Update to Provable Security : Designs and Open Questions

Until very recently the development of cryptographic solutions for electronic commerce applications was done in an ad hoc manner. Notions of security for protocols that designers wished to meet were intuitive rather that rigorous. Schemes were designed that were subsequently broken, modifications were made to prevent specific attacks, and so the cycle would repeat. This is clearly an unsatisfactory methodology, since an adversary will devise its attacks after the scheme has been specified. In particular, it will try to take actions other than those envisioned by the designer. The idea of provable security is to formally define security notions for cryptographic problems. Once one has formal definition, one then designs schemes so that one can provide a mathematical justification for their security under the chosen definition. The way one does this is by showing how an algorithm to break the scheme could be used to solve some intractable problem. The conclusion is that, if the problem is indeed intractable, then the scheme must be secure under the chosen definition. This is preferable to an ad hoc approach because the result holds regardless of the strategy employed by the adversary when it attempts to break the scheme. The idea of provable security was first introduced by Goldwasser and Micali in 1984 in their paperProbabilistic Encryption. The cryptographic scheme that they treated in this work was public key encryption. Since then the principle has been applied extensively in a variety of contexts. In this report we survey the state of the art of provable security. We begin by giving a more indepth introduction to the subject and describing some of the major results that have been achieved. Having done this we discuss some of the most pressing open problems in the area. 2 ECRYPT — European NoE in Cryptology