in particular, the perfect secrecy
of Vernam’s one-time pad are unconditional. Although perfect unconditional
security is not reachable in most practical situations, there are promising at-
tempts to design practical cryptosystems which provably come close to perfect
information-theoretic security. The proofs are based on classical information-
theoretic methods and do not depend on unproven assumptions. The security
relies on the fact that communication channels are noisy or on the limited
storage capacity of an adversary. Some results in this approach are reviewed
in the chapter on provably secure encryption (Section 9.6).
2. Symmetric-Key Encryption

In this chapter, we give an introduction to symmetric-key encryption. We
explain the notions of stream and block ciphers. The operation modes of
block ciphers are studied and, as prominent examples for block ciphers, DES
and AES are described.
Symmetric-key encryption provides secrecy when two parties, say Alice
and Bob, communicate. An adversary who intercepts a message should not
get any significant information about its content.
To set up a secure communication channel, Alice and Bob first agree on
a key k. They keep their shared key k secret. Before sending a message m
to Bob, Alice encrypts m by using the encryption algorithm E and the key
k. She obtains the ciphertext c = E(k, m) and sends c to Bob. By using the
decryption algorithm D and the same key k , Bob decrypts c to recover the
plaintext m = D(k, c).
We speak of symmetric encryption, because both communication part-
ners use the same key k for encryption and decryption. The encryption and
decryption algorithms E and D are publicly known. Anyone can decrypt a
ciphertext, if he or she knows the key. Thus, the key k has to be kept secret.
A basic problem in a symmetric scheme is how Alice and Bob can agree
on a shared secret key k in a secure and efficient way. For this key exchange,
the methods of public-key cryptography are needed, which we discuss in the
subsequent chapters. There were no solutions to the key exchange problem,
until the revolutionary concept of public-key cryptography was discovered 30
years ago.
We require that the encrypted plaintext m can be uniquely recovered
from the ciphertext c. This means that for a fixed key k, the encryption map
must be bijective. Mathematically, symmetric encryption may be considered
as follows.
Definition 2.1. A symmetric-key encryption scheme consists of a map
E : K ×M −→ C,
such that for each k ∈ K, the map

E
k
: M −→ C, m −→ E(k, m)