IACR News

Updates on the COVID-19 situation are on the Announcement channel.

Here you can see all recent updates to the IACR webpage. These updates are also available:

07 January 2022

Jiaxin Pan, Benedikt Wagner
ePrint Report
We construct the first tightly secure signature schemes in the multi-user setting with adaptive corruptions from lattices. In stark contrast to the previous tight constructions whose security is solely based on number-theoretic assumptions, our schemes are based on the Learning with Errors (LWE) assumption which is supposed to be post-quantum secure. The security of our scheme is independent of the numbers of users and signing queries, and it is in the non-programmable random oracle model. Our LWE-based scheme is compact namely, its signatures contain only a constant number of lattice vectors.

At the core of our construction are a new abstraction of the existing lossy identification (ID) schemes using dual-mode commitment schemes and a refinement of the framework by Diemert et al. (PKC 2021) which transforms a lossy ID scheme to a signature using sequential OR proofs. In combination, we obtain a tight generic construction of signatures from dual-mode commitments in the multi-user setting. Improving the work of Diemert et al., our new approach can be instantiated using not only the LWE assumption, but also an isogeny-based assumption. We stress that our LWE-based lossy ID scheme in the intermediate step uses a conceptually different idea than the previous lattice-based ones.

Of independent interest, we formally rule out the possibility that the aforementioned ID-to-Signature'' methodology can work tightly using parallel OR proofs. In addition to the results of Fischlin et al. (EUROCRYPT 2020), our impossibility result shows a qualitative difference between both forms of OR proofs in terms of tightness.
Hyunji Kim, Sejin Lim, Yeajun Kang, Wonwoong Kim, Hwajeong Seo
ePrint Report
Crypto-ransomware has a process to encrypt the victim's files, and crypto-ransomware requests the victim for money for a key to decrypt the encrypted file. In this paper, we present new approaches to prevent crypto-ransomware by detecting block cipher algorithms for Internet of Things (IoT) platforms. The generic software of the AVR package and the lightweight block cipher library (FELICS) written in C language was trained through the neural network, and then we evaluated the result. Unlike the previous technique, the proposed method does not extract sequence and frequency characteristics, but considers opcodes and opcode sequences as words and sentences, performs word embedding, and then inputs them to the neural network based on the encoder structure of the transformer model. Through this approach, the file size was reduced by 0.5 times while maintaining a similar level of classification performance compared to the previous method. The detection success rate for the proposed method was evaluated with the F-measured value, which is the harmonic mean of precision and recall. In addition to achieving 98% crypto-ransomware detection success rates, classification by benign firmware and lightweight cryptography algorithm, Substitution-Permutation-Network (SPN) structure, Addition-Rotation-eXclusive-or structure (ARX) and normal firmware classification are also possible.
Runsong Wang, Xuelian Li, Juntao Gao, Hui Li, Baocang Wang
ePrint Report
This paper considers the capability of 4-round Keccak-224/256/384/512 against the cryptanlysis involved by the quantum algorithm. In order to effectively find the corresponding rotational number for the rotational counterpart of preimage, we first establish a probabilistic algorithm based on the Grover search to guess a possible rotational number by using the fixed relations of bits pairs in some coordinates. This is committed to achieving that each iteration of searching the rotational counterparts contains only one run of 4-round Keccak variant applied for the verification, which can reduce the attack complexity in the quantum setting. Based on finding the rotational number under an acceptable randomness, we construct two attack models to focus on the recovery of preimage. In the first model, the Grover’s algorithm serves as finding out a rotational counterpart of the preimage. Through 64 attempts of checking the correct rotational number, the desired preimage can be obtained. In the second model, we abstract the finding of rotational counterparts into searching vertexes on a hypercube, and then, the SKW quantum algorithm is used to deal with the finding of the vertexes acted as rotational counterparts. Compared to the recent works in classical setting, we greatly reduce the attack complexity of preimage recovery. Furthermore, the first attack model is superior to the generic quantum preimage attack for 4-round Keccak-224/256/384/512, and the second model has slightly lower attack effect but more practicality on the 4-round Keccak-512/384, that is, the model is exponentially easier to implement in quantum circuit than both our first attack model and the generic quantum preimage attack.
Ferucio Laurentiu Tiplea, Sorin Iftene, George Teseleanu, Anca-Maria Nica
ePrint Report
The aim of this paper is to provide an overview on the newest results regarding the security of identity-based encryption schemes from quadratic residuosity. It is shown that the only secure schemes are the Cocks and Boneh-Gentry-Hamburg schemes (except of anonymous variations of them).
Alfredo Rial, Ania M. Piotrowska
ePrint Report
Coconut [NDSS 2019] is an attribute-based credential scheme with threshold issuance. We analyze its security properties. To this end, we define an ideal functionality for attribute-based access control with threshold issuance. We describe a construction that realizes our functionality. Our construction follows Coconut with a few changes. In particular, it modifies the protocols for blind issuance of credentials and for credential show so that user privacy holds against computationally unbounded adversaries. The modified protocols are slightly more efficient than those of Coconut. Our construction also extends the public key, which seems necessary to prove unforgeability.
Christian Matt, Jesper Buus Nielsen, Søren Eller Thomsen
ePrint Report
Many decentralized systems rely on flooding protocols for message dissemination. In such a protocol, the sender of a message sends it to a randomly selected set of peers. These peers again send the message to their randomly selected peers, until every network participant has received the message. This type of protocols clearly fail in face of an adaptive adversary who can simply corrupt all peers of the sender and thereby prevent the message from being delivered. Nevertheless, flooding protocols are commonly used within protocols that aim to be cryptographically secure, most notably in blockchain protocols. While it is possible to revert to static corruptions, this gives unsatisfactory security guarantees, especially in the setting of a blockchain that is supposed to run for an extended period of time. To be able to provide meaningful security guarantees in such settings, we give precise semantics to what we call $\delta$-delayed adversaries in the Universal Composability (UC) framework. Such adversaries can adaptively corrupt parties, but there is a delay of time $\delta$ from when an adversary decides to corrupt a party until they succeed in overtaking control of the party. Within this model, we formally prove the intuitive result that flooding protocols are secure against $\delta$-delayed adversaries when $\delta$ is at least the time it takes to send a message from one peer to another plus the time it takes the recipient to resend the message. To this end, we show how to reduce the adaptive setting with a $\delta$-delayed adversary to a static experiment with an Erdős–Rényi graph. Using the established theory of Erdős–Rényi graphs, we provide upper bounds on the propagation time of the flooding functionality for different neighborhood sizes of the gossip network. More concretely, we show the following for security parameter $\kappa$, point-to-point channels with delay at most $\Delta$, and $n$ parties in total, with a sufficiently delayed adversary that can corrupt any constant fraction of the parties: If all parties send to $\Omega(\kappa)$ parties on average, then we can realize a flooding functionality with maximal delay $\mathcal{O}\bigl(\Delta \cdot \log (n) \bigr)$; and if all parties send to $\Omega\bigl( \sqrt{\kappa n \log (n)} \bigr)$ parties on average, we can realize a flooding functionality with maximal delay $\mathcal{O}(\Delta)$.
Abhiram Kothapalli, Bryan Parno
ePrint Report
Arguments of knowledge are powerful cryptographic primitives that allow a prover to demonstrate that it knows a satisfying witness to a prescribed statement. Tremendous progress has been made in developing efficient argument systems by leveraging homomorphic structure in an increasingly composable and recursive manner. However, the extent to which homomorphisms can be composed and manipulated in the service of efficient argument systems is still not well understood. To this end, we introduce reductions of knowledge, a generalization of arguments of knowledge, which reduce checking a statement in one relation to checking a derived statement in another, and better capture the composable and recursive nature of arguments over homomorphisms. We construct and study the tensor reduction, which is capable of reducing any homomorphic statement composed via the tensor product, and provides knowledge soundness unconditionally when working over vector spaces. We show that tensor reductions generalize a large class of prior recursive techniques including the ubiquitous sumcheck protocol. We additionally show that tensor reductions can be employed to construct reductions of knowledge with logarithmic communication for familiar linear algebraic statements, and in turn, these can be composed to recover a reduction of knowledge for NP with logarithmic communication.
Jiahui Liu, Qipeng Liu, Luowen Qian
ePrint Report
Chandran et al. (SIAM J. Comput.'14) formally introduced the cryptographic task of position verification, where they also showed that it cannot be achieved by classical protocols. In this work, we initiate the study of position verification protocols with classical verifiers. We identify that proofs of quantumness (and thus computational assumptions) are necessary for such position verification protocols. For the other direction, we adapt the proof of quantumness protocol by Brakerski et al. (FOCS'18) to instantiate such a position verification protocol. As a result, we achieve classically verifiable position verification assuming the quantum hardness of Learning with Errors.

Along the way, we develop the notion of 1-of-2 non-local soundness for a natural non-local game for 1-of-2 puzzles, first introduced by Radian and Sattath (AFT'19), which can be viewed as a computational unclonability property. We show that 1-of-2 non-local soundness follows from the standard 2-of-2 soundness (and therefore the adaptive hardcore bit property), which could be of independent interest.
Benedikt Wagner, Lucjan Hanzlik, Julian Loss
ePrint Report
Known constructions of (efficient) blind signatures either rely on non-standard hardness assumptions or require parameters that grow linearly with the number of concurrently issued signatures. This holds true even in the random oracle model.

Katz, Loss and Rosenberg (ASIACRYPT 2021) presented a generic construction that boosts a scheme supporting logarithmically many concurrent signing sessions to a scheme that supports polynomially many. Unfortunately, this construction has two drawbacks: 1) the communication between the signer and the user still grows linearly with the number of issued signatures 2) their schemes inherit a very loose security bound from the underlying scheme and, as a result, require impractical parameter sizes.

In this paper, we eliminate these two drawbacks by proposing two highly practical blind signature schemes from the CDH and RSA assumptions. Our resulting schemes have communication which grows only logarithmically in the number of issued signatures. In addition, we introduce new techniques to mitigate the large security loss in the construction of Katz et al. Overall, we obtain the following parameter sizes (providing 128 bits of security):

- Our main scheme PIKA is based on the BLS blind signature scheme (Boldyreva, PKC 2003) and is secure under the \cdh assumption over a standard-sized group. Signatures are of size roughly 3KB and communication per signature is roughly 150KB. - Our RSA-based scheme is based on the Okamoto-Guillou-Quisquater blind signature scheme (Okamoto, CRYPTO 1992). It has signatures and communication of roughly 9KB and 8KB, respectively.
Vadim Lyubashevsky, Ngoc Khanh Nguyen, Maxime Plancon
ePrint Report
Lattice-based blind signature schemes have been receiving some recent attention lately. Earlier efficient 3-round schemes (Asiacrypt 2010, Financial Cryptography 2020) were recently shown to have mistakes in their proofs, and fixing them turned out to be extremely inefficient and limited the number of signatures that a signer could send to less than a dozen (Crypto 2020). In this work we propose a round-optimal, 2-round lattice-based blind signature scheme which produces signatures of length 150KB. The running time of the signing protocol is linear in the maximum number signatures that can be given out, and this limits the number of signatures that can be signed per public key. Nevertheless, the scheme is still quite efficient when the number of signatures is limited to a few dozen thousand, and appears to currently be the most efficient lattice-based candidate.
Josef Pieprzyk, Marcin Pawlowski, Pawel Morawiecki, Arash Mahboubi, Jarek Duda, Seyit Camtepe
ePrint Report
The generation of pseudorandom binary sequences is of a great importance in numerous applications stretching from simulation and gambling to cryptography. Pseudorandom bit generators (PRBGs) can be split into two classes depending on their claimed security. The first includes PRBGs that are provably secure (such as the Blum-Blum-Shub one). Security of the second class rests on heuristic arguments. Sadly, PRBG from the first class are inherently inefficient and some PRBG are insecure against quantum attacks. While, their siblings from the second class are very efficient, but security relies on their resistance against known cryptographic attacks.

This work presents a construction of PRBG from the asymmetric numeral system (ANS) compression algorithm. We define a family of PRBGs for $2^R$ ANS states and prove that it is indistinguishable from a truly random one for a big enough $R$. To make our construction efficient, we investigate PRBG built for smaller $R=7,8,9$ and show how to remove local correlations from output stream. We permute output bits using rotation and Keccak transformations and show that permuted bits pass all NIST tests. Our PRBG design is provably secure (for a large enough $R$) and heuristically secure (for a smaller $R$). Besides, we claim that our PRBG is secure against quantum adversaries.
Amalfi, Italy, 12 September - 14 September 2022
Event Calendar
Event date: 12 September to 14 September 2022
Casablanca, Maroc, 14 July - 16 July 2022
Event Calendar
Event date: 14 July to 16 July 2022
University of Bergen, Department of Informatics; Norway
Job Posting
We look for postdoc in side channel attacks (SCA) for a project in threshold implementation (TI). The position is within RCN project "Threshold Implementation and Boolean Functions" with key members Lilya Budaghyan, Claude Carlet and Vincent Rijmen, and in cooperation with COSIC group at KU Leuven. It is for 3 year period (possible extension to 4 years). For application and more information see https://www.jobbnorge.no/en/available-jobs/job/215372/postdoctoral-research-fellow-position-in-informatics-cryptography

Closing date for applications:

Contact: Prof. Lilya Budaghyan lilya.budaghyan@uib.no

Seoul National University of Science and Technology
Job Posting
Seoul National University of Science and Technology is currently recruiting research professors and the application process ends on January 11. Applicants will be matched with advisors, so they must choose them in advance.
The Cryptography and Information Security Lab, led by Professor Changhoon Lee, is looking for a candidate who is interested in cryptography and information security. The successful candidate will work on research projects, attend lab seminars, and publish SCI(E) papers under the direction of advisor. We expect a successful candidate to be able to publish SCI (E) papers related to hash function and cryptocurrency security.
Required Qualifications:
• Candidate must have recently received a Ph.D. degree (no more than 5 years from the date of obtaining the degree) or expect to receive it before March 1, 2022.
• Candidate must have published 2 or more SCI(E) papers in the last 3 years.
Appointment term and salary:
• Contract term: from appointment date (March 1, 2022) 1 year
• Salary (gross): 39,6 million won per year

Closing date for applications:

Contact: Interested candidates should email professor Changhoon Lee (chlee@seoultech.ac.kr) before January, 9.

• University of Surrey
Job Posting
The Department of Computer Science at the University of Surrey is seeking to appoint a Reader or Senior Lecturer in Software Security to strengthen its research and ambitious strategic growth within the Surrey Centre for Cyber Security (SCCS). This appointment is on a full-time and permanent basis.

The Department of Computer Science has a world-class reputation in cyber security and regularly publishes at top-tier venues. The Department is home to Surrey Centre for Cyber Security (SCCS) and Surrey is only one of four institutions in the UK holding recognition from the National Cyber Security Centre as an Academic Centre of Excellence in both Cyber Security Research and in Cyber Security Education (Gold). SCCS delivers world-leading research expertise in applied cryptography, trusted computing, privacy and authentication, secure communications, blockchain and distributed ledger technologies, and security verification. The Centre includes 16 academics across two research groups: Secure Systems and Distributed and Networked Systems, with around 30 research associates and PhD students. SCCS is leading the recently established Surrey Security Network through which our cross-disciplinary research agenda in cyber security is delivered across the School of Computer Science and Electronic Engineering and across all Faculties of the University. SCCS maintains close links with leading industries, the public sector and governmental bodies, leading to a strong heritage of real-world impact. Our Computer Science BSc programme has been running successfully for many years and continues to attract strong students. The Department offers Information Security MSc and Data Science MSc programmes with growing student numbers. The Department has made significant investment in its facilities with a new 200-seater computer science teaching laboratory, a virtual cloud computing platform, a secure systems facility and an HPC cluster for research.

Research areas of particular interest include (but are not limited to) the following: software security, malware analysis, offensive security. Applicants in related applied areas of research are also invited to apply.

Closing date for applications:

Contact: Steve Schneider (s.schneider@surrey.ac.uk)

Hasso-Plattner-Institute, University of Potsdam (Potsdam/Berlin, Germany)
Job Posting

The Cybersecurity - Identity Management group at the Hasso-Plattner-Institute (HPI), University of Potsdam is looking for motivated PhD students and Postdocs in the area of cryptography and privacy.

Research Topics: Development and analysis of provably secure cryptographic protocols for real-world problems. Topics of interest include (but are not limited to): privacy-enhancing technologies, password-based cryptography, as well as foundations for real-world cryptography.

Requirements: Master’s degree (or PhD for postdoctoral position) in Computer Science, Mathematics, or a related area by the time of appointment. Profound knowledge and interest in the areas of cryptography and IT security. Fluency in English (written and spoken).

There are two types for the positions: One comes with a teaching obligation for which also sufficient German language skills are required. Review of applicants will start immediately until the position is filled. The starting date is flexible. The other is through the scholarship program of the HPI. Deadline for scholarship applications is February 1st, and the positions usually start around April.

We look forward to your application including a CV and motivation letter. Applications for the PhD position should also include a list of attended Master courses and grades, whereas applications for the Postdoc position should include contact information for two references. Please submit your application documents (only as PDF) via email, and indicate whether you are interested in a scholarship or teaching position.

Closing date for applications:

Contact: Anja Lehmann (firstname.lastname@hpi.de)

03 January 2022

SUTD, Singapore
Job Posting
iTrust is a Cyber Security Research Center in SUTD and a National Satellite of Excellence in Singapore for securing critical infrastructure. iTrust hosts the world-class cyber-physical system (CPS) testbeds which are used for research, education, training, live-fire exercise, and technology validation.

We are looking for postdocs / research fellows with expertise on cybersecurity in general and CPS security in particular. The candidates should have track record of strong R&D capability, with publications at leading security conferences. The candidates familiar with shipboard OT systems or autonomous vehicles will be considered with the priority. Candidate working in the current position less than one year will not be considered (unless due to the end of contract). Fresh PhD graduates are welcome. Only short-listed candidates will be contacted for interview. Successful candidates will be offered internationally competitive remuneration.

Interested candidates please send your CV to Prof. Jianying Zhou. Email: jianying_zhou (at) sutd.edu.sg. Home: http://jianying.space/

Closing date for applications:

Contact: Prof. Jianying Zhou

01 January 2022

Fabrice Benhamouda, Tancrède Lepoint, Michele Orrù, Mariana Raykova
ePrint Report
We present a new construction for publicly verifiable anonymous tokens with private metadata. This primitive enables an issuer to generate an anonymous authentication token for a user while embedding a single private metadata bit. The token can be publicly verified, while the value of the private metadata is only accessible to the party holding the secret issuing key and remains hidden to any other party, even to the user. The security properties of this primitive also include unforgeability, which guarantees that only the user can generate new valid tokens, and unlinkability that guarantees that tokens issued with the same private metadata bit are indistinguishable. Our anonymous tokens scheme builds on the top of blind Schnorr signatures.

We analyze its security in the algebraic group model and prove its security under the modified ROS assumption, one-more discrete logarithm, and decisional Diffie-Hellman assumptions.
Rutchathon Chairattana-Apirom, Anna Lysyanskaya
ePrint Report
Blind signature schemes are one of the best and best-studied tools for privacy-preserving authentication. It has a blind signing protocol in which a signer learns nothing about the message being signed or the resulting signature; thus such a signature can serve as an anonymous authentication token. Thus, constructing efficient blind signatures secure under realistic cryptographic assumptions is an important goal.

A recent paper by Benhamouda, Lepoint, Loss, Orr\`u, and Raykova (Eurocrypt '21) showed that a large class of blind signature schemes secure in the stand-alone setting are no longer secure when multiple instances of the blind signing protocol are executed concurrently. The best known technique to salvage the security of such blind signatures was recently proposed by Katz, Loss, and Rosenberg (Asiacrypt '21). For the security parameter $\kappa$, their technique transforms blind signature schemes that are secure for $\mathcal{O}(\log \kappa)$ concurrent executions of the blind signing protocol into ones that are secure for any $N = \mathsf{poly}(\kappa)$ concurrent executions. The resulting, transformed blind signing protocol needs $\mathcal{O}(N)$ times more computation and communication than the original one.

In this paper, we give an improved transform for obtaining a secure blind signing protocol tolerating $N = \mathsf{poly}(\kappa)$ concurrent executions from one that is secure for $\mathcal{O}(\log \kappa)$ concurrent executions. Our technique still needs $\mathcal{O}(N)$ times more computation, but only $\mathcal{O}(\log N)$ more communication than the original blind signature.