International Association
for Cryptologic Research

Discrete Gaussian sampling is an integral part of many lattice

based cryptosystems such as public-key encryption, digital signature schemes and homomorphic encryption schemes. In this paper we propose a compact and fast Knuth-Yao sampler for sampling from a narrow discrete Gaussian distribution with very high precision. The designed samplers have a maximum statistical distance of $2^{-90}$ to a true discrete Gaussian distribution. In this paper we investigate various optimization techniques to achieve minimum area and cycle requirement. For the standard deviation 3.33, the most area-optimal implementation of the bit-scan operation based Knuth-Yao sampler consumes 30 slices on the Xilinx Virtex 5 FPGAs, and requires on average 17 cycles to generate a sample. We improve the speed of the sampler by using a precomputed table that directly maps the initial random bits into samples with very high probability. The fast sampler consumes 35 slices and spends on average 2.5 cycles to generate a sample. However the sampler architectures are not secure against timing and power analysis based attacks. In this paper we propose a random shuffle method to protect the Gaussian distributed polynomial against such attacks. The side channel attack resistant sampler architecture consumes 52 slices and spends on average 420 cycles to

generate a polynomial of 256 coefficients.

We provide a generic transformation from any \\emph{affine} message authentication code (MAC) to an identity-based encryption (IBE) scheme over pairing groups of prime order. If the MAC satisfies a security notion related to unforgeability against chosen-message attacks and, for example, the $k$-Linear assumption holds, then the resulting IBE scheme is adaptively secure. Our security reduction is tightness preserving, i.e., if the MAC has a tight security reduction so has the IBE scheme. Furthermore, the transformation also extends to hierarchical identity-based encryption (HIBE). We also show how to construct affine MACs with a tight security reduction to standard assumptions. This, among other things, provides the first tightly secure HIBE in the standard model.

This paper uses cryptographic techniques to study the problem of zone enumeration in DNSSEC. DNSSEC is designed to prevent network attackers from tampering with domain name system (DNS) messages. The cryptographic machinery used in DNSSEC, however, also creates a new vulnerability -zone enumeration, where an adversary launches a small number of online DNSSEC queries and then uses offline dictionary attacks to learn which domain names are present or absent in a DNS zone. We explain why the current DNSSEC standard (with NSEC and NSEC3) suffers from zone enumeration: we use cryptographic lower bounds to prove that DNSSEC\'s three design goals -high performance, security against network attackers, and privacy against zone enumeration- cannot be satisfied simultaneously. We then introduce NSEC5, a new cryptographic construction that solves the problem of DNSSEC zone enumeration while matching our lower bounds and remaining faithful to the operational realities of DNSSEC. NSEC5 can be thought of as a variant of NSEC3, where the hash function is replaced with an RSA-based keyed-hashing scheme.

Template Attacks consist of two stages, the profiling stage and the extraction stage. In order to improve the key-recovery efficiency of Template Attacks, a feasible way is to characterize signals and noises accurately. Under the assumption that a reference device is available, in the profiling stage, one can operate the reference device as many times as possible and samples a large number of power traces to help accurately characterize signals and noises at different interesting points. However, in some practical scenarios, it is not always the case and one can only record a limited number of power traces. In this paper, we show that one can still make Template Attacks practical and more powerful in the above scenario if he could obtain some kind of priori knowledge about the reference device. For example, the priori knowledge is some kind of priori distribution of the signal component in the instantaneous power consumption for fixed operation on fixed data. Evaluation results show that the priori knowledge poses potential threat to the physical security of cryptographic devices and this kind of threat can not be neglected.

Membership encryption is a newly developed cryptographic primitive that combines membership proof and encryption into an unified setting. This paper presents a new flexible membership encryption scheme which is provably secure and significantly more efficient than the previous scheme. Further we apply our proposed membership encryption to construct a round optimal 1-out-of-$n$ priced oblivious transfer (POT) protocol which, unlike the existing 1-out-of-n POT schemes,is proven secure under the universally composable (UC) security model and thus preserves security when it is executed with multiple protocol instances that run concurrently in an adversarily controlled way. Moreover, using our membership encryption, the POT protocol exhibits constant

communication complexity on the buyer\'s side and $O(n)$ communication cost on the vendor\'s side, which is so far the best known in the literature.

The SPEKE protocol is commonly considered one of the classic Password Authenticated Key Exchange (PAKE) schemes. It has been included in international standards (particularly, ISO/IEC 11770-4 and IEEE 1363.2) and has been deployed in commercial products. We observe that the original SPEKE specification is subtly different from those defined in the ISO/IEC 11770-4 and IEEE 1363.2 standards. We show that those differences have critical security implications. First of all, we present two new attacks on SPEKE: a relay attack and a key-malleability attack. The first attack allows an attacker to impersonate a user without knowing the password by engaging in two parallel sessions with the victim. The second attack allows an attacker to malleate the session key established between two honest users without being detected. Both attacks are applicable to the original SPEKE scheme. However, they are to some extent addressed in the ISO/IEC 11770-4 and IEEE 1363.2 standards, but in a vaguely defined manner. The vagueness makes it extremely difficult for a security-conscious developer to implement the protocol correctly. We propose countermeasures and suggest concrete changes to the standards.

In their seminal work on non-malleable cryptography, Dolev, Dwork and Naor, showed how to construct a non-malleable commitment with logarithmically-many \"rounds\"/\"slots\", the idea being that any adversary may successfully maul in some slots but would fail in at least one. Since then new ideas have been introduced, ultimately resulting in constant-round protocols based on any one-way function. Yet, in spite of this remarkable progress, each of the known constructions of non-malleable commitments leaves something to be desired.

In this paper we propose a new technique that allows us to to construct a non-malleable protocol with only a single ``slot\", and to improve in at least one aspect over each of the previously proposed protocols. Two direct byproducts of our new ideas are a four round non-malleable commitment and a four round non-malleable zero-knowledge argument, the latter matching the round complexity of the best known zero-knowledge argument (without the non-malleability requirement). The protocols are based on the existence of one-way permutations (or alternatively one-way functions with an extra round) and admit very efficient instantiations via standard homomorphic commitments and sigma protocols.

Our analysis relies on algebraic reasoning, and makes use of error correcting codes in order to ensure that committers\' tags differ in many coordinates. One way of viewing our construction is as a method for combining many atomic sub-protocols in a way that simultaneously amplifies soundness and non-malleability, thus requiring much weaker guarantees to begin with, and resulting in a protocol which is much trimmer in complexity compared to the existing ones.

We present a construction for non-interactive zero-knowledge proofs of

knowledge in the random oracle model from general sigma-protocols. Our

construction is secure against quantum adversaries. Prior

constructions (by Fiat-Shamir and by Fischlin) are only known to be

secure against classical adversaries, and Ambainis, Rosmanis, Unruh

(FOCS 2014) gave evidence that those constructions might not be secure

against quantum adversaries in general.

To prove security of our constructions, we additionally develop new

techniques for adaptively programming the quantum random oracle.

We propose a new construction for achieving adaptively secure functional encryption for poly-sized circuits from indistinguishability obfuscation. Our reduction has polynomial loss to the underlying primitives. We develop a punctured programming approach to constructing and proving systems where outside of obfuscation we rely only on primitives constructable from pseudo random generators.

In this paper, we propose an authenticated key exchange (AKE) protocol

from Ideal lattices. The protocol

is simple since it does not involve any other cryptographic primitives

to achieve authentication (e.g., signatures). This allows us

to establish a security proof solely based on the hardness of

the well-known ring-LWE problems, thus on some hard lattice problems in the worst-case (e.g., SVP and SIVP). We give the security proof of the proposed

AKE protocol in an enhanced variant of the original

Bellare-Rogaway (BR) model,

which additionally captures weak Perfect Forward Secrecy (wPFS),

in the random oracle (RO) model.

The Information Security Centre of Excellence (ISCX) at the Faculty of Computer Science, University of New Brunswick’s Fredericton Campus invites application for a Research Associate in the field of Cyber Security. The successful candidate will work with the members of ISCX to conduct original research, design, and development for the Intelligent Tools for an Automated Security Analysis and Risk Management for Large-Scale Systems project. This project will be carried out in collaboration with IBM Security Division and is mainly funded under the Atlantic Innovation Foundation (AIF) program. For more information on the project and ISCX, please see www.iscx.ca.

To be considered for the position the applicant should have a PhD degree in Computer Science. Some postdoctoral research experience is an asset. Good oral and written communication skills and the ability to work on a team project are essential.

This is a full-time position, available as of October 1, 2014 and will initially be for one year, with the possibility of renewal for three more years. Salary will depend upon the qualifications and experience of the successful applicant.

Interested applicants should submit a covering letter, along with a resume, and the name, address, phone and e-email addresses of three academic references. Review of applications will begin in August 1, 2014 and will continue until the position is filled.

Submission: 17 October 2014
From November 17 to November 19
Location: Kuala Lumpur, Malaysia
More Information: http://sdiwc.net/conferences/2014/iccics2014/

Submission: 17 October 2014
From November 17 to November 19
Location: Kuala Lumpur, Malaysia
More Information: http://www.sdiwc.net/conferences/eecea2014

The High Assurance Software Laboratory (HASLab) at INESC TEC has an opening for a 2 year Post-Doc position.

The position is within the cryptography and information security group in the HASLab.

The group is actively working on: provable security, domain-specific languages and software development tools for cryptography, efficient implementation of cryptographic software, and formal verification of cryptographic proofs and implementations.

We are looking for a highly motivated researcher with a recent Ph.D. and background in at least one of the following fields:

provable security,

efficient implementation of cryptography,

programming languages and verification,

and an interest in carrying out research at their intersection.

The position starts from November 2014. The salary is around 18K euros per year after tax. The working language is English.

Applications should arrive no later than September 19, 2014 and should include a CV, a cover letter, and the names and contact details for two references.

In this paper we study a scan based side channel attack

against the Grain family of stream ciphers. The attack works

because scan chain test of circuits can be transformed into a

powerful cryptographic attack due to the properties of scan

based technique. So as a result the attack targets the test

circuitry. We show how the attacker gains the knowledge about

the locations of internal state bits of the NFSR and the LFSR and

how he finds the secret key.

The existence of succinct non-interactive arguments for NP (i.e.,

non-interactive computationally-sound proofs where the verifier\'s

work is essentially independent of the complexity of the NP

nondeterministic verifier) has been an intriguing question for the

past two decades. Other than CS proofs in the random oracle model

[Micali, FOCS \'94], the only existing candidate construction is

based on an elaborate assumption that is tailored to a specific

protocol [Di Crescenzo and Lipmaa, CiE \'08].

We formulate a general and relatively natural notion of an

\\emph{extractable collision-resistant hash function (ECRH)} and show

that, if ECRHs exist, then a modified version of Di Crescenzo and

Lipmaa\'s protocol is a succinct non-interactive argument for

NP. Furthermore, the modified protocol is actually a succinct

non-interactive \\emph{adaptive argument of knowledge (SNARK).} We

then propose several candidate constructions for ECRHs and

relaxations thereof.

We demonstrate the applicability of SNARKs to various forms of delegation of computation, to succinct non-interactive zero knowledge arguments, and to succinct two-party secure computation. Finally, we show that SNARKs essentially imply the existence of ECRHs, thus demonstrating the necessity of the assumption.

Going beyond $\\ECRH$s, we formulate the notion of {\\em extractable

one-way functions ($\\EOWF$s)}. Assuming the existence of a natural

variant of $\\EOWF$s, we construct a $2$-message

selective-opening-attack secure commitment scheme and a 3-round

zero-knowledge argument of knowledge. Furthermore, if the $\\EOWF$s are

concurrently extractable, the 3-round zero-knowledge protocol is also

concurrent zero-knowledge.

Our constructions circumvent previous black-box impossibility

results regarding these protocols by relying on $\\EOWF$s as the non-black-box component in the security reductions.

From October 13 to October 16
Location: Porto, Portugal
More Information: http://attackschool.di.uminho.pt

After more than a decade of usage, bilinear groups have established their place in the cryptographic canon by enabling the construction of many advanced cryptographic primitives. Unfortunately, this explosion in functionality has been accompanied by an analogous growth in the complexity of the assumptions used to prove security. Many of these assumptions have been gathered under the umbrella of the \"uber-assumption,\" yet certain classes of these assumptions -- namely, q-type assumptions -- are stronger and require larger parameter sizes than their static counterparts.

In this paper, we show that in certain groups, many classes of q-type assumptions are in fact implied by subgroup hiding (a well-established, static assumption). Our main tool in this endeavor is the dual-system technique, as introduced by Waters in 2009. As a case study, we first show that in composite-order groups, we can prove the security of the Dodis-Yampolskiy PRF based solely on subgroup hiding and allow for a domain of arbitrary size (the original proof only allowed a polynomially-sized domain). We then turn our attention to classes of q-type assumptions and show that they are implied -- when instantiated in appropriate groups -- solely by subgroup hiding. These classes are quite general and include assumptions such as q-SDH. Concretely, our result implies that every construction relying on such assumptions for security (e.g., Boneh-Boyen signatures) can, when instantiated in appropriate composite-order bilinear groups, be proved secure under subgroup hiding instead.

This paper analyzes the cost of breaking ECC under the following assumptions: (1) ECC is using a standardized elliptic curve that was actually chosen by an attacker; (2) the attacker is aware of a vulnerability in some curves that are not publicly known to be vulnerable.

This cost includes the cost of exploiting the vulnerability, but also the initial cost of computing a curve suitable for sabotaging the standard. This initial cost depends upon the acceptability criteria used by the public to decide whether to allow a curve as a standard, and (in most cases) also upon the chance of a curve being vulnerable.

This paper shows the importance of accurately modeling the actual acceptability criteria: i.e., figuring out what the public can be fooled into accepting. For example, this paper shows that plausible models of the \"Brainpool acceptability criteria\" allow the attacker to target a one-in-a-million vulnerability.

Differential Fault Analysis is a powerful cryptanalytic tool to reveal secret

keys of cryptographic algorithms.

By corrupting the computation of an algorithm, an attacker gets

additional information about the secret key.

In 2012, several Differential Fault Analyses on the AES cipher were

analyzed

from an information-theoretic perspective.

This analysis exposed whether or not the leaked information was fully exploited.

It revealed if an analysis was already optimal or if it could still be improved.

We applied the same approach to all existing Differential Fault Analyses

on the CLEFIA cipher.

We show that only some of these attacks are already optimal.

We improve those analyses which did not exploit all information.

With one exception, all attacks against CLEFIA-128 reach the theoretical limit

after our improvement.

Our improvement of an attack against CLEFIA-192 and CLEFIA-256 reduces the

number of fault injections to the lowest possible number reached to date.