Intro & Perfect Secrecy
Course overview, Shannon’s definition of perfect security, and the one-time pad.
1. Course staff
Instructors: Shafi Goldwasser and Vinod Vaikuntanathan
Teaching assistants: Noga Amit and Zoe Xi
2. Course website
All information about the class can be found on the course website.
3. Grading
- 30% of the grade: midterm.
- 40% of the grade: final.
- 10% of the grade: five problem sets.
- 10% of the grade: oral problem-set review, scheduled after the midterm.
- 10% of the grade: class participation.
- You may collaborate on problem sets in small groups of up to three, but must write your solutions separately and in your own words. We strongly recommend not using AI tools to solve your problem sets.
- If you need an extension for any reason, email the staff and you will be granted 48 additional hours, no questions asked. If you need more time, contact S3 if you are an undergraduate or your academic advisor if you are a graduate student.
4. What is this class about?
This is a foundations class in which we will learn fundamental concepts in cryptography. We will see three themes.
- Definitions. We will learn how to think adversarially: how to model the adversary, its goals, and its capabilities. We will focus on finding the “correct definitions” that capture the real world. When trying to achieve secrecy, integrity, authenticity, fairness, zero knowledge, or another cryptographic goal, we often encounter an impossibility result. Cryptography is the art of overcoming such barriers—often by carefully choosing the definitions and models.
- Hardness assumptions. Most cryptography relies on hardness assumptions because unconditional security is often impossible. These assumptions come from number theory, group theory, elliptic curves, lattices, and coding theory.
- Reductions. We prove security via reductions: if an adversary breaks our scheme, we transform that adversary into a break of the underlying hardness assumption. As Silvio Micali puts it, “science wins either way!”
We will use these concepts to do what has always seemed indistinguishable from magic: communicate secretly and authentically without meeting to share a secret; compute on encrypted data; prove statements without revealing why they are true; hide in plain sight; and more.
5. Perfect security and the one-time pad
Claude Shannon was the first to give a rigorous definition of secure encryption [1]. His definition is now commonly called perfect security. He also showed that a very simple encryption scheme—the one-time pad—satisfies this definition.
First, let us understand the syntax of an encryption scheme. Alice and Bob need a private or secret key that the eavesdropper Eve does not know; otherwise, Eve can simulate Bob and recover the hidden message whenever Bob does. We will revisit this assumption later in the course. For now, we study symmetric-key, or secret-key, encryption.
An encryption scheme has a message space \(\mathcal M\) (the plaintext space), a ciphertext space \(\mathcal C\), a key space \(\mathcal K\), and two polynomial-time algorithms with syntax
Correctness. For every \(m\in\mathcal M\) and \(k\in\mathcal K\),
Security. To be defined.
Correctness is the easy part. How do we define what it means for an encryption scheme to be secure? For now, it makes sense to restrict the adversary to eavesdropping on communications between Alice and Bob, rather than actively tampering with them. One thing at a time.
We want to be maximalistic: seeing a ciphertext should not help the adversary determine the transmitted message beyond any prior knowledge already conveyed by the message distribution \(M\). If \(M\) is uniform over \(\{\texttt{buy},\texttt{sell}\}\), then even after seeing the ciphertext, the adversary’s view should remain 50–50. This is the essence of Shannon’s definition.
6. How to define security
An encryption scheme has message, ciphertext, and key spaces \(\mathcal M,\mathcal C,\mathcal K\), and polynomial-time algorithms \((\Enc,\Dec)\). It satisfies correctness as above and, for every distribution \(M\) over \(\mathcal M\), every plaintext \(m\in\mathcal M\), and every ciphertext \(c\in\mathcal C\),
The definition does not refer explicitly to an adversary. Nevertheless, it captures the idea that Eve knows exactly as much about the plaintext after seeing the ciphertext as she did before. The ciphertext reveals no information about \(m\).
An encryption scheme \((\Enc,\Dec)\) is perfectly indistinguishable if for every \(m_0,m_1\in\mathcal M\) and every \(c\in\mathcal C\),
An encryption scheme is perfectly secret if and only if it is perfectly indistinguishable.
Proof.
First, suppose \((\Enc,\Dec)\) is Shannon secure. Fix plaintexts \(m_0,m_1\in\mathcal M\) and a ciphertext \(c\in\mathcal C\). Let \(M\) be uniform on \(\{m_0,m_1\}\), so \(\Pr[M=m_0]=\Pr[M=m_1]=1/2\). By Shannon security, for each \(b\in\{0,1\}\),
Bayes’ theorem gives
Combining these equalities,
Since this holds for both \(b=0\) and \(b=1\), the two ciphertext probabilities are equal, proving perfect indistinguishability.
Conversely, suppose the scheme is perfectly indistinguishable. Let \(M\) be any distribution over \(\mathcal M\), and fix \(m_0\in\mathcal M\) and \(c\in\mathcal C\). By Bayes’ rule,
Perfect indistinguishability implies
Substituting into Bayes’ rule yields \(\Pr[M=m_0\mid\Enc(k,M)=c]=\Pr[M=m_0]\), as required.
There is a third, equivalent definition in which Eve appears explicitly. It resembles many of the definitions we will use later.
An encryption scheme \((\Enc,\Dec)\) is perfectly secure against an adversary if for every \(\mathcal E:\mathcal C\rightarrow\{0,1\}\) and every pair \(m_0,m_1\in\mathcal M\),
It is a good exercise to show that this definition is equivalent to perfect indistinguishability, and therefore to Shannon security.
7. The one-time pad
Shannon not only gave the first rigorous definition of secure encryption; he also constructed a scheme satisfying it. The construction is known as the one-time pad.
For any integer \(n\), the message, ciphertext, and key spaces are all \(\{0,1\}^n\). Choose \(n\) large enough to accommodate the plaintexts to be sent.
The one-time pad is elegant, simple, and efficient. It is also easy to prove perfectly indistinguishable, which immediately implies perfect secrecy.
The one-time pad is perfectly indistinguishable.
Proof.
For plaintexts \(m_0,m_1\in\{0,1\}^n\) and ciphertext \(c\in\{0,1\}^n\), there are unique keys \(k_0:=m_0\oplus c\) and \(k_1:=m_1\oplus c\) satisfying \(\Enc(k_b,m_b)=c\). Therefore,
Thus the probabilities are equal for \(m_0\) and \(m_1\), as desired.
8. The one-time pad can be used only once
The one-time pad has been used significantly in practice, especially by diplomats transmitting classified information during World War II. However, a key of length \(n\) can encrypt only \(n\) bits. To exchange a 1 GB message, Alice and Bob must first exchange a 1 GB key.
Reusing a key \(k\gets\{0,1\}^n\) to encrypt two messages \(m_0,m_1\in\{0,1\}^n\) breaks security because
The unfortunate fact is that this limitation is inherent.
If \((\Enc,\Dec)\) is perfectly indistinguishable, then \(|\mathcal K|\geq|\mathcal M|\).
Proof.
For every plaintext \(m\in\mathcal M\) and every ciphertext \(c\) in the image of \(\Enc\), at least one key must map \(m\) to \(c\); otherwise the scheme is not perfectly indistinguishable. Two distinct plaintexts cannot map to the same ciphertext under the same key, because correctness would then be impossible. Thus there must be at least as many keys as ciphertexts. Since there must be at least one distinct ciphertext for every plaintext, there must be at least as many keys as plaintexts.
We will later consider randomized encryption algorithms. The same impossibility result holds for randomized encryption, though the proof is slightly more delicate.
This impossibility result is unacceptable for our goals. We want to agree on a single key \(k\gets\{0,1\}^n\) and then encrypt arbitrarily many messages. Given the lower bound, we must somehow weaken the security definition.
To see how, examine the attack. Suppose \(|\mathcal K|<|\mathcal M|\), and Eve receives \(c=\Enc(k,m_b)\). She can compute
If \(m_0\in M_c\) and \(m_1\notin M_c\), Eve outputs 0. If \(m_1\in M_c\) and \(m_0\notin M_c\), she outputs 1. If both lie in \(M_c\), she outputs a random bit.
The lower-bound proof shows that for some pair \(m_0,m_1\), there is a probability \(p>0\) that one plaintext does not lie in \(M_c\). Eve then succeeds with probability at least \((1+p)/2>1/2\).
But deciding whether \(m_b\in M_c\) is extremely challenging: it takes time roughly \(2^n\). Even for \(n=256\), this is more than the number of molecules on Earth. Since Eve represents an entity in the real world, let us restrict her running time to be significantly less than \(2^n\). This turns out to be a very good idea.