View source for Ciphertext indistinguishability

'''Ciphertext indistinguishability''' is a property of many [[Encryption|encryption]] schemes. Intuitively, if a [[Cryptosystem|cryptosystem]] possesses the property of [[Computational indistinguishability|indistinguishability]], then an adversary will be unable to distinguish pairs of [[Ciphertext|ciphertext]]s based on the message they encrypt. The property of indistinguishability under chosen plaintext attack is considered a basic requirement for most [[Provable security|provably secure]] public key cryptosystems, though some schemes also provide indistinguishability under chosen ciphertext attack and adaptive chosen ciphertext attack. Indistinguishability under chosen plaintext attack is equivalent to the property of [[Semantic security|semantic security]], and many cryptographic proofs use these definitions interchangeably.

A cryptosystem is considered ''secure in terms of indistinguishability'' if no adversary, given an encryption of a message randomly chosen from a two-element message space determined by the adversary, can identify the message choice with probability significantly better than that of random guessing ({{frac|1|2}}). If any adversary can succeed in distinguishing the chosen ciphertext with a probability significantly greater than {{frac|1|2}}, then this adversary is considered to have an "advantage" in distinguishing the ciphertext, and the scheme is ''not'' considered secure in terms of indistinguishability. This definition encompasses the notion that in a secure scheme, the adversary should learn no information from seeing a ciphertext. Therefore, the adversary should be able to do no better than if it guessed randomly.

== Formal definitions ==

Security in terms of indistinguishability has many definitions, depending on assumptions made about the capabilities of the attacker. It is normally presented as a game, where the cryptosystem is considered [[Information security|secure]] if no adversary can win the game with significantly greater probability than an adversary who must guess randomly. The most common definitions used in cryptography are '''indistinguishability under chosen plaintext attack''' (abbreviated IND-CPA), '''indistinguishability under (non-adaptive) chosen ciphertext attack''' (IND-CCA1), and '''indistinguishability under adaptive chosen ciphertext attack''' (IND-CCA2). Security under either of the latter definition implies security under the previous ones: a scheme which is IND-CCA1 secure is also IND-CPA secure, and a scheme which is IND-CCA2 secure is both IND-CCA1 and IND-CPA secure. Thus, IND-CCA2 is the strongest of the three definitions of security.

=== Indistinguishability under chosen-plaintext attack (IND-CPA)  {{anchor|IND-CPA}} ===

For a probabilistic asymmetric key encryption algorithm, indistinguishability under chosen plaintext attack (IND-CPA) is defined by the following game between an adversary and a challenger. For schemes based on computational security, the adversary is modeled by a probabilistic polynomial time [[Turing machine]], meaning that it must complete the game and output a ''guess'' within a polynomial number of time steps. In this definition E(PK, ''M'') represents the encryption of a message ''M'' under the key ''PK'':

#The challenger generates a key pair ''PK'', ''SK'' based on some security parameter ''k'' (e.g., a key size in bits), and publishes ''PK'' to the adversary. The challenger retains ''SK''.
#The adversary may perform a polynomially bounded number of encryptions or other operations.
#Eventually, the adversary submits two distinct chosen plaintexts <math>\scriptstyle M_0, M_1</math> to the challenger.
#The challenger selects a bit ''b'' <math>\scriptstyle \in</math> {0, 1} uniformly at random, and sends the ''challenge'' ciphertext ''C'' = E(PK, <math>\scriptstyle M_b</math>) back to the adversary.
#The adversary is free to perform any number of additional computations or encryptions.
#Finally, the adversary outputs a guess for the value of ''b''.

A cryptosystem is '''indistinguishable under chosen plaintext''' attack if every probabilistic polynomial time adversary has only a negligible "[[Advantage (cryptography)|advantage]]" over random guessing. An adversary is said to have a negligible "advantage" if it wins the above game with probability <math>\scriptstyle \left(\frac{1}{2}\right) \,+\, \epsilon(k)</math>, where <math>\scriptstyle \epsilon(k)</math> is a [[Negligible function|negligible function]] in the security parameter ''k'', that is for every (nonzero) polynomial function <math>\scriptstyle poly()</math> there exists <math>\scriptstyle k_0</math> such that <math>\scriptstyle |\epsilon(k)| \;<\; \left|\frac{1}{poly(k)}\right|</math> for all <math>\scriptstyle k \;>\; k_0</math>.

Although the adversary knows <math>\scriptstyle M_0</math>, <math>\scriptstyle M_1</math> and PK, the probabilistic nature of E means that the encryption of <math>\scriptstyle M_b</math> will be only one of many valid ciphertexts, and therefore encrypting <math>\scriptstyle M_0</math>, <math>\scriptstyle M_1</math> and comparing the resulting ciphertexts with the challenge ciphertext does not afford any non-negligible advantage to the adversary.

While the above definition is specific to an asymmetric key cryptosystem, it can be adapted to the symmetric case by replacing the public key encryption function with an [[Oracle machine|encryption oracle]], which retains the secret encryption key and encrypts arbitrary plaintexts at the adversary's request.

==== Symmetric IND-CPA Game, Formalized ====
The adversarial process of performing a chosen-plaintext attack is usually outlined in the form of a Cryptographic Game. To test for symmetric IND-CPA, the game described above is defined.<ref name=":0">{{cite web|url=https://web.cs.ucdavis.edu/~rogaway/classes/227/spring05/book/main.pdf|title=Introduction to Modern Cryptography, Chapter 5: Symmetric Encryption|last2=Rogaway|first2=Phillip|date=May 11, 2005|page=93|last1=Bellare|first1=Mihir|access-date=6 April 2020}}</ref> Let <math>
\mathcal{K}
</math> be a key generation function, <math>
\mathcal{E}
</math> be an encryption function, and <math>
\mathcal{D}
</math> be a decryption function. Let <math>
\mathcal{S}\mathcal{E} = (\mathcal{K}, \mathcal{E}, \mathcal{D})
</math> be a symmetric encryption scheme. The game <math>Guess</math> is defined as:

[[File:IND-CPA_Guess_Cryptographic_Game.svg|frameless|300x300px]]

As many times as it would like, an adversary selects two plaintext messages of its own choosing and provides them to the '''LR''' oracle which returns a ciphertext encrypting one of the messages. An adversary's advantage is determined by its probability of guessing the value of ''b,'' a value chosen at random at the beginning of the game which determines the message that is encrypted in the '''LR''' oracle. Therefore, its advantage is defined as:<ref name=":0" />

[[File:Advantage_of_IND-CPA_Guess_Game.svg|frameless|456x456px]]

=== Indistinguishability under chosen ciphertext attack/adaptive chosen ciphertext attack (IND-CCA1, IND-CCA2) {{anchor|IND-CCA1|IND-CCA2}} ===

Indistinguishability under non-adaptive and adaptive Chosen Ciphertext Attack (IND-CCA1, IND-CCA2) uses a definition similar to that of IND-CPA. However, in addition to the public key (or encryption oracle, in the symmetric case), the adversary is given access to a ''decryption oracle'' which decrypts arbitrary ciphertexts at the adversary's request, returning the plaintext. In the non-adaptive definition, the adversary is allowed to query this oracle only up until it receives the challenge ciphertext. In the adaptive definition, the adversary may continue to query the decryption oracle even after it has received a challenge ciphertext, with the caveat that it may not pass the challenge ciphertext for decryption (otherwise, the definition would be trivial).

#The challenger generates a key pair ''PK'', ''SK'' based on some security parameter ''k'' (e.g., a key size in bits), and publishes ''PK'' to the adversary. The challenger retains ''SK''.
#The adversary may perform any number of calls to the encryptions and decryption oracle based on arbitrary ciphertexts, or other operations.
#Eventually, the adversary submits two distinct chosen plaintexts <math>\scriptstyle M_0,\, M_1</math> to the challenger.
#The challenger selects a bit ''b'' ∈ {0, 1} uniformly at random, and sends the "challenge" ciphertext ''C'' = E(PK, <math>\scriptstyle M_b</math>) back to the adversary.
#The adversary is free to perform any number of additional computations or encryptions.
##In the ''non-adaptive'' case (IND-CCA1), the adversary may ''not'' make further calls to the decryption oracle.
##In the ''adaptive'' case (IND-CCA2), the adversary may make further calls to the decryption oracle, but may not submit the challenge ciphertext ''C''.
#Finally, the adversary outputs a guess for the value of ''b''.

A scheme is IND-CCA1/IND-CCA2 secure if no adversary has a non-negligible advantage in winning the above game.

=== Indistinguishable from random noise ===
{{main | Distinguishing attack }}

Sometimes we need encryption schemes in which the ciphertext string is indistinguishable from a random string by the adversary.<ref>{{cite book
| title=Cryptographic Engineering
| first1=Debrup
| last1=Chakraborty
| first2=Francisco
| last2=Rodríguez-Henríquez.
| editor=Çetin Kaya Koç
| url=https://books.google.com/books?id=nErZY4vYHIoC
| year=2008
| page=340
| isbn=9780387718170}}</ref>

If an adversary is unable to tell if a message even exists, it gives the person who wrote the message [[Social:Plausible deniability|plausible deniability]].

Some people building encrypted communication links prefer to make the contents of each encrypted datagram indistinguishable from random data, in order to make traffic analysis more difficult.<ref>{{cite web
| url=http://www.financialcryptography.com/mt/archives/000728.html
| title=Indistinguishable from random
| date=2006-05-20
| author=iang
| accessdate=2014-08-06}}</ref>

Some people building systems to store encrypted data prefer to make the data indistinguishable from random data in order to make [[Anti-computer forensics#Data hiding|data hiding]] easier.
For example, some kinds of [[Disk encryption|disk encryption]] such as [[Software:TrueCrypt#Identifying TrueCrypt volumes|TrueCrypt]] attempt to hide data in the innocent random data left over from some kinds of [[Data erasure|data erasure]].
As another example, some kinds of steganography attempt to hide data by making it match the statistical characteristics of the innocent "random" [[Image noise|image noise]] in digital photos.

To support such [[Deniable encryption|deniable encryption]] systems, a few cryptographic algorithms are specifically designed to make ciphertext messages indistinguishable from random bit strings.<ref>{{cite web
| url=http://elligator.cr.yp.to/elligator-20130828.pdf
| title=Elligator: Elliptic-curve points indistinguishable from uniform random strings
| first1=Daniel J.
| last1=Bernstein
| first2=Mike
| last2=Hamburg
| first3=Anna
| last3=Krasnova
| first4=Tanja
| date=2013-08-28
| accessdate=2015-01-23}}</ref><ref>{{cite book
| first=Bodo
| last=Möller
| date=2004
| doi=10.1007/978-3-540-30108-0_21|title = Computer Security – ESORICS 2004|volume = 3193| pages=335–351
|series = Lecture Notes in Computer Science|isbn = 978-3-540-22987-2| chapter=A Public-Key Encryption Scheme with Pseudo-random Ciphertexts
}}</ref><ref>{{cite book
| title=The Nature of Computation
| first1=Cristopher
| last1=Moore
| first2=Stephan
| last2=Mertens
| url=https://books.google.com/books?id=jnGKbpMV8xoC
| date=2011
| isbn=9780191620805}}</ref>

Most applications don't require an encryption algorithm to produce encrypted messages that are indistinguishable from random bits.
However, some authors consider such encryption algorithms to be conceptually simpler and easier to work with, and more versatile in practice—and most IND-CPA encryption algorithms apparently do, in fact, produce encrypted messages that are indistinguishable from random bits.<ref>{{cite web
| url=http://www.cs.ucdavis.edu/~rogaway/papers/nonce.pdf
| title=Nonce-Based Symmetric Encryption
| first=Phillip
| last=Rogaway
| date=2004-02-01
| pages=5–6
| accessdate=2014-08-07}}</ref>

== Equivalences and implications ==

Indistinguishability is an important property for maintaining the confidentiality of encrypted communications. However, the property of indistinguishability has in some cases been found to imply other, apparently unrelated security properties. Sometimes these implications go in both directions, making two definitions equivalent; for example, it is known that the property of indistinguishability under adaptive chosen ciphertext attack (IND-CCA2) is equivalent to the property of [[Malleability (cryptography)|non-malleability]] under the same attack scenario (NM-CCA2). This equivalence is not immediately obvious, as non-malleability is a property dealing with message integrity, rather than confidentiality. In other cases, it has been demonstrated that indistinguishability can be combined with certain other definitions, in order to imply still other useful definitions, and vice versa. The following list summarizes a few known implications, though it is by no means complete.

The notation <math>\scriptstyle A \;\Rightarrow\; B</math> means that property A implies property B. <math>\scriptstyle A \;\Leftrightarrow\; B</math> means that properties A and B are ''equivalent''. <math>\scriptstyle A \;\not \Rightarrow\; B</math> means that property A does not necessarily imply property B.

* IND-CPA <math>\scriptstyle \Leftrightarrow</math> [[Semantic security|semantic security]] under CPA.
* NM-CPA ([[Malleability (cryptography)|non-malleability]] under chosen plaintext attack) <math>\scriptstyle \Rightarrow</math> IND-CPA.
* NM-CPA ([[Malleability (cryptography)|non-malleability]] under chosen plaintext attack) <math>\scriptstyle \not \Rightarrow</math> IND-CCA2.
* NM-CCA2 ([[Malleability (cryptography)|non-malleability]] under adaptive chosen ciphertext attack) <math>\scriptstyle \Leftrightarrow</math> IND-CCA2.

== See also==

* [[Distinguishing attack]]
* [[Computational indistinguishability]]
* Chosen ciphertext attack
* Adaptive chosen ciphertext attack

== References ==
<references />

* {{cite book
| title=Introduction to Modern Cryptography: Principles and Protocols
| url=https://archive.org/details/Introduction_to_Modern_Cryptography
| first1=Jonathan
| last1=Katz
| first2=Yehuda
| last2=Lindell
| publisher=Chapman & Hall / CRC Press
| date=2007
| isbn=978-1584885511}}

{{Cryptography navbox}}

[[Category:Theory of cryptography]]

{{Sourceattribution|Ciphertext indistinguishability}}