International Association for Cryptologic Research

IACR News Central

Here you can see all recent updates to the IACR webpage. These updates are also available:

Now viewing news items related to:

18 June 2018
ePrint Report Actively Secure OT-Extension from q-ary Linear Codes Ignacio Cascudo, René Bødker Christensen, Jaron Skovsted Gundersen
We consider recent constructions of $1$-out-of-$N$ OT-extension from Kolesnikov and Kumaresan (CRYPTO 2013) and from Orrú et al. (CT-RSA 2017), based on binary error-correcting codes. We generalize their constructions such that $q$-ary codes can be used for any prime power $q$. This allows to reduce the number of base $1$-out-of-$2$ OT's that are needed to instantiate the construction for any value of $N$, at the cost of increasing the complexity of the remaining part of the protocol. We analyze these trade-offs in some concrete cases.
ePrint Report On the Universally Composable Security of OpenStack Kyle Hogan, Hoda Maleki, Reza Rahaeimehr, Ran Canetti, Marten van Dijk, Jason Hennessey, Mayank Varia, Haibin Zhang
OpenStack is the prevalent open-source, non-proprietary package for managing cloud services and data centers. It is highly complex and consists of multiple inter-related components which are developed by separate, loosely coordinated groups. We initiate an effort to provide a rigorous and holistic security analysis of OpenStack. Our analysis has the following key features:

-It is user-centric: It stresses the security guarantees given to users of the system, in terms of privacy, correctness, and timeliness of the services.

-It provides defense in depth: It considers the security of OpenStack even when some of the components are compromised. This departs from the traditional design approach of OpenStack, which assumes that all services are fully trusted.

-It is modular: It formulates security properties for individual components and uses them to assert security properties of the overall system.

We base our modeling and security analysis in the universally composable (UC) security framework, which has been so far used mainly for analyzing security of cryptographic protocols. Indeed, demonstrating how the UC framework can be used to argue about security-sensitive systems which are mostly non-cryptographic in nature is another main contribution of this work.

Our analysis covers only a number of core components of OpenStack. Still, it uncovers some basic and important security trade-offs in the design. It also naturally paves the way to a more comprehensive analysis of OpenStack.
ePrint Report Verifiable Delay Functions Dan Boneh, Joseph Bonneau, Benedikt Bünz, Ben Fisch
We study the problem of building a verifiable delay function (VDF). A VDF requires a specified number of sequential steps to evaluate, yet produces a unique output that can be efficiently and publicly verified. VDFs have many applications in decentralized systems, including public randomness beacons, leader election in consensus protocols, and proofs of replication. We formalize the requirements for VDFs and present new candidate constructions that are the first to achieve an exponential gap between evaluation and verification time.
In this paper we proposed an ultra-lightweight cipher GRANULE. It is based on Feistel network which encrypts 64 bits of data with 80/128 bits of key. GRANULE needs very less memory space as compared to existing lightweight ciphers .GRANULE needs 1288 GEs for 80 bit and 1577 GEs for 128 bit key size. It also shows good resistance against linear and differential cryptanalysis. GRANULE needs very small footprint area and provides robust secure design which thwart attacks like biclique attack, zero correlation attack, meet in the middle attack ,key schedule attack and key collision attack. GRANULE is having a strong S-box which is the key designing aspect in any cipher design. In this paper GRANULE is proposed with 32 rounds which are enough to provide resistance against all possible types of attacks. GRANULE consumes very less power as compared to other modern lightweight ciphers. We believe GRANULE cipher is the best suited cipher for providing robust security in applications like IoT.
ePrint Report CHQS: Publicly Verifiable Homomorphic Signatures Beyond the Linear Case Lucas Schabh{\"u}ser, Denis Butin, Johannes Buchmann
Sensitive data is often outsourced to cloud servers, with the server performing computation on the data. Computational correctness must be efficiently verifiable by a third party while the input data remains confidential. This paper introduces CHQS, a homomorphic signature scheme from bilinear groups fulfilling these requirements. CHQS is the first such scheme to be both context hiding and publicly verifiable for arithmetic circuits of degree two. It also achieves amortized efficiency: after a precomputation, verification can be faster than the evaluation of the circuit itself.
ePrint Report Trends in design of ransomware viruses Vlad Constantin Craciun, Andrei Mogage, Emil Simion
The ransomware nightmare is taking over the internet impacting common users,small businesses and large ones. The interest and investment which are pushed into this market each month, tells us a few things about the evolution of both technical and social engineering and what to expect in the short-coming future from them. In this paper we analyze how ransomware programs developed in the last few years and how they were released in certain market segments throughout the deep web via RaaS, exploits or SPAM, while learning from their own mistakes to bring profit to the next level. We will also try to highlight some mistakes that were made, which allowed recovering the encrypted data, along with the ransomware authors preference for specific encryption types, how they got to distribute, the silent agreement between ransomwares, coin-miners and bot-nets and some edge cases of encryption, which may prove to be exploitable in the short-coming future.
ePrint Report Consolidating Security Notions in Hardware Masking Lauren De Meyer, Begül Bilgin, Oscar Reparaz
This paper revisits the security conditions of masked hardware implementations. We describe a new, succinct, information-theoretic condition to ensure security in the presence of glitches. This single condition includes, but is not limited to, previous security notions such as those used in threshold implementations. As a consequence, we can prove the security of masked functions that work with non-uniform input sharings. Our notion naturally generalizes to higher orders. Furthermore, we can apply our condition in a tool that efficiently tests and validates the resistance of masked hardware circuits against DPA. Finally, we also treat the notion of (strong) non-interference from an information-theoretic point-of-view in order to unify the different security concepts and pave the way to the verification of composability in the presence of glitches.
ePrint Report Continuous NMC Secure Against Permutations and Overwrites, with Applications to CCA Secure Commitments Ivan Damgård, Tomasz Kazana, Maciej Obremski, Varun Raj, Luisa Siniscalchi
Non-Malleable Codes (NMC) were introduced by Dziembowski, Pietrzak and Wichs in ICS 2010 as a relaxation of error correcting codes and error detecting codes. Faust, Mukherjee, Nielsen, and Venturi in TCC 2014 introduced an even stronger notion of non-malleable codes called continuous non-malleable codes where security is achieved against continuous tampering of a single codeword without re-encoding. We construct information theoretically secure CNMC resilient to bit permutations and overwrites, this is the first Continuous NMC constructed outside of the split-state model. In this work we also study relations between the CNMC and parallel CCA commitments. We show that the CNMC can be used to bootstrap a \sd\ parallel CCA bit commitment to a \sd\ parallel CCA string commitment, where \sd\ parallel CCA is a weak form of parallel CCA security. Then we can get rid of the \sd\ limitation obtaining a parallel CCA commitment, requiring only one-way functions.
ePrint Report Randomness analysis for multiple-recursive matrix generator Subhrajyoti Deb, Bubu Bhuyan, Sartaj Ul Hasan
Randomness testing of binary sequences generated by any keystream generator is of paramount importance to both designer and attacker. Here we consider a word-oriented keystream generator known as multiple-recursive matrix generator, which was introduced by Niederreiter (1993). Using NIST statistical test suite as well as DieHarder statistical package, we analyze randomness properties of binary sequences generated by multiple-recursive matrix generator and show that these sequences are not really adequate for any cryptographic applications. We also propose nonlinearly filtered multiple-recursive matrix generator based a special nonlinear function and establish that sequences generated by such a nonlinearly filtered multiple-recursive matrix generator provide good randomness results. Moreover, we compare our randomness test results with some of the recent lightweight stream ciphers like Lizard, Fruit, and Plantlet.
14 June 2018
ePrint Report On the Impossibility of Cryptography with Tamperable Randomness Per Austrin, Kai-Min Chung, Mohammad Mahmoody, Rafael Pass, Karn Seth
We initiate a study of the security of cryptographic primitives in the presence of efficient tampering attacks to the randomness of honest parties. More precisely, we consider p-tampering attackers that may \emph{efficiently} tamper with each bit of the honest parties' random tape with probability p, but have to do so in an ``online'' fashion. Our main result is a strong negative result: We show that any secure encryption scheme, bit commitment scheme, or zero-knowledge protocol can be ``broken'' with probability $p$ by a $p$-tampering attacker. The core of this result is a new Fourier analytic technique for biasing the output of bounded-value functions, which may be of independent interest.

We also show that this result cannot be extended to primitives such as signature schemes and identification protocols: assuming the existence of one-way functions, such primitives can be made resilient to (\nicefrac{1}{\poly(n)})-tampering attacks where $n$ is the security~parameter.
Weeve is a global network of IoT devices autonomously buying and selling device data. Powered by next-generation cryptography, cryptoeconomics, incentive mechanisms, and secured by the blockchain, Weeve is the basis for the Economy of Things – generating high-quality data stream networks. Weeve’s goal is to empower the commercialization of IoT through sharing data in a new era of data economies. We look for applicants with keen interest in at least one of the following topics:

Smart Contracting and Blockchain applications (e.g. Ethereum, Hyperledger, Cardano),

Blockchain-enabled mechanism design and applications (e.g. graded token-curated registries),

Radically new voting schemes beyond “the richer get richer” (e.g. quadratic voting, token-curated voting),

Scalable consensus protocols ,

Cryptographic algorithms (e.g. NIZKs, SNARGs, STARKs) & privacy-enhancing/GDPR-friendly protocols (e.g. MPC,)

System Security (e.g. ARM Trustzone, Intel SGX)

We solicit applications at various entry levels, from junior to senior, covering the complete spectrum from full-time research to development. We also appreciate and support research internships of PhDs and PostDocs. We offer a competitive salary, an academic environment, and access to Berlin’s vibrant blockchain ecosystem. Weeve leaves much freedom for pursuing one’s own ideas and supports this with condensing research ideas into a PhD and disseminating those to the blockchain community (meetups, conferences, etc.).

Closing date for applications: 31 July 2018

Contact: For technical inquiries, please contact Prof. Dr. Sebastian Gajek: (sebastian.gajek (at)

For recruitment queries, contact NBT Tech Recruiter: Ayca (ayca.kuzuimamlar (at)

More information:

The CRYPTO Research Group of LMV (Laboratoire de Mathématiques de Versailles), part of Versailles-St-Quentin-en-Yvelines University (UVSQ), invites applications for a postdoctoral researcher position in the area of Post-Quantum Cryptography.

The position is available immediately for one year, and is renewable, based on mutual interest and availability of funding. The starting date can be arranged as convenient.

The candidates are expected to:

- have completed their PhD degree in cryptography;

- have adequate cryptography research experience demonstrated through a strong publication record.

Applications should be sent via email and should include a CV, a list of publications, a short research proposal, and contact information for one or two persons who are willing to give references.

Closing date for applications: 30 June 2018

Contact: Contact: Prof. Louis Goubin, Louis.Goubin (at)

More information:

12 June 2018
ePrint Report Cryptanalysis of SFN Block Cipher Sadegh Sadeghi, Nasour Bagheri
SFN is a lightweight block cipher designed to be compact in hardware environment and also efficient in software platforms. Compared to the conventional block ciphers that are either Feistel or Substitution-Permutation (SP) network based, SFN has a different encryption method which uses both SP network structure and Feistel network structure to encrypt. SFN supports key lengths of 96 bits and its block length is 64 bits. In this paper, we propose an attack on full SFN by using the related key distinguisher. With this attack, we are able to recover the keys with a time complexity of 2^{60.58} encryptions. The data and memory complexity of the attacks are negligible. In addition, in the single key mode, we present a meet in the middle attack against the full rounds block cipher for which the time complexity is 2^{80} SFN calculations and the memory complexity is 2^{87} bytes. The date complexity of this attack is only a single known plaintext and its corresponding ciphertext.
ePrint Report Ramanujan graphs in cryptography Anamaria Costache, Brooke Feigon, Kristin Lauter, Maike Massierer, Anna Puskas
In this paper we study the security of a proposal for Post-Quantum Cryptography from both a number theoretic and cryptographic perspective. Charles-Goren-Lauter in 2006 proposed two hash functions based on the hardness of finding paths in Ramanujan graphs. One is based on Lubotzky--Phillips--Sarnak (LPS) graphs and the other one is based on Supersingular Isogeny Graphs. A 2008 paper by Petit-Lauter-Quisquater breaks the hash function based on LPS graphs. On the Supersingular Isogeny Graphs proposal, recent work has continued to build cryptographic applications on the hardness of finding isogenies between supersingular elliptic curves. A 2011 paper by De Feo-Jao-Pl\^ut proposed a cryptographic system based on Supersingular Isogeny Diffie--Hellman as well as a set of five hard problems. In this paper we show that the security of the SIDH proposal relies on the hardness of the SIG path-finding problem introduced in [CGL06]. In addition, similarities between the number theoretic ingredients in the LPS and Pizer constructions suggest that the hardness of the path-finding problem in the two graphs may be linked. By viewing both graphs from a number theoretic perspective, we identify the similarities and differences between the Pizer and LPS graphs.
XS-circuits describe block ciphers that utilize 2 operations: X) bitwise modulo 2 addition of binary words and S) substitution of words using key-dependent S-boxes with possibly complicated internal structure. We propose a model of XS-circuits which, despite the simplicity, covers a rather wide range of block ciphers. In our model, several instances of a simple round circuit, which contains only one S~operation, are linked together and form a compound circuit called a cascade. S operations of a cascade are interpreted as independent round oracles. We deal with diffusion characteristics of cascades. These characteristics are related to the cryptographic strength of corresponding block ciphers. We obtain results on invertibility, transitivity and 2-transitivity of mappings induced by round circuits and their cascades. We provide estimates on the first and second activation times where the i-th activation time is the minimum number of rounds which guarantees that at least i round oracles get different queries while processing two different cascade's inputs. The activation times are related to differential cryptanalysis. We introduce the similarity and duality relations between round circuits. Cascades of related circuits have the same or dual diffusion characteristics. We find canonical representatives of classes of similar circuits and show that the duality between circuits is related to duality between differential and linear attacks against corresponding block ciphers. We discuss families of circuits with growing number of inputs. Such families can be used to build wide-block ciphers.
4-bit crypto S-boxes play a significant role in encryption and decryption of many cipher algorithms from last 4 decades. Generation and cryptanalysis of generated 4-bit crypto S-boxes is one of the major concerns of modern cryptography till now. In this paper 48, 4-bit crypto S-boxes are generated with addition of all possible additive constants to the each element of crypto S-box of corresponding multiplicative inverses of all elemental polynomials (EPs) under the concerned irreducible polynomials (IPs) over Galois field GF(2^4). Cryptanalysis of 48 generated 4-bit crypto S-boxes is done with all relevant cryptanalysis algorithms of 4-bit crypto S-boxes. The result shows the better security of generated 4-bit crypto S-boxes.
We propose a new computational problem over the noncommutative group, called the twin conjugacy search problem. This problem is related to the conjugacy search problem and can be used for almost all of the same cryptographic constructions that are based on the conjugacy search problem. However, our new problem is at least hard as the conjugacy search problem. Moreover, the twin conjugacy search problem have many applications. One of the most important applications, we propose a trapdoor test which can replace the function of the decision oracle. We also show other applications of the problem, including: a non-interactive key exchange protocol and a key exchange protocol, a new encryption scheme which is secure against chosen ciphertext attack, with a very simple and tight security proof and short ciphertexts, under a weak assumption, in the random oracle model.
ePrint Report Implementation and Performance Evaluation of RNS Variants of the BFV Homomorphic Encryption Scheme Ahmad Al Badawi, Yuriy Polyakov, Khin Mi Mi Aung, Bharadwaj Veeravalli, Kurt Rohloff
Homomorphic encryption provides the ability to compute on encrypted data without ever decrypting them. Potential applications include aggregating sensitive encrypted data on a cloud environment and computing on the data in the cloud without compromising data privacy. There have been several recent advances resulting in new homomorphic encryption schemes and optimized variants of existing schemes. Two efficient Residue-Number-System variants of the Brakerski-Fan-Vercauteren homomorphic encryption scheme were recently proposed: the Bajard-Eynard-Hasan-Zucca (BEHZ) variant based on integer arithmetic with auxiliary moduli, and the Halevi-Polyakov-Shoup (HPS) variant based on a combination of integer and floating-point arithmetic techniques. We implement and evaluate the performance of both variants in CPU (both single- and multi-threaded settings) and GPU. The most interesting (and also unexpected) result of our performance evaluation is that the HPS variant in practice scales significantly better (typically by 15%-30%) with increase in multiplicative depth of the computation circuit than BEHZ. This implies that the runtime performance and supported circuit depth for HPS will always be better for most practical applications. The comparison of the homomorphic multiplication runtimes for CPU and GPU demonstrates that our best GPU performance results are 3x-33x faster than our best multi-threaded results for a modern server CPU environment. For the multiplicative depth of 98, our fastest GPU implementation performs decryption in 0.5 ms and homomorphic multiplication in 51 ms for 128-bit security settings, which is already practical for cloud environments supporting GPU computations. Our best runtime results are at least two orders of magnitude faster than all previously reported results for any variant of the Brakerski-Fan-Vercauteren scheme.
ePrint Report BISEN: Efficient Boolean Searchable Symmetric Encryption with Verifiability and Minimal Leakage Guilherme Borges, Henrique Domingos, Bernardo Ferreira, João Leitão, Tiago Oliveira, Bernardo Portela
The prevalence and availability of cloud infrastructures has made them the de facto solution for storing and archiving data, both for organizations and individual users. Nonetheless, the cloud's wide spread adoption is still hindered by data privacy and security concerns, particularly in applications with large data collections where efficient search and retrieval services are also major requirements. This leads to increased tension between security, efficiency, and search expressiveness, which current state of art solutions try to balance through complex cryptographic protocols that sacrifice efficiency and expressiveness for near optimal security.

In this paper we tackle this tension by proposing BISEN, a new provably-secure boolean searchable symmetric encryption scheme that improves these three complementary dimensions by exploring the design space of isolation guarantees offered by novel commodity hardware such as Intel SGX, abstracted as Isolated Execution Environments (IEEs). BISEN is the first scheme to enable highly expressive and arbitrarily complex boolean queries, with minimal leakage of information regarding performed queries and accessed data. Furthermore, by exploiting trusted hardware and the IEE abstraction, BISEN reduces communication costs between the client and the cloud, boosting query execution performance. Experimental validation and comparison with the state of art shows that BISEN provides better performance with enriched search semantics and security
Witness pseudorandom functions (witness PRFs), introduced by Zhandry [Zha16], was defined for an NP language L and generate a pseudorandom value for any instance x. The same pseudorandom value can be obtained efficiently using a valid witness w for x belongs to L. Zhandry built a subset-sum encoding scheme from multilinear maps and then converted a relation circuit corresponding to an NP language L to a subset-sum instance to achieve a witness PRF for L. The main goal in developing witness PRF in [Zha16] is to avoid obfuscation from various constructions of cryptographic primitives. Reliance on cryptographic tools built from multilinear maps may be perilous as existing multilinear maps are still heavy tools to use and suffering from many non-trivial attacks.

In this work, we give constructions of the following cryptographic primitives without using multilinear maps and instantiating obfuscation from randomized encoding: – We construct witness PRFs using a puncturable pseudorandom function and sub-exponentially secure randomized encoding scheme in common reference string (CRS) model. A sub-exponentially secure randomized encoding scheme in CRS model can be achieved from a sub-exponentially secure public key functional encryption scheme and learning with error assumptions with sub-exponential hardness. – We turn our witness PRF into a multi-relation witness PRF where one can use the scheme with a class of relations related to an NP language. – Furthermore, we construct an offline witness encryption scheme using our proposed witness PRF. The offline witness encryption scheme of Abusalah et al. [AFP16] was built from a plain public-key encryption, a statistical simulation-sound non-interactive zero knowledge (SSS-NIZK) proof system and obfuscation. In their scheme, a(n) SSS-NIZK proof is needed for the encryption whose efficiency depends on the underlying public key encryption. We replace SSS-NIZK by our witness PRF and construct an offline witness encryption scheme. More precisely, our scheme is based on a public-key encryption, a witness PRF and employs a sub-exponentially secure randomized encoding scheme in CRS model instantiating obfuscation. Our offline witness encryption can be turned into an offline functional witness encryption scheme where decryption releases a function of a message and witness as output.
ePrint Report Lower Bounds on Lattice Enumeration with Extreme Pruning Yoshinori Aono, Phong Q. Nguyen, Takanobu Seito, Junji Shikata
At Eurocrypt '10, Gama, Nguyen and Regev introduced lattice enumeration with extreme pruning: this algorithm is implemented in state-of-the-art lattice reduction software and used in challenge records. They showed that extreme pruning provided an exponential speed-up over full enumeration. However, no limit on its efficiency was known, which was problematic for long-term security estimates of lattice-based cryptosystems. We prove the first lower bounds on lattice enumeration with extreme pruning: if the success probability is lower bounded, we can lower bound the global running time taken by extreme pruning. Our results are based on geometric properties of cylinder intersections and some form of isoperimetry. We discuss their impact on lattice security estimates.
ePrint Report Polynomial Functional Encryption Scheme with Linear Ciphertext Size Jung Hee Cheon, Seungwan Hong, Changmin Lee, Yongha Son
In this paper, we suggest a new selective secure functional encryption scheme for degree $d$ polynomial. The number of ciphertexts for a message with length $\ell$ in our scheme is $O(\ell)$ regardless of $d$, while it is at least $\ell^{d/2}$ in the previous works.

Our main idea is to generically combine two abstract encryption schemes that satisfies some special properties. We also gives an instantiation of our scheme by combining ElGamal scheme and Ring-LWE based homomorphic encryption scheme, whose ciphertext length is exactly $2\ell+1,$ for any degree $d.$
We present a new method that produces bounded FHE schemes (see Definition 3), starting with encryption schemes that support one algebraic operation. We use this technique to construct examples of encryption schemes that, theoretically can handle any algebraic function on encrypted data.
ePrint Report Ring Homomorphic Encryption Schemes Mugurel Barcau, Vicentiu Pasol
We analyze the structure of commutative ring homomorphic encryption schemes and show that they are not quantum IND-CCA secure.
11 June 2018
Job Posting Cryptographic Researchers PQShield Ltd., Oxford, UK.
PQShield Ltd. is a spin-out company of the University of Oxford, specialised in Post-Quantum Cryptography.

We invite experts in PQ cryptography to join our team as (Senior) Cryptographic Researchers. Candidates are expected to have a PhD degree in any PQ cryptography field or the equivalent in industrial experience with a solid publication record.

The company is offering competitive packages in addition to the chance to be affiliated with the Mathematical Institute at the University of Oxford.

Closing date for applications: 15 August 2018

Contact: Interested candidates, please send your CVs to Ali El Kaafarani on elkaafarani (at) or elkaafarani (at)

9 June 2018
Job Posting Research Fellow National University of Singapore
(For NUS SoC CS Dept)

Research Fellow

National University of Singapore


“NUS-Singtel Cyber Security R&D Lab” ( is a 5 years joint project with about SGD 43 mil (approximately USD 31 mil) of funds contributed by Singapore Telecommunications Limited (SingTel), National University of Singapore (NUS), and National Research Foundation (NRF) of Singapore. The R&D Lab will conduct research in four broad areas of cyber security having strategic relevance to Singtel’s business: (1) Predictive Security Analytics; (2) Network, Data and Cloud Security; (3) Internet-of-Things and Industrial Control Systems; (4) Future-Ready Cyber Security Systems.

NUS-SingTel Lab currently has one research fellow position with competitive pay. It is available to (fresh) PhD graduates in computer science/engineering from Singapore or overseas.

The Research Fellow will be responsible for working closely with the Principal Investigator and lab members on a new 3-year research project which just starts in June 2018. He/she should possess experience or interest in at least some of the following research areas:

• Key management, Authentication, Authorization and Access control

• Trusted computing (e.g. TPM, Intel SGX)

• Post-quantum cryptography

Job requirements:

• A PhD degree in a relevant area (Computer Science/Engineer, mathematics, etc);

• Good publication record in cyber security and crypto area

o Publication in Rank 1 Cyber Security or Crypto Conference, or AsiaCrypt, ESORICS, ACSAC, TCC, Euro S&P, etc;

• Good communication skills (English), self-motivated and good team players;

• Some experience in programming is a plus;

• Willing to perform practical research which may eventually lead to products

To apply for the above position, please send a copy of your recent CV to comxj (at) with an email subject “Application for RF”.

Closing date for applications: 31 December 2018

Contact: Dr Xu (comxj (at)

More information:

7 June 2018
Job Posting Four PhD Studentships University of Birmingham, UK
The Centre for Cyber Security and Privacy at the University of Birmingham has 4 open vacancies for PhD students to start Sept/Oct 2018. This is an opportunity to join a successful and growing research group with a healthy cohort of PhD students (currently 15). Full stipends are available (including UK/EU tuition fees).

Candidates should have a background including cyber security (e.g. good grades in cyber security modules, a strong cyber security final project, or being on a dedicated cyber security course). Given the focus of all three studentships on hardware and attacks, candidates should additionally have a demonstrable interest in and familiarity with hardware security, pentesting, embedded systems and/or side-channel attacks.

The available projects (with supervisors and stipends) are:

  • Cyber Security for the Vehicles of Tomorrow (Flavio Garcia) £14,553 for 3 years
  • User-controlled Hardware Security Anchors: Evaluation and Design (Mark Ryan, Flavio Garcia, David Oswald) £14,553 for 3 years
  • BioLeak: Side-Channel Analysis of Fingerprint Matching Algorithms (David Oswald, Flavio Garcia) £22,000 for 3 years
  • FaultFinder: from Faulty Output to Fault Model – an Automated Approach (David Oswald, Flavio Garcia) £22,000 for 3 years

For more information please contact the relevant supervisors or our centre administrator. Please note that for BioLeak and FaultFinder candidates must be UK citizens.

Closing date for applications: 25 June 2018

Contact: Garfield Benjamin (administrator) g.r.benjamin (at)

Mark Ryan (Professor) m.d.ryan (at)

Flavio Garcia (Professor) f.garcia (at)

David Oswald (Lecturer) d.f.oswald (at)

More information:

The chair MAIS at TU Darmstadt, led by Prof. Dr. Heiko Mantel, is offering multiple positions. We are looking for researchers who are interested in addressing foundational problems that will be of practical relevance or in addressing practical problems based on solid foundations. The research focus shall be on software security (information-flow security or side-channel analysis) using formal methods or systematic experiments.

We are offering three positions for Ph.D. candidates and Postdocs in the following areas:

  1. information-flow analysis techniques for object-oriented programs at the level of source code and bytecode based on compositional and precise verification techniques
  2. experimental analysis of side-channel vulnerabilities in cryptographic implementations and generation of attacks exploiting such vulnerabilities
  3. program analysis techniques for detecting side-channel vulnerabilities in cryptographic implementations and for assessing the seriousness of such vulnerabilities

The overall goal of our research at MAIS is to make software-based systems more trustworthy (i.e. secure, safe, and correct) than they are today. As software engineering is a complex and error-prone task,

we employ formal methods in combination with experiments for reasoning about software and critical system properties. We investigate software systems on the level of source code, bytecode, and machine code as well as on the level of more abstract system specifications. This allows us to provide support for security at different stages of software

development. At MAIS we are offering a productive and collaborative research environment in which you can discuss ideas with other team members working on related topics.

The positions are available immediately and applications will be considered until the positions are taken. These are positions with regular salary and social benefits based on TV-TUD. For more information and how to apply, see

Closing date for applications:

Event date: 22 October to 26 October 2018
Submission deadline: 3 July 2018
Notification: 2 August 2018
6 June 2018
ePrint Report Pisa: Arbitration Outsourcing for State Channels Patrick McCorry, Surya Bakshi, Iddo Bentov, Andrew Miller, Sarah Meiklejohn
State channels are a leading approach for improving the scalability of blockchains and cryptocurrencies. They allow a group of distrustful parties to optimistically execute an application-defined program amongst themselves, while the blockchain serves as a backstop in case of a dispute or abort. This effectively bypasses the congestion, fees and performance constraints of the underlying blockchain in the typical case. However, state channels introduce a new and undesirable assumption that a party must remain on-line and synchronised with the blockchain at all times to defend against execution fork attacks. An execution fork can revert a state channel’s history, potentially causing financial damage to a party that is innocent except for having crashed. To provide security even to parties that may go off-line for an extended period of time, we present Pisa, a protocol enables such parties to delegate to a third party, called the custodian, to cancel execution forks on their behalf. To evaluate Pisa, we provide a proof-of-concept implementation for a simplified Sprites and we demonstrate that it is cost-efficient to deploy on the Ethereum network.

newer items   older items