International Association
for Cryptologic Research

Recently, program obfuscation has proven to be an extremely powerful tool and has been used to construct a variety of cryptographic primitives with amazing properties. However, current candidate obfuscators are far from practical and rely on unnatural hardness assumptions about multilinear maps. In this work, we bring several applications of obfuscation closer to practice by showing that a weaker primitive called witness pseudorandom functions (witness PRFs) suces. Applications include multiparty key exchange without trusted setup, polynomially-many hardcore bits for any one-way function, and more. We then show how to instantiate witness PRFs from multilinear maps. Our witness PRFs are simpler and more ecient than current obfuscation candidates, and involve very natural hardness assumptions about the underlying maps.

Quantum zero-knowledge proofs and quantum proofs of knowledge are

inherently difficult to analyze because their security analysis uses

rewinding. Certain cases of quantum rewinding are handled by the

results by Watrous (SIAM J Comput, 2009) and Unruh (Eurocrypt 2012),

yet in general the problem remains elusive. We show that this is not

only due to a lack of proof techniques: relative to an oracle, we show

that classically secure proofs and proofs of knowledge are insecure in

the quantum setting.

More specifically, sigma-protocols, the Fiat-Shamir construction, and

Fischlin\'s proof system are quantum insecure under assumptions that

are sufficient for classical security. Additionally, we show that for

similar reasons, computationally binding commitments provide almost no

security guarantees in a quantum setting.

To show these results, we develop the \"pick-one trick\", a general

technique that allows an adversary to find one value satisfying a

given predicate, but not two.

Correct authenticated decryption requires the receiver to buffer the decrypted message until the authenticity check has been performed. In high-speed networks, which must handle large message frames at low latency, this behavior becomes practically infeasible. This paper proposes CCA-secure on-line ciphers as a practical alternative to AE schemes since the former provide some defense against malicious message modifications. Unfortunately, all published on-line ciphers so far are either inherently sequential, or lack a CCA-security proof.

This paper introduces POE, a family of on-line ciphers that combines provable security against chosen-ciphertext attacks with pipelineability to support efficient implementations. POE combines a block cipher and an e-AXU family of hash functions. Different instantiations of POE are given, based on different universal hash functions and suitable for different platforms. Moreover, this paper introduces POET, a provably secure on-line AE scheme, which inherits pipelineability and chosen-ciphertext-security from POE and provides additional resistance against nonce-misuse attacks.

The Ihara limit (or constant) $A(q)$ has been a central problem of study in the asymptotic theory of global function fields (or equivalently, algebraic curves over finite fields). It addresses global function fields with many rational points and,

so far, most applications of this theory do not

require additional properties. Motivated by recent applications, we require global function fields

with the additional property that their zero class divisor groups contain at most a small number of $d$-torsion points. We capture this with the notion of torsion limit, a new asymptotic quantity for global function fields.

It seems that it is even harder to determine values of this new quantity than the Ihara constant.

Nevertheless, some non-trivial upper bounds are derived.

Apart from this new asymptotic quantity and bounds on it, we also introduce Riemann-Roch systems of equations. It turns out that this type of equation system

plays an important role in the study of several other problems in each of these areas: arithmetic secret sharing, symmetric bilinear complexity of multiplication in finite fields, frameproof codes and the theory of error correcting codes.

Finally, we show how our new asymptotic quantity, our bounds on it and Riemann-Roch systems can be used to improve results in these areas.

A fair contract-signing protocol is an important mechanism which allows two participants to sign a digital contract via the public computer networks in a fair way. Based on the RSA signature scheme and Σ-protocol, we propose a new contract-signing protocol in this paper. The proposed protocol is not only fair and optimistic, but also efficient and abuse-free. Moreover, security and efficiency analysis are provided.

M3lcrypt (canonical M3lcryptH) is a password based key derivation

function built around the Merkle-Damgard hash function H. It supports

large [pseudo]random salt values ( 128-bit) and password lengths.

We present new constructions of two-message and one-message witness-indistinguishable proofs (ZAPs and NIWIs). This includes:

\\begin{itemize}

\\item

ZAP (or, equivalently, non-interactive zero-knowledge in the common random string model) from indistinguishability obfuscation and one-way functions.

\\item

NIWIs from indistinguishability obfuscation and one-way permutations.

\\end{itemize}

The previous construction of ZAPs [Dwork and Naor, FOCS 00] was based on trapdoor permutations. The two previous NIWI constructions were based either on ZAPs and a derandomization-type complexity assumption [Barak, Ong, and Vadhan CRYPTO 03], or on a specific number theoretic assumption in bilinear groups [Groth, Sahai, and Ostrovsky, CRYPTO 06].

The Discrete Logarithm Problem is at the base of the famous Diffie Hellman key agreement algorithm and many others. The key idea behind Diffie Helmann is the usage of the Discrete Logarithm function in (Z/pZ)∗ as a trap door function. The Discrete Logarithm function output in (Z/pZ)∗ seems to escape to any attempt of finding some sort of pattern. Nevertheless some new characterization will be introduced together with a novel and more efficient trial multi- plication algorithm.

Camellia is one of the widely used block ciphers, which has been selected as an international standard by ISO/IEC. In this paper, we focus on the key-recovery attacks on reduced-round Camellia-192/256 with meet-in-the-middle methods. We utilize multiset and the differential enumeration methods which are popular to analyse AES in the recent to attack Camellia-192/256. We propose a 7-round property for Camellia-192, and achieve a 12-round attack with $2^{180}$ encryptions, $2^{113}$ chosen plaintexts and $2^{130}$ 128-bit memories. Furthermore, we present an 8-round property for Camellia-256, and apply it to break the 13-round Camellia-256 with $2^{232.7}$ encryptions, $2^{113}$ chosen ciphertexts and $2^{227}$ 128-bit memories.

We show that a recently proposed password authentication scheme based on geometric hashing has several security weaknesses, and that the use of this scheme should be avoided in practice.

A sensor network is a network comprised of many small, wireless, resource-limited nodes that sense data about their environment and report readings to a base station. One technique to conserve power in a sensor network is to aggregate sensor readings hop-by-hop as they travel towards a base station, thereby reducing the total number of messages required to collect each sensor reading. In an adversarial setting, the ability of a malicious node to alter this aggregate total must be limited. We present three aggregation protocols inspired by three natural key pre-distribution schemes for linear networks. Assuming no more than k consecutive nodes are malicious, each of these protocols limits the capability of a malicious node to altering the aggregate total by at most a single valid sensor reading. Additionally, our protocols are able to detect malicious behavior as it occurs, allowing the protocol to be aborted early, thereby conserving energy in the remaining nodes. A rigorous proof of security is also given for each protocol.

Recent developments in Multi-party Computation (MPC) has resulted in very efficient protocols for dishonest majority in the preprocessing model. In particular, two very promising protocols for Boolean circuits have been proposed by Nielsen et al. (nicknamed TinyOT) and by Damg ̊ard and Zakarias (nicknamed MiniMac). While TinyOT has already been implemented, we present in this paper the first implementation of MiniMac, using the same platform as the existing TinyOT implementation. We also suggest several improvements of MiniMac, both on the protocol design and implementation level. In particular, we suggest a modification of MiniMac that achieves increased parallelism at no extra communication cost. This gives an asymptotic improvement of the original protocol as well as an 8-fold speed-up of our implementation. We compare the resulting protocol to TinyOT for the case of secure computation in parallel of a large number of AES encryptions and find that it performs better than results reported so far on TinyOT, on the same hardware.

We study the Reliable Broadcast problem in incomplete networks, under the locally bounded adversarial model (Koo, 2004), that is, there is a known bound on the number of players that a Byzantine adversary controls in each player\'s neighborhood. We generalize the model

to the more realistic non-uniform case, by allowing this bound to vary from node to node.

We first settle an open question of Pelc and Peleg (2005) in the affirmative, by showing that Koo\'s Certified Propagation Algorithm (CPA) for ad hoc networks is indeed unique, that is, it can tolerate as many local corruptions as any other non-faulty algorithm, thus having optimal resilience. Actually, we prove the stronger result that a natural extension of CPA is unique for the non-uniform model. We do this by providing a necessary and sufficient condition for reliable broadcast in ad hoc networks. On the other hand, we show that it is NP-hard to check whether this condition holds for a given graph G.

We also study known topology networks and prove that a topological condition, shown by Pelc and Peleg to be necessary for the existence of a Broadcast algorithm, is also sufficient. This leads to an optimal resilience algorithm for known networks as well. On the downside, we prove that PPA is inefficient. However, we are able to provide evidence showing that probably no efficient protocol of optimal resilience exists.

We take one more step, by considering a hybrid between ad hoc and known topology networks: each node knows a part of the network, namely a connected subgraph containing itself. We show that this partial knowledge model allows for more accurate reliable broadcast

algorithms.

Finally, we show that our results extend to the general adversary model. This, among others, means that an appropriate adaptation of CPA is unique against general adversaries in ad hoc networks.

Submission: 30 November 2014
From December 19 to December 23
Location: Chennai, India
More Information: http://http://ask2014.iiitd.ac.in/

Traceable attribute-based signatures extend standard attribute-based signatures by granting a designated tracing authority the power to revoke the anonymity of signatures by revealing who signed them. Such a feature is important in deterring abuse and enforcing accountability.

In this work, we revisit the notion of Decentralized Traceable Attribute-Based Signatures (DTABS) introduced by El Kaafarani et al. (CT-RSA 2014) and improve the state-of-the-art in two directions: Firstly, we provide a new stronger security model which circumvents some shortcomings in existing models. Our model minimizes the trust placed in attribute authorities and hence provides, among other things, a stronger definition for non-frameability. In addition, unlike previous models, our model

captures the notion of tracing soundness which ensures that even if all parties in the system are fully corrupt, no one but the user who produced the signature could claim authorship of the signature.

Secondly, we provide a generic construction that is secure w.r.t.\\

our strong security model and show two example instantiations in the standard model which are much more efficient than existing constructions (secure under weaker security definitions).

Impossible differential attacks are among the most powerful forms of cryptanalysis against block ciphers. We present in this paper an in-depth complexity analysis of these attacks. We show an unified way to mount such attacks and provide generic formulas for estimating their time, data and memory complexities. LBlock is a well studied lightweight block cipher with respect to impossible differential attacks. While previous single-key cryptanalysis reached up to 22 rounds, by applying our method we are able to break 23 rounds with time complexity $2^{75.36}$ and data complexity $2^{59}$. Other time/data trade-offs are equally possible. This is to our knowledge the best (non-exhaustive search like) cryptanalysis of this function in the single-key model.

In this article, a new symmetric block cipher named MSEA is proposed. MSEA is based on ARX cryptographic design technique. MSEA is simple in nature due to the use of combinations of elementary operations like modular addition, bit-wise rotation and bit-wise XOR. In MSEA, plain text block, secret key, and number of encryption rounds are variable in size, while the size of cipher text is double of size of plain text. Data-dependant rotation is the most vital feature of MSEA through which the unpredictability of encrypted text is increasing. Key formation and encryption/decryption schemes of MSEA are significantly fast.

We define a model for applications that process large data sets in a way that enables additional optimizations of encryption operations. We designed a new strong pseudo-random tweakable permutation, WCFB, to take advantage of identified characteristics. WCFB is built with only 2m+1 block cipher invocation for m cipherblocks and approximately 5m XOR operations.

WCFB can benefit from commonly occurring plaintext, such as encryption of a 0^nm sector, and repeated operations on the same wide block.

We prove the birthday-bound security of the mode, expressed in terms of the security of the underlying block cipher.

A case analysys of disk block access requests by Windows 8.1 is provided.

We consider unconditionally secure leakage resilient two-party

computation, where security means that the leakage obtained by an

adversary can be simulated using a similar amount of leakage from the

private inputs or outputs. A related problem is known as circuit

compilation, where there is only one device doing a computation on

public input and output. Here the goal is to ensure that the adversary

learns only the input/output behaviour of the computation, even given

leakage from the internal state of the device. We study these

problems in an enhanced version of the ``only computation leaks\'\'

model, where the adversary is additionally allowed a bounded amount of

{\\em global} leakage from the state of the entity under attack. In

this model, we show the first unconditionally secure leakage resilient

two-party computation protocol. The protocol assumes access to

correlated randomness in the form of a functionality $\\fOrt$ that

outputs pairs of orthogonal vectors $(\\vec{u}, \\vec{v})$ over some

finite field, where the adversary can leak independently from

$\\vec{u}$ and from $\\vec{v}$. We also construct a general circuit

compiler secure in the same leakage model. Our constructions work,

even if the adversary is allowed to corrupt a constant fraction of the

calls to $\\fOrt$ and decide which vectors should be output. On the

negative side, we show that unconditionally secure two-party

computation and circuit compilation are in general impossible in the

plain version of our model. For circuit compilation we need a

computational assumption to exhibit a function that cannot be securely

computed, on the other hand impossibility holds even if global leakage

is not allowed. It follows that even a somewhat unreliable version of

$\\fOrt$ cannot be implemented with unconditional security in the plain

leakage model, using classical communication. However, we show that an

implementation using quantum communication does exist. In particular,

we propose a simple ``prepare-and-measure\'\' type protocol which we

show secure using a new result on sampling from a quantum

population. Although the protocol may produce a small number of

incorrect pairs, this is sufficient for leakage resilient computation

by our other results.

In lattice cryptography, worst-case to average-case reductions rely on two problems: Ajtai\'s SIS and Regev\'s LWE,

which refer to a very small class of random lattices related to the group G=Z_q^n.

We generalize worst-case to average-case reductions to (almost) all integer lattices,

by allowing G to be any (sufficiently large) finite abelian group.

In particular, we obtain a partition of the set of full-rank integer lattices of large volume

such that finding short vectors in a lattice chosen uniformly at random from any of the partition cells is as hard as finding short vectors in any integer lattice.

Our main tool is a novel group generalization of lattice reduction, which we call structural lattice reduction: given a finite abelian group $G$ and a lattice $L$,

it finds a short basis of some lattice $\\bar{L}$ such that $L \\subseteq \\bar{L}$ and $\\bar{L}/L \\simeq G$.

Our group generalizations of SIS and LWE allow us to abstract lattice cryptography, yet preserve worst-case assumptions.