International Association
for Cryptologic Research

to appear

Certificateless public key cryptography is an attractive paradigm since it eliminates the use of certificates in traditional public key cryptography and alleviates the inherent key escrow problem in identity-based cryptography. Recently, Xiong et al. proposed a certificateless signature scheme and proved that their scheme is existentially unforgeable against adaptive chosen message attack under the random oracle model. He et al. pointed out that Xiong et al.\'s scheme is insecure against the Type II adversary. But, their forged signatures are not random, and their improved scheme has the same security defects as Xiong et al.\'s scheme. In this paper, we present two malicious-but-passive KGC attack methods on Xiong et al.\'s scheme and our results show that their scheme is insecure against malicious-but-passive KGC attack.

Bilinear maps, or pairings, initially proposed in a cryptologic context for cryptanalytic purposes, proved afterward to be an amazingly flexible and useful tool for the construction of cryptosystems with unique features. Yet, they are notoriously hard to implement efficiently, so that their effective deployment requires a careful choice of parameters and algorithms. In this paper we review the evolution of pairing-based cryptosystems, the development of efficient algorithms and the state of the art in pairing computation, and the challenges yet to be addressed on the subject, while also presenting some new algorithmic and implementation refinements in affine and projective coordinates.

We study a classical problem of privacy amplification, where two parties Alice and Bob share a weak secret X of min-entropy k, and wish to agree on secret key $R$ of length $m$ over a public communication channel completely controlled by a computationally unbounded attacker Eve.

Despite being extensively studied in the literature, the design of (efficient) \"optimal\" privacy amplification protocols is still open. Part of the reason is that there are quite a few important efficiency/security goals when designing privacy amplification protocols. The most basic such goal is to minimize the {\\em entropy loss} L=k-m, and it is known that the optimal value for L=O(\\lambda), where \\eps=2^{-\\lambda} is the desired security of the protocol. Other important considerations include (1) minimizing the number of communication rounds, (2) achieving strongest security notion called {\\em post-application robustness}, and (3) ensuring that the protocol $P$ does not leak some ``useful information\'\' about the source $X$ (this is called {\\em source privacy}). Additionally,

when trying to extract a key R which is much shorter than the source length |X| (and, often, the min-entropy bound k), \"Goal (0)\" of minimizing the entropy loss is replaced by asking (4) if P can be made {\\em locally computable} (meaning it reads only O(|R|) bits of X; this is called the {\\em Bounded Retrieval Model} (BRM)), and/or (5) if P can be sequentially run to extract the optimal number t = \\Theta(k/\\lambda) of session keys R_1,...,R_t of length m=O(\\lambda) each.

As a result, {\\em all} existing protocols in the literature fail to achieve at least two of Goals (0)-(3) (or, when |R|

We study the problem of verifiable delegation of computation over

outsourced data, whereby a powerful worker maintains a large data

structure for a weak client in a verifiable way. Compared to the

well-studied problem of verifiable computation, this setting imposes

additional difficulties since the verifier needs to verify consistency

of updates succinctly and without maintaining large state. In particular,existing general solutions are far from practical in this setting.

We present a scheme for verifiable evaluation of hierarchical set

operations (unions, intersections and set-differences) applied to a

collection of dynamically changing sets of elements from a given

domain. That is, we consider two types of queries issued by the

client: updates (insertions and deletions) and data queries, which

consist of ``circuits\'\' of unions, intersections, and set-differences

on the current collection of sets.

This type of queries comes up in database queries, keyword search and

numerous other applications, and indeed our scheme can be effectively

used in such scenarios. The verification cost incurred is proportional

only to the size of the final outcome set and to the size of the query, and is independent of the cardinalities of the involved sets. The cost of updates is optimal ($O(1)$ modular operations per update).

Our construction extends that of [Papamanthou et al., Crypto 2011]

and relies on a modified version of the \\emph{extractable collision-resistant hash function} (ECRH) construction, introduced in [Bitansky et al., ITCS 2012] that can be used to succinctly hash univariate polynomials.

Although NFC mobile services have great potential for growth, they have raised a number of issues which are of concern to researchers and are preventing the wide adoption of this technology within society. Dynamic relationships of NFC ecosystem players in an NFC transaction process make them partners in a way that sometimes requires that they share access permission to applications that are running in the service environment. One of the technologies that can be used to ensure secure NFC transactions is cloud computing. This offers a wider range of advantages than the use of a Secure Element (SE) as a single entity in an NFC enabled mobile phone. In this paper, we propose a protocol for NFC mobile payments based on cloud Wallet model. In our protocol, the SE in the mobile device is used for customer authentication whereas the customer\'s banking credentials are stored in a cloud under the control of the Mobile Network Operator (MNO). The proposed protocol eliminates the requirement for a shared secret between the Point of Sale (PoS) and the MNO before execution of the protocol, a mandatory requirement in the earlier version of this protocol. This makes it more practicable and user friendly. A detailed analysis of the protocol discusses multiple attack scenarios.

We study homomorphic authenticated encryption, where privacy

and authenticity of data are protected simultaneously. We define homomorphic versions

of various security notions for privacy and authenticity, and investigate

relations between them. In particular, we show that it is possible to

give a natural definition of IND-CCA for homomorphic authenticated encryption, unlike

the case of homomorphic encryption. Also, we construct a homomorphic

authenticated encryption scheme supporting arithmetic circuits on $\\ZZ_Q$

for smooth modulus $Q$, which is chosen-ciphertext secure both for privacy

and authenticity. Our scheme is based on the error-free approximate GCD assumption.

We will be awarding 10 fully-funded studentships (generous stipend and college fees for four years) to outstanding candidates to join the Royal Holloway Centre for Doctoral Training in Cyber Security in October 2014.

We will consider applications from candidates with undergraduate and masters\\\' qualifications in a wide range of disciplines, including, but not limited to, mathematics, computer science, and electrical and electronic engineering.

Please see the Entry Requirements at http://www.rhul.ac.uk/isg/cybersecuritycdt/entryrequirements.aspx and instructions on How to Apply at http://www.rhul.ac.uk/isg/cybersecuritycdt/howtoapply.aspx. Funding is provided by the EPSRC, and thus is subject to their eligibility conditions. For further details, please visit the CDT Funding page at http://www.rhul.ac.uk/isg/cybersecuritycdt/funding.aspx.

Closing date for receiving applications is the 30th March 2014. We will however assess applications on an ongoing basis, and we reserve the right to make an offer to outstanding candidates before the closing date.

The Interdisciplinary Centre for Security, Reliability and Trust (SnT, www.securityandtrust.lu) at University of Luxembourg is looking for a PhD candidate in privacy-preserving recommender systems. The PhD topic is related to investigate the privacy issues in recommender systems and propose efficient and secure mechanisms to achieve the maximum privacy. The candidate is expected to design new privacy-preserving recommender systems for both horizontally and vertically partitioned dataset, prove their privacy properties, and study their asymptotical performances.

The student will work closely with the team members of the APSIA group, led by Prof. Peter Y. A. Ryan. Moreover, the student will be encouraged to collaborate with researchers from the group of Prof. Jiuyong Li at University of South Australia (UniSA), Australia.

For informal inquiries please contact: Dr. Qiang Tang qiang.tang (at) uni.lu

To formally apply for this position: http://emea3.mrted.ly/9lwj

Worcester Polytechnic Institute (WPI) invites applications for a faculty position in the Department of Electrical & Computer Engineering at all ranks, commensurate with qualifications.

Required qualifications for the position include; an earned Ph.D. in Electrical & Computer Engineering, or a closely related field. Areas of particular interest include, but are not limited to: security engineering, hardware and embedded systems security, and mobile and cyber-physical systems security.

The successful candidate will be expected to establish and maintain a high quality, self-sustaining research program. WPI offers ample opportunity for collaboration with current department faculty as well as appropriate cross-campus, interdisciplinary research groups in various topics in security. In addition to excellence in teaching and research, candidates should look forward to engaging undergraduate and graduate students in a classroom and projects intensive environment, and expanding our graduate research program.

Qualified applicants should submit a detailed curriculum vitae, a brief statement of specific teaching and research objectives, and four letters of recommendation at least one of which addresses teaching experience or potential, via https://careers.wpi.edu/. Review of applications will begin on November 1, 2013 and will continue until the position is filled.

From November 20 to November 21
Location: Bonn, Germany
More Information: http://cosec.bit.uni-bonn.de/students/events/mpimbit/

Submission: 6 December 2013
Notification: 27 January 2014
From June 4 to June 6
Location: Kyoto, Japan
More Information: http://www2.nict.go.jp/nsri/fund/asiaccs2014/index.html

Submission: 1 March 2014
Notification: 15 April 2014
From July 21 to July 23
Location: Oxford, United Kingdom
More Information: http://www.sigsac.org/wisec/WiSec2014/

In the setting of searchable symmetric encryption (SSE), a data owner D outsources a database (or document/file collection) to a remote server E in encrypted form such that D can later search the collection at E while hiding information about the database and queries from E. Leakage to E is to be confined to well-defined forms of data-access and query patterns while preventing disclosure of explicit data and query plaintext values. Recently, Cash et al presented a protocol, OXT, which can run arbitrary Boolean queries in the SSE setting and which is remarkably efficient even for very large databases.

In this paper we investigate a richer setting in which the data owner

D outsources its data to a server E but D is now interested to allow clients (third parties) to search the database such that clients learn the information D authorizes them to learn but nothing else while E still does not learn about the data or queried values as in the basic SSE setting. Furthermore, motivated by a wide range of applications, we extend this model and requirements to a setting where, similarly to private information retrieval, the client\'s queried values need to be hidden also from the data owner D even though the latter still needs to authorize the query. Finally, we consider the scenario in which authorization can be enforced by the data owner D without D learning the policy, a setting that arises in court-issued search warrants.

We extend the OXT protocol of Cash et al to support arbitrary Boolean queries in all of the above models while withstanding adversarial

non-colluding servers (D and E) and arbitrarily malicious clients,

and while preserving the remarkable performance of the protocol.

This paper introduces a new obfuscation called obfuscation of encrypted blind signature. Informally, encrypted blind signature enable the message is blind to signer, and she couldn\'t distinguish two encrypted signatures by herself. A obfuscation of encrypted blind signature makes the process of encrypted blind signature unintelligible for any third party, while still keeps the original encrypted blind signature functionality. We use schnorr\'s blind signature scheme and linear encryption scheme as blocks to construct a new obfuscator. Moreover, we propose two new security definition: blindness w.r.t encrypted blind signature (EBS) obfuscator and one-more unforgeability(OMU) w.r.t EBS obfuscator, and prove them based on Decision Liner Diffie-Hellman(DL) assumption and the hardness of discrete logarithm, respectively. We also demonstrate that our obfuscator satisfies the Average-Case Virtual Black-Box Property(ACVBP) property w.r.t dependent oracle, it is indistinguishable secure. Our paper expand a new direction for the application of obfuscation.

Side-Channel Attacks (SCA) are considered a serious threat against embedded cryptography. Therefore security critical chips must be tested for SCA resistance before deployment or certification. SCA are powerful but can need a lot of computation power, especially in the presence of countermeasures. The computation complexity of these attacks can be reduced by selecting a small subset of points where leakage prevails. In this paper, we propose a method to detect relevant leakage points in side-channel traces. The method is based on Normalized Inter-Class Variance (NICV). A key advantage of NICV over state-of-the-art is that NICV does neither need a clone device nor the knowledge of secret parameters of the crypto-system. NICV has a low computation requirement and it detects leakage using public information like input plaintexts or output ciphertexts only. It can also be used to test the efficiency of leakage models, the quality of traces and robustness of countermeasures. A theoretical rationale of NICV with practical application on real crypto-systems are provided to support our claims.

Public key exchange protocol is identified as an important application in the field of public-key cryptography. Most of the existing public key exchange schemes are Diffie-Hellman (DH)-type, whose security is based on DH problems over different groups. Note that there exists Shor\'s polynomial-time algorithm to solve these DH problems when a quantum computer is available, we are therefore motivated to seek for a non-DH-type and quantum resistant key exchange protocol. To this end, we turn our attention to lattice-based cryptography. The higher methodology behind our roadmap is that in analogy to the link between ElGamal, DSA, and DH, one should expect a NTRU lattice-based key exchange primitive in related to NTRU-ENCRYPT and NTRU-SIGN. However, this excepted key exchange protocol is not presented yet and still missing. In this paper, this missing key exchange protocol is found, hereafter referred to as NTRU-KE, which is studied in aspects of security and key-mismatch failure. In comparison with ECDH (Elliptic Curve-based Diffie-Hellman), NTRU-KE features faster computation speed, resistance to quantum attack, and more communication overhead. Accordingly, we come to the conclusion that NTRU-KE is currently comparable with ECDH. However, decisive advantage of NTRU-KE will occur when quantum computers become a reality.

The security of public-key encryption (PKE), a widely-used cryptographic primitive, has received much attention in the cryptographic literature. Many security notions for PKE have been proposed, including several versions of CPA-security, CCA-security, and non-malleability. These security notions are usually defined in terms of a certain game that an efficient adversary cannot win with non-negligible probability or advantage.

If a PKE scheme is used in a larger protocol, then the security of this protocol is proved by showing a reduction of breaking a certain security property of the PKE scheme to breaking the security of the protocol. A major problem is that each protocol requires in principle its own tailor-made security reduction. Moreover, which security notion of the PKE should be used in a given context is a priori not evident; the employed games model the use of the scheme abstractly through oracle access to its algorithms, and the sufficiency for specific applications is neither explicitly stated nor proven.

In this paper we propose a new approach to investigating the application of PKE, following the constructive cryptography paradigm of Maurer and Renner (ICS~2011). The basic use of PKE is to enable confidential communication from a sender A to a receiver B, assuming A is in possession of B\'s public key. One can distinguish two relevant cases: The (non-confidential) communication channel from A to B can be authenticated (e.g., because messages are signed) or non-authenticated. The application of PKE is shown to provide the construction of a secure channel from A to B from two (assumed) authenticated channels, one in each direction, or, alternatively, if the channel from A to B is completely insecure, the construction of a confidential channel without authenticity. Composition then means that the assumed channels can either be physically realized or can themselves be constructed cryptographically, and also that the resulting channels can directly be used in any applications that require such a channel. The composition theorem shows that several construction steps can be composed, which guarantees the soundness of this approach and eliminates the need for separate reduction proofs.

We also revisit several popular game-based security notions (and variants thereof) and give them a constructive semantics by demonstrating which type of construction is achieved by a PKE scheme satisfying which notion. In particular, the necessary and sufficient security notions for the above two constructions to work are CPA-security and a variant of CCA-security, respectively.

Extractability, or \"knowledge,\" assumptions (such as the \"knowledge-of-exponent\" assumption) have recently gained popularity in the cryptographic community--leading to the study of primitives such as extractable one-way functions, extractable hash functions, succinct non- interactive arguments of knowledge (SNARKs), and extractable obfuscation, and spurring the development of a wide spectrum of new applications relying on these primitives. For most of these applications, it is required that the extractability assumption holds even in the presence of attackers receiving some auxiliary information that is sampled from some fixed efficiently computable distribution Z.

We show that, assuming the existence of collision-resistant hash functions, there exists a pair of efficient distributions Z, Z\'; such that either:

o extractable one-way functions w.r.t. Z do not exist, or

o extractability obfuscations for Turing machines w.r.t. Z do not exist.

A corollary of this result shows that assuming existence of fully homomorphic encryption with decryption in NC1, there exist efficient distributions Z, Z\' such that either

o extractability obfuscations for NC1 w.r.t. Z do not exist, or

o SNARKs for NP w.r.t. Z\' do not exist.

To achieve our results, we develop a \"succinct punctured program\" technique, mirroring the powerful \"punctured program\" technique of Sahai and Waters (ePrint\'13), and present several other applications of this new technique.

This paper defines adaptive soundness (AS) security for witness encryption and applies it to provide the first non-invasive schemes for asymmetric password-based encryption (A-PBE). A-PBE offers significant gains over classical, symmetric password-based encryption (S-PBE) in the face of attacks that compromise servers to recover hashed passwords. We also show by counter-example that the original soundness security (SS) requirement of GGSW does not suffice for the security of their own applications, and show that AS fills the gap.