Understanding why Semantic Security implies Message Recovery Security

Question

I am stuck in the proof where it says $$p_0=\frac{1}{|M|},$$ I just do not understand how we can infer this equality.

Also, am I right in understanding that B is defined as choosing his two messages at random each time (i.e sampled uniformly from $M$)?

This is the link to two pictures: the first one containing the definition of Semantic Security, the second containing the definition of Message Recovery Security and the Proof I cannot follow: https://i.sstatic.net/e9M5O.jpg

They are from Dan Boneh and Victor Shoup's free e-book 'A Graduate Course in Applied Cryptography'"A Graduate Course in Applied Cryptography"

Answer 1

The definition of semantic security we see in the Shoup book is better explained in his well-known paper Sequences of Games: A Tool for Taming Complexity in Security Proofs.

You must pay the very attention to their words on page 15 of the book:

Actually, our attack game for defining semantic security comprises two alternative "sub-games", or "experiments" --- in both experiments, the adversary follows the same protocol; however, the challenger’s behavior is slightly different in the two experiments.

So, the point here is that we consider two games: this is why sometimes the adversary $\mathcal{B}$ receives from the SSChallenger a c (that I'll call it here) "well formed"; this is the Game 1, or the game of message $m_1$;

Sometimes, c is only "semanticly" equivalent to an encryption of $m_0$ or $m_1$; let me call it "dummy c"; this is the Game 0, or game of message $m_0$.

Furthermore, after receiving a c", the adversary $\mathcal{B}$ passes it on to $\mathcal{A}$, the message recovery adversary. When that c is "well formed", the chance of the adversary $\mathcal{B}$ is equal to the chance of $\mathcal{A}$ guessing.

But when c is dummy, $\mathcal{A}$ cannot help, and $\mathcal{B}$ best chance is $1/|M|$.

Answer 2

The reason $ p_0 = \frac 1 {||M||}$ is because $ p_0 $ is the probability that adversary B guesses $ m_1 $ when the message was actually $ m_0 $. In this situation, B "cheated" in playing the MR game because A received a ciphertext unrelated to $ m_1 $ and has to guess that the message was $ m_1 $ anyway. And since B "cheated" the probability that A succeeds is exactly that of random chance (B might as well not given A the ciphertext at all). This is why the textbook says:

"On the other hand, when c is an encryption of $ m_0 $, the adversary A's output is independent of $ m_1 $, ..."

I think it's confusing as given because if A is given $ c := E[k, m_0] $ it seems like we should care about the case where A returns $ m_0 $, but in fact SSadv only takes into consideration the times when B returns 1 which means A returns $ m_1 $, so we don't care at all when A actually manages to decode $ c $ correctly.

Answer 3

Sorry if I'm a bit late but I want to consider a bit different approach to this proof, it's indeed tricky and every sentence should be read really carefully. I've just wrapped my head around this so if I come with better explanation or some additional conclusion I'll add it here.

1. First of all we should really carefully observe how we define semantic security. So we will run some simulation (multiple experiments) which must be uniformly distributed between C choosing m0 and m1. If that's not the case and let's say that experiment m1 is more common then m0, A will always just output m1 so it doesn’t make any sense. The trick is that if we run N experiments, half of them will be W0 and half W1. So semantic security is actually indistinguishability of adversary A to know which experiment is being played, so suppose the opposite case when A can fully distinguish between experiments. Probability of A saying b = 1 when experiment W1 is being played is 1 and probability of A saying b = 1 when W0 is being played is obviously 0. So the SSadv = |1 - 0| = 1, so when something is semantic secure A will : hit some W1 with b = 1 + miss with b = 0 for some W1 + hit b = 0 for W0 and miss b = 1 for W0, so all in all it will be negligible.

2. MRadv is much easier to get, it just defines advantage if A is able to do anything better then random guess (1/|M|)

Now the composite game: So there is some new library which is efficient and can recover message with some probability that is not negligible - p. So your strategy is to use it as a black box (you don't care what's going down there) to win the first game, and keep in mind that you will always listen to A.

What you (B) can do is to start a game, generate m0 and m1 and send it to C, C is the same as above explained (N/2 it's W0, N/2 it's W1). So if A is really good it will output m' = m1 whenever C encrypted m1 and m' = m0 whenever C encrypted m0 (actually maybe something different from m0, but we don't care about that at all, abstract it in a way where A can tell you two different answers: - it is m1 or it is not m1). So whenever A outputs m1, B outputs b=1 and if A says it's not m1 neither will B. From that we see that B's chances to win the game are exactly the same as the advantage of A - which is p with random guess consideration (1/|M|). So more formally: |p1 - p0| = |p - 1|M||.

Now we derive simple contradiction: Given the efficient A that can recover a message we have constructed B running in pretty much same time (so it's also efficient) which was able to win the first game (remember that we said that p is not negligible, 1/|M| is negligible, so non-negligible - negligible is still non-negligible). But definition of semantic security stands that there is no efficient B that can have non-negligible advantage -> such A can't exist whence the theorem follows.

Answer 4

Since $m_1$ is chosen independently of $m_0$, we have

$$ \Pr[A \text{ outputs } m_1 \mid c \text{ is an encryption of } m_0] = \Pr[A \text{ outputs } m_1] $$

For $i = 1, \ldots, |M|$, let $q_i$ be the probability that $A$ outputs the $i$th message in $M$, denoted $m^{(i)}$ (so we do not confuse it with $m_0$ and $m_1$). Then:

\begin{align*} \Pr[A \text{ outputs } m_1] &= \sum_{i = 1}^{|M|} \Pr[A \text{ outputs } m_1 \mid m^{(i)} \text{ is chosen as } m_1] \Pr[m^{(i)} \text{ is chosen as } m_1]\\ &= \sum_{i = 1}^{|M|} \Pr[A \text{ outputs } m^{(i)} \mid m^{(i)} \text{ is chosen as } m_1] \Pr[m^{(i)} \text{ is chosen as } m_1]\\ &= \sum_{i = 1}^{|M|} \Pr[A \text{ outputs } m^{(i)}] \Pr[m^{(i)} \text{ is chosen as } m_1]\\ &= \sum_{i = 1}^{|M|} q_i \cdot \frac{1}{|M|} = \frac{1}{|M|} \sum_{i = 1}^{|M|} q_i = \frac{1}{|M|} (1) = \frac{1}{|M|} \end{align*}

The equality in the third line above follows from the fact that $A$'s input, i.e., the encryption of $m_0$, is independent of $m_1 = m^{(i)}$. Also, since $m_1$ is chosen uniformly at random, we have the probability $1/|M|$ as the probability of choosing $m^{(i)}$ as $m_1$.

Answer 5

I disagree with the answers claiming that the probability is at best $1/|M|$. It is precisely that. The independence argument in the book seemed a bit nebulous me (although I believe it is ultimately correct), so I made the following formal computation to convince myself:

For simplicity, assume $\mathcal{A}$ is deterministic. Then there are three random variables at play in the experiment, each with uniform distribution over its sample space: $k \in \mathcal{K}$, $m_0 \in \mathcal{M}$ and $m_1 \in \mathcal{M}$. By definition, we have $$ p_0 = \frac{1}{|\mathcal{K}| |\mathcal{M}|^2} \cdot |\{(k, m_0, m_1) \colon \mathcal{A}(E(k, m_0)) = m_1\}|. $$

For each fixed $k$ and $m_0$, there is exactly one $m_1$ satisfying the condition on the triples, namely $m_1 = E(k, m_0)$. Therefore, $$ p_0 = \frac{1}{|\mathcal{K}| |\mathcal{M}|^2} \cdot |\{(k, m_0)\}| = \frac{1}{|\mathcal{M}|}, $$ as desired.

Answer 6

You can think like this: when c is an encryption of $m_0$. Then A outputs a message $\hat{m}$ dependent on $m_0$. Now, envision $m_1$ as a random variable on M. This implies that the probability of $m_1$ equaling $\hat{m}$ is 1/|M|. Essentially, a fixed $\hat{m}$ and an independently random $m_1$.

Answer 7

I personally feel that the proof is incorrect. What we can show is that $p_0 \leq \frac{1}{|M|}$ instead of equality. But the result is the same: $p-\frac{1}{|M|}\leq p_1-p_0\leq \epsilon$.