International Association
for Cryptologic Research

We implemented a prototype of our scheme and demonstrated its efficiency on datasets from prior work. Apart from its concrete efficiency, our scheme is also simpler: in particular, it does not require the server to support any operation other than upload and download of data. Thus the server in our scheme can be based solely on a cloud storage service, rather than a cloud computation service as well, as in prior work.

In building our dynamic SSE scheme, we introduce a new primitive called Blind Storage, which allows a client to store a set of files on a remote server in such a way that the server does not learn how many files are stored, or the lengths of the individual files; as each file is retrieved, the server learns about its existence (and can notice the same file being downloaded subsequently), but the file\'s name and contents are not revealed. This is a primitive with several applications other than SSE, and is of independent interest.

In this paper, based on some observations discovered by Wang et. al., we present new differential and linear attacks on Zorro, both of which recover the full secret key with practical complexity. These attacks are based on very efficient distinguishers that have only two active sboxes per four rounds. The time complexity of our differential and linear attacks are $2^{52.74}$ and $2^{57.85}$ and the data complexity are $2^{55.15}$ chosen plaintexts and $2^{45.44}$ known plaintexts, respectively. The results clearly show that the block cipher Zorro does not have enough security against differential and linear cryptanalysis.

We have proposed new polynomials for approximation, and implemented and benchmarked all our algorithms on the Sharemind secure multi-party computation framework.

maps, where efficiency in proposed instantiations is closely tied to the maximum number of ``levels\'\' of multilinearity required. The most efficient previous construction of a core obfuscator, due to Barak, Garg, Kalai, Paneth, and Sahai (Eurocrypt 2014) required the maximum number of levels of multilinearity to be $\\Theta(\\ell s^{6.82})$, where $s$ is the size of the Boolean formula to be obfuscated, and $\\ell$ is the number of input bits to the formula. In contrast, our construction only requires the maximum number of levels of multilinearity to be $\\Theta(\\ell s)$. This results in significant improvements in both the total size of the obfuscation, as well as the running time of evaluating an obfuscated formula.

Staff scientists will have an opportunity to blend academic research with leadership in architecting next-generation security systems together with RSA Engineering. Applicants should possess enthusiasm for both cutting-edge research and real-world deployment; also valuable are either implementation skills or a desire to work with development staff to create prototypes. A PhD in Computer Science or a closely related field is required, as is residence in or relocation to the Boston, MA area. To apply, please send a resume to labs_hiring (at) rsa.com. The review of applications will begin immediately and will continue until the position is filled.

RSA is the security division of EMC, the world leader in information infrastructure solutions. RSA Laboratories’ charter is to produce research with practical impact on the products and strategy of RSA and its parent company EMC and scholarly influence in the larger research community.

You will be working with a SGSII phone, coding mostly in C/C++. Knowledge of Java is beneficial. Since the prototype is running on top of a microkernel (Fiasco.OC), prior knowledge of virtualization architectures will be useful but can also be picked up during the course of the project. To apply, please email an updated CV/Resume to the email address below indicating in the body of the email why the project interests you. The internship will cover living costs for a student in Berlin.

It has been a major open problem to understand which (monotone) functions can be realized by a computational secret-sharing schemes. Yao suggested a method for secret-sharing for any function that has a polynomial-size monotone circuit (a class which is strictly smaller than the class of monotone functions in P). Around 1990 Rudich raised the possibility of obtaining secret-sharing for all monotone functions in NP: In order to reconstruct the secret a set of parties must be \"qualified\" and provide a witness attesting to this fact.

Recently, there has been much excitement regarding the possibility of obtaining program obfuscation satisfying the \"indistinguishability obfuscation\" requirement: A transformation that takes a program and outputs an obfuscated version of it so that for any two functionally equivalent programs the output of the transformation is computationally indistinguishable.

Our main result is a construction of a computational secret-sharing scheme for any monotone function in NP assuming the existence of an efficient indistinguishability obfuscator for P and one-way functions. Furthermore, we show how to get the same result but relying on a weaker obfuscator: an efficient indistinguishability obfuscator for CNF formulas.

problem. We give an algorithm, for certain parameters, for solution of the Markov problem. The Markov problem is related to the knot recognition problem. Hence we also a new algorithm the knot recognition problem. This knot recognition algorithm may be used for previously proposed cryptosystem that uses knots.

years against reduced-round versions of AES. We introduce a slight improvement to

the basic attack which lowers the number of chosen plaintexts needed to successfully

mount it. Our version of the attack on 6-round AES can be carried out completely

in practice, as we demonstrate providing a full implementation. We also detail the

structure of our implementation, showing the performances we achieve.

The designers claim that \\pandas, which is one of the designs of the \\panda-family, provides 128-bit security in the nonce misuse model.

In this note, we describe our forgery attack against \\pandas.

Our attack works in the nonce misuse model.

It exploits the fact that the message processing function and the finalization function are identical,

and thus a variant of the length-extension attack can be applied.

We can find a tag for a pre-specified formatted message with 2 encryption oracle calls, $2^{64}$ computational cost, and negligible memory.

and submitted to the CAESAR competition.

The designers claim that \\paese, which is one of the designs of the \\paes-family,

provides 128-bit security in the nonce misuse model.

In this note, we show our forgery attack against \\paese.

Our attack works in the nonce misuse model.

The attack exploits the slow propagation of message differences.

The attack is very close to the universal forgery attack.

As long as the target message is not too short, {\\it e.g.} more than 10 blocks (160 bytes),

a tag is forged only with $2^{11}$ encryption oracle calls, $2^{11}$ computational cost, and negligible memory.

The applicants are expected to hold a master degree in computer science, mathematics, or a related area and to have a background in cryptography.

(1) We look for a doctoral student in the area of lattice-based cryptography at the earliest possible date. Lattice-based cryptography is a very promising direction in cryptography offering both (presumably) quantum immunity and additional features, e.g., fully homomorphic encryption. We are interested in both cryptanalysis (the concrete hardness of lattice problems) and the construction of provably secure and practical lattice-based schemes.

Previous experience in algebra, number theory, the geometry of numbers, and/or lattice-based cryptography is advantageous. The successful candidate will work in a research team of several doctoral students led by Dr. Özgür Dagdelen.

Please send your application to lattice-position (at) cdc.informatik.tu-darmstadt.de.

(2) We offer a three-year position (doctoral student or postdoc) in a research project funded by the German Science Foundation DFG. The goal of this project is to integrate the hash-based signature scheme XMSS, invented in Darmstadt, into crypto-based security solutions such as SSL/TLS, HTTPS, S/MIME in collaboration with the company Genua mbH in Kirchheim.

Postdocs are also encouraged to apply here. Previous experience in the area of the project is advantageous. The successful candidate will work in a research team dealing with cryptography and crypto-based security solutions.

Please send your application to ha