International Association
for Cryptologic Research

In this paper, we present a construction of public key encryption

secure against related key attacks from hash proof systems in the

standard model. We show that the schemes presented by Jia et

al. (Provsec2013) are special cases of our general theory, and also

give other instantiations based on the QR and DCR assumptions. To

fulfill the related key security, we require the hash proof systems

to satisfy the key homomorphism and computational finger-printing properties. Compared with the construction given by Wee (PKC2012), our construction removed the use of one-time

signatures.

A usual way to construct block ciphers is to apply several rounds of a given structure. Many kinds of attacks are

mounted against block ciphers. Among them, differential and linear attacks are widely used. In~\\cite{V98,V03}, it is

shown that ciphers that achieve perfect pairwise decorrelation are secure against linear and differential attacks. It is possible to obtain such schemes by introducing at least one random affine permutation as a round function in the design of the scheme.

In this paper, we study attacks on schemes based on classical Feistel schemes where we introduce one or two affine

permutations.

Since these schemes resist against linear and differential

attacks, we will study stronger attacks based on specific equations on 4-tuples of

cleartext/ciphertext messages. We give the

number of messages needed to distinguish a permutation produced by such schemes from a random

permutation, depending on the number of rounds used in the schemes, the number and the position of the random affine permutations introduced in the schemes.

At Eurocrypt 2010, Freeman presented a framework to convert cryptosystems based on composite-order groups into ones that use prime-order groups. Such a transformation is interesting not only from a conceptual point of view, but also since for relevant parameters, operations in prime-order groups are faster than composite-order operations by an order of magnitude. Since Freeman\'s work, several other works have shown improvements, but also lower bounds on the efficiency of such conversions.

In this work, we present a new framework for composite-to-prime-order conversions. Our framework is in the spirit of Freeman\'s work; however, we develop a different, ``polynomial\'\' view of his approach, and revisit several of his design decisions. This eventually leads to significant efficiency improvements, and enables us to circumvent previous lower bounds. Specifically, we show how to implement Groth-Sahai proofs in a prime-order environment (with a symmetric pairing) almost twice as efficiently as the state of the art.

We also show that our new conversions are optimal in a very broad sense. Besides, our conversions also apply in settings with a multilinear map, and can be instantiated from a variety of computational assumptions (including, e.g., the $k$-linear assumption).

Starting in 2014, IACR will sponsor a small number of Cryptology Schools providing intensive training on clearly identified topics in cryptology. The aim of this program is to develop awareness and increased capacity for research in cryptology.

A Cryptology School is typically held full-time for 4-5 days of intensive learning and constitutes an efficient way to provide high-quality training for graduate students, as well as for professionals. Attendance should be open to anyone who is interested and qualified. In order to facilitate learning, a school is usually taught by a few domain experts with a focus on educating the audience rather than impressing with results. In line with the mission of IACR, a Cryptology School should enable the audience to advance the theory and practice of cryptology and related fields.

There are two rounds of submissions every year. The submission deadlines are:

• December 31st of year X-1: For schools that take place between March of year X and February of year X + 1.
• June 30th of year X: For schools that take place between September of year X and August of year X + 1.

Submissions must be sent by email to schools /at/ iacr.org.

For more information about this new program and how to prepare a proposal, please refer to http://www.iacr.org/schools/

Route Origin Verification (ROVER), a mechanism for securing interdomain routing with BGP, is a proposed alternative to the Resource Public Key Infrastructure (RPKI). While the RPKI requires the design and deployment of a completely new security infrastructure, ROVER leverages existing reverse DNS and DNSSEC deployments. Both ROVER and RPKI are based on a hierarchy of authorities that are trusted to provide information about the routing system.

It has been argued recently that misconfigurations or compromises of the RPKI\'s trusted authorities can present new risks to the routing system. Meanwhile, the advocates of ROVER claim that it provides a \"fail-safe\" approach, where the Internet will continue to work as it is even when ROVER fails. This poster therefore compares the impact of ROVER failures to those of the RPKI.

Submission: 16 July 2014
From January 5 to January 10
Location: Haldia, India
More Information: http://hithaldia.co.in/icmc2015/

The security of HMAC (and similar hash-based MACs) against

state-recovery and universal forgery attacks was very recently shown to

be suboptimal, following a series of surprising results by Leurent et

al. and Peyrin et al. These results have shown that such powerful

attacks require much less than $2^{\\ell}$ computations, contradicting

the common belief (where $\\ell$ denotes the internal state size). In

this work, we revisit and extend these results, with a focus on

properties of concrete hash functions such as a limited message length,

and special iteration modes.

We begin by devising the first state-recovery attack on HMAC with a

HAIFA hash function (using a block counter in every compression function

call), with complexity $2^{4\\ell/5}$. Then, we describe improved

trade-offs between the message length and the complexity of a

state-recovery attack on HMAC. Consequently, we obtain improved attacks

on several HMAC constructions used in practice, in which the the hash

functions limit the maximal message length (e.g., SHA-1 and SHA-2).

Finally, we present the first universal forgery attacks, which can be

applied with short message queries to the MAC oracle. In particular, we

devise the first universal forgery attacks applicable to SHA-1 and

SHA-2.

Linear algebra plays an important role in computer science, especially in cryptography.Numerous cryptog-raphic protocols, scientific computations, and numerical computations are based on linear algebra. Many linear algebra tasks can be reduced to some core problems, such as matrix multiplication, determinant of matrix and the characteristic polynomial of matrix. However, it is difficult to execute these tasks independently for client whose computation abilities are weaker than polynomial-time computational ability. Cloud Computing is a novel economical paradigm which provides powerful computational resources that enables resources-constrained client to outsource their mass computing tasks to the cloud.

In this paper, we propose a new verifiable and secure outsourcing protocol for the problem of computing the characteristic polynomial and eigenvalues of matrix. These protocols are not only efficient and secure, but also unnecessary for any cryptographic assumption.

The $r$-round (iterated) \\emph{Even-Mansour cipher} (also known as \\emph{key-alternating cipher}) defines a block cipher from $r$ fixed public $n$-bit permutations $P_1,\\ldots,P_r$ as follows: given a sequence of $n$-bit round keys $k_0,\\ldots,k_r$, an $n$-bit plaintext $x$ is encrypted by xoring round key $k_0$, applying permutation $P_1$, xoring round key $k_1$, etc. The (strong) pseudorandomness of this construction in the random permutation model (i.e., when the permutations $P_1,\\ldots,P_r$ are public random permutation oracles that the adversary can query in a black-box way) was studied in a number of recent papers, culminating with the work of Chen and Steinberger (EUROCRYPT~2014), who proved that the $r$-round Even-Mansour cipher is indistinguishable from a truly random permutation up to $O(2^{\\frac{rn}{r+1}})$ queries of any adaptive adversary (which is an optimal security bound since it matches a simple distinguishing attack). All results in this entire line of work share the common restriction that they only hold under the assumption that \\emph{the round keys $k_0,\\ldots,k_r$ and the permutations $P_1,\\ldots,P_r$ are independent}. In particular, for two rounds, the current state of knowledge is that the block cipher $E(x)=k_2\\oplus P_2(k_1\\oplus P_1(k_0\\oplus x))$ is provably secure up to $O(2^{2n/3})$ queries of the adversary, when $k_0$, $k_1$, and $k_2$ are three independent $n$-bit keys, and $P_1$ and $P_2$ are two independent random $n$-bit permutations. In this paper, we ask whether one can obtain a similar bound for the two-round Even-Mansour cipher \\emph{from just one $n$-bit key and one $n$-bit permutation}. Our answer is positive: when the three $n$-bit round keys $k_0$, $k_1$, and $k_2$ are adequately derived from an $n$-bit master key $k$, and the same permutation $P$ is used in place of $P_1$ and $P_2$, we prove a qualitatively similar $\\tilde{O}(2^{2n/3})$ security bound (in the random permutation model). To the best of our knowledge, this is the first ``beyond the birthday bound\'\' security result for AES-like ciphers that does not assume independent round keys.

We extend the FLUSH+RELOAD side-channel attack of Benger et al. to extract a significantly larger number of bits of information per observed signature when using OpenSSL. This means that by observing only 25 signatures, we can recover secret keys of the secp256k1 curve, used in the Bitcoin protocol, with a probability greater than 50 percent. This is an order of magnitude improvement over the previously best known result.

The new method of attack exploits two points: Unlike previous partial disclosure attacks we utilize all information obtained and not just that in the least significant or most significant bits, this is enabled by a property of the \"standard\" curves choice of group order which enables extra bits of information to be extracted. Furthermore, whereas previous works require direct information on ephemeral key bits, our attack utilizes the indirect information from the wNAF double and add chain.

In cloud computing, efficiencies are reaped by resource sharing such as co-location of computation and deduplication of data. This work exploits resource sharing in virtualization software to build a powerful cache-based attack on AES. We demonstrate the vulnerability by mounting Cross-VM Flush+Reload cache attacks in VMware VMs to recover the AES keys of OpenSSL 1.0.1 running inside the victim VM. Furthermore, the attack works in a realistic setting where different VMs are located on separate cores. The modified flush+reload attack we present, takes only in the order of seconds to minutes to succeed in a cross-VM setting. Therefore long term co-location, as required by other fine grain attacks in the literature, are not needed. The results of this study show that there is a great security risk to OpenSSL AES implementation running on VMware cloud services when the deduplication is not disabled.

Fault attacks are active attacks in which an adversary with physical

access to a cryptographic device, for instance a smartcard, tampers

with the execution of an algorithm to retrieve secret material. Since

the seminal Bellcore attack on RSA signatures, there has been

extensive work to discover new fault attacks against cryptographic

schemes, and to develop countermeasures against such

attacks. Originally focused on high-level algorithmic descriptions,

these works increasingly focus on concrete implementations. While

lowering the abstraction level leads to new fault attacks, it also

makes their discovery significantly more challenging. In order to face

this trend, it is therefore desirable to develop principled,

tool-supported approaches that allow a systematic analysis of the

security of cryptographic implementations against fault attacks.

We propose, implement, and evaluate a new approach for finding fault

attacks against cryptographic implementations. Our approach is based

on identifying implementation-independent mathematical properties we

call fault conditions. We choose them so that it is possible to

recover secret data purely by computing on sufficiently many data

points that satisfy a fault condition. Fault conditions capture the

essence of a large number of attacks from the literature, including

lattice-based attacks on RSA. Moreover, they provide a basis for

discovering automatically new attacks: using fault conditions, we

specify the problem of finding faulted implementations as a program

synthesis problem. Using a specialized form of program synthesis, we

discover multiple faulted implementations on RSA and ECDSA that

realize the fault conditions, and hence lead to fault attacks. Several

of the attacks found by our tool are new, and of independent interest.

In a seminal work at EUROCRYPT \'96, Coppersmith showed how to find

all small roots of a univariate polynomial congruence in polynomial

time: this has found many applications in public-key cryptanalysis

and in a few security proofs. However, the running time of the

algorithm is a high-degree polynomial, which limits experiments: the

bottleneck is an LLL reduction of a high-dimensional matrix with

extra-large coefficients. We present in this paper the first

significant speedups over Coppersmith\'s algorithm. The first

speedup is based on a special property of the matrices used by

Coppersmith\'s algorithm, which allows us to provably speed up the

LLL reduction by rounding, and which can also be used to improve

the complexity analysis of Coppersmith\'s original algorithm.

The exact speedup depends on the LLL algorithm used: for instance,

the speedup is asymptotically quadratic in the bit-size of the

small-root bound if one uses the Nguyen-Stehl\\\'e {\\Ltwo}

algorithm. The second speedup is heuristic and applies whenever

one wants to enlarge the root size of Coppersmith\'s algorithm by

exhaustive search. Instead of performing several LLL reductions

independently, we exploit hidden relationships between these

matrices so that the LLL reductions can be somewhat chained to

decrease the global running time. When both speedups are combined,

the new algorithm is in practice hundreds of times faster for

typical parameters.

Motivated by revelations concerning population-wide surveillance of

encrypted communications, we formalize and investigate the resistance

of symmetric encryption schemes to mass surveillance. The focus is on

algorithm-substitution attacks (ASAs), where a subverted encryption

algorithm replaces the real one. We assume that the goal

of ``big~brother\'\' is undetectable subversion, meaning

that ciphertexts produced by the subverted encryption algorithm

should reveal plaintexts to big~brother yet

be indistinguishable to users from those produced

by the real encryption scheme. We formalize security

notions to capture this goal and then offer both attacks and

defenses. In the first category we show that successful (from the

point of view of big brother) ASAs may be mounted on a large class of

common symmetric encryption schemes. In the second category we show

how to design symmetric encryption schemes that avoid such attacks and

meet our notion of security. The lesson that emerges is the danger of

choice: randomized, stateless schemes are subject to attack while

deterministic, stateful ones are not.

Non-interactive verifiable outsourced computation enables a computationally weak client to outsource the computation of a function $f$ on input $x$ to a more powerful but untrusted server, who will return the result of the function evaluation as well as a proof that the computation is performed correctly. A basic requirement of a verifiable outsourced computation scheme is that the client should invest less time in preparing the inputs and verifying the proof than computing the function by himself.

One of the best solutions of such non-interactive schemes are based on

Yao\'s garble circuit and full homomorphic encryption, which leads to invest $poly(T)$ running time in offline stage and $poly(log T)$ time in online stage of the client, where $T$ is the time complexity to compute $f$.

In this paper, we\'ll present a scheme which does not need to use garble circuit, but to use a very simple technique to confuse the function we are going to compute, and only invests $poly(log T)$ running time in the offline stage.

Recently, the Residue Number System and the Cox-Rower architecture

have been used to compute efficiently Elliptic Curve Cryptography over

FPGA. In this paper, we are rewriting the conditions of Kawamura\'s theorem for the base extension without error in order to define the maximal range of the set from which the moduli can be chosen to build a base. At the same time, we give a procedure to compute correctly the truncation function of the Cox module. We also present a modified ALU of the Rower architecture using a second level of Montgomery Representation. Such architecture allows us to select the

moduli with the new upper bound defined with the condition. This modification makes the Cox-Rower architecture suitable to compute 521 bits ECC with radix downto 16 bits compared to 18 with the classical Cox-Rower architecture. We validate our results through FPGA implementation of a scalar multiplication at classical cryptography security levels (NIST curves). Our implementation uses 35% less LUTs compared to the state of the art generic implementation of ECC

using RNS for the same performance [5]. We also slightly improve the computation time (latency) and our implementation shows best ratio throughput/area for RNS computation supporting any curve independently of the chosen base.

We put the Gentry-Szydlo algorithm into a mathematical framework, and show that it is part of a general theory of ``lattices with symmetry\'\'. For large ranks, there is no good algorithm that decides whether a given lattice has an orthonormal basis. But when the lattice is given with enough symmetry, we can construct a provably deterministic polynomial time algorithm to accomplish this, based on the work of Gentry and Szydlo. The techniques involve algorithmic algebraic number theory, analytic number theory, commutative algebra, and lattice basis reduction. This sheds new light on the Gentry-Szydlo algorithm, and the ideas should be applicable to a range of questions in cryptography.

We propose \\emph{RAW Path ORAM}, an ORAM construction that improves the state of the art Path ORAM in several ways.

First, RAW Path ORAM reduces the amount of encryption operations by $4\\times$ compared with Path ORAM.

Second, RAW Path ORAM enables a much more efficient and simpler integrity verification scheme.

Third, RAW Path ORAM dramatically simplifies the theoretical analysis on client storage requirement (stash size).

We build RAW Path ORAM in hardware and name it \\emph{Tiny ORAM}.

Tiny ORAM is the first hardware ORAM design that efficiently supports small client storage, arbitrary block sizes (e.g., 64~Bytes to 4096~Bytes) and integrity verification.

Block size flexibility allows Tiny ORAM to greatly reduce the worst-case access latency for ORAM running programs with erratic data locality.

To reduce the performance overhead that comes with small client storage, we add \\emph{Unified ORAM} scheme that further decreases ORAM access latency by up to 39\\% on real workloads.

We demonstrate a complete working prototype on a stock FPGA board.

Tiny ORAM requires $5\\%/15\\%$ of the FPGA logic/memory (including encryption and integrity verification)

and can complete an ORAM access for a 64 Byte block in $1.25-4.75\\mu s$.

Message authentication is one of the most basic tasks of cryptography, and authentication based on public-key infrastructure (PKI) is one of the most prevalent methods for message and entity authentication. Still, the state of the art in composable security analysis of PKI-based authentication is somewhat unsatisfactory. Specifically, existing treatments either (a)~make the unrealistic assumption that the PKI is accessible only within the confines of the authentication protocol itself, thus failing to capture real-world PKI-based authentication, or (b)~impose often-unnecessary requirements---such as strong on-line non-transferability---on candidate protocols, thus ruling out natural candidates.

We give a modular and composable analytical framework for PKI-based message authentication protocols. This framework guarantees security even when the PKI is pre-existing and globally available, without being unnecessarily restrictive. Specifically, we model PKI as a global set-up functionality within the \\emph{Global~UC} security model [Canetti \\etal, TCC 2007] and relax the ideal authentication functionality accordingly. We then demonstrate the security of a simple signature-based authentication protocol. Our modeling makes minimal security assumptions on the PKI in use; in particular, ``knowledge of the secret key\'\' is not guaranteed or verified. To enable our treatment, we formulate two new composition theorems.

A popular effective countermeasure to protect block cipher implementations against differential power analysis (DPA) attacks is to mask the internal operations of the cryptographic algorithm with random numbers. While the masking technique resists against first-order (univariate) DPA attacks, higher-order (multivariate) attacks were able to break masked devices. In this paper, we formulate a statistical model for higher-order DPA attack. We derive an analytic success rate formula that distinctively shows the effects of algorithmic confusion property, signal-noise-ratio (SNR), and masking on leakage of masked devices. It further provides a formal proof for the centered product combination function being optimal for higher-order attacks in very noisy scenarios. We believe that the statistical model fully reveals how the higher-order attack works around masking, and would offer good insights for embedded system designers to implement masking techniques.