IACR News
Here you can see all recent updates to the IACR webpage. These updates are also available:
09 September 2022
Sovereign Systems, Santa Monica/Remote
We’re a small team with a big mission and we’re looking for our Founding Cryptographic Software Engineer. Sovereign Systems was founded on the premise that personal data is valuable, and so are privacy and security. Historically, this premise has represented a paradox, as users and organizations have been forced to trade one for the other. Sovereign Systems is providing a solution to this paradox.
This is an opportunity to get in on the ground floor and shape the technical vision and strategy. You’ll work directly alongside the CEO and Chief Data Scientist with the support of an all-star team of A-list and highly active advisors. You’ll start by doing, rolling your sleeves up, and cranking out code. As we grow, you’ll help to build our technical team and collaborate with key stakeholders on the processes and frameworks that will allow the company to run both joyfully and efficiently.
In this role, you will have the opportunity to:
- You will have the chance to craft solutions and develop software for millions of users around the world.
- You'll be part of a company whose commitment to user privacy is at the heart of everything.
- You'll be surrounded by the most creative, passionate, and talented engineers in the industry, constantly being challenged to go beyond the norm to find new, innovative ways of solving problems and to make software safer, easier, and more fun to use.
Key qualifications :
- Passion for creating effective and pragmatic cryptographic schemes.
- MS/Ph.D. in Computer Science or CSE or equivalent experience. 5+ years building cloud-based and distributed systems.
- Understanding of fundamental cryptographic algorithms and the underlying mathematics, such as finite field arithmetic.
- Experience implementing privacy-preserving cryptographic primitives and protocols like fully homomorphic and oblivious encryption, and garbled circuits, and using libraries such as Zama, Microsoft SEAL, HELayers.
- Experience implementing high-performance cryptographic protocols in languages like Rust, Java, Go, Python, or C/C++.
Closing date for applications:
Contact: Jackie Peters
Cybersecurity Group, TU Delft, The Netherlands
For PhD: candidates are required to hold a MSc in math, computer science or related subject (preferably with some related backgrounds on cryptography). Further, they should provide sufficient English skills, e.g., International English test certificate.
For Post-doc: candidates must hold a PhD in mathematics or computer science with expertise on cryptography, and they are expected to have great backgrounds on UC or lattice-base crypto, and/or cryptography in general. Candidates must have a strong track record, academic writing and communication ability.
All the positions may have flexible starting date. Please prepare a detailed resume (including a list of publications if have), bachelor and MSc transcripts (for the PhD position), 1 page motivation letter, International English certificate (if have), and two references (names and contact emails).
Please contact shihui.fu@tudelft.nl for further questions.
Closing date for applications:
Contact: Dr. S. Fu (shihui.fu@tudelft.nl)
University of Amsterdam, Amsterdam, The Netherlands
More information: https://vacatures.uva.nl/UvA/job/PhD-Position-in-Energy-and-Security-of-Machine-Learning-Applications-in-the-Cloud-to-Edge-Continuum/745019702/
Closing date for applications:
Contact: dr. Ana Oprescu (a.m.oprescu at uva.nl)
More information: https://vacatures.uva.nl/UvA/job/PhD-Position-in-Energy-and-Security-of-Machine-Learning-Applications-in-the-Cloud-to-Edge-Continuum/745019702/
07 September 2022
Giuseppe D'Alconzo, Andrea Gangemi
Bin Hu, Zongyang Zhang, Han Chen, You Zhou, Huazu Jiang, Jianwei Liu
Shweta Agrawal, Rishab Goyal, Junichi Tomida
Stronger Security: In the typical formulation of MIFE security, an attacker is allowed to either corrupt all or none of the users who can encrypt the data. In this work, we study MIFE security in a stronger and more natural model where we allow an attacker to corrupt any subset of the users, instead of only permitting all-or-nothing corruption. We formalize the model by providing each user a unique encryption key, and letting the attacker corrupt all non-trivial subsets of the encryption keys, while still maintaining the MIFE security for ciphertexts generated using honest keys. We construct a secure MIFE system for quadratic functions in this fine-grained corruption model from bilinear maps. Our construction departs significantly from the existing MIFE schemes as we need to tackle a more general class of attackers.
Broader Functionality: The notion of multi-client functional encryption, MCFE, is a useful extension of MIFE. In MCFE, each encryptor can additionally tag each ciphertext with appropriate metadata such that ciphertexts with only matching metadata can be decrypted together. In more detail, each ciphertext is now annotated with a unique label such that ciphertexts encrypted for different slots can now only be combined together during decryption as long as the associated labels are an exact match for all individual ciphertexts. In this work, we upgrade our MIFE scheme to also support ciphertext labelling. While the functionality of our scheme matches that of MCFE for quadratic functions, our security guarantee falls short of the general corruption model studied for MCFE. In our model, all encryptors share a secret key, therefore this yields a secret-key version of quadratic MCFE, which we denote by SK-MCFE. We leave the problem of proving security in the general corruption model as an important open problem.
Youngjin Bae, Jung Hee Cheon, Wonhee Cho, Jaehyung Kim, Taekyung Kim
In this paper, we propose a new bootstrapping algorithm of the Cheon-Kim-Kim-Song (CKKS) scheme to use a known bootstrapping algorithm repeatedly, so called { Meta-BTS}. By repeating the original bootstrapping operation twice, one can obtain another bootstrapping with its precision essentially doubled; it can be generalized to be $k$-fold bootstrapping operations for some $k>1$ while the ciphertext size is large enough. Our algorithm overcomes the precision limitation given by the rescale operation.
Wenshuo Guo, Fang-Wei Fu
06 September 2022
Christopher Battarbee, Delaram Kahrobaei, Ludovic Perret, Siamak F. Shahandashti
Thomas Pornin
Yuanyuan Zhou, Joop van de Pol, Yu Yu, François-Xavier Standaert
Motivated by the above, we extend the PKE attack of May et al. to CRT-RSA with additive exponent blinding. While admitting $r_pe\in(0,N^{\frac{1}{4}})$, our extended PKE works ideally when $r_pe \approx N^{\frac{1}{12}}$, in which case the entire private key can be recovered using only $\frac{1}{3}$ known MSBs or LSBs of the blinded CRT exponents $d^{\prime}_p$ and $d^{\prime}_q$. Our extended PKE follows their novel two-step approach to first compute the key-dependent constant $k^{\prime}$ ($ed^{\prime}_p = 1 + k^{\prime}(p-1)$, $ed^{\prime}_q = 1 + l^{\prime}(q-1)$), and then to factor $N$ by computing the root of a univariate polynomial modulo $k^{\prime}p$. We extend their approach as follows. For the MSB case, we propose two options for the first step of the attack, either by obtaining a single estimate $k^{\prime}l^{\prime}$ and calculating $k^{\prime}$ via factoring, or by obtaining multiple estimates $k^{\prime}l^{\prime}_1,\ldots,k^{\prime}l^{\prime}_z$ and calculating $k^{\prime}$ probabilistically via GCD.
For the LSB case, we extend their approach by constructing a different univariate polynomial in the second step of the LSB attack. A formal analysis shows that our LSB attack runs in polynomial time under the standard Coppersmith-type assumption, while our MSB attack either runs in sub-exponential time with a reduced input size (the problem is reduced to factor a number of size $e^2r_pr_q\approx N^{\frac{1}{6}}$) or in probabilistic polynomial time under a novel heuristic assumption. Under the settings of the most common key sizes (1024-bit, 2048-bit, and 3072-bit) and blinding factor lengths (32-bit, 64-bit, and 128-bit), our experiments verify the validity of the Coppersmith-type assumption and our own assumption, as well as the feasibility of the factoring step.
To the best of our knowledge, this is the first PKE on CRT-RSA with experimentally verified effectiveness against 128-bit unknown exponent blinding factors. We also demonstrate an application of the proposed PKE attack using real partial side-channel key leakage targeting a Montgomery Ladder exponentiation CRT implementation.
Youssef El Housni
Delaram Kahrobaei, Ramón Flores, Marialaura Noce
Amadou TALL
Christof Beierle, Patrick Felke, Gregor Leander, Sondre Rønjom
Mohammad Mahzoun, Liliya Kraleva, Raluca Posteuca, Tomer Ashur
Tomoyuki Morimae, Takashi Yamakawa
1. We construct a CV-NIZK for QMA in the quantum secret parameter model where a trusted setup sends a quantum proving key to the prover and a classical verification key to the verifier. It is information theoretically sound and zero-knowledge.
2. Assuming the quantum hardness of the learning with errors problem, we construct a CV-NIZK for QMA in a model where a trusted party generates a CRS and the verifier sends an instance-independent quantum message to the prover as preprocessing. This model is the same as one considered in the recent work by Coladangelo, Vidick, and Zhang (CRYPTO '20). Our construction has the so-called dual-mode property, which means that there are two computationally indistinguishable modes of generating CRS, and we have information theoretical soundness in one mode and information theoretical zero-knowledge property in the other. This answers an open problem left by Coladangelo et al, which is to achieve either of soundness or zero-knowledge information theoretically. To the best of our knowledge, ours is the first dual-mode NIZK for QMA in any kind of model.
3. We construct a CV-NIZK for QMA with quantum preprocessing in the quantum random oracle model. This quantum preprocessing is the one where the verifier sends a random Pauli-basis states to the prover. Our construction uses the Fiat-Shamir transformation. The quantum preprocessing can be replaced with the setup that distributes Bell pairs among the prover and the verifier, and therefore we solve the open problem by Broadbent and Grilo (FOCS '20) about the possibility of NIZK for QMA in the shared Bell pair model via the Fiat-Shamir transformation.
05 September 2022
István Vajda
Léo Ducas, Eamonn W. Postlethwaite, Ludo N. Pulles, Wessel van Woerden
Its simplicity makes Hawk competitive. We provide cryptanalysis with experimental evidence for the design of Hawk and implement two parameter sets, Hawk-512 and Hawk-1024. Signing using Hawk-512 and Hawk-1024 is four times faster than Falcon on x86 architectures, produces signatures that are about 15% more compact, and is slightly more secure against forgeries by lattice reduction attacks. When floating-points are unavailable, Hawk signs 15 times faster than Falcon.
We provide a worst case to average case reduction for module LIP. For certain parametrisations of Hawk this applies to secret key recovery and we reduce signature forgery in the random oracle model to a new problem called the one more short vector problem.