International Association
for Cryptologic Research

While the round function of the AEGIS authenticated encryption algorithms is highly parallelizable, their mode of operation is not.

We introduce two new modes to overcome that limitation: AEGIS-128X and AEGIS-256X, that require minimal changes to existing implementations and retain the security properties of AEGIS-128L and AEGIS-256.

From hashing and commitment schemes to Fiat-Shamir and encryption, hash functions are everywhere in zero-knowledge proofsystems (ZKPs), and minor performance changes in ``vanilla'' implementations can translate in major discrepancies when the hash is processed as a circuit within the proofsystem.

Protocol designers have resorted to a number of techniques and custom modes to optimize hash functions for ZKPs settings, but so far without a single established, well-studied construction. To address this need, we define the Sponge API for Field Elements (SAFE), a unified framework for permutation-based schemes (including AEAD, Sigma, PRNGs, and so on). SAFE eliminates the performance overhead, is pluggable in any field-oriented protocol, and is suitable for any permutation algorithm.

SAFE is implemented in Filecoin's Neptune hash framework, {which is} our reference implementation (in Rust). SAFE is also being integrated in other prominent ZKP projects. This report specifies SAFE and describes some use cases.

Among other improvements, our construction is among the first to store the protocol metadata in the sponge inner part in a provably secure way, which may be of independent interest to the sponge use cases outside of ZKP.

Secure computation is of critical importance to not only the DoD, but across financial institutions, healthcare, and anywhere personally identifiable information (PII) is accessed. Traditional security techniques require data to be decrypted before performing any computation. When processed on untrusted systems the decrypted data is vulnerable to attacks to extract the sensitive information. To address these vulnerabilities Fully Homomorphic Encryption (FHE) keeps the data encrypted during computation and secures the results, even in these untrusted environments. However, FHE requires a significant amount of computation to perform equivalent unencrypted operations. To be useful, FHE must significantly close the computation gap (within 10x) to make encrypted processing practical. To accomplish this ambitious goal the TREBUCHET project is leading research and development in FHE processing hardware to accelerate deep computations on encrypted data, as part of the DARPA MTO Data Privacy for Virtual Environments (DPRIVE) program. We accelerate the major secure standardized FHE schemes (BGV, BFV, CKKS, FHEW, etc.) at >=128-bit security while integrating with the open-source PALISADE and OpenFHE libraries currently used in the DoD and in industry. We utilize a novel tile-based chip design with highly parallel ALUs optimized for vectorized 128b modulo arithmetic. The TREBUCHET coprocessor design provides a highly modular, flexible, and extensible FHE accelerator for easy reconfiguration, deployment, integration and application on other hardware form factors, such as System-on-Chip or alternate chip areas

We provide security foundations for SAFE, a recently introduced API framework for sponge-based hash functions tailored to prime-field-based protocols. SAFE aims to provide a robust and foolproof interface, has been implemented in the Neptune hash framework and some zero-knowledge proof projects, but currently lacks any security proof. In this work we identify the SAFECore as versatile variant sponge construction underlying SAFE, we prove indifferentiability of SAFECore for all (binary and prime) fields up to around $|\mathbb{F}_p|^{c/2}$ queries, where $\mathbb{F}_p$ is the underlying field and $c$ the capacity, and we apply this security result to various use cases. We show that the SAFE-based protocols of plain hashing, authenticated encryption, verifiable computation, non-interactive proofs, and commitment schemes are secure against a wide class of adversaries, including those dealing with multiple invocations of a sponge in a single application. Our results pave the way of using SAFE with the full taxonomy of hash functions, including SNARK-, lattice-, and x86-friendly hashes.

Digital signatures ensure legitimate access through identity authentication. It is also used to build blocks in blockchains and to authenticate transactions. The Courtois-Finiasz-Sendrier (CFS) digital signature is a well-known code-based digital signature scheme based on the Niederreiter cryptosystem. The CFS signature, however, is not widely used due to the long processing time required by its signing algorithm. Most code-based digital signature schemes are based on Niederreiter. The paper proposes a new code-based digital signature based on the McEliece cryptosystem. The proposed McEliece code-based scheme also gives less complexity and a higher success rate. The scheme provides an efficient code-based algorithm to sign a document in a shorter processing time. The scheme is also secure against public key structural attacks. The proposed scheme is the efficient code-based digital signature based on McEliece with a lower processing time required to construct a valid digital signature. The proposed signing algorithm also creates smaller signatures. In addition, the verification algorithm checks the integrity value to avoid any forgery before final verification.

Besides the U.S. NIST standard SHA-3(Keccak), another sponge-based primitive Ascon was selected as the NIST standard for lightweight applications, recently. Exploring the security against attacks on the sponge-based hash functions is very important. At EUROCRYPT 2023, Qin et al. introduced the MitM preimage attack framework and the automatic tools for Keccak, Ascon, and Xoodyak.

In this paper, we extend Qin et al.'s MitM attack framework into collision attack and also develop various techniques to improve the automatic tools for both preimage and collision attacks. We introduce a novel initial structure called weak-diffusion structure that enjoys many more degrees of freedom to build the blue/red neutral sets than Qin et al.'s. In addition, a more flexible condition scheme is introduced to reduce the diffusion of variables. To further accelerate the solving of automatic model, we propose a heuristic two-stage searching strategy, which first finds many blue neutral sets with naturally weak-diffusion properties, and then solves different automatic models with different blue neutral sets prefixed. Also symmetry property of Keccak is applied to speed up the search.

At last, we introduce the first collision attack on 4-round Keccak-512. Besides, the first MitM-based preimage attack on 4-round Keccak-384 is found that outperforms all previous attacks, while Qin et al. only found attack on Keccak-512. Moreover, we find collision attacks on reduced Xoodyak and Ascon with 1-2 rounds improvements than before. The complexities of preimage attacks on reduced Xoodyak and Ascon are also improved.

Secure multi-party computation has been considered by the cryptographic community for a number of years. Until recently it has been a purely theoretical area, with few implementations with which to test various ideas. This has led to a number of optimisations being proposed which are quite restricted in their application. In this paper we describe an implementation of the two-party case, using Yao’s garbled circuits, and present various algorithmic protocol improvements. These optimisations are analysed both theoretically and empirically, using experiments of various adversarial situations. Our experimental data is provided for reasonably large circuits, including one which performs an AES encryption, a problem which we discuss in the context of various possible applications.

Event date: 23 November to 24 November 2023
Submission deadline: 20 September 2023
Notification: 1 November 2023

Event date: 12 December to 14 December 2023
Submission deadline: 28 June 2023
Notification: 6 September 2023

The Applied Cryptography Unit (https://groups.oist.jp/appcrypto) at the Okinawa Institute of Science and Technology (OIST) is seeking to hire up to four postdoctoral scholars in cryptography.

The Applied Cryptography Unit, led by Prof Carlos Cid, was established in 2022, to conduct research in the design and analysis of modern cryptographic primitives and schemes used to protect confidentiality and integrity of data, both in the classical and in the quantum settings. To forge and develop its research activities, we are now seeking to hire up to four outstanding post-doctoral researchers to work in the following topics: post-quantum / quantum cryptography (design and analysis), quantum cryptanalysis, post-quantum cryptographic techniques for privacy-preserving mechanisms.

The postdocs will be provided with funding and access to world-class facilities to pursue their research. The Unit aims to establish a highly collaborative environment, and we expect there will be several opportunities to work with other research groups at OIST, in Japan and overseas.

Submission Documents

Applicants should prepare a single pdf file with:

• Cover letter, outlining the motivation for applying for the position, research interests, experience and qualifications of relevance for the position;
• CV with a list of publications;
• Names and contact information of two referees, one of which should be a previous employer.

and submit it at https://www.oist.jp/careers/postdoctoral-scholars-applied-cryptography-unit

Application Deadline:

Applicants will be considered until the positions are filled, but submissions by 28 May 2023 will guarantee full consideration.

Closing date for applications:

Contact: Carlos Cid (carlos.cid@oist.jp)

More information: https://www.oist.jp/careers/postdoctoral-scholars-applied-cryptography-unit

iTrust is a Cyber Security Research Center in SUTD and a National Satellite of Excellence in Singapore for securing critical infrastructure. iTrust hosts the world-class cyber-physical system (CPS) testbeds which are used for research, education, training, live-fire exercise, and technology validation.

We offer PhD scholarship on cybersecurity in general and CPS security in particular (especially on IoT and maritime). The candidates should have an excellent background (with Bachelor or Master degree and CGPA>80%) in mathematics or computer science/engineering. Acquaintance with cryptography and network/system security concepts as well as some programming skills is preferred. Interested candidates please send your CV to Prof. Jianying Zhou or Prof. Sudipta Chattopadhyay. Only short-listed candidates will be contacted for interview.

Closing date for applications:

Contact: Prof. Jianying Zhou [jianying_zhou@sutd.edu.sg] or Prof. Sudipta Chattopadhyay [sudipta_chattopadhyay@sutd.edu.sg]

More information: https://itrust.sutd.edu.sg/

The Digital Security Department of EURECOM, Sophia-Antipolis France, invites applications for a PhD position.
Topic - Artificial Intelligence (AI) technologies can efficiently process large amounts of data, to help stakeholders improve their services and propose applications tailored to end-user needs. While the benefits of AI technologies for the society are manifold and range from personalized services to improved healthcare, their adoption remains unfortunately slow due to various obstacles among which the lack of trustworthiness. Indeed, the performance and robustness of AI technologies rely on the access to large datasets of good quality. Such datasets usually include privacy-sensitive information. In this context, Federated learning (FL) is emerging as a powerful paradigm to collaboratively train a machine-learning (ML) model among thousands or even millions of participants. FL inherently promises (some) privacy and governance guarantees for the clients because the training data never leaves the client’s premises. Nevertheless, the collaborative aggregation of models’ parameters can potentially expose clients' specific information, and opens up to security breaches with potential loss of privacy. The successful candidate will study, the privacy and security challenges associated with federated learning and design and evaluate scalable and efficient privacy-enhancing technologies for FL using advanced cryptographic techniques such as multi-key homomorphic encryption or multi-party computation.
Requirements - Applicants should hold a Master degree or equivalent in Computer Science or a closely related area with a strong background on cryptography. Some background in machine learning is appreciated.
The application requires, among other documents, a CV, a cover letter describing the applicant’s research interests, the contact details of 2/3 persons that can provide references about the candidate and the transcripts of courses taken at graduate (and optionally undergraduate) level.

Closing date for applications:

Contact: Applicants are invited to send their applications via e-mail under reference [PhD-FLP] to melek.onen@eurecom.fr

Dfns Labs, the research division of Dfns, seeks MS/Ph.D scholars with a substantial aptitude in applied cryptography for remote internships spanning 10-12 weeks. These internships encompass designing and implementing threshold cryptographic protocols. Opportunities for internships are available throughout the year, commencing in the summer of 2023. We welcome applications from individuals of diverse backgrounds with distinctive outlooks.

Dfns is a cybersecurity company that builds custody SaaS solutions for web3 apps. Dfns gives financial institutions and businesses—from fintechs to e-commerce sites—the freedom to own and transfer crypto using a battle-designed security infrastructure.

Job Description

Develop proof-of-concepts exhibiting common MPC, threshold cryptography, and zero-knowledge proof implementations.

Collaborate with the research and engineering team on technical research tasks.

Contribute to academic articles and blog posts.

Stay apprised of the newest advancements in crypto, DeFi, and blockchain.

Interact with a team of cryptographers and engineers to contribute to the company's research plan.

Basic Qualifications

Must be enrolled in a Ph.D. or Masters program in Computer Science or a related technical field.

Must possess formidable software engineering skills in common programming languages (e.g. C/C++, Rust (preferred), Python, Java).

Should possess a working knowledge of cryptography and privacy-enhancing technologies.

Must possess superior written and verbal communication skills.

Additional Information

Compensation: Attractive salary, equity options, paid time-off, etc.

Location: Hybrid – Home or Office-based

Closing date for applications:

Contact: Please send your CV to research-jobs@dfns.co
Contact Xianrui Meng (xm@dfns.co) and Jon Katz (jkatz@dfns.co) for more information.

Applications are invited for 6 Research Fellow posts to perform research in the area of AI-enabled cybersecurity. The posts are associated with the newly-created Cyber-AI Technologies Hub at CSIT, which is a collaboration with cyber security companies on projects in AI-enabled cyber security. The Cyber-AI Technologies Hub is a physical environment where companies and academia are co-located to collaborate on the advancement and demonstration of AI and cyber security.

Research Fellows will have the opportunity to advance research in areas such as: threat intelligence and monitoring, ICS malware detection and network intrusion detection, device trust, hardware/embedded systems security, security and verification of AI and threat prediction and prevention.

The successful candidates must have obtained, or be about to obtain, a PhD in engineering or physical sciences. At least 3 years’ high quality research experience in cybersecurity, and/or machine learning/AI, as evidenced by a strong track record of publications in leading journals and conferences in relevant areas.

Closing Date: 17/04/2023

Closing date for applications:

Contact: Paul Miller (p.miller@qub.ac.uk)

More information: https://hrwebapp.qub.ac.uk/tlive_webrecruitment/wrd/run/ETREC107GF.open?VACANCY_ID=411415IzIk&WVID=6273090Lgx&LANG=USA

Lattice-based cryptography has laid the foundation of various modern-day cryptosystems that cater to several applications, including post-quantum cryptography. For structured lattice-based schemes, polynomial arithmetic is a fundamental part. In several instances, the performance optimizations come from implementing compact multipliers due to the small range of the secret polynomial coefficients. However, this optimization does not easily translate to side-channel protected implementations since masking requires secret polynomial coefficients to be distributed over a large range. In this work, we address this problem and propose two novel generalized techniques, one for the number theoretic transform (NTT) based and another for the non-NTT-based polynomial arithmetic. Both these proposals enable masked polynomial multiplication while utilizing and retaining the small secret property.

For demonstration, we used the proposed technique and instantiated masked multipliers for schoolbook as well as NTT-based polynomial multiplication. Both of these can utilize the compact multipliers used in the unmasked implementations. The schoolbook multiplication requires an extra polynomial accumulation along with the two polynomial multiplications for a first-order protected implementation. However, this cost is nothing compared to the area saved by utilizing the existing cheap multiplication units. We also extensively test the side-channel resistance of the proposed design through TVLA to guarantee its first-order security.

A distributed oblivious RAM (DORAM) is a method for accessing a secret-shared memory while hiding the accessed locations. DORAMs are the key tool for secure multiparty computation (MPC) for RAM programs that avoids expensive RAM-to-circuit transformations.

We present new and improved 3-party DORAM protocols. For a logical memory of size $N$ and for each logical operation, our DORAM requires $O(\log N)$ local CPU computation steps. This is known to be asymptotically optimal. Our DORAM satisfies passive security in the honest majority setting. Our technique results with concretely-efficient protocols and does not use expensive cryptography (such as re-randomizable or homomorphic encryption). Specifically, our DORAM is 25X faster than the known most efficient DORAM in the same setting.

Lastly, we extend our technique to handle malicious attackers at the expense of using slightly larger blocks (i.e., $\omega(\log^2 N)$ vs. $\Omega(\log N)$). To the best of our knowledge, this is the first concretely-efficient maliciously secure DORAM.

Technically, our construction relies on a novel concretely-efficient 3-party oblivious permutation protocol. We combine it with efficient non-oblivious hashing techniques (i.e., Cuckoo hashing) to get a distributed oblivious hash table. From this, we build a full-fledged DORAM using a distributed variant of the hierarchical approach of Goldreich and Ostrovsky (J. ACM '96). These ideas, and especially the permutation protocol, are of independent interest.

Proof of Storage-time (PoSt) is a cryptographic primitive that enables a server to demonstrate non-interactive continuous avail- ability of outsourced data in a publicly verifiable way. This notion was first introduced by Filecoin to secure their Blockchain-based decentral- ized storage marketplace, using expensive SNARKs to compact proofs. Recent work [2] employs the notion of trapdoor delay function to address the problem of compact PoSt without SNARKs. This approach however entails statefulness and non-transparency, while it requires an expensive pre-processing phase by the client. All of the above renders their solution impractical for decentralized storage marketplaces, leaving the stateless trapdoor-free PoSt with reduced setup costs as an open problem. In this work, we present stateless and transparent PoSt constructions using probabilistic sampling and a new Merkle variant commitment. In the process of enabling adjustable prover difficulty, we then propose a multi- prover construction to diminish the CPU work each prover is required to do. Both schemes feature a fast setup phase and logarithmic verification time and bandwidth with the end-to-end setup, prove, and verification costs lower than the existing solutions

We revisit the problem of {\em reusable} non-interactive secure computation (NISC). A standard NISC protocol for a sender-receiver functionality $f$ enables the receiver to encrypt its input $x$ such that any sender, on input $y$, can send back a message revealing only $f(x,y)$. Security should hold even when either party can be malicious. A {\em reusable} NISC protocol has the additional feature that the receiver's message can be safely reused for computing multiple outputs $f(x,y_i)$. Here security should hold even when a malicious sender can learn partial information about the honest receiver's outputs in each session.

We present the first reusable NISC protocol for general functions $f$ that only makes a {\em black-box} use of any two-message oblivious transfer protocol, along with a random oracle. All previous reusable NISC protocols either made a non-black-box use of cryptographic primitives (Cachin et al., ICALP 2002) or alternatively required a stronger arithmetic variant of oblivious transfer and were restricted to $f$ in $\mathsf{NC}^1$ or similar classes (Chase et al., Crypto 2019). Our result is obtained via a general compiler from standard NISC to reusable NISC that makes use of special type of honest-majority protocols for secure multiparty computation.

Finally, we extend the above main result to reusable {\em two-sided} NISC, in which two parties can encrypt their inputs in the first round and then reveal different functions of their inputs in multiple sessions. This extension either requires an additional (black-box) use of additively homomorphic commitment or alternatively requires the parties to maintain a state between sessions.

Secure computation enables mutually distrusting parties to jointly compute a function on their secret inputs, while revealing nothing beyond the function output. A long-running challenge is understanding the required communication complexity of such protocols---in particular, when communication can be sublinear in the circuit representation size of the desired function. For certain functions, such as Private Information Retrieval (PIR), this question extends to even sublinearity in the input size.

We develop new techniques expanding the set of computational assumptions for sublinear communication in both settings:

1) [Circuit size] We present sublinear-communication protocols for secure evaluation of general layered circuits, given any 2-round rate-1 batch oblivious transfer (OT) protocol with a particular ``decomposability'' property. In particular, this condition can be shown to hold for the recent batch OT protocols of (Brakerski et al. Eurocrypt 2022), in turn yielding a new sublinear secure computation feasibility result: from Quadratic Residuosity (QR) together with polynomial-noise-rate Learning Parity with Noise (LPN). Our approach constitutes a departure from existing paths toward sublinear secure computation, all based on fully homomorphic encryption or homomorphic secret sharing.

2) [Input size.] We construct single-server PIR based on the Computational Diffie-Hellman (CDH) assumption, with polylogarithmic communication in the database input size $n$. Previous constructions from CDH required communication $\Omega(n)$. In hindsight, our construction comprises of a relatively simple combination of existing tools from the literature.

As zero-knowledge proofs gain increasing adoption, the cryptography community has designed domain-specific languages (DSLs) that facilitate the construction of zero-knowledge proofs (ZKPs). Many of these DSLs, such as Circom, facilitate the construction of arithmetic circuits, which are essentially polynomial equations over a finite field. In particular, given a program in a zero-knowledge proof DSL, the compiler automatically produces the corresponding arithmetic circuit. However, a common and serious problem is that the generated circuit may be underconstrained, either due to a bug in the program or a bug in the compiler itself. Underconstrained circuits admit multiple witnesses for a given input, so a malicious party can generate bogus witnesses, thereby causing the verifier to accept a proof that it should not. Because of the increasing prevalence of such arithmetic circuits in blockchain applications, several million dollars worth of cryptocurrency have been stolen due to underconstrained arithmetic circuits.

Motivated by this problem, we propose a new technique for finding ZKP bugs caused by underconstrained polynomial equations over finite fields. Our method performs semantic reasoning over the finite field equations generated by the compiler to prove whether or not each signal is uniquely determined by the input. Our proposed approach combines SMT solving with lightweight uniqueness inference to effectively reason about underconstrained circuits. We have implemented our proposed approach in a tool called $\mathbf{\mathsf{QED}^2}$ and evaluate it on 163 Circom circuits. Our evaluation shows that $\mathbf{\mathsf{QED}^2}$ can successfully solve 70\% of these benchmarks, meaning that it either verifies the uniqueness of the output signals or finds a pair of witnesses that demonstrate non-uniqueness of the circuit. Furthermore, $\mathbf{\mathsf{QED}^2}$ has found 8 previously unknown vulnerabilities in widely-used circuits.