# CS 276, Spring 2004 Cryptography

Instructor:
David Wagner (daw@cs, 765 Soda Hall, 642-2758)

Lectures:
Monday/Wednesday, 10:30-12:00, 310 Soda

### Announcements

• No class on Monday, May 10! Last lecture is Wednesday, May 5.
• Final projects are due at 9am on Wed, May 19.

### Lectures

Here is a list of past lectures and the topics covered. I've also indicated possibilities for further reading. B&R = Bellare & Rogaway's notes; V7 = Vadhan's lecture 7; etc.

01 (1/21): Introduction. Basic motivating scenarios for cryptography. History. Information-theoretic secrecy. [notes] (V1,V3; B&R intro, B&R info-theory)

02 (1/26): Shannon secrecy. Computational indistinguishability. Pseudorandom generators. [notes] (V3,V11; B&R info-theory)

03 (1/28): Exercises with indistinguishability. Pseudorandom functions. Pseudorandom permutations. [notes + notes] (B&R block ciphers, B&R prfs; V12)

04 (2/2): Pseudorandom functions and permutations. The birthday paradox. PRF/PRP switching lemma. [notes + notes] (B&R prfs, B&R Appendix A; V12)

05 (2/4): Guest lecture from Umesh Vazirani.

06 (2/9): Symmetric-key schemes. Definitions of security (IND-CPA): real-or-random, left-or-right, find-then-guess. Equivalence of real-or-random and left-or-right. [notes] (B&R symm encryption)

07 (2/11): Left-or-right and find-then-guess are equivalent. Semantic security. Find-then-guess and semantic security are equivalent. [notes + notes] (B&R symm encryption)

08 (2/18): CTR mode is IND-CPA secure. Message integrity: INT-PTXT, INT-CTXT. Encryption does not provide integrity. [notes + notes] (B&R integrity)

09 (2/23): Message authentication codes (MACs). 2-universal hashing. PRFs are good MACs. Stretching the input size of a PRF. [notes + notes]

10 (2/25): HMAC. Broken systems. The need for message authentication when encrypting. IND-CCA2. [notes + notes]

11 (3/1): IND-CPA and INT-CTXT => IND-CCA2. Intro to number theory: groups, finite fields, Fermat's theorem, Euler's theorem, Legendre symbols, quadratic residues. [notes] (paper on EtA, AtE, E&A) (B&R number thy)

12 (3/3): Public key encryption. Trapdoor one-way permutations: RSA, Rabin. Hard-core bits. [notes + notes] (B&R asym enc)

13 (3/8): Goldreich-Levin theorem. Goldwasser-Micali public-key encryption. [notes] (Goldreich-Levin notes: from a previous class, from Mihir Bellare)

14 (3/10): Goldwasser-Micali for arbitrary-length messages. Hard-core bits from any trapdoor one-way permutation. The random oracle model. Simple RSA. [??? + notes] (paper on random oracles)

15 (3/15): Chosen-ciphertext secure public-key encryption in the random oracle model. Non-malleability. Public-key signatures. Several candidate signature schemes. [David M. + notes]

16 (3/17): Full Domain Hash (FDH). Probabilistic Full Domain Hash (PFDH). Pitfalls of the random oracle model. [notes + notes]

17 (3/29): Implications in symmetric-key cryptography. The following are equivalent: OWF, PRG, PRF, PRP, symmetric-key encryption, bit commitment, coin flipping. [notes + Alex]

18 (3/31): Guest lecture from Vinod Prabhakaran: information-theoretic (unconditionally secure) cryptography.

19 (4/5): Bit commitment, coin flipping. Signatures from any one-way function. Black-box reductions and separations, Impagliazzo-Rudich. [notes + notes]

20 (4/7): Algebraic cryptanalysis of public-key cryptosystems. Factoring: Fermat's method, Dixon's algorithm, quadratic sieve. Attacks on RSA: the common modulus attack, the related message attack. Lattices and cryptanalysis.

21 (4/12): Interactive proof systems. Zero-knowledge proofs. ZKIP for 3-coloring. Zero-knowledge proofs of knowledge.

22 (4/14): Secret sharing. Shamir's scheme for t-out-of-n sharing. Verifiable secret sharing. Pedersen's VSS scheme. [notes] [partial notes (from S'02) + errata regarding accusals + Shamir's original paper]

23 (4/19) Secure multi-party computation. The millionaire's problem. Adversary models: semi-honest, malicious. Definitions of security for the semi-honest model. Oblivious transfer. [partial notes (from S'02) + notes on the defn]

24 (4/21) A general 2-party protocol secure against semi-honest attackers, for any functionality. Definitions of security for the malicious model.

25 (4/26) Finishing up multi-party computation. Electronic cash. Blind signatures, Chaum's online ecash scheme, payer- and payee-anonymity. [notes (from S'02)]

26 (4/28) Threshold cryptography. Schemes with trusted dealer: RSA, El Gamal. Security in the malicious model. Distributed key generation for El Gamal.

27 (5/3) Electronic voting protocols. Honest-verifier zero-knowledge proofs of knowledge of a discrete log; of equality of two discrete logs. The Fiat-Shamir heuristic for non-interactive ZK. The disjunction trick. The Cramer-Gennaro-Schoenmakers protocol.

28 (5/5) Mixes. Publicly verifiable mixes. Anonymous email. Visual cryptography. Chaum's digital voting protocol.

### Assignments

Homework 1 (due 2/2): assignment [solution].

Homework 2 (due 2/9): assignment [solution].

Midterm 1 (due 3/17): assignment [solution] [common errors].

### Course Overview

This class teaches the theory, foundations and applications of modern cryptography. In particular, we treat cryptography from a complexity-theoretic viewpoint. In recent years, researchers have found many practical applications for these theoretical results, and so we will also discuss their impact along the way and how one may use the theory to design secure systems.

### Official Course Description

CS276: Cryptography. Prerequisite: CS170. Graduate survey of modern topics on theory, foundations, and applications of modern cryptography. One-way functions; pseudorandomness; encryption; authentication; public-key cryptosystems; notions of security. May also cover zero-knowledge proofs, multi-party cryptographic protocols, practical applications, and/or other topics, as time permits.

### Syllabus

This list is tentative and subject to change.

• Introduction. Basic motivating scenarios for cryptography. History. Information-theoretic secrecy.
• Block ciphers. Standard modes of operation.
• Pseudorandom functions. Pseudorandom permutations. The birthday paradox. Applications. One-way functions.
• Symmetric encryption schemes. Definitions. IND-CPA. Security of standard modes of operation. IND-CCA2.
• Message authentication. MACs. Definitions. PRFs as MACs. CBC-MAC.
• Authenticated encryption. INT-PTXT. INT-CTXT. Non-malleability.
• Commitment schemes. Hard-core predicates. Goldreich-Levin theorem.
• Pseudorandom generators. PRG's from OWF's. Blum-Micali-Yao.
• PRF's from PRG's. Goldreich-Goldwasser-Micali
• Basics on number theory. Number-theoretic primitives. RSA. Rabin's function. Definition of trapdoor one-way functions.
• Public-key encryption. Definitions. Semantic security. Message indistinguishability. Goldwasser-Micali cryptosystem. Hybrid encryption.
• Digital signatures. Trapdoor signatures. RSA. Random oracles. Full-domain hash. PSS.
• Zero knowledge proofs. Proofs of knowledge.
• Foundations. Constructions of signatures based on any one-way function. Oracles and separations.
If there is time, advanced topics may also include:
• Secret sharing. Shamir's scheme. Generalized access structures.
• Threshold cryptography. Verifiable secret sharing. Proactive security.
• Secure voting schemes. Electronic cash.
• Secure multi-party computation.
• Cryptographic protocols.

### Enrollment Policies

The class appears to be over-enrolled at the moment. This is a graduate course, and as such, EECS graduate students will receive first priority on taking the course. I hope to be able to accomodate all interested EECS graduate students.

Homeworks: 10%
Scribe notes: 20%
Take-home midterm: 30%
Final project: 40%

You will be asked to write a set of scribe notes for either a lecture or for a set of homework solutions. We strongly recommend that scribe notes be written in LaTeX. Please make an effort to make your scribe notes "beautiful", clear, and readable.

You will do a final project. Further details will be made available here.

We will assign several homework sets throughout the semester. To really learn this material, it is important that you not only watch our lectures but also practice the material. Please turn in your homework solutions on paper at the beginning of class on the appropriate day.

### Textbook

There is no required textbook.

The following sources may be helpful as a reference, and will provide supplemental material.

M. Bellare and P. Rogaway, Introduction to Modern Cryptography.
We will follow their exposition fairly closely.
S. Goldwasser and M. Bellare, Lecture Notes on Cryptography.
Another excellent set of notes, with a somewhat different focus.