International Association
for Cryptologic Research

Talek is a private group messaging system that sends messages through potentially untrustworthy servers, while hiding both data content and the communication patterns among its users. Talek explores a new point in the design space of private messaging; it guarantees access sequence indistinguishability, which is among the strongest guarantees in the space, while assuming an anytrust threat model, which is only slightly weaker than the strongest threat model currently found in related work. Our results suggest that this is a pragmatic point in the design space, since it supports strong privacy and good performance: we demonstrate a 3-server Talek cluster that achieves throughput of 9,433 messages/second for 32,000 active users with 1.7-second end-to-end latency. To achieve its security goals without coordination between clients, Talek relies on information-theoretic private information retrieval. To achieve good performance and minimize server-side storage, Talek intro- duces new techniques and optimizations that may be of independent interest, e.g., a novel use of blocked cuckoo hashing and support for private notifications. The latter provide a private, efficient mechanism for users to learn, without polling, which logs have new messages.

The Centre for Secure Information Technologies (CSIT) at Queen's University Belfast is seeking motivated PhD students to work on the following research topics:

Secure IoT devices using Digital Fingerprint

Investigating Security Vulnerabilities of Approximate Computing

Practical and Post-quantum IoT security

Practical Privacy-preserving homomorphic analytics

Post Quantum Anonymous Credential

Functional Encryption and its Application

For further information and how to apply, please visit the QUB website for PhD study: http://www.qub.ac.uk/schools/eeecs/Research/PhDStudy/

Closing date for applications:

Contact: Ciara Rafferty: c.m.rafferty@qub.ac.uk

More information: http://www.qub.ac.uk/schools/eeecs/Research/PhDStudy/

Primality testing is a basic cryptographic task. But developers today are faced with complex APIs for primality testing, along with documentation that fails to clearly state the reliability of the tests being performed. This leads to the APIs being incorrectly used in practice, with potentially disastrous consequences. In an effort to overcome this, we present a primality test having a simplest-possible API: the test accepts a number to be tested and returns a Boolean indicating whether the input was composite or probably prime. For all inputs, the output is guaranteed to be correct with probability at least $1 - 2^{128}$. The test is performant: on random, odd, 1024-bit inputs, it is faster than the default test used in OpenSSL by 17\%. We investigate the impact of our new test on the cost of random prime generation, a key use case for primality testing. The OpenSSL developers have adopted our suggestions in full; our new API and primality test are scheduled for release in OpenSSL 3.0.

Dual system encryption is an important method used in pairing-based cryptography for constructing fully secure IBE, ABE and FE schemes. A long time open question is that, whether there is an analogue of dual system method in lattice, which can be used to prove the full security of lattice-based ABE or FE schemes. We solve this problem in this paper.

We do this by introducing a new primitive called approximate inner product encryption (aIPE), which is the approximate version of the well known inner product encryption. We show that a fully secure ABE supporting CNF as its access policy can be constructed from a selectively secure aIPE and the LWE assumption. We also point out that the functionality of aIPE is included in FE for arbitrary circuits, which can be constructed from LWE assumption, hence the full security of our scheme can be totally based on the hardness of LWE.

LAC is a Ring Learning With Error based cryptosystem that has been proposed to the NIST call for post-quantum standardization and passed the first round of the submission process. The particularity of LAC is to use an error-correction code ensuring a high security level with small key sizes and small ciphertext sizes. LAC team proposes a CPA secure cryptosystem, LAC.CPA, and a CCA secure one, LAC.CCA, obtained by applying the Fujisaki-Okamoto transformation on LAC.CPA. In this paper, we study the security of LAC Key Exchange (KE) mechanism, using LAC.CPA, in a misuse context: when the same secret key is reused for several key exchanges and an active adversary has access to a mismatch oracle. This oracle indicates information on the possible mismatch at the end of the KE protocol. In this context, we show that an attacker needs at most $8$ queries to the oracle to retrieve one coefficient of a static secret key. This result has been experimentally confirmed using the reference and optimized implementations of LAC. Since our attack can break the CPA version in a misuse context, the Authenticated KE protocol, based on the CCA version, is not impacted. However, this research provides a tight estimation of LAC resilience against this type of attacks.

Zero-knowledge proofs and in particular succinct non-interactive zero-knowledge proofs (so called zk-SNARKs) are getting increasingly used in real-world applications, with cryptocurrencies being the prime example. Simulation extractability (SE) is a strong security notion of zk-SNARKs which informally ensures non-malleability of proofs. This property is acknowledged as being highly important by leading companies in this field such as Zcash and supported by various attacks against the malleability of cryptographic primitives in the past. Another problematic issue for the practical use of zk-SNARKs is the requirement of a fully trusted setup, as especially for large-scale decentralized applications finding a trusted party that runs the setup is practically impossible. Quite recently, the study of approaches to relax or even remove the trust in the setup procedure, and in particular subversion as well as updatable zk-SNARKs (with latter being the most promising approach), has been initiated and received considerable attention since then. Unfortunately, so far SE-SNARKs with aforementioned properties are only constructed in an ad-hoc manner and no generic techniques are available.

In this paper we are interested in such generic techniques and therefore firstly revisit the only available lifting technique due to Kosba et al. (called COCO) to generically obtain SE-SNARKs. By exploring the design space of many recently proposed SNARK- and STARK-friendly symmetric-key primitives we thereby achieve significant improvements in the prover computation and proof size. Unfortunately, the COCO framework as well as our improved version (called OCOCO) is not compatible with updatable SNARKs. Consequently, we propose a novel generic lifting transformation called Lamassu. It is built using different underlying ideas compared to COCO (and OCOCO). In contrast to COCO it only requires key-homomorphic signatures (which allow to shift keys) covering well studied schemes such as Schnorr or ECDSA. This makes Lamassu highly interesting, as by using the novel concept of so called updatable signatures, which we introduce in this paper, we can prove that Lamassu preserves the subversion and in particular updatable properties of the underlying zk-SNARK. This makes Lamassu the first technique to also generically obtain SE subversion and updatable SNARKs. As its performance compares favorably to OCOCO, Lamassu is an attractive alternative that in contrast to OCOCO is only based on well established cryptographic assumptions.

In a transaction-output-based blockchain system, where each transaction spends UTXOs (the previously unspent transaction outputs), a user must provide a signature, or more precisely a \(\textit{scriptSig}\) for Bitcoin, to spend an UTXO, which proves the ownership of the spending output. When Pedersen commitment \(g^xh^a\) or ElGamal commitment \((g^xh^a,h^x)\) introduced into blockchain as transaction output, for supporting confidential transaction feature, where the input and output amounts in a transaction are hidden, the prior signature schemes such as Schnorr signature scheme and its variants does not directly work here if using the commitment as the public key, since nobody including the committer knows the private key of a \(g^xh^a\) when $a$ is not zero, meaning no one knows the $c$ such that \((g^c=g^xh^a)\). This is a signature scheme which is able to use the \(C=g^xh^a\) as the signature public key for any value of $a$. The signer, proceeding from a random Pedersen commitment \(R=g^{k_1}h^{k_2}\), generates a random bit sequence $e$, by multiplication of a stored private key $x$ with the bit sequence $e$ and by addition of the random number $k_1$ to get the $u$, by multiplication of the committed value $a$ with the bit sequence $e$ and by addition of the random number $k_2$ to get the $v$, finally constructs \(\sigma=(R,u,v)\) as the signature, with the corresponding public key $C$. In turn, the verifier calculates a Pedersen commitment \(S=g^uh^v\), and accepts the signature if \(S=RC^e\). For an electronic signature, a hash value $e$ is calculated from a random Pedersen commitment $R$, the Pedersen commitment $C$, and from the message $m$ to be signed. This signature scheme will be very helpful in the design of a non-interactive transaction in Mimblewimble.

Non-repudiation of messages generated by users is a desirable feature in a number of applications ranging from online banking to IoT scenarios. However, it requires certified public keys and usually results in poor usability as a user must carry around his certificate (e.g., in a smart-card) or must install it in all of his devices. A user-friendly alternative, adopted by several companies and national administrations, is to have a ``cloud-based'' PKI. In a nutshell, each user has a PKI certificate stored at a server in the cloud; users authenticate to the server---via passwords or one-time codes---and ask it to sign messages on their behalf. As such, there is no way for the server to prove to a third party that a signature on a given message was authorized by a user. As the server holds the user's certified key, it might as well have signed arbitrary messages in an attempt to impersonate that user. In other words, a user could deny having signed a message, by claiming that the signature was produced by the server without his consent. The same holds in case the secret key is derived deterministically from the user's password, for the server, by knowing the password, may still frame the user.

In this paper we provide a "password-only" solution to non-repudiation of user messages by introducing Auditable Asymmetric Password Authenticated Public Key Establishment (A2PAKE). This is a PAKE-like protocol that generates an asymmetric key-pair where the public key is output to every participant, but the secret key is private output to just one of the parties (e.g., the user). Further, the protocol can be audited, i.e., given the public key output by a protocol run with a user, the server can prove to a third party that the corresponding secret key is held by that specific user. Thus, if the user signs messages with that secret key, then signatures are non-repudiable. We provide a universally composable definition of A2PAKE and an instantiation based on a distributed oblivious pseudo-random function. We also develop a prototype implementation of our instantiation and use it to evaluate its performance in realistic settings.

ARX-KW is a family of key wrapping construction based on add-rotate-xor primitives: the pseudo-random function SipHash for authentication and the stream cipher ChaCha for confidentiality. This paper presents ARX-KW, proposes a specific instantiation of ARX-KW and details the design decisions that were made.

Today, deep neural networks represent a common option when conducting the profiled side-channel analysis. Such techniques commonly do not require pre-processing, and yet, they can break targets that are even protected with countermeasures. Unfortunately, it is usually far from trivial to find neural network hyper-parameters that would result in such top-performing attacks. The hyper-parameter leading the training process is the number of epochs during which the training happens. If the training is too short, the network does not reach its full capacity, while if the training is too long, the network overfits, and consequently, is not able to generalize to unseen examples. Finding the right moment to stop the training process is particularly difficult for side-channel analysis as there are no clear connections between machine learning and side-channel metrics that govern the training and attack phases, respectively.

In this paper, we tackle the problem of determining the correct epoch to stop the training in deep learning-based side-channel analysis. First, we explore how information is propagated through the hidden layers of a neural network, which allows us to monitor how training is evolving. Second, we demonstrate that the amount of information transferred to the output layer can be measured and used as a reference metric to determine the epoch at which the network offers optimal generalization. To validate the proposed methodology, we provide extensive experimental results that confirm the effectiveness of our metric of choice for avoiding overfitting in the profiled side-channel analysis.

Let $X \in {\mathbb{Z}}^{n \times m}$, with each entry independently and identically distributed from an integer Gaussian distribution. We consider the orthogonal lattice $\Lambda^\perp(X)$ of $X$, i.e., the set of vectors $\mathbf{v} \in {\mathbb{Z}}^m$ such that $X \mathbf{v}= \mathbf{0}$. In this work, we prove probabilistic upper bounds on the smoothing parameter and the $(m-n)$-th minimum of $\Lambda^\perp(X)$. These bounds improve and the techniques build upon prior works of Agrawal, Gentry, Halevi and Sahai [Asiacrypt'13], and of Aggarwal and Regev [Chicago J. Theoret. Comput. Sci.'16].

A remarkable breakthrough in mathematics in recent years is the proof of the long-standing conjecture: sphere packing (i.e., packing unit balls) in the $E_8$ lattice is optimal in the sense of the best density \cite{V17} for sphere packing in $\mathbb{R}^8$. In this work, based on the $E_8$ lattice code, we design a mechanism for asymmetric key consensus from noise (AKCN), referred to as AKCN-E8, for error correction and key consensus. As a direct application of the AKCN-E8 code, we present highly practical key encapsulation mechanism (KEM) from the ideal lattice based on the ring learning with errors (RLWE) problem. Compared to the RLWE-based NewHope-KEM \cite{newhope-NIST}, which is a variant of NewHope-Usenix \cite{newhope15} and is now a promising candidate in the second round of NIST post-quantum cryptography (PQC) standardization competition, our AKCN-E8-KEM has the following advantages:

* The size of shared-key is doubled,.

* More compact ciphertexts, at the same or even higher security level.

* More flexible parameter selection for tradeoffs among security, ciphertext size and error probability.

Event date: 25 August to 28 August 2020
Submission deadline: 15 March 2020
Notification: 18 May 2020

Event date: 24 August to 27 August 2020
Submission deadline: 23 March 2020
Notification: 8 May 2020

The Cryptography and Privacy Engineering Group (ENCRYPTO) at Technische Universität Darmstadt offers a position for a Doctoral Researcher (Research Assistant/PhD Student) in the project “Privacy-preserving Services on The Internet” (PSOTI) funded via an ERC Starting Grant. We develop techniques and tools for protecting privacy in applications.

Job Description
The fully funded position is for up to 4.5 years with starting date latest on August 1, 2020. In our project, we will build privacy-preserving services on the Internet. This includes protocols for privately outsourcing, searching and processing data among untrusted service providers using secure multi-party computation, and building a scalable secure multi-party computation framework. You will do research, build prototype implementations, and publish and present the results at top conferences and journals. We provide an open and international working environment for excellent research in a sociable team and give the opportunity for further qualification (doctoral/PhD degree). TU Darmstadt is ranked as a top university for IT security and cryptography in Europe and computer science in Germany. The position is based in the “City of Science” Darmstadt, which is very international and livable, and well-connected in the Rhine-Main area around Frankfurt.

Your Profile

• You have a completed Master degree (or equivalent) from a top university with excellent grades in IT security, computer science, applied mathematics, electrical engineering, or a similar field.
• Extensive knowledge in IT security/applied cryptography and excellent software development skills are required.
• Additional knowledge in cryptographic protocols (ideally secure multi-party computation) is a plus.
• You are self-motivated, reliable, creative, able to discuss/write/present scientific results in English, and able to conduct excellent research on challenging scientific problems with practical relevance.

Application deadline: June 1, 2020; later applications will be accepted until the position has been filled.

Closing date for applications:

Contact: Thomas Schneider (schneider@encrypto.cs.tu-darmstadt.de)

More information: https://encrypto.de/PSOTI-PHDSTUDENT

We have a position available for a 12-month postdoc in blockchain technologies. In particular, you are welcome to apply if you are interested in applications of Multi-party Computation to blockchains, high-assurance cryptography for blockchain deployments, and/or blockchain-assisted boardroom voting.
The Postdoc will perform research to construct use cases for blockchain technologies in these application domains. The developed material will be used both for research publications and other educational activities, related to training Danish industry professionals and technical managers in securely adopting blockchain technology.
The project is a collaboration between researchers from many institutions in Denmark: the Departments of Engineering and Computer Science at Aarhus University (AU), the Concordium Blockchain Research Center (COBRA) at AU, the DIGIT Centre for Digitalisation, Big Data and Data Analytics at AU, the Alexandra Institute and other partners in Copenhagen (IT University and Institute for Futures Studies). The project is funded by the Danish Industry Foundation, at a total of 1 million euros.
Qualifications: We are looking for dedicated and enthusiastic applicants, with a PhD in Computer Science/Engineering, Mathematics or related discipline. Previous experience in cryptography for blockchains is fundamental. Further requirements are fluency in English, good reporting/organization skills, ability to collaborate in groups and with industry, and being able to work independently.
To Apply: Send a cover letter, Curriculum Vitae with at least two references to contacts below.

Closing date for applications:

Contact: Diego F. Aranha, Assistant Professor of Engineering, dfaranha (at) eng.au.dk
Bas Spitters, Associate Professor of Computer Science, spitters (at) cs.au.dk

More information: https://alexandra.dk/dk/aktuelt/nyheder/2019/industriens-fond-st-tter-blockchain-uddannelser-til-virksomhedsledere

The Cryptography and Privacy Engineering Group (ENCRYPTO) at Technische Universität Darmstadt offers a position for a Postdoctoral Researcher in the project “Privacy-preserving Services on The Internet” (PSOTI) funded via an ERC Starting Grant. We develop techniques and tools for protecting privacy in applications.

Job Description
The fully funded position is for up to 2.5 years with starting date as soon as possible. In our project, we will build privacy-preserving services on the Internet. This includes protocols for privately outsourcing, searching and processing data among untrusted service providers using secure multi-party computation, and building a scalable secure multi-party computation framework. You will co-advise PhD students, be involved in the project management, do research, build prototype implementations, and publish the results at top venues in IT security / applied cryptography. We provide an open and international working environment for excellent research in a sociable team. TU Darmstadt is ranked as a top university for IT security and cryptography in Europe and computer science in Germany. The position is based in the “City of Science” Darmstadt, which is very international and livable, and well-connected in the Rhine-Main area around Frankfurt.

Your Profile

• You have a completed PhD degree (or equivalent) from a top university in IT security, computer science, applied mathematics, electrical engineering, or a similar area.
• Publications at top venues for IT security/applied cryptography (e.g., S&P, CCS, NDSS, USENIX SEC, EUROCRYPT), ideally on cryptographic protocols and secure computation, are required.
• Experience in software development, project management, and supervising students is needed.
• You are self-motivated, reliable, creative, able to discuss/write/present scientific results in English, and can conduct excellent research on challenging scientific problems with practical relevance.

Application deadline: None; applications will be accepted until the position is filled.

Closing date for applications:

Contact: Thomas Schneider (schneider@encrypto.cs.tu-darmstadt.de)

More information: https://encrypto.de/PSOTI-POSTDOC

Microarchitecture based side-channel attacks are common threats nowadays. Intel SGX technology provides a strong isolation from an adversarial OS, however, does not guarantee protection against side-channel attacks. In this paper, we analyze the security of the mbedTLS binary GCD algorithm, an implementation that offers interesting challenges when compared for example with OpenSSL, due to the usage of very tight loops in the former. Using practical experiments we demonstrate the mbedTLS binary GCD implementation is vulnerable to side-channel analysis using the SGX-Step framework against mbedTLS based SGX enclaves.

We analyze the security of some use cases of this algorithm in this library, resulting in the discovery of a new vulnerability in the ECDSA code path that allows a single-trace attack against this implementation. This vulnerability is three-fold interesting:

* It resides in the implementation of a countermeasure which makes it more dangerous due to the false state of security the countermeasure currently offers.

* It reduces mbedTLS ECDSA security to an integer factorization problem.

* An unexpected GCD call inside the ECDSA code path compromises the countermeasure.

We also cover an orthogonal use case, this time inside the mbedTLS RSA code path during the computation of a CRT parameter when loading a private key. The attack also exploits the binary GCD implementation threat, showing how a single vulnerable primitive leads to multiple vulnerabilities. We demonstrate both security threats with end-to-end attacks using 1000 trials each, showing in both cases single-trace attacks can be achieved with success rates very close to 100%.

This paper presents a set of efficient and parameterized hardware accelerators that target post-quantum lattice-based cryptographic schemes, including a versatile cSHAKE core, a binary-search CDT-based Gaussian sampler, and a pipelined NTT-based polynomial multiplier, among others. Unlike much of prior work, the accelerators are fully open-sourced, are designed to be constant-time, and are parameterized at compile-time to support different parameters without the need for re-writing the hardware implementation. These flexible, to-be publicly-available accelerators are used to demonstrate the first hardware-software co-design using RISC-V of the post-quantum lattice-based signature scheme qTESLA with provably secure parameters. In particular, we demonstrate that the NIST's Round 2 level 1 and level 3 qTESLA variants achieve over a 40-100x speedup for key generation, about a 10x speedup for signing, and about a 16x speedup for verification, compared to the baseline RISC-V software-only implementation. For instance, this corresponds to execution in 7.7, 34.4, and 7.8 milliseconds for key generation, signing, and verification, respectively, for qTESLA's level 1 parameter set on an Artix-7 FPGA, demonstrating the feasibility of the scheme for embedded applications.

Multivariate encryption schemes are public key encryption schemes using multivariate polynomials over finite fields. In 2020, Jiahui Chen et al. proposed a new multivariate encryption scheme. In order to construct the public key consisting of quadratic polynomials, they used the minus and plus modifiers to prevent known attacks, such as linear equations attack, minRank attack and algebraic attack. However, in this paper we show that even if such modifiers are used, an attack using linear algebra is valid for their scheme. In fact, our attack can break the claimed 80 and 128-bit parameters in the complexity of around 27 and 31 bits, respectively.