%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1997}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{4}{September 11, 1997}{Ron Rivest}{Abby Knickerbocker} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Unconditionally Secure Authentication}

The key issue addressed in this lecture is that of {\it authentication}; how 
can Bob be sure that the message he has received was actually sent by 
Alice?  In addition, how can he be sure that the message was not corrupted 
en route by Eve?

\subsection{Message Authentication Code (MAC)}

The idea here is to send the message $M$ along with a MAC, $f(M,k)$, 
that is a function of the message $M$ and the secret key $k$.  How does 
the MAC allow Bob to assure himself that the message $M$ is really from 
Alice?  Alice and Bob share the secret key $k$.  Bob recomputes the MAC 
and confirms that the message $M$ was from Alice.

{\bf Note:}  Authentication is a separate goal from privacy; here, we are 
not concerned with confidentiality.  $M$ is sent cleartext over the channel, 
and we do not care who hears it.

It is also important that a new key $k$ is used every time.  For instance, 
this prevents replay attacks.  Eve cannot resend the message the next 
day; Bob will not accept it.

{\bf GOAL:}  Eve should not be able to generate a valid pair $M^{'},f(M^{'},k)$ 
even after hearing one valid pair $M, f(M,k)$.

{\bf IDEA:}  The one-time key $k$ is a pair $(a,b)$ of coefficients:
$k=(a,b)$ and then we define $f(M,k)=y=aM+b$.  Having seen one $(M,y)$ pair 
is of no help in figuring out the appropriate $y^{'}$ for a different 
message $M^{'}$.


{\bf More formally:}  Suppose $|M|=n$  (i.e. $M$ has $n$ bits).

Let $p$ be a prime, with $|p|>n$.

Then $Z_{p}=\{0,1,...,p-1\}$ forms a field in modulo p with respect to $+,-,*,/$.

\begin{itemize}
\item $+$ is associative and commutative with identity 0
\item $*$ is associative and commutative with identity 1
\item all elements have additive inverses:  $-5=12 (mod 17)$
\item all nonzero elements have multiplicative inverses:  $5^{-1}=7 (mod 17)$
\item division:  $2/5=2*7=14 (mod 17)$ since $5^{-1}=7$
\end{itemize}

Now choose $a$ and $b$ uniformly at random from $Z_{p}$, and define 
$f(M,k)=aM+b (mod p)$.

{\bf Note:}  $|f(M,k)|=|p|$, so the MAC is as long as the message.

Suppose Eve hears $(M,y)$, where $y=aM+b (mod p)$.  What has she learned?  
She knows $M$, $y$, and $p$, but not $a$ and $b$.  There are $p$ pairs of 
coefficients $(a,b)$ that are consistent with the equation $y=aM+b (mod p)$.  
Suppose Eve picks some $a_{i} \in Z_{p}$.  Then $b_{i}=y-a_{i}M (mod p)$
satisfies the above equation.  All such choices $(a_{i},b_{i})$ are equally 
likely, as far as Eve knows.

Suppose Eve wants Bob to accept a different message $M^{'}\not=M$.  She 
must compute a new MAC that Bob will accept.

$f(M^{'},k)=a_{i}M+(y-a_{i}M) (mod p) = a_{i}(M^{'}-M)+y (mod p)$

where $a_{i}$ is Eve's guess.  BUT, these give different values for 
different choices of $a_{i}$, since:

$a_{i}(M^{'}-M)+y=a_{j}(M^{'}-M)+y$

$a_{i}=a_{j}$

Thus, $f(M^{'},k)$ is equally likely to be any value in $Z_{p}$.  Therefore, 
Eve's chance of getting $f(M^{'},k)$ right is $1/p$.

\subsubsection{One-time Key $k$}

What happens if Alice and Bob use the same secret key $k$ to compute the 
MAC's for two separate messages $M$ and $M^{'}$?  Then they are computing 
the two equations $y=f(M,k)$ and $y^{'}=f(M^{'},k)$.  This gives the two 
following equations:

$y=aM+b (mod p)$

$y^{'}=aM^{'}+b (mod p)$

But that gives Eve two equations in two unknowns, and she can solve for 
$a$ and $b$.  $a=(y-y^{'})/(M-M^{'})$ and $b=y-aM$.  Then Eve knows both 
$a$ and $b$!  Therefore, {\bf do not} reuse a key.

\subsubsection{Length of the MAC}

Both the key and the MAC have length proportional to $|M|$.  Having $|k|=|M|$ 
is unavoidable.  However, the length of the MAC is long, and it would be nice 
if we could improve this.

{\bf Ideas to shorten MAC:}
\begin{itemize}
\item only send low-order 64 bits of $y=aM+b (mod p)$
\item choose small $p$ (64, 65 bits)

divide $M$ into chunks $M=M_{1},M_{2},...,M_{t}$ where $0<=M_{i}<p$

$k=(a_{1},a_{2},...,a_{t},b)$ where $0<=a_{i}<p$, and $0<=b<p$

$f(M,k)=\sum a_{i}M_{i}+b (mod p)$
\end{itemize}

\subsection{Privacy and Authentication}

Previously, we were only concerned with authentication.  Alice was sending 
her message $M$ cleartext over the channel, and Eve could read it.  Now we 
want to consider the case where Alice wants her message to be private so that 
only Bob can read it, {\it and} she wants to authenticate the message.  Now 
we combine the One-Time Pad (OTP) and the One-Time MAC (OTM).  We have two 
choices:

\begin{itemize}
\item encrypt $M$ with OTP, {\it then} append MAC of ciphertext:  $M \oplus k,
f(M \oplus k,k^{'})$
\item append MAC to $M$, use OTP to encrypt $(M,y)$ pair:  $(M,f(M,k^{'})) \oplus k$

\end{itemize}

There are two advantages of the first choice, where we encrypted the message 
$M$ and then appended the MAC of the ciphertext.  First of all, Bob can check 
the MAC before decrypting.  If it is garbage, then he does not have to 
waste time decrypting $M \oplus k$.  Second, encrypting the message first 
uses fewer random bits off the pad:

\begin{itemize}
\item $M \oplus k,f(M \oplus k,k^{'})$

$|k|=n$   

$|k^{'}|=n$   

{\bf $n+2n=3n$}

\item $(M,f(M,k^{'})) \oplus k$   

$|k^{'}|=2n$   

$|k|=2n$   

{\bf $2n+2n=4n$}

\end{itemize}

\subsection{Length of One-Time Key $k$}

Is it possible to shorten the length of the one-time key $k$, $|k|$, needed 
for privacy or authentication?  To do so, we must start making assumptions 
about computational difficulty.

Alice encrypts a message $M$ that is $n$ bits long with a key $k$ that is 
$t$ bits long, resulting in ciphertext $C$, which is also $n$ bits long.  
Imagine that Eve hears $C$ and has an infinite amount of computing power.  
Eve tries all $2^{t}$ keys and examines the resulting plaintext $M$.  She 
then gets $2^{t}$ candidate messages.  Assume that the number of reasonable 
messages of length $M$ is $\alpha^{n}$ ($1<=\alpha<2$) (e.g. English 
$\alpha=1.1$).  The expected number of keys giving a reasonable result is 
thus:

$2^{t}(\alpha/2)^{n}$

Thus, when $t+n(lg(\alpha)-1)<0$ then the number of keys giving reasonable 
results $<=1$.  When:

$n>t/(1-lg(\alpha))$

then there is only one key that works ($n>7t$ for English).  This argues that 
unconditional security requires growing the length of the keys with the 
length of the message.  Thus, unconditional security requires {\it long} 
one-time keys.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
