International Association for Cryptologic Research

# IACR News Central

Get an update on changes of the IACR web-page here. For questions, contact newsletter (at) iacr.org. You can also get this service via

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

2012-08-05
15:17 [Pub][ePrint]

Consider a setting of two mutually distrustful parties Alice and Bob who want to securely

evaluate some function on pre­-specified inputs. The well studied notion of two­-party secure computation

allows them to do so in the stand­alone setting. Consider a deterministic function (e.g., 1­-out­-of­-2 bit

OT) that Alice and Bob can not evaluate trivially and which allows only Bob to receive the output. We

show that Alice and Bob can not securely compute any such function in the concurrent setting even

when their inputs are pre­-specified. Our impossibility result also extends to all deterministic functions in

which both Alice and Bob get the same output. Our results have implications in the bounded­-concurrent

setting as well.

15:17 [Pub][ePrint]

We present new protocols for {\\em publicly verifiable} secure outsourcing of polynomials and matrix multiplication, which can

be instantiated over RSA moduli, and proven secure under the DDH/RSA/Factoring Assumptions over such groups. Since all previous solutions are based on the use of bilinear maps, we demonstrate that publicly verifiable computation can be achieved even under different and standard assumptions.

Perhaps more interestingly, our solution can handle polynomials over finite fields of {\\em any} characteristic (starting from 2), and thus it can also support public verification of boolean formulas. This allows for a lot of flexibility, and it avoids the efficiency penalty of working bit by bit in fields larger than 2.

The core of our result is a new concept of Algebraic One-Way Functions which may be of independent interest.

2012-08-03
08:32 [Event][New]

Submission: 24 September 2012
From March 7 to March 8
Location: Paris, France

2012-08-02
15:17 [Pub][ePrint]

In this paper we present a novel, publicly verifiable mixing

scheme which has everlasting privacy towards observers: all the information published on the bulletin board by the mixes (audit information etc) reveals no information about the identity of any of the messages published. The correctness of the mixing process is statistical: even if all authorities conspire, they cannot change the contents of any message without being detected with overwhelming probability. We accomplish this by encoding the messages submitted using so-called Pedersen commitments. Decoding (opening) these is possible because we create a parallel mix-net run by the same mixes to which the public has no access. This private mix-net uses the same permutations as the public one, but uses homomorphic encryption, which is used to send auxiliary information (messages, decommitment values) through the mix-net to allow decoding.

15:17 [Pub][ePrint]

In 2007, the U.S. National Institute of Standards and Technology (NIST) announced a public contest aiming at the selection of a new standard for a cryptographic hash function. In this paper, the security margin of five SHA-3 finalists is evaluated with an assumption that attacks launched on finalists should be practically verified. A method of attacks applied is called logical cryptanalysis where the original task is expressed as a SATisfiability problem instance. A new toolkit is used to simplify the most arduous stages of this type of cryptanalysis and helps to mount the attacks in a uniform way. In the context of SAT-based attacks, it has been shown that all the finalists have substantially bigger security margin than the current standards SHA-256 and SHA-1. Two other metrics, software performance and hardware efficiency are combined with security results to provide a more comprehensive picture of the SHA-3 finalists.

2012-08-01
06:17 [Pub][ePrint]

This paper presents a new bit-parallel multiplier for the finite

field $GF(2^m)$ generated with an irreducible all-one polynomial.

Redundant representation is used to reduce the time delay of the

proposed multiplier, while a three-term Karatsuba-like formula is

combined with this representation to decrease the space complexity.

As a result, the proposed multiplier requires about 10 percent fewer

AND/XOR gates than the most efficient bit-parallel multipliers using

an all-one polynomial, while it has almost the same time delay as

the previously proposed ones.

06:17 [Pub][ePrint]

We study the weakness of key schedules from an observation: many existing attacks use the fact that the key schedules poorly distribute

key bits in the diffusion path of round function.

This reminds us of the importance of the diffusion\'s relation between key schedule and round function.

We present new cryptanalysis results by exploring such diffusion relation and propose a new criterion for necessary key schedule diffusion.

We discuss potential attacks and summarize the causes for key schedules without satisfying this criterion.

One major cause is that overlapping between the diffusion of key schedule and round function leads to information leakage of key bits.

Finally, a measure to estimate our criterion for recursive key schedules is presented.

Today designing key schedule still lacks practical and necessary principles.

For a practical key schedule with limited diffusion, our work adds more insight to its requirements and helps to maximize the security level.

06:17 [Pub][ePrint]

We show that it is possible to achieve perfect forward secrecy in two-message or one-round key exchange (KE) protocols that satisfy even stronger security properties than provided by the extended Canetti-Krawczyk (eCK) security model. In particular, we consider perfect forward secrecy in the presence of adversaries that can reveal ephemeral secret keys and the long-term secret keys of the actor of a session (similar to Key Compromise Impersonation).

We propose two new game-based security models for KE protocols. First, we formalize a slightly stronger variant of the eCK security model that we call eCKw. Second, we integrate perfect forward secrecy into eCKw, which gives rise to the even stronger eCK-PFS model. We propose a security-strengthening transformation (i.e., a compiler) between our new models. Given a two-message Diffie-Hellman type protocol secure in eCKw, our transformation yields a two-message protocol that is secure in eCK-PFS. As an example, we show how our transformation can be applied to the NAXOS protocol.

06:17 [Pub][ePrint]

We show how to exploit the encrypted key import functions of a

variety of different cryptographic devices to reveal the imported

key. The attacks are padding oracle attacks, where error messages

resulting from incorrectly padded plaintexts are used as a side

channel. In the asymmetric encryption case, we modify and improve

Bleichenbacher\'s attack on RSA PKCS#1v1.5 padding, giving new

cryptanalysis that allows us to carry out the `million message

attack\' in a mean of 49 000 and median of 14 500 oracle calls in the

case of cracking an unknown valid ciphertext under a 1024 bit key

(the original algorithm takes a mean of 215 000 and a median of 163

000 in the same case). We show how implementation details of certain

devices admit an attack that requires only 9 400 operations on

average (3 800 median). For the symmetric case, we adapt Vaudenay\'s

CBC attack, which is already highly efficient. We demonstrate the

vulnerabilities on a number of commercially available cryptographic

devices, including security tokens, smartcards

and the Estonian electronic ID card. The attacks are

efficient enough to be practical: we give timing details for all

the devices found to be vulnerable, showing how our optimisations make a qualitative difference to the practicality of the attack.

We give mathematical analysis of the effectiveness of the attacks,

extensive empirical results, and a discussion of countermeasures and manufacturer reaction.

06:17 [Pub][ePrint]

Recently, Sood-Sarje-Singh proposed an improvement to Liou et al.\'s dynamic ID-based remote user authentication scheme using smart cards to prevent impersonation attack, malicious user attack, off-line password guessing attack, and man-in-the-middle attack. However, we demonstrate that Sood et al.\'s scheme is still vulnerable to malicious user attack, impersonation attack and steal information from a database attack.

06:17 [Pub][ePrint]

Data access control is an effective way to ensure the data security in the cloud. However, due to data outsourcing and untrusted cloud servers, the data access control becomes a challenging issue in cloud storage systems. Existing access control schemes are no longer applicable to cloud storage systems, because they either produce multiple encrypted copies of the same data or require a fully trusted cloud server.

Ciphertext-Policy Attribute-based Encryption (CP-ABE) is a promising technique for access control of encrypted data. It requires a trusted authority manages all the attributes and distributes keys in the system. In cloud storage systems, there are multiple authorities co-exist and each authority is able to issue attributes independently.

However, existing CP-ABE schemes cannot be directly applied to the access control for multi-authority cloud storage systems, due to the inefficiency of decryption and revocation. In this paper, we propose DAC-MACS (Data Access Control for Multi-Authority Cloud Storage), an effective and secure data access control scheme with efficient decryption and revocation. Specifically, we construct a new multi-authority CP-ABE scheme with efficient decryption and also design an efficient attribute revocation method that can achieve both forward security and backward security. The analysis and the simulation results show that our DAC-MACS is highly efficient and provably secure under the security model.