International Association
for Cryptologic Research

Sablier is an authenticated encryption cipher submitted to the CAESAR competition, which is composed of the encryption Sablier v1 and the authentication \\textup{Au}. In this work we present a state recovery attack against the encryption Sablier v1 with time complexity about $2^{44}$ operations and data complexity about 24 of 16-bit keywords. Our attack is practical in the workstation. It is noticed that the update of the internal state of Sablier v1 is invertible, thus our attack can further deduce a key recovery attack and a forgery attack against the authenticated encryption Sablier. The result shows that Sablier v1 is far from the goal of its security design (80-bit level).

Identity-based signature (IBS) is a specific type of public-key signature (PKS) where any identity string $ID$ can be used for the public key of a user. Although an IBS scheme can be constructed from any PKS scheme by using the certificate paradigm, it is still important to construct an efficient IBS scheme with short signature under the standard assumption without relying on random oracles. Recently, Kwon proposed an IBS scheme and claimed its strong unforgeability under the computational Diffie-Hellman (CDH) assumption. In this paper, we show that the security proof of Kwon is seriously flawed. To show the flaws, we first show that there exists a distinguisher that can distinguish the distribution of simulated signature from that of real signatures. Next, we also show that the simulator of Kwon\'s security argument cannot extract the solution of the CDH assumption even if there exists an adversary that forges the signature. Therefore, the security of the Kwon\'s IBS scheme is not related to the hardness of the CDH assumption.

UKS (unknown key-share) attacks are now common attacks to Authenticated Key Exchange (AKE) protocols. We summarize two popular countermeasures against UKS attacks on the implicitly authenticated key exchange protocols. The first one forces the CA to check the possession of private keys during registration, which is impractical for the CA. The second one adds identities in the derivation of the session key, which leads to modify the protocols already used in practice. By using the key protection capability of hardware security chips, such as TPM or TCM, we propose a new way to prevent UKS attacks that needs no check of possession of private keys and no addition of identities during the derivation of the session key. We modify the CK model to adapt the protocols using hardware security chips. We then implement a protocol once used in NSA, called KEA and subject to UKS attacks, using TCM chips. Our implementation, called tKEA, is secure under our security model. To show the generality of our way, we also show that our new way can prevent UKS attacks on the MQV protocol.

We propose the concept of Zero-Knowledge Password Policy Checks (ZKPPC) to enable remote registration of client passwords without their actual transmission to the server. The ZKPPC protocol executed as part of the client registration process allows the client to prove compliance of the chosen password with the password policy defined by the server. The main benefit of ZKPPC-based password registration is that it guarantees that passwords can never be processed nor stored in clear on the server side. At the end of the registration phase the server only receives and stores some verification information that can later be used for authentication in suitable Verifier-based Password Authenticated Key Exchange (VPAKE) protocols.

To this end, we first formalize the requirements of ZKPPC protocols and propose a general framework for their construction in the standard model using randomised password hashing and set membership proofs. We design a suitable encoding scheme for password characters and show how to express password policies to allow the adoption of set membership proofs. Finally, we present a concrete ZKPPC-based registration protocol that is based on efficient Pedersen commitments and corresponding proofs, and analyse its performance.

To complete the ZKPPC-based registration and authentication framework we propose a concrete VPAKE protocol, where the server can use the obtained verification information from the ZKPPC-based registration phase to subsequently setup secure communication sessions with the client. Our VPAKE protocol follows the recent framework for the construction of such protocols and is secure in the standard model.

Fuzzy extractors convert a noisy source of entropy into a consistent uniformly-distributed key. In the process of eliminating noise, they lose some of the entropy of the original source---in the worst case, as much as the logarithm of the number of correctable error patterns. We call what is left after this worst-case loss the minimum usable entropy. Unfortunately, this quantity is negative for some sources that are important in practice. Most known approaches for building fuzzy extractors work in the worst case and cannot be used when the minimum usable entropy is negative.

We construct the first fuzzy extractors that work for a large class of distributions that have negative minimum usable entropy. Their security is computational. They correct Hamming errors over a large alphabet. In order to avoid the worst-case loss, they necessarily restrict distributions for which they work.

Our first construction requires high individual entropy of a constant fraction of symbols, but permits symbols to be dependent. Our second construction requires a constant fraction of symbols to have a constant amount of entropy conditioned on prior symbols. The constructions can be implemented efficiently based on number-theoretic assumptions or assumptions on cryptographic hash functions.

The sweeping success of the original (2008) bitcoin protocol proves that digital currency has arrived. The mounting opposition from the financial establishment indicates an overshoot. We propose to tame bitcoin into bitcoin.BitMint: keeping the bitcoin excitement -- fitted into real world security, stability and fraud concerns.

The basic idea is to excise the bitcoin money generation formula, and otherwise apply bitcoin essentially \"as is\" over digital coins which are redeemable by the mint that minted them. This will preserve the bitcoin assured anonymity. The new bitcoin.BitMint solution will benefit from bitcoin\'s double-spending prevention, and would otherwise enjoy all the benefits associated with money in a digital form.

bitcoin.BitMint will allow traders to invest in US$, gold, or any other commodity while practicing their trade in cyberspace, anonymously, securely, and non-speculatively.

This \"mint-in-the-middle\" protocol will allow law enforcement authorities to execute a proper court order to enforce the disclosure of a suspected fraudster, but the community of honest traders will trade with robust privacy as offered by the original bitcoin protocol.

We envision interlinked bitcoin.BitMint trading environments, integrated via an InterMint protocol: a framework for the evolution of a cascaded super currency - global and highly stable.

Submission: 1 June 2014
Notification: 11 July 2014
From September 1 to September 2
Location: Istanbul, Turkey
More Information: http://www.light-sec.org/

In recent years, studies about the SATisfiability Problem (short for SAT) were more and more numerous because of its conceptual simplicity and ability to express a large set of various problems. Within a practical framework, works highlighting SAT impli- cations in real world problems had grown significantly. In this way, a new field called logical cryptanalysis appears in the 2000s and consists in an algebraic cryptanalysis in a binary context thanks to SAT solving. This paper deals with this concept applied to cryptographic hash functions. We first present the logical cryptanalysis principle, and provide details about our encoding approach. In a second part, we put the stress on the contribution of SAT to analyze the generated problem thanks to the discover of logical inferences and so simplifications in order to reduce the computational complexity of the SAT solving. This is mainly realized thanks to the use as a preprocessor of learning and pruning techniques from the community. Third, thanks to a probabilistic reasoning applied on the formulas, we present a weakness based on the use of round constants to detect probabilistic relations as implications or equivalences between certain vari- ables. Finally, we present a practical framework to exploit these weaknesses through the inversions of reduced-step versions of MD4, MD5, SHA-0 and SHA-1 and open some prospects.

We describe an automatic analysis to check secure multiparty computation protocols against privacy leaks. The analysis is sound --- a protocol that is deemed private does not leak anything about its private inputs, even if active attacks are performed against it. Privacy against active adversaries is an essential ingredient in constructions aiming to provide security (privacy + correctness) in adversarial models of intermediate (between passive and active) strength. Using our analysis we are able to show that the protocols used by the Sharemind secure multiparty computation platform are actively private.

The proceedings of PKC 2014 are now available online to IACR members.

Submission: 21 April 2014
Notification: 9 June 2014
From September 3 to September 5
Location: Amalfi, Italy
More Information: http://scn.dia.unisa.it/

Submission: 18 July 2014
From December 14 to December 17
Location: Delhi, India
More Information: http://cse.iitkgp.ac.in/conf/INDOCRYPT2014/

A number of attractive PhD grants is available at Center for the Theory of Interactive Computation (CTIC), which is a Sino-Danish research center. The center is a collaboration between the Computer Science Department at Aarhus University, Denmark and IIIS, Tsinghua University, Beijing, China, and is led by Professor Andrew Chi-Chih Yao, Tsinghua University, and Professor Peter Bro Miltersen, Aarhus University. The positions are within the focus areas of the center which are computational complexity theory, cryptography, quantum informatics, and algorithmic game theory. See also http://ctic.au.dk/.

The successful candidates will obtain their degrees from Aarhus University and are expected to do most of their studies there, but also do stays at IIIS.

To be admitted as a PhD student at Aarhus University Graduate School of Science and Technology PhD program requires between 3 and 5 years of study, depending on the background of the candidate. The minimum requirement for applying is a Bachelor\\\'s degree. Applications should be entered at the Aarhus Graduate School of Science and Technology (GSST) web interface, where PhD applicants will also find detailed and relevant information about the application process, deadlines, financing etc.: http://talent.au.dk/phd/scienceandtechnology/.

To obtain further information before applying, please email ctic (at) cs.au.dk. The next application deadline is May 1st, 2014.

The Centre for Computer and Information Security Research (CCISR) at the University of Wollongong, Australia, is looking for a high caliber PhD student to work in the topic of \\\"Post-quantum Cryptography\\\".

The topic includes the following sub-topics:

- lattice-based cryptography,

- multivariate cryptography,

- code-based cryptography,

- quantum computing.

Candidates are required to have a good background in mathematics.

All the decisions made will be final and there is no appeal procedure.

Ideally, it is expected that the candidate will start the PhD candidature by August 2014.

Interested candidates should send their complete CV, which includes their research experience and publication to Dr. Thomas Plantard (thomaspl (at) uow.edu.au).

Any questions regarding this position should be directed to

Prof. Willy Susilo (wsusilo (at) uow.edu.au) or Dr. Thomas Plantard (thomaspl (at) uow.edu.au).

While AES is extensively in use in a number of applications, its area cost limits its deployment in resource constrained platforms. In this paper, we have implemented SIMON, a recent promising low-cost alternative of AES on reconfigurable platforms. The Feistel network, the construction of the round function and the key generation of SIMON, enables bit-serial hardware architectures which can significantly reduce the cost. Moreover, encryption and decryption can be done using the same hardware. The results show that with an equivalent security level, SIMON is 86\\% smaller than AES, 70\\% smaller than PRESENT (a standardized low-cost AES alternative), and its smallest hardware architecture only costs 36 slices (72 LUTs, 30 registers). To our best knowledge, this work sets the new area records as we propose the hardware architecture of the smallest block cipher ever published on FPGAs at 128-bit level of security. Therefore, SIMON is a strong alternative to AES for low-cost FPGA based applications.

Motivated by growing importance of parallelism in modern computational systems, we introduce a very natural generalization to a parallel setting of the powerful (sequential) black pebbling game over DAGs. For this new variant, when considering pebbling graphs with with multiple disconnected components (say when modelling the computation of multiple functions in parallel), we demonstrate a significant shortcoming of the two most common types of complexity measures for DAGs inherited from the sequential setting (namely S-complexity and ST-complexity). Thus, to ensure the applicability of the new pebbling game as a tool for proving results about say the \\emph{amortized} hardness of functions being repeatedly evaluated, we introduce a new complexity measure for DAGs called \\emph{cumulative complexity} (CC) and show how it overcomes this problem.\\\\

With the aim of facilitating the new complexity lower-bounds in parallel settings we turn to the task of finding high CC graphs for the parallel pebbling game. First we look at several types of graphs such as certain stacks of superconcentrators, permutation graphs, bit-reversal graphs and pyramid graphs, which are known to have high (even optimally so) complexity in the sequential setting. We show that all of them have much lower parallel CC then one could hope for from a graph of equal size. This motivates our first main technical result, namely the construction of a new family of constant in-degree graphs whose parallel CC approaches maximality to within a polylogarithmic factor.\\\\

The second contribution of this work is to demonstrate an application of these new theoretical tools, in particular to the field of cryptography. Memory-hard function (MHF), introduced by Percival~\\cite{Per09}, have the intuitive goal of leverage the relatively high cost of memory in integrated circuits compared to general purpose computers in order to decrease the attractiveness of using custom circuits to mount brute-force attacks. We provide a new formalization for key property of such functions (overcoming problems with the approach of~\\cite{Per09}) using a new type of \\emph{amortized} computational hardness for families of functions in the (parallel) random oracle model. We motivate the hardness definition by showing how it provides an immediate lower-bound on the monetary cost of repeatedly evaluating such functions in several real-world (parallel) computational environments (e.g. FPGAs, ASICs, Cloud Computers). Indeed, in practice such devices are often the most cost effective means for mounting large-scale brute-force attacks on security relevant functions (such as say Proofs-of-Work and the hash functions used to obscure stored passwords in login servers). As the main technical result of this section, for the family of functions $f_G$ (over strings) characterized via a given DAG $G$, we prove a lower-bound on the hardness of $f_G$ in terms of the parallel CC of $G$. In consequence, we obtain the first provably secure (and intuitively sound) MHF.

The Inaugural Sir Vaughan F.R. Jones PhD Scholarship

This prestigious scholarship will fund the research in any area of mathematics of a PhD student supervised by a member of the Department of Mathematics. Selection is based purely on the record and research promise of the candidate. The Jones Scholarship offers an annual stipend of NZ$25,000 (tax free), plus fees, for three years of PhD study.

New Zealand mathematician Vaughan Jones, KNZM FRS FRSNZ FAAAS, was awarded the Fields Medal in 1990. He is Distinguished Professor at both the University of Auckland and Vanderbilt University. He is best known for his work on knot (Jones) polynomials and von Neumann algebras.

Interested candidates are encouraged to contact members of the Department informally concerning possible research projects. For public key cryptography or number theory, please contact Steven Galbraith.

Full applications must be received by August 30, 2014.

Submission: 1 June 2014
Notification: 1 July 2014
From October 29 to October 29
Location: San Francisco, USA
More Information: http://www.m2m-sec.org/

The Reliable Communication Group at the University of Bergen invites applications for a 3-year researcher position in Boolean functions. The position is supposed to start in October 2014.

The candidate is expected to have PhD degree in mathematics or computer science or related disciplines, and have considerable publications in discrete functions.

We are seeking an active researcher with expertise in Boolean functions, discrete mathematics and symmetric cryptography to work within the recently funded project “Discrete functions and their applications in cryptography and mathematics”. The prime objectives of this project are Boolean functions with optimal resistance to various cryptographic attacks (differential, linear, algebraic et al.) and their applications in discrete mathematics (such as commutative semifields, o-polynomials, difference sets, dual hyperovals, regular graphs, m-sequences, codes et al.).

Achterbahn stream cipher is proposed as a candidate for ECRYPT eSTREAM project which deals with key of length 80-bit. The linear distinguishing attack,which aims at distinguishing the keystream from purely random keystream,is employed to Achterbahn stream cipher. A linear distinguishing attack is based on linear sequential circuit approximation technique which distinguishes statistical bias in the keystream. In order to build the distinguisher, linear approximations of both non-linear feedback shift register (NLFSR) and the non-linear Boolean combining function R:F_2^8→F_2 are used. The keystream sequence generated by this algorithm consist a distinguisher with its probability bias〖 2〗^(-1809). Thus, to distinguish the Achterbahn, we only need 1/ε^2 =〖〖(2〗^1809)〗^2=2^3618 keystream bits and the time complexity is about 10/ε^2 =2^3621.3 which is much higher than the exhaustive key search O(2^80).