Encryption mode diagrams.

[doc/ips] / enc-intro.tex

\xcalways\section{Introduction to Encryption}\x

\xcalways\subsection{Security notions and attacks}\x

\begin{slide}
  \head{Security notions for encryption}

  What does it mean to say that an encryption scheme is secure?
\end{slide}

\begin{slide}
  \topic{adversarial goals}
  \resetseq
  \head{Encryption: adversarial goals \seq}

  \begin{description}
  \item [Indistinguishability (find-then-guess)] The adversary chooses two
    plaintexts.  One is selected at random, and the ciphertext is returned.
    The adversary cannot guess which plaintext was chosen with probability
    significantly better than $\frac{1}{2}$.
  \item [Semantic security] An adversary given a ciphertext cannot compute
    anything about the plaintext that it couldn't compute given only its
    length.
  \end{description}
\end{slide}

\begin{slide}
  \head{Encryption: adversarial goals \seq}

  \begin{description}
  \item [Indistinguishability (left-or-right)] The adversary is given an
    oracle which accepts two plaintexts.  Before the game begins, a decision
    is taken as to whether the oracle returns the result of encrypting the
    `left' plaintext, or the `right' one.  The adversary cannot guess which
    with probability significantly better than $\frac{1}{2}$.
  \item [Indistinguishability (real-or-random)] The adversary is given an
    oracle.  Before the game begins, a decision is taken as to whether the
    oracle correctly encrypts the plaintexts it is given (`real') or whether
    it returns a ciphertext for a randomly chosen plaintext of the same
    length (`random').  The adversary cannot guess which with probability
    significantly better than $\frac{1}{2}$.
  \end{description}
\end{slide}

\begin{slide}
  \head{Encryption: adversarial goals \seq}

  \begin{description}
  \item [Non-malleability] An adversary cannot transform a ciphertext such
    that the plaintexts of the two ciphertexts are related, with better than
    negligible probability.
  \item [Plaintext awareness] An adversary cannot create a ciphertext without
    `knowing' (or easily being able to find out) the corresponding plaintext
    (or knowing that the ciphertext is invalid), except with negligible
    probability.
  \end{description}
\end{slide}

\begin{slide}
  \topic{types of attacks}
  \head{Encryption: types of attacks}

  \begin{description}
  \item [Chosen plaintext] The adversary may encrypt plaintexts of its
    choice.  In the asymmetric setting, it is given a public key; in the
    symmetric setting, it is provided with an encryption oracle.
  \item [Chosen ciphertext (lunchtime)] (Find-then-guess, semantic security
    and non-malleability) As with chosen plaintext, but the adversary is
    given an oracle which can decrypt ciphertexts during its first stage.
  \item [Adaptive chosen ciphertexts] As with standard chosen ciphertexts,
    except that the adversary is given the decryption oracle for its entire
    run.  The adversary is forbidden from using the oracle to decrypt
    ciphertexts which it is required to distinguish.
  \end{description}
\end{slide}

\begin{slide}
  \topic{funny abbreviations}
  \head{Funny abbreviations}

  The attack goals are given abbreviations: IND, NM, PA for
  indistinguishability, non-malleability and plaintext awareness.

  The attack types are given abbreviations too: CPA, CCA1, CCA2 for chosen
  plaintext, chosen ciphertext and adaptive chosen ciphertext.

  Hence, IND-CPA means `indistinguishable under chosen plaintext attack',
  NM-CCA2 means `non-malleable under chosen ciphertext attack'.
  
  PA stands on its own (but there are two different meanings).
\end{slide}

\endinput

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: "ips"
%%% End: