IACR News
Here you can see all recent updates to the IACR webpage. These updates are also available:
22 July 2021
Lichao Wu, Guilherme Perin, Stjepan Picek
ePrint Report
Deep learning-based side-channel analysis already became a de-facto standard when investigating the most powerful profiling side-channel analysis. The results from the last few years show that deep learning techniques can efficiently break targets that are even protected with countermeasures. While there are constant improvements in making the deep learning-based attacks more powerful, little is done on evaluating such attacks' performance. Indeed, what is done today is not different from what was done more than a decade ago.
This paper considers how to evaluate deep learning-based side-channel analysis and whether the commonly used techniques give the best results. To that end, we consider different summary statistics and the influence of algorithmic randomness on the stability of profiling models. Our results show that besides commonly used metrics like guessing entropy, one should also show the standard deviation results to assess the attack performance properly. Our results show that using the arithmetic mean for guessing entropy does not yield the best results, and instead, a geometric mean should be used.
This paper considers how to evaluate deep learning-based side-channel analysis and whether the commonly used techniques give the best results. To that end, we consider different summary statistics and the influence of algorithmic randomness on the stability of profiling models. Our results show that besides commonly used metrics like guessing entropy, one should also show the standard deviation results to assess the attack performance properly. Our results show that using the arithmetic mean for guessing entropy does not yield the best results, and instead, a geometric mean should be used.
Melissa Azouaoui, Olivier Bronchain, Vincent Grosso, Kostas Papagiannopoulos, François-Xavier Standaert
ePrint Report
We revisit the popular adage that side-channel countermeasures must be combined to be efficient, and study its application to bitslice masking and shuffling. Our contributions are threefold. First, we improve this combination: by shuffling the shares of a masked implementation rather than its tuples, we can amplify the impact of the shuffling exponentially in the number of shares, while this impact was independent of the masking security order in previous works. Second, we evaluate the masking and shuffling combination's performance vs. security tradeoff under sufficient noise conditions: we show that the best approach is to mask first (i.e., fill the registers with as many shares as possible) and shuffle the independent operations that remain. Third, we discuss the challenges for implementing masking and shuffling under low noise conditions: we recall that such algorithmic countermeasures cannot be implemented securely without a minimum level of physical noise. We conclude that with moderate but sufficient noise, the bitslice masking + shuffling combination is relevant, and its interest increases when randomness is expensive and many independent operations are available for shuffling. When these conditions are not met, masking only is the best option. As a side result, we improve the best known attack against shuffling from Asiacrypt 2012, which we use in our concrete evaluations.
Sébastien Duval, Pierrick Méaux, Charles Momin, François-Xavier Standaert
ePrint Report
State-of-the-art re-keying schemes can be viewed as a tradeoff between efficient but heuristic solutions based on binary field multiplications, that are only secure if implemented with a sufficient amount of noise, and formal but more expensive solutions based on weak pseudorandom functions, that remain secure if the adversary accesses their output in full. Recent results on “crypto dark matter” (TCC 2018) suggest that low-complexity pseudorandom functions can be obtained by mixing
linear functions over different small moduli. In this paper, we conjecture that by mixing some matrix multiplications in a prime field with a physical mapping similar to the leakage functions exploited in side-channel analysis, we can build efficient
re-keying schemes based on “crypto-physical dark matter”, that remain secure against an adversary who can access noise-free measurements. We provide first analyzes of the security and implementation properties that such schemes provide. Precisely, we first show that they are more secure than the initial (heuristic) proposal by Medwed et al. (AFRICACRYPT 2010). For example, they can resist attacks put forward by Belaid et al. (ASIACRYPT 2014), satisfy some relevant cryptographic properties and can be connected to a “Learning with Physical Rounding” problem that shares some similarities with standard learning problems. We next show that they are significantly more efficient than the weak pseudorandom function proposed by Dziembowski et al. (CRYPTO 2016), by exhibiting hardware implementation results.
Yifeng Song, Danyang Zhu, Jing Tian, Zhongfeng Wang
ePrint Report
Due to the enormous energy consuming involved in the proof of work (POW) process, the resource-efficient blockchain system is urged to be released. The verifiable delay function (VDF), being slow to compute and easy to verify, is believed to be the kernel function of the next-generation blockchain system. In general, the reduction over a class group, involving many complex operations, such as the large-number division and multiplication operations, takes a large portion in the VDF. In this paper, for the first time, we propose a highspeed architecture for the reduction by incorporating algorithmic transformations and architectural optimizations. Firstly, based on the fastest reduction algorithm, we present a modified version to make it more hardware-friendly by introducing a novel transformation method that can efficiently remove the largenumber
divisions. Secondly, highly parallelized and pipelined architectures are devised respectively for the large-number multiplication and addition operations to reduce the latency and the critical path. Thirdly, a compact state machine is developed to enable maximum overlapping in time for computations. The experiment results show that when computing 209715 reduction steps with the input width of 2048 bits, the proposed design only takes 137.652ms running on an Altera Stratix-10 FPGA at 100MHz frequency, while the original algorithm needs 3278ms when operating over an i7-6850K CPU at 3.6GHz frequency. Thus we have obtained a drastic speedup of nearly 24x over an advanced CPU.
19 July 2021
Zilliqa Research Pte. Ltd., Remote position
Job Posting
Zilliqa Research Pte. Ltd. is the creator of Zilliqa – a scalable blockchain platform to run distributed applications. The company maintains the platform as well as develops tools and services around it.
The research team at Zilliqa consists of senior researchers and research engineers working on distributed systems, programming languages, system security and formal verification. Since starting in late 2017, the team has produced several scientific and engineering work ranging from distributed systems, e.g., the sharding design for scaling blockchains that is now being adopted by several other platforms; to programming languages, e.g., a new principled smart contract language amenable to formal verification called Scilla among others.
We firmly believe in conducting research with practical significance in the blockchain space and particularly research that can go into production systems like Zilliqa, Ethereum or Bitcoin.
Role Overview: As a blockchain researcher, you will be responsible for conducting impactful research that can improve the state of the art blockchain infrastructures and in particular the Zilliqa blockchain. In this role, you will be working very closely with the research team as well as system engineers. We offer a competitive salary, a creative work environment and an opportunity to push a research contribution into a production system.
Scope of Role: We are looking for a researcher with experience in blockchains, distributed systems and applied cryptography. The role will require the researcher to identify key research problems in the blockchain space and the Zilliqa platform in particular and conduct impactful research.
Experience: Research experience either as a PhD or as research assistant.
Must have published at least 2 papers in top-tier conferences.
Must have a good engineering background.
Must have conducted research in distributed systems, applied cryptography, system security, and blockchains in general.
Applying for this Role: Contact us by sending your updated CV.
The research team at Zilliqa consists of senior researchers and research engineers working on distributed systems, programming languages, system security and formal verification. Since starting in late 2017, the team has produced several scientific and engineering work ranging from distributed systems, e.g., the sharding design for scaling blockchains that is now being adopted by several other platforms; to programming languages, e.g., a new principled smart contract language amenable to formal verification called Scilla among others.
We firmly believe in conducting research with practical significance in the blockchain space and particularly research that can go into production systems like Zilliqa, Ethereum or Bitcoin.
Role Overview: As a blockchain researcher, you will be responsible for conducting impactful research that can improve the state of the art blockchain infrastructures and in particular the Zilliqa blockchain. In this role, you will be working very closely with the research team as well as system engineers. We offer a competitive salary, a creative work environment and an opportunity to push a research contribution into a production system.
Scope of Role: We are looking for a researcher with experience in blockchains, distributed systems and applied cryptography. The role will require the researcher to identify key research problems in the blockchain space and the Zilliqa platform in particular and conduct impactful research.
Experience:
Applying for this Role: Contact us by sending your updated CV.
Closing date for applications:
Contact: amrit@zilliqa.com
TU Darmstadt, Germany
Job Posting
The Cryptography and Privacy Engineering Group (ENCRYPTO) @CS Department @Technical University of Darmstadt offers a fully funded position as Doctoral Researcher (Research Assistant/PhD Student) in Private Machine Learning for Mobile Applications, ideally starting from Oct 1, 2021 for up to 3 years with the possibility of extension.
Job description: You'll work in the research training group/doctoral college Privacy & Trust for Mobile Users funded by the German Research Foundation (DFG). In our sub-project, we build cryptography-based private machine learning services for mobile applications and investigate their legal applicability (data protection) and economic feasibility in interdisciplinary collaborations. You conduct research, implement prototypes, and publish&present the results at top venues. You'll participate in teaching and supervise thesis students & student assistants.
We offer: We demonstrate that privacy is efficiently protectable in real-world applications via cryptographic protocols. Our open and international working environment facilitates excellent research in a sociable team. TU Darmstadt is a top research university for IT security, cryptography and CS in Europe. Darmstadt is a very international, livable and well-connected city in the Rhine-Main area around Frankfurt. Knowledge of German is beneficial, but not required, and TU Darmstadt offers corresponding support.
Your profile:
Job description: You'll work in the research training group/doctoral college Privacy & Trust for Mobile Users funded by the German Research Foundation (DFG). In our sub-project, we build cryptography-based private machine learning services for mobile applications and investigate their legal applicability (data protection) and economic feasibility in interdisciplinary collaborations. You conduct research, implement prototypes, and publish&present the results at top venues. You'll participate in teaching and supervise thesis students & student assistants.
We offer: We demonstrate that privacy is efficiently protectable in real-world applications via cryptographic protocols. Our open and international working environment facilitates excellent research in a sociable team. TU Darmstadt is a top research university for IT security, cryptography and CS in Europe. Darmstadt is a very international, livable and well-connected city in the Rhine-Main area around Frankfurt. Knowledge of German is beneficial, but not required, and TU Darmstadt offers corresponding support.
Your profile:
- Completed Master's degree (or equivalent) at a top university with excellent grades in IT security, computer science, or a similar area.
- Extensive knowledge in applied cryptography/IT security and very good software development skills. Knowledge in cryptographic protocols (ideally MPC) is a plus.
- Experience with/motivation for working with other disciplines, e.g., law or economics.
- Self-motivated, reliable, creative, can work independently, and want to do excellent research.
- Our working language is English: able to discuss/write/present scientific results in English. German is beneficial but not required.
Closing date for applications:
Contact: Thomas Schneider (application@encrypto.cs.tu-darmstadt.de)
More information: https://encrypto.de/2021-RTG-EN
Brandenburg University of Technology (BTU) Cottbus-Senftenberg
Job Posting
Dear students,
Several PhD positions (TV-L 13, full time) in the area of self-learning. Anomaly detection for critical infrastructure, secure cyber-physical Systems, Artificial Intelligence/Machine Learning for Encrypted Network Traffic Analysis (Traffic Analysis) at the Brandenburg University of Technology (BTU Cottbus) are to be filled as soon as possible.
English-speaking applicants with basic German language skills are also welcome.
Tasks:
Active research in the area of intrusion detection systems (IDS) for critical infrastructures, secure cyber-physical systems, and artificial intelligence / machine learning for traffic analysis.
Implementation and evaluation of new algorithms and methods.
Cooperation and knowledge transfer with industrial partners.
Publication of scientific results.
Assistance with teaching.
The employment takes place with the goal of doctoral graduation (obtaining a PhD degree).
Requirements:
Recognized above-average master's degree in computer science or a related discipline
Very good English skills
Programming skills
Interest in IT security/privacy/networking.
Applications containing the following documents:
A detailed Curriculum Vitae.
Transcript of records from your Master studies.
An electronic version of your Master thesis, if possible should be sent in a single PDF file as soon as possible, but not later than 30.07.2021 at itsec-jobs.informatik@lists.b-tu.de.
Several PhD positions (TV-L 13, full time) in the area of self-learning. Anomaly detection for critical infrastructure, secure cyber-physical Systems, Artificial Intelligence/Machine Learning for Encrypted Network Traffic Analysis (Traffic Analysis) at the Brandenburg University of Technology (BTU Cottbus) are to be filled as soon as possible.
English-speaking applicants with basic German language skills are also welcome.
Tasks:
Active research in the area of intrusion detection systems (IDS) for critical infrastructures, secure cyber-physical systems, and artificial intelligence / machine learning for traffic analysis.
Implementation and evaluation of new algorithms and methods.
Cooperation and knowledge transfer with industrial partners.
Publication of scientific results.
Assistance with teaching.
The employment takes place with the goal of doctoral graduation (obtaining a PhD degree).
Requirements:
Recognized above-average master's degree in computer science or a related discipline
Very good English skills
Programming skills
Interest in IT security/privacy/networking.
Applications containing the following documents:
A detailed Curriculum Vitae.
Transcript of records from your Master studies.
An electronic version of your Master thesis, if possible should be sent in a single PDF file as soon as possible, but not later than 30.07.2021 at itsec-jobs.informatik@lists.b-tu.de.
Closing date for applications:
Contact: Prof. A. Panchenko
More information: https://www.informatik.tu-cottbus.de/~andriy/phd-ad-btu_en.pdf
15 July 2021
Yokohama, Japan, 7 March - 11 March 2022
PKC
Event date: 7 March to 11 March 2022
Submission deadline: 6 September 2021
Notification: 30 November 2021
Submission deadline: 6 September 2021
Notification: 30 November 2021
University of Stuttgart, Institute of Information Security
Job Posting
The Institute of Information Security at University of Stuttgart offers a
fully-funded Postdoc position in formal verification.
The successful candidate is expected to work on tool-supported formal verification of security-critical systems and security protocols.
The position is available immediately with an internationally competitive salary (German public salary scale TV-L E13, or TV-L E14, depending on the candidate's qualification, ranging from about 4.600 Euro to 6.200 Euro monthly gross salary). The appointment period follows the German Wissenschaftszeitvertragsgesetz (WissZeitVg), ranging from one year to up to six years.
The Institute of Information Security offers a creative international environment for top-level international research in Germany's high-tech region.
The successful candidate should have a Ph.D. (or should be very close to completion thereof) in Computer Science, Mathematics, Information Security, or a related field. We value strong analytical skills and
- solid knowledge of logic, proofs and/or formal verification techniques (Theorem Proving, Type Checking, etc.),
- solid programming experience.
The deadline for applications is
August 1st, 2021.
Late applications will be considered until the position is filled. See the official job announcement for details on how to apply.
https://www.sec.uni-stuttgart.de/institute/job-openings/
Closing date for applications:
Contact: Prof. Ralf Küsters
Institute of Information Security
University of Stuttgart
Germany
ralf.kuesters@sec.uni-stuttgart.de
More information: https://www.sec.uni-stuttgart.de/institute/job-openings/
QPQ
Job Posting
Did you recently gain a Master/PhD in the area of Applied Cryptology?
Do you want to design, code and co-invent the next generation of Distributed Systems protocols?
At QPQ, we are building the Internet of Economics, a new approach to a compliant and regulated financial systems infrastructure.
Join a team of mathematicians, computer scientists, engineers and self-taught individuals.
What do we give you?
Do you want to design, code and co-invent the next generation of Distributed Systems protocols?
At QPQ, we are building the Internet of Economics, a new approach to a compliant and regulated financial systems infrastructure.
Join a team of mathematicians, computer scientists, engineers and self-taught individuals.
What do we give you?
- A stimulating, Socratic intellectual environment.
- As Socratic implies, we want you to have a voice. We do not recruit brilliant people to put them in boxes, we recruit brilliant people so they can push the horizons even further.
- Hybrid office approach – we have been a distributed workforce from the start. This role is centred around our European axis, so we expect you to live within +/- 2 hours of CET. We get together a complete team every quarter, so you must be willing to travel and embrace being part of a diverse team drawn from many walks of life and cultures.
- Competitive salary, travel expense budget and many future opportunities to participate in the company’s growth.
- The mother of all intellectual challenges!
- Perform research and engineering on cryptographic protocols applied in a DeFi context.
- Working with a multi-faceted team of practitioners on a set of blockchain-based privacy protocols interacting in a DeFi environment and providing compliance with financial regulations.
- Focus on modern zero knowledge protocols that guarantee privacy and compliance.
- Master or Ph.D. in cryptography or a closely related field.
- Be able to prototype protocols/schemes/algorithms in at least one relevant programming language.
- General understanding of full-stack system architecture.
- Have a thorough approach and be committed to high quality output.
- Have prior research/code already published in the space.
- A proactive, self-driven approach and problem-solving mindset.
Closing date for applications:
Contact: Emanuele Ragnoli at opportunities at qpq.io
QPQ
Job Posting
Do you have a Master/PhD, research or coding experience in the area of Applied Cryptology?
Do you want to design, code and co-invent the next generation of Distributed Systems protocols?
At QPQ, we are building the Internet of Economics, a new approach to a compliant and regulated financial systems infrastructure. Join a team of mathematicians, computer scientists, engineers and self-taught individuals.
What do we give you?
Do you want to design, code and co-invent the next generation of Distributed Systems protocols?
At QPQ, we are building the Internet of Economics, a new approach to a compliant and regulated financial systems infrastructure. Join a team of mathematicians, computer scientists, engineers and self-taught individuals.
What do we give you?
- A stimulating, Socratic intellectual environment. As Socratic implies, we want you to have a voice. We do not recruit brilliant people to put them in boxes, we recruit brilliant people so they can push the horizons even further.
- Hybrid office approach – we have been a distributed workforce from the start. This role is centred around our European axis, so we expect you to live within +/- 2 hours of CET. We get together a complete team every quarter, so you must be willing to travel and embrace being part of a diverse team drawn from many walks of life and cultures.
- Competitive salary, travel expense budget and many future opportunities to participate in the company’s growth.
- The mother of all intellectual challenges!
- Perform research and engineering on cryptographic protocols in a DS context.
- Working with a multi-faceted team of practitioners on a set of DLT-based privacy protocols interacting in a DeFi environment and providing compliance with financial regulations.
- Focus on modern zero knowledge protocols that guarantee privacy and compliance.
- 3+ years of experience in software development.
- Be able to prototype protocols/schemes/algorithms in at least one relevant programming language.
- General understanding of full-stack system architecture.
- Have a thorough approach and be committed to high quality output Have prior research/code already published in the space.
- Excellent communication and collaboration skills.
- A proactive, self-driven approach and problem.
Closing date for applications:
Contact: Emanuele Ragnoli at opportunities at qpq.io
13 July 2021
Yohei Watanabe, Takeshi Nakai, Kazuma Ohara, Takuya Nojima, Yexuan Liu, Mitsugu Iwamoto, Kazuo Ohta
ePrint Report
Searchable symmetric encryption (SSE) enables clients to search encrypted data. Curtmola et al. (ACM CCS 2006) formalized a model and security notions of SSE and proposed two concrete constructions called SSE-1 and SSE-2. After the seminal work by Curtmola et al., SSE becomes an active area of encrypted search.
In this paper, we focus on two unnoticed problems in the seminal paper by Curtmola et al. First, we show that SSE-2 does not appropriately implement Curtmola et al.'s construction idea for dummy addition. We refine SSE-2's (and its variants') dummy-adding procedure to keep the number of dummies sufficiently many but as small as possible. We then show how to extend it to the dynamic setting while keeping the dummy-adding procedure work well and implement our scheme to show its practical efficiency. Second, we point out that the SSE-1 can cause a search error when a searched keyword is not contained in any document file stored at a server and show how to fix it.
In this paper, we focus on two unnoticed problems in the seminal paper by Curtmola et al. First, we show that SSE-2 does not appropriately implement Curtmola et al.'s construction idea for dummy addition. We refine SSE-2's (and its variants') dummy-adding procedure to keep the number of dummies sufficiently many but as small as possible. We then show how to extend it to the dynamic setting while keeping the dummy-adding procedure work well and implement our scheme to show its practical efficiency. Second, we point out that the SSE-1 can cause a search error when a searched keyword is not contained in any document file stored at a server and show how to fix it.
Anne Canteaut, Lukas Kölsch, Chao Li, Chunlei Li, Kangquan Li, Longjiang Qu, Friedrich Wiemer
ePrint Report
Recently, Bar-On et al. introduced at Eurocrypt’19 a new tool, called the differential-linear connectivity table (DLCT), which allows for taking into account the dependency between the two subciphers E_0 and E_1 involved in differential-linear attacks.
This paper presents a theoretical characterization of the DLCT, which corresponds to an autocorrelation table (ACT) of a vectorial Boolean function. We further provide some new theoretical results on ACTs of vectorial Boolean functions.
This paper presents a theoretical characterization of the DLCT, which corresponds to an autocorrelation table (ACT) of a vectorial Boolean function. We further provide some new theoretical results on ACTs of vectorial Boolean functions.
Andrea Coladangelo, Jiahui Liu, Qipeng Liu, Mark Zhandry
ePrint Report
In 2012, Aaronson and Christiano introduced the idea of hidden subspace states to build public-key quantum money [STOC '12]. Since then, this idea has been applied to realize several other cryptographic primitives which enjoy some form of unclonability.
In this work, we study a generalization of hidden subspace states to hidden coset states. This notion was considered independently by Vidick and Zhang [Eurocrypt '21], in the context of proofs of quantum knowledge from quantum money schemes. We explore unclonable properties of coset states and several applications:
* We show that, assuming indistinguishability obfuscation (iO), hidden coset states possess a certain direct product hardness property, which immediately implies a tokenized signature scheme in the plain model. Previously, a tokenized signature scheme was known only relative to an oracle, from a work of Ben-David and Sattath [QCrypt '17].
* Combining a tokenized signature scheme with extractable witness encryption, we give a construction of an unclonable decryption scheme in the plain model. The latter primitive was recently proposed by Georgiou and Zhandry [ePrint '20], who gave a construction relative to a classical oracle.
* We conjecture that coset states satisfy a certain natural (information-theoretic) monogamy-of-entanglement property. Assuming this conjecture is true, we remove the requirement for extractable witness encryption in our unclonable decryption construction, by relying instead on compute-and-compare obfuscation for the class of unpredictable distributions. As potential evidence in support of the monogamy conjecture, we prove a weaker version of this monogamy property, which we believe will still be of independent interest.
* Finally, we give a construction of a copy-protection scheme for pseudorandom functions (PRFs) in the plain model. Our scheme is secure either assuming iO, OWF and extractable witness encryption, or assuming iO, OWF, compute-and-compare obfuscation for the class of unpredictable distributions, and the conjectured monogamy property mentioned above. This is the first example of a copy-protection scheme with provable security in the plain model for a class of functions that is not evasive.
* We show that, assuming indistinguishability obfuscation (iO), hidden coset states possess a certain direct product hardness property, which immediately implies a tokenized signature scheme in the plain model. Previously, a tokenized signature scheme was known only relative to an oracle, from a work of Ben-David and Sattath [QCrypt '17].
* Combining a tokenized signature scheme with extractable witness encryption, we give a construction of an unclonable decryption scheme in the plain model. The latter primitive was recently proposed by Georgiou and Zhandry [ePrint '20], who gave a construction relative to a classical oracle.
* We conjecture that coset states satisfy a certain natural (information-theoretic) monogamy-of-entanglement property. Assuming this conjecture is true, we remove the requirement for extractable witness encryption in our unclonable decryption construction, by relying instead on compute-and-compare obfuscation for the class of unpredictable distributions. As potential evidence in support of the monogamy conjecture, we prove a weaker version of this monogamy property, which we believe will still be of independent interest.
* Finally, we give a construction of a copy-protection scheme for pseudorandom functions (PRFs) in the plain model. Our scheme is secure either assuming iO, OWF and extractable witness encryption, or assuming iO, OWF, compute-and-compare obfuscation for the class of unpredictable distributions, and the conjectured monogamy property mentioned above. This is the first example of a copy-protection scheme with provable security in the plain model for a class of functions that is not evasive.
Chethan Kamath, Karen Klein, Krzysztof Pietrzak, Daniel Wichs
ePrint Report
Yao’s garbling scheme is one of the most fundamental cryptographic constructions. Lindell and Pinkas (Journal of Cryptograhy 2009) gave a formal proof of security in the selective setting where the adversary chooses the challenge inputs before seeing the garbled circuit assuming secure symmetric-key encryption (and hence one-way functions). This was followed by results, both positive and negative, concerning its security in the, stronger, adaptive setting. Applebaum et al. (Crypto 2013) showed that it cannot satisfy adaptive security as is, due to a simple incompressibility argument. Jafargholi and
Wichs (TCC 2017) considered a natural adaptation of Yao’s scheme (where the output mapping is sent in the online phase, together with the garbled input) that circumvents this negative result, and proved that it is adaptively secure, at least for shallow circuits. In particular, they showed that for the class of circuits of depth $\delta$, the loss in security is at most exponential in $\delta$. The above results all concern the simulation-based notion of security.
In this work, we show that the upper bound of Jafargholi and Wichs is basically optimal in a strong sense. As our main result, we show that there exists a family of Boolean circuits, one for each depth $\delta\in\mathbb{N}$, such that any black-box reduction proving the adaptive indistinguishability of the natural adaptation of Yao’s scheme from any symmetric-key encryption has to lose a factor that is exponential in $\sqrt(\delta)$. Since indistinguishability is a weaker notion than simulation, our bound also applies to adaptive simulation.
To establish our results, we build on the recent approach of Kamath et al. (Eprint 2021), which uses pebbling lower bounds in conjunction with oracle separations to prove fine-grained lower bounds on loss in cryptographic security.
In this work, we show that the upper bound of Jafargholi and Wichs is basically optimal in a strong sense. As our main result, we show that there exists a family of Boolean circuits, one for each depth $\delta\in\mathbb{N}$, such that any black-box reduction proving the adaptive indistinguishability of the natural adaptation of Yao’s scheme from any symmetric-key encryption has to lose a factor that is exponential in $\sqrt(\delta)$. Since indistinguishability is a weaker notion than simulation, our bound also applies to adaptive simulation.
To establish our results, we build on the recent approach of Kamath et al. (Eprint 2021), which uses pebbling lower bounds in conjunction with oracle separations to prove fine-grained lower bounds on loss in cryptographic security.
Léo Weissbart, Łukasz Chmielewski, Stjepan Picek, Lejla Batina
ePrint Report
Profiling attacks, especially those based on machine learning, proved to be very successful techniques in recent years when considering the side-channel analysis of symmetric-key crypto implementations. At the same time, the results for implementations of asymmetric-key cryptosystems are very sparse.
This paper considers several machine learning techniques to mount side-channel attacks on two implementations of scalar multiplication on the elliptic curve Curve25519. The first implementation follows the baseline implementation with complete formulae as used for EdDSA in WolfSSl, where we exploit power consumption as a side-channel. The second implementation features several countermeasures, and in this case, we analyze electromagnetic emanations to find side-channel leakage.
Most techniques considered in this work result in potent attacks, and especially the method of choice appears to be convolutional neural networks (CNNs), which can break the first implementation with only a single measurement in the attack phase. The same convolutional neural network demonstrated excellent performance for attacking AES cipher implementations.
Our results show that some common grounds can be established when using deep learning for profiling attacks on very different cryptographic algorithms and their corresponding implementations.
This paper considers several machine learning techniques to mount side-channel attacks on two implementations of scalar multiplication on the elliptic curve Curve25519. The first implementation follows the baseline implementation with complete formulae as used for EdDSA in WolfSSl, where we exploit power consumption as a side-channel. The second implementation features several countermeasures, and in this case, we analyze electromagnetic emanations to find side-channel leakage.
Most techniques considered in this work result in potent attacks, and especially the method of choice appears to be convolutional neural networks (CNNs), which can break the first implementation with only a single measurement in the attack phase. The same convolutional neural network demonstrated excellent performance for attacking AES cipher implementations.
Our results show that some common grounds can be established when using deep learning for profiling attacks on very different cryptographic algorithms and their corresponding implementations.
Geoffroy Couteau, Pierre Meyer
ePrint Report
In this work we introduce a new (circuit-dependent) homomorphic secret sharing (HSS) scheme for any $\log/\log\log$-local circuit, with communication proportional only to the width of the circuit and polynomial computation, which is secure assuming the super-polynomial hardness of learning parity with noise (LPN). At the heart of our new construction is a pseudorandom correlation generator (PCG) which allows two parties to locally stretch short seeds into pseudorandom instances of an arbitrary $\log/\log\log$-local additive correlation.
Our main application, and the motivation behind this work, is a generic two-party secure computation protocol for every layered (boolean or arithmetic) circuit of size $s$ with total communication $O(s/\log\log s)$ and polynomial computation, assuming the super-polynomial hardness of the standard learning parity with noise assumption (a circuit is layered if its nodes can be partitioned in layers, such that any wire connects adjacent layers). This expands the set of assumptions under which the `circuit-size barrier' can be broken, for a large class of circuits. The strength of the underlying assumption is tied to the sublinearity factor: we achieve communication $O(s/k(s))$ under the $s^{2^{k(s)}}$-hardness of LPN, for any $k(s) \leq (\log\log s) / 4$.
Previously, the set of assumptions known to imply a PCG for correlations of degree $\omega(1)$ or generic secure computation protocols with sublinear communication was restricted to LWE, DDH, and a circularly secure variant of DCR.
Our main application, and the motivation behind this work, is a generic two-party secure computation protocol for every layered (boolean or arithmetic) circuit of size $s$ with total communication $O(s/\log\log s)$ and polynomial computation, assuming the super-polynomial hardness of the standard learning parity with noise assumption (a circuit is layered if its nodes can be partitioned in layers, such that any wire connects adjacent layers). This expands the set of assumptions under which the `circuit-size barrier' can be broken, for a large class of circuits. The strength of the underlying assumption is tied to the sublinearity factor: we achieve communication $O(s/k(s))$ under the $s^{2^{k(s)}}$-hardness of LPN, for any $k(s) \leq (\log\log s) / 4$.
Previously, the set of assumptions known to imply a PCG for correlations of degree $\omega(1)$ or generic secure computation protocols with sublinear communication was restricted to LWE, DDH, and a circularly secure variant of DCR.
Rohit Chatterjee, Sanjam Garg, Mohammad Hajiabadi, Dakshita Khurana, Xiao Liang, Giulio Malavolta, Omkant Pandey, Sina Shiehian
ePrint Report
Ring signatures allow a user to sign a message on behalf of a ``ring'' of signers, while hiding the true identity of the signer. As the degree of anonymity guaranteed by a ring signature is directly proportional to the size of the ring, an important goal in cryptography is to study constructions that minimize the size of the signature as a function of the number of ring members.
In this work, we present the first compact ring signature scheme (i.e., where the size of the signature grows logarithmically with the size of the ring) from the (plain) learning with errors (LWE) problem. The construction is in the standard model and it does not rely on a common random string or on the random oracle heuristic. In contrast with the prior work of Backes et al. [EUROCRYPT'2019], our scheme does not rely on bilinear pairings, which allows us to show that the scheme is post-quantum secure assuming the quantum hardness of LWE.
At the heart of our scheme is a new construction of compact and statistically witness indistinguishable ZAP arguments for NP $\cap$ coNP, that we show to be sound based on the plain LWE assumption. Prior to our work, statistical ZAPs (for all of NP) were known to exist only assuming sub-exponential LWE. We believe that this scheme might find further applications in the future.
In this work, we present the first compact ring signature scheme (i.e., where the size of the signature grows logarithmically with the size of the ring) from the (plain) learning with errors (LWE) problem. The construction is in the standard model and it does not rely on a common random string or on the random oracle heuristic. In contrast with the prior work of Backes et al. [EUROCRYPT'2019], our scheme does not rely on bilinear pairings, which allows us to show that the scheme is post-quantum secure assuming the quantum hardness of LWE.
At the heart of our scheme is a new construction of compact and statistically witness indistinguishable ZAP arguments for NP $\cap$ coNP, that we show to be sound based on the plain LWE assumption. Prior to our work, statistical ZAPs (for all of NP) were known to exist only assuming sub-exponential LWE. We believe that this scheme might find further applications in the future.
Maamar Ouladj, Sylvain Guilley, Philippe Guillot, Farid Mokrane
ePrint Report
Cryptographic software is particularly vulnerable to side-channel attacks when programmed in embedded devices.
Indeed, the leakage is particularly intense compared to the noise level, making it mandatory for the developer to implement side-channel attack protections.
Random masking is a customary option, but in this case, the countermeasure must be high-order,
meaning that each sensitive variable is splitted into multiple (at least two) shares.
Attacks therefore become computationally challenging.
In this paper, we show that high-order template attacks can be expressed under the form of a convolution. This formulation allows for a considerable speed-up in their computation thanks to fast Fourier transforms. To further speed-up the attack, we also provide an interesting multi-threading implementation of this approach. This strategy naturally applies to template attacks where the leakage of each share is multivariate. We show that this strategy can be adapted to several masking schemes, inherently to the way the splitting is realized. This technique allows us to validate multiple very high-order attacks (order of some tens). In particular, it revealed a non-trivial flaw (hard to detect otherwise) in a multivariate extension of the DSM masking (and subsequently to fix it, and validate its rationale).
In this paper, we show that high-order template attacks can be expressed under the form of a convolution. This formulation allows for a considerable speed-up in their computation thanks to fast Fourier transforms. To further speed-up the attack, we also provide an interesting multi-threading implementation of this approach. This strategy naturally applies to template attacks where the leakage of each share is multivariate. We show that this strategy can be adapted to several masking schemes, inherently to the way the splitting is realized. This technique allows us to validate multiple very high-order attacks (order of some tens). In particular, it revealed a non-trivial flaw (hard to detect otherwise) in a multivariate extension of the DSM masking (and subsequently to fix it, and validate its rationale).
Ripon Patgiri
ePrint Report
Data secrecy is a major concern in many domains. Nowadays, the data are kept in tight security with high privacy. Users do not want to share their secret information with anyone; however, the users' confidential data are not protected from the administrators. Administrators can read the users' data. Why should any Administrator read users' data? To address this issue, we propose a new secrecy protocol to store data secretly, named Secret Cloud Storage, SecretStore for short, to enable Secrecy as a Service model over the Cloud Computing paradigm. This article demonstrates how to protect users' data from any unintended users, including the data administrators. Moreover, we introduce tight security using the client-side symmetric cryptography method. In addition, we devise a forgetful private key to generate or regenerate a private key to encrypt or decrypt based on a secret word. We also show how to strengthen the weak password. Finally, we demonstrate how to implement the Secrecy as a Service model in Cloud Storage using highly unpredictable private keys.