IACR News
Here you can see all recent updates to the IACR webpage. These updates are also available:
12 July 2020
Daniel Kales, Greg Zaverucha
We apply the attack to MQDSS, a post-quantum signature scheme relying on the hardness of the MQ-problem. Concretely, forging a signature for the L1 instance of MQDSS, which should provide 128 bits of security, can be done in $\approx 2^{95}$ operations. We verify the validity of the attack by implementing it for round-reduced versions of MQDSS, and the designers have revised their parameter choices accordingly.
We also survey other post-quantum signature algorithms and find the attack succeeds against PKP-DSS (a signature scheme based on the hardness of the permuted kernel problem) and list other schemes that may be affected. Finally, we use our analysis to choose parameters and investigate the performance of a 5-round variant of the Picnic scheme.
Fabio Campos, Lars Jellema, Mauk Lemmen, Lars Müller, Daan Sprenkels, Benoit Viguier
Congwei Zhou, Bin Hu, Jie Guan
10 July 2020
Universitat Politècnica de Catalunya, Department of Network Engineering (Spain, Barcelona)
The SISCOM Research Group (https://siscom.upc.edu/en) within the Department of Network Engineering (https://entel.upc.edu/en) at the Universitat Politècnica de Catalunya (UPC) (https://www.upc.edu/en/) welcomes and encourages applications for a PhD position in the area of database privacy to start in fall 2020.
DESCRIPTION OF POSITIONThe PhD position has a duration of 3 years and is made available through the research project “Big Data Anonymization” funded by “la Caixa”, a top Spanish financial institution. The main objectives of this project are to pioneer advance beyond state of the art on the design of anonymization algorithms and to develop a comprehensive understanding of privacy in a context of big data. The ultimate aim is to contribute to making big data compatible with the right to privacy. For the scholarship, we are looking for a candidate who is qualified to undertake supervised independent research in the area of database anonymization, in particular in the protection of dynamic data under popular syntactic models (e.g., l-diversity, t-closeness) and differential privacy.
QUALIFICATIONSWe seek a highly motivated PhD student
- who has completed or is about to complete by summer 2020 a Master's degree in mathematics, computer science, or telecom engineering;
- with excellent academic record;
- good analytical skills;
- strong oral and written communication skills.
Candidates should send to Prof. Jordi Forné (jordi.forne@upc.edu) the following information:
- their CV (including list of publications, if any);
- their academic record (with marks);
- a certificate of English (TOEFL, Cambridge or similar).
September 15, 2020.
Closing date for applications:
Contact: Prof. Jordi Forné
08 July 2020
Orlando, USA, 9 November 2020
Submission deadline: 23 July 2020
Notification: 26 August 2020
Villanova University, Department of Electrical and Computer Engineering
2. Research area. Post quantum cryptography hardware implementation, fault detection/attack, and hardware security.
3. Qualification. Preferred to have research experience in the areas of cryptographic engineering, fault detection, hardware security, and VLSI design. Students from electrical/computer engineering, computer science, and cryptography (applied mathematics) or other related majors are WARMLY welcome! Programming skills such as HDL, C++ will be more favorable.
NOTE: because of the time urgency, it's better that you are currently in U.S.
4. Application process. Interested students can directly send the CV/resume to Dr. Jiafeng Harvest Xie's email: jiafeng.xie@villanova.edu.
5. Application information. The detailed application requirement is available at the department website.
6. Additional information. Villanova University is a private research university located in Radnor Township, a suburb northwest of Philadelphia, Pennsylvania. U.S. News & World Report ranks Villanova as tied for the 46th best National University in the U.S. for 2020.
7. PI introduction. Dr. Jiafeng Harvest Xie is currently an Assistant Professor at the Department of Electrical and Computer Engineering of Villanova University. His research interests include cryptographic engineering, hardware security, and VLSI digital design. He is the Best Paper Awardee of IEEE HOST 2019. He is also the Associate Editor for Microelectronics Journal, IEEE Access, and IEEE Trans. Circuits and Systems II.
Contact: Dr. Jiafeng Harvest Xie, email: jiafeng.xie@villanova.edu
Closing date for applications:
Contact: Dr. Jiafeng Harvest Xie, email: jiafeng.xie@villanova.edu
More information: https://www1.villanova.edu/villanova/engineering/departments/ece/facultyStaff/biodetail.html?mail=jiafeng.xie@villanova.
07 July 2020
Eunsang Lee, Joon-Woo Lee, Jong-Seon No, Young-Sik Kim
Florian Unterstein, Tolga Sel, Thomas Zeschg, Nisha Jacob, Michael Tempelmeier, Michael Pehl, Fabrizio De Santis
Susumu Kiyoshima
Michele Ciampi, Roberto Parisella, Daniele Venturi
- We exhibit a generic compiler taking any delayed-input Sigma protocol and returning a delayed-input Sigma protocol satisfying adaptive-input special honest-verifier zero-knowledge (SHVZK). In case the initial Sigma protocol also satisfies adaptive-input special soundness, our compiler preserves this property. - We revisit the recent paradigm by Canetti et al. (STOC 2019) for obtaining NIZK proof systems in the CRS model via the Fiat-Shamir transform applied to so-called trapdoor Sigma protocols, in the context of adaptive security. In particular, assuming correlation-intractable hash functions for all sparse relations, we prove that Fiat- Shamir NIZKs satisfy either: (i) Adaptive soundness (and non-adaptive zero-knowledge), so long as the challenge is obtained by hashing both the provers first round and the instance being proven; (ii) Adaptive zero-knowledge (and non-adaptive soundness), so long as the challenge is obtained by hashing only the provers first round, and further assuming that the initial trapdoor Sigma protocol satisfies adaptive-input SHVZK. - We exhibit a generic compiler taking any Sigma protocol and returning a trapdoor Sigma protocol. Unfortunately, this transform does not preserve the delayed-input property of the initial Sigma protocol (if any). To complement this result, we also give yet another compiler taking any delayed-input trapdoor Sigma protocol and returning a delayed-input trapdoor Sigma protocol with adaptive-input SHVZK.
An attractive feature of our first two compilers is that they allow obtaining efficient delayed-input Sigma protocols with adaptive security, and efficient Fiat-Shamir NIZKs with adaptive soundness (and non-adaptive zero-knowledge) in the CRS model. Prior to our work, the latter was only possible using generic NP reductions.
Arnold G. Reinhold
Aude Le Gluher, Pierre-Jean Spaenlehauer, Emmanuel Thomé
Ashoka SB, Lakshmikanth D
Daniel Adkins, Archita Agarwal, Seny Kamara, Tarik Moataz
Xuan Thanh Do, Duong Hieu Phan, Moti Yung
We first present an AnoBEB construction for up to $k$ users from LWE assumption, where $k$ is bounded by the scheme security parameter. The scheme does not grow with the parameter and beat the PKE method. Actually, our scheme is as efficient as the underlying LWE public-key encryption; namely, the rate is, in fact, $1$ and thus optimal. The scheme is achieved easily by an observation about an earlier scheme with a different purpose.
More interestingly, we move on to employ the new AnoBEB in other multimedia broadcasting methods and, as a second contribution, we introduce a new approach to construct an efficient ``Trace and Revoke scheme'' which combines the functionalites of revocation and of tracing people (called traitors) who in a broadcasting schemes share their keys with the adversary which, in turn, generates a pirate receiver. Note that, as was put forth by Kiayias and Yung (EUROCRYPT '02), combinatorial traitor tracing schemes can be constructed by combining a system for small universe, integrated via an outer traceability codes (collusion-secure code or identifying parent property (IPP) code). There were many efficient traitor tracing schemes from traceability codes, but no known scheme supports revocation as well. Our new approach integrates our AnoBEB system with a Robust IPP code, introduced by Barg and Kabatiansky (IEEE IT '13). This shows an interesting use for robust IPP in cryptography. The robust IPP codes were only implicitly shown by an existence proof. In order to make our technique concrete, we propose two explicit instantiations of robust IPP codes. Our final construction gives the most efficient trace and revoke scheme in the bounded collusion model.
Jiayu Qiang, Yi Deng
Fynn Dallmeier, Jan P. Drees, Kai Gellert, Tobias Handirk, Tibor Jager, Jonas Klauke, Simon Nachtigall, Timo Renzelmann, Rudi Wolf
Such protocols meet the demand for communication with minimal latency, but those currently deployed in practice achieve only rather weak security properties, as they may not achieve forward security for the first transmitted payload message and require additional countermeasures against replay attacks.
Recently, 0-RTT protocols with full forward security and replay resilience have been proposed in the academic literature. These are based on puncturable encryption, which uses rather heavy building blocks, such as cryptographic pairings. Some constructions were claimed to have practical efficiency, but it is unclear how they compare concretely to protocols deployed in practice, and we currently do not have any benchmark results that new protocols can be compared with.
We provide the first concrete performance analysis of a modern 0-RTT protocol with full forward security, by integrating the Bloom Filter Encryption scheme of Derler et al. (EUROCRYPT 2018) in the Chromium QUIC implementation and comparing it to Google's original QUIC protocol.
We find that for reasonable deployment parameters, the server CPU load increases approximately by a factor of eight and the memory consumption on the server increases significantly, but stays below 400 MB even for medium-scale deployments that handle up to 50K connections per day. The difference of the size of handshake messages is small enough that transmission time on the network is identical, and therefore not significant.
We conclude that while current 0-RTT protocols with full forward security come with significant computational overhead, their use in practice is not infeasible, and may be used in applications where the increased CPU and memory load can be tolerated in exchange for full forward security and replay resilience on the cryptographic protocol level. Our results also serve as a first benchmark that can be used to assess the efficiency of 0-RTT protocols potentially developed in the future.
Jacqueline Brendel, Cas Cremers, Dennis Jackson, Mang Zhao
Remarkably, no detailed proofs have ever been given for these security properties for EdDSA, and in particular its Ed25519 instantiations. Ed25519 is one of the most efficient and widely used signature schemes, and different instantiations of Ed25519 are used in protocols such as TLS 1.3, SSH, Tor, ZCash, and WhatsApp/Signal. The differences between these instantiations are subtle, and only supported by informal arguments, with many works assuming results can be directly transferred from Schnorr signatures. Similarly, several proofs of protocol security simply assume that Ed25519 satisfies properties such as EUF-CMA or SUF-CMA.
In this work we provide the first detailed analysis and security proofs of Ed25519 signature schemes. While the design of the schemes follows the well-established Fiat-Shamir paradigm, which should guarantee existential unforgeability, there are many side cases and encoding details that complicate the proofs, and all other security properties needed to be proven independently.
Our work provides scientific rationale for choosing among several Ed25519 variants and understanding their properties, fills a much needed proof gap in modern protocol proofs that use these signatures, and supports further standardisation efforts.