\documentclass[letterpaper,10pt]{article}
\input{latexdefs}

\begin{document}
\makeheader{Cryptographic Definitions}

\noindent In this note, we will recall the main definitions of the cryptographic notions encountered
in this course.

\section{Cryptographic Building Blocks}

\paragraph{Pseudorandom generators (PRGs).} Let $G \colon \zo^\lambda \to \zo^n$ be an efficiently-computable
function where $n > \lambda$. We define the following PRG security experiments:

\medskip
\noindent \setlength{\boxheight}{1.2cm}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 0$}:
    \begin{enumerate}[noitemsep, leftmargin=*]
    \item The challenger samples $s \getsr \zo^\lambda$ and sends $t \gets G(s)$ to $\calA$.
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
  \end{enumerate}
\end{minipage}}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 1$}:
  \begin{enumerate}[noitemsep, leftmargin=*]
    \item The challenger samples $t \getsr \zo^n$ and gives $t$ to $\calA$.
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
    \end{enumerate}
\end{minipage}}

\medskip

\noindent We say $G$ is a secure PRG if for all efficient adversaries $\calA$,
\[ \ms{PRGAdv}[\calA] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]} = \negl(\lambda). \]

\paragraph{Pseudorandom functions (PRFs).} Let $F \colon \calK \times \calX \to \calY$ be an efficiently-computable
function with a key space $\calK$, domain $\calX$, and range $\calY$ (technically, each of these
sets is a function of the security parameter $\lambda$).
We now define the following PRF security experiments:

\medskip
\noindent \setlength{\boxheight}{2.2cm}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 0$}:
    \begin{enumerate}[noitemsep, leftmargin=*]
    \item The challenger samples $k \getsr \calK$.
    
    \item The adversary can now adaptively make
    queries to the challenger. In each query, the adversary chooses
    an input $x \in \calX$, and the challenger replies with $F(k, x)$.

    \item The adversary outputs a bit $b' \in \zo$.
  \end{enumerate}
\end{minipage}}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 1$}:
  \begin{enumerate}[noitemsep, leftmargin=*]
    \item The challenger samples a function $f \getsr \Funs[\calX, \calY]$.

    \item The adversary can now adaptively make
    queries to the challenger. In each query, the adversary chooses
    an input $x \in \calX$, and the challenger replies with $f(x)$.

    \item The adversary outputs a bit $b' \in \zo$.
  \end{enumerate}
\end{minipage}}

\medskip
\noindent We say that $F$ is a secure PRF if for all efficient adversaries $\calA$,
\[ \ms{PRFAdv}[\calA] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]} = \negl(\lambda). \]
In the above definition, $\Funs[\calX, \calY]$ denotes the set of {\em all} functions $f \colon \calX \to \calY$.

\paragraph{Pseudorandom permutations (PRPs).}
Let $F \colon \calK \times \calX \to \calX$ be an efficiently-computable
function with a key space $\calK$ and domain $\calX$ (technically, each of these
sets is a function of the security parameter $\lambda$). We say that $F$ is a pseudorandom
permutation (PRP) if the following properties hold:
\begin{itemize}
  \item For every key $k \in \calK$, the function $F(k, \cdot)$ is a permutation on $\calX$.

  \item There exists an efficiently-computable function $F^{-1} \colon \calK \times \calX \to \calX$ such that
  for all $k \in \calK$ and all $x \in \calX$,
  \[ F^{-1}(k, F(k, x)) = x. \]
\end{itemize}
For security, we define the following PRP security experiments:

\medskip
\noindent \setlength{\boxheight}{2.2cm}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 0$}:
    \begin{enumerate}[noitemsep, leftmargin=*]
    \item The challenger samples $k \getsr \calK$.
    
    \item The adversary can now adaptively make
    queries to the challenger. In each query, the adversary chooses
    an input $x \in \calX$, and the challenger replies with $F(k, x)$.

    \item The adversary outputs a bit $b' \in \zo$.
  \end{enumerate}
\end{minipage}}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 1$}:
  \begin{enumerate}[noitemsep, leftmargin=*]
    \item The challenger samples a function $f \getsr \Perm[\calX]$.

    \item The adversary can now adaptively make
    queries to the challenger. In each query, the adversary chooses
    an input $x \in \calX$, and the challenger replies with $f(x)$.

    \item The adversary outputs a bit $b' \in \zo$.
  \end{enumerate}
\end{minipage}}

\medskip
\noindent We say that $F$ is a secure PRP if for all efficient adversaries $\calA$,
\[ \ms{PRPAdv}[\calA] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]} = \negl(\lambda). \]
In the above definition, $\Perm[\calX]$ denotes the set of {\em all} permutations $f \colon \calX \to \calX$.

\paragraph{Collision-resistant hash functions (CRHFs).} Let
$H \colon \zo^n \to \zo^m$ where $m < n$ (for full formality, the hash function would be indexed by a security
parameter $\lambda$ and $n, m$ are polynomials in $\lambda$). We say that $H$ is a collision-resistant hash function if for 
all efficient (uniform) adversaries $\calA$ (that takes the security parameter $\lambda$ as input),
\[ \ms{CRHFAdv}[\calA] = \Pr[(x, y) \gets \calA : H(x) = H(y) \text{ and } x \ne y] = \negl(\lambda). \]

\section{Symmetric Encryption}
A symmetric encryption scheme (also called a cipher) is defined over a key space $\calK$, a message space $\calM$, and
a ciphertext space $\calC$ (technically, each of these sets is a function of the security parameter
$\lambda$) and consists of two efficient algorithms:
\begin{itemize}
  \item $\Encrypt(k, m) \to \ct$: On input a key $k \in \calK$ and a message $m \in \calM$, the encryption
  algorithm outputs a ciphertext $\ct$.

  \item $\Decrypt(k, \ct) \to m / \bot$: On input a key $k \in \calK$ and a ciphertext $\ct \in \calC$, the
  decryption algorithm either outputs a message $m \in \calM$ or a special symbol $\bot$ (to indicate
  a decryption failure).
\end{itemize}

\paragraph{Correctness.} The encryption scheme is correct if for all keys $k \in \calK$ and all messages
$m \in \calM$,
\[ \Pr[\Decrypt(k, \Encrypt(k, m)) = m] = 1. \]

\paragraph{Perfect secrecy.} The encryption scheme satisfies perfect secrecy if for all pairs of
messages $m_0, m_1 \in \calM$ and all ciphertext $\ct \in \calC$,
\[ \Pr[k \getsr \calK : \Encrypt(k, m_0) = c] = \Pr[k \getsr \calK : \Encrypt(k, m_1) = c].  \]

\paragraph{Semantic security.} We start by defining the semantic security experiment:

\medskip
\noindent \setlength{\boxheight}{1.8cm}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 0$}:
    \begin{enumerate}[noitemsep, leftmargin=*]
    \item The challenger samples a key $k \getsr \calK$.
    \item The adversary $\calA$ sends messages $m_0, m_1 \in \calM$ to the challenger.
    \item The challenger replies with $\Encrypt(k, m_0)$.
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
  \end{enumerate}
\end{minipage}}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 1$}:
  \begin{enumerate}[noitemsep, leftmargin=*]
    \item The challenger samples a key $k \getsr \calK$.
    \item The adversary $\calA$ sends messages $m_0, m_1 \in \calM$ to the challenger.
    \item The challenger replies with $\Encrypt(k, m_1)$.
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
    \end{enumerate}
\end{minipage}}

\medskip
\noindent We say the encryption scheme satisfies semantic security if for all efficient adversaries $\calA$,
\[ \ms{SSAdv}[\calA] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]} = \negl(\lambda). \]
Note that when the message space $\calM$ contains {\em variable-length} messages, then
each of the adversary's encryption queries $(m_0, m_1)$ in the semantic security experiment
must additionally satisfy $|m_0| = |m_1|$.

\paragraph{Security against chosen-plaintext attacks (CPA-security).} We start by defining the CPA-security experiment:

\medskip
\noindent \setlength{\boxheight}{2.4cm}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 0$}:
    \begin{itemize}[noitemsep, leftmargin=*]
    \item The challenger samples a key $k \getsr \calK$.
    \item The adversary can now make queries to the challenger:
    \begin{itemize}[noitemsep, leftmargin=*]
      \item {\bf Encryption query:} The adversary sends $m_0, m_1 \in \calM$
      to the challenger. The challenger replies with $\Encrypt(k, m_0)$.
    \end{itemize}
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
  \end{itemize}
\end{minipage}}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 1$}:
    \begin{itemize}[noitemsep, leftmargin=*]
    \item The challenger samples a key $k \getsr \calK$.
    \item The adversary can now make queries to the challenger:
    \begin{itemize}[noitemsep, leftmargin=*]
      \item {\bf Encryption query:} The adversary sends $m_0, m_1 \in \calM$
      to the challenger. The challenger replies with $\Encrypt(k, m_1)$.
    \end{itemize}
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
  \end{itemize}
\end{minipage}}

\medskip
\noindent We say the encryption scheme satisfies security against chosen-plaintext attacks
(CPA-security) if for all efficient adversaries $\calA$,
\[ \ms{CPAAdv}[\calA] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]} = \negl(\lambda). \]
Note that when the message space $\calM$ contains {\em variable-length} messages, then
each of the adversary's encryption queries $(m_0, m_1)$ in the CPA-security experiment
must additionally satisfy $|m_0| = |m_1|$.

\paragraph{Security against chosen-ciphertext attacks (CCA-security).} We start by defining the CCA-security experiment:

\medskip
\noindent \setlength{\boxheight}{3cm}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 0$}:
    \begin{itemize}[noitemsep, leftmargin=*]
    \item The challenger samples a key $k \getsr \calK$.
    \item The adversary can now make queries to the challenger:
    \begin{itemize}[noitemsep, leftmargin=*]
      \item {\bf Encryption query:} The adversary sends $m_0, m_1 \in \calM$
      to the challenger. The challenger replies with $\Encrypt(k, m_0)$.

      \item {\bf Decryption query:} The adversary sends a ciphertext $\ct \in \calC$
      to the challenger. The challenger replies with $\Decrypt(k, \ct)$.
    \end{itemize}
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
  \end{itemize}
\end{minipage}}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 1$}:
    \begin{itemize}[noitemsep, leftmargin=*]
    \item The challenger samples a key $k \getsr \calK$.
    \item The adversary can now make queries to the challenger:
    \begin{itemize}[noitemsep, leftmargin=*]
      \item {\bf Encryption query:} The adversary sends $m_0, m_1 \in \calM$
      to the challenger. The challenger replies with $\Encrypt(k, m_1)$.

      \item {\bf Decryption query:} The adversary sends a ciphertext $\ct \in \calC$
      to the challenger. The challenger replies with $\Decrypt(k, \ct)$.
    \end{itemize}
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
  \end{itemize}
\end{minipage}}

\medskip
\noindent We say an adversary $\calA$ is admissible for the CCA-security game if it
does not issue a decryption query on a ciphertext $\ct$ it {\em previously} received from the challenger
(in response to an encryption query). We say the encryption scheme satisfies security against
chosen-ciphertext attacks (CCA-security) if for all efficient and admissible adversaries $\calA$,
\[ \ms{CCAAdv}[\calA] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]} = \negl(\lambda). \]
Note that when the message space $\calM$ contains {\em variable-length} messages, then
each of the adversary's encryption queries $(m_0, m_1)$ in the CCA-security experiment
must additionally satisfy $|m_0| = |m_1|$.

\paragraph{Ciphertext integrity.} We start by defining the ciphertext integrity experiment:

\medskip

\noindent \setlength{\boxheight}{2cm}
\fbox{\begin{minipage}[t][\boxheight]{0.99\linewidth}
  \footnotesize
  {\bf Ciphertext integrity experiment}:
    \begin{itemize}[noitemsep, leftmargin=*]
    \item The challenger samples a key $k \getsr \calK$.
    \item The adversary can now make encryption queries to the challenger:
    \begin{itemize}[noitemsep, leftmargin=*]
      \item {\bf Encryption query:} The adversary sends $m \in \calM$
      to the challenger. The challenger replies with $\ct \gets \Encrypt(k, m)$.
    \end{itemize}
    \item The adversary $\calA$ outputs a ciphertext $\ct^\ast \in \calC$.
  \end{itemize}
\end{minipage}}

\medskip
\noindent Let $\ct_1, \ldots, \ct_Q \in \calC$ be the ciphertexts that the challenger gives the adversary
in the security game (when responding to encryption queries).
We say an adversary $\calA$ is admissible for the existential unforgeability game if
$\ct^\ast \notin \set{\ct_1, \ldots, \ct_Q}$. We say that the encryption
scheme satisfies ciphertext integrity if for all efficient
and admissible adversaries $\calA$,
\[ \Pr[\Decrypt(k, \ct^\ast) \ne \bot] = \negl(\lambda). \]

\paragraph{Authenticated encryption.} We say the encryption scheme is an authenticated encryption
if it satisfies CPA-security {\em and} ciphertext integrity.


\section{Message Authentication Codes}
A message authentication code (MAC) is defined over a key space $\calK$, a message space $\calM$, and a
tag space $\calT$ (technically, each of these sets is a function of the security parameter $\lambda$)
and consists of two efficient algorithms:
\begin{itemize}
  \item $\Sign(k, m) \to t$: On input a key $k \in \calK$ and a message $m \in \calM$, the signing algorithm
  outputs a tag $t$.

  \item $\Verify(k, m, t) \to 0/1$: On input a key $k \in \calK$, a message $m \in \calM$, and a tag
  $t \in \calT$, the verification algorithm outputs a bit $b \in \zo$ (indicating whether the tag
  is valid or not).
\end{itemize}

\paragraph{Correctness.} The MAC is correct if for all keys $k \in \calK$ and all messages $m \in \calM$,
\[ \Pr[\Verify(k, m, \Sign(k, m)) = 1] = 1. \]

\paragraph{Existential unforgeability.} We start by defining the existential unforgeability
experiment:

\medskip

\noindent \setlength{\boxheight}{2cm}
\fbox{\begin{minipage}[t][\boxheight]{0.99\linewidth}
  \footnotesize
  {\bf Existential unforgeability experiment}:
    \begin{itemize}[noitemsep, leftmargin=*]
    \item The challenger samples a key $k \getsr \calK$.
    \item The adversary can now make signing queries to the challenger:
    \begin{itemize}[noitemsep, leftmargin=*]
      \item {\bf Signing query:} The adversary sends $m \in \calM$
      to the challenger. The challenger replies with $t \gets \Sign(k, m)$.
    \end{itemize}
    \item The adversary $\calA$ outputs a message $m^\ast \in \calM$ and tag
    $t^\ast \in \calT$.
  \end{itemize}
\end{minipage}}

\medskip
\noindent Let $m_1, \ldots, m_Q \in \calM$ be the signing queries the adversary makes 
and let $t_1, \ldots, t_Q \in \calT$ be the respective tags that the challenger responds
with. We say an adversary $\calA$ is admissible for the existential unforgeability game if
$(m^\ast, t^\ast) \notin \set{(m_1, t_1), \ldots, (m_Q, t_Q)}$. We say the MAC
satisfies existential unforgeability against chosen-message attacks if for all efficient
and admissible adversaries $\calA$,
\[ \Pr[\Verify(k, m^\ast, t^\ast) = 1] = \negl(\lambda). \]

\section{Block Cipher Modes of Operation}
We now recall two common ways to use block ciphers to construct CPA-secure encryption schemes.

\paragraph{Counter mode.} Let $F \colon \calK \times \zo^n \to \zo^n$ be a secure PRF.
In the following, $k$ is the PRF key and $m = (m_1, \ldots, m_n)$ are the blocks of the
message (i.e., $m_i \in \zo^n$). In randomized counter-mode encryption, sample
$\ms{IV} \getsr \zo^n$, and the ciphertext is $(\ms{IV}, c_1, \ldots, c_n)$.
We view $\ms{IV}$ as an integer between $0$ and $2^n - 1$, and perform arithmetic operations
modulo $2^{n}$.

\medskip

\noindent \begin{minipage}{\textwidth}
\begin{framed}
\begin{center}
\begin{tikzpicture}
    \foreach \x in {1, 2, 3} {
        \node (f\x) at ($\x*(2.5cm,0)-(2.5cm,0)$) [minimum size=1.25cm,rounded corners=1ex,fill=blue!20,draw] {$F(k, \cdot)$};
        \node (c\x) [below of=f\x, node distance=2.5cm] {$c_\x$};
        \node (p\x) [below of=f\x, node distance=1.5cm, circle, draw] {};
        \node (m\x) [left of=p\x, node distance=1.0cm] {$m_\x$};
        \draw[-] (p\x.north) -- (p\x.south);
        \draw[-] (p\x.east) -- (p\x.west);
        \draw[-latex] (m\x) -- (p\x);
        \draw[-latex] (f\x) -- (p\x);
        \draw[-latex] (p\x) -- (c\x);
    }

    \node (n1) [above of=f1, node distance=1.5cm] {$\ms{IV}$};
    \node (n2) [above of=f2, node distance=1.5cm] {$\ms{IV} + 1$};
    \node (n3) [above of=f3, node distance=1.5cm] {$\ms{IV} + 2$};
    \foreach \x in {1, 2, 3} {
      \draw[-latex] (n\x) -- (f\x);
    }
    \begin{scope}
        \node at (7,0) {$\cdots\cdots\cdots\cdots$};
    \end{scope}

    \begin{scope}
        \node (f) at (8.8cm,0) [minimum size=1.25cm,rounded corners=1ex,fill=blue!20,draw] {$F(k, \cdot)$};
        \node (n) [above of=f, node distance=1.5cm] {$\ms{IV} + n - 1$};
        \node (c) [below of=f, node distance=2.5cm] {$c_n$};
        \node (p) [below of=f, node distance=1.5cm, circle, draw] {};
        \node (m) [left of=p, node distance=1.0cm] {$m_n$};
        \draw[-] (p.north) -- (p.south);
        \draw[-] (p.east) -- (p.west);
        \draw[-latex] (m) -- (p);
        \draw[-latex] (n) -- (f);
        \draw[-latex] (f) -- (p);
        \draw[-latex] (p) -- (c);
    \end{scope}
\end{tikzpicture}
\end{center}
\vspace{-10pt}
\end{framed}
\vspace{-10pt}
\captionof{figure}{Counter-mode encryption}
\end{minipage}

\medskip

\noindent \begin{minipage}{\textwidth}
\begin{framed}
\begin{center}
\begin{tikzpicture}
    \foreach \x in {1, 2, 3} {
        \node (f\x) at ($\x*(2.5cm,0)-(2.5cm,0)$) [minimum size=1.25cm,rounded corners=1ex,fill=green!20,draw] {$F(k, \cdot)$};
        \node (c\x) [below of=f\x, node distance=2.5cm] {$m_\x$};
        \node (p\x) [below of=f\x, node distance=1.5cm, circle, draw] {};
        \node (m\x) [left of=p\x, node distance=1.0cm] {$c_\x$};
        \draw[-] (p\x.north) -- (p\x.south);
        \draw[-] (p\x.east) -- (p\x.west);
        \draw[-latex] (m\x) -- (p\x);
        \draw[-latex] (f\x) -- (p\x);
        \draw[-latex] (p\x) -- (c\x);
    }

    \node (n1) [above of=f1, node distance=1.5cm] {$\ms{IV}$};
    \node (n2) [above of=f2, node distance=1.5cm] {$\ms{IV} + 1$};
    \node (n3) [above of=f3, node distance=1.5cm] {$\ms{IV} + 2$};
    \foreach \x in {1, 2, 3} {
      \draw[-latex] (n\x) -- (f\x);
    }
    \begin{scope}
        \node at (7,0) {$\cdots\cdots\cdots\cdots$};
    \end{scope}

    \begin{scope}
        \node (f) at (8.8cm,0) [minimum size=1.25cm,rounded corners=1ex,fill=green!20,draw] {$F(k, \cdot)$};
        \node (n) [above of=f, node distance=1.5cm] {$\ms{IV} + n - 1$};
        \node (c) [below of=f, node distance=2.5cm] {$m_n$};
        \node (p) [below of=f, node distance=1.5cm, circle, draw] {};
        \node (m) [left of=p, node distance=1.0cm] {$c_n$};
        \draw[-] (p.north) -- (p.south);
        \draw[-] (p.east) -- (p.west);
        \draw[-latex] (m) -- (p);
        \draw[-latex] (n) -- (f);
        \draw[-latex] (f) -- (p);
        \draw[-latex] (p) -- (c);
    \end{scope}
\end{tikzpicture}
\end{center}
\vspace{-10pt}
\end{framed}
\vspace{-10pt}
\captionof{figure}{Counter-mode decryption}
\end{minipage}

\paragraph{Cipherblock chaining (CBC).} Let
$F \colon \calK \times \zo^n \to \zo^n$ be a block cipher (i.e., a secure PRP).
In the following, $k$ is the PRP key and $m = (m_1, \ldots, m_n)$ are the blocks
of the message (i.e., $m_i \in \zo^n$). In CBC encryption, sample
$\ms{IV} \getsr \zo^n$, and the ciphertext is $(\ms{IV}, c_1, \ldots, c_n)$.

\medskip

\noindent \begin{minipage}{\textwidth}
\begin{framed}
\begin{center}
\begin{tikzpicture}
    \foreach \x in {1, 2, 3} {
        \node (f\x) at ($\x*(2.5cm,0)-(2.5cm,0)$) [minimum size=1.25cm,rounded corners=1ex,fill=blue!20,draw] {\footnotesize $F(k, \cdot)$};
        \node (p\x) [above of=f\x, node distance=1.5cm, circle, draw] {};
        \node (m\x) [above of=p\x, node distance=1cm] {$m_\x$};
        \node (c\x) [below of=f\x, node distance=1.5cm] {$c_\x$};
        \draw[-] (p\x.north) -- (p\x.south);
        \draw[-] (p\x.east) -- (p\x.west);
        \draw[-latex] (m\x) -- (p\x);
        \draw[-latex] (p\x) -- (f\x);
        \draw[-latex] (f\x) -- (c\x);
    }

    \foreach \x in {1, 2} {
      \draw[-latex] ($(c\x) + (0,0.6cm)$) -| +(0.8cm,2.4cm) -- ($(p\x) + (2.4cm,0)$);
    }

    \node (iv) [left of=p1, node distance=1.5cm] {$\ms{IV}$};
    \draw[-latex] (iv) -- (p1);
    \foreach \x in {1, 2} {
      \node (cnext\x) at ($(p\x) + (1.8,.2cm)$) {$c_\x$};
    }

    \begin{scope}
        \node at (6.4,0) {$\cdots\cdots$};
    \end{scope}

    \begin{scope}
        \node (f) at (9.6cm,0) [minimum size=1.25cm,rounded corners=1ex,fill=blue!20,draw] {\footnotesize $F(k, \cdot)$};
        \node (p) [above of=f, node distance=1.5cm, circle, draw] {};
        \node (m) [above of=p, node distance=1cm] {$m_n$};
        \node (c) [below of=f, node distance=1.5cm] {$c_n$};
        \node (cend) at ($(p) + (-.7,.2cm)$) {$c_{n - 1}$};
        \draw[-] (p.north) -- (p.south);
        \draw[-] (p.east) -- (p.west);
        \draw[-latex] (m) -- (p);
        \draw[-latex] (p) -- (f);
        \draw[-latex] (f) -- (c);
        \draw[-] ($(c) + (-2.5,0.6cm)$) -- ($(c) + (-1.7,0.6cm)$);
        \draw[-latex] ($(c) + (-1.7,0.6cm)$) |- + (0cm,2.4cm) -- (p);
    \end{scope}
\end{tikzpicture}
\end{center}
\vspace{-10pt}
\end{framed}
\vspace{-10pt}
\captionof{figure}{CBC encryption}
\end{minipage}

\medskip

\noindent \begin{minipage}{\textwidth}
\begin{framed}
\begin{center}
\begin{tikzpicture}

    \foreach \x in {1, 2, 3} {
        \node (f\x) at ($\x*(2.5cm,0)-(2.5cm,0)$) [minimum size=1.25cm,rounded corners=1ex,fill=green!20,draw] {\footnotesize $F^{-1}(k, \cdot)$};
        \node (c\x) [below of=f\x, node distance=2.5cm] {$m_\x$};
        \node (p\x) [below of=f\x, node distance=1.5cm, circle, draw] {};
        \node (m\x) [above of=f\x, node distance=1.5cm] {$c_\x$};
        \draw[-] (p\x.north) -- (p\x.south);
        \draw[-] (p\x.east) -- (p\x.west);
        \draw[-latex] (m\x) -- (f\x);
        \draw[-latex] (f\x) -- (p\x);
        \draw[-latex] (p\x) -- (c\x);
    }

    \node (iv) [left of=p1, node distance=1.5cm] {$\ms{IV}$};
    \draw[-latex] (iv) -- (p1);

    \foreach \x in {1, 2} {
        \draw[-latex] ($(m\x) - (0,0.5cm)$) -| +(0.8cm,-2.5cm) -- ($(p\x) + (2.4cm,0)$);
    }
    \foreach \x in {1, 2} {
      \node (cnext\x) at ($(p\x) + (1.8,.2cm)$) {$c_\x$};
    }

    \begin{scope}
        \node at (6.4,0) {$\cdots\cdots$};
    \end{scope}

    \begin{scope}
        \node (f) at (9.6cm,0) [minimum size=1.25cm,rounded corners=1ex,fill=green!20,draw] {\footnotesize $F^{-1}(k, \cdot)$};
        \node (c) [below of=f, node distance=2.5cm] {$m_n$};
        \node (p) [below of=f, node distance=1.5cm, circle, draw] {};
        \node (cend) at ($(p) + (-.7,.2cm)$) {$c_{n - 1}$};
        \node (m) [above of=f, node distance=1.5cm] {$c_n$};
        \draw[-] (p.north) -- (p.south);
        \draw[-] (p.east) -- (p.west);
        \draw[-latex] (m) -- (f);
        \draw[-latex] (f) -- (p);
        \draw[-latex] (p) -- (c);
        \draw[-] ($(m) - (2.5,0.5cm)$) -- ($(m) - (1.7,0.5cm)$);
        \draw[-latex] ($(m) - (1.7,0.5cm)$) |- + (0cm,-2.5cm) -- (p);
    \end{scope}
\end{tikzpicture}
\end{center}
\vspace{-10pt}
\end{framed}
\vspace{-10pt}
\captionof{figure}{CBC decryption}
\end{minipage}

\section{Public-Key Encryption}

A public-key encryption scheme is define with respect to a message space $\calM$ and a ciphertext
space $\calC$ (technically, each of these sets can be a function of the security parameter $\lambda$)
and consists of three algorithms:
\begin{itemize}
  \item $\Setup \to (\pk, \sk)$: The setup algorithm outputs a public key $\pk$ and a secret key $\sk$.
  (Technically, this algorithm takes the security parameter $\lambda$ as input).

  \item $\Encrypt(\pk, m) \to \ct$: On input the public key $\pk$ and a message $m \in \calM$,
  the encryption algorithm outputs a ciphertext $\ct$.

  \item $\Decrypt(\sk, \ct) \to m$: On input a secret key $\sk$ and a ciphertext $\ct$, the decryption algorithm
  either outputs a message $m \in \calM$ or a special symbol $\bot$ (to indicate a decryption failure).
\end{itemize}

\paragraph{Correctness.} A public-key encryption scheme is correct if for all
$(\pk, \sk)$ output by $\Setup$ and all messages $m \in \calM$,
\[ \Pr[\Decrypt(\sk, \Encrypt(\pk, m)) = m] = 1. \]

\paragraph{Semantic security.} The semantic security experiment is defined analogously to the corresponding
notion in the secret-key setting:

\medskip
\noindent \setlength{\boxheight}{1.8cm}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 0$}:
    \begin{enumerate}[noitemsep, leftmargin=*]
    \item The challenger samples $(\pk, \sk) \gets \Setup$ and gives $\pk$ to $\calA$.
    \item The adversary $\calA$ sends messages $m_0, m_1 \in \calM$ to the challenger.
    \item The challenger replies with $\Encrypt(\pk, m_0)$.
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
  \end{enumerate}
\end{minipage}}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 1$}:
  \begin{enumerate}[noitemsep, leftmargin=*]
    \item The challenger samples $(\pk, \sk) \gets \Setup$ and gives $\pk$ to $\calA$.
    \item The adversary $\calA$ sends messages $m_0, m_1 \in \calM$ to the challenger.
    \item The challenger replies with $\Encrypt(\pk, m_1)$.
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
    \end{enumerate}
\end{minipage}}

\medskip
\noindent We say the encryption scheme satisfies semantic security if for all efficient adversaries $\calA$,
\[ \ms{SSAdv}[\calA] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]} = \negl(\lambda). \]

\paragraph{CCA security.} We start by defining
the CCA-security experiment for public-key encryption. This is the analog of the corresponding
secret-key notion.

\medskip
\noindent \setlength{\boxheight}{4.6cm}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 0$}:
    \begin{itemize}[noitemsep, leftmargin=*]
    \item The challenger samples $(\pk, \sk) \gets \Setup$ and gives $\pk$ to $\calA$.
    \item The adversary can now issue decryption queries to the challenger:
    \begin{itemize}[noitemsep, leftmargin=*]
      \item {\bf Decryption query:} The adversary sends a ciphertext $\ct \in \calC$
      to the challenger. The challenger replies with $\Decrypt(\sk, \ct)$.
    \end{itemize}
    \item The adversary $\calA$ sends messages $m_0, m_1 \in \calM$ to the challenger.
    \item The challenger replies with $\ct^* \gets \Encrypt(\pk, m_0)$.
    \item The adversary can make more decryption queries to the challenger,
    with the restriction that it is not allowed to query on $\ct^*$.
    \begin{itemize}[noitemsep, leftmargin=*]
      \item {\bf Decryption query:} The adversary sends a ciphertext $\ct \ne \ct^*$
      to the challenger. The challenger replies with $\Decrypt(\sk, \ct)$.
    \end{itemize}
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
  \end{itemize}
\end{minipage}}
\fbox{\begin{minipage}[t][\boxheight]{0.48\linewidth}
  \footnotesize
  {\bf Experiment $b = 1$}:
    \begin{itemize}[noitemsep, leftmargin=*]
    \item The challenger samples $(\pk, \sk) \gets \Setup$ and gives $\pk$ to $\calA$.
    \item The adversary can now issue decryption queries to the challenger:
    \begin{itemize}[noitemsep, leftmargin=*]
      \item {\bf Decryption query:} The adversary sends a ciphertext $\ct \in \calC$
      to the challenger. The challenger replies with $\Decrypt(\sk, \ct)$.
    \end{itemize}
    \item The adversary $\calA$ sends messages $m_0, m_1 \in \calM$ to the challenger.
    \item The challenger replies with $\ct^* \gets \Encrypt(\pk, m_1)$.
    \item The adversary can make more decryption queries to the challenger,
    with the restriction that it is not allowed to query on $\ct^*$.
    \begin{itemize}[noitemsep, leftmargin=*]
      \item {\bf Decryption query:} The adversary sends a ciphertext $\ct \ne \ct^*$
      to the challenger. The challenger replies with $\Decrypt(\sk, \ct)$.
    \end{itemize}
    \item The adversary $\calA$ outputs a bit $b' \in \zo$.
  \end{itemize}
\end{minipage}}

\medskip
\noindent We say the encryption scheme satisfies security against
chosen-ciphertext attacks (CCA-security) if for all efficient adversaries $\calA$,
\[ \ms{CCAAdv}[\calA] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]} = \negl(\lambda). \]

\section{Digital Signatures}

A digital signature scheme is defined over a message space $\calM$ and a signature space $\calS$
(technically, each of these sets can be a function of the security parameter $\lambda$) and consists
of three main algorithms:
\begin{itemize}
  \item $\Setup \to (\vk, \sk)$: The setup algorithm outputs a public verification key $\vk$ and a secret
  signing key $\sk$. (Technically, this algorithm takes the security parameter $\lambda$ as input).

  \item $\Sign(\sk, m) \to \sigma$: On input the signing key $\sk$ and a message $m \in \calM$,
  the signing algorithm outputs a signature $\sigma \in \calS$.

  \item $\Verify(\vk, m, \ct) \to \zo$: On input the verification key $\vk$, a message $m \in \calM$,
  and a signature $\sigma \in \calS$, the verification algorithm outputs a bit $b \in \zo$
  (indicating whether the signature is valid or not).
\end{itemize}

\paragraph{Correctness.} The signature scheme is correct if for all
$(\vk, \sk)$ output by $\Setup$ and all messages $m \in \calM$,
\[ \Pr[\Verify(\vk, m, \Sign(\sk, m)) = 1] = 1. \]

\paragraph{Unforgeability.} We start by defining the unforgeability experiment:

\medskip

\noindent \setlength{\boxheight}{2cm}
\fbox{\begin{minipage}[t][\boxheight]{0.99\linewidth}
  \footnotesize
  {\bf Existential unforgeability experiment}:
    \begin{itemize}[noitemsep, leftmargin=*]
    \item The challenger samples $(\vk, \sk) \gets \Setup$ and gives $\vk$ to the adversary.
    \item The adversary can now make signing queries to the challenger:
    \begin{itemize}[noitemsep, leftmargin=*]
      \item {\bf Signing query:} The adversary sends $m \in \calM$
      to the challenger. The challenger replies with $\sigma \gets \Sign(\sk, m)$.
    \end{itemize}
    \item The adversary $\calA$ outputs a message $m^\ast \in \calM$ and signature
    $\sigma^\ast \in \calS$.
  \end{itemize}
\end{minipage}}

\medskip
\noindent We say an adversary $\calA$ is admissible for the signature unforgeability game if
the adversary does not make a signing query on the message $m^\ast$.
We say the signature scheme satisfies unforgeability if for all efficient
and admissible adversaries $\calA$,
\[ \Pr[\Verify(\sk, m^\ast, \sigma^\ast) = 1] = \negl(\lambda). \]

\end{document}
