Are there any symmetric cryptosystems which are provably secure in the sense that there exists a reduction from their security to the hardness of some underlying hard problem such as integer factorisation?

If not, why not?

  • $\begingroup$ The pohlig-helman cipher ($c=m^e\bmod p$ for some secret $e,p$) could be a candidate for replacing AES in a "provably secure way" (though I couldn't find a proof right now). $\endgroup$
    – SEJPM
    Commented May 16, 2019 at 18:31
  • 1
    $\begingroup$ AES in CTR mode is just as ‘provable’ as Pohlig–Hellman in, say, CBC mode. Both of them rely on unproven conjectures: that AES and Pohlig–Hellman are PRPs. But AES is tremendously more efficient for the same conjectured security. $\endgroup$ Commented May 16, 2019 at 20:28
  • $\begingroup$ If Hash function count, there was a candidate for SHA-3 based on lattice problems (SWIFFT). $\endgroup$
    – LeoDucas
    Commented May 17, 2019 at 6:04

3 Answers 3

  1. Finding uniform random $x$ given $x^3 \bmod{pq}$ for uniform random 1024-bit primes $p$ and $q$ is conjectured to be hard because smart, motivated cryptanalysts have spent decades trying to do so and have left only a track record of failure.*

  2. Finding uniform random $k$ given $\operatorname{AES256}_k(92187681)$ is conjectured to be hard because smart, motivated cryptanalysts have spent decades trying to do so and have left only a track record of failure.

That said, the best estimates for the cost of (1) are much cheaper than the best estimates for (2), and the computation of $x^3 \bmod{pq}$ is much costlier than the computation of $\operatorname{AES256}_k(92187681)$. In other words, RSA-2048 is much more expensive for less security than AES-256.

You might be tempted to say that the RSA problem is a more fundamental problem in number theory, and as such is the only one that's really a ‘hard problem’. But it is precisely because RSA is embedded in a rich mathematical theory—as is needed for separate public key and private key operations!—that it is more vulnerable to attacks. In reality, AES is a much harder problem than RSA!

There are many symmetric cryptosystems that use AES, and for which there is a theorem that breaking them can't be much easier than breaking AES, such as AES-GCM. Similarly, there are many public-key cryptosystems that use the RSA trapdoor permutation, and for which there is a theorem that breaking them can't be much easier than inverting the RSA trapdoor permutation, like RSA-PSS and RSA-KEM.

The term ‘provable security’ means nothing more than there is a theorem. These cryptosystems—AES-GCM, RSA-PSS, and RSA-KEM alike—all have ‘provable security’ because there is a theorem, not because of any mathematical theory around AES or RSA. So does a 1-bit universal hashing authenticator have provable security, even though the amount of security it provides is so small an attacker will win with the probability of a fair coin toss coming up heads.

* Incidentally, while the RSA problem can't be harder than factorization, we don't have a proof that it can't be easier. There is some weak evidence—a reduction in the generic ring model—but there's no theorem that if factoring is hard then the RSA problem is hard. Hence not even the RSA problem has ‘provable security’ relative to factoring.

  • $\begingroup$ A different way to say it is to say that "RSA has more structure than AES and thus is weaker", but of course you need that extra structure for public key encryption... $\endgroup$
    – SEJPM
    Commented May 16, 2019 at 18:26

The existence of one-way functions (OWFs) implies symmetric-key encryption (SKE) through the following sequence of reductions:

  1. Build a pseudo-random generator (PRG) from the OWF using the HILL construction [H+] (This is not very efficient --- one gets better constructions from one-way permutations: see [BM]).
  2. Use the GGM construction [GGM] to construct a pseudo-random function (PRF) from this PRG
  3. The construction of SKE from PRF is folklore (the key of the PRF serves as the key $k$ of the SKE, and to encrypt a message $m$ in the range of the PRF, pick a random element $r$ from the domain of the PRF and set $m\oplus PRF_k(r)$).
  4. Alternatively, one can construct a block cipher a.k.a pseudo-random permutation (PRP) from the PRF using Luby-Rackoff [LR] --- once you have block ciphers, it is possible to encrypt arbitrary-sized messages using an appropriate mode of operation (e.g., CBC).

So, it boils down to the assumptions that yield OWFs as raised in this previous question. There are several candidate constructions of one-way functions from diverse problems arising from cryptography (e.g., stream ciphers, hash functions), complexity theory (e.g., the planted SAT and planted Clique problem), combinatorics (e.g., Goldreich's one-way function) and learning theory: I'd recommend reading Barak's recent survey titled "The Complexity of Public-Key Cryptography" for a thorough treatment of this topic. Number theoretic assumptions like integer factorisation or discrete-log problem also yield one-way functions, but they are in some sense an overkill as they have more "structure" than required for SKE.

In practice, however the constructions that you get by following the above chain of reductions are terribly inefficient and one relies on a (heuristic) block cipher like AES.

[BM] Blum and Micali. How to Generate Cryptographically Strong Sequence of Pseudorandom Bits. SIAM JoC’82.

[GGM] Goldreich, Goldwasser and Micali. How to Construct Random Functions. JACM’86.

[H+]: Håstad, Impagliazzo, Levin and Luby. A Pseudorandom Generator from Any One-Way Function. SIAM JoC’99.

[LR] Luby and Rackoff. How to Construct Pseudorandom Permutations from Pseudorandom Functions. SIAM JoC’88.


The cipher from Fully Homomorphic Encryption over the Integers is a candidate example.

It is a symmetric cipher that is provably reducible to the approximate greatest common divisor problem.

Note that it is symmetric in the sense of "the same key is used to encrypt and decrypt", as opposed to "extremely fast and useful for bulk data". The latter definition is typically assumed when the words "symmetric cipher" are used, but that is not the case here.

  • $\begingroup$ I wonder what security claims that scheme achieves, ie could one (probably) build CCA-secure encryption from that? $\endgroup$
    – SEJPM
    Commented May 16, 2019 at 18:27
  • 2
    $\begingroup$ @SEJPM If solving Approximate Common Divisor problem is hard, then it is IND-CPA. $\endgroup$ Commented May 24, 2019 at 13:09
  • $\begingroup$ It is worth noting that several homomorphic public key schemes (even the ones over lattices) are construct on top of symmetric homomorphic ones, i.e. construct a private key homomorphic scheme, define the public key $pk = \{c_1, ..., c_\ell\}$ where $c_i$'s are encryptions of zero, then encrypt message $m$ by taking a random linear combination of those publicly available ciphertexts and adding $m$, that is $Enc_{pk}(m) = \sum r_i c_i + m$ for random $r_i \in \{0, 1\}$. $\endgroup$ Commented May 24, 2019 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.