International Association
for Cryptologic Research

ANSI X9.24-1:2009 specifies the key check value, which is used to verify the integrity of the blockcipher key. This value is defined as the most significant bits of the ciphertext of the zero block, and is assumed to be publicly known data for verification. ISO/IEC 9797-1:2011 illustrates a total of ten CBC MACs, where one of these MACs, the basic CBC MAC, is widely known to be insecure. In this paper, we consider the remaining nine CBC MACs and derive the quantitative security impact of using the key check value. We first show attacks against five MACs by taking advantage of the knowledge of the key check value. We then prove that the analysis is tight, in a concrete security paradigm. For the remaining four MACs, we prove that the standard birthday bound still holds even with the presence of the key check value. As a result, we obtain a complete characterization of the impact of using ANSI X9.24-1 key check value with the ISO/IEC 9797-1 MACs.

Secret sharing schemes split a secret into multiple shares that are usually distributed to distinct participants with the goal that only authorized subsets of participants can recover it. We show that SETUP (Secretly Embedded Trapdoor with Universal Protection) attack can be embedded in schemes that employ enough randomness to give the attacker an overwhelming advantage to access the secret. In case of ideal schemes, a coalition of a few participants (within at least one is the attacker) can succeed the attack, while in case of non-ideal schemes the attacker knowledge can be enough to reveal the secret. We exemplify the proposed attack against Shamir\'s threshold scheme, as being the most well-known and used secret sharing scheme. Finally, we consider some prevention techniques against the attack.

We are among the first to systematically investigate (memory-trace) oblivious data structures. We propose a framework for constructing a variety of oblivious data structures, achieving asymptotic performance gains in comparison with generic Oblivious RAM (ORAM). We evaluate the performance of our oblivious data structures in terms of their bandwidth over- heads, and also when applied to a secure computation setting. Finally, we leverage our new framework to design an efficient oblivious memory allocator which is particularly useful due to the community\'s recent efforts in compiling programs targeting ORAM-capable secure processors.

Submission: 20 June 2014
Notification: 23 July 2014
From October 9 to October 10
Location: Hong Kong, Hong Kong
More Information: http://home.ie.cuhk.edu.hk/~provsec14/

Submission: 19 March 2014
Notification: 19 May 2014
From September 8 to September 12
Location: Fribourg, Switzerland
More Information: http://www.ares-conference.eu

RC4 is the most widely used stream cipher around. So, it is important that it runs cost effectively, with minimum encryption time. In other words, it should give higher throughput. In this paper, a mechanism is proposed to improve the throughput of RC4 algorithm in multicore processors using multithreading. The proposed mechanism does not parallelize RC4, instead it introduces a way that multithreading can be used in encryption when the plaintext is in the form of a text file. In this particular research, the source codes were written in Java (JDK version: 1.6.0_21) in Windows environments. Experiments to analyze the throughput were done separately in an Intel® P4 machine (O/S: Windows XP), Core 2 Duo machine (O/S: Windows XP) and Core i3 machine (O/S: Windows 7).

Outcome of the research: Higher throughput of RC4 algorithm can be achieved in multicores when using the proposed mechanism in this research. Effective use of multithreading in encryption can be achieved in multicores using this technique.

In this paper, we propose new non-monotonic attribute-based encryption schemes with compact parameters.

The first three schemes are key-policy attribute-based encryption (KP-ABE) and the fourth scheme is ciphertext-policy attribute-based encryption (CP-ABE) scheme.

\\begin{itemize}

\\item Our first scheme has very compact ciphertexts. The ciphertext overhead only consists of two group elements and this is the shortest in the literature.

Compared to the scheme by Attrapadung et al. (PKC2011), which is the best scheme in terms of the ciphertext overhead, our scheme shortens ciphertext overhead by $33\\%$.

The scheme also reduces the size of the master public key to about half.

\\item Our second scheme is proven secure under the decisional bilinear Diffie-Hellman (DBDH) assumption, which is one of the most standard assumptions in bilinear groups. Compared to the non-monotonic KP-ABE scheme from the same assumption by Ostrovsky et al. (ACM-CCS\'07), our scheme achieves more compact parameters. The master public key and the ciphertext size is about the half that of their scheme.

\\item Our third scheme is the first non-monotonic KP-ABE scheme that can deal with unbounded size of set and access policies. That is, there is no restriction on the size of attribute sets and

the number of allowed repetition of the same attributes which appear in an access policy.

The master public key of our scheme is very compact: it consists of only constant number of group elements.

\\item Our fourth scheme is the first non-monotonic CP-ABE scheme that can deal with unbounded size of set and access policies. The master public key of the scheme consists of only constant number of group elements.

\\end{itemize}

We construct our KP-ABE schemes in a modular manner.

We first introduce special type of predicate encryption that we call two-mode identity based broadcast encryption (TIBBE).

Then, we show that any TIBBE scheme that satisfies certain condition can be generically converted into non-monotonic KP-ABE scheme.

Finally, we construct efficient TIBBE schemes and apply this conversion to obtain the above new non-monotonic KP-ABE schemes.

Simple side-channel attacks trade off data complexity (i.e. the number of side-channel observations needed for a successful attack) with computational complexity (i.e. the number of operations applied to the side-channel traces). In the specific example of Simple Power Analysis (SPA) attacks on the Advanced Encryption Standard (AES), two approaches can be found in the literature, one which is a pragmatic approach that involves basic techniques such as efficient enumeration of key candidates, and one that is seemingly more elegant and uses algebraic techniques. Both of these different techniques have been used in complementary settings: the pragmatic attacks were solely applied to the key schedule whereas the more elegant methods were only applied to the encryption rounds. In this article, we investigate how these methods compare in what we consider to be a more practical setting in which adversaries gain access to erroneous information about both key schedule and encryption rounds. We conclude that the pragmatic enumeration technique better copes with erroneous information which makes it more interesting in practice.

We initiate the study of the following problem:

Suppose Alice and Bob would like to outsource their encrypted private data sets to the cloud, and they also want to conduct the set intersection operation on their plaintext data sets. The straightforward solution for them is to download their outsourced ciphertexts, decrypt the ciphertexts locally, and then execute a commodity two-party set intersection protocol. Unfortunately, this solution is not practical.

We therefore motivate and introduce the novel notion of {\\em Verifiable Delegated Set Intersection on outsourced encrypted data} (VDSI).

The basic idea is to delegate the set intersection operation to the cloud, while (i) not giving the decryption capability to the cloud,

and (ii) being able to hold the misbehaving cloud accountable.

We formalize security properties of VDSI and present a construction.

In our solution, the computational and communication costs on the users are linear to the size of the intersection set,

meaning that the efficiency is optimal up to a constant factor.

We study a method for key predistribution in a network of $n$ users where pairwise keys are computed by hashing users\' IDs along with secret information that has been (pre)distributed to the network users by a trusted entity. A communication graph $G$ can be specified to indicate which pairs of users should be able to compute keys. We determine necessary and sufficient conditions for schemes of this type to be secure. We also consider the problem of minimizing the storage requirements of such a scheme; we are interested in the total storage as well as the maximum storage required by any user. Minimizing the total storage is NP-hard, whereas minimizing the maximum storage required by a user can be computed in polynomial time.

In this paper, analysis of a simply modified RC4 algorithm is presented. RC4 is the most widely used stream cipher and it is not considered as a cipher that is strong in security. Many alternatives have been proposed to improve RC4 key generation and pseudo random number generation but the thoughts behind this work is to try out a simple modification of RC4\'s PRGA, where we can mention like this:

Output = M XOR GeneratedKey XOR j

After having done the modification the modified algorithm is tested for its secrecy and performance and analyzed over the variable key length with respect to those of the original RC4. The results show that the modified algorithm is better than the original RC4 in the aspects of secrecy and performance.

In open literature there is a lack of focus on Shannon\'s secrecy of ciphers as a security measurement of symmetric key encryption, hence in this research, Shannon\'s theories on secrecy of ciphers were used to calculate the average secrecy of each symmetric cipher used in this research. All secrecy and performance analysis were done using a newly created tool. Analysis is done based on the secrecy level and performance of the algorithm. This paper presents an analysis of some of the widely used symmetric key algorithms which fall under the categories of block and stream ciphers together with the two combined algorithms. [DES, TripleDES, AES, RC2, RC4, Hybrid1(TripleDES+RC4) and Hybrid2 (AES+RC4) are used]. Analysis is pivoted around on two measurement criteria under two circumstances which are described later in this paper. All the algorithms are implemented in Core Java

using classes available in JAVA package javax.crypto. Separate classes are written to calculate the secrecy of ciphers and the encryption time. And also the tool is created using Core Java with the help of Netbeans IDE. As far as the outcome of the research is concerned, the performances of all stream ciphers are higher than that of block ciphers and the combined algorithms have similar performance level to block ciphers. Secrecy levels of block ciphers are comparatively higher than that of stream ciphers as the history says, it is further proved by Shannon\'s theories in this research. The combined algorithms have more stable secrecy levels.

In this work, we explore the connection between witness indistinguishability (WI) and indistinguishability obfuscation (iO). We construct a one-round witness indistinguishable protocol for all of NP based on the the existence of indistinguishability obfuscator (the first candidate construction of indistinguishability obfuscator was recently put forward by Garg et.al. in 2013). Based on our one-round WI, we also

construct a two-round oblivious transfer (OT) protocol and by a slight modification of our OT protocol, we get a noninteractive bit commitment scheme.

Job Opening ID: 93077

Please see the job posting at UMJOBS.ORG for the full description, salary range, and requirements.

ALL APPLICANTS MUST APPLY DIRECTLY TO THE UNIVERSITY OF MICHIGAN AT UMJOBS.ORG. APPLICATIONS SUBMITTED ELSEWHERE WILL NOT BE CONSIDERED.

Job Summary

UMTRI is currently establishing a world-class transportation cyber-security team. For this team we seek motivated, energetic, independently working team players. The incumbent for this position will assist in the design, and development of Cybersecurity project plans, and tests. Hands-on security system penetration strategies will be tested along with security strategies for projects housed at the University of Michigan Transportation Research Institute (UMTRI)l, including work for industrial partners, government sponsors and the Safety Pilot Model Deployment (http://safetypilot.umtri.umich.edu/) project. The successful candidate for this position will be required to interact with sponsors and other engineering and technical staff, prepare components of related research proposals, and other plans related to large cyber security projects. You will also prepare documentation and participate in the development of publications and technical reports.

Additional Information

Please visit the posting on UMJOBS.ORG for more information regarding require and desired qualifications, underfill requirements and the mandatory background screening.

U-M EEO/AA Statement

The University of Michigan is an equal opportunity/affirmative action employer.

Submission: 6 April 2014
Notification: 18 May 2014
From September 22 to September 24
Location: Lublin, Poland
More Information: http://www.css.umcs.lublin.pl

Job Opening ID: 93081

Please see the job posting at UMJOBS.ORG for the full description, salary range, and requirements.

ALL APPLICANTS MUST APPLY DIRECTLY TO THE UNIVERSITY OF MICHIGAN AT UMJOBS.ORG. APPLICATIONS SUBMITTED ELSEWHERE WILL NOT BE CONSIDERED.

Job Summary

UMTRI is currently establishing a world-class transportation cyber-security team. For this team we seek motivated, energetic, independently working team players. The successful candidate for this position will lead and manage the design, planning, coordination, staffing, development and testing of large cyber-security projects at the University of Michigan Transportation Research Institute (UMTRI), including work for industrial partners, government sponsors and Safety Pilot Model Deployment (http://safetypilot.umtri.umich.edu/). The successful incumbent will be required to interact with sponsors, industry partners, principal investigators, other engineering and technical staff, and project stakeholders in defining project scope, preparation of components of related research proposals, and other plans related to cyber security projects. The incumbent will be expected to prepare documentation and participate in the development of publications and technical reports, and present results.

Duties will also include supervision and management of programming and engineering staff on project planning, development, integration and execution. At the senior level, experience in the area of project design and deployment is included, but leadership will not include supervision of 3+ programmers and/or engineers.

Additional Information:

Please visit the posting on UMJOBS.ORG for more information regarding required and desired qualifications, underfill requirements, and the mandatory background screening.

U-M EEO/AA Statement

The University of Michigan is an equal opportunity/affirmative action employer.

The Institute of Technology at the University of Washington Tacoma has been undergoing unprecedented growth due to the high demand for its programs. We are seeking a highly motivated, full-time lecturer for its Computer Engineering and Systems program. This position requires a Master’s degree or higher or foreign equivalent in Computer Engineering or a closely related field. Commitment to high-quality teaching and excellent communication skills are also required. This is a 9-month renewable position with appointment terms of 1-5 years and begins on September 16, 2014. Candidates with experience in the industry, especially with embedded systems design are encouraged to apply. The successful candidate will have demonstrated capabilities teaching embedded and real-time systems, digital system design, or VLSI design. We seek individuals who have a balance of hardware and software teaching experience (MATLAB, Verilog, VHDL, C/C++). Currently the emphasis of the program is on embedded systems; however we anticipate developing additional tracks in the near future to accommodate the breadth of demand for our graduates.Applicants should include (1) a cover letter describing academic qualifications and professional experiences and how they specifically relate to the Computer Engineering and Systems curriculum, and previous activities mentoring minorities and/or advancing minorities, women, or members of other under-represented groups, (2) a description of teaching philosophy (including a list of courses the candidate is qualified to teach, refer to http://www.washington.edu/students/crscatt/tces.html#tces103), (3) evidence of teaching effectiveness (4) a curriculum vitae, and (5) contact information for three references.

RC4 is the most widely used stream cipher around. A lot of modifications of RC4 cipher can be seen in open literature. Most of them enhance the secrecy of the cipher and the security levels have been analyzed theoretically by using mathematics. In this paper, a new effective RC4 cipher is proposed and the security analysis has been done using Shannon\'s Secrecy theories where numerical values are obtained to depict the secrecy. The proposed cipher is a combination of Improved RC4 cipher proposed by Jian Xie et al and modified RC4 cipher proposed by T.D.B Weerasinghe, which were published prior to this work. Combination is done in such a way that the concept used in the modified RC4 algorithm is used in the Improved RC4 cipher by Jian Xie et al. Importantly, an immense improvement of performance and secrecy are obtained by this combination. Hence this particular modification of RC4 cipher can be used in software applications where there is a need to improve the throughput as well as secrecy.

Physically unclonable functions (PUFs) exploit the unavoidable manufacturing variations of an integrated circuit (IC). Their input-output behavior serves as a unique IC \'fingerprint\'. Therefore, they have been envisioned as an IC authentication mechanism, in particular for the subclass of so-called strong PUFs. The protocol proposals are typically accompanied with two PUF promises: lightweight and an increased resistance against physical attacks. In this work, we review eight prominent proposals in chronological order: from the original strong PUF proposal to the more complicated converse and slender PUF proposals. The novelty of our work is threefold. First, we employ a unied notation and framework for ease of understanding. Second, we initiate direct comparison between protocols, which has been neglected in each of the proposals. Third, we reveal numerous security and practicality issues. To such an extent, that we can not support the use of any proposal in its current form. All proposals aim to compensate the lack of cryptographic properties of the strong PUF. However, proper compensation seems to oppose the lightweight objective.

Non-malleable codes are a natural relaxation of error correcting/detecting codes that have useful applications in the context of tamper resilient cryptography. Informally, a code is non-malleable if an adversary trying to tamper with an encoding of a given message can only leave it unchanged or modify it to the encoding of a completely unrelated value. This paper introduces an extension of the

standard non-malleability security notion - so-called continuous non-malleability - where we allow the adversary to tamper continuously with an encoding. This is in contrast to the standard notion of

non-malleable codes where the adversary only is allowed to tamper a single time with an encoding. We show how to construct continuous non-malleable codes in the common split-state model where an encoding consist of two parts and the tampering can be arbitrary but has to be independent with both parts. Our main contributions are outlined below:

1. We propose a new uniqueness requirement of split-state codes which states that it is computationally hard to find two codewords C = (X0;X1) and C0 = (X0;X1\') such that both codewords are valid, but X0 is the same in both C and C0. A simple attack shows that uniqueness

is necessary to achieve continuous non-malleability in the split-state model. Moreover, we illustrate that none of the existing constructions satisfies our uniqueness property and hence is not secure in the continuous setting.

2. We construct a split-state code satisfying continuous non-malleability. Our scheme is based

on the inner product function, collision-resistant hashing and non-interactive zero-knowledge

proofs of knowledge and requires an untamperable common reference string.

3. We apply continuous non-malleable codes to protect arbitrary cryptographic primitives against tampering attacks. Previous applications of non-malleable codes in this setting required to

perfectly erase the entire memory after each execution and and required the adversary to be restricted in memory. We show that continuous non-malleable codes avoid these restrictions.