IACR News
Here you can see all recent updates to the IACR webpage. These updates are also available:
07 July 2020
Ashoka SB, Lakshmikanth D
ePrint ReportDaniel Adkins, Archita Agarwal, Seny Kamara, Tarik Moataz
ePrint ReportXuan Thanh Do, Duong Hieu Phan, Moti Yung
ePrint ReportWe first present an AnoBEB construction for up to $k$ users from LWE assumption, where $k$ is bounded by the scheme security parameter. The scheme does not grow with the parameter and beat the PKE method. Actually, our scheme is as efficient as the underlying LWE public-key encryption; namely, the rate is, in fact, $1$ and thus optimal. The scheme is achieved easily by an observation about an earlier scheme with a different purpose.
More interestingly, we move on to employ the new AnoBEB in other multimedia broadcasting methods and, as a second contribution, we introduce a new approach to construct an efficient ``Trace and Revoke scheme'' which combines the functionalites of revocation and of tracing people (called traitors) who in a broadcasting schemes share their keys with the adversary which, in turn, generates a pirate receiver. Note that, as was put forth by Kiayias and Yung (EUROCRYPT '02), combinatorial traitor tracing schemes can be constructed by combining a system for small universe, integrated via an outer traceability codes (collusion-secure code or identifying parent property (IPP) code). There were many efficient traitor tracing schemes from traceability codes, but no known scheme supports revocation as well. Our new approach integrates our AnoBEB system with a Robust IPP code, introduced by Barg and Kabatiansky (IEEE IT '13). This shows an interesting use for robust IPP in cryptography. The robust IPP codes were only implicitly shown by an existence proof. In order to make our technique concrete, we propose two explicit instantiations of robust IPP codes. Our final construction gives the most efficient trace and revoke scheme in the bounded collusion model.
Jiayu Qiang, Yi Deng
ePrint ReportFynn Dallmeier, Jan P. Drees, Kai Gellert, Tobias Handirk, Tibor Jager, Jonas Klauke, Simon Nachtigall, Timo Renzelmann, Rudi Wolf
ePrint ReportSuch protocols meet the demand for communication with minimal latency, but those currently deployed in practice achieve only rather weak security properties, as they may not achieve forward security for the first transmitted payload message and require additional countermeasures against replay attacks.
Recently, 0-RTT protocols with full forward security and replay resilience have been proposed in the academic literature. These are based on puncturable encryption, which uses rather heavy building blocks, such as cryptographic pairings. Some constructions were claimed to have practical efficiency, but it is unclear how they compare concretely to protocols deployed in practice, and we currently do not have any benchmark results that new protocols can be compared with.
We provide the first concrete performance analysis of a modern 0-RTT protocol with full forward security, by integrating the Bloom Filter Encryption scheme of Derler et al. (EUROCRYPT 2018) in the Chromium QUIC implementation and comparing it to Google's original QUIC protocol.
We find that for reasonable deployment parameters, the server CPU load increases approximately by a factor of eight and the memory consumption on the server increases significantly, but stays below 400 MB even for medium-scale deployments that handle up to 50K connections per day. The difference of the size of handshake messages is small enough that transmission time on the network is identical, and therefore not significant.
We conclude that while current 0-RTT protocols with full forward security come with significant computational overhead, their use in practice is not infeasible, and may be used in applications where the increased CPU and memory load can be tolerated in exchange for full forward security and replay resilience on the cryptographic protocol level. Our results also serve as a first benchmark that can be used to assess the efficiency of 0-RTT protocols potentially developed in the future.
Jacqueline Brendel, Cas Cremers, Dennis Jackson, Mang Zhao
ePrint ReportRemarkably, no detailed proofs have ever been given for these security properties for EdDSA, and in particular its Ed25519 instantiations. Ed25519 is one of the most efficient and widely used signature schemes, and different instantiations of Ed25519 are used in protocols such as TLS 1.3, SSH, Tor, ZCash, and WhatsApp/Signal. The differences between these instantiations are subtle, and only supported by informal arguments, with many works assuming results can be directly transferred from Schnorr signatures. Similarly, several proofs of protocol security simply assume that Ed25519 satisfies properties such as EUF-CMA or SUF-CMA.
In this work we provide the first detailed analysis and security proofs of Ed25519 signature schemes. While the design of the schemes follows the well-established Fiat-Shamir paradigm, which should guarantee existential unforgeability, there are many side cases and encoding details that complicate the proofs, and all other security properties needed to be proven independently.
Our work provides scientific rationale for choosing among several Ed25519 variants and understanding their properties, fills a much needed proof gap in modern protocol proofs that use these signatures, and supports further standardisation efforts.
Kwangsu Lee
ePrint ReportMichail Moraitis, Elena Dubrova
ePrint Report06 July 2020
Tim Beyne, Anne Canteaut, Gregor Leander, María Naya-Plasencia, Léo Perrin, Friedrich Wiemer
ePrint ReportWilly Quach
ePrint ReportOur main technical contribution is a public-key encryption scheme from LWE where messy public keys (under which encryptions hide the underlying message statistically) can be recognized in time essentially independent of the LWE modulus $q$.
Christian Badertscher, Alexandru Cojocaru, Léo Colisson, Elham Kashefi, Dominik Leichtle, Atul Mantri, Petros Wallden
ePrint ReportTherefore the question becomes relevant whether it is possible to rely solely on classical channels between client and server and yet benefit from its quantum capabilities while retaining privacy. Classical-client remote state preparation ($\sf{RSP}_{CC}$) is one of the promising candidates to achieve this because it enables a client, using only classical communication resources, to remotely prepare a quantum state. However, the privacy loss incurred by employing $\sf{RSP}_{CC}$ as sub-module to avoid quantum channels is unclear.
In this work, we investigate this question using the Constructive Cryptography framework by Maurer and Renner (ICS'11). We first identify the goal of $\sf{RSP}_{CC}$ as the construction of ideal \RSP resources from classical channels and then reveal the security limitations of using $\sf{RSP}_{CC}$ in general and in specific contexts:
1. We uncover a fundamental relationship between constructing ideal $\sf{RSP}$ resources (from classical channels) and the task of cloning quantum states with auxiliary information. Any classically constructed ideal $\sf{RSP}$ resource must leak to the server the full classical description (possibly in an encoded form) of the generated quantum state, even if we target computational security only. As a consequence, we find that the realization of common $\sf{RSP}$ resources, without weakening their guarantees drastically, is impossible due to the no-cloning theorem.
2. The above result does not rule out that a specific $\sf{RSP}_{CC}$ protocol can replace the quantum channel at least in some contexts, such as the Universal Blind Quantum Computing ($\sf{UBQC}$) protocol of Broadbent et al. (FOCS 09). However, we show that the resulting $\sf{UBQC}$ protocol cannot maintain its proven composable security as soon as $\sf{RSP}_{CC}$ is used as a subroutine.
3. We show that replacing the quantum channel of the above $\sf{UBQC}$ protocol by the $\sf{RSP}_{CC}$ protocol QFactory of Cojocaru et al. (Asiacrypt 19), preserves the weaker, game-based, security of $\sf{UBQC}$.
Osman Biçer, Alptekin Küpçü
ePrint ReportLuka Music, Céline Chevalier, Elham Kashefi
ePrint ReportHowever, the reality is much more complex. Security models dealing with superposition attacks only consider unconditional security. Conversely, security models considering computational security assume that all supposedly classical messages are measured, which forbids by construction the analysis of superposition attacks. Boneh and Zhandry have started to study the quantum computational security for classical primitives in their seminal work at Crypto'13, but only in the single-party setting. To the best of our knowledge, an equivalent model in the multiparty setting is still missing.
In this work, we propose the first computational security model considering superposition attacks for multiparty protocols. We show that our new security model is satisfiable by proving the security of the well-known One-Time-Pad protocol and give an attack on a variant of the equally reputable Yao Protocol for Secure Two-Party Computations. The post-mortem of this attack reveals the precise points of failure, yielding highly counter-intuitive results: Adding extra classical communication, which is harmless for classical security, can make the protocol become subject to superposition attacks. We use this newly imparted knowledge to construct the first concrete protocol for Secure Two-Party Computation that is resistant to superposition attacks. Our results show that there is no straightforward answer to provide for either the vulnerabilities of classical protocols to superposition attacks or the adapted countermeasures.
Marc Abboud, Thomas Prest
ePrint ReportTal Moran, Daniel Wichs
ePrint ReportThe recent work of Damg\aa{}rd, Ganesh and Orlandi (CRYPTO '19) defined a variant of incompressible encodings as a building block for ``proofs of replicated storage''. They constructed incompressible encodings in an ideal permutation model, but it was left open if they can be constructed under standard assumptions, or even in the more basic random-oracle model. In this work, we undertake the comprehensive study of incompressible encodings as a primitive of independent interest and give new constructions, negative results and applications:
* We construct incompressible encodings in the common random string (CRS) model under either Decisional Composite Residuosity (DCR) or Learning with Errors (LWE). However, the construction has several drawbacks: (1) it is not composable, (2) it only achieves selective security, and (3) the CRS is as long as the data $m$. * We leverage the above construction to also get a scheme in the random-oracle model, under the same assumptions, that avoids all of the above drawbacks. Furthermore, it is significantly more efficient than the prior ideal-model construction. * We give black-box separations, showing that incompressible encodings in the plain model cannot be proven secure under any standard hardness assumption, and incompressible encodings in the CRS model must inherently suffer from all of the drawbacks above. * We give a new application to ``big-key cryptography in the bounded-retrieval model'', where secret keys are made intentionally huge to make them hard to exfiltrate. Using incompressible encodings, we can get all the security benefits of a big key without wasting storage space, by having the key to encode useful data.
Luca Frittoli, Matteo Bocchi, Silvia Mella, Diego Carrera, Beatrice Rossi, Pasqualina Fragneto, Ruggero Susella, Giacomo Boracchi
ePrint Report03 July 2020
KU Leuven, Belgium
Job PostingThe Innovation Manager will identify opportunities for bilateral projects and research platforms, technology transfer, and potentially spin-off companies, including the definition of licenses, patents or other forms of valorization. All these tasks are executed in coordination with KU Leuven Research and Development. In particular, the Innovation Manager will assist in defining and maintaining a strategic research agenda to create a continuum between fundamental research, strategic research and applied research.
The lndustrial Research Fund (lOF) of KU Leuven forms a bridge between strategic basic research, technological innovations and industrial collaborations. Based on cooperations with KU Leuven research groups and different stakeholders from industry and society, we aim to broaden our valorization portfolio and to increase the transfer of knowledge. We have a team of more than 40 experienced innovation managers involved in the development of practical and innovative technological solutions based on the expertise and infrastructure of the research groups within KU Leuven.
Profile
- PhD or equivalent research expertise in applied cryptography
- Preferably industrial experience
- At least a high level understanding or parts of MPC, FHE, PQC, TEE
- Experience in valorization of research results
- Creative, enthusiastic, with a strong commitment to research valorization
- Proactive, entrepreneurial mindset
- Strong communication skills, including international and intercultural
- Willing to travel globally
Closing date for applications:
Contact: Nigel Smart (nigel.smart@kuleuven.be) Ingrid Verbauwhede (ingrid.verbauwhede@kuleuven.be) Frederik Vercauteren (frederik.vercauteren@kuleuven.be)
More information: https://www.kuleuven.be/personeel/jobsite/jobs/55715055
01 July 2020
London, United Kingdom, 30 November - 1 December 2020
Event CalendarSubmission deadline: 24 August 2020
Notification: 1 October 2020
Aizuwakamatsu, Japan, 30 January - 2 February 2020
Event CalendarSubmission deadline: 20 July 2020
Notification: 15 September 2020
30 June 2020
Fujitsu Laboratories of America
Job PostingProfile Description:
- Proven experience in production quality software development.
- Previous experience and code contributions to open source projects is a plus.
- Experience in implementation of cryptographic libraries.
- Graduate level knowledge of crypto theory. Familiarity with threshold cryptosystems and multiparty protocols (MPC). Academic publications in Crypto/Security is a plus.
- Experience in design and implementation of large software systems and writing secure code in C/C++/Rust/Golang.
- Familiarity with blockchain systems such as Hyperledger Fabric and/or Ethereum.
- Ability to meet deliverables and deadlines with minimal supervision.
- Fluent in written and spoken english.
Deadline for Application: Open until the position is filled.
Start Date: Immediate, but flexible.
Salary: Very attractive, depends on experience.
Closing date for applications:
Contact: Avradip Mandal, Researcher. amandal@fujitsu.com