IACR News
Here you can see all recent updates to the IACR webpage. These updates are also available:
23 April 2024
Taipei, Taiwan, 7 March - 9 March 2026
Sofia, Bulgaria, 26 March - 28 March 2025
Chennai, India, 18 December - 21 December 2024
Submission deadline: 8 September 2024
Notification: 18 October 2024
Halifax, Canada, 4 September 2024
Submission deadline: 15 June 2024
Notification: 15 July 2024
City of Edinburgh, United Kingdom, 2 September - 6 September 2024
Submission deadline: 14 June 2024
University of Birmingham, Birmingham, United Kingdom
I am looking for Ph.D. students in the area of analysing and preventing physical side channels in embedded devices. Two positions are available, which, as usual in the UK, enable the post holder to cover their tuition fees as well as enable them to cover their living expenses.
The research topics that I am recruiting for are:
- Pre-silicon modelling and analysis: you should be familiar with utilising a typical HW design flow, power simulation tools, and you should have an interest in developing skills in leakage modelling as well as analysis.
- Statistical detection and analysis methods: you should be comfortable with probability theory and statistics, and you should have an interest in exploring sophisticated statistical approaches in the context of exploiting and detecting leakage. This research may also touch on statistical learning methods.
- Implementation and analysis of post-quantum schemes: you should be familiar with low level software implementations (aka Assembly programming), and have an interest in exploring implementation options (potentially also considering dedicated hardware, e.g. the impact of dedicated instructions) to develop secure and reasonably efficient post-quantum implementations.
If you feel that you fit with one (or several) of the three topics, or, if you believe that you can make a good case for another topic, then please get in touch (see contact info below). Please send me a transcript of records, and a short (1 page) statement explaining why you want to do a PhD with me). If I think that you are a viable candidate, I will guide you through the application process.
I am now a faculty member and thus part of the Birmingham Centre for Security and Privacy. You can find information about this research group here: https://www.birmingham.ac.uk/research/centre-for-cyber-security-and-privacy. This is a sizeable research group, which offers companionship via other PhD students and staff members, as well as opportunities via many good relationships with industry.
Closing date for applications:
Contact: Prof. Elisabeth Oswald (sca-research@pm.me, or m.e.oswald@bham.ac.uk).
22 April 2024
Jie Xie, Yuncong Hu, Yu Yu
Gurgen Arakelov, Nikita Kaskov, Daria Pianykh, Yuriy Polyakov
Ward Beullens, Pierre Briaud, Morten Øygarden
This work improves our understanding of the security of both problems. Firstly, we propose and implement a novel collision attack on R-SDP($G$) that provides the best attack under realistic restrictions on memory. Secondly, we derive precise complexity estimates for algebraic attacks on R-SDP that are shown to be accurate by our experiments. We note that neither of these improvements threatens the updated parameters of CROSS.
Min Xie, Peichen Ju, Yanqi Zhao, Zoe L. Jiang, Junbin Fang, Yong Yu, Xuan Wang
We provide a practical DAAC-CR instance based on a novel primitive that we identify as structure-preserving signatures on equivalence classes on vector commitments (SPSEQ-VC). This primitive may be of independent interest, and we detail an efficient construction. Compared to traditional DAC systems that rely on non-interactive zero-knowledge (NIZK) proofs, the credential size in our DAAC-CR instance is constant, independent of the length of delegation chain and the number of attributes. We formally prove the security of our scheme in the generic group model and demonstrate its practicality through performance benchmarks.
Benoît Cogliati, Pierre-Alain Fouque, Louis Goubin, Brice Minaud
As many attacks have appeared on code-based and multivariate schemes, we think it is important for the ongoing NIST competition to look at the security proofs of these schemes. The original proof of Sakumoto, Shirai, and Hiwatari (PQCrypto 2011) was flawed, then corrected by Chatterjee, Das and Pandit (INDOCRYPT 2022). The fix is still not sufficient, as it only works for very large finite fields. A new proof in the Quantum ROM model was proposed by Kosuge and Xagawa (PKC 2024), but it is rather loose, even when restricted to the classical setting.
In this paper, we introduce several tools that yield tighter security bounds for Hash-and-Sign with Retry signatures in the classical setting. These include the Hellinger distance, stochastic dominance arguments, and a new combinatorial tool to transform a proof in the non-adaptative setting to the adaptative setting. Ultimately, we obtain a sharp bound for the security of Hash-and-Sign with Retry signatures, applicable to various code-based and multivariate schemes. Focusing on NIST candidates, we apply these results to the MAYO, PROV, and modified UOV signature schemes. In most cases, our bounds are tight enough to apply with the real parameters of those schemes; in some cases, smaller parameters would suffice.
Zhengjun Cao, Lihua Liu
Truman Welling, Onur Gunlu, Aylin Yener
Sam Gunn, Yael Tauman Kalai, Anand Natarajan, Agi Villanyi
Léo Perrin
For algebraic attack relying on the computation and exploitation of a Gröbner basis, our survey of the literature suggests to base a security argument on the complexity of the variable elimination step rather than that of the computation of the Gröbner basis itself. Indeed, it turns out that the latter complexity is hard to estimate---and is sometimes litteraly non-existent. Focusing on the elimination step, we propose a generalization of the "FreeLunch" approach which, under a reasonable conjecture about the behaviour of the degree of polynomial ideals of dimension 0, is sufficient for us to argue that both XHash8 and XHash12 are safe against such attacks.
We implemented a simplified version of the generation (and resolution) of the corresponding set of equations in SAGE, which allowed us to validate our conjecture at least experimentally, and in fact to show that the lower bound it provides on the ideal degree is not tight---meaning we are a priori understimating the security of these permutations against the algebraic attacks we consider.
At this stage, if used as specified, these hash functions seem safe from Gröbner bases-based algebraic attacks.
Xiaoyang Dong, Boxin Zhao, Lingyue Qin, Qingliang Hou, Shun Zhang, Xiaoyun Wang
Divesh Aggarwal, Leong Jin Ming, Alexandra Veliche
Amos Beimel, Oriol Farràs, Oded Nir
Our work is inspired by several motivations: 1) Obtaining efficient schemes (with perfect or computational security) for natural families of access structures; 2) Making progress in the search for better schemes for general access structures, which are often based on schemes for slice access structures; 3) Proving or disproving the conjecture by Csirmaz (J. Math. Cryptol., 2020) that an access structures and its dual can be realized by secret-sharing schemes with the same share size.
The main results of this work are: - Perfect schemes for high slices. We present a scheme for $(n-k)$-slices with information-theoretic security and share size $kn\cdot 2^{\tilde{O}(\sqrt{k \log n})}$. Using a different scheme with slightly larger shares, we prove that the ratio between the optimal share size of $k$-slices and that of their dual $(n-k)$-slices is bounded by $n$. - Computational schemes for high slices. We present a scheme for $(n-k)$-slices with computational security and share size $O(k^2 \lambda \log n)$ based on the existence of one-way functions. Our scheme makes use of a non-standard view point on Shamir secret-sharing that allows to share many secrets with different thresholds with low cost. - Multislice access structures. $(a:b)$-multislices are access structures that behave similarly to slices, but are unconstrained on coalitions in a wider range of cardinalities between $a$ and $b$. We use our new schemes for high slices to realize multislices with the same share sizes that their duals have today. This solves an open question raised by Applebaum and Nir (Crypto, 2021), and allows to realize hypergraph access structures that are chosen uniformly at random under a natural set of distributions with share size $2^{0.491n+o(n)}$ compared to the previous result of $2^{0.5n+o(n)}$.