International Association
for Cryptologic Research

It is of folkloric belief that the security of classical cryptographic protocols is automatically broken if the Adversary is allowed to perform superposition queries and the honest players forced to perform actions coherently on quantum states. Another widely held intuition is that enforcing measurements on the exchanged messages is enough to protect protocols from these attacks.

However, the reality is much more complex. Security models dealing with superposition attacks only consider unconditional security. Conversely, security models considering computational security assume that all supposedly classical messages are measured, which forbids by construction the analysis of superposition attacks. Boneh and Zhandry have started to study the quantum computational security for classical primitives in their seminal work at Crypto'13, but only in the single-party setting. To the best of our knowledge, an equivalent model in the multiparty setting is still missing.

In this work, we propose the first computational security model considering superposition attacks for multiparty protocols. We show that our new security model is satisfiable by proving the security of the well-known One-Time-Pad protocol and give an attack on a variant of the equally reputable Yao Protocol for Secure Two-Party Computations. The post-mortem of this attack reveals the precise points of failure, yielding highly counter-intuitive results: Adding extra classical communication, which is harmless for classical security, can make the protocol become subject to superposition attacks. We use this newly imparted knowledge to construct the first concrete protocol for Secure Two-Party Computation that is resistant to superposition attacks. Our results show that there is no straightforward answer to provide for either the vulnerabilities of classical protocols to superposition attacks or the adapted countermeasures.

In the recent years, some security proofs in cryptography have known significant improvements by replacing the statistical distance with alternative divergences. We continue this line of research, both at a theoretical and practical level. On the theory side, we propose a new cryptographic divergence with quirky properties. On the practical side, we propose new applications of alternative divergences: circuit-private FHE and prime number generators. More precisely, we provide the first formal security proof of the prime number generator PRIMEINC (Brandt and Damgård, CRYPTO 1992), and improve by an order of magnitude the efficiency of a prime number generator by Fouque and Tibouchi (ICALP 2014) and the washing machine technique by Ducas and Stehlé (EUROCRYPT 2016) for circuit-private FHE.

An incompressible encoding can probabilistically encode some data $m$ into a codeword $c$, which is not much larger. Anyone can decode the codeword $c$ to recover the original data $m$. However, the codeword $c$ cannot be efficiently compressed, even if the original data $m$ is given to the decompression procedure on the side. In other words, $c$ is an efficiently decodable representation of $m$, yet is computationally incompressible even given $m$. An incompressible encoding is composable if many encodings cannot be simultaneously compressed.

The recent work of Damg\aa{}rd, Ganesh and Orlandi (CRYPTO '19) defined a variant of incompressible encodings as a building block for ``proofs of replicated storage''. They constructed incompressible encodings in an ideal permutation model, but it was left open if they can be constructed under standard assumptions, or even in the more basic random-oracle model. In this work, we undertake the comprehensive study of incompressible encodings as a primitive of independent interest and give new constructions, negative results and applications:

* We construct incompressible encodings in the common random string (CRS) model under either Decisional Composite Residuosity (DCR) or Learning with Errors (LWE). However, the construction has several drawbacks: (1) it is not composable, (2) it only achieves selective security, and (3) the CRS is as long as the data $m$. * We leverage the above construction to also get a scheme in the random-oracle model, under the same assumptions, that avoids all of the above drawbacks. Furthermore, it is significantly more efficient than the prior ideal-model construction. * We give black-box separations, showing that incompressible encodings in the plain model cannot be proven secure under any standard hardness assumption, and incompressible encodings in the CRS model must inherently suffer from all of the drawbacks above. * We give a new application to ``big-key cryptography in the bounded-retrieval model'', where secret keys are made intentionally huge to make them hard to exfiltrate. Using incompressible encodings, we can get all the security benefits of a big key without wasting storage space, by having the key to encode useful data.

The sequential structure of some side-channel attacks makes them subject to error propagation, i.e. when an error occurs during the recovery of some part of a secret key, all the following guesses might as well be chosen randomly. We propose a methodology that strengthens sequential attacks by automatically identifying and correcting errors. The core ingredient of our methodology is a change-detection test that monitors the distribution of the distinguisher values used to reconstruct the secret key. Our methodology includes an error-correction procedure that can cope both with false positives of the change-detection test, and inaccuracies of the estimated location of the wrong key guess. The proposed methodology is general and can be included in several attacks. As meaningful examples, we conduct two different side-channel attacks against RSA-2048: an horizontal power-analysis attack based on correlation and a vertical timing attack. Our experiments show that, in all the considered cases, strengthened attacks outperforms their original counterparts and alternative solutions that are based on thresholds. In particular, strengthened attacks achieve high success rates even when the side-channel measurements are noisy or limited in number, without prohibitively increasing the computing time.

This position in the COSIC research group of the KU Leuven, addresses valorization opportunities in new forms of cryptography that support calculations on encrypted data, without having to decrypt the data. These new forms of cryptography include fully homomorphic encryption, multi-party computation, trusted execution environments and related topics.

The Innovation Manager will identify opportunities for bilateral projects and research platforms, technology transfer, and potentially spin-off companies, including the definition of licenses, patents or other forms of valorization. All these tasks are executed in coordination with KU Leuven Research and Development. In particular, the Innovation Manager will assist in defining and maintaining a strategic research agenda to create a continuum between fundamental research, strategic research and applied research.

The lndustrial Research Fund (lOF) of KU Leuven forms a bridge between strategic basic research, technological innovations and industrial collaborations. Based on cooperations with KU Leuven research groups and different stakeholders from industry and society, we aim to broaden our valorization portfolio and to increase the transfer of knowledge. We have a team of more than 40 experienced innovation managers involved in the development of practical and innovative technological solutions based on the expertise and infrastructure of the research groups within KU Leuven.

Profile

• PhD or equivalent research expertise in applied cryptography
• Preferably industrial experience
• At least a high level understanding or parts of MPC, FHE, PQC, TEE
• Experience in valorization of research results
• Creative, enthusiastic, with a strong commitment to research valorization
• Proactive, entrepreneurial mindset
• Strong communication skills, including international and intercultural
• Willing to travel globally

Offer An exciting and challenging job, focused on continuous innovation and development in a transdisciplinary and international context. We offer a permanent position as Innovation Manager of the Industrial Research Fund (IOF) at KU

Closing date for applications:

Contact: Nigel Smart (nigel.smart@kuleuven.be) Ingrid Verbauwhede (ingrid.verbauwhede@kuleuven.be) Frederik Vercauteren (frederik.vercauteren@kuleuven.be)

More information: https://www.kuleuven.be/personeel/jobsite/jobs/55715055

Event date: 30 November to 1 December 2020
Submission deadline: 24 August 2020
Notification: 1 October 2020

Event date: 30 January to 2 February 2020
Submission deadline: 20 July 2020
Notification: 15 September 2020

The Security and Cryptography team in Fujitsu Laboratories of America is looking for an engineer for contributing to opensource blockchain projects. You will work closely with a team of cryptographers and security researchers located in Sunnyvale, California and Tokyo, Japan. Your main task will be secure software development in C/C++/Rust/golang/Nodejs as part of Fujitsu Laboratory's OSS activity in Hyperledger. In addition, you will also be encouraged to write academic papers based on your work leading to publications in top tier cryptography and security conferences.

Profile Description:

• Proven experience in production quality software development.
• Previous experience and code contributions to open source projects is a plus.
• Experience in implementation of cryptographic libraries.
• Graduate level knowledge of crypto theory. Familiarity with threshold cryptosystems and multiparty protocols (MPC). Academic publications in Crypto/Security is a plus.
• Experience in design and implementation of large software systems and writing secure code in C/C++/Rust/Golang.
• Familiarity with blockchain systems such as Hyperledger Fabric and/or Ethereum.
• Ability to meet deliverables and deadlines with minimal supervision.
• Fluent in written and spoken english.

Working hours are flexible. Initially you will be offered a full time (we are also open to offering part time) remote contractor position for six months. Depending on your performance and status of the project, the contract can be extended or can be converted to a full time permanent position based on Sunnyvale, California.

Deadline for Application: Open until the position is filled.
Start Date: Immediate, but flexible.
Salary: Very attractive, depends on experience.

Closing date for applications:

Contact: Avradip Mandal, Researcher. amandal@fujitsu.com

The Max Planck Institute (MPI) for Security and Privacy is looking for motivated students to apply for a Ph.D. program. The research will be conducted on the theory of cryptography and computer security and more specifically in one of the following topics:

Homomorphic encryption and code obfuscation

Zero-knowledge proofs and succinct arguments

Cryptocurrencies and blockchains

Post-quantum and lattice-based cryptography

Multi-party computation

Other research proposals by the candidate will also be considered, depending on the common interests.

The ideal candidate shall satisfy the following requirements:

Have a Master degree or equivalent (or is close to complete one) in computer science, mathematics, or related fields

Is fluent in English and has excellent communication and writing skills

Is familiar with probability theory and mathematical proofs. Strong background in cryptography, linear algebra, number theory, or complexity theory is a plus

Most importantly, is passionate about learning new concepts and determined to solve challenging questions in the theory of cryptography and computer security

Publications (or manuscripts under submission) in related areas are greatly valued but are not mandatory

The MPI for Security and Privacy is co-located with the Ruhr University of Bochum (Germany) and offers a vibrant atmosphere for research that spans across all aspects of computer security. The Ph.D. program is entirely in English and the knowledge of German is not required for a successful career at MPI.

The position is fully funded (100%) and paid according to the E-13 pay category. The starting date if flexible but ideally somewhere in fall 2020. To apply for the position, send an email to Giulio Malavolta (address below) including the following documents:

A curriculum vitae

2-3 recommendation letters from previous advisors or employers

A brief cover letter (half page at most) describing your research interests

If you have any question, don’t hesitate to get in touch.

Closing date for applications:

Contact: Giulio Malavolta (giulio.malavolta@berkeley.edu)

More information: https://www.mpi-sp.org/

Your responsibilities:

• Identifying weaknesses in existing 3GPP radio access network technologies including 4G and 5G (NR). • Develop and promote proposals to mitigate the security/privacy issues identified. • Cooperate with universities and other eco-system partners on security research and analysis • Help shape the industry with new innovation via standardization bodies e.g. 3GPP, ETSI, etc. • Engage with customers and regulators in order to help shape a secure ICT world. • Work with the world leading researchers across the world on the most advanced technologies including AI, IoT under the scope of 5G. • Help steer our 5G products and solutions security. • Provide analysis and insight of industry trends. • Generate product security roadmap recommendations.

Our requirements:

• PhD in computer science or advanced PhD with focus on telecommunication security (preferably radio access technologies, the 3GPP air-interface protocol stack). • Several years of experience in network security research, specifically in the domains of protocol analysis, vulnerability detection, protocol correctness, protocol verification, etc. • Several years of experience researching and developing tools/demos/PoCs which demonstrate the impact of such security issues (vulnerabilities) on the network. • Several years of experience researching and implementing mitigation solutions (PoC/Demo level) for protocol vulnerabilities including algorithms development, performance/cost and impact analysis of algorithms implementation. • Openness to work in a diversified work environment with unique work cultures. • Experience in presenting technical information to both technical and non-technical audience. • Fluent in English (written and spoken).

Must be eligible to work in the EU to be considered for this position.

By applying to this position, you agree with our PRIVACY STATEMENT. You can read in full our privacy policy via the link below.

https://career.huawei.com/reccampportal/portal5/grcprivacy.html

For further information on the requirements please click on the link below:

https://apply.worka

Closing date for applications:

Contact: Viet-Duc Benedikt Lai duc.lai.ext@huawei.com

More information: https://apply.workable.com/j/64698ECA7B

Work Sub-area:

Lightweight Cryptography including authentication protocols

Secure boot mechanisms for embedded/IoT devices

Funding Agency: Ministry of Communication and Information Technology

Tentative Duration: Upto:31/03/2021

Qualifications: B. Tech. (with GATE qualification) / MSc. (with NET/SET qualification) / M.C.A. (with GATE* qualification) 1st class or equivalent in the appropriate discipline.

Desirables: Basic knowledge of cryptography or some experience with using RFID tags or experience on some Raspberry based project or using Trusted Platform Modules (TPMs)

Note: The requirement of qualifying NET/SET/GATE qualification may be relaxed by the Committee in case of highly meritorious candidates.

Closing date for applications:

Contact:
Dr. Dhiman Saha,
Department of Electrical Engineering and Computer Science,
Indian Institute of Technology Bhilai.
email: dhiman [at] iitbhilai [dot] ac [dot] in

For more info about the research group and other opportunities visit: http://de.ci.phe.red

More information: http://ird.iitd.ac.in/sites/default/files/jobs/project/IITD-IRD-100-2020.pdf

Despite the fundamental importance of delay functions, repeated squaring in RSA groups (Rivest, Shamir and Wagner '96) is the only candidate offering both a useful structure and a realistic level of practicality. Somewhat unsatisfyingly, its sequentiality is provided directly by assumption (i.e., the function is assumed to be a delay function).

We prove sharp thresholds on the sequentiality of all generic-ring delay functions relative to an RSA modulus based on the hardness of factoring in the standard model. In particular, we show that generically speeding-up repeated squaring (even with a preprocessing stage and any polynomial number parallel processors) is equivalent to factoring.

More generally, based on the (essential) hardness of factoring, we prove that any generic-ring function is in fact a delay function, admitting a sharp sequentiality threshold that is determined by our notion of sequentiality depth. Moreover, we show that generic-ring functions admit not only sharp sequentiality thresholds, but also sharp pseudorandomness thresholds.

Due to its simplicity, succinctness, and performance, Groth16 is currently the most widely deployed succinct (zero-knowledge) argument of knowledge (SNARK) system. Groth16 is known to be perfectly zero-knowledge and knowledge sound in the generic (and algebraic) group model. However, the existing security arguments for Groth16 are silent about the soundness of the proof system in the presence of simulated proofs --- a common requirement for both the composable security and game-hopping style security analysis of protocols built using such argument systems. This important gap let to a line of work on simulation-extractable, also called simulation knowledge sound, succinct proof systems. Groth16 itself cannot satisfy the strongest notion of simulation-extractability that implies proof non-malleability --- in fact, proofs are perfectly randomizable. Surprisingly, in this short note we show that Groth16 does satisfy a weaker notion of simulation-extractability implying statement non-malleability. This property is often sufficient for typical applications that motivate the use of strong simulation-extractability. Notably, one can obtain UC security using efficient compilers.

A novel Nakamoto-like consensus was proposed by Tang et al. (ACISP 2019) to speed up the convergence (block finality) rate by determining a weight of a block in the blockchain by a tunable potential function of the block hash. However, the convergence of the scheme was evaluated only in an experimental way and a sudden utilization of another blockchain was not clearly explained. This article asymptotically analyses the convergence of Nakamoto-like consensus of Tang et al. by proposing a general framework for formalizing consensus schemes comprising both the classical Nakamoto consensus (bitcoin consensus) and the consensus of Tang et al. The framework contains two categories of schemes, namely, small-step consensus like the bitcoin consensus and giant-step consensus of Tang et al. Furthermore, the essence of the second chain, the even-trigger, is shown to be a necessity of realizing giant-step consensus.

We revisit the definition of efficient algorithms and argue, that the standard runtime classes, strict probabilistic polynomial time (PPT) and expected probabilistic polynomial time (EPT) are “unnatural” from a cryptographic perspective. They are not closed under indistinguishability. Applied to EPT, this suggests computationally expected polynomial time (CEPT), the class of runtimes which are (computationally) indistinguishable from EPT. We analyse the behaviour of CEPT for zero-knowledge proofs and designated adversaries in the setting of uniform complexity (following Goldreich (JC’93)). A designated adversary is (only) efficient in the protocol it is designed to attack. This security notion, first proposed in Feige’s thesis [Fei90], is very natural, but there are obstructions to achieving it. Prior work on handling (designated) EPT adversaries by Katz and Lindell (TCC’05) requires superpolynomial hardness assumptions, whereas the work of Goldreich (TCC’07) requires “nice” adversarial behaviour under rewinding. We provide easy-to-check criteria for zero-knowledge protocols with black-box simulation in the plain model, which show that many (all known?) such protocols handle designated CEPT adversaries in CEPT.

In this report, we analyze the security of the trust establishment protocol used in the Olvid messaging protocol. The latter relies on the PV-SAS-MCA message cross-authentication protocol by Pasini an Vaudenay based on short authenticated strings (SAS). In order to make the implementation portable across different platforms, Olvid proposed particular instantiations of the underlying primitives used in PV-SAS-MCA in addition to some other minor modifications. Here, we show that these changes have no impact on the security of the scheme. More precisely, we formally prove that the trust establishment protocol used in Olvid is a secure message cross-authentication protocol. The proof of security is in the random-oracle model and relies on the security of the underlying pseudorandom generator. It also assumes users know each other and have an authentic channel between them.

Data-oblivious algorithms are a key component of many secure computation protocols.

In this work, we show that advances in secure multiparty shuffling algorithms can be used to increase the efficiency of several key cryptographic tools.

The key observation is that many secure computation protocols rely heavily on secure shuffles. The best data-oblivious shuffling algorithms require $O(n \log n)$, operations, but in the two-party or multiparty setting, secure shuffling can be achieved with only $O(n)$ communication.

Leveraging the efficiency of secure multiparty shuffling, we give novel algorithms that improve the efficiency of securely sorting sparse lists, secure stable compaction, and securely merging two sorted lists.

Securely sorting private lists is a key component of many larger secure computation protocols. The best data-oblivious sorting algorithms for sorting a list of $n$ elements require $O(n \log n)$ comparisons. Using black-box access to a linear-communication secure shuffle, we give a secure algorithm for sorting a list of length $n$ with $t \ll n$ nonzero elements with communication $O(t \log^2 n + n)$, which beats the best oblivious algorithms when the number of nonzero elements, $t$, satisfies $t < n/\log^2 n$.

Secure compaction is the problem of removing dummy elements from a list, and is essentially equivalent to sorting on 1-bit keys. The best oblivious compaction algorithms run in $O(n)$-time, but they are unstable, i.e., the order of the remaining elements is not preserved. Using black-box access to a linear-communication secure shuffle, we give a stable compaction algorithm with only $O(n)$ communication.

Our main result is a novel secure merge protocol. The best previous algorithms for securely merging two sorted lists into a sorted whole required $O(n \log n)$ secure operations. Using black-box access to an $O(n)$-communication secure shuffle, we give the first secure merge algorithm that requires only $O(n \log \log n)$ communication. Our algorithm takes as input $n$ secret-shared values, and outputs a secret-sharing of the sorted list.

All our algorithms are generic, i.e., they can be implemented using generic secure computations techniques and make black-box access to a secure shuffle.

Our techniques extend naturally to the multiparty situation (with a constant number of parties) as well as to handle malicious adversaries without changing the asymptotic efficiency.

These algorithm have applications to securely computing database joins and order statistics on private data as well as multiparty Oblivious RAM protocols.

As a popular paradigm, crowd-sensing network emerges to achieve sensory data collection and task allocation to mobile users. On one hand these sensory data could be private and sensitive, and on the other hand, data transmission separately could incur heavy communication overhead. Fortunately, the technique of homomorphic encryption (HE) allows the addictive and/or multiplicative operations over the encrypted data as well as privacy protection. Therefore, several data aggregation schemes based on HE are proposed for crowd-sensing network. However, most of the existing schemes do not support ciphertext comparison efficiently, thus data center cannot process ciphertexts with flexibility. To address this challenge, we propose a comparable homomorphic encryption (CompHE) scheme based on Lagrange’s interpolation theorem, which enables ciphertext comparison between multiple users in crowdsensing network. Based on the Partial Discrete Logarithm and Decisional Diffie-Hellman assumption, the proposed CompHE scheme is provably secure in the random oracle model. Performance analysis confirms that the proposed scheme have improved the computational efficiency compared with existing schemes.

FPGAs offer many-fold acceleration to various application domains, and have become a part of cloud-based computation. However, their cloud-use introduce Cloud Service Provider (CSP) as trusted parties, who can access the hardware designs in plaintext. Therefore, the intellectual property of hardware designers is not protected against a dishonest cloud. In this paper, we propose a scheme for the confidentiality of accelerators on cloud, without limiting CSP to maintain their resources freely. Our proposed scheme is based on Proxy Re-Encryption which allows the developers to upload their accelerators to the CSPs under encryption. The CSPs cannot decrypt them; however, alter the encryption that allows the target FPGAs they pick to decrypt. In addition, our scheme allows metering the use of accelerators.

Low energy consumption is an important factor in today's technologies as many devices run on a battery and there are new applications which require long runtimes with very small batteries. As many of these devices are connected to some kind of network, they require encryption/decryption to securely transmit data. Hence, the energy consumption of the cipher is an important factor for the battery life. We evaluate the energy consumption of lightweight ciphers implemented on a custom 65nm ASIC. Since the energies to measure are very small, we first introduce, compare and evaluate two techniques to precisely measure the energy consumption of a real cryptographic core. In our comparative investigations, using the PRINCE block cipher we examine the effect of the design architecture (round-based versus unrolled) on the amount of energy consumption. In addition to considering other effects (like fixed key versus random key), we compare round-based implementations of different block ciphers (PRINCE, MIDORI and SKINNY) under similar settings providing first such practical investigations.