IACR News
Here you can see all recent updates to the IACR webpage. These updates are also available:
31 May 2024
Ayaz Khan
28 May 2024
Jeju, Korea, 21 August - 23 August 2024
Submission deadline: 15 June 2024
Notification: 20 July 2024
DigicomAI
DigicomAI is focused on building next-generation digital communications and information security technology. Our advanced AI capabilities are designed to automate network management decision-making, harden networks, and enable cross-cloud control without the need for human intervention. By leveraging our technology, organizations can improve network performance, increase operating efficiency, and reduce resource expenditures.
Role Description
We are seeking a part-time consultant (remote) to provide Cryptography & Cybersecurity services in support of technology research, design, implementation and general corporate governance. You will be responsible for providing expertise and guidance on cryptography and cybersecurity principles, trends and best practices. Your project-based tasks will involve conducting information security assessments, ensuring application security, researching and advising product developers on cryptography techniques and engineering recommendations. You will also help keep the company up-to-date with the latest industry trends and technologies.
Qualifications
- Cybersecurity and Information Assurance skills
- Experience in Applied Cryptography Engineering
- Vulnerability Assessment knowledge
- Expertise in Application Security and Network Security
- Understanding of risk assessment and risk management
- International industry experience (Europe, Middle East or Australia preferred)
- Strong problem-solving and analytical skills
- Excellent written and verbal communication skills
- Ability to work independently and remotely
- Relevant Information Security and Cryptographic certifications (CISSP, etc)
- Bachelor’s degree in Computer Science, Cybersecurity, or a related field
Additional
This is an ideal position for an experienced cybersecurity and cryptography engineer who wants to contribute their expertise to cutting-edge technology development projects. We offer a fully-remote, asynchronous schedule tailored to the specific needs of the Consultant.
Closing date for applications:
Contact: Ted Runkle (Venture Advisor)
University of Birmingham, Birmingham, United Kingdom
The Center for Security and Privacy at the School of Computer Science of the University of Birmingham has an open PhD position in post-quantum cryptography. The supervision will be shared by Rishiraj Bhattacharyya and Christophe Petit. We invite applications from candidates with interests in Cryptography and Computer Algebra. The ideal candidate will have a strong background in Mathematics, Computer Science, Physics or a related area.
The primary research theme for the call is in the foundations and cryptanalysis of post-quantum cryptosystems. The exact projects could be tailored to match the candidate's background and interests.
The review of applications will start immediately and the call remains open until September 2024. For more information, please reach out to Rishiraj (r.bhattacharyya@bham.ac.uk) and Christophe (c.petit.1@bham.ac.uk).Closing date for applications:
Contact: Rishiraj Bhattacharyya (r.bhattacharyya@bham.ac.uk) and Christophe Petit (c.petit.1@bham.ac.uk)
27 May 2024
Eunmin Lee, Joohee Lee, Yuntao Wang
In this work, we generalize and extend the idea of Meet-LWE by introducing ternary trees, which result in diverse representations of the secrets. More precisely, we split the secrets into three pieces with the same dimension and expand them into a ternary tree to leverage the increased representations to improve the overall attack complexity. We carefully analyze and optimize the time and memory costs of our attack algorithm exploiting ternary trees, and compare them to those of the Meet-LWE attack. With asymptotic and non-asymptotic comparisons, we observe that our attack provides improved estimations for all parameter settings, including those of the practical post-quantum schemes, compared to the Meet-LWE attack. We also evaluate the security of the Round 2 candidates of the KpqC competition which aims to standardize post-quantum public key cryptosystems in the Republic of Korea, and report that the estimated complexities for our attack applied to SMAUG-T are lower than the claimed for some of the recommended parameters.
Lucas Piske, Jaspal Singh, Ni Trieu
We use standard homomorphic secret sharing (HSS) schemes, variant of the Learning with Parity Noise assumption and the Quadratic Residuosity assumption to construct batched FSS schemes for point functions with single-bit and multi-bit output. Our scheme is asymptotically superior than naively batching state of the art FSS schemes for point functions. Concretely our batch key sizes are smaller by a factor of $3-80\times$ as batch size is increased from $2^{13}$ to $2^{19}$. Although our protocol relies on public key operations, it exhibits inefficiency in a LAN setting. However, it demonstrates up to a 120-fold improvement in a WAN setting with slow network bandwidth.
As a building block in our protocols, we introduce a new HSS ciphertext compression algorithm, that can decompress a short compressed ciphertext to give low noise ciphertexts of array of input message bits. This primitive might be of independent interest for other HSS related applications.
Fatima Elsheimy, Julian Loss, Charalampos Papamanthou
Our first protocol is deterministic and ensures early stopping termination in $ (d+5) \cdot (\lfloor f/d \rfloor +3)$ rounds, where $d$ is a fixed constant. For example, for all $d\ge 6$, our protocol runs in at most $(1+\epsilon )\cdot f$ rounds (where $0<\epsilon<1$), improving (for large $f$) upon the best previous early stopping deterministic broadcast protocol by Perry and Toueg~\cite{Perry}, which terminates in $min(2f+4,2t+2)$ rounds. Additionally, our second protocol is randomized, ensuring termination in an expected constant number of rounds and achieving early stopping in $(d+9) \cdot (\lfloor f/d \rfloor +2)$ rounds in the worst case. This marks a significant improvement over a similar result by Goldreich and Petrank[GOLDREICH1990], which always requires an expected constant number of rounds and $O(t)$ rounds in the worst case, i.e., does not have the early stopping property.
Yao-Ching Hsieh, Huijia Lin, Ji Luo
Our general framework is modular and conceptually simple, reducing the task of constructing ABE to that of constructing noisy linear secret sharing schemes, a more lightweight primitive. The versatility of our framework is demonstrated by three new ABE schemes based on variants of the evasive LWE assumption.
- We obtain two ciphertext-policy ABE schemes for all polynomial-size circuits with a predetermined depth bound. One of these schemes has *succinct* ciphertexts and secret keys, of size polynomial in the depth bound, rather than the circuit size. This eliminates the need for tensor LWE, another new assumption, from the previous state-of-the-art construction by Wee [EUROCRYPT ’22].
- We develop ciphertext-policy and key-policy ABE schemes for deterministic finite automata (DFA) and logspace Turing machines ($\mathsf{L}$). They are the first lattice-based public-key ABE schemes supporting uniform models of computation. Previous lattice-based schemes for uniform computation were limited to the secret-key setting or offered only weaker security against bounded collusion.
Lastly, the new primitive of evasive IPFE serves as the lattice-based counterpart of pairing-based IPFE, enabling the application of techniques developed in pairing-based ABE constructions to lattice-based constructions. We believe it is of independent interest and may find other applications.
Pierre Meyer, Claudio Orlandi, Lawrence Roy, Peter Scholl
[**Two ciphertexts per multiplication, from IND-CPA security of Damgård-Jurik.**] Assuming the Damgård-Jurik cryptosystem is semantically secure (which follows from DCR), there is a garbling scheme for circuits with $B$-bounded integer arithmetic using only two ciphertexts per multiplication. The total bit-size of the resulting garbled circuit is: $$(n + 2s_\times+2D_\times)\cdot (\zeta + 1) \cdot \log N$$ where $n$ is the number of inputs, $s_\times$ is the number of multiplications, $D_\times$ is the multiplicative depth of the circuit, $N$ is an RSA modulus and $N^{\zeta-1}$ is a rough bound on the magnitude of wire values in the computation.
[**One ciphertext per multiplication, from KDM security of Damgård-Jurik.**] Assuming the Damgård-Jurik encryption scheme remains secure given encryption of the key and its inverse, the construction achieves rate-$1$. The total bit-size of the resulting garbled circuit is: $$(n + s_\times + 1) \cdot (\zeta + 1) \cdot \log N$$ where the parameters are as above, except $N^{\zeta-2}$ is the magnitude bound.
As a side result, we show that our scheme based on IND-CPA security achieves rate $3/5$ for levelled circuits.
Dachao Wang, Alexander Maximov, Patrik Ekdahl, Thomas Johansson
Jan Bobolz, Pooya Farshim, Markulf Kohlweiss, Akira Takahashi
Arnaud Sipasseuth
Noga Ron-Zewi, Mor Weiss
In this work, we construct the first ZK-IOPs approaching the witness length for a natural NP problem. More specifically, we design constant-query and constant-round IOPs for 3SAT in which the total communication is $(1+\gamma)m$, where $m$ is the number of variables and $\gamma>0$ is an arbitrarily small constant, and ZK holds against verifiers querying $m^\beta$ bits from the prover's messages, for a constant $\beta>0$. This gives a ZK variant of a recent result of Ron-Zewi and Rothblum (FOCS `20), who construct (non-ZK) IOPs approaching the witness length for a large class of NP languages. Previous constructions of ZK-IOPs incurred an (unspecified) large constant multiplicative overhead in the proof length, even when restricting to ZK against the honest verifier.
We obtain our ZK-IOPs by improving the two main building blocks underlying most ZK-IOP constructions, namely ZK codes and ZK-IOPs for sumcheck. More specifically, we give the first ZK-IOPs for sumcheck that achieve both sublinear communication for sumchecking a general tensor code, and a ZK guarantee. We also show a strong ZK preservation property for tensors of ZK codes, which extends a recent result of Bootle, Chiesa, and Liu (EC `22). Given the central role of these objects in designing ZK-IOPs, these results might be of independent interest.
Arnaud Sipasseuth
Damiano Abram, Lawrence Roy, Peter Scholl
We construct succinct, two-party HSS for branching programs, based on either the decisional composite residuosity assumption, a DDH-like assumption in class groups, or learning with errors with a superpolynomial modulus-to-noise ratio. We then give several applications of succinct HSS, which were only previously known using fully homomorphic encryption, or stronger tools:
- Succinct vector oblivious linear evaluation (VOLE): Two parties can obtain secret shares of a long, arbitrary vector $\vec x$, multiplied by a scalar $\Delta$, with communication sublinear in the size of the vector. - Batch, multi-party distributed point functions: A protocol for distributing a batch of secret, random point functions among $N$ parties, for any polynomial $N$, with communication sublinear in the number of DPFs. - Sublinear MPC for any number of parties: Two new constructions of MPC with sublinear communication complexity, with $N$ parties for any polynomial $N$: (1) For general layered Boolean circuits of size $s$, with communication $O(N s/\log\log s)$, and (2) For layered, sufficiently wide Boolean circuits, with communication $O(N s/\log s)$.
Mehmet Sabir Kiraz, Enrique Larraia, Owen Vaughan
Sébastien Canard, Caroline Fontaine, Duong Hieu Phan, David Pointcheval, Marc Renard, Renaud Sirdey
Charlotte Hoffmann
In this work we present the first traceable secret sharing scheme based on the Chinese remainder theorem. This was stated as an open problem by Boneh, Partap and Rotem, as it gives rise to traceable secret sharing with weighted threshold access structures. The scheme is based on Mignotte's secret sharing and increases the size of the shares of the standard Mignotte secret sharing scheme by a factor of $2$.
Qian Guo, Erik Mårtensson, Adrian Åström
We further propose an adaptive method to enhance parallel mismatch attacks, initially proposed by Shao et al. at AsiaCCS 2024, thereby significantly reducing query complexity. This method combines the adaptive attack with post-processing via lattice reduction to retrieve the final secret key entries. Our method proves its efficacy by reducing query complexity by 14.6 % for Kyber512 and 7.5 % for Kyber768/Kyber1024.
Furthermore, this approach has the potential to substantially improve multi-value Plaintext-Checking (PC) oracle-based side-channel attacks against the CCA-secure version of Kyber KEM.