International Association
for Cryptologic Research

NIST has recently selected CRYSTALS-Kyber as a new public key encryption and key establishment algorithm to be standardized. This makes it important to evaluate the resistance of CRYSTALS-Kyber implementations to side-channel attacks. Software implementations of CRYSTALS-Kyber have already been thoroughly analysed. The discovered vulnerabilities helped improve the subsequently released versions and promoted stronger countermeasures against side-channel attacks. In this paper, we present the first attack on a protected hardware implementation of CRYSTALS-Kyber. We demonstrate a practical message (shared key) recovery attack on the first-order masked FPGA implementation of Kyber-512 by Kamucheka et al. (2022) using power analysis based on the Hamming distance leakage model. The presented attack exploits a vulnerability located in the masked message decoding procedure which is called during the decryption step of the decapsulation. The message recovery is performed using a profiled deep learning-based method which extracts the message directly, without extracting each share explicitly. By repeating the same decapsulation process multiple times, it is possible to increase the success rate of full shared key recovery to 99%.

Idealized constructions in cryptography prove the security of a primitive based on the security of another primitive. The challenge of building a pseudorandom function (PRF) from a random permutation (RP) has only been recently tackled by Chen, Lambooij and Mennink [CRYPTO 2019] who proposed Sum of Even-Mansour (SoEM) with a provable beyond-birthday-bound security. In this work, we revisit the challenge of building a PRF from an RP. On the one hand, we describe Keyed Sum of Permutations (KSoP) that achieves the same provable security as SoEM while being strictly simpler since it avoids a key addition but still requires two independent keys and permutations. On the other hand, we show that it is impossible to further simplify the scheme by deriving the two keys with a simple linear key schedule as it allows a non-trivial birthday-bound key recovery attack. The birthday-bound attack is mostly information-theoretic, but it can be optimized to run faster than a brute-force attack.

We present a novel stateless zero-knowledge rollup (ZK-rollup) protocol with client-side validation called Intmax2. Our architecture distinctly diverges from existing ZK-rollup approaches since essentially all of the data availability and computational costs are shifted to the client-side as opposed to imposing heavy computational requirements on the rollup aggregators. Moreover, the data storage and computation in our approach is parallelizable for each user. Therefore, there are no specific nodes to validate the contents of transactions. In effect, only block producers, who periodically submit a Merkle tree root containing all the transactions, are necessary.

Recently, many cryptographic primitives such as homomorphic encryption (HE), multi-party computation (MPC) and zero-knowledge (ZK) protocols have been proposed in the literature which operate on prime field $\mathbb{F}_p$ for some large prime $p$. Primitives that are designed using such operations are called arithmetization-oriented primitives. As the concept of arithmetization-oriented primitives is new, a rigorous cryptanalysis of such primitives is yet to be done. In this paper, we investigate arithmetization-oriented APN functions. More precisely, we investigate APN permutations in the CCZ-classes of known families of APN power functions over prime field $\mathbb{F}_p$. Moreover, we present a new class of APN binomials over $\mathbb{F}_q$ obtained by modifying the planar function $x^2$ over $\mathbb{F}_q$. We also present a class of binomials having differential uniformity at most $5$ defined via the quadratic character over finite fields of odd characteristic. We give sufficient conditions for which this family of binomials is permutation. Computationally it is confirmed that the latter family contains new APN functions for some small parameters. We conjecture it to contain an infinite subfamily of APN functions.

REAMC Report-007(2023) ACORN-QRE: Specification and Analysis of a Method of Generating Secure One-time Pads for Use in Encryption Roy S Wikramaratna (email: rwikramaratna@gmail.com) Abstract

The Additive Congruential Random Number (ACORN) generator is straightforward to implement; it has been demonstrated in previous papers to give rise to sequences with long period which can be proven from theoretical considerations to approximate to being uniform in up to k dimensions (for any given k).

The ACORN-QRE algorithm is a straightforward modification of ACORN which effectively avoids the linearity of the original algorithm, while preserving the uniformity of the modified sequence. It provides a new method for generating one-time pads that are resistant to attack either by current computers or by future computing developments, including quantum computers. The pads can use any alphabet (including both binary and alphanumeric) and can be used with a Vernam-type cypher to securely encrypt both files and communications.

This report explains how the ACORN-QRE algorithm works and provides evidence for the claim that the resulting one-time pads are inherently not susceptible to cryptanalysis and that they will remain secure against foreseeable developments in computing, including the potential development of quantum computers.

The ACORN-QRE algorithm is patented in the UK under Patent No. GB2591467; patent applied for in the US under Application No. 17/795632. The patents are owned by REAMC Limited, 4 Nuthatch Close, Poole, Dorset BH17 7XR, United Kingdom

Towards building more scalable blockchains, an approach known as data availability sampling (DAS) has emerged over the past few years. Even large blockchains like Ethereum are planning to eventually deploy DAS to improve their scalability. In a nutshell, DAS allows the participants of a network to ensure the full availability of some data without any one participant downloading it entirely. Despite the significant practical interest that DAS has received, there are currently no formal definitions for this primitive, no security notions, and no security proofs for any candidate constructions. For a cryptographic primitive that may end up being widely deployed in large real-world systems, this is a rather unsatisfactory state of affairs.

In this work, we initiate a cryptographic study of data availability sampling. To this end, we define data availability sampling precisely as a clean cryptographic primitive. Then, we show how data availability sampling relates to erasure codes. We do so by defining a new type of commitment schemes which naturally generalizes vector commitments and polynomial commitments. Using our framework, we analyze existing constructions and prove them secure. In addition, we give new constructions which are based on weaker assumptions, computationally more efficient, and do not rely on a trusted setup, at the cost of slightly larger communication complexity. Finally, we evaluate the trade-offs of the different constructions.

Efficient power management is critical for embedded devices, both for extending their lifetime and ensuring safety. However, this can be a challenging task due to the unpredictability of the batteries commonly used in such devices. To address this issue, dedicated Integrated Circuits known as "fuel gauges" are often employed outside of the System-On-Chip. These devices provide various metrics about the available energy source and are highly accurate. However, their precision can also be exploited by malicious actors to compromise platform confidentiality if the Operating System fails to intervene. Depending on the fuel gauge and OS configuration, several attack scenarios are possible. In this article, we focus on Android and demonstrate how it is possible to bypass application isolation to recover PINs entered in other processes.

YOSO-style MPC protocols (Gentry et al., Crypto'21), are a promising framework where the overall computation is partitioned into small, short-lived pieces, delegated to subsets of one-time stateless parties. Such protocols enable gaining from the security benefits provided by using a large community of participants where "mass corruption" of a large fraction of participants is considered unlikely, while keeping the computational and communication costs manageable. However, fully realizing and analyzing YOSO-style protocols has proven to be challenging: While different components have been defined and realized in various works, there is a dearth of protocols that have reasonable efficiency and enjoy full end to end security against adaptive adversaries.

The YOSO model separates the protocol design, specifying the short-lived responsibilities, from the mechanisms assigning these responsibilities to machines participating in the computation. These protocol designs must then be translated to run directly on the machines, while preserving security guarantees. We provide a versatile and modular framework for analyzing the security of YOSO-style protocols, and show how to use it to compile any protocol design that is secure against static corruptions of $t$ out of $c$ parties, into protocols that withstand adaptive corruption of $T$ out of $N$ machines (where $T/N$ is closely related to $t/c$, specifically when $t/c<0.5$, we tolerate $T/N \leq 0.29$) at overall communication cost that is comparable to that of the traditional protocol even when $c << N$.

Furthermore, we demonstrate how to minimize the use of costly non-committing encryption, thereby keeping the computational and communication overhead manageable even in practical terms, while still providing end to end security analysis. Combined with existing approaches for transforming stateful protocols into stateless ones while preserving static security (e.g. Gentry et al. 21, Kolby et al. 22), we obtain end to end security.

The BBS+ signature scheme is one of the most prominent solutions for realizing anonymous credentials. In particular, due to properties like selective disclosure and efficient protocols for creating and showing possession of credentials. In recent years, research in cryptography has increasingly focused on the distribution of cryptographic tasks to mitigate attack surfaces and remove single points of failure.

In this work, we present a threshold BBS+ protocol in the preprocessing model. Our protocol supports an arbitrary $t$-out-of-$n$ threshold and achieves non-interactive signing in the online phase. It relies on a new pseudorandom correlation-based offline protocol producing preprocessing material with sublinear communication complexity in the number of signatures. Both our offline and online protocols are actively secure under the Universal Composability framework. Finally, we estimate the concrete efficiency of our protocol, including an implementation of the online phase. The online protocol without network latency takes less than $15 ms$ for $t \leq 30$ and credentials sizes up to $10$. Further, our results indicate that the influence of $t$ on the online signing is insignificant, $< 6 \%$ for $t \leq 30$, and the overhead of the thresholdization occurs almost exclusively in the offline phase.

The Security and Privacy Research Unit at TU Wien (https://secpriv.wien) is offering a fully funded PhD position within the WWTF project “SCALE2: SeCure, privAte, and interoperabLe layEr 2” (https://www.wwtf.at/funding/programmes/ict/ICT22-045/) under the supervision of Dr. Georgia Avarikioti and Univ.-Prof. Dr. Matteo Maffei.
Your profile:

• Master degree in computer science or equivalent (degree completion by employment start)
• Background in security/blockchain is a plus
• Excellent English, communication, and teamwork skills

Your tasks:

• Conducting world-class research in the design and analysis of scaling protocols for blockchains
• Engaging in research collaborations
• Contributing to teaching blockchain technologies on Masters-level

We offer:

• The Security and Privacy group is internationally renowned, regularly publishes in top security venues, and consists of an international, diverse team with expertise in cryptography, security, privacy, and game theory
• An international English-speaking environment (German not required)
• Personal/professional development, flexible hours
• Central workplace location (U1/U2/U4 Karlsplatz)
• Creative environment in a top-ranked city in livability
• A competitive salary

TU Wien strongly advocates for women, especially in leadership roles, and encourages applications from females and individuals with special needs. If qualifications are equal, female applicants will be prioritized unless specific reasons favor a male candidate.
The application material should include:

• Motivation letter
• Bachelor/Master’s transcripts
• Publication list (if available)
• Curriculum vitae
• Contact information for two referees

Closing date for applications:

Contact: Interested candidates should send the application material to Matteo Maffei (matteo.maffei@tuwien.ac.at) and Georgia Avarikioti (georgia.avarikioti@tuwien.ac.at). Applications received by August 15th will receive full consideration, but applications will be accepted until the position is filled.

Mysten Labs believes that decentralized and open protocols are the bedrock of the internet of value. This is why at Mysten Labs, we are creating foundational infrastructure to accelerate the adoption of decentralized protocols based on blockchain technologies.

Mysten is looking for a Software Engineer who is interested in cryptographic protocols and their application to blockchain. This person would work with us to design, check and implement mission-critical algorithms on range of topics including; cryptographic primitives such as pairing-based cryptography, distributed cryptographic protocols such as signature aggregation and distributed key generation, and zero-knowledge building blocks such as vector commitments and accumulators. They would then put this cryptography into practice in order to realize the scalability required by the next generation of blockchain networks.

What You'll Have:

5+ years of experience in hands-on software engineering for cryptographic operations, such as signature schemes, accumulators, key management, data encryption and compression.

Understanding of fundamental cryptographic algorithms and underlying math for any of the following: hash functions, finite field arithmetic, polynomials (FFT) and elliptic curves.

Experience implementing high-performance and parallelizable protocols in languages such as Go, Rust Java, or C/C++.

Experience with tools, practices, and programming patterns for ensuring software correctness.

Experience implementing zk-SNARK circuits or proof systems (i.e., Groth16, Halo, Plonk, STARKs, Marlin) is considered a plus.

Understanding, research publications or hands-on experience in any of the following is considered a bonus: zero knowledge proofs, threshold signatures, multi-party computations, efficient accumulators, distributed randomness generation, auditing cryptographic software/smart contracts, lightweight and embedded cryptography.

Closing date for applications:

Contact: Please navigate to our job posting if you wish to apply: https://jobs.ashbyhq.com/mystenlabs/a3d0da5b-b3cb-45db-9aa8-dc89ba0cee5e

More information: https://jobs.ashbyhq.com/mystenlabs/a3d0da5b-b3cb-45db-9aa8-dc89ba0cee5e

The University of Birmingham's School of Computer Science continues to thrive during a period of sustained growth. We are inviting applications for full professorial positions [1]. If you are a leader with a passion for computer science (and in particular Cyber Security), this is an extraordinary opportunity to shape the future of our academic community.

Areas of interest include (but are not limited to) systems security, artificial intelligence, network/web security, as well as formal methods and cryptography.

As part of the University of Birmingham, you will have access to state-of-the-art facilities, world-class research centres (in particular the Centre for Cyber Security and Privacy [2]), and a growing network of academic and industry collaborations. Our commitment to diversity and inclusion ensures an inclusive and welcoming environment for all.

The deadline for applications is 30 July 2023. Please note that we reserve the right to close this vacancy early once a sufficient number of applications have been received.

[1] https://www.jobs.ac.uk/job/DBD093/chair-in-computer-science-school-of-computing-science-4-positions-102099

[2] https://www.birmingham.ac.uk/research/centre-for-cyber-security-and-privacy/index.aspx

Closing date for applications:

Contact: For further information, please contact Aad van Moorsel, a.vanmoorsel@bham.ac.uk. For informal enquiries regarding the Centre for Cyber Security and Privacy, please contact David Oswald (d.f.oswald@bham.ac.uk) and Mark Ryan (m.d.ryan@bham.ac.uk).

More information: https://www.jobs.ac.uk/job/DBD093/chair-in-computer-science-school-of-computing-science-4-positions-102099

The responsibilities of this exciting, varied role will include:

• Software security assessment of SoC/IC security architectures and security scope specifications

• Plan, track and execute process, specification as well as software implementation reviews

• Assessment of software security robustness and effectiveness of security mechanisms

• Work with engineering teams and security engineers to innovate solutions to security-related problems

• Manage the NXP’s software secure development lifecycle (SSDLC) applied on product developments to minimize security risks

• Work on continuous improvements to keep up with state-of-the-art security technologies

• Refine software security best practices to assure and efficient and effective application

• Provide consultation on specific areas of security expertise and on the application of the SSDLC

To ensure your successful performance in this role, the following is desired

• Finished a BSEE or MSEE preferred in Security Engineering or Software Engineering

• Have good understanding of embedded software design, programming, documentation, and testing

• Have experience in the design and development of secure software, focus on embedded systems or complete solutions

• Have experience in the security concept/design, thread analysis, risk/threat modelling and mitigation strategies

• Have professional knowledge of software languages (C, Java, Java Card, Python, Rust)

• Knowledge of security compliance and certification processes would be an advantage

• Be familiar with "state of the art" software tools, CI/CD, secure software engineering processes, IoT solutions and service (depending on area of expertise)

• Have excellent communication skills, are willing to listen and adapt

• Are a collaborator with strong soft skills, ideally experienced in multicultural and global working environment

Closing date for applications:

Contact:

Veronika von Hepperger

Senior Talent Acquisition Specialist

(veronika.vonhepperger@nxp.com)

We bring to life fast, permissionless, decentralized computation. The Nillion team is looking for talented cryptographers to help build a new paradigm in decentralized computing to redefine network computation on private data. As a Cryptographer at Nillion, you will research, design, and define cryptographic protocols within the larger framework of distributed systems, formally proving their security. You will be responsible for conducting groundbreaking research that will lead to commercially viable and reliable products by analyzing, proposing, and validating cryptography solutions within a decentralized computing environment. We work in an environment where tangibility and flexibility are key attributes that help us innovate. Our engineering team embodies those qualities, bringing clarity and direction to help move new ideas forward. If you enjoy keeping up to speed on current technological trends and have a background in cryptography and security - get in touch! Requirements: - 5+ years of academic research experience in cryptography - Qualified to a PhD or Postdoc degree in cryptography or related field - Several international scientific publications - Deep understanding of multi-party computation (MPC) -Excellent verbal and written communication skills in English -Extensive experience working with internal and external stakeholders -Have highly effective communication, interpersonal and critical thinking skills -Ability to understand, formally describe and prove mathematical concepts in writing -The ability to write formal security proofs in the UC framework -Publications in the domain of MPC (Publications in the domains of ZKP or FHE are a bonus) Responsibilities: -Developing new protocols and their security proofs -Creating variants of existing protocols (synchronous/asynchronous, computational/ITS, passive/active, static/mobile adversaries, boolean/arithmetic, etc.) -Verifying existing NMC protocols and their security proofs -Proof-reading existing written material (e.g. technical whitepaper) -Writing new security proofs for existing NMC protocols.. See full job description below.

Closing date for applications:

Contact: Roisin Kavanagh, Head of People and Talent.

More information: https://apply.workable.com/nillion/j/CD9D0CFCD3/

The random oracle model is an instrument used for proving that protocol has no structural flaws when settling with standard hash properties is impossible or fairly difficult. In practice, however, random oracles have to be instantiated with some specific hash functions, which are not random oracles. Hence, in the real world, an adversary has broader capabilities than considered in the random oracle proof — it can exploit the peculiarities of a specific hash function to achieve its goal. In a case when a hash function is based on some building block, one can go further and show that even if the adversary has access to that building block, the hash function still behaves like a random oracle under some assumptions made about the building block. Thereby, the protocol can be proved secure against more powerful adversaries under less complex assumptions. The indifferentiability notion formalizes that approach.

In this paper we study whether Streebog, a Russian standardized hash function, can instantiate a random oracle from that point of view. We prove that Streebog is indifferentiable from a random oracle under an ideal cipher assumption for the underlying block cipher.

The post-quantum digital signature scheme CRYSTALS-Dilithium has been recently selected by the NIST for standardization. Implementing CRYSTALS-Dilithium, and other post-quantum cryptography schemes, on embedded devices raises a new set of challenges, including ones related to performance in terms of speed and memory requirements, but also related to side-channel and fault injection attacks security. In this work, we investigated the latter and describe a differential fault attack on the randomized and deterministic versions of CRYSTALS-Dilithium. Notably, the attack requires a few instructions skips and is able to reduce the MLWE problem that Dilithium is based on to a smaller RLWE problem which can be practically solved with lattice reduction techniques. Accordingly, we demonstrated key recoveries using hints extracted on the secret keys from the same faulted signatures using the LWE with side-information framework introduced by Dachman-Soled et al. at CRYPTO’20. As a final contribution, we proposed algorithmic countermeasures against this attack and in particular showed that the second one can be parameterized to only induce a negligible overhead over the signature generation.

The analysis of real-life incidents has revealed that state-level efforts are made to camouflage the intentional flaws in the mathematical layer of an S-Box to exploit the information-theoretic properties, i.e., Kuznyechik. To extract and investigate the common features in the backdoored S-Box(es), this research thoroughly examines them from the perspective of 24 cryptanalytic attack vectors available in the open literature. We have debunked the earlier claims by the backdoor engineers that their designs are stealthy against statistical distinguishers. A backdoored architecture fulfils the notions of randomness but lacks the strength to resist sophisticated cryptanalytic attacks. Our analysis has revealed that during the backdoor insertion phase, a malicious designer compromises vital cryptographic properties, prominently the algebraic degree, differential trails, avalanche characteristics and leaving the open ground for hybrid attacks. It is observed that these mappings attain the upper bound of BCT, FBCT and DLCT, thus paving the way for hybrid attacks with high probability.

We present a simple and lightweight single-server sublinear private information retrieval scheme based on new techniques in hint construction and usage. Our scheme has small amortized response and close to optimal online response, which is only twice that of simply fetching the desired entry without privacy. For a 128 GB database with 64-byte entries, each query consumes only 117 KB of communication and 7.5 milliseconds of computation, amortized.

We establish new results on the Fiat-Shamir (FS) security of several protocols that are widely used in practice, and we provide general tools for establishing similar results for others. More precisely, we: (1) prove the FS security of the FRI and batched FRI protocols; (2) analyze a general class of protocols, which we call $\delta$-correlated, that use low-degree proximity testing as a subroutine (this includes many "Plonk-like" protocols (e.g., Plonky2 and Redshift), ethSTARK, RISC Zero, etc.); and (3) prove FS security of the aforementioned "Plonk-like" protocols, and sketch how to prove the same for the others.

We obtain our first result by analyzing the round-by-round (RBR) soundness and RBR knowledge soundness of FRI. For the second result, we prove that if a $\delta$-correlated protocol is RBR (knowledge) sound under the assumption that adversaries always send low-degree polynomials, then it is RBR (knowledge) sound in general. Equipped with this tool, we prove our third result by formally showing that "Plonk-like" protocols are RBR (knowledge) sound under the assumption that adversaries always send low-degree polynomials. We then outline analogous arguments for the remainder of the aforementioned protocols.

To the best of our knowledge, ours is the first formal analysis of the Fiat-Shamir security of FRI and widely deployed protocols that invoke it.

Privacy-preserving payment systems face the difficult task of balancing privacy and accountability: on one hand, users should be able to transact privately and anonymously, on the other hand, no illegal activities should be tolerated. The challenging question of finding the right balance lies at the core of the research on accountable privacy that stipulates the use of cryptographic techniques for policy enforcement, but still allows an authority to revoke the anonymity of transactions whenever such an automatic enforcement is technically not supported. Current state-of-the-art systems are only able to enforce rather limited policies, such as spending or transaction limits, or assertions about participants, but are unable to enforce more complex policies that for example jointly evaluate both, the private credentials of sender and recipient-let alone to do this without an auditor in the loop during payment. This limits the cases where privacy revocation can be avoided as the method to fulfill regulations, which is unsatisfactory from a data-protection viewpoint and shows the need for cryptographic solutions that are able to elevate accountable privacy to a more fine-grained level.

In this work, we present such a solution. We show how to enforce complex policies while offering strong privacy and anonymity guarantees by enhancing the notion of policy-compliant signatures (PCS) introduced by Badertscher, Matt and Waldner (TCC'21). In more detail, we first define the notion of unlinkable PCS (ul-PCS) and show how this cryptographic primitive can be generically integrated with a wide range of systems including UTxO-based ledgers, privacy-preserving protocols like Monero or Zcash, and central-bank digital currencies. We give a generic construction for ul-PCS for any policy, and optimized constructions tailored for special policy classes, such as role-based policies and separable policies.

To bridge the gap between theory and practice, we provide prototype implementations for all our schemes. We give the first benchmarks for policy-compliant signatures in general, and demonstrate their feasibility for reasonably sized attribute sets for the special cases.