International Association
for Cryptologic Research

A weak pseudorandom function (weak PRF) is one of the most important cryptographic primitives for its efficiency although it has lower security than a standard PRF.

Recently, Boneh et al. (TCC'18) introduced two types of new weak PRF candidates, called a basic Mod-2/Mod-3 and alternative Mod-2/Mod-3 weak PRF. They both use the mixture of linear computations defined on different small moduli to satisfy conceptual simplicity, low complexity (depth-2 ${\sf ACC^0}$) and MPC friendliness. In fact, the new candidates are conjectured to be exponentially secure against any adversary that allows exponentially many samples, and a basic Mod-2/Mod-3 weak PRF is the only candidate that satisfies all above features. However, none of direct attacks which focus on a basic and alternative Mod-2/Mod-3 weak PRFs uses their own structures.

In this paper, we investigate weak PRFs in three perspectives; attacks, fixes, and a new analysis to support the hardness conjecture of weak PRFs. We first propose direct attacks for an alternative Mod-2/Mod-3 weak PRF and a basic Mod-2/Mod-3 weak PRF when a circulant matrix is used as a secret key.

For an alternative Mod-2/Mod-3 weak PRF, we prove that the adversary's advantage is at least $2^{-0.105n}$, where $n$ is the size of input space of weak PRF. Similarly, we show that the advantage of our heuristic attack to the weak PRF with a circulant matrix key is larger than $2^{-0.21n}$, which is contrary to previous expectation that `a structured secret key' does not affect the security of a weak PRF. Thus, for optimistic parameter choice $n = 2\lambda$ for the security parameter $\lambda$, parameters should be increased to preserve $\lambda$-bit security when an adversary obtains exponentially many samples.

Next, we provide a simple method for repairing two weak PRFs affected by our attack while preserving the depth-2 ${\sf ACC^0}$ circuit complexity and parameters.

Moreover, we provide an observation and a new analysis to support the exponential hardness conjecture of a basic Mod-2/Mod-3 weak PRF when a secret key is uniformly sampled from $\{0,1\}^{m \times n}$.

In this paper, we extend the concept of bias amplifiers and show how they can be used to detect badly broken noise sources both in the design and production phases of a true random number generator. We also develop a theoretical framework that supports the experimental results obtained in this paper.

We introduce an interpolation attack using the \textsc{Moebius Transform}. This can reduce the time complexity to get a linear system of equations for specified intermediate state bits, which is general to cryptanalysis of some ciphers with update function of low algebraic degree. Along this line, we perform an interpolation attack against \textsc{Elephant-Delirium}, a round 2 submission of the ongoing NIST lightweight cryptography project. This is the first third-party cryptanalysis on this cipher. Moreover, we promote the interpolation attack by applying it to the \textbf{Farfalle} pseudo-random constructions \textsc{Kravatte} and \textsc{Xoofff}. Our attacks turn out to be the most efficient method for these ciphers thus far.

GlobalPlatform (GP) card specifications are defined for smart cards regarding rigorous security requirements. The increasingly more powerful cards within an open ecosystem of multiple players stipulate that asymmetric-key protocols become necessary. In this paper, we analyze SCP10, which is the Secure Channel Protocol (SCP) that relies on RSA for key exchange and authentication. Our findings are twofold. First, we demonstrate several flaws in the design of SCP10. We discuss the scope of the identified flaws by presenting several attack scenarios in which a malicious attacker can recover all the messages protected by SCP10. We provide a full implementation of these attacks. For instance, an attacker can get the freshly generated session keys in less than three hours. Second, we propose a secure implementation of SCP10 and discuss how it can mitigate the discovered flaws. Finally, we measure the overhead incurred by the implemented countermeasures.

Event date: 18 November to 20 November 2020
Submission deadline: 3 July 2020
Notification: 4 September 2020

The ISG is seeking to recruit a post-doctoral research assistant to work in the area of cryptography. The position is available now until 1 June 2022.

The PDRA will work alongside Prof. Martin Albrecht, Dr. Rachel Player and other cryptographic researchers at Royal Holloway on topics in lattice-based cryptography. This post is part of the EU H2020 PROMETHEUS project (https://www.h2020prometheus.eu) for building privacy preserving systems from advanced lattice primitives. Our research focus within this project is on cryptanalysis and implementations, but applicants with a strong background in other areas such as protocol/primitive design are also encouraged to apply.

See also this blog post (https://martinralbrecht.wordpress.com/2020/06/26/postdoc-at-royal-holloway-on-lattice-based-cryptography-3/) for more details.

Closing date for applications:

Contact: Martin Albrecht or Rachel Player

More information: https://jobs.royalholloway.ac.uk/Vacancy.aspx?ref=0620-149

Department Summary: University of North Texas (UNT) is rapidly building its Center for Agile and Adaptive Manufacturing (CAAAM), a State of Texas funded multi-million-dollar initiative with a multi-disciplinary focus on further advancing the science and technology of additive manufacturing (AM). CAAAM involves a multi-disciplinary team of researchers from materials science, mechanical engineering, manufacturing, data science, cybersecurity and logistics & supply chain, committed to collaborating on large research projects with an emphasis on additive manufacturing.

Position Summary: CAAAM is seeking a Research Assistant Professor to collaborate with a team of faculty on cybersecurity issues related to AM. This is a non-tenure track terminal position with a primary association with CAAAM and secondary association with an appropriate academic department. The selected candidate is expected to focus on cybersecurity in the context of advanced manufacturing systems in general and additive manufacturing systems more specifically. A successful candidate will work closely with faculty in the Computer Science and Engineering department as well as other faculty and researchers in CAAAM. The candidate is expected to conduct research on securing advanced manufacturing systems and develop fundamental and innovative approaches to the design and validation of secure, trustworthy and resilient cyber systems for industrial automation. The candidate is also expected to develop educational material for training workforce to operate advanced manufacturing systems as well as mentor graduate students and post-doctoral researchers working in CAAAM.

Minimum qualifications include an earned doctorate in Computer Engineering, Computer Science or a related discipline with a research focus on cybersecurity in general but more specifically, cybersecurity related to cyber-physical systems, security in edge devices, hardware/systems security, security of IoT’s and Industrial IoT’s, design and validation of secure and resilient cyber-physical systems. The research background should be evident from high quality publications.

Closing date for applications:

Contact: Krishna Kavi (Krishna.Kavi@unt.edu), Mary Chandler (Mary.Chandler@unt.edu)

More information: http://jobs.untsystem.edu/postings/34619

What you will do

Reporting to the Director, Fintech Research team in the IT Services department, you use your expertise and intellect to solve unique and difficult problems. Working in a talented and diverse team you touch all phases of a research and development project towards meeting challenging policy goals.

You will have the opportunity to use your specialized skills, develop these further and contribute to other areas of the project:
- Devise technical solutions to difficult and unique problems either independently, with team members or with external vendors and experts as required
-Identify gaps and Investigate emerging technologies as required for their application for CBDC
- Liaise closely with, and consider impacts on, other aspects of the system, outside the immediate area of responsibility, in formulating technical designs
- Recommend solutions to specific problem to solution architect and project leadership with a holistic view of impacts (e.g. effectiveness of solution, costs, risks, evolution over time)
- Explain and justify design choices, especially when multiple options are available
- Explain technologies and solutions to other technical audiences and occasionally business stakeholders in the Bank
- Assist in the design and development of proof-of-technologies / proof-of-concepts
- Contribute to development of a working CBDC system
- Contribute to the documentation and body of knowledge of technical designs
- Give intellectual leadership to other members of the team involved in the same domain area
- Manage day-to-day relationship with external parties such as vendors to ensure efficient work practices and management of risks
- Manage and balance the workloads of multiple simultaneous projects

What you can expect from us

Salaries are based on qualifications and experience and typically range from $94,100 and $117,600 (job grade 18). The intent is to staff at job grade job grade 18. Based on business needs and the successful candidate’s experience, knowledge and competencies, the position may be staffed at JG 17 ($83,900 and $104,

Closing date for applications:

Contact: Apply Online using above link

More information: https://careers.bankofcanada.ca/job/Ottawa-%28Downtown%29-Research-and-Development-Technologist%2C-CBDC/540381817/

OneSpan is seeking applications for highly motivated and self-driven research scientists to complement its Innovation Centre team currently working on cutting-edge research in security, privacy, machine learning and digital identity. The Innovation Centre was established to research and prototype the next generation of digital technologies to improve online security. We seek to make technological advances in areas ranging from OneSpan’s core business of strong authentication, to areas of growing importance such as cybersecurity incidents detection, digital identity and privacy. Our work aims to generate new scientific knowledge, prototypes, and intellectual property that can be transferred into products. We also aspire to be a leading academic-industry partner of choice on emerging technologies related to online security. Job Duties and Responsibilities The objective of the research scientist is to conduct applied research linked to OneSpan’s product range with the aim of enhancing OneSpan’s offering in the short and mid-term. Your key tasks are: Propose research agenda. Perform first-class research. Create research software prototypes that could lead to new products. Show leadership in your field of expertise. Work collaboratively in a team that spans international borders and departments. Requirements Must haves A PhD degree or equivalent experience in information engineering, computer science. Candidates expected to finish their PhD before autumn 2020 will also be considered. Strong proven interest and knowledge of one or more of these research areas: security, machine learning, digital identity, and privacy A willingness to learn and the ability to quickly understand unfamiliar areas of technology. Desirable skills Interest in computer security and machine learning. Some experience in software development. Experience in working in multi-disciplinary teams Authoring reports for and presenting to non-technical audiences. Demonstrated ability to innovate through publications, patents or equivalent

Closing date for applications:

Contact: Julie Tinel

More information: https://grnh.se/48c98f131us

OneSpan is seeking applications for highly motivated and self-driven research scientists to complement its Innovation Centre team currently working on cutting-edge research in security, privacy, machine learning and digital identity. The Innovation Centre was established to research and prototype the next generation of digital technologies to improve online security. We seek to make technological advances in areas ranging from OneSpan’s core business of strong authentication, to areas of growing importance such as cybersecurity incidents detection, digital identity and privacy. Our work aims to generate new scientific knowledge, prototypes, and intellectual property that can be transferred into products. We also aspire to be a leading academic-industry partner of choice on emerging technologies related to online security. Job Duties and Responsibilities The objective of the research scientist is to conduct applied research linked to OneSpan’s product range with the aim of enhancing OneSpan’s offering in the short and mid-term. Your key tasks are: Propose research agenda. Perform first-class research. Create research software prototypes that could lead to new products. Show leadership in your field of expertise. Work collaboratively in a team that spans international borders and departments. Requirements Must haves A PhD degree or equivalent experience in information engineering, computer science. Candidates expected to finish their PhD before autumn 2020 will also be considered. Strong proven interest and knowledge of one or more of these research areas: security, machine learning, digital identity, and privacy A willingness to learn and the ability to quickly understand unfamiliar areas of technology. Desirable skills Interest in computer security and machine learning. Some experience in software development. Experience in working in multi-disciplinary teams Authoring reports for and presenting to non-technical audiences. Demonstrated ability to innovate through publications, patents or equivalent

Closing date for applications:

Contact: Julie Tinel

More information: https://grnh.se/a47755df1us

Event date: 21 June to 24 June 2020
Submission deadline: 4 September 2020
Notification: 9 November 2020

Event date: 7 July to 9 July 2020

We introduce and construct a variant of a time-lock puzzle which is non-malleable. A non-malleable time-lock puzzle guarantees, roughly, that it is impossible to "maul" a puzzle into one for a related message without solving it. The security of this construction relies on the existence of any (plain) time-lock puzzle and it is proven secure in the auxiliary-input random oracle model. We show that our construction satisfies bounded concurrency and prove that it is impossible to obtain full concurrency. We additionally introduce a more general non-malleability notion, termed functional non-malleability, which protects against tampering attacks that affect a specific function of the related messages. We show that in many (useful) cases, our construction satisfies fully concurrent functional non-malleability.

We use our (functional) non-malleable time-lock puzzles to give efficient multi-party protocols for desirable tasks such as coin flipping and auctions. Our protocols are (1) fair, meaning that no malicious party can influence the output, (2) optimistically efficient, meaning that if all parties are honest, then the protocol terminates immediately, and (3) publicly verifiable, meaning that from the transcript of the protocol anyone can quickly infer the outcome, without the need to perform a long computation phase. Our protocols support an unbounded number of participants and require no adversary-independent trusted setup. Our protocol is the first protocol that satisfies all of the above properties under any assumption. Security is proven assuming the repeated squaring assumption and in the auxiliary-input random oracle model. Along the way, we introduce a publicly verifiable notion of time-lock puzzles which is of independent interest. This notion allows the solver of the puzzle to compute the solution together with a proof which can be quickly verified by anyone.

Lightweight authenticated key exchange (AKE) protocols based on symmetric-key cryptography is important in securing the Internet of Things (IoT). However, achieving perfect forward secrecy (PFS) is not trivial for AKE based on symmetric-key cryptography, as opposed to AKE based on public-key cryptography. The most recent proposals that provide PFS are SAKE and SAKE-AM. In this paper, we first take a closer look at these protocols and observe that they are vulnerable to a number of attacks, such as, replay attack, denial of service (DoS) attack, tracking attack, etc. We then propose countermeasures to both protocols to restore security. Additionally, our proposed scheme SAKE+ enables concurrent execution of the protocol, whereas the original SAKE scheme supports the sequential execution of the protocol. The concurrency provided by our scheme makes it more suitable for IoT applications where a server receives and sends information from a large number of IoT end devices. Finally, we prove the security and soundness of our schemes, and verify using ProVerif tool.

We propose a Dynamic Universal Accumulator in the Accumulator Manager setting for bilinear groups which extends Nguyen's positive accumulator and Au et al. and Damgård and Triandopoulos non-membership proof mechanism. The new features include support for batch addition and deletion operations as well as a privacy-friendly decentralized batch witness update protocol, where the witness update information is the same for all users. Together with a non-interactive zero-knowledge protocol, these make the proposed scheme suitable as an efficient and scalable Anonymous Credential System, accessible even by low-resource users. We show security of the proposed protocol under the t-SDH assumption through a proper initialization of the accumulator and we demonstrate its practical relevance by providing and discussing an implementation realized using state-of-the-art libraries.

Non-malleable codes allow one to encode data in such a way that, after tampering, the modified codeword is guaranteed to decode to either the original message, or a completely unrelated one. Since the introduction of the notion by Dziembowski, Pietrzak, and Wichs (ICS '10 and J. ACM '18), a large body of work has focused on realizing such coding schemes secure against various classes of tampering functions. It is well known that there is no efficient non-malleable code secure against all polynomial size tampering functions. Nevertheless, non-malleable codes in the plain model (i.e., no trusted setup) secure against $\textit{bounded}$ polynomial size tampering are not known and obtaining such a code has been a major open problem.

We present the first construction of a non-malleable code secure against $\textit{all}$ polynomial size tampering functions that have $\textit{bounded polynomial depth}$. This is an even larger class than all bounded polynomial $\textit{size}$ functions and, in particular, we capture all functions in non-uniform $\mathbf{NC}$ (and much more). Our construction is in the plain model (i.e., no trusted setup) and relies on several cryptographic assumptions such as keyless hash functions, time-lock puzzles, as well as other standard assumptions. Additionally, our construction has several appealing properties: the complexity of encoding is independent of the class of tampering functions and we obtain sub-exponentially small error.

We present several improvements to the framework of differential-linear attacks with a special focus on ARX ciphers. As a demonstration of their impact, we apply them to Chaskey and ChaCha and we are able to significantly improve upon the best attacks published so far.

A Hashed Time Lock Contract (HTLC) is a central concept in cryptocurrencies where some value can be spent either with the preimage of a public hash by one party (Bob) or after a timelock expires by another party (Alice). We present a bribery attack on HTLC's where Bob's hash-protected transaction is censored by Alice's timelocked transaction. Alice incentivizes miners to censor Bob's transaction by leaving almost all her value to miners in general. Miners follow (or refuse) the bribe if their expected payoff is better (or worse). We explore conditions under which this attack is possible, and how HTLC participants can protect themselves against the attack. Applications like Lightning Network payment channels and Cross-Chain Atomic Swaps use HTLC's as building blocks and are vulnerable to this attack. Our proposed solution uses the hashpower share of the weakest known miner to derive parameters that make these applications robust against this bribing attack.

In both hardware and software, masking can represent an effective means of hardening an implementation against side-channel attacks such as Differential Power Analysis (DPA). Focusing on software, however, the use of masking can present various challenges: specifically, it often 1) requires significant effort to translate any theoretical security properties into practice, and, even then, 2) imposes a significant overhead in terms of efficiency. To address both challenges, this paper explores use of an Instruction Set Extension (ISE) as a means of supporting masking in software-based implementations of symmetric cryptographic algorithms: we design, implement, and evaluate such an ISE using RISC-V as the base architecture.

The Fiat-Shamir transform is a methodology for compiling a (public-coin) interactive proof system for a language $L$ into a non-interactive argument system for $L$. Proving security of the Fiat-Shamir transform in the standard model, especially in the context of succinct arguments, is largely an unsolved problem. The work of Canetti et al. (STOC 2019) proved the security of the Fiat-Shamir transform applied to the Goldwasser-Kalai-Rothblum (STOC 2008) succinct interactive proof system under a very strong ``optimal learning with errors'' assumption. Achieving a similar result under standard assumptions remains an important open question.

In this work, we consider the problem of compiling a different succinct interactive proof system: Pietrzak's proof system (ITCS 2019) for the iterated squaring problem. We construct a hash function family (with evaluation time roughly $2^{\lambda^{\epsilon}}$) that guarantees the soundness of Fiat-Shamir for this protocol assuming the sub-exponential ($2^{-n^{1-\epsilon}}$)-hardness of the $n$-dimensional learning with errors problem. (The latter follows from the worst-case $2^{n^{1-\epsilon}}$ hardness of lattice problems.) More generally, we extend the ``bad-challenge function'' methodology of Canetti et al. for proving the soundness of Fiat-Shamir to a class of protocols whose bad-challenge functions are not efficiently computable.

As a corollary (following Choudhuri et al., ePrint 2019 and Ephraim et al., EUROCRYPT 2020), we construct hard-on-average problems in the complexity class $\mathbf{CLS}\subset \mathbf{PPAD}$ under the $2^{\lambda^\epsilon}$-hardness of the repeated squaring problem and the $2^{-n^{1-\epsilon}}$-hardness of the learning with errors problem. Under the additional assumption that the repeated squaring problem is ``inherently sequential'', we also obtain a Verifiable Delay Function (Boneh et al., EUROCRYPT 2018) in the standard model. Finally, we give additional PPAD-hardness and VDF instantiations demonstrating a broader tradeoff between the strength of the repeated squaring assumption and the strength of the lattice assumption.