International Association
for Cryptologic Research

Verifiable random functions (Micali et al., FOCS'99) allow a key-pair holder to verifiably evaluate a pseudorandom function under that particular key pair. These primitives enable fair and verifiable pseudorandom lotteries, essential in proof-of-stake blockchains such as Algorand and Cardano, and are being used to secure billions of dollars of capital. As a result, there is an ongoing IRTF effort to standardize VRFs, with a proposed ECVRF based on elliptic-curve cryptography appearing as the most promising candidate.

In this work, towards understanding the general security of VRFs and in particular the ECVRF construction, we provide an ideal functionality in the Universal Composability (UC) framework (Canetti, FOCS'01) that captures VRF security, and show that ECVRF UC-realizes this functionality.

We further show how the range of a VRF can generically be extended in a modular fashion based on the above functionality. This observation is particularly useful for protocols such as Ouroboros since it allows to reduce the number of VRF evaluations (per slot) and VRF verifications (per block) from two to one at the price of additional (but much faster) hash-function evaluations.

Finally, we study batch verification in the context of VRFs. We provide a UC-functionality capturing a VRF with batch-verification capability, and propose modifications to ECVRF that allow for this feature. We again prove that our proposal UC-realizes the desired functionality. We provide a performance analysis showing that verification can yield a factor-two speedup for batches with 1024 proofs, at the cost of increasing the proof size from 80 to 128 bytes.

Many online applications, such as online file backup services, support the sharing of indexed data between a set of devices. These systems may offer client-side encryption of the data, so that the stored data is inaccessible to the online host. A potentially desirable goal in this setting would be to protect not just the contents of the backed-up files, but also their identifiers. However, as these identifiers are typically used for indexing, a deterministic consistent mapping across devices is necessary. Additionally, in a multi-device setting, it may be desirable to maintain an ability to revoke a device’s access—e.g. through rotating encryption keys for new data.

We present a new primitive, called the Oblivious Revocable Function (ORF), which operates in the above setting and allows identifiers to be obliviously mapped to a consistent value across multiple devices, while enabling the server to permanently remove an individual device’s ability to map values. This permits a stronger threat model against metadata, in which metadata cannot be derived from identifiers by a revoked device colluding with the service provider, so long as the service provider was honest at the instant of revocation. We describe a simple Diffie- Hellman-based construction that achieves ORFs and provide a proof of security under the UC framework.

We present experimental findings on the decoding failure rate (DFR) of BIKE, a fourth-round candidate in the NIST Post-Quantum Standardization process, at the 20-bit security level. We select parameters according to BIKE design principles and conduct a series of experiments. We directly compute the average DFR on a range of BIKE block sizes and identify both the waterfall and error floor regions of the DFR curve. We then study the influence on the average DFR of three sets $\mathcal{C}$, $\mathcal{N}$, and $2\mathcal{N}$ of near-codewords --- vectors of low weight that induce syndromes of low weight --- defined by Vasseur in 2021. We find that error vectors leading to decoding failures have small maximum support intersection with elements of these sets; further, the distribution of intersections is quite similar to that of sampling random error vectors and counting the intersections with $\mathcal{C}$, $\mathcal{N}$, and $2\mathcal{N}$. Our results indicate that these three sets are not sufficient in classifying vectors expected to cause decoding failures. Finally, we study the role of syndrome weight on the decoding behavior and conclude that the set of error vectors that lead to decoding failures differ from random vectors by having low syndrome weight.

Lightweight cryptography is characterized by the need for low implementation cost, while still providing sufficient security. This requires careful analysis of building blocks and their composition. SKINNY is an ISO/IEC standardized family of tweakable block ciphers and is used in the NIST lightweight cryptography standardization process finalist Romulus. We present non-trivial linear approximations of two- round SKINNY that have correlation one or minus one and that hold for a large fraction of all round tweakeys. Moreover, we show how these could have been avoided.

This note discusses lattice-based cryptography over the field with $p= 2^{64} - 2^{32} + 1$ elements, with an eye to supporting lattice-based cryptography operations in virtual machines such as Miden VM that operate natively over this field. It discusses how to support Dilithium and Falcon, two lattice-based signature scheme recently selected by the NIST PQC project; and proposes parameters for efficient public key encryption and publicly re-randomizable commitments modulo $p$.

The emergence of distributed digital currencies has raised the need for a reliable consensus mechanism. In proof-of-stake cryptocur- rencies, the participants periodically choose a closed set of validators, who can vote and append transactions to the blockchain. Each valida- tor can become a leader with the probability proportional to its stake. Keeping the leader private yet unique until it publishes a new block can significantly reduce the attack vector of an adversary and improve the throughput of the network. The problem of Single Secret Leader Election (SSLE) was first formally defined by Boneh et al. in 2020. In this work, we propose a novel framework for constructing SSLE proto- cols, which relies on secure multi-party computation (MPC) and satisfies the desired security properties. Our framework does not use any shuffle or sort operations and has a computational cost for N parties as low as O(N) of basic MPC operations per party. We improve the state-of-the- art for SSLE protocols that do not assume a trusted setup. Moreover, our SSLE scheme efficiently handles weighted elections. That is, for a total weight S of N parties, the associated costs are only increased by a factor of logS. When the MPC layer is instantiated with techniques based on Shamir’s secret-sharing, our SSLE has a communication cost of O(N2) which is spread over O(log N) rounds, can tolerate up to t < N/2 of faulty nodes without restarting the protocol, and its security relies on DDH in the random oracle model. When the MPC layer is instantiated with more efficient techniques based on garbled circuits, our SSLE re- quires all parties to participate, up to N − 1 of which can be malicious, and its security is based on the random oracle model.

The 2022 election is being held to fill four Officer positions and three of nine Director positions.

Nominations are due by October 1st, 2022.

Information about the vacant positions and the nomination process is available at https://iacr.org/elections/2022/announcement.html.

The Coding Theory and Cryptology group is looking for an excellent candidate for a fully funded Ph.D. position as part of QSI (Quantum-Safe Internet), a Marie Curie Innovative Training Network (MSCA-ITN). The QSI network involves top-ranking partner universities from France, Italy, Germany, the Netherlands, Denmark, Spain, the UK, and Switzerland, as well as industrial partners.

You will conduct research at the intersection of quantum and post-quantum cryptography and publish/present the results at top venues for research in crypto/IT Security. This is a joint doctorate, supervised by A. Hülsing, K. Hövelmanns and B. Škorić.

You must meet the following requirements:

• Master’s degree or equivalent in computer science, mathematics, or a related field.
• Outstanding grades in classes related to cryptography, IT security, theoretical CS, or mathematics. (Familiarity with provable security and/or a strong mathematical background are a plus.)
• Excellent communication/writing skills in English. (No Dutch required.)
• Compliance with the MSCA-ITN mobility rule: You must not have resided or carried out your main activity (work, studies, etc.) in the Netherlands for more than 12 months in the 36 months immediately before your recruitment date.

We offer:

• Full-time employment for the duration of the PhD (four years at TU/e).
• A well-rounded training offered by the QSI network, covering a range of topics related to secure communications in the quantum era, as well as complementary training intended to enhance your personal development.
• Generous travel budget that allows for, e.g., exposure to different sectors via planned placements and attendance to summer schools.
• Salary and benefits in accordance with the collective labour agreement for Dutch universities. Candidates from abroad can be eligible to an additional tax reduction scheme.

The positions is to be filled as soon as possible. We strongly encourage applications from members of any underrepresented group in our research area.

Closing date for applications:

Contact: To apply or for questions, use itn-applications@huelsing.net. Applications should contain (in a single PDF):

• Cover letter describing your research interests
• CV, including transcripts
• Contact details of 2-3 potential references

The Cybersecurity and AI Group led by Prof. Gerhard Wunder (https://www.mi.fu-berlin.de/en/inf/groups/ag-comm/index.html/) and the Information Security Group led by Prof. Marian Margraf (https://www.mi.fu-berlin.de/inf/groups/ag-idm/index.html/) at Freie Universität Berlin are looking for one PhD student in the area of cryptographic security, post-quantum codes and signatures.

The position is connected to UltraSec, which is a research project focusing on the immensely potential Ultra Wide Band (UWB) wireless technology. The collaborative project consists of partners from leading academia, IoT and security centric startup, research institute, and industry. The PhD candidate contributes to the theoretical foundations, design, and implementation of security architecture for UWB based IoT-development platform thereby closely collaborating with the partners in the consortium. Candidates are expected to co-author articles published in high-quality academic venues such as IEEE/ACM conferences and journals. Within the framework of the externally funded research project, the opportunity for writing a doctoral-thesis is granted.

Your profile

• Applicants must possess a master degree in computer science, mathematics, electrical engineering or similar.
• Solid mathematical background in classical cryptography, post-quantum cryptography, and good coding skills in C/Go/Rust/Python/MATLAB is desirable.
• General understanding of coding quality and solid practice of source code and project management tools (Git, Travis-CI etc) is a plus.
• Moreover, the candidate should be able and willing to work and cooperate with the members of group and the project consortium.

Starting Date: October/ November 2022.

Further information can be found here: https://www.mi.fu-berlin.de/en/inf/groups/ag-comm/open-positions/wimis/index.html

Closing date for applications:

Contact: Applications including all the relevant documents should be sent electronically by e-mail to g.wunder@fu-berlin.de (cc: stefanie.bahe@fu-berlin.de), preferably as a single pdf-document.

More information: https://www.mi.fu-berlin.de/en/inf/groups/ag-comm/open-positions/wimis/index.html

Simula UiB is a research centre in Cryptography and Information Theory located in Bergen, Norway. We are currently looking for an outstanding candidate for a 4-year PhD researcher position in the area of symmetric-key cryptography. The successful candidate will work under the supervision of Prof Carlos Cid, towards a PhD degree from the University of Bergen. The research topic will be one of the following:

• Design and analysis of dedicated symmetric-key ciphers for privacy-preserving mechanisms (e.g. MPC, FHE, ZKP schemes); or,
• Quantum cryptanalysis of symmetric-key primitives.

We are looking for a candidate who has recently completed, or is about to complete, a master’s degree in cryptography, mathematics, or a closely related field. The master’s degree must have been awarded, with good results, before their start in the PhD position – in particular the candidate must satisfy the enrolment requirements for the PhD programme at the University of Bergen. The candidate must be highly motivated and be able to demonstrate their potential for conducting original research in cryptography. Simula UiB currently has 13 Early Career Researchers working on a range of research problems in cryptography and information theory and can offer a vibrant, stimulating and inclusive working environment to the successful candidate.

Interested and qualified candidates should apply at https://www.simula.no/about/job/phd-student-symmetric-key-cryptography
Deadline for application is 31 October 2022; however applications will be screened continuously, and we may conclude recruitment as soon as we find the right candidate. The starting date is negotiable.

Closing date for applications:

Contact: For additional enquiries about this position, please contact Carlos Cid (carlos@simula.no)

More information: https://www.simula.no/about/job/phd-student-symmetric-key-cryptography

We are looking for a motivated research engineer to join the cybersecurity and applied cryptography group at the university of St. Gallen.
More specifically, the job includes:

• Development and implementation of concepts and research results, both individually and in collaboration with researchers and PhD students;
• Run of experiments and simulation of realistic conditions to test the performance of developed algorithms and protocols;
• Development, maintenance and organization of software;
• Support to BSc, MSc and PhD students, postdocs and researchers who use the lab;
• Responsibility for day routines in the lab, for example purchases, installations, bookings, inventory;

Your profile:

We are looking for a strongly motivated and self-driven person who is able to work and learn new things independently.

Good command of English is required.

You should have a good academic track record and well developed analytical and problem solving skills.

Excellent programming skills and familiarity with cryptographic libraries.

Previous experience in implementation projects with C++, Matlab, Python is desired.

Deadline: 31 August 2022 Apply online: https://jobs.unisg.ch/offene-stellen/cryptography-engineer-m-w-d/ccfd1b3a-e89c-4918-81e7-478348b0c48d

Closing date for applications:

Contact: Katerina Mitrokotsa

More information: https://jobs.unisg.ch/offene-stellen/cryptography-engineer-m-w-d/ccfd1b3a-e89c-4918-81e7-478348b0c48d

We are looking for a bright and motivated PhD student for a 3-year fully funded PhD position starting 1 November 2022 (negotiable). The project is financed by the Independent Research Fund Denmark, and it is a collaboration between DTU, the University of Cambridge, the University of Colorado, Colorado Springs, and Telenor Denmark. It is an excellent opportunity to be involved in advanced research on cyber-security, with important practical applications.

The project’s emphasis will be on digital ghost ships (DGS). A DGS is defined as any online resource (e.g. an IoT device) that has been connected to the Internet and has been subsequently abandoned (in terms of management, updates, or security patches). Hence, DGS may include systems with default usernames and passwords as well as systems that lack important security updates. We aim at proposing novel ways for identifying such DGS, which is the first step into making them secure or taking them down. To do this, the project will not only research novel network detection techniques but also examine how human psychology plays a role in creating DGS.

Closing date for applications:

Contact: Emmanouil Vasilomanolakis

More information: https://www.compute.dtu.dk/english/sitecore/indhold/dtu/dtuenglish-old/forside/about/job-and-career/vacant%20positions/job?id=5ffc257d-616c-4f97-b39d-d16d483459c3

The Ph.D. will focus on discovering new security threats introduced by cloud FPGAs and developing new secure architectures to safeguard cloud infrastructures and their users. A secure deployment strategy of cloud FPGAs will be developed; it should cover all known security threats and new security threats discovered during the project. The overall research project will be conducted on both local experimental setups and online real-world FPGA-integrated cloud environments.

Requirements: PhD candidates are required to have a master degree in computer science, mathematics, electrical engineering, or comparable areas. Candidates that are expected to finish their M.Sc. thesis in the near future can also apply. Candidates should have a clear interest in fundamental research, should be creative and solid in their research, should have (potential) interest in computer security and computer engineering, and should be able to cooperate with experts from different disciplines. It is essential that you have good academic writing and presentation skills. Candidates are expected to have an excellent command of English.

Information and application: The application deadline is 31 August 2022. All applications should include a motivation letter, a detailed CV, and a list of grades and courses.

Interested candidate can learn more information at https://www.cwi.nl/jobs/vacancies/946698

Closing date for applications:

Contact: Dr. Chenglu Jin, chenglu.jin@cwi.nl

More information: https://www.cwi.nl/jobs/vacancies/946698

Do you want to work with us to make society better secured against digital threats? "I want a job that is challenging, socially useful and creative!" This is something we often hear when we ask why job seekers have chosen us. Many of the world's challenges must be solved with technology and at SINTEF we want that to happen in a sustainable way. And we are lucky, many people know that SINTEF is concerned that our work should have a societal benefit. Right now we have a senior researcher position available in cyber security! Our focus areas are: -risk assessment and incident management -secure software development and testing -built-in privacy and GDPR -critical infrastructure -security in cyber-physical systems and IoT -security in 5G and other communication technologies -We currently have projects in several domains: aviation, petroleum, -maritime industry, health, public services and software development.

Closing date for applications:

Contact: Per Håkon Meland

More information: https://candidate.hr-manager.net/ApplicationInit.aspx?cid=1131&ProjectId=145153&DepartmentId=18961&MediaId=5

Can we hope to provide provable security against model extraction attacks? As a step towards a theoretical study of this question, we unify and abstract a wide range of "observational" model extraction defense mechanisms -- roughly, those that attempt to detect model extraction using a statistical analysis conducted on the distribution over the adversary's queries. To accompany the abstract observational model extraction defense, which we call OMED for short, we define the notion of complete defenses -- the notion that benign clients can freely interact with the model -- and sound defenses -- the notion that adversarial clients are caught and prevented from reverse engineering the model. We then propose a system for obtaining provable security against model extraction by complete and sound OMEDs, using (average-case) hardness assumptions for PAC-learning. Our main result nullifies our proposal for provable security, by establishing a computational incompleteness theorem for the OMED: any efficient OMED for a machine learning model computable by a polynomial size decision tree that satisfies a basic form of completeness cannot satisfy soundness, unless the subexponential Learning Parity with Noise (LPN) assumption does not hold. To prove the incompleteness theorem, we introduce a class of model extraction attacks called natural Covert Learning attacks based on a connection to the Covert Learning model of Canetti and Karchmer (TCC '21), and show that such attacks circumvent any defense within our abstract mechanism in a black-box, nonadaptive way. Finally, we further expose the tension between Covert Learning and OMEDs by proving that Covert Learning algorithms require the nonexistence of provable security via efficient OMEDs. Therefore, we observe a "win-win" result by obtaining a characterization of the existence of provable security via efficient OMEDs by the nonexistence of natural Covert Learning algorithms.

We show that we can break SIDH in polynomial time, even with a random starting curve~$E_0$.

This work presents RPM, a scalable anonymous communication protocol suite using secure multiparty computation (MPC) with the offline-online model. We generate random, unknown permutation matrices in a secret-shared fashion and achieve improved (online) performance and the lightest communication and computation overhead for the clients compared to the state of art robust anonymous communication protocols. Using square-lattice shuffling, we make our protocol scale well as the number of clients increases. We provide three protocol variants, each targeting different input volumes and MPC frameworks/libraries. Besides, due to the modular design, our protocols can be easily generalized to support more MPC functionalities and security properties as they get developed. We also illustrate how to generalize our protocols to support two-way anonymous communication and secure sorting. We have implemented our protocols using the MP-SPDZ library suit and the benchmark illustrates that our protocols achieve unprecedented online phase performance with practical offline phases.

Multi-signatures are protocols that allow a group of signers to jointly produce a single signature on the same message. In recent years, a number of practical multi-signature schemes have been proposed in the discrete-log setting, such as MuSigT (CRYPTO'21) and DWMS (CRYPTO'21). The main technical challenge in constructing a multi-signature scheme is to achieve a set of several desirable properties, such as (1) security in the plain public-key (PPK) model, (2) concurrent security, (3) low online round complexity, and (4) key aggregation. However, previous lattice-based, post-quantum counterparts to Schnorr multi-signatures fail to satisfy these properties.

In this paper, we introduce MuSigL, a lattice-based multi-signature scheme simultaneously achieving these design goals for the first time. Unlike the recent, round-efficient proposal of Damgård et al. (PKC'21), which had to rely on lattice-based trapdoor commitments, we do not require any additional primitive in the protocol, while being able to prove security from the standard module-SIS and LWE assumptions. The resulting output signature of our scheme therefore looks closer to the usual Fiat--Shamir-with-abort signatures.

Secure multiparty computation can often utilize a trusted source of correlated randomness to achieve better efficiency. A recent line of work, initiated by Boyle et al. (CCS 2018, Crypto 2019), showed how useful forms of correlated randomness can be generated using a cheap, one-time interaction, followed by only "silent" local computation. This is achieved via a pseudorandom correlation generator (PCG), a deterministic function that stretches short correlated seeds into long instances of a target correlation. Previous works constructed concretely efficient PCGs for simple but useful correlations, including random oblivious transfer and vector-OLE, together with efficient protocols to distribute the PCG seed generation. Most of these constructions were based on variants of the Learning Parity with Noise (LPN) assumption. PCGs for other useful correlations had poor asymptotic and concrete efficiency.

In this work, we design a new class of efficient PCGs based on different flavors of the ring-LPN assumption. Our new PCGs can generate OLE correlations, authenticated multiplication triples, matrix product correlations, and other types of useful correlations over large fields. These PCGs are more efficient by orders of magnitude than the previous constructions and can be used to improve the preprocessing phase of many existing MPC protocols.

Impossible differential (ID) cryptanalysis is one of the most important attacks on block ciphers. The Mixed Integer Linear Programming (MILP) model is a popular method to determine whether a specific difference pair is an ID. Unfortunately, due to the huge search space (approximately $2^{2n}$ for a cipher with a block size $n$ bits), we cannot leverage this technique to exhaust all difference pairs, which is a well-known long-standing problem.

In this paper, we propose a systematic method to find all IDs for SPN block ciphers. The idea is to partition the whole difference pair space into lots of small disjoint sets, each of which has a representative difference pair. All difference pairs in one small set are possible if its representative pair is possible, and this can be conveniently checked by the MILP model. In this way, the overall search space is drastically reduced to a practical size by excluding the sets containing no IDs. We then examine the remaining difference pairs to identify all IDs (if some IDs exist). If our method cannot find any ID, the target cipher is proved free of ID distinguishers.

Our method works especially well for SPN ciphers with block size 64. We apply our method to SKINNY-64 and successfully find all 432 and 12 truncated IDs (we find all IDs but all of them can be assembled into certain truncated IDs) for 11 and 12 rounds, respectively. We also prove, for the first time, that 13-round SKINNY-64 is free of ID distinguishers even when considering the differential transitions through the Difference Distribution Table (DDT). Similarly, we find all 12 truncated IDs (all IDs are assembled into 12 truncated IDs) for 13-round CRAFT and prove there is no ID for 14 rounds. For SbPN cipher GIFT-64, we prove that there is no ID for 8 rounds.

For SPN ciphers with larger block sizes, we show that our idea is also useful to strengthen the current search methods. For example, if we consider the Sbox to be ideal and only consider the branch number information of the diffusion matrix, we can find all 6,750 truncated IDs for 6-round Rijndael-192 in 1 second and prove that there is no truncated ID for 7 rounds. Previously, we need to solve approximately $2^{48}$ MILP models to achieve the same goal. For GIFT-128, we exhausted all difference patterns that have an active superbox in the plaintext and ciphertext and proved there is no ID of such patterns for 8 rounds.

Although we have searched for a larger or even full space for IDs, no longer ID distinguishers have been found. This implies the reasonableness of the intuition that a small number (usually one or two) of active bits/words at the beginning and end of an ID will be the longest.