What's the difference between trapdoor and encryption?

Question

Trapdoor is a function taking as input $x$ and givings us output $y$ where it is hard to convert $y\rightarrow x $ back without knowing a secret $s$.

I think that $y$ is an encryption of $x$ under a some certain key($s$ or its associated public key).

So is trapdoor encryption?

Answer 1

A trapdoor function doesn't have the security requirements of an encryption function. If you directly use a trapdoor for encryption you open yourself up to related key attacks, known plaintext attacks, malleability attacks and a whole host of other attacks.

Trapdoor functions are used as a single piece of a larger encryption function that handles all these issues.

Answer 2

Trapdoor functions are a special kind of one-way function, where it is possible to calculate the reverse function with the knowledge of some secret value, which is called the trapdoor. If a trapdoor function is also a permutation (bijective, from a set to itself), then it's called a trapdoor permutation.

When considering encryption, we need an encryption algorithm $E_k(m)$ with message $m$ and key $k$ and a decryption algorithm $D_{k'}(c)$ with ciphertext $c$ and key $k'$, where $D_{k'}(E_k(m)) = m$ holds (most often it has to hold for all values, sometimes it is acceptable if this doesn't hold for a negligible amount of messages).

So in order to fullfill the definition of an encryption scheme, the trapdoor has to be injective for almost all values. This is similar to the term statistically injective (e.g. in How to Use Indistinguishability Obfuscation: Deniable Encryption, and More by Sahai and Waters, 2013). Otherwise it would be impossible to decrypt again and get back the input message. So for encryption schemes, trapdoor permutations are more interesting than trapdoor functions in general.

But as @Daffy correctly pointed out: Security definitions for encryption schemes, e.g. IND-CPA or IND-CCA, do not directly apply to trapdoor functions or trapdoor permutations. But those can be used to construct encryption schemes, e.g. public-key encryption schemes insolve some kind of trapdoor function.

But the trapdoor function itself does not necessarily fullfill the necessary security definitions. Here's an example:

• In RSA the modular exponentiation is a trapdoor oneway function.
• RSA is not IND-CPA secure.
• With the padding scheme OAEP we get an IND-CCA secure encryption scheme in the random oracle model

Answer 3

Let $f$ be hard to invert. Given $y=f(x)$, the value $x$ is unknown to an adversary (who cannot invert $f$).

This is why one might assume that "$y$ is an encryption of $x$".

However, this is not the case in general: Define $g(x_1,x_2)=(f(x_1),x_2)$. Then $g$ is hard to invert if $f$ is, but $y=g(x)$ reveals information about $x=(x_1,x_2)$.