IACR News
Here you can see all recent updates to the IACR webpage. These updates are also available:
30 November 2015
University College Cork, Ireland
DYPOSIT will investigate the problem of large, shared cyber physical systems under attack. The project will consider the challenge of dynamically formulating and adapting security controls, rapidly and on-demand, in the face of unfolding attacks on a shared cyber physical system fabric integrating multiple applications run by a variety of stakeholders. The Post-Doctoral Researcher will primarily contribute to the development and implementation of a distributed security model for cyber physical systems in which trade-offs between threats, controls and other constraints, can be reasoned about in managing security policy deployment.
29 November 2015
Beijing, China, November 1 - November 3
Location: Beijing, China
More Information: http://tcc2016b.sklois.cn/
Colin Boyd, Britta Hale, Stig Frode Mjølsnes, Douglas Stebila
Samee Zahur, David Evans
throughout the computation. Designers of such computations today must either put substantial effort into constructing a circuit representation of their algorithm, or use a high-level language and lose the opportunity to make important optimizations or experiment with protocol variations. We show how extensibility can be
improved by judiciously exposing the nature of data-oblivious computation. We introduce a new language that allows application developers to program secure computations without being experts in cryptography, while enabling programmers to create abstractions such as oblivious RAM and width-limited integers, or even new protocols without needing to modify the
compiler. This paper explains the key language features that safely enable such extensibility and describes the simple implementation approach we use to ensure security properties are preserved.
Antonio Faonio, Jesper Buus Nielsen
We introduce the notion of \\emph{fully} leakage resilient codes (FLRCs), where the adversary can leak some $\\lambda_0$ bits from the encoding process, i.e., the message and
the randomness involved during the encoding process. In addition the adversary can as usual leak from the codeword.
We give a simulation-based definition requiring that the adversary\'s leakage from the encoding process and the codework can be simulated given just $\\lambda_0$ bits of leakage from the message. For $\\lambda_0 = 0$ our new simulation-based notion is equivalent to the usual game-based definition. A FLRC would be interesting in its own right and would be useful in building other leakage-resilient primitives in a composable manner.
We give a fairly general impossibility result for FLRCs in the popular split-state model, where the codeword is broken into independent parts and where the leakage occurs independently on the parts. We show that if the leakage is allowed to be any poly-time function of the secret and if collision-resistant hash functions exist,
then there is no FLRC for the split-state model. The result holds only when the message length can be linear in the security parameter. However,
we can extend the impossibility result to FLRCs for constant-length messages under assumptions related to differing-input obfuscation. These results show that it is highly unlikely that we can build FLRCs for the split-state model when the leakage can be any poly-time function of the secret state.
We then give two feasibility results for weaker models.
First, we show that for $\\NC^0$-bounded leakage from the randomness and arbitrary poly-time leakage from the parts of the codeword the inner-product construction proposed by Dav\\\'{i} \\etal (SCN\'10) and successively improved by Dziembowski and Faust (ASIACRYPT\'11) is a FLRC for the split-state model. Second, we provide a compiler from any LRC to a FLRC in the common reference string model for any fixed leakage family of small cardinality. In particular, this compiler applies to the split-state model but also to many other models.
Qiang Tang, Jun Wang
University of Bergen, Norway
About the project/work tasks
Analyze, design and implement symmetric cryptographic lightweight primitives. Establish new methods of algebraic cryptanalysis and implement them efficiently. Advance the theoretical understanding of the use of Nonlinear Feedback Shift Registers (NLFSRs) for the needs of symmetric key cryptography.
The research training
The PhD candidate should have a strong background in computer science or/and mathematics with relevance to cryptography and must participate in an approved educational program for a PhD degree within a period of 3 years.
Nir Bitansky, Vinod Vaikuntanathan
The technique relies on the idea of ``reverse randomization\'\' [Naor, Crypto 1989] and on Nisan-Wigderson style derandomization, which was previously used in cryptography to obtain non-interactive witness-indistinguishable proofs and commitment schemes [Barak, Ong and Vadhan, Crypto 2003].
28 November 2015
Ding Wang, Ping Wang
to validate the legitimacy of a remote client, who must hold a valid smart card and the correct password in order to successfully login the server. So far the research on this domain has mainly focused on developing more secure, privacy-preserving and efficient protocols, which has led to numerous efficient proposals with a diversity of security provisions, yet little attention has been directed towards another important aspect, i.e. the usability of a scheme. This paper focuses on the study of two specific security threats on usability in two-factor authentication. Using two representative protocols as case studies, we demonstrate two types of security threats on usability: (1) Password change attack, which may easily render the smart card completely unusable by changing the password to a random value; and (2) De-synchronization attack, which breaks the consistence of the pseudo-identities between the user and the server. These threats, though realistic in practice, have been paid little attention in the literature. In addition to revealing the vulnerabilities, we discuss how to thwart these security threats and secure the protocols.
Katsuyuki Takashima, Atsushi Takayasu
e.g. smaller deviations for discrete Gaussian distributions. However, since previous analyses used a fixed order R\\\'enyi divergence, i.e., order two, they lost tightness of reductions. To overcome the deficiency, we adaptively optimize the orders based on the advantages of the adversary for several lattice-based schemes. The optimizations enable us to prove the security with both improved efficiency and tighter reductions. Indeed, our analysis offers security reductions with smaller parameters than the statistical distance based analysis and the reductions are tighter than those of previous R\\\'enyi divergence based analyses. As applications, we show tighter security reductions for sampling discrete Gaussian distributions with smaller precomputed tables for Bimodal Lattice Signature Scheme (BLISS), and the variants of learning with errors (LWE) problem and the small integer solution (SIS) problem called k-LWE and k-SIS, respectively.
Zhengjun Cao, Lihua Liu
Eric Crockett, Chris Peikert
general-purpose software library for lattice cryptography, written in
the functional and strongly typed language Haskell. In comparison
with several prior implementations of lattice-based cryptographic
schemes, \\lol has several novel and distinguishing features,
which include:
* \\emph{Generality and modularity:} \\lol defines simple but
general interfaces for the lattice cryptography ``toolbox,\'\'
allowing for a wide variety of cryptographic schemes to be expressed
very naturally and concisely. For example, we implement an advanced
fully homomorphic encryption (FHE) scheme in as few as 2--5 lines of
code per feature, via code that very closely matches the scheme\'s
mathematical definition.
* \\emph{Parallelism:} \\lol automatically exploits multi-core
parallelism, achieving nearly linear speedups per core. It also
allows for the use of other parallel ``backends\'\' (e.g., based on
GPUs or other specialized hardware), with no changes to application
code.
* \\emph{Theory affinity:} \\lol is designed from the ground-up
around the specialized ring representations, fast algorithms, and
worst-case hardness proofs that have been developed for the Ring-LWE
problem and its cryptographic applications. In particular, \\lol
implements fast algorithms for sampling from
\\emph{theory-recommended} error distributions over \\emph{arbitrary}
cyclotomic rings, and provides tools for maintaining tight control
of error growth in cryptographic schemes.
* \\emph{Advanced features:} \\lol exposes the rich \\emph{hierarchy}
of cyclotomic rings to cryptographic applications. We use this to
give the first-ever implementation of a set of FHE operations
collectively known as ``ring switching,\'\' and also describe a more
efficient variant that we call ``ring tunneling.\'\'
Finally, we document a variety of perspectives, objects, and
algorithms related to practical and theoretically sound usage of
Ring-LWE in cyclotomic rings, which we believe will serve as a useful
reference for future implementations.
Subhadeep Banik, Andrey Bogdanov, Takanori Isobe, Kyoji Shibutani, Harunaga Hiwatari, Toru Akishita, Francesco Regazzoni
This paper presents the block cipher Midori that is optimized with respect to the energy consumed by the circuit per bit in encryption or decryption operation. We deliberate on the design choices that lead to low energy consumption in an electrical circuit, and try to optimize each component of the circuit as well as its entire architecture for energy. An added motivation is to make both encryption and decryption functionalities available by small tweak in the circuit that would not incur significant area or energy
overheads.
We propose two energy-efficient block ciphers Midori128 and Midori64 with block sizes equal to 128 and 64 bits respectively. These ciphers have the added property that a circuit that provides both the functionalities of encryption and decryption can be designed with very little overhead in terms of area and energy. We compare our results with other ciphers with similar characteristics: it was found that the energy consumptions of Midori64 and Midori128 are by far better when compared ciphers like PRINCE and NOEKEON.
Zhigang Chen, Xinxia Song
Olivier Blazy, Céline Chevalier, Damien Vergnaud
on a shared \\human-memorable\" password without requiring a public-key infrastructure. It is one of the most
widely used and fundamental cryptographic primitives. Unfortunately, mass password theft from organizations
is continually in the news and, even if passwords are salted and hashed, brute force breaking of password
hashing is usually very successful in practice.
In this paper, we propose two ecient protocols where the password database is somehow shared among two
servers (or more), and authentication requires a distributed computation involving the client and the servers.
In this scenario, even if a server compromise is doable, the secret exposure is not valuable to the adversary since
it reveals only a share of the password database and does not permit to brute force guess a password without
further interactions with the parties for each guess. Our protocols rely on smooth projective hash functions and
are proven secure under classical assumption in the standard model (i.e. do not require idealized assumption,
such as random oracles).
Abderrahmane Nitaj, Tajjeeddine Rachidi
27 November 2015
Jesus Diaz, David Arroyo, Francisco B. Rodriguez
Iraklis Leontiadis, Ming Li
Data is produced massively from ubiquitous devices that cannot be stored locally. Moreover, third party authorities
in order to increase their value in the market with more knowledge, seek to collect
individual data inputs, such that they can make a decision with more relevant information. Aggregators, acting as third
parties, are interested in learning a statistical function as the sum over a census of data. Users are reluctant to
reveal their information in cleartext, since it is treated as personal sensitive information. The paradoxical paradigm
of preserving the privacy of individual data while granting an untrusted third party to learn in cleartext a function
thereof, is partially addressed by the current privacy preserving aggregation protocols.
Current solutions are either focused on a honest-but-curious Aggregator who is trusted to follow the rules of the
protocol or they model a malicious Aggregator with trustworthy users. That limits the security analysis to users who
are trustworthy to not share any secret information with a malicious Aggregator. In this paper we are the first to
propose a protocol with fully malicious users who collude with a malicious Aggregator in order
to forge a message of a trusted user. We introduce the new cryptographic primitive of \\emph{convertible tag}, that
consists of a two-layer authentication tag. Users first tag their data with their secret key and then an untrusted
\\emph{Converter} converts the first layer tags in a second layer. The final tags allow the Aggregator to produce a
proof for the correctness of a computation over users\' data. Security and privacy of the scheme is preserved against
the \\emph{Converter} and the Aggregator, under the notions of \\emph{Aggregator obliviousness} and \\emph{Aggregate
unforgeability} security definitions, augmented with malicious users. Our protocol is provable secure under standard
assumptions in the random oracle model.
Ritam Bhaumik, Mridul Nandi
Takahiro Matsuda, Goichiro Hanaoka
In this paper, we show a new CCA secure KEM based on a CCA secure $1$-bit PKE scheme which achieves the public key size $2 \\cdot |pk|$ and the ciphertext size $(2k + o(k)) \\cdot |c|$. These sizes are asymptotically optimal in the sense that they are (except for a constant factor) the same as those of the simplest \\lq\\lq bitwise-encrypt\'\' construction (seen as a KEM by encrypting a $k$-bit random session-key) that works for the chosen plaintext attack and non-adaptive chosen ciphertext attack settings. We achieve our main result by developing several new techniques and results on the \\lq\\lq double-layered\'\' construction (which builds a KEM from an inner PKE/KEM and an outer PKE scheme) by Myers and Shelat and on the notion of detectable PKE/KEM by Hohenberger, Lewko, and Waters (EUROCRYPT 2012).