International Association
for Cryptologic Research

While it is well known that the sawtooth function has a point-wise convergent Fourier series, the rate of convergence is not the best possible for the application of approximating the mod function in small intervals around multiples of the modulus. We show a different sine series, such that the sine series of order n has error O(epsilon^(2n+1)) for approximating the mod function in epsilon-sized intervals around multiples of the modulus. Moreover, the resulting polynomial, after Taylor series approximation of the sine series, has small coefficients, and the whole polynomial can be computed at a precision that is only slightly larger than -(2n+1)log epsilon, the precision of approximation being sought. This polynomial can then be used to approximate the mod function to almost arbitrary precision, and hence allows practical CKKS-HE bootstrapping with arbitrary precision.

The advent of a full-scale quantum computer will severely impact most currently-used cryptographic systems. The most well-known aspect of this impact lies in the computational-hardness assumptions that underpin the security of most current public-key cryptographic systems: a quantum computer can factor integers and compute discrete logarithms in polynomial time, thereby breaking systems based on these problems. However, simply replacing these problems by other which are (believed to be) impervious even to a quantum computer does not completely solve the issue. Indeed, many security proofs of cryptographic systems are no longer valid in the presence of a quantum-capable attacker; while this does not automatically implies that the affected systems would be broken by a quantum computer, it does raises questions on the exact security guarantees that they can provide. This overview document aims to analyze all aspects of the impact of quantum computers on cryptographic, by providing an overview of current quantum-hard computational problems (and cryptographic systems based on them), and by presenting the security proofs that are affected by quantum-attackers, detailing what is the current status of research on the topic and what the expected effects on security are.

Lattice-based cryptography is one of the leading proposals for post-quantum cryptography. The Shortest Vector Problem (SVP) is arguably the most important problem for the cryptanalysis of lattice-based cryptography, and many lattice-based schemes have security claims based on its hardness. The best quantum algorithm for the SVP is due to Laarhoven [Laa16 PhD] and runs in (heuristic) time $2^{0.2653d + o(d)}$. In this article, we present an improvement over Laarhoven's result and present an algorithm that has a (heuristic) running time of $2^{0.2570 d + o(d)}$ where $d$ is the lattice dimension. We also present time-memory trade-offs where we quantify the amount of quantum memory and quantum random access memory of our algorithm. The core idea is to replace Grover's algorithm used in [Laa16 PhD] in a key part of the sieving algorithm by a quantum random walk in which we add a layer of local sensitive filtering.

Masking has been recognized as a sound and secure countermeasure for cryptographic implementations, protecting against physical side-channel attacks. Even though many different masking schemes have been presented over time, design and implementation of protected cryptographic Integrated Circuits (ICs) remains a challenging task. More specifically, correct and efficient implementation usually requires manual interactions accompanied by longstanding experience in hardware design and physical security. To this end, design and implementation of masked hardware often proves to be an error-prone task for engineers and practitioners. As a result, our novel tool for automated generation of masked hardware (AGEMA) allows even inexperienced engineers and hardware designers to create secure and efficient masked cryptograhic circuits originating from an unprotected design. More precisely, exploiting the concepts of Probe-Isolating Non-Interference (PINI) for secure composition of masked circuits, our tool provides various processing techniques to transform an unprotected design into a secure one, eventually accelerating and safeguarding the process of masking cryptographic hardware. Ultimately, we evaluate our tool in several case studies, emphasizing different trade-offs for the transformation techniques with respect to common performance metrics, such as latency, area, and randomness.

In this paper, we study efficient and authorized rewriting of transactions already written to a blockchain. Mutable transactions will make a fraction of all blockchain transactions, but will be a necessity to meet the needs of privacy regulations, such as the General Data Protection Regulation (GDPR). The state-of-the-art rewriting approaches have several shortcomings, such as lack of user anonymity, inefficiency, and absence of revocation mechanisms. We present ReTRACe, an efficient framework for blockchain rewrites. ReTRACe is designed by composing a novel revocable chameleon hash with ephemeral trapdoor scheme, a novel revocable fast attribute based encryption scheme, and a dynamic group signature scheme. We discuss ReTRACe, and its constituent primitives in detail, along with their security analyses, and present experimental results to demonstrate the scalability of ReTRACe.

As a solution to mitigate the key exposure problems in the digital signature, forward security has been proposed. The forward security guarantees the integrity of the messages generated in the past despite leaks of a current time period secret key by evolving a secret key on each time period. However, there is no forward secure signature scheme whose all metrics have constant complexities. Furthermore, existing works do not support multi-user aggregation of signatures. In this paper, we propose a forward secure aggregate signature scheme utilizing recursive zk-SNARKs (zero knowledge Succinct Non-interactive ARguments of Knowledge), whose all metrics including size and time have $O(1)$. The proposed forward secure signature scheme can aggregate signatures generated by not only a single user but also multiple users. The security of the proposed scheme is formally proven under zero-knowledge assumption and random oracle model.

We investigate the digital signature schemes in the indifferentiability framework. We show that the well-known Lamport one-time signature scheme and the tree-based signature scheme can be ``lifted'' to realize ideal one-time signature, and ideal signature, respectively, without using computational assumptions. We for the first time show that the ideal signatures, ideal one-time signatures, and random oracles are equivalent in the framework of indifferentiability.

Secure multiparty generation of an RSA biprime is a challenging task, which increasingly receives attention, due to the numerous privacy-preserving applications that require it. In this work, we construct a new protocol for the RSA biprime generation task, secure against a malicious adversary, who can corrupt any subset of protocol participants. Our protocol is designed for generic MPC, making it both platform-independent and allowing for weaker security models to be assumed (e.g., honest majority), should the application scenario require it. By carefully ``postponing" the check of possible inconsistencies in the shares provided by malicious adversaries, we achieve noteworthy efficiency improvements. Concretely, we are able to produce additive sharings of the prime candidates, from multiplicative sharings via a semi-honest multiplication, without degrading the overall (active) security of our protocol. This is the core of our sieving technique, increasing the probability of our protocol sampling a biprime. Similarly, we perform the first biprimality test, requiring several repetitions, without checking input share consistency, and perform the more costly consistency check only in case of success of the Jacobi symbol based biprimality test. Moreover, we propose a protocol to convert an additive sharing over a ring, into an additive sharing over the integers. Besides being a necessary sub-protocol for the RSA biprime generation, this conversion protocol is of independent interest. The cost analysis of our protocol demonstrated that our approach improves the current state-of-the-art (Chen et al. -- Crypto 2020), in terms of communication efficiency. Concretely, for the two-party case with malicious security, and primes of 2048 bits, our protocol improves communication by a factor of ~37.

In a set membership proof, the public information consists of a set of elements and a commitment. The prover then produces a zero-knowledge proof showing that the commitment is indeed to some element from the set. This primitive is closely related to concepts like ring signatures and ``one-out-of-many'' proofs that underlie many anonymity and privacy protocols. The main result of this work is a new succinct lattice-based set membership proof whose size is logarithmic in the size of the set.

We also give a transformation of our set membership proof to a ring signature scheme. The ring signature size is also logarithmic in the size of the public key set and has size $\raapprox$~KB for a set of $2^5$ elements, and $\rdapprox$~KB for a set of size $2^{25}$. At an approximately $128$-bit security level, these outputs are between 1.5X and 7X smaller than the current state of the art succinct ring signatures of Beullens et al. (Asiacrypt 2020) and Esgin et al. (CCS 2019).

We then show that our ring signature, combined with a few other techniques and optimizations, can be turned into a fairly efficient Monero-like confidential transaction system based on the MatRiCT framework of Esgin et al. (CCS 2019). With our new techniques, we are able to reduce the transaction proof size by factors of about 4X - 10X over the aforementioned work. For example, a transaction with two inputs and two outputs, where each input is hidden among $2^{15}$ other accounts, requires approximately $30$KB in our protocol.

This paper demonstrates an architecture for accelerating the polynomial multiplication using number theoretic transform (NTT). Kyber is one of the finalists in the third round of the NIST post-quantum cryptography standardization process. Simultaneously, the performance of NTT execution is its main challenge, requiring large memory and complex memory access pattern. In this paper, an efficient NTT architecture is presented to improve the respective computation time. We propose several optimization strategies for efficiency improvement targeting different performance requirements for various applications. Our NTT architecture, including four butterfly cores, occupies only 798 LUTs and 715 FFs on a small Artix-7 FPGA, showing more than 44% improvement compared to the best previous work. We also implement a coprocessor architecture for Kyber KEM benefiting from our high-speed NTT core to accomplish three phases of the key exchange in 9, 12, and 19 \mus, respectively, operating at 200 MHz.

It follows from a result by Friedl, Ivanyos, Magniez, Santha and Sen from 2014 that, for any fixed integer $m > 0$ (thought of as being small), there exists a quantum algorithm for solving the hidden shift problem in an arbitrary finite abelian group $(G, +)$ with time complexity poly$( \log |G|) \cdot 2^{O(\sqrt{\log |mG|})}$. As discussed in the current paper, this can be viewed as a modest statement of Pohlig-Hellman type for hard homogeneous spaces. Our main contribution is a simpler algorithm achieving the same runtime for $m = 2^tp$, with $t$ any non-negative integer and $p$ any prime number, where additionally the memory requirements are mostly in terms of quantum random access classical memory; indeed, the amount of qubits that need to be stored is poly$( \log |G|)$. Our central tool is an extension of Peikert's adaptation of Kuperberg's collimation sieve to arbitrary finite abelian groups. This allows for a reduction, in said time, to the hidden shift problem in the quotient $G/2^tpG$, which can then be tackled in polynomial time, by combining methods by Friedl et al. for $p$-torsion groups and by Bonnetain and Naya-Plasencia for $2^t$-torsion groups.

Public-key cryptography based on the lattice problem is efficient and believed to be secure in a post-quantum era. In this paper, we introduce carefully optimized implementations of Kyber encryption schemes for 64-bit ARM Cortex-A processors. Our research contribution includes several optimizations for Number Theoretic Transform (NTT), noise sampling, and AES accelerator based symmetric function implementations. The proposed Kyber512 implementation on ARM64 improved previous works by 1.72×, 1.88×, and 2.29× for key generation, encapsulation, and decapsulation, respectively. Moreover, by using AES accelerator in the proposed Kyber512-90s implementation, it is improved by 8.57×, 6.94×, and 8.26× for key generation, encapsulation, and decapsulation, respectively. These results set new speed records for Kyber encryption on 64-bit ARM Cortex-A processors.

We use matrices over bit strings as platforms for Diffie-Hellman-like public key exchange protocols. When multiplying matrices like that, we use Boolean OR operation on bit strings in place of addition and Boolean AND operation in place of multiplication. As a result, (1) computations with these matrices are very efficient; (2) standard methods of attacking Diffie-Hellman-like protocols are not applicable.

Updatable encryption (UE) is symmetric encryption which additionally supports key rotation. UE was introduced for scenarios where a user stores encrypted data on a cloud and, in order to mitigate secret key leakage, periodically sends a short update token, which the cloud uses to re-encrypt stored data to a fresh key. A long line of research resulted in a wide variety of security properties UE schemes can provide, including confidentiality, integrity protection, and hiding metadata. Unfortunately, given the complexity and nuances in the definitions, different properties are difficult to compare for non-experts, making it hard to judge which scheme provides the best security-efficiency trade-off for a given application.

In this work, we challenge the approach of defining UE as a primitive with a set of properties. As an alternative, we propose to treat UE as an interactive protocol, whose goal is to implement secure outsourced storage, using limited and imperfect resources (such as a small, leakable memory). To facilitate this approach, we introduce a framework that allows to easily formalize different security guarantees and available resources, making security-efficiency trade-offs of UE protocols easy to compare.

We believe that our approach opens the way for many constructions of secure storage that are not compatible with the currently defined syntax of UE. Indeed, we propose two new protocols: one for the setting with adversaries who control randomness (an attack vector so far not considered for UE), and one for the setting with adversaries that actively tamper with memory. Both protocols provide stronger confidentiality guarantees than all existing UE schemes.

In this work we present a new approach to verifiable decryption which converts a 2-party passively secure distributed decryption protocol into a 1-party proof of correct decryption. To introduce our idea, we first present a toy example for an ElGamal distributed decryption protocol before applying our method to a lattice-based scheme. This leads to an efficient lattice-based verifiable decryption with only one server; it has lightweight computations as we reduce the need of zero-knowledge proofs. We believe the flexibility of the general technique is interesting and provides attractive trade-offs between complexity and security, in particular for the interactive variant where the online phase can be very efficient.

Overview of Rabdan Academy: The Academy is a government-owned world class education institution established to coordinate and enhance learning outcomes for organizations and individuals in the safety, security, defense, emergency preparedness and crisis management sectors. Rabdan Academy was officially established under Law No. 7 for 2013, issued by President His Highness Sheikh Khalifa bin Zayed Al Nahyan in his capacity as Ruler of Abu Dhabi and is accredited by the UAE's Commission for Academic Accreditation (CAA) of the Ministry of Higher Education & Scientific Research. The academy is the first in UAE in providing learning in dual approach of combining academic and vocational education in one place whilst recognizing prior learning and experience and providing accredited and transferable credit from course to course and job to job. Key Objectives: To contribute and assist Rabdan Academy in achieving its Research Strategy and build an outstanding record in research related to contemporary issues related to Rabdan Academy’s mandate in developing safety, security, defence, emergency preparedness and crisis management (SSDEC) and ensuring students and activities are to positively contribute to improving the resilience of the nation. Key Responsibilities Reporting directly to the Assistant Dean of Research, the Researcher is responsible for producing peer reviewed research papers to be published in Quartile 1 Scopus Indexed Journals in arears related to safety, security, defence, emergency preparedness and crisis management (SSDEC), including but not limited to: • Carrying out approved scholarly research activities; • Contributing to RA related scholarship, research projects, and initiatives; * Working Closely with other colleagues from the homeland security Program on some projects with our stakeholders ( Ministry of defense, Ministry • Publish research papers in the top 10% most cited publications in its subject, to increase their work visibility, hence, number of citations; • Collaborate with other researchers to conduct joint researc

Closing date for applications:

Contact: Mr. Amir Adel - Recruitment Specialist

More information: https://ra.ac.ae/

The GOC group at MIS, University of Picardie Jules Verne is hiring a two-year postdoctoral researcher to work on the POSTCRYPTUM project, funded by the Agence Nationale de Recherche (ANR) and AID/DGA. This is a three-years project focused on algebraic cryptanalysis of public key cryptosystems, focused mainly on post-quantum schemes. For more details on the project, please check here: https://home.mis.u-picardie.fr/~ionica/postcryptum/Welcome.html The ideal candidate should hold a Phd degree in Computer Science or Mathematics, with a taste for cryptography, experimental mathematics and computation. He or she should have experience in one or several of the following areas: multivariate cryptography, coding theory, elliptic curves, polynomial system solving, Gröbner basis, linearization algorithms, linear algebra, exhaustive search, SAT solvers, hybrid methods for polynomial system solving. The starting date is flexible, but preferably around October 2021. For more information, please contact us (sorina.ionica@u-picardie.fr) before sending in your application.

Closing date for applications:

Contact: Sorina Ionica

More information: https://home.mis.u-picardie.fr/~ionica/postcryptum/Welcome.html

Seconize is an award winning Cyber Risk and Compliance Management Product Startup. We are currently looking to hire a seasoned Security Tester with below skills and requirements. 1. Security Testing of Telecom Products (3G/4G/GSM/5G) or related 2. Security Testing of IOT products, Proprietary Hardware , Networking Products 3. Thorough understanding of Cryptography protocols, techniques 4. Hands on Testing of PKI, Key Management, Cryptography Libraries and Implementations 5. Hands on experience with Standards such FIPS, NIST Security (SP 800-175b) OR ISO19790 or relevant 6. Ability to understand the business context of target applications and doing business logic testing 7. Ability to interact with Customers in a professional way 8. Minimum of 5 - 8 years of experience 8. Certifications like OSCP, CEH or relavant are mandatory The position is currently Remote (India-only), candidate should be ready to move to Bengaluru when needed.

Closing date for applications:

Contact: Sashank Dara

The IBM cryptography research group in Zurich is looking for a Ph.D. student and/or a post-doctoral scholar to work in the area of lattice-based zero-knowledge proofs.

The ideal candidate should have:

Very good implementation skills – preferably in C or C++

A solid mathematical background – e.g. abstract algebra and some basic familiarity with algebraic number theory is a plus

High motivation for creating efficient theoretical cryptographic designs and turning them into prototypes and high-quality optimized implementations

Papers in top cryptography conferences (for the post-doc position)

Prior experience working with ZK proofs (not necessarily lattice-based) is a plus

This position is funded by a European ERC project, and all its output will be open source and patent-free. So a positive attitude towards contributing to the open source community is also a requirement.

The IBM research lab is located in Ruschlikon, a lakeside town that is reachable in 10 minutes by direct public transport from central Zurich. English is the working language at the lab, and it is also widely understood and spoken in Zurich and its surrounding regions.

The group offers very good working conditions, with the majority of our time being spent purely on research activities. It is also currently one of the leading research groups in quantum-safe cryptography, with some of its members (Luca de Feo, Vadim Lyubashevsky, and Gregor Seiler) significantly contributing to the invention, design, and implementation of several finalists in the ongoing NIST post-quantum standardization effort.

To apply, please include a C.V., a brief motivation letter, and the names and email addresses of two references. If you have contributed to open source projects, please include a link to the repository and a brief explanation of your role. The starting date is flexible, but the sooner the better.

Closing date for applications:

Contact: If interested, please send the application to: Vadim Lyubashevsky; vad@zurich.ibm.com; with "ZK APPLICATION" as the subject line

Event date: 31 May to 2 June 2021
Submission deadline: 27 May 2021
Notification: 29 May 2021