Public Key Encryption Part 1
1. Administrative and Exam-Writing Remarks
At the beginning of the lecture, the lecturer gave a reminder about writing solutions for cryptographic security games.
When describing an attack or adversary, one should write the solution step by step, even if some steps feel obvious.
For example, instead of only saying that an adversary breaks a construction, one should explicitly describe actions such as:
- query a message to an oracle;
- receive a ciphertext;
- compute a value from the ciphertext, for example by XORing it with another known value;
- repeat the process for another message if needed;
- compare the obtained values;
- finally output a guess.
The point is that a step-by-step description makes the thought process clear to the graders and avoids ambiguity.
The lecturer also mentioned that students who do not need to take the second date have no lecture next week.
2. Motivation: From Key Exchange to Public-Key Encryption
In the previous lecture, the course discussed the problem of distributing secret keys and the idea of key exchange.
In a key exchange protocol, Alice and Bob interact with each other in order to derive a shared secret key:
\[ K. \]
An eavesdropper may see all communication, but should not be able to compute the shared key.
Public key encryption is based on a similar intuition, but instead of running an interactive puzzle every time, the receiver publishes a fixed puzzle. This public puzzle is called the public key.
The motivation is especially clear for email or asynchronous messaging.
If Alice wants to send Bob an encrypted email, she does not want to first interact with Bob in real time. She wants to obtain some public information about Bob and use it to encrypt a message that only Bob can decrypt.
In private-key encryption, the same key is used for encryption and decryption:
\[ \mathsf{Enc}_K(m), \qquad \mathsf{Dec}_K(c). \]
Therefore, if Bob simply published the private key \(K\) on his website, then everyone could decrypt all ciphertexts.
Public key encryption solves this asymmetry problem by using two different keys:
\[ pk \quad \text{for encryption}, \]
and
\[ sk \quad \text{for decryption}. \]
The public key \(pk\) can be published. Anyone can use it to encrypt messages for Bob. The secret key \(sk\) is kept private by Bob and is needed to decrypt.
The intended structure is:
\[ c \leftarrow \mathsf{Enc}(pk,m), \]
and only the owner of \(sk\) should be able to compute
\[ m = \mathsf{Dec}(sk,c). \]
The public key behaves like a computational puzzle: it is easy to use the public key to create ciphertexts, but it should be hard to recover the secret key or decrypt ciphertexts without the corresponding secret key.
3. Public Key Distribution
Public key encryption still requires Alice to obtain Bob’s public key somehow.
For example, Bob may publish his public key on a website, or a messaging system may distribute public keys for users.
The lecturer mentioned Signal and WhatsApp as examples of systems that still have a kind of key distribution center, but not in the old private-key sense. The server distributes users’ public keys, not their private keys.
Thus, if Alice wants to talk to Bob, the server may give Alice Bob’s public key. Alice can then encrypt messages end-to-end for Bob. The messages may still pass through the servers, but the servers should not be able to read them.
The important difference is:
\[ \text{private-key distribution center: distributes shared secret keys}, \]
whereas
\[ \text{public-key directory: distributes public keys}. \]
Public key encryption does not completely eliminate the problem of key distribution. Alice still needs an authentic public key for Bob. However, it removes the need for Alice and Bob to be online at the same time for every secure communication.
4. Aside: Identity-Based Encryption
The lecturer briefly mentioned identity-based encryption as a more advanced idea.
In ordinary public key encryption, Bob’s public key is a random-looking string of bits. Alice must somehow obtain this public key before encrypting.
In identity-based encryption, the public key can be an identity string, such as an email address:
\[ \texttt{bob@example.com}. \]
Then Alice could encrypt directly to Bob’s identity, without first downloading Bob’s public key.
However, this requires a special trusted party that issues private keys to users. Bob would need to obtain the corresponding secret key from this trusted party.
So the idea is:
\[ pk_{\text{Bob}} = \text{Bob's identity string}. \]
For example:
\[ pk_{\text{Bob}} = \texttt{bob@example.com}. \]
Then Alice can encrypt to that string, while Bob obtains the corresponding secret key from the trusted authority.
This is not the main topic of the basic course, but it illustrates how cryptography can sometimes make public keys more user-friendly.
5. Syntax of Public Key Encryption
A public key encryption scheme consists of three probabilistic polynomial-time algorithms, except that decryption is usually deterministic:
\[ (\mathsf{KeyGen}, \mathsf{Enc}, \mathsf{Dec}). \]
Here PPT means that the algorithms run in polynomial time and may use randomness.
5.1. Key Generation
The key generation algorithm takes the security parameter \(1^\lambda\) as input and outputs a public key and a secret key:
\[ (pk,sk) \leftarrow \mathsf{KeyGen}(1^\lambda). \]
The security parameter is written in unary as \(1^\lambda\), as usual in complexity-based cryptography.
The public key is meant to be distributed publicly.
The secret key is kept private by the receiver.
5.2. Encryption
The encryption algorithm takes a public key and a message as input and outputs a ciphertext:
\[ c \leftarrow \mathsf{Enc}(pk,m). \]
A crucial point is that public-key encryption must normally be randomized.
More explicitly, one may write:
\[ c = \mathsf{Enc}(pk,m;r), \]
where \(r\) is fresh encryption randomness.
In the lecture slides, this randomness is hidden in the notation, so we simply write:
\[ c \leftarrow \mathsf{Enc}(pk,m). \]
Because the encryption key is public, anyone can run this algorithm.
5.3. Decryption
The decryption algorithm takes the secret key and a ciphertext as input and outputs a message:
\[ m := \mathsf{Dec}(sk,c). \]
For malformed ciphertexts, especially when discussing CCA security, decryption may also output a failure symbol:
\[ \bot. \]
For correctly generated ciphertexts, decryption should recover the original message.
5.4. Correctness
Correctness says that if a message is encrypted under the public key, then decrypting with the corresponding secret key gives back the same message.
Formally, for all security parameters \(\lambda \in \mathbb{N}\) and all messages \(m\),
\[ \Pr\left[ \mathsf{Dec}(sk,\mathsf{Enc}(pk,m)) = m \right] = 1, \]
where
\[ (pk,sk) \leftarrow \mathsf{KeyGen}(1^\lambda). \]
The probability is over the randomness of key generation and encryption.
Compared with private-key encryption, the main syntactic difference is that encryption uses \(pk\), while decryption uses \(sk\).
6. Textbook RSA
The first public key encryption proposal was given by Rivest, Shamir, and Adleman in 1978.
This scheme is now known as RSA.
The simple version discussed in the lecture is called textbook RSA.
The lecturer emphasized that textbook RSA should not be used in practice. It is important historically and conceptually, but it has serious security problems.
6.1. Factoring-Based Intuition
RSA is based on the hardness of factoring.
The key generation algorithm chooses two large prime numbers:
\[ P, Q. \]
Then it computes the modulus
\[ N = P \cdot Q. \]
The value \(N\) is public.
The assumed hard problem is:
\[ \text{given } N, \text{ find } P \text{ and } Q. \]
If \(P\) and \(Q\) are large primes, factoring \(N\) should be hard.
If \(N\) had many small factors, factoring would be easy. One could simply try dividing by small primes such as \(2,3,5,\dots\). Therefore RSA relies on the fact that \(N\) is the product of two large primes.
The lecturer gave a rough size intuition: in older settings, primes of around 512 bits were used, while nowadays much larger parameters are needed. In modern practice, one usually speaks about the total RSA modulus size, for example a 2048-bit or larger modulus.
6.2. Euler Phi Function
For
\[ N = P \cdot Q \]
with prime \(P\) and \(Q\), Euler’s phi function is
\[ \varphi(N) = (P-1)(Q-1). \]
This value is easy to compute if one knows \(P\) and \(Q\), but it should be hard to compute from \(N\) alone.
6.3. Key Generation
Textbook RSA key generation works as follows.
Choose two random \(\lambda\)-bit primes \(P,Q\), and set
\[ N := P \cdot Q. \]
Choose a public exponent \(e\) such that
\[ \gcd(e,\varphi(N)) = 1. \]
Then compute \(d\) such that
\[ e d \equiv 1 \pmod{\varphi(N)}. \]
That is, \(d\) is the modular inverse of \(e\) modulo \(\varphi(N)\).
The public key is
\[ pk := (N,e). \]
The secret key is
\[ sk := (N,d). \]
The value \(N\) appears in both keys, but the actual secret information is \(d\). Computing \(d\) is easy if one knows \(P\) and \(Q\), because then one can compute \(\varphi(N)\). Without the factorization of \(N\), computing \(d\) should be hard.
A common RSA public exponent in practice is
\[ e = 65537 = 2^{16}+1. \]
6.4. Encryption
For a message
\[ m \in \mathbb{Z}_N, \]
textbook RSA encryption computes
\[ c := m^e \bmod N. \]
6.5. Decryption
Textbook RSA decryption computes
\[ m := c^d \bmod N. \]
6.6. Why Decryption Works
Since
\[ c = m^e \bmod N, \]
decryption gives
\[ c^d \equiv (m^e)^d = m^{ed} \pmod N. \]
Because
\[ ed \equiv 1 \pmod{\varphi(N)}, \]
RSA’s correctness theorem implies that
\[ m^{ed} \equiv m \pmod N. \]
So decryption recovers the original message.
The lecturer did not go deeply into the number theory in this lecture. The main intuition is that \(e\) and \(d\) behave like inverse exponents.
6.7. Modular Arithmetic Reminder
The notation
\[ x \bmod N \]
means the remainder after division by \(N\).
For example,
\[ 5 \bmod 2 = 1. \]
RSA operates in modular arithmetic, not over ordinary real numbers.
7. Security Problems of Textbook RSA
Textbook RSA has many problems as an encryption scheme.
The two main problems discussed in the lecture were:
- encryption is deterministic;
- ciphertexts are malleable because of the multiplicative structure.
7.1. Deterministic Encryption
Textbook RSA encryption is deterministic:
\[ c = m^e \bmod N. \]
For a fixed public key and a fixed message \(m\), the ciphertext is always the same.
Therefore, anyone can test whether a ciphertext \(c\) encrypts a guessed message \(m\) by checking whether
\[ c \stackrel{?}{=} \mathsf{Enc}(pk,m). \]
For textbook RSA, this means checking
\[ c \stackrel{?}{=} m^e \bmod N. \]
Example:
Suppose Alice sends Bob an encrypted message, and the attacker guesses that the plaintext is
\[ m = \text{``I am Alice''}. \]
Because Bob’s public key is public, the attacker can compute
\[ c' = \mathsf{Enc}(pk,\text{``I am Alice''}). \]
Then the attacker compares \(c'\) with the observed ciphertext \(c\).
If
\[ c' = c, \]
then the attacker knows that the plaintext was indeed
\[ \text{``I am Alice''}. \]
This is why deterministic public key encryption cannot be IND-CPA secure.
7.2. Multiplicative Homomorphism
Textbook RSA also has a multiplicative property.
If
\[ c_1 = \mathsf{Enc}(pk,m_1) = m_1^e \bmod N \]
and
\[ c_2 = \mathsf{Enc}(pk,m_2) = m_2^e \bmod N, \]
then
\[ c_1 \cdot c_2 \equiv m_1^e \cdot m_2^e = (m_1m_2)^e \pmod N. \]
Thus,
\[ c_1 \cdot c_2 \bmod N = \mathsf{Enc}(pk,m_1m_2). \]
In particular, if
\[ c = \mathsf{Enc}(pk,m), \]
then
\[ 2^e \cdot c \bmod N = \mathsf{Enc}(pk,2m). \]
So an attacker can transform a ciphertext for \(m\) into a ciphertext for \(2m\), without knowing \(m\).
This is a form of malleability.
The lecturer noted that such a property can sometimes be useful. In homomorphic encryption, one intentionally wants operations on ciphertexts to correspond to operations on plaintexts.
However, for ordinary encryption, this is dangerous: an attacker should not be able to modify ciphertexts in a meaningful way.
8. IND-CPA Security for Public Key Encryption
The lecture then defined IND-CPA security for public key encryption.
This definition is analogous to IND-CPA security for private-key encryption, but there is an important difference:
In public-key encryption, the adversary receives the public key.
Because the adversary has \(pk\), it can run the encryption algorithm by itself. Therefore, unlike in the private-key setting, there is no need to give the adversary an encryption oracle.
8.1. IND-CPA Experiment
The public-key IND-CPA experiment proceeds as follows.
The challenger generates a key pair:
\[ (pk,sk) \leftarrow \mathsf{KeyGen}(1^\lambda). \]
The challenger samples a random challenge bit:
\[ b \leftarrow \{0,1\}. \]
- The challenger sends the public key \(pk\) to the adversary \(\mathcal{A}\).
The adversary outputs two challenge messages:
\[ m_0, m_1. \]
These must be valid messages. In standard definitions, they are usually required to have the same length, so that message length does not trivially reveal the answer.
The challenger encrypts one of the two messages:
\[ c^\star \leftarrow \mathsf{Enc}(pk,m_b). \]
- The challenger sends \(c^\star\) to the adversary.
The adversary outputs a guess:
\[ b'. \]
The experiment outputs \(1\) if the adversary guessed correctly:
\[ b' = b. \]
Otherwise, the experiment outputs \(0\).
8.2. IND-CPA Definition
A public key encryption scheme
\[ (\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec}) \]
is IND-CPA secure if for every PPT adversary \(\mathcal{A}\), there exists a negligible function \(\nu\) such that for all \(\lambda \in \mathbb{N}\),
\begin{equation*} \left| \Pr[\mathsf{IND\text{-}CPA}_{\mathcal{A}}(\lambda)=1] - \frac{1}{2} \right| < \nu(\lambda). \end{equation*}The expression
\begin{equation*} \left| \Pr[\mathsf{IND\text{-}CPA}_{\mathcal{A}}(\lambda)=1] - \frac{1}{2} \right| \end{equation*}is the adversary’s advantage over random guessing.
So the definition says that every efficient adversary can do only negligibly better than guessing.
Equivalently, one may write that
\[ \Pr[\mathsf{IND\text{-}CPA}_{\mathcal{A}}(\lambda)=1] = \frac{1}{2} + \mathsf{negl}(\lambda). \]
The lecturer mentioned that both ways of expressing the idea may appear in student solutions.
9. Why Randomized Encryption Is Necessary
If public-key encryption is deterministic, IND-CPA security is impossible.
Suppose encryption is deterministic. Then the adversary can do the following:
- Receive the public key \(pk\).
- Choose two distinct messages \(m_0,m_1\).
- Send \(m_0,m_1\) to the challenger.
Receive the challenge ciphertext
\[ c^\star = \mathsf{Enc}(pk,m_b). \]
Compute
\[ c_0 := \mathsf{Enc}(pk,m_0). \]
If
\[ c^\star = c_0, \]
output
\[ b' = 0. \]
Otherwise output
\[ b' = 1. \]
Because encryption is deterministic, this adversary wins with probability essentially \(1\).
Therefore:
\[ \boxed{ \text{deterministic public-key encryption cannot be IND-CPA secure.} } \]
This is why the syntax of public-key encryption defines
\[ \mathsf{Enc} \]
as a randomized algorithm.
However, randomness alone is not sufficient for security. One still has to prove that the scheme is secure.
The lecturer gave practical anecdotes about systems that mistakenly used things like Base64 encoding or predictable codes as if they were encryption. Base64 is only an encoding, not encryption. Adding superficial randomness or encoding does not magically give cryptographic security.
The practical lesson was:
\[ \boxed{ \text{Do not implement your own crypto unless you really know what you are doing.} } \]
10. Explicit IND-CPA Attack on Textbook RSA
The lecturer then described how one would write an IND-CPA attack on textbook RSA.
Let
\[ pk = (N,e). \]
The adversary \(\mathcal{A}\) does the following.
- Receive \(pk = (N,e)\).
Choose two distinct messages
\[ m_0, m_1 \in \mathbb{Z}_N. \]
- Send \(m_0,m_1\) to the challenger.
Receive
\[ c^\star. \]
Compute
\[ c_0 := m_0^e \bmod N. \]
If
\[ c^\star = c_0, \]
output
\[ b' = 0. \]
Otherwise output
\[ b' = 1. \]
Since textbook RSA is deterministic, if the challenger encrypted \(m_0\), then
\[ c^\star = m_0^e \bmod N. \]
If the challenger encrypted \(m_1\), then for distinct messages the ciphertext will be different except for negligible or excluded degenerate cases.
Thus the adversary distinguishes the challenge ciphertext and breaks IND-CPA security.
Therefore:
\[ \boxed{ \text{textbook RSA is not IND-CPA secure.} } \]
11. Is IND-CPA Security Enough?
The next question was whether IND-CPA security is enough.
The lecturer motivated chosen-ciphertext attacks using real-world services.
Imagine a service that receives ciphertexts, decrypts them internally, and then does something based on the plaintext.
For example:
- a voting service decrypts an encrypted vote and accepts or rejects it;
- a message service decrypts a ciphertext and posts the resulting message;
- a system decrypts a ciphertext and increments a counter for Alice or Bob;
- a server responds differently depending on whether the decrypted plaintext has the expected format.
Even if the service does not directly return the plaintext, its behavior may leak information.
For example, suppose the decrypted plaintext is supposed to contain a name. If sending a certain ciphertext causes Alice’s counter to increase, then the attacker learns that the plaintext was related to Alice.
This kind of service can behave like a decryption oracle.
Therefore, IND-CPA does not model all realistic attacks. We need a stronger definition where the adversary can query a decryption oracle.
12. IND-CCA Security
IND-CCA stands for indistinguishability under chosen ciphertext attacks.
It is also called IND-CCA2 security when one wants to distinguish it from CCA1 security.
The key new feature is that the adversary receives access to a decryption oracle.
The oracle takes ciphertexts \(c\) and returns
\[ \mathsf{Dec}(sk,c). \]
The adversary may submit arbitrary bitstrings as ciphertexts. They do not have to be honestly generated outputs of the encryption algorithm.
This is important because attackers may send malformed or random ciphertexts to a real service and observe the response.
12.1. IND-CCA Experiment
The IND-CCA experiment proceeds as follows.
The challenger generates keys:
\[ (pk,sk) \leftarrow \mathsf{KeyGen}(1^\lambda). \]
The challenger samples
\[ b \leftarrow \{0,1\}. \]
- The challenger sends the public key \(pk\) to the adversary.
Before the challenge, the adversary may query a decryption oracle.
For any ciphertext \(c\), the oracle returns
\[ \mathsf{Dec}(sk,c). \]
This may be a message \(m\), or it may be the failure symbol
\[ \bot. \]
The adversary sends two challenge messages
\[ m_0,m_1. \]
The challenger computes
\[ c^\star \leftarrow \mathsf{Enc}(pk,m_b) \]
and sends \(c^\star\) to the adversary.
After receiving \(c^\star\), the adversary again gets access to the decryption oracle.
However, the adversary is not allowed to query the exact challenge ciphertext \(c^\star\).
Formally, post-challenge queries must satisfy
\[ c \neq c^\star. \]
If this restriction did not exist, the adversary could simply ask the decryption oracle to decrypt \(c^\star\), immediately learn \(m_b\), and win trivially.
Finally, the adversary outputs
\[ b'. \]
The experiment outputs \(1\) if
\[ b'=b. \]
12.2. IND-CCA Definition
A public key encryption scheme is IND-CCA secure if for every PPT adversary \(\mathcal{A}\), there exists a negligible function \(\nu\) such that for all \(\lambda \in \mathbb{N}\),
\begin{equation*} \left| \Pr[\mathsf{IND\text{-}CCA}_{\mathcal{A}}(\lambda)=1] - \frac{1}{2} \right| < \nu(\lambda). \end{equation*}IND-CCA is stronger than IND-CPA because the adversary has more power.
In particular, the adversary can try to modify the challenge ciphertext \(c^\star\) into a related ciphertext \(c \neq c^\star\), send it to the decryption oracle, and observe what happens.
A secure scheme should prevent this from helping.
13. Example: Adding a Dummy Bit Breaks IND-CCA Security
The lecturer gave an important example showing why CCA security is sensitive to even small ciphertext modifications.
Assume we start with a public key encryption scheme
\[ \Pi_1 = (\mathsf{KeyGen}_1,\mathsf{Enc}_1,\mathsf{Dec}_1) \]
that is IND-CCA secure.
Now define a new scheme
\[ \Pi_2 = (\mathsf{KeyGen}_2,\mathsf{Enc}_2,\mathsf{Dec}_2) \]
as follows.
Key generation is the same:
\[ \mathsf{KeyGen}_2 = \mathsf{KeyGen}_1. \]
Encryption adds a useless leading bit \(0\):
\[ \mathsf{Enc}_2(pk,m) = 0 \,\|\, \mathsf{Enc}_1(pk,m). \]
Decryption ignores the first bit:
\[ \mathsf{Dec}_2(sk,b \,\|\, c) = \mathsf{Dec}_1(sk,c). \]
At first glance, this may look harmless. The extra bit does not contain any message information.
However, \(\Pi_2\) is not IND-CCA secure.
13.1. Attack
In the IND-CCA game, the adversary receives the challenge ciphertext
\[ c^\star = 0 \,\|\, c, \]
where
\[ c = \mathsf{Enc}_1(pk,m_b). \]
The adversary then constructs a different ciphertext:
\[ \tilde{c} = 1 \,\|\, c. \]
Clearly,
\[ \tilde{c} \neq c^\star. \]
Therefore, the adversary is allowed to query the decryption oracle on \(\tilde{c}\).
The oracle returns
\[ \mathsf{Dec}_2(sk,\tilde{c}) = \mathsf{Dec}_2(sk,1 \,\|\, c) = \mathsf{Dec}_1(sk,c) = m_b. \]
Thus the adversary learns the challenge plaintext \(m_b\) and can output the correct bit \(b\).
So even though the first bit was supposed to be useless, the scheme fails CCA security because ciphertexts can be modified without being rejected.
13.2. Lesson
CCA security requires more than hiding the plaintext.
It also requires that ciphertexts cannot be meaningfully modified.
A good CCA-secure scheme should reject manipulated ciphertexts, usually by outputting
\[ \bot. \]
This connects to the intuition from authenticated encryption: if ciphertexts can be modified and still decrypt, then the scheme is vulnerable to chosen-ciphertext attacks.
14. IND-CCA1 Security
The lecture then introduced an intermediate notion called IND-CCA1 security.
IND-CCA1 is weaker than IND-CCA2.
In IND-CCA1, the adversary receives a decryption oracle only before seeing the challenge ciphertext.
After the challenge ciphertext \(c^\star\) is given, the adversary no longer has access to the decryption oracle.
So the structure is:
- receive \(pk\);
- make decryption queries;
- submit \(m_0,m_1\);
receive
\[ c^\star = \mathsf{Enc}(pk,m_b); \]
- output a guess \(b'\) without further decryption queries.
Formally, a scheme is IND-CCA1 secure if for every PPT adversary \(\mathcal{A}\), there exists a negligible function \(\nu\) such that
\begin{equation*} \left| \Pr[\mathsf{IND\text{-}CCA1}_{\mathcal{A}}(\lambda)=1] - \frac{1}{2} \right| < \nu(\lambda). \end{equation*}14.1. Intuition for CCA1
CCA1 models a situation where the attacker had access to some decryption leakage in the past, but this access stops before the target challenge ciphertext appears.
For example, a service may have had an implementation bug that leaked decryption behavior. The attacker could query the service for a while. Later, the bug is fixed, and only after that does the attacker receive a target ciphertext.
CCA1 captures this weaker kind of chosen-ciphertext exposure.
14.2. Relation Between CCA1 and CCA2
IND-CCA2 gives the adversary decryption oracle access both before and after the challenge.
IND-CCA1 gives decryption oracle access only before the challenge.
Therefore:
\[ \boxed{ \text{IND-CCA2 security implies IND-CCA1 security.} } \]
But the converse is not necessarily true.
15. Choosing the Right Security Notion
The lecturer emphasized that security definitions model different attacker capabilities.
Which notion is needed depends on the application.
If the application never exposes any decryption behavior, then IND-CPA may be enough.
If there is any chance that an attacker can observe how a system decrypts ciphertexts, then one should consider CCA security.
In practice, the safest approach is usually to use schemes with the strongest standard notion available, namely IND-CCA2 security, because real systems often leak more than designers initially expect.
However, stronger schemes may be more complicated.
16. Relation to Future Lectures
The lecturer previewed later topics.
Textbook RSA is based on factoring.
Future lectures will discuss ElGamal and hashed ElGamal, which are based on Diffie–Hellman style assumptions and discrete logarithm structures.
The lecturer mentioned the following high-level picture:
- textbook RSA is not IND-CPA secure;
- basic ElGamal is IND-CPA secure under suitable assumptions, but not fully IND-CCA secure;
- hashed ElGamal gives a stronger notion such as IND-CCA1, but still not full IND-CCA2 in the version previewed;
- later the course will discuss how to obtain full CCA security.
The lecturer also mentioned hybrid encryption.
The idea of hybrid encryption is to combine public-key encryption with private-key encryption:
- the public-key part is used to establish or encapsulate a symmetric key;
- the symmetric-key part is used to encrypt the actual message efficiently.
This is important because public-key encryption is usually slower than private-key encryption.
A CCA-secure hybrid encryption construction may use a CCA-secure private-key encryption scheme internally.
17. Public-Key IND-CPA vs Private-Key IND-CPA
A student asked whether public-key IND-CPA is stronger than private-key IND-CPA because the adversary receives the public key rather than merely oracle access.
The lecturer’s answer was that the notions are not directly comparable, because they model different settings.
In private-key encryption, the secret key is hidden, and the adversary may get oracle access depending on the security game.
In public-key encryption, the adversary receives a public key and can encrypt locally. The public key is like a puzzle: the adversary can inspect it, compute with it, and try to recover the secret key.
So the adversary does have more explicit public information in the public-key setting, but the two definitions belong to different cryptographic models.
18. Final Summary
Public key encryption allows encrypted communication without requiring the sender and receiver to interact at the same time.
The receiver publishes a public key
\[ pk, \]
and keeps a secret key
\[ sk. \]
Anyone can encrypt using \(pk\), but only the holder of \(sk\) should be able to decrypt.
A public key encryption scheme consists of
\[ (\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec}). \]
Correctness requires
\[ \mathsf{Dec}(sk,\mathsf{Enc}(pk,m)) = m. \]
Textbook RSA was the first public key encryption proposal, based on the difficulty of factoring
\[ N = P \cdot Q. \]
Its operations are:
\[ c = m^e \bmod N, \]
and
\[ m = c^d \bmod N. \]
However, textbook RSA is not IND-CPA secure because it is deterministic.
Deterministic public-key encryption cannot be IND-CPA secure, since anyone can re-encrypt guessed messages using the public key and compare ciphertexts.
Textbook RSA is also malleable:
\[ \mathsf{Enc}(pk,m_1)\cdot \mathsf{Enc}(pk,m_2) \equiv \mathsf{Enc}(pk,m_1m_2) \pmod N. \]
IND-CPA security for public-key encryption is defined like private-key IND-CPA, except that the adversary receives the public key and does not need an encryption oracle.
IND-CCA security, also called IND-CCA2 security, additionally gives the adversary access to a decryption oracle before and after the challenge, except that the adversary may not query the exact challenge ciphertext.
IND-CCA1 is weaker: the adversary has decryption oracle access only before the challenge.
The hierarchy is:
\[ \text{IND-CCA2} \implies \text{IND-CCA1} \implies \text{IND-CPA}. \]
The main conceptual lesson is:
\[ \boxed{ \text{Public-key encryption must be randomized and non-malleable enough for the desired security notion.} } \]
And the practical lesson is:
\[ \boxed{ \text{Use standard, well-analyzed cryptographic schemes; do not implement your own crypto.} } \]