International Association
for Cryptologic Research

Kahrobaei, Tortora, Tota showed how, to any nilpotent group of class n, one can associate a non-interactive key exchange protocol between n+1 users. The multilinear commutator maps associated to nilpotent groups play a key role in this protocol. In the present paper, we explore some alternative platforms, such as pro-p groups.

In the Zendoo white paper we introduced a novel sidechain construction for Bitcoin-like blockchains, which allows a mainchain to create and communicate with sidechains of different types without knowing their internal structure. In this paper, we take a step further by introducing a comprehensive method for sidechains to communicate amongst each other. We will also discuss the details of a cross-chain token transfer protocol that extends the generic communication mechanism. With the cross-chain token transfer protocol, it can enable a broad range of new applications, such as an exchange platform, that allows the ability to trade tokens issued from different sidechains.

We propose a new, unifying framework that yields an array of cryptographic primitives with {\em certified deletion}. These primitives enable a party in possession of a quantum ciphertext to generate a classical certificate that the encrypted plaintext has been information-theoretically deleted, and cannot be recovered even given unbounded computational resources. For $X \in \{\mathsf{public}\text{-}\mathsf{key},\mathsf{attribute\text{-}based},\mathsf{fully\text{-}homomorphic},\mathsf{witness},\mathsf{timed}\text{-}\mathsf{release}\}$, our compiler yields post-quantum $X$ encryption with certified deletion, assuming post-quantum $X$ encryption. Assuming the existence of statistically-binding commitments, our compiler yields statistically-binding commitments with certified everlasting hiding as well as statistically-sound zero-knowledge proofs for QMA with certified everlasting zero-knowledge. We also introduce and construct information-theoretic secret sharing with certified deletion. While encryption with certified deletion was first introduced by Broadbent and Islam (TCC 2020) in the context of an information-theoretic one-time pad, existing proposals by Unruh (Eurocrypt 2014), Hiroka et al. (Asiacrypt 2021), Hiroka et al. (Crypto 2021), and Poremba (QIP 2022) for {\em public-key} primitives with certified deletion (1) have complex tailored constructions and non-generic proofs, (2) are not known to satisfy everlasting security after deletion in the plain model, and in many cases (3) resort to idealized models or stronger cryptographic assumptions like obfuscation. We remedy this situation by developing a novel proof technique to argue that a bit $b$ has been {\em information-theoretically deleted} from an adversary's view once they produce a valid deletion certificate, despite having been previously {\em information-theoretically determined} by the ciphertext they held in their view. This may be of independent interest. Finally, we take the notion of certified deletion a step further, and explore its implications in the context of mistrustful two-(and multi-)party cryptography. Here, there is a strong impossibility result by Unruh (Crypto 2013) building on Lo, Chau, and Mayers (Physical Review Letters) showing that everlasting security against \emph{every} party is impossible to achieve, even with quantum communication, and even if parties are computationally bounded during the protocol. Nevertheless, we introduce the notion of \emph{Everlasting Security Transfer}, enabling participants to dynamically request that \emph{any} party (or parties) information-theoretically delete their data, even \emph{after} the protocol execution completes. We show how to construct secure two-party and multi-party computation satisfying this notion of security, which is impossible to achieve in a classical world. Our constructions all assume only statistically-binding commitments, which can be built from one-way functions or pseudo-random quantum states.

All known instantiations for fully homomorphic encryption (FHE) produce noisy ciphertexts and rely on a technique called bootstrapping to reduce the noise so as to enable an arbitrary number of homomorphic operations. Bootstrapping is the main performance bottleneck and arguably the biggest obstacle to widespread adoption of FHE. Among the FHE schemes, TFHE and its variations present the appealing property of having a bootstrapping procedure---as well as its extension to programmable bootstrapping---that is relatively light-weight. The essential operations consist of a series of multiplications in $(Z/qZ)[X]/(X^N+1)$. While the NTT is seemingly the natural candidate for evaluating these multiplications in a fast and exact way, it restricts the possible choices for $q$ and $N$. To the authors' knowledge, all current implementations of TFHE with $q$ a power of two actually employ the FFT over the complex numbers instead. This introduces real numbers to the otherwise purely discrete algorithms, including all the drawbacks of the need to approximate them using finite precision.

This work studies the avenues available to apply the NTT in the context of TFHE-like schemes. In particular, it considers various combinations of coefficient rings and quotient polynomials that are compatible with the requirements of the underlying scheme. Importantly, this work provides methods for adapting the (programmable) bootstrapping to quotient polynomials beyond power-of-two cyclotomics. As a side effect, it also demonstrates how this may enhance the programmability of the bootstrapping.

Anonymity of public key encryption (PKE) requires that, in a multi-user scenario, the PKE ciphertexts do not leak information about which public keys are used to generate them. Corruptions are common threats in the multi-user scenario but anonymity of PKE under corruptions is less studied in the literature. In TCC 2020, Benhamouda et al. first provide a formal characterization for anonymity of PKE under a specific type of corruption. However, no known PKE scheme is proved to meet their characterization.

To the best of our knowledge, all the PKE application scenarios which require anonymity also require confidentiality. However, in the work by Benhamouda et al., different types of corruptions for anonymity and confidentiality are considered, which can cause security pitfalls. What's worse, we are not aware of any PKE scheme which can provide both anonymity and confidentiality under the same types of corruptions.

In this work, we introduce a new security notion for PKE called ANON-RSO$_k\&$C security, capturing anonymity under corruptions. We also introduce SIM-RSO$_k\&$C security which captures confidentiality under the same types of corruptions. We provide a generic framework of constructing PKE scheme which can achieve the above two security goals simultaneously based on a new primitive called key and message non-committing encryption (KM-NCE). Then we give a general construction of KM-NCE utilizing a variant of hash proof system (HPS) called Key-Openable HPS. We also provide Key-Openable HPS instantiations based on the matrix decisional Diffie-Hellman assumption. Therefore, we can obtain various concrete PKE instantiations achieving the two security goals in the standard model with compact ciphertexts. Furthermore, for some PKE instantiation, its security reduction is tight.

NOVA signature scheme is a UOV-type signature scheme over a non-commutative coefficient ring with a novel structural map. In this article we show that a randomly generated central map for the scheme is very likely insecure and may suffer from a forgery attack in polynomial time.

This paper introduces Ibex, an advertising system that reduces the amount of data that is collected on users while still allowing advertisers to bid on real-time ad auctions and measure the effectiveness of their ad campaigns. Specifically, Ibex addresses an issue in recent proposals such as Google’s Privacy Sandbox Topics API in which browsers send information about topics that are of interest to a user to advertisers and demand-side platforms (DSPs). DSPs use this information to (1) determine how much to bid on the auction for a user who is interested in particular topics, and (2) measure how well their ad campaign does for a given audience (i.e., measure conversions). While Topics and related proposals reduce the amount of user information that is exposed, they still reveal user preferences. In Ibex, browsers send user information in an encrypted form that still allows DSPs and advertisers to measure conversions, compute aggregate statistics such as histograms about users and their interests, and obliviously bid on auctions without learning for whom they are bidding. Our implementation of Ibex shows that creating histograms is 1.7–2.5× more expensive for browsers than disclosing user information, and Ibex’s oblivious bidding protocol can finish auctions within 550 ms. We think this makes Ibex capable of preserving a good experience while improving user privacy.

Privacy-preserving protocols for matchings on general graphs can be used for applications such as online dating, bartering, or kidney donor exchange. In addition, they can act as a building blocks for more complex protocols. While privacy preserving protocols for matchings on bipartite graphs are a well-researched topic, the case of general graphs has experienced significantly less attention so far. We address this gap by providing the first privacy-preserving protocol for maximum weight matching on general graphs. We present two protocol variants, which both compute an $1/2-$approximation instead of an optimal solution in favor of scalability. For $N$ nodes, the first variant requires $\mathcal{O}(N \log^2 N)$ rounds and $\mathcal{O}(N^3\log N)$ communication, and the second variant requires only $\mathcal{O}(N \log N)$ rounds and $\mathcal{O}(N^3)$ communication. We implement both variants and find that the first variant runs in $14.9$ minutes for $N=300$ nodes, while the second variant requires only $5.1$ minutes for $N=300$, and $12.5$~minutes for $N=400$.

In this paper we study the security of two constructions for variable-length universal hash functions by means of their universality. Both constructions make use of a fixed-length unkeyed function that we call a block function. One construction is serial and is an idealization of the compression phase of Pelican-MAC. The other construction is parallel and is an idealization of the compression phase of Farfalle. Both are instances of a class of functions we call semi-group accumulators. We prove that the universality of these constructions is fully determined by the differential probability of block function differentials and, if not a permutation, the relative frequency of block function outputs. We show that both block function parallelization and serialization have equal security (against forgery) in the Wegman-Carter(-Shoup) construction. However, for the block functions we target, parallelization can provide significantly better security than serialization in the Protected Hash (PH) construction. Moreover, below a certain data limit, PH provides better security than WC(S) for the block function parallelization, despite the fact that it does not require a nonce. We show evidence of this effect by taking Xoodoo[3] as the block function .

The latest message driven (LMD) greedy heaviest observed sub-tree (GHOST) consensus protocol is a critical component of future proof-of-stake (PoS) Ethereum. In its current form, the protocol is brittle and intricate to reason about, as evidenced by recent attacks, patching attempts, and Görli testnet reorgs. We present Goldfish, which can be seen as a considerably simplified variant of the current protocol, and prove that it is secure and reorg resilient in synchronous networks with dynamic participation, assuming a majority of the nodes (called validators) follows the protocol honestly. Furthermore, we show that subsampling validators can improve the communication efficiency of Goldfish, and that Goldfish is composable with finality gadgets and accountability gadgets. The aforementioned properties make Goldfish a credible candidate for a future protocol upgrade of PoS Ethereum, as well as a versatile pedagogical example. Akin to traditional propose-and-vote-style consensus protocols, Goldfish is organized into slots, at the beginning of which a leader proposes a block containing new transactions, and subsequently members of a committee take a vote towards block confirmation. But instead of using quorums, Goldfish is powered by a new mechanism that carefully synchronizes the inclusion and exclusion of votes in honest validators' views.

Event date: 26 March to
Submission deadline: 19 November 2022
Notification: 25 January 2023

Event date: 3 April to 4 April 2023
Submission deadline: 28 November 2022
Notification: 23 January 2023

Event date: 6 October to 7 October 2022
Submission deadline: 12 September 2022
Notification: 13 September 2022

We have a vacancy for a postdoctoral fellowship at the Department of Mathematical Sciences at NTNU in Trondheim, Norway. The postdoctoral fellowship position is a temporary position where the main goal is to qualify for work in senior academic positions.

The position is funded by the Norwegian Research Council in the project: “OffPAD - Optimizing balance between high security and usability. An innovative approach to endpoint security”.

The NIST Post Quantum Cryptography Standardization is expected to end in 2024, and post-quantum cryptography will be required to secure all sensitive information in the years to come shortly after, e.g., in protocols such as TLS, SSH, FIDO and other systems. Additionally, NIST have announced a new call for quantum secure digital signature algorithms.

The goal of this project is to conduct research on post-quantum authentication protocols and improve upon the frameworks used today when it comes to long-term security.

The postdoc will be part of the NTNU Applied Cryptology Lab, a multidisciplinary research group consisting of members from the Department of Mathematical Sciences and the Department of Information Security and Communication Technology.

A list of possible, but not limited, research topics for the postdoctoral position are:

Post-quantum cryptography

Key-exchange

Digital signatures

Zero-knowledge proofs

Multi-party computation

Homomorphic encryption

Provable security

Your main supervisor will be Associate Professor Tjerand Silde at the Department of Information Security and Communication Technology.

Closing date for applications:

Contact: Tjerand Silde (tjerand.silde@ntnu.no)

More information: https://www.jobbnorge.no/en/available-jobs/job/231938/postdoctoral-fellow-in-cryptography-focusing-on-post-quantum-authentication-protocols

In a fast changing world, it takes pioneering spirit to create trustworthy technology. We enable secure connectivity and payment solutions for billions of people around the globe. At Giesecke+Devrient, you will play a key role in realizing the digital transformation.

Giesecke+Devrient is looking for a Cryptography Engineer (m/f/d) for its Cryptology department at its Munich Headquarters as soon as possible

Job Description:

• Secure implementation of cryptographic algorithms and security relevant OS components for smart cards in assembler
• Optimization regarding run time and memory consumption
• Design and implementation of countermeasures to defend against hardware related attacks against smart cards
• Analysis of the results of side-channel attacks and derivation of effective countermeasures

Your Profile:

• Background in mathematics, computer science or electronic engineering
• Ideally PhD in cryptography or 3+ years experience in cryptography or related area
• Programming skills in assembler for embedded microcontrollers
• Ideally experience in embedded security and side-channel-attacks

Your Benefits:

• High level of responsibility and exciting projects
• Working in an international security technology company
• Very flexible working hours and home office possibilities
• Wide range of training and further education opportunities
• Attractive family benefits such as a summer holiday camp for children
• Other benefits such as an own sports club and a canteen subsidized by the employer

We are looking forward to receiving your application!

https://careers.gi-de.com/job/Munich-Kryptologen-%28mfd%29-81677/723297801/

Closing date for applications:

Contact: Dr. Harald Vater (Harald.Vater (at) gi-de.com)

We’re a small team with a big mission and we’re looking for our Founding Cryptographic Software Engineer. Sovereign Systems was founded on the premise that personal data is valuable, and so are privacy and security. Historically, this premise has represented a paradox, as users and organizations have been forced to trade one for the other. Sovereign Systems is providing a solution to this paradox.

This is an opportunity to get in on the ground floor and shape the technical vision and strategy. You’ll work directly alongside the CEO and Chief Data Scientist with the support of an all-star team of A-list and highly active advisors. You’ll start by doing, rolling your sleeves up, and cranking out code. As we grow, you’ll help to build our technical team and collaborate with key stakeholders on the processes and frameworks that will allow the company to run both joyfully and efficiently.

In this role, you will have the opportunity to:

• You will have the chance to craft solutions and develop software for millions of users around the world.
• You'll be part of a company whose commitment to user privacy is at the heart of everything.
• You'll be surrounded by the most creative, passionate, and talented engineers in the industry, constantly being challenged to go beyond the norm to find new, innovative ways of solving problems and to make software safer, easier, and more fun to use.

Key qualifications :

• Passion for creating effective and pragmatic cryptographic schemes.
• MS/Ph.D. in Computer Science or CSE or equivalent experience. 5+ years building cloud-based and distributed systems.
• Understanding of fundamental cryptographic algorithms and the underlying mathematics, such as finite field arithmetic.
• Experience implementing privacy-preserving cryptographic primitives and protocols like fully homomorphic and oblivious encryption, and garbled circuits, and using libraries such as Zama, Microsoft SEAL, HELayers.
• Experience implementing high-performance cryptographic protocols in languages like Rust, Java, Go, Python, or C/C++.

Closing date for applications:

Contact: Jackie Peters

The Cybersecurity Group at TU Delft now opens a 4-year PhD position and two 2/3-year Post-doc positions within the Horizon Europe projects. The successful candidates are expected to do cutting-edge research on the topic of applied cryptography (in particular UC, lattice-based crypto) with renowned international researchers. They will be provided excellent research environment, international visiting/collaborations, and competitive salary and allowance packages.

For PhD: candidates are required to hold a MSc in math, computer science or related subject (preferably with some related backgrounds on cryptography). Further, they should provide sufficient English skills, e.g., International English test certificate.
For Post-doc: candidates must hold a PhD in mathematics or computer science with expertise on cryptography, and they are expected to have great backgrounds on UC or lattice-base crypto, and/or cryptography in general. Candidates must have a strong track record, academic writing and communication ability.

All the positions may have flexible starting date. Please prepare a detailed resume (including a list of publications if have), bachelor and MSc transcripts (for the PhD position), 1 page motivation letter, International English certificate (if have), and two references (names and contact emails).

Please contact shihui.fu@tudelft.nl for further questions.

Closing date for applications:

Contact: Dr. S. Fu (shihui.fu@tudelft.nl)

The University of Amsterdam offers a PhD position related to information security in machine learning applications. The project is especially concerned with trade-offs between security and other properties such as accuracy and energy consumption. This includes the accuracy and energy impact of cryptographic approaches to privacy-preserving machine learning, using for example secure multiparty computing or homomorphic encryption.

More information: https://vacatures.uva.nl/UvA/job/PhD-Position-in-Energy-and-Security-of-Machine-Learning-Applications-in-the-Cloud-to-Edge-Continuum/745019702/

Closing date for applications:

Contact: dr. Ana Oprescu (a.m.oprescu at uva.nl)

More information: https://vacatures.uva.nl/UvA/job/PhD-Position-in-Energy-and-Security-of-Machine-Learning-Applications-in-the-Cloud-to-Edge-Continuum/745019702/

We present TRIFORS (TRIlinear FOrms Ring Signature), a logarithmic post-quantum (linkable) ring signature based on a novel assumption regarding equivalence of alternating trilinear forms. The basis of this work is the construction by Beullens, Katsumata and Pintore from 2020 to obtain a linkable ring signature from a cryptographic group action. The group action on trilinear forms used here is the same employed in the signature presented by Tang et al. at EUROCRYPT 22. We first define a sigma protocol that, given a set of public keys, the ring, allows to prove the knowledge of a secret key corresponding to a public one in the ring. Furthermore, some optimisations are used to reduce the size of the signature: among others, we use a novel application of the combinatorial number system to the space of the challenges. Using the Fiat-Shamir transform, we obtain a (linkable) ring signature of competitive length with the state-of-the-art among post-quantum proposals for security levels 128 and 192.

Dynamic-committee proactive secret sharing (DPSS) enables the update of secret shares and the alternation of shareholders, which makes it a promising technology for long-term key management and committee governance. However, there is a huge gap in communication costs between the state-of-the-art asynchronous and non-asynchronous DPSS schemes. In this paper, we fill this gap and propose the first practical DPSS scheme, DyCAPS, with a cubic communication cost w.r.t. the number of shareholders. DyCAPS can be efficiently integrated into existing asynchronous BFT-based blockchains to support the member change in BFT committees, without increasing the overall asymptotic communication cost. The experimental results show that DyCAPS introduces acceptable latency during the reconfiguration of the committees.