English language

How to pronounce querier in English?

Full Transcript

in this video we're going to talk about
the most secure cipher in the world
why nobody uses it and what we do
instead
now if you haven't seen our video on
classical ciphers
go back and check that out first now you
remember from the last video we looked
at
three classical ciphers the caesar
cipher
the vigenere cipher and the enigma
machine
each of these ciphers leaks information
for example
the caesar cipher leaks information
about the frequency of plaintext letters
because
that information is preserved in the
ciphertext now the visionaire cipher
still leaks information because
the message is typically much longer
than the key
and the key is applied to the message by
repeating itself
over and over again so some of that
structure is still preserved
then of course there's the enigma
machine which leaks information
about what the plaintext isn't so
is it even possible to build a cipher
that leaks
no information at all we actually can do
this
it's called the one-time pad
the one-time pad looks just like the
vigenere cipher but with
three crucial exceptions the key must be
exactly
as long as the message no repeats
allowed the key must also be chosen
uniformly at random that means all
keys in the key space must be equally
likely to be chosen and finally
the key can never be reused
now if you can satisfy those three
requirements then
encrypting a message with the one-time
pad is just the same as the vigenere
each letter of the key corresponds to a
position in the alphabet
and you transform the plaintext
character by moving it forward
that many spaces in the alphabet now
here's the
magic of the one-time pad
if i gave you a cipher text and i asked
you to tell me what the message was
you've got a problem because the key has
to be
as large as the plain text that means
that the key space
is as big as the plain text space
if i wanted to make a guess about what
the plain text was
i could make a guess about what the key
was
i could apply that key to the ciphertext
to get back
a guess about what the plaintext was
so here's what this means for any
ciphertext
there exists some key that will decrypt
it
into any possible message
and what that means is that you get no
information
about what the plaintext was we call
this
information theoretic security
what this means is that the one-time pad
is unbreakable
in the sense that all the computing
power that ever was and ever will be
would not help you to recover the
message
it can't every key was equally likely to
have been chosen
and there is some key that will
transform your ciphertext
into any message so you just can't tell
which one it was
now you're saying wow this is great
unbreakable cryptography
that's nuts why don't we use that every
day well there's a few
practical problems they're not little
problems either they're big problems
the first one is that the key has to be
as long as the message itself
so all you've really done is taken the
problem of securely communicating a
message
and you've traded it for securely
communicating a key
so if you wanted to use a one-time pad
to encrypt
this video you would have to take
hundreds of megabytes of data and
somehow
securely transmitted to mountain view
for
every video you wanted to watch and then
you would have to have them
store it until you were ready to receive
the video
then if either party ever reused
any portion of the key material all of
the perfect security properties are
broken
so in practice what we want is a single
short fixed length key that we can use
to encrypt
all kinds of data this isn't information
theoretic security
it's computational security remember in
this model
brute forcing the key is still possible
even though it might be hard
so what should it mean for a cipher in
this model to be secure
well the one-time pad reveals no
information about the plaintext
given the ciphertext so it'd be really
cool if we could capture a similar idea
in the computational security model
this leads us to an important security
concept called
semantic security here's how it works
imagine alice and bob are communicating
in two different universes
now imagine in both universes all the
computers in the world
are trying to recover some information
about the plaintext
now imagine kirchhoff's principle
applies
in both universes that means that in
both universes
these computers receive information
about which cipher was used
and even how long the cipher text was
but in universe a that's all these
computers get
universe b they get the same information
except
they also get the ciphertext
so obviously if you don't have the
ciphertext you're not going to be able
to do decryption
however in universe b since they have
the cipher text
they can try to brute force the key and
there's a non-zero chance that they'll
just get lucky
and find the right one so universe b has
a small advantage over universe a
so if we can formalize what we mean by
the two universes being
basically the same and we can show
that these two universes are basically
the same then what we're doing is we're
saying that
seeing the ciphertext doesn't give you
any information
so this is what we mean by semantically
secure
but how do we actually go about proving
that a cipher
is or isn't semantically secure in order
to do this
we're going to play a game not a fun
game like minecraft or baseball
it's an abstract game like game theory
it has players
rules and some kind of winning condition
this is a game about encryption the
game's going to involve
some cipher the game goes like this
i start by picking two messages from the
plain text space
any two messages i want and i send them
to you
then you flip a coin if it's heads you
pick the first message
and if it's tails you pick the second
message now whichever message you pick
you're going to encrypt it using the
cipher and a particular key
we call this the challenge ciphertext
you're going to send the challenge
ciphertext to me and now i have to guess
which of the two messages you picked
if i'm right i win we're going to call
this
the eavesdropping game because it models
what it would be like
for an attacker who's eavesdropping a
communication channel
now there's a few interesting
implications of this game
the first is if i guess randomly i will
win
50 percent of the time remember you're
picking the message
with a 50 50 chance if i also pick with
a 50 50 chance
our guesses will be the same 50 percent
of the time
second if i have any ability at all
to distinguish the ciphertext i can win
this game with a greater than 50
chance if i can't distinguish ciphertext
i can't do better than 50
but even if i use a strategy that causes
me to win
less than 50 percent of the time i can
always just take my strategy
and then guess the opposite of whatever
my strategy says
and then i will win more than 50 of the
time
so the advantage i have in winning this
game is how
far off of 50 50 i am
remember if i'm less than 50 i can
always just guess the opposite to become
more than 50.
so is my advantage in the eavesdropping
game
ever zero well no because
i get the challenge ciphertext which
means that in principle i could try to
brute force it
and there's some probability that i'll
get lucky and find the right key
depending on the ciphertext it might be
a small chance but it's not zero
so how small is so small
it basically doesn't matter that's what
we're interested in formalizing
this brings us to the notion of what's
called a negligible function
we're parameterizing this function in
the context of the security parameter of
the cipher
the key length and we say that we have a
negligible advantage in winning this
game
if our advantage is less than or equal
to a negligible function in the security
parameter
in other words our advantage is less
than or equal to
a number that's so small we don't care
we say a cipher is indistinguishable
under eavesdropping if there is no
probabilistic
polynomial time turing machine
essentially an efficient algorithm
that can win the eavesdropping game with
an advantage that is greater than
negligible
okay so how would you use this
definition to prove
that the caesar vigenere and enigma
ciphers
are not indistinguishable under
eavesdropping
what challenge ciphertext would you pick
what algorithm would you use
to make a guess about the challenge
ciphertext
and what advantage would this strategy
give you
however it turns out in practice that
indistinguishability under eavesdropping
is too strong a security notion
it's unreasonable and practice to assume
that eavesdropping is the best an
attacker can do
what if we look at some other models
that grant the attacker
additional powers
one such power is called the chosen
plaintext attack
the chosen plaintext attack game runs
exactly the same as the eavesdropping
game
the only difference is we give the
guesser
and additional power the ability to make
encryption queries
what that means is that i as the querier
can ask
you to do some encryptions for me i can
send you
any plaintext i want and you will send
me back
the encryption of that plain text under
the same key that you will use
to encrypt the challenge ciphertext
what that does is it allows me as the
querier to potentially get some
information about what the key might be
now if i cannot get an advantage
distinguishing ciphertext
even though i have the power to ask you
to encrypt plaintext for me then
we say the system is indistinguishable
under
chosen plane text attack ind cpa
indistinguishability under chosen plain
text attack was the original framing
of the notion of semantic security by
goldwasser and mccally
who won the touring award for their work
now let's consider a game that gives the
guesser even more powers
we call this the chosen ciphertext
attack
it runs exactly the same as the chosen
plaintext attack
except that as the querier i also have
the ability to ask you
to decrypt messages for me
the only restriction is that this power
runs out
when i submit the challenge plaintext
if i cannot get a non-negligible
advantage winning the chosen ciphertext
attack
game even though i have the ability to
request you to decrypt things for me
then we say that the system is
indistinguishable
under chosen ciphertext attack but we're
going to make a distinction here we're
going to call this the
non-adaptive version because there's an
adaptive version
the non-adapter version we call it ind
one and finally there's something called
the adaptive
chosen ciphertext attack it proceeds
exactly the same
as the non-adaptive version except that
you can continue
making decryption queries after you've
received the challenge ciphertext
the only catch is that i cannot ask you
to decrypt the challenge ciphertext for
me
otherwise what's the point of the game
but that doesn't mean
that i couldn't take the challenge
ciphertext and modify it in some
trivial way and give it to you and ask
you to decrypt it
now if despite all of this i still can't
get an advantage in winning this game
despite all of these powers we say that
the cipher
is indistinguishable under adaptive
chosen
ciphertext attack end cca 2.
now that's the standard that we apply to
cryptography
that we use on the internet today so for
example
the security protocol that's encrypting
this video stream right now
is secure under adaptive chosen
ciphertext attack
now this may seem abstract but there are
real world situations
where it is possible for real-life
attackers to
make these kind of decryption queries in
roundabout ways
which is why we need a security
definition that's like this
now i've described these attack models
in very informal terms
if you'd like to read a more formal
definition of these security levels
check out this textbook by katzen
lindell i'll leave a link in the
description below
in the next video we're going to look at
some examples of modern ciphers
and see how these security notions apply
well that's it for this video
if you enjoyed this don't forget to
click like and subscribe
and we'll see you next time

in this video we're going to talk about

Toggle Transcript

querier::noun | Spocien Dictionary

querier

noun

someone who asks a question

Type	Words
Synonyms	asker, enquirer, inquirer, questioner
Type of	talker, speaker, utterer, verbaliser, verbalizer
Has types	inquisitor, interrogator, interviewer, canvasser, pollster, quizzer, tester, poll taker, cross-examiner, cross-questioner, examiner, headcounter
Derivation	query

How to pronounce querier in English?

querier::noun | Spocien Dictionary

abandonment

Related words

Related

Subscribe to our Newslatter