International Association
for Cryptologic Research

As a solution to mitigate the key exposure problems in the digital signature, forward security has been proposed. The forward security guarantees the integrity of the messages generated in the past despite leaks of a current time period secret key by evolving a secret key on each time period. However, there is no forward secure signature scheme whose all metrics have constant complexities. Furthermore, existing works do not support multi-user aggregation of signatures. In this paper, we propose a forward secure aggregate signature scheme utilizing recursive zk-SNARKs (zero knowledge Succinct Non-interactive ARguments of Knowledge), whose all metrics including size and time have $O(1)$. The proposed forward secure signature scheme can aggregate signatures generated by not only a single user but also multiple users. The security of the proposed scheme is formally proven under zero-knowledge assumption and random oracle model.

We investigate the digital signature schemes in the indifferentiability framework. We show that the well-known Lamport one-time signature scheme and the tree-based signature scheme can be ``lifted'' to realize ideal one-time signature, and ideal signature, respectively, without using computational assumptions. We for the first time show that the ideal signatures, ideal one-time signatures, and random oracles are equivalent in the framework of indifferentiability.

Secure multiparty generation of an RSA biprime is a challenging task, which increasingly receives attention, due to the numerous privacy-preserving applications that require it. In this work, we construct a new protocol for the RSA biprime generation task, secure against a malicious adversary, who can corrupt any subset of protocol participants. Our protocol is designed for generic MPC, making it both platform-independent and allowing for weaker security models to be assumed (e.g., honest majority), should the application scenario require it. By carefully ``postponing" the check of possible inconsistencies in the shares provided by malicious adversaries, we achieve noteworthy efficiency improvements. Concretely, we are able to produce additive sharings of the prime candidates, from multiplicative sharings via a semi-honest multiplication, without degrading the overall (active) security of our protocol. This is the core of our sieving technique, increasing the probability of our protocol sampling a biprime. Similarly, we perform the first biprimality test, requiring several repetitions, without checking input share consistency, and perform the more costly consistency check only in case of success of the Jacobi symbol based biprimality test. Moreover, we propose a protocol to convert an additive sharing over a ring, into an additive sharing over the integers. Besides being a necessary sub-protocol for the RSA biprime generation, this conversion protocol is of independent interest. The cost analysis of our protocol demonstrated that our approach improves the current state-of-the-art (Chen et al. -- Crypto 2020), in terms of communication efficiency. Concretely, for the two-party case with malicious security, and primes of 2048 bits, our protocol improves communication by a factor of ~37.

In a set membership proof, the public information consists of a set of elements and a commitment. The prover then produces a zero-knowledge proof showing that the commitment is indeed to some element from the set. This primitive is closely related to concepts like ring signatures and ``one-out-of-many'' proofs that underlie many anonymity and privacy protocols. The main result of this work is a new succinct lattice-based set membership proof whose size is logarithmic in the size of the set.

We also give a transformation of our set membership proof to a ring signature scheme. The ring signature size is also logarithmic in the size of the public key set and has size $\raapprox$~KB for a set of $2^5$ elements, and $\rdapprox$~KB for a set of size $2^{25}$. At an approximately $128$-bit security level, these outputs are between 1.5X and 7X smaller than the current state of the art succinct ring signatures of Beullens et al. (Asiacrypt 2020) and Esgin et al. (CCS 2019).

We then show that our ring signature, combined with a few other techniques and optimizations, can be turned into a fairly efficient Monero-like confidential transaction system based on the MatRiCT framework of Esgin et al. (CCS 2019). With our new techniques, we are able to reduce the transaction proof size by factors of about 4X - 10X over the aforementioned work. For example, a transaction with two inputs and two outputs, where each input is hidden among $2^{15}$ other accounts, requires approximately $30$KB in our protocol.

This paper demonstrates an architecture for accelerating the polynomial multiplication using number theoretic transform (NTT). Kyber is one of the finalists in the third round of the NIST post-quantum cryptography standardization process. Simultaneously, the performance of NTT execution is its main challenge, requiring large memory and complex memory access pattern. In this paper, an efficient NTT architecture is presented to improve the respective computation time. We propose several optimization strategies for efficiency improvement targeting different performance requirements for various applications. Our NTT architecture, including four butterfly cores, occupies only 798 LUTs and 715 FFs on a small Artix-7 FPGA, showing more than 44% improvement compared to the best previous work. We also implement a coprocessor architecture for Kyber KEM benefiting from our high-speed NTT core to accomplish three phases of the key exchange in 9, 12, and 19 \mus, respectively, operating at 200 MHz.

It follows from a result by Friedl, Ivanyos, Magniez, Santha and Sen from 2014 that, for any fixed integer $m > 0$ (thought of as being small), there exists a quantum algorithm for solving the hidden shift problem in an arbitrary finite abelian group $(G, +)$ with time complexity poly$( \log |G|) \cdot 2^{O(\sqrt{\log |mG|})}$. As discussed in the current paper, this can be viewed as a modest statement of Pohlig-Hellman type for hard homogeneous spaces. Our main contribution is a simpler algorithm achieving the same runtime for $m = 2^tp$, with $t$ any non-negative integer and $p$ any prime number, where additionally the memory requirements are mostly in terms of quantum random access classical memory; indeed, the amount of qubits that need to be stored is poly$( \log |G|)$. Our central tool is an extension of Peikert's adaptation of Kuperberg's collimation sieve to arbitrary finite abelian groups. This allows for a reduction, in said time, to the hidden shift problem in the quotient $G/2^tpG$, which can then be tackled in polynomial time, by combining methods by Friedl et al. for $p$-torsion groups and by Bonnetain and Naya-Plasencia for $2^t$-torsion groups.

Public-key cryptography based on the lattice problem is efficient and believed to be secure in a post-quantum era. In this paper, we introduce carefully optimized implementations of Kyber encryption schemes for 64-bit ARM Cortex-A processors. Our research contribution includes several optimizations for Number Theoretic Transform (NTT), noise sampling, and AES accelerator based symmetric function implementations. The proposed Kyber512 implementation on ARM64 improved previous works by 1.72×, 1.88×, and 2.29× for key generation, encapsulation, and decapsulation, respectively. Moreover, by using AES accelerator in the proposed Kyber512-90s implementation, it is improved by 8.57×, 6.94×, and 8.26× for key generation, encapsulation, and decapsulation, respectively. These results set new speed records for Kyber encryption on 64-bit ARM Cortex-A processors.

We use matrices over bit strings as platforms for Diffie-Hellman-like public key exchange protocols. When multiplying matrices like that, we use Boolean OR operation on bit strings in place of addition and Boolean AND operation in place of multiplication. As a result, (1) computations with these matrices are very efficient; (2) standard methods of attacking Diffie-Hellman-like protocols are not applicable.

Updatable encryption (UE) is symmetric encryption which additionally supports key rotation. UE was introduced for scenarios where a user stores encrypted data on a cloud and, in order to mitigate secret key leakage, periodically sends a short update token, which the cloud uses to re-encrypt stored data to a fresh key. A long line of research resulted in a wide variety of security properties UE schemes can provide, including confidentiality, integrity protection, and hiding metadata. Unfortunately, given the complexity and nuances in the definitions, different properties are difficult to compare for non-experts, making it hard to judge which scheme provides the best security-efficiency trade-off for a given application.

In this work, we challenge the approach of defining UE as a primitive with a set of properties. As an alternative, we propose to treat UE as an interactive protocol, whose goal is to implement secure outsourced storage, using limited and imperfect resources (such as a small, leakable memory). To facilitate this approach, we introduce a framework that allows to easily formalize different security guarantees and available resources, making security-efficiency trade-offs of UE protocols easy to compare.

We believe that our approach opens the way for many constructions of secure storage that are not compatible with the currently defined syntax of UE. Indeed, we propose two new protocols: one for the setting with adversaries who control randomness (an attack vector so far not considered for UE), and one for the setting with adversaries that actively tamper with memory. Both protocols provide stronger confidentiality guarantees than all existing UE schemes.

In this work we present a new approach to verifiable decryption which converts a 2-party passively secure distributed decryption protocol into a 1-party proof of correct decryption. To introduce our idea, we first present a toy example for an ElGamal distributed decryption protocol before applying our method to a lattice-based scheme. This leads to an efficient lattice-based verifiable decryption with only one server; it has lightweight computations as we reduce the need of zero-knowledge proofs. We believe the flexibility of the general technique is interesting and provides attractive trade-offs between complexity and security, in particular for the interactive variant where the online phase can be very efficient.

Overview of Rabdan Academy: The Academy is a government-owned world class education institution established to coordinate and enhance learning outcomes for organizations and individuals in the safety, security, defense, emergency preparedness and crisis management sectors. Rabdan Academy was officially established under Law No. 7 for 2013, issued by President His Highness Sheikh Khalifa bin Zayed Al Nahyan in his capacity as Ruler of Abu Dhabi and is accredited by the UAE's Commission for Academic Accreditation (CAA) of the Ministry of Higher Education & Scientific Research. The academy is the first in UAE in providing learning in dual approach of combining academic and vocational education in one place whilst recognizing prior learning and experience and providing accredited and transferable credit from course to course and job to job. Key Objectives: To contribute and assist Rabdan Academy in achieving its Research Strategy and build an outstanding record in research related to contemporary issues related to Rabdan Academy’s mandate in developing safety, security, defence, emergency preparedness and crisis management (SSDEC) and ensuring students and activities are to positively contribute to improving the resilience of the nation. Key Responsibilities Reporting directly to the Assistant Dean of Research, the Researcher is responsible for producing peer reviewed research papers to be published in Quartile 1 Scopus Indexed Journals in arears related to safety, security, defence, emergency preparedness and crisis management (SSDEC), including but not limited to: • Carrying out approved scholarly research activities; • Contributing to RA related scholarship, research projects, and initiatives; * Working Closely with other colleagues from the homeland security Program on some projects with our stakeholders ( Ministry of defense, Ministry • Publish research papers in the top 10% most cited publications in its subject, to increase their work visibility, hence, number of citations; • Collaborate with other researchers to conduct joint researc

Closing date for applications:

Contact: Mr. Amir Adel - Recruitment Specialist

More information: https://ra.ac.ae/

The GOC group at MIS, University of Picardie Jules Verne is hiring a two-year postdoctoral researcher to work on the POSTCRYPTUM project, funded by the Agence Nationale de Recherche (ANR) and AID/DGA. This is a three-years project focused on algebraic cryptanalysis of public key cryptosystems, focused mainly on post-quantum schemes. For more details on the project, please check here: https://home.mis.u-picardie.fr/~ionica/postcryptum/Welcome.html The ideal candidate should hold a Phd degree in Computer Science or Mathematics, with a taste for cryptography, experimental mathematics and computation. He or she should have experience in one or several of the following areas: multivariate cryptography, coding theory, elliptic curves, polynomial system solving, Gröbner basis, linearization algorithms, linear algebra, exhaustive search, SAT solvers, hybrid methods for polynomial system solving. The starting date is flexible, but preferably around October 2021. For more information, please contact us (sorina.ionica@u-picardie.fr) before sending in your application.

Closing date for applications:

Contact: Sorina Ionica

More information: https://home.mis.u-picardie.fr/~ionica/postcryptum/Welcome.html

Seconize is an award winning Cyber Risk and Compliance Management Product Startup. We are currently looking to hire a seasoned Security Tester with below skills and requirements. 1. Security Testing of Telecom Products (3G/4G/GSM/5G) or related 2. Security Testing of IOT products, Proprietary Hardware , Networking Products 3. Thorough understanding of Cryptography protocols, techniques 4. Hands on Testing of PKI, Key Management, Cryptography Libraries and Implementations 5. Hands on experience with Standards such FIPS, NIST Security (SP 800-175b) OR ISO19790 or relevant 6. Ability to understand the business context of target applications and doing business logic testing 7. Ability to interact with Customers in a professional way 8. Minimum of 5 - 8 years of experience 8. Certifications like OSCP, CEH or relavant are mandatory The position is currently Remote (India-only), candidate should be ready to move to Bengaluru when needed.

Closing date for applications:

Contact: Sashank Dara

The IBM cryptography research group in Zurich is looking for a Ph.D. student and/or a post-doctoral scholar to work in the area of lattice-based zero-knowledge proofs.

The ideal candidate should have:

Very good implementation skills – preferably in C or C++

A solid mathematical background – e.g. abstract algebra and some basic familiarity with algebraic number theory is a plus

High motivation for creating efficient theoretical cryptographic designs and turning them into prototypes and high-quality optimized implementations

Papers in top cryptography conferences (for the post-doc position)

Prior experience working with ZK proofs (not necessarily lattice-based) is a plus

This position is funded by a European ERC project, and all its output will be open source and patent-free. So a positive attitude towards contributing to the open source community is also a requirement.

The IBM research lab is located in Ruschlikon, a lakeside town that is reachable in 10 minutes by direct public transport from central Zurich. English is the working language at the lab, and it is also widely understood and spoken in Zurich and its surrounding regions.

The group offers very good working conditions, with the majority of our time being spent purely on research activities. It is also currently one of the leading research groups in quantum-safe cryptography, with some of its members (Luca de Feo, Vadim Lyubashevsky, and Gregor Seiler) significantly contributing to the invention, design, and implementation of several finalists in the ongoing NIST post-quantum standardization effort.

To apply, please include a C.V., a brief motivation letter, and the names and email addresses of two references. If you have contributed to open source projects, please include a link to the repository and a brief explanation of your role. The starting date is flexible, but the sooner the better.

Closing date for applications:

Contact: If interested, please send the application to: Vadim Lyubashevsky; vad@zurich.ibm.com; with "ZK APPLICATION" as the subject line

Event date: 31 May to 2 June 2021
Submission deadline: 27 May 2021
Notification: 29 May 2021

Event date: 27 October to
Submission deadline: 21 June 2021
Notification: 19 July 2021

Event date: 15 August 2021
Submission deadline: 1 June 2021
Notification: 1 July 2021

The Cybersecurity research group, headed by Elisabeth Oswald, is a relatively new group established in Austria's sunny south. The group currently features a diverse range of members (from France, Iran, India, and China). Current members work on topics such as leakage profiling, advanced leakage simulators, attacks (utilising deep learning), statistical foundations, and hardware aspects of side channels. The group receives funding from the ERC, as well as local funding, and thus offers a supportive research environment (both financially as well as from a human perspective).

The group is looking to grow by two more members: one post doc and one doctoral student. The group is particularly keen to expand their existing coverage of topics and seeks researchers with an interest in

• compilers/languages to support the secure implementation of cryptographic primitives
• machine/deep learning
• secure implementations w.r.t. the RISC-V instruction set

A good candidate for the Post-doc position will have some existing publications in relevant venues (IACR conferences or workshops, journals, or system security venues), enjoy working with people in an international context, and love water, sun, and mountains.

A good candidate for the PhD position will have a background in either computer science, maths, or statistics (an MSc level degree is required), will ideally have done some project in a crypto/security related topic, enjoy working with people in an international context, and love water, sun, and mountains.

The funding for the Post-Doc Position is available until 31.08.2023. The funding for the PhD position is for 40 months. Rates are set according to a standard collective agreement for such positions (Kollektivvertrag), but the salary for the Post-Doc position can be adjusted depending on previous experience.

Don't hesitate to get in touch with Elisabeth Oswald for informal enquiries, or to apply!

Closing date for applications:

Contact: Please contact Elisabeth . Oswald @ aau . at

More information: http://www.cybersecurityresearch.at

The dual attack has long been considered a relevant attack on lattice-based cryptographic schemes relying on the hardness of learning with errors (LWE) and its structured variants. As solving LWE corresponds to finding a nearest point on a lattice, one may naturally wonder how efficient this dual approach is for solving more general closest vector problems, such as the classical closest vector problem (CVP), the variants bounded distance decoding (BDD) and approximate CVP, and preprocessing versions of these problems. While primal, sieving-based solutions to these problems (with preprocessing) were recently studied in a series of works on approximate Voronoi cells, for the dual attack no such overview exists, especially for problems with preprocessing. With one of the take-away messages of the approximate Voronoi cell line of work being that primal attacks work well for approximate CVP(P) but scale poorly for BDD(P), one may wonder if the dual attack suffers the same drawbacks, or if it is a better method for solving BDD(P).

In this work we provide an overview of cost estimates for dual algorithms for solving these ''classical'' closest lattice vector problems. Heuristically we expect to solve the search version of average-case CVPP in time and space $2^{0.293d + o(d)}$. For the distinguishing version of average-case CVPP, where we wish to distinguish between random targets and targets planted at distance approximately the Gaussian heuristic from the lattice, we obtain the same complexity in the single-target model, and we obtain query time and space complexities of $2^{0.195d + o(d)}$ in the multi-target setting, where we are given a large number of targets from either target distribution. This suggests an inequivalence between distinguishing and searching, as we do not expect a similar improvement in the multi-target setting to hold for search-CVPP. We analyze three slightly different decoders, both for distinguishing and searching, and experimentally obtain concrete cost estimates for the dual attack in dimensions $50$ to $80$, which confirm our heuristic assumptions, and show that the hidden order terms in the asymptotic estimates are quite small.

Our main take-away message is that the dual attack appears to mirror the approximate Voronoi cell line of work -- whereas using approximate Voronoi cells works well for approximate CVP(P) but scales poorly for BDD(P), the dual approach scales well for BDD(P) instances but performs poorly on approximate CVP(P).

During the last years, many Physical Zero-knowledge Proof(ZKP) protocols for Nikoli’s puzzles have been designed. In this paper, we propose two ZKP protocols for the two Nikoli’s puzzles called Nurikabe and Hitori. These two puzzles have some similarities, since in their rules at least one condition requires that some cells are connected to each other, horizontally or vertically. The novelty in this paper is to propose two techniques that allow us to prove such connectivity without leaking any information about a solution.