A Designers Guide to KEMs Alex Dent [email protected]
http://www.isg.rhul.ac.uk/~alex
Slide 2
Asymmetric Ciphers Involve two keys: a public key and a private
key. Alice wants to send a message to Bob. Alice encrypts the
message using Bobs public key. Bob decrypts the message using his
private key.
Slide 3
Asymmetric Ciphers Tremendously convenient (if we ignore the
need for a PKI). Slow for both encryption and decryption. Usually
only work with short messages.
Slide 4
Hybrid Ciphers An asymmetric cipher that combines both
asymmetric and symmetric cryptographic techniques. - ISO/IEC
18033-2
Slide 5
Hybrid Ciphers 1.Randomly generate a symmetric key. 2.Encrypt
the message using that symmetric key and some symmetric technique.
3.Encrypt the symmetric key using an asymmetric technique. 4.Send
both parts to Bob.
Slide 6
Hybrid Ciphers 1.Decrypt the asymmetric ciphertext to recover
the random symmetric key. 2.Decrypt the symmetric part using the
newly decrypted random symmetric key. Hybrid ciphers can cope with
long messages and are not much slower then traditional asymmetric
ciphers.
Slide 7
Hybrid Ciphers Techniques has been used for years (Used in PGP,
SSL/TLS, IPSec.) Can be done badly (see Why textbook ElGamal and
RSA encryption are insecure by Boneh, Joux and Nguyen.) Formalised
as a KEM-DEM system by Shoup.
Slide 8
Slide 9
KEMs and DEMs Formalise hybrid ciphers by splitting it into two
parts: Asymmetric key encapsulation mechanism (KEM) Symmetric data
encapsulation mechanism (DEM)
Slide 10
KEMs and DEMs KEM takes as input a public key and produces a
random symmetric key of a pre- specified length and an encryption
of that key. DEM takes as input a symmetric key and a message and
outputs an encryption of that message. Both have specific security
requirements.
Slide 11
KEMs and DEMs pkC1C1 mC2C2 K KEM DEM
Slide 12
KEMs and DEMs K KEM DEM m C1C1 C2C2 sk
Slide 13
The Security Criterion for KEMs Indistinguishable from random
(IND) in the adaptive chosen ciphertext model (CCA2). A KEM is
secure if, given a symmetric key K and a ciphertext C produced by
the KEM, no attacker can tell if C decrypts to gave K or whether K
was chosen at random. (The attacker also gets to make queries to a
KEM decryption oracle in the usual way).
Slide 14
Designing KEMs By secure here we mean secure in a very weak
sense. We only assume that the encryption algorithm is secure in
the OW-CPA model. Can we build secure KEMs from secure encryption
algorithms?
Slide 15
Designing KEMs Secure in the OW-CPA model means it is hard to
invert a random ciphertext given only the public key. Two known
constructions: RSA-KEM and PSEC-KEM. Both have security proofs
based on the underlying encryption mechanism.
Slide 16
Known Constructions I 1.Generate a random plaintext. 2.Encrypt
the plaintext to give a ciphertext. 3.Hash the plaintext and
ciphertext to give a symmetric key. RNG ENCRYPT HASH K C r
Slide 17
Known Constructions I Provably secure (in the random oracle
model) However proof needs two extra assumptions: The encryption
algorithm must remain secure even if the attacker is given the
ability to tell the difference between valid and invalid
ciphertexts. We must be able to tell if a plaintext/ciphertext pair
is valid or not for the encryption algorithm. Both of these
conditions are fulfilled by RSA.
Slide 18
Known Constructions II RNG HASHSPLITSMOOTHENCRYPT HASH XOR K
C1C1 C2C2
Slide 19
New Constructions I 1.Generate a random plaintext. 2.Encrypt
the plaintext to give a ciphertext. 3.Hash the plaintext to get a
checksum. 4.Hash the plaintext to give a symmetric key. RNG HASH K
C2C2 r ENCRYPT C1C1
Slide 20
New Constructions I Provably secure (in the RO model). Still
need to have one extra assumption: We must be able to tell if a
plaintext/ciphertext pair is valid or not for the encryption
algorithm. This condition is always satisfied if the encryption
algorithm is deterministic.
Slide 21
New Constructions II 1.Generate a random plaintext. 2.Hash the
plaintext to get a string of random looking bits. 3.Encrypt the
plaintext using the hash code as the random coins. 4.Hash that
ciphertext to give a symmetric key. RNG ENCRYPT HASH K C r
Slide 22
New Constructions II Provably Secure (in the RO model). No need
for extra assumptions but does need a formal definition of
probabilistic encryption algorithm. Surprisingly, it doesnt work
for deterministic algorithms (it becomes the first known
construction).
Slide 23
Rabin-KEM As a practical example we will describe a new KEM
that is provably as secure as factoring. There are already several
hybrid schemes based on the difficulty of factoring (e.g. EPOC-2)
but no KEMs. Uses New Construction I.
Slide 24
Encryption Let n=pq be an RSA modulus. 1.Choose r in the range
1, , n. 2.Let C 1 =Hash(r). 3.Let C 2 =r 2 mod n. 4.Let K=Hash(r).
5.Output K and (C 1,C 2 ).
Slide 25
Decryption Let the secret key be some method of determining
square roots modulo n. 1.Compute the four square roots of C 2 : r
1, r 2, r 3, and r 4. 2.If there exists exactly one r i such that
Hash(r i )=C 1 then output Hash(r i ). 3.Otherwise output
error.
Slide 26
Rabin-KEM Provably as secure as factoring (in the random oracle
model). Checksum helps identify correct root. Small chance that
valid ciphertexts may be rejected.
Slide 27
Conclusions KEM-DEM constructions promising, practical area of
research. More efficient constructions (especially in terms of
ciphertext length)? Specialist constructions?
