International Association
for Cryptologic Research

We evaluate eight implementations of provable secure side-channel masking schemes that were published in top-tier academic venues such as Eurocrypt, Asiacrypt, CHES and SAC. Specifically, we evaluate the side-channel attack resistance of eight open-source and first-order side-channel protected AES-128 software implementations on the Cortex-M4 platform. Using a T-test based leakage assessment we demonstrate that all implementations produce first-order leakage with as little as 10,000 traces. Additionally, we demonstrate that all except for two Inner Product Masking based implementations are vulnerable to a straightforward correlation power analysis attack. We provide an assembly level analysis showing potential sources of leakage for two implementations. Some of the studied implementations were provided for benchmarking purposes. We demonstrate several flaws in the benchmarking procedures and question the usefulness of the reported performance numbers in the face of the implementations’ poor side-channel resistance. This work serves as a reminder that practical evaluations cannot be omitted in the context of side-channel analysis.

This work extends the composable secure-emulation of Canetti et al. to dynamic settings. Our work builds on top of dynamic probabilistic I/O automata, a recent framework introduced to model dynamic probabilistic systems. Our extension is an important tool towards the formal verification of protocols combining probabilistic distributed systems and cryptography in dynamic settings (e.g. blockchains, secure distributed computation, cybersecure distributed protocols etc).

Hardware obfuscation by redundancy addition is a well-known countermeasure against reverse engineering. For FPGA designs, such a technique can be implemented with a small overhead, however, its effectiveness is heavily dependent on the stealthiness of the redundant elements. Since there are powerful tools for combinational redundancy removal, opting for sequential redundancy is believed to result in stronger obfuscation. However, in this paper, we demonstrate that it is possible to identify sequential redundancy in obfuscated SRAM FPGA designs by ensuring the full controllability of each instantiated look-up table input via iterative bitstream modification. The presented algorithm works directly on bitstream and does not require the possession of a flattened netlist. The feasibility of our approach is verified on the example of an obfuscated SNOW 3G design implemented in a Xilinx 7-series FPGA.

Event date: 29 September to 30 September 2022
Submission deadline: 10 June 2022
Notification: 12 August 2022

Event date: 11 September to 16 September 2022
Submission deadline: 30 April 2022
Notification: 30 June 2022

Event date: 28 September to 30 September 2022
Submission deadline: 10 May 2022
Notification: 13 July 2022

We are looking for a Research Fellow (Post-Doc), to join our group. The applicants should have background and be interested in working on different aspects of lattice based cryptography, and a strong publication record, in particular on:

- security proofs for lattice-based schemes,
- building and implementing lattice-based constructions.

Profile:

- Doctorate degree in the field of cryptography,
- Expertise in one of these areas: public key cryptography, lattice-based cryptography.

The research will take place in the CAPSULE team (formerly called EMSEC team), within the IRISA computer science institute located in Rennes, France. To apply please send us (both) by email your detailed CV (with publication list) and a research statement.
The position is for two years, up to three, and has flexible starting date.
Review of applications will start immediately until the position is filled.

Closing date for applications:

Contact: Adeline Roux-Langlois (adeline.roux-langlois@irisa.fr) and Alexandre Wallet (alexandre.wallet@inria.fr)

Status is building the tools and infrastructure for the advancement of a secure, private, and open web3, through research, the creation of developer tools, and the support of the open-source community.

Currently, our Blockchain Infrastructure Team is researching consensus algorithms, Multi-Party Computation techniques, ZKPs, and other cutting-edge solutions with the aim to take blockchain technology to the next level of security, decentralization, and scalability for a wide range of use cases.

Some of the responsibilities:

- Analyze the team’s technical proposals and look for potential flaws.

- Identify opportunities to provide mathematical proofs to the protocols developed by the team.

- Analyze mathematically the parameter space of complex algorithms.

- Describe mechanisms to better understand, analyze and prove the correctness of the ideas and designs produced by the team.

- Work on mathematical proofs for the team algorithms and protocol designs.

- Propose improvements to the algorithms and protocols developed by the team.

- Propose new solutions to the problems tackled by the team.

- Write documentation and scientific papers with the highest standards of quality.

- Strive to constantly set the highest scientific standards for the team’s research.

Closing date for applications:

Contact: Maya

More information: https://jobs.status.im/?gh_jid=4012660

Technology Innovation Institute (TII) is a publicly funded research institute, based in Abu Dhabi, United Arab Emirates. It is home to a diverse community of leading scientists, engineers, mathematicians, and researchers from across the globe, transforming problems and roadblocks into pioneering research and technology prototypes that help move society ahead.

Cryptography Research Centre

In our connected digital world, secure and reliable cryptography is the foundation of digital information security and data integrity. We address the world’s most pressing cryptographic questions. Our work covers post-quantum cryptography, lightweight cryptography, cloud encryption schemes, secure protocols, quantum cryptographic technologies and cryptanalysis.

Position: Privacy Researcher

Conduct research on state-of-the-art Privacy Enhancing Technologies

Analyze project requirements and provide technical and functional recommendations

Design and implementation of building blocks to utilize privacy-preserving cryptographic techniques to cloud computing and machine learning applications

Propose new projects and research directions

Skills required for the job

MSc or PhD degree in Cryptography, Applied Cryptography, Information Theory, Mathematics or Computer Science

2+ years of work experience

Knowledge in one of the following topics is required: Homomorphic encryption, Functional encryption, Secure multi party computation, Zero-knowledge proofs

Experience in C desired, C++, Rust and Python relevant as well

Solid engineering practices and processes, such as development and testing methodology and documentation

Quick learner, geared towards implementation. Eager to develop new skills and willing to take ownership of projects

Knowledge in some of the following topics will be valuable: Edge computing, Machine learning, Identity Management, Differential privacy

Closing date for applications:

Contact: Mehdi Messaoudi - Talent Acquisition Manager
mehdi.messaoudi@tii.ae

More information: https://www.tii.ae/cryptography

Technology Innovation Institute (TII) is a publicly funded research institute, based in Abu Dhabi, United Arab Emirates. It is home to a diverse community of leading scientists, engineers, mathematicians, and researchers from across the globe, transforming problems and roadblocks into pioneering research and technology prototypes that help move society ahead.

Cryptography Research Centre

In our connected digital world, secure and reliable cryptography is the foundation of digital information security and data integrity. We address the world’s most pressing cryptographic questions. Our work covers post-quantum cryptography, lightweight cryptography, cloud encryption schemes, secure protocols, quantum cryptographic technologies and cryptanalysis.

Position: Post Quantum Cryptography Researcher

Design, implement and deploy quantum-safe cryptographic algorithms covering both but not limited to: key exchange algorithms and digital signature schemes

Conduct research and development in lattice-based, code-based or hash-based cryptosystems.

Perform security assessments of either crypto-primitives or cryptosystems at the theoretical and implementation level

Design end-to-end secure communication protocols using state-of-the art and customized cryptographic algorithms and primitives

Skills required for the job

PhD degree in Cryptography, Applied Cryptography, Information Theory and Mathematics or Computer Science

Postdoctoral research experience in symmetric-key cryptology as well as teaching experience is also an advantage

2+ years of work experience in the field

Closing date for applications:

Contact: Mehdi Messaoudi - Talent Acquisition Manager
mehdi.messaoudi@tii.ae

More information: https://www.tii.ae/cryptography

Technology Innovation Institute (TII) is a publicly funded research institute, based in Abu Dhabi, United Arab Emirates. It is home to a diverse community of leading scientists, engineers, mathematicians, and researchers from across the globe, transforming problems and roadblocks into pioneering research and technology prototypes that help move society ahead.

Cryptography Research Centre

In our connected digital world, secure and reliable cryptography is the foundation of digital information security and data integrity. We address the world’s most pressing cryptographic questions. Our work covers post-quantum cryptography, lightweight cryptography, cloud encryption schemes, secure protocols, quantum cryptographic technologies and cryptanalysis.

Position: Senior FHE Researcher

Conduct research on state-of-the-art FHE schemes

Analyze project requirements and provide technical and functional recommendations

Supervise the design and implementation of FHE building blocks to machine learning applications

Propose new projects and research directions

Skills required for the job

4+ years of work experience in the field

Knowledge of partially-, somewhat-, and fully homomorphic encryption schemes

Deep understanding of lattice-based cryptography

Quick learner, geared towards implementation

Eager to develop new skills and willing to take ownership of projects

Strong track record of publishing in top tier conferences

Experience in C, C++, Rust or Go is a plus. Software engineering skills, such as agile methodologies, versioning, and knowledge with hardware languages is also a plus

Closing date for applications:

Contact: Mehdi Messaoudi - Talent Acquisition Manager
mehdi.messaoudi@tii.ae

More information: https://www.tii.ae/cryptography

Applications are invited for a post-doctoral fellow position in one or more of these areas- cryptographic engineering/applied cryptography as it relates to blockchain technology, cryptocurrencies and digital payments. The successful candidate will join Professor Anwar Hasan’s research group at the University of Waterloo. Applicants with a recent Ph.D. in Computer Engineering, Computer Science or a related discipline, and publications at premium venues are encouraged to send pdf copies of their CVs and cover letters via email to Professor Anwar Hasan (ahasan at uwaterloo.ca). Application deadline: March 31, 2022 for full consideration. After this deadline, applications will be processed as they arrive.

Closing date for applications:

Contact: Professor Anwar Hasan

In the Faculty of Computer Science, Electrical Engineering and Mathematics, there are several open positions in the Institute of Computer Science, limited to up to 5 years, to be filled as soon as possible. We are looking for internationally qualified personalities in the fields of:

• IT Security (reference number 5121)
• Quantum Computing (reference number 5122)

who will each lead an independent junior research group and support the established strategic focus areas of the Institute of Computer Science. Each junior research group will be provided with a position for a research assistant (f/m/d) (pay scale E13 TV-L).

Applications with cover letter, curriculum vitae, doctoral certificate, research and teaching statement as well as the indication of two references (in one PDF-file) are requested under each reference number until 31.03.2022 to the e-mail-address mentioned below.

More information:
https://www.uni-paderborn.de/fileadmin/zv/4-4/stellenangebote/Kennziffer5119-5122_Englisch.pdf

Closing date for applications:

Contact: If you have any questions, please contact Prof. Dr. Eric Bodden (eric.bodden@uni-paderborn.de)
The applications should then be sent to the following email addresses:
eim-i-5121@upb.de
eim-i-5122@upb.de

More information: https://www.uni-paderborn.de/fileadmin/zv/4-4/stellenangebote/Kennziffer5119-5122_Englisch.pdf

The IACR and PKC Steering Committee are pleased to announce the 2022 Test-of-Time award for papers published PKC.

PKC is the International Conference on Practice and Theory in Public Key Cryptography, which was founded in 1998 and became an official IACR event in 2003. The Test-of-Time award recognizes outstanding papers, published in PKC about 15 years ago, making a significant contribution to the theory and practice of public key cryptography, preferably with influence either on foundations or on the practice of the field.

The 2022 award was given on Tuesday March 8th at PKC in a virtual Award Ceremony, for papers published in the conference's initial years of early 2000s and late 1990s. In the first few years a number of papers from a few different initial years of PKC can be recognized. Thereafter, the award will typically recognize one year at a time with one or two papers.

The recipients of the 2022 award are:

• Password-Based Authenticated Key Exchange in the Three-Party Setting, by Michel Abdalla, Pierre-Alain Fouque, and David Pointcheval, PKC 2005.
• Curve25519: New Diffie-Hellman Speed Records, by Daniel J. Bernstein, PKC 2006.

Congratulations to these authors for their impactful work! More information about the award can be found at https://iacr.org/meetings/pkc/test_of_time_award/

Event date: 24 August to 26 August 2022
Submission deadline: 8 May 2022
Notification: 10 June 2022

Event date: 13 August 2022
Submission deadline: 1 May 2022

The understanding of directionality for updatable encryption (UE) schemes is important, but not yet completed in the literature. We show that security in the backward-leak uni-directional key updates setting is equivalent to the no-directional one. Combining with the work of Jiang (ASIACRYPT 2020) and Nishimaki (PKC 2022), it is showed that the backward-leak notion is the strongest one among all known key update notions and more relevant in practice. We propose two novel generic constructions of UE schemes that are secure in the backward-leak uni-directional key update setting from public key encryption (PKE) schemes: the first one requires a key and message homomorphic PKE scheme and the second one requires a bootstrappable PKE scheme. These PKE can be constructed based on standard assumptions (such as the Decisional Diffie-Hellman and Learning With Errors assumptions). It is in stark contrast to the work of Nishimaki, which uses indistinguishability obfuscations, and Slamanig and Striecks (Cryptology ePrint Archive, 2021/268), which requires pairings.

We investigate the use of the Dilithium post-quantum digital signature scheme on memory-constrained systems. Reference and optimized implementations of Dilithium in the benchmarking framework pqm4 (Cortex-M4) require 50 – 100 KiB of memory, demonstrating the significant challenge to use Dilithium on small IoT platforms. We show that compressing polynomials, using an alternative number theoretic transform, and falling back to the schoolbook method for certain multiplications reduces the memory footprint significantly. This results in the first implementation of Dilithium for which the recommended parameter set requires less than 7 KiB of memory for key and signature generation and less than 3 KiB of memory for signature verification. We also provide benchmark details of a portable implementation in order to estimate the performance impact when using these memory reduction methods.

We build a library SecFloat for secure 2-party computation (2PC) of 32-bit single-precision floating-point operations and math functions. The existing functionalities used in cryptographic works are imprecise and the precise functionalities used in standard libraries are not crypto-friendly, i.e., they use operations that are cheap on CPUs but have exorbitant cost in 2PC. SecFloat bridges this gap with its novel crypto-friendly precise functionalities. Compared to the prior cryptographic libraries, SecFloat is up to six orders of magnitude more precise and up to two orders of magnitude more efficient. Furthermore, against a precise 2PC baseline, SecFloat is three orders of magnitude more efficient. The high precision of SecFloat leads to the first accurate implementation of secure inference. All prior works on secure inference of deep neural networks rely on ad hoc float-to-fixed converters. We evaluate a model where the fixed-point approximations used in privacy-preserving machine learning completely fail and floating-point is necessary. Thus, emphasizing the need for libraries like SecFloat.

Decentralized Finance (DeFi) protocols have triggered a paradigm shift in the world of finance: intermediaries as known in traditional finance risk becoming redundant because DeFi creates an inherent state of “trustlessness”; financial transactions are executed in a deterministic, trustless and censorship resistant manner; the individual is granted verifiability, control and sovereignty. This creates challenges for compliance with jurisdictional Anti-Money Laundering and Combatting the Financing of Terrorism (AML/CFT) regulations, including Know-Your-Customer (KYC) policies, given that no personal information should be shared and stored on public, transparent blockchains. This paper presents a solution concept for where a DeFi protocol is required or finds it desirable to implement KYC policies. zkKYC in DeFi requires no personal identifiable information to be shared with DeFi protocols for the purpose of regulatory transparency. The presented approach extends the zkKYC solution concept (which leverages self-sovereign identity and zero-knowledge proofs) with the introduction of KYC Issuers and Decentralized Oracle Networks (DONs) as key solution components. KYC Issuers verify the identity of an individual, but have no knowledge about their digital asset wallets or DeFi activity. DeFi protocols interact with digital asset wallets, but have no knowledge about the identity of the individual controlling them. If and when deemed necessary, only a designated governance entity is able to reveal the identity of an individual that is under strong suspicion of being a bad actor in a DeFi protocol. The presented solution architecture demonstrates flexibility in being agnostic to blockchain platforms and SSI implementations and extensibility in being forward compatible with on-chain identity and reputation systems. Similar to the original zkKYC solution concept, zkKYC in DeFi breaks the regulatory transparency vs. user privacy trade-off.