International Association
for Cryptologic Research

The hybrid argument is a fundamental and well-established proof technique of modern cryptography for showing the indistinguishability of distributions. As such, its details are often glossed over and phrases along the line of "this can be proven via a standard hybrid argument" are common in the cryptographic literature. Yet, the hybrid argument is not always as straightforward as we make it out to be, but instead comes with its share of intricacies. For example, a commonly stated variant says that if one has a sequence of hybrids $H_0,...,H_t$, and each pair $H_i$, $H_{i+1}$ is computationally indistinguishable, then so are the extreme hybrids $H_0$ and $H_t$. We iterate the fact that, in this form, the statement is only true for constant $t$, and we translate the common approach for general $t$ into a rigorous statement.

The paper here is not a research paper in the traditional sense. It mainly consists of an excerpt from the book "The Theory of Hash Functions and Random Oracles - An Approach to Modern Cryptography" (Information Security and Cryptography, Springer, 2021), providing a detailed discussion of the intricacies of the hybrid argument that we believe is of interest to the broader cryptographic community. The excerpt is reproduced with permission of Springer.

In this paper, we present ZEN, a toolchain for producing efficient zero-knowledge proof systems of privacy-preserving verifiable neural network models. Taking an existing neural network as an input, ZEN produces a verifiable computation scheme for a classification task or a recognition task, namely ZEN$_{class}$ and ZEN$_{rec}$. Both ZEN$_{class}$ and ZEN$_{rec}$ ensure the privacy, more precisely, the zero-knowledge property of the input data. In practice, this means removing the personal identifications, such as the facial image or other biometric data, from the attack surface. And thanks to three decades’ consecutive efforts on zkSNARK from our community, the entire process is non-interactive and verifiable. Thus, our schemes potentially enable many important applications, ranging from trustless oracles for decentralized ledgers to privacy-preserving facial identification systems. To our best knowledge, ZEN is the first zero-knowledge neural network scheme that preserves the privacy of input data while delivering verifiable outputs. To build efficient schemes with no additional accuracy loss, ZEN includes two major technical contributions. First, we propose a zkSNARK friendly quantization approach, which is semantically equivalent to the state-of-the-art quantization algorithm, yet brings significant savings in constraint size. Second, we propose a novel encoding scheme, namely stranded encoding, that encodes batched dot products, the workhorse of many matrix operations, using only a fraction of finite field elements. This brings sizable savings in terms of the number of constraints for the matrix operation circuits. Our end-to-end evaluation demonstrates the effectiveness of ZEN: compared with simply combining the state-of-the-art full quantization scheme with zkSNARK (ZEN-vanilla), ZEN has $3.68 \sim 20.99 \times$ ($14.14 \times$ on average) savings in the number of constraints (as a result, in prover time as well) thanks to our zkSNARK friendly quantization and stranded encoding.

Proof of Elapsed Time (PoET) is a Nakamoto-style consensus algorithm where proof of work is replaced by a wait time randomly generated by a trusted execution environment (TEE). PoET was originally developed by Intel engineers and contributed to Hyperledger Sawtooth, but has never been formally defined or analyzed. In particular, PoET enables consensus on a bitcoin-like scale without having to resort to mining. Proof of Luck (PoL), designed by Milutinovic et. al., is a similar (but not identical) protocol that also builds a Nakamoto-style consensus algorithm using a TEE. Like PoET, it also lacks a formal proof.

In this work, we formally define a simplified version of PoET and Proof of Luck, which we call elapsed time (ET) consensus with a trusted timer. We prove the security of our ET consensus protocol with a trusted gimer given an honest majority assumption in a model very similar to the bitcoin backbone model proposed by Garay et al. which we call the elapsed time backbone model. Our model and protocol aims to capture the essence of PoeT and PoL while ignoring some of the more practical difficulties associated with such protocols, such as bootstrapping and setting up the TEE.

The PoET protocol also contains a function called the $z$-test that limits the number of blocks a player can publish in any particular larger set of blocks. Surprisingly, by improving this $z$-test a little bit we can prove the security of our ET consensus protocol without any TEEs with a (slightly stronger) honest majority assumption. This implies that Nakamoto-style consensus with rate limiting and no proofs of work can be used to obtained scalable consensus in a permissioned setting: in other words, ``bitcoin without proofs of work'' can be made secure without a TEE for private blockchains!

In this paper, we present the complete analysis of Huff curves for implementing isogeny-based cryptography. In this regard, we first investigate the computational cost of the building-blocks when compression functions are used for Huff curves and presented an additional formula on Huff curves for implementing isogeny-based cryptography. From our implementation, the performance of Huff-SIDH and Montgomery-SIDH is almost the same, and Huff-CSIDH is 6.4\% faster than Montgomery-CSIDH but 4\% slower than Hybrid-CSIDH. The result of our work shows that the Huff curve can be quite practical for implementing isogeny-based cryptography but has some limitations.

In this paper, we present two new perturbations for the design of multivariate schemes that we call ``Ariadne Thread'' and ``Salt''. From these ideas, we present some efficient multivariate encryption and signature schemes with explicit parameters that resist all known attacks. In particular they resist the two main (and often very powerful) attacks in this area: the Gröbner attacks (to compute a cleartext from a ciphertext) and the MinRank attacks (to recover the secret key). Ariadne Threat and Salt can also be seen as new ``perturbations'' that we can use to enforce many multivariate schemes. The ``Salt'' perturbation works only for public key equations of degree (at least) 3. Similarly at present the ``Ariadne Thread'' perturbation seems to be particularly powerful with public keys of degree 3. Despite this, the size of the public key may still be reasonable since we can use larger fields (and also maybe non dense equations). Ariadne Thread perturbation seems to be particularly interesting for encryption. This is unusual since in multivariate cryptography encryption is generally more difficult than signatures.

In this paper, we computationally analyze Passkey Entry in its entirety as a cryptographic authenticated key exchange (AKE) - including user-protocol interactions that are typically ignored as out-of-band. To achieve this, we model the user-to-device channels, as well as the typical device-to-device channel, and adversarial control scenarios in both cases. In particular, we separately capture adversarial control of device displays on the initiating and responding devices as well as adversarial control of user input mechanisms using what we call a CYBORG model. The CYBORG model enables realistic real-world security analysis in light of published attacks on user-mediated protocols such as Bluetooth that leverage malware and device displays. In light of this, we show that all versions of Passkey Entry fail to provide security in our model. Finally, we demonstrate how slight modications to the protocol would allow it to achieve stronger security guarantees for all current variants of passkey generation, as well as a newly proposed twofold mode of generation we term Dual Passkey Entry. These proof-of-concept modications point to improved design approaches for user-mediated protocols. Finally, this work points to categories of vulnerabilities, based on compromise type, that could be exploited in Bluetooth Passkey Entry.

Secure Multiparty Computation involves a protocol between parties with an aim to produce a computed result just as a Trust Party would produce if the parties provided their inputs to it. The Trusted party in conventional computation is replaced by "un-trusted" parties in Secure Multiparty Computation. We first show that this existing Binary definition of Trust is inadequate. Real world is rife with disparities, that which produce a perceivable trust gradient between the participants. Conventional MPC models do not take this into account and rather provide security guarantees based on the threshold of corrupted parties. The thresholds are supposed to cover for some of the parties turning out to be corrupt. Often, with the knowledge of \emph{prior probability} of a party being corrupt, we can do better if we allot weight to each party based on how trusted we perceive it to be. Our paper explores this idea and our contributions towards it are two folds. First, we introduce the Graded Trust model where each party essentially has a \emph{Trust Grade} assigned to it in the protocol based on the prior of it being corrupt. Then, we present a discussion on the philosophy behind graded trust, and the potential benefits for large scale public MPC systems.

The concept of private stream aggregation (PSA) has been proposed by Shi et al. (NDSS 2011) to allow for data analysis in a privacy-preserving manner. In this work, we introduce the notion of labeled secret sharing (LaSS) schemes and show how to use it to construct PSA schemes. We also show how to realize LaSS using pseudorandom functions or alternatively with a hash function modeled as a random oracle and how it can be used to construct PSA schemes. Additionally, we revisit the security model of Becker et al. (NDSS 2018) and describe stronger security notions for PSA. We then present additional constructions achieving the stronger security notions by relying on recent results on multi-client functional encryption. For all of our constructions, we present implementations to show their practicality and the performance gains over existing solutions.

We are looking for an assistant/associate professor to extend and complement the cryptology research and teaching of the Cyber Security Section at DTU Compute. The position is available from August 1 2021 or according to mutual agreement.

Closing date for applications:

Contact: Professor Lars Ramkilde Knudsen, lrkn@dtu.dk. Please use the above link when applying for the position. Applications sent by email will not be considered.

More information: https://www.dtu.dk/english/about/job-and-career/vacant-positions/job?id=dd355396-a1f7-4960-8e94-af0f50a374dc

Event date: 23 January 2021

Ph.D. positions are available in the Cryptology and Data Security research group at the Institute of Computer Science, University of Bern, led by Christian Cachin.

Our research addresses all aspects of security in distributed systems, especially cryptographic protocols, consistency, consensus, and cloud-computing security. We are particularly interested in blockchains, distributed ledger technology, cryptocurrencies, and their security and economics.

Candidates should have a strong background in computer science. They should like conceptual, rigorous thinking for working theoretically, or be interested in building innovative systems for working practically. Demonstrated expertise in cryptography, distributed computing, or blockchain technology is a plus. Applicants must hold a master degree in the relevant research fields.

Positions are available immediately and come with a competitive salary. The selection process runs until suitable candidates have been found. The University of Bern conducts excellent research and lives up its vision that “Knowledge generates value”. The city of Bern lies in the center of Switzerland and offers some of the highest quality of life worldwide.

If you are interested, please apply be sending email with one single PDF file and subject line set to Application for Ph.D., addressed directly to Prof. Christian Cachin at crypto (at) inf.unibe.ch.

Since we receive many applications, we encourage you to include material that demonstrates your interests and strengths and sets you apart from others.

For more information, please contact Christian Cachin (https://crypto.unibe.ch/cc/).

Closing date for applications:

Contact: Christian Cachin < crypto (at) inf.unibe.ch >

More information: https://crypto.unibe.ch/

Join the vibrant security and applied crypto research group in Brno, Czechia! Join the research team that won the 2016 USENIX Security Symposium Best Paper Award, 2017 ACM CCS Real-World Impact Award, or 2020 CHES Best Paper Award. The team that helped hundreds of graduates in the security Master programs, has been involved in both fundamental and applied crypto/security/privacy research projects and industry partnerships.

The Dean of the Faculty of Informatics, Masaryk University, invites applications for one position of Assistant Professor in Cybersecurity, with the Department of Computer Systems and Communications.

Applications due: February 28, 2021
Employment start date: By mutual agreement

This position is aimed to strengthen the work of the Centre for Research on Cryptography and Security (CRoCS - https://crocs.fi.muni.cz/) at the Faculty of Informatics. CRoCS works to improve security and privacy of real-world solutions through applied research (often in cooperation with industry) and advanced education of future security professionals. System security or network security focus are most desired, yet the abilities to work with a team of graduate students and faculty on research targeting top security/crypto conferences and to engage both undergraduate and graduate students in both educational and research exercises are most critical.

Job description keypoints:

• Active international cooperation, in both research and education.
• Involvement in teaching in the cybersecurity area.
• Supervision of Master/Bachelor theses and consultancy or co-supervision of PhDs.
• Involvement in expanding industrial cooperation in the cybersecurity area.
• Expert knowledge in at least one of the areas covered by courses:
  • PV181 Laboratory of security and applied cryptography {https://is.muni.cz/course/fi/podzim2019/PV181};
  • PA193 Secure coding principles and practices {https://is.muni.cz/course/fi/podzim2019/PA193}.
  • PA197 Secure Network Design {https://is.muni.cz/course/fi/jaro2020/PA197}.

Closing date for applications:

Contact: Vashek Matyas

More information: https://www.muni.cz/en/about-us/careers/vacancies/59434

The AWS Cryptography Group is looking for an Applied Scientist with knowledge of cryptographic computing technologies such as privacy preserving machine learning, fully and partially homomorphic encryption, secure multiparty computation, private information retrieval, and related technologies. You will use this knowledge to conceptualize how this technology can be integrated into internal infrastructure and public AWS services, develop prototypes, and provide customers with world-class security. The ideal candidate will have a strong understanding of cryptography, the ability to prototype solutions, and a passion to realize these technologies in AWS products and services. We encourage research and publication of results that apply to our customers most complex initiatives.

We are seeking a candidates who are innovative, look for new ideas everywhere, and are not limited by “not invented here”. They should think big, and have bold ideas for new ways to serve customers.

BASIC QUALIFICATIONS

• PhD in Computer Science or a closely related field
• Expert knowledge of cryptography and, in particular, cryptographic-computing techniques (homomorphic encryption, secure multiparty computation, etc.)
• Practical knowledge in one or more common development languages (C/C++, Java, Go, Rust, Python, etc.)
• Good written and verbal communication skills.

PREFERRED QUALIFICATIONS

• Basic knowledge of machine learning
• 5+ years of industry experience

Amazon is committed to a diverse and inclusive workplace. Amazon is an equal opportunity employer and does not discriminate on the basis of race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or other legally protected status. For individuals with disabilities who would like to request an accommodation, please visit https://www.amazon.jobs/en/disability/us.

Closing date for applications:

Contact: Bill Horne

More information: https://amazon.jobs/en/internal/jobs/1397391/applied-cryptographer

Our Statistics and Privacy team focuses on establishing step-change improvements to advance our long-term business growth. The team's expertise spans many domains including statistics, machine learning and cryptography. We develop methodologies, design and prototype solutions, and partner with our engineering colleagues to launch these solutions such that millions of advertisers can benefit. Examples include internal and external experimentation platforms, ads delivery optimization for efficient causal outcomes, and the application of privacy enhancing technologies across our ads product stack.

We are looking for research interns to join our teams to drive forward new prototypes and methodologies. Interns will pursue novel applied research associated with privacy preserving machine learning, cryptography and internet technology, or causal inference and experimentation platforms. This work is critical to our long-term product development, and we expect interns to provide both scientific expertise and creative solutions to accelerate their project area.

Responsibilities

Assess potential opportunities and execute world-class research associated with your area of scientific expertise

Write high quality academic papers to advocate the research and innovations

Establish approaches to rigorously assess relative performance of new technologies or strategies

Learn new tools, systems and languages quickly as required by the particular project you are working on

Apply communication skills to engage diverse audiences on technical topics and nuanced insights

Minimum Qualifications

Currently has, or is in the process of obtaining, a PhD degree in statistics, computer science, electrical engineering, physics, quantitative social science, or a related quantitative field

Expertise in one of the following areas: privacy preserving machine learning, cryptography and internet technology, or causal inference and experimentation platforms

continued on application webpage, see https://www.facebook.com/careers/v2/jobs/270789727484557/

Closing date for applications:

Contact: Apply Online or reach out to Benjamin Case (bmcase {at} fb DOT com) or Sanjay Saravanan

More information: https://www.facebook.com/careers/v2/jobs/270789727484557/

The Institute of Applied Information Processing and Communications (aka IAIK) is the largest university institute in Austria for research and education in security and privacy. It has been active in this field for more than 30 years and currently employs more than 60 researchers. Within the "Secure Systems" area of our institute Sujoy Sinha Roy is establishing the new research group "Cryptographic Engineering”.

In order to complement our team, we are looking for a fulltime post-doctoral researcher:

Responsibilities:
The post-doctoral researcher will be working on the hardware acceleration of homomorphic encryption within the “Cyroptografic Engineering” group within the “Secure Systems” area at IAIK.

Required Qualifications:

A PhD (or close to completion) in computer science, information and computer engineering, software development, mathematics, or a related field.

Publications in top conferences, or submitted/accepted papers in top journals.

Experience with cryptography, programming, and digital circuit design (ASIC or FPGA) design

How to apply:
Applications, curriculum vitae and other documents should preferably be uploaded here https://free.formcloud.de/formcycle/form/provide/7780/. Please select 7050/postdoc_2021 as a reference number.

The position is full time - 40 h per week and the employment duration is set for 18 months. Prefered starting date early 2021. The application deadline is February 15th 2021.

Closing date for applications:

Contact: Sujoy Sinha Roy – sujoy.sinharoy@iaik.tugraz.at

Chosen ciphertext security for lattice based encryption schemes is generally achieved through a generic transformation such as the Fujisaki-Okamoto transformation. This method requires full re-encryption of the plaintext during decapsulation, which typically dominates the cost of the latter procedure. In this work we show that it is possible to develop alternative transformations specifically designed for lattice based encryption schemes. We propose two novel chosen ciphertext transformations, $\mathtt{ETC1}$ and $\mathtt{ETC2}$, in which re-encryption is replaced by checking the error term of the input ciphertext. We show that our new ciphertext validity check can be securely applied to lattice based encryption schemes under specific conditions. For the NIST post-quantum standardization candidate Threebears we show a speed-up for decapsulation of up to $37.4\%$. Moreover, as our method only changes the validation check during decapsulation, it is fully backwards compatible with existing implementations of the Fujisaki-Okamoto transformation.

In this paper, we present the first side-channel attack on a first-order masked implementation of IND-CCA secure Saber KEM. We show how to recover both the session key and the long-term secret key from 16 traces by deep learning-based power analysis without explicitly extracting the random mask at each execution. Since the presented method is not dependent on the mask, we can improve success probability by combining score vectors of multiple traces captured for the same ciphertext. This is an important advantage over previous attacks on LWE/LWR-based KEMs, which must rely on a single trace. Another advantage is that the presented method does not require a profiling device with deactivated countermeasure, or known secret key. Thus, if a device under attack is accessible, it can be used for profiling. This typically maximizes the classification accuracy of deep learning models. In addition, we discovered a leakage point in the primitive for masked logical shifting on arithmetic shares which has not been known before. We also present a new approach for secret key recovery, using maps from error-correcting codes. This approach can compensate for some errors in the recovered message.

We propose a smart contract that allows two mutually distrusting parties to transact any non-digital good or service on a blockchain. The contract acts as an escrow and settles disputes by letting parties wager that they can convince an arbiter they were the honest party. We analyze the contract as an extensive-form game and prove that the contract is secure in a strong game-theoretic sense if and only if the arbiter is biased in favor of honest parties. We show this is inherent to any contract that achieves game-theoretic security for interesting trades. We consider a generalization of the contract with different ways of paying back the wagers, and we can instantiate it to make a tradeoff between security and the size of the wager. By relaxing the security notion such that parties have only weak incentive to behave honestly, we can replace the arbiter by a random coin toss protocol. We implement the contract in Ethereum and estimate the amortized cost of running the contract as 2-3 USD for the seller and 4-5 USD for the buyer.

In a recent paper Géraud-Stewart and Naccache \cite{gsn2021} (GSN) described an non-interactive process allowing a prover $\mathcal P$ to convince a verifier $\mathcal V$ that a modulus $n$ is the product of two randomly generated primes ($p,q$) of about the same size. A heuristic argument conjectures that $\mathcal P$ cannot control $p,q$ to make $n$ easy to factor.

GSN's protocol relies upon elementary number-theoretic properties and can be implemented efficiently using very few operations. This contrasts with state-of-the-art zero-knowledge protocols for RSA modulus proper generation assessment.

This paper proposes an alternative process applicable in settings where $\mathcal P$ co-generates a modulus $n=p_1q_1p_2q_2$ with a certification authority $\mathcal V$. If $\mathcal P$ honestly cooperates with $\mathcal V$, then $\mathcal V$ will only learn the sub-products $n_1=p_1q_1$ and $n_2=p_2q_2$.

A heuristic argument conjectures that at least two of the factors of $n$ are beyond $\mathcal P$'s control. This makes $n$ appropriate for cryptographic use provided that \emph{at least one party} (of $\mathcal P$ and $\mathcal V$) is honest. This heuristic argument calls for further cryptanalysis.

Zero-knowledge (ZK) proofs with an optimal memory footprint have attracted a lot of attention, because such protocols can easily prove very large computation with a small memory requirement. Such ZK protocol only needs O(M) memory for both parties, where M is the memory required to verify the statement in the clear. In this paper, we propose several new ZK protocols in this setting, which improve the concrete efficiency and, at the same time, enable sublinear amortized communication for circuits with some notion of relaxed uniformity. 1. In the circuit-based model, where the computation is represented as a circuit over a field, our ZK protocol achieves a communication complexity of 1 field element per non-linear gate for any field size while keeping the computation very cheap. We implemented our protocol, which shows extremely high efficiency and affordability. Compared to the previous best-known implementation, we achieve 6×–7× improvement in computation and 3×– 7× improvement in communication. When running on intro-level AWS instances, our protocol only needs one US dollar to prove one trillion AND gates (or 2.5 US dollars for one trillion multiplication gates over a 61-bit field). 2. In the setting where part of the computation can be represented as a set of polynomials, we can achieve communication sublinear to the polynomial size: the communication only depends on the input size and the highest degree of all polynomials, independent of the number of polynomials and the number of multiplications in the polynomials. Using the improved ZK protocol, we can prove matrix multiplication with communication proportional to the input size, rather than the number of multiplications. Proving the multiplication of two 1024 × 1024 matrices, our implementation, with one thread and 1 GB of memory, only needs 10 seconds and communicates 25 MB, 35× faster than the state-of-the-art protocol Virgo that would need more than 140 GB of memory for the same task.