IND-onetime security
From CRYPTUTOR
←Older revision | Newer revision→
IND-onetime security is a security definition for one-time private-key encryption schemes, equivalent to perfect secrecy. The "IND" part of the name IND-onetime comes from the fact that it is an indistinguishability-based security definition (the adversary tries to distinguish between encryptions of two different messages).
Definition
Let A be an adversary, which we model as an arbitrary (unbounded) computation. We define the following experiment/game played against A
IND-onetime Distinguishability Experiment:
We say that the advantage of A in this experiment is
- We (privately) choose a key k according to the key generation algorithm:
.
- We (privately) choose a random bit
.
- Challenge: A outputs two messages,
and
.
- Response: We give A the ciphertext
.
- A outputs
(i.e, a guess for our b).
.
A one-time encryption scheme is 
-IND-onetime secure if:
- For all adversaries A, the advantage of A in the IND-onetime experiment is at most .
When 
, we omit it and simply call the scheme IND-onetime secure.
Equivalence to perfect secrecy
It is not hard to see that IND-onetime security is equivalent to perfect secrecy. An IND-onetime adversary sees only a sample from the distribution 
. If the encryption scheme has perfect secrecy, then this distribution is independent of b and thus the adversary has no advantage in guessing b. Otherwise, the distributions 
and 
differ for some some and . Then an IND-onetime adversary can choose those as his challenge and then run any statistical test which has an advantage in distinguishing the two distributions (such a test must exist if the distributions differ).
