International Association
for Cryptologic Research

GlobalPlatform (GP) card specifications are defined for smart cards regarding rigorous security requirements. The increasingly more powerful cards within an open ecosystem of multiple players stipulate that asymmetric-key protocols become necessary. In this paper, we analyze SCP10, which is the Secure Channel Protocol (SCP) that relies on RSA for key exchange and authentication. Our findings are twofold. First, we demonstrate several flaws in the design of SCP10. We discuss the scope of the identified flaws by presenting several attack scenarios in which a malicious attacker can recover all the messages protected by SCP10. We provide a full implementation of these attacks. For instance, an attacker can get the freshly generated session keys in less than three hours. Second, we propose a secure implementation of SCP10 and discuss how it can mitigate the discovered flaws. Finally, we measure the overhead incurred by the implemented countermeasures.

Event date: 18 November to 20 November 2020
Submission deadline: 3 July 2020
Notification: 4 September 2020

The ISG is seeking to recruit a post-doctoral research assistant to work in the area of cryptography. The position is available now until 1 June 2022.

The PDRA will work alongside Prof. Martin Albrecht, Dr. Rachel Player and other cryptographic researchers at Royal Holloway on topics in lattice-based cryptography. This post is part of the EU H2020 PROMETHEUS project (https://www.h2020prometheus.eu) for building privacy preserving systems from advanced lattice primitives. Our research focus within this project is on cryptanalysis and implementations, but applicants with a strong background in other areas such as protocol/primitive design are also encouraged to apply.

See also this blog post (https://martinralbrecht.wordpress.com/2020/06/26/postdoc-at-royal-holloway-on-lattice-based-cryptography-3/) for more details.

Closing date for applications:

Contact: Martin Albrecht or Rachel Player

More information: https://jobs.royalholloway.ac.uk/Vacancy.aspx?ref=0620-149

Department Summary: University of North Texas (UNT) is rapidly building its Center for Agile and Adaptive Manufacturing (CAAAM), a State of Texas funded multi-million-dollar initiative with a multi-disciplinary focus on further advancing the science and technology of additive manufacturing (AM). CAAAM involves a multi-disciplinary team of researchers from materials science, mechanical engineering, manufacturing, data science, cybersecurity and logistics & supply chain, committed to collaborating on large research projects with an emphasis on additive manufacturing.

Position Summary: CAAAM is seeking a Research Assistant Professor to collaborate with a team of faculty on cybersecurity issues related to AM. This is a non-tenure track terminal position with a primary association with CAAAM and secondary association with an appropriate academic department. The selected candidate is expected to focus on cybersecurity in the context of advanced manufacturing systems in general and additive manufacturing systems more specifically. A successful candidate will work closely with faculty in the Computer Science and Engineering department as well as other faculty and researchers in CAAAM. The candidate is expected to conduct research on securing advanced manufacturing systems and develop fundamental and innovative approaches to the design and validation of secure, trustworthy and resilient cyber systems for industrial automation. The candidate is also expected to develop educational material for training workforce to operate advanced manufacturing systems as well as mentor graduate students and post-doctoral researchers working in CAAAM.

Minimum qualifications include an earned doctorate in Computer Engineering, Computer Science or a related discipline with a research focus on cybersecurity in general but more specifically, cybersecurity related to cyber-physical systems, security in edge devices, hardware/systems security, security of IoT’s and Industrial IoT’s, design and validation of secure and resilient cyber-physical systems. The research background should be evident from high quality publications.

Closing date for applications:

Contact: Krishna Kavi (Krishna.Kavi@unt.edu), Mary Chandler (Mary.Chandler@unt.edu)

More information: http://jobs.untsystem.edu/postings/34619

What you will do

Reporting to the Director, Fintech Research team in the IT Services department, you use your expertise and intellect to solve unique and difficult problems. Working in a talented and diverse team you touch all phases of a research and development project towards meeting challenging policy goals.

You will have the opportunity to use your specialized skills, develop these further and contribute to other areas of the project:
- Devise technical solutions to difficult and unique problems either independently, with team members or with external vendors and experts as required
-Identify gaps and Investigate emerging technologies as required for their application for CBDC
- Liaise closely with, and consider impacts on, other aspects of the system, outside the immediate area of responsibility, in formulating technical designs
- Recommend solutions to specific problem to solution architect and project leadership with a holistic view of impacts (e.g. effectiveness of solution, costs, risks, evolution over time)
- Explain and justify design choices, especially when multiple options are available
- Explain technologies and solutions to other technical audiences and occasionally business stakeholders in the Bank
- Assist in the design and development of proof-of-technologies / proof-of-concepts
- Contribute to development of a working CBDC system
- Contribute to the documentation and body of knowledge of technical designs
- Give intellectual leadership to other members of the team involved in the same domain area
- Manage day-to-day relationship with external parties such as vendors to ensure efficient work practices and management of risks
- Manage and balance the workloads of multiple simultaneous projects

What you can expect from us

Salaries are based on qualifications and experience and typically range from $94,100 and $117,600 (job grade 18). The intent is to staff at job grade job grade 18. Based on business needs and the successful candidate’s experience, knowledge and competencies, the position may be staffed at JG 17 ($83,900 and $104,

Closing date for applications:

Contact: Apply Online using above link

More information: https://careers.bankofcanada.ca/job/Ottawa-%28Downtown%29-Research-and-Development-Technologist%2C-CBDC/540381817/

OneSpan is seeking applications for highly motivated and self-driven research scientists to complement its Innovation Centre team currently working on cutting-edge research in security, privacy, machine learning and digital identity. The Innovation Centre was established to research and prototype the next generation of digital technologies to improve online security. We seek to make technological advances in areas ranging from OneSpan’s core business of strong authentication, to areas of growing importance such as cybersecurity incidents detection, digital identity and privacy. Our work aims to generate new scientific knowledge, prototypes, and intellectual property that can be transferred into products. We also aspire to be a leading academic-industry partner of choice on emerging technologies related to online security. Job Duties and Responsibilities The objective of the research scientist is to conduct applied research linked to OneSpan’s product range with the aim of enhancing OneSpan’s offering in the short and mid-term. Your key tasks are: Propose research agenda. Perform first-class research. Create research software prototypes that could lead to new products. Show leadership in your field of expertise. Work collaboratively in a team that spans international borders and departments. Requirements Must haves A PhD degree or equivalent experience in information engineering, computer science. Candidates expected to finish their PhD before autumn 2020 will also be considered. Strong proven interest and knowledge of one or more of these research areas: security, machine learning, digital identity, and privacy A willingness to learn and the ability to quickly understand unfamiliar areas of technology. Desirable skills Interest in computer security and machine learning. Some experience in software development. Experience in working in multi-disciplinary teams Authoring reports for and presenting to non-technical audiences. Demonstrated ability to innovate through publications, patents or equivalent

Closing date for applications:

Contact: Julie Tinel

More information: https://grnh.se/48c98f131us

OneSpan is seeking applications for highly motivated and self-driven research scientists to complement its Innovation Centre team currently working on cutting-edge research in security, privacy, machine learning and digital identity. The Innovation Centre was established to research and prototype the next generation of digital technologies to improve online security. We seek to make technological advances in areas ranging from OneSpan’s core business of strong authentication, to areas of growing importance such as cybersecurity incidents detection, digital identity and privacy. Our work aims to generate new scientific knowledge, prototypes, and intellectual property that can be transferred into products. We also aspire to be a leading academic-industry partner of choice on emerging technologies related to online security. Job Duties and Responsibilities The objective of the research scientist is to conduct applied research linked to OneSpan’s product range with the aim of enhancing OneSpan’s offering in the short and mid-term. Your key tasks are: Propose research agenda. Perform first-class research. Create research software prototypes that could lead to new products. Show leadership in your field of expertise. Work collaboratively in a team that spans international borders and departments. Requirements Must haves A PhD degree or equivalent experience in information engineering, computer science. Candidates expected to finish their PhD before autumn 2020 will also be considered. Strong proven interest and knowledge of one or more of these research areas: security, machine learning, digital identity, and privacy A willingness to learn and the ability to quickly understand unfamiliar areas of technology. Desirable skills Interest in computer security and machine learning. Some experience in software development. Experience in working in multi-disciplinary teams Authoring reports for and presenting to non-technical audiences. Demonstrated ability to innovate through publications, patents or equivalent

Closing date for applications:

Contact: Julie Tinel

More information: https://grnh.se/a47755df1us

Event date: 21 June to 24 June 2020
Submission deadline: 4 September 2020
Notification: 9 November 2020

Event date: 7 July to 9 July 2020

We introduce and construct a variant of a time-lock puzzle which is non-malleable. A non-malleable time-lock puzzle guarantees, roughly, that it is impossible to "maul" a puzzle into one for a related message without solving it. The security of this construction relies on the existence of any (plain) time-lock puzzle and it is proven secure in the auxiliary-input random oracle model. We show that our construction satisfies bounded concurrency and prove that it is impossible to obtain full concurrency. We additionally introduce a more general non-malleability notion, termed functional non-malleability, which protects against tampering attacks that affect a specific function of the related messages. We show that in many (useful) cases, our construction satisfies fully concurrent functional non-malleability.

We use our (functional) non-malleable time-lock puzzles to give efficient multi-party protocols for desirable tasks such as coin flipping and auctions. Our protocols are (1) fair, meaning that no malicious party can influence the output, (2) optimistically efficient, meaning that if all parties are honest, then the protocol terminates immediately, and (3) publicly verifiable, meaning that from the transcript of the protocol anyone can quickly infer the outcome, without the need to perform a long computation phase. Our protocols support an unbounded number of participants and require no adversary-independent trusted setup. Our protocol is the first protocol that satisfies all of the above properties under any assumption. Security is proven assuming the repeated squaring assumption and in the auxiliary-input random oracle model. Along the way, we introduce a publicly verifiable notion of time-lock puzzles which is of independent interest. This notion allows the solver of the puzzle to compute the solution together with a proof which can be quickly verified by anyone.

Lightweight authenticated key exchange (AKE) protocols based on symmetric-key cryptography is important in securing the Internet of Things (IoT). However, achieving perfect forward secrecy (PFS) is not trivial for AKE based on symmetric-key cryptography, as opposed to AKE based on public-key cryptography. The most recent proposals that provide PFS are SAKE and SAKE-AM. In this paper, we first take a closer look at these protocols and observe that they are vulnerable to a number of attacks, such as, replay attack, denial of service (DoS) attack, tracking attack, etc. We then propose countermeasures to both protocols to restore security. Additionally, our proposed scheme SAKE+ enables concurrent execution of the protocol, whereas the original SAKE scheme supports the sequential execution of the protocol. The concurrency provided by our scheme makes it more suitable for IoT applications where a server receives and sends information from a large number of IoT end devices. Finally, we prove the security and soundness of our schemes, and verify using ProVerif tool.

We propose a Dynamic Universal Accumulator in the Accumulator Manager setting for bilinear groups which extends Nguyen's positive accumulator and Au et al. and Damgård and Triandopoulos non-membership proof mechanism. The new features include support for batch addition and deletion operations as well as a privacy-friendly decentralized batch witness update protocol, where the witness update information is the same for all users. Together with a non-interactive zero-knowledge protocol, these make the proposed scheme suitable as an efficient and scalable Anonymous Credential System, accessible even by low-resource users. We show security of the proposed protocol under the t-SDH assumption through a proper initialization of the accumulator and we demonstrate its practical relevance by providing and discussing an implementation realized using state-of-the-art libraries.

Non-malleable codes allow one to encode data in such a way that, after tampering, the modified codeword is guaranteed to decode to either the original message, or a completely unrelated one. Since the introduction of the notion by Dziembowski, Pietrzak, and Wichs (ICS '10 and J. ACM '18), a large body of work has focused on realizing such coding schemes secure against various classes of tampering functions. It is well known that there is no efficient non-malleable code secure against all polynomial size tampering functions. Nevertheless, non-malleable codes in the plain model (i.e., no trusted setup) secure against $\textit{bounded}$ polynomial size tampering are not known and obtaining such a code has been a major open problem.

We present the first construction of a non-malleable code secure against $\textit{all}$ polynomial size tampering functions that have $\textit{bounded polynomial depth}$. This is an even larger class than all bounded polynomial $\textit{size}$ functions and, in particular, we capture all functions in non-uniform $\mathbf{NC}$ (and much more). Our construction is in the plain model (i.e., no trusted setup) and relies on several cryptographic assumptions such as keyless hash functions, time-lock puzzles, as well as other standard assumptions. Additionally, our construction has several appealing properties: the complexity of encoding is independent of the class of tampering functions and we obtain sub-exponentially small error.

We present several improvements to the framework of differential-linear attacks with a special focus on ARX ciphers. As a demonstration of their impact, we apply them to Chaskey and ChaCha and we are able to significantly improve upon the best attacks published so far.

A Hashed Time Lock Contract (HTLC) is a central concept in cryptocurrencies where some value can be spent either with the preimage of a public hash by one party (Bob) or after a timelock expires by another party (Alice). We present a bribery attack on HTLC's where Bob's hash-protected transaction is censored by Alice's timelocked transaction. Alice incentivizes miners to censor Bob's transaction by leaving almost all her value to miners in general. Miners follow (or refuse) the bribe if their expected payoff is better (or worse). We explore conditions under which this attack is possible, and how HTLC participants can protect themselves against the attack. Applications like Lightning Network payment channels and Cross-Chain Atomic Swaps use HTLC's as building blocks and are vulnerable to this attack. Our proposed solution uses the hashpower share of the weakest known miner to derive parameters that make these applications robust against this bribing attack.

In both hardware and software, masking can represent an effective means of hardening an implementation against side-channel attacks such as Differential Power Analysis (DPA). Focusing on software, however, the use of masking can present various challenges: specifically, it often 1) requires significant effort to translate any theoretical security properties into practice, and, even then, 2) imposes a significant overhead in terms of efficiency. To address both challenges, this paper explores use of an Instruction Set Extension (ISE) as a means of supporting masking in software-based implementations of symmetric cryptographic algorithms: we design, implement, and evaluate such an ISE using RISC-V as the base architecture.

The Fiat-Shamir transform is a methodology for compiling a (public-coin) interactive proof system for a language $L$ into a non-interactive argument system for $L$. Proving security of the Fiat-Shamir transform in the standard model, especially in the context of succinct arguments, is largely an unsolved problem. The work of Canetti et al. (STOC 2019) proved the security of the Fiat-Shamir transform applied to the Goldwasser-Kalai-Rothblum (STOC 2008) succinct interactive proof system under a very strong ``optimal learning with errors'' assumption. Achieving a similar result under standard assumptions remains an important open question.

In this work, we consider the problem of compiling a different succinct interactive proof system: Pietrzak's proof system (ITCS 2019) for the iterated squaring problem. We construct a hash function family (with evaluation time roughly $2^{\lambda^{\epsilon}}$) that guarantees the soundness of Fiat-Shamir for this protocol assuming the sub-exponential ($2^{-n^{1-\epsilon}}$)-hardness of the $n$-dimensional learning with errors problem. (The latter follows from the worst-case $2^{n^{1-\epsilon}}$ hardness of lattice problems.) More generally, we extend the ``bad-challenge function'' methodology of Canetti et al. for proving the soundness of Fiat-Shamir to a class of protocols whose bad-challenge functions are not efficiently computable.

As a corollary (following Choudhuri et al., ePrint 2019 and Ephraim et al., EUROCRYPT 2020), we construct hard-on-average problems in the complexity class $\mathbf{CLS}\subset \mathbf{PPAD}$ under the $2^{\lambda^\epsilon}$-hardness of the repeated squaring problem and the $2^{-n^{1-\epsilon}}$-hardness of the learning with errors problem. Under the additional assumption that the repeated squaring problem is ``inherently sequential'', we also obtain a Verifiable Delay Function (Boneh et al., EUROCRYPT 2018) in the standard model. Finally, we give additional PPAD-hardness and VDF instantiations demonstrating a broader tradeoff between the strength of the repeated squaring assumption and the strength of the lattice assumption.

Can Alice and Bob agree on a uniformly random secret key without having any truly secret randomness to begin with? Here we consider a setting where Eve can get partial leakage on the internal state of both Alice and Bob individually before the protocol starts. They then run a protocol using their states without any additional randomness and need to agree on a shared key that looks uniform to Eve, even after observing the leakage and the protocol transcript. We focus on non-interactive (one round) key exchange (NIKE), where Alice and Bob send one message each without waiting for one another.

We first consider this problem in the symmetric-key setting, where the states of Alice and Bob include a shared secret as well as individual uniform randomness. However, since Eve gets leakage on these states, Alice and Bob need to perform privacy amplification to derive a fresh secret key from them. Prior solutions require Alice and Bob to sample fresh uniform randomness during the protocol, while in our setting all of their randomness was already part of their individual states a priori and was therefore subject to leakage. We show an information-theoretic solution to this problem using a novel primitive that we call a two-seed extractor, which we in turn construct by drawing a connection to communication-complexity lower-bounds in the number-on-forehead (NOF) model.

We then turn to studying this problem in the public-key setting, where the states of Alice and Bob consist of independent uniform randomness. Unfortunately, we give a black-box separation showing that leakage-resilient NIKE in this setting cannot be proven secure via a black-box reduction under any game-based assumption when the leakage is super-logarithmic. This includes virtually all assumptions used in cryptography, and even very strong assumptions such as indistinguishability obfuscation (iO). Nevertheless, we also provide positive results that get around the above separation: - We show that every key exchange protocol (e.g., Diffie-Hellman) is secure when the leakage amount is logarithmic, or potentially even greater if we assume sub-exponential security without leakage. - We notice that the black-box separation does not extend to schemes in the common reference string (CRS) model, or to schemes with preprocessing, where Alice and Bob can individually pre-process their random coins to derive their secret state prior to leakage. We give a solution in the CRS model with preprocessing using bilinear maps. We also give solutions in just the CRS model alone (without preprocessing) or just with preprocessing (without a CRS), using iO and lossy functions.

We study collision-finding against Merkle-Damgård hashing in the random-oracle model by adversaries with an arbitrary $S$-bit auxiliary advice input about the random oracle and $T$ queries. Recent work showed that such adversaries can find collisions (with respect to a random IV) with advantage $\Omega(ST^2/2^n)$, where $n$ is the output length, beating the birthday bound by a factor of $S$. These attacks were shown to be optimal. We observe that the collisions produced are very long, on the order $T$ blocks, which would limit their practical relevance. We prove several results related to improving these attacks to find short collisions. We first exhibit a simple attack for finding $B$-block-long collisions achieving advantage $\tilde{\Omega}(STB/2^n)$. We then study if this attack is optimal. We show that the prior technique based on the bit-fixing model (used for the $ST^2/2^n$ bound) provably cannot reach this bound, and towards a general result we prove there are qualitative jumps in the optimal attacks for finding length $1$, length $2$, and unbounded-length collisions. Namely, the optimal attacks achieve (up to logarithmic factors) order of $(S+T)/2^n$, $ST/2^n$ and $ST^2/2^n$ advantage. We also give an upper bound on the advantage of a restricted class of short-collision finding attacks via a new analysis on the growth of trees in random functional graphs that may be of independent interest.

We observe that all previously known lattice-based blind signature schemes contain subtle flaws in their security proofs (e.g., R\"uckert, ASIACRYPT '08) or can be attacked (e.g., BLAZE by Alkadri et al., FC '20). Motivated by this, we revisit the problem of constructing blind signatures from standard lattice assumptions.

We propose a new three-round lattice-based blind signature scheme whose security can be proved, in the random oracle model, from the standard SIS assumption. Our starting point is a modified version of the (insecure) BLAZE scheme, which itself is based Lyubashevsky's three-round identification scheme combined with a new aborting technique to reduce the correctness error. Our proof builds upon and extends the recent modular framework for blind signatures of Hauck, Kiltz, and Loss (EUROCRYPT '19). It also introduces several new techniques to overcome the additional challenges posed by the correctness error which is inherent to all lattice-based constructions.

While our construction is mostly of theoretical interest, we believe it to be an important stepping stone for future works in this area.