*21:17* [Pub][ePrint]
Tweakable Blockciphers with Beyond Birthday-Bound Security, by Will Landecker and Thomas Shrimpton and R. Seth Terashima
Liskov, Rivest and Wagner formalized the tweakable blockcipher (TBC) primitive at CRYPTO\'02. The typical recipe for instantiating a TBC is to start with a blockcipher, and then build up a construction that admits a tweak. Almost all such constructions enjoy provable security only to the birthday bound, and the one that does achieve security beyond the birthday bound (due to Minematsu) severely restricts the tweak size and requires per-invocation blockcipher rekeying.This paper gives the first TBC construction that simultaneously allows for arbitrarily \"wide\" tweaks, does not rekey, and delivers provable security beyond the birthday bound. Our construction is built from a blockcipher and an $\\eAXU$ hash function.

As an application of the TBC primitive, LRW suggest the TBC-MAC construction (similar to CBC-MAC but chaining through the tweak), but leave open the question of its security. We close this question, both for TBC-MAC as a PRF and a MAC. Along the way, we find a nonce-based variant of TBC-MAC that has a tight reduction to the security of the underlying TBC, and also displays graceful security degradation when nonces are misused. This result is interesting on its own, but it also serves as an application of our new TBC construction, ultimately giving a variable input-length PRF with beyond birthday-bound security.

*07:14* [Conf][CHES]
invited speakers announced
CHES 2012 will feature 2 invited talks
Steven Murdoch

University of Cambridge, UK

Title: "Banking Security: Attacks and Defences"

Christof Tarnovsky

Flylogic Engineering

Title: TBD

*15:17* [Pub][ePrint]
Improved CRT Algorithm for Class Polynomials in Genus 2, by Kristin Lauter and Damien Robert
We present a generalization to genus 2 of the probabilisticalgorithm in Sutherland~\\cite{Sutherland} for computing Hilbert class polynomial˻s. The improvement over the algorithm presented

in~\\cite{BGL} for the genus 2 case, is that we do not need to find a

curve in the isogeny class with endomorphism ring which is the maximal

order: rather we present a probabilistic algorithm for ``going up\'\' to a {\\it

maximal} curve (a curve with maximal endomorphism ring), once we find {\\it

any} curve in the right isogeny class. Then we use the structure of the

Shimura class group and the computation of $(\\ell,\\ell)$-isogenies to

compute all isogenous maximal curves from an initial one.

*15:17* [Pub][ePrint]
Differential Fault Analysis of AES: Towards Reaching its Limits, by Sk Subidh Ali , Debdeep Mukhopadhyay, and Michael Tunstall
In this paper we present a theoretical analysis of the limitsof the Differential Fault Analysis (DFA) of AES by developing an inter

relationship between conventional cryptanalysis of AES and DFAs. We

show that the existing attacks have not reached these limits and present techniques to reach these. More specifically, we propose optimal DFA on states of AES-128 and AES-256. We also propose attacks on the key schedule of the three versions of AES, and demonstrate that these are some of the most efficient attacks on AES to date. Our attack on AES-128 key schedule is optimal, and the attacks on AES-192 and AES-256 key schedule are very close to optimal. Detailed experimental results have been provided for the developed attacks. The work has been compared to other works and also the optimal limits of Differential Fault Analysis of AES.

*15:17* [Pub][ePrint]
Multi-receiver Homomorphic Authentication Codes for Network Coding, by Zhaohui Tang, and Hoon Wei Lim
We investigate a new class of authenticate codes (A-codes) that support verificationby a group of message recipients in the network coding setting. That is, a sender generates an

A-code over a message such that any intermediate node or recipient can check the authenticity

of the message, typically to detect pollution attacks. We call such an A-code as multi-receiver

homomorphic A-code (MRHA-code). In this paper, we first formally define an MRHA-code.

We then derive some lower bounds on the security parameters and key sizes associated with our

MRHA-codes. Moreover, we give efficient constructions of MRHA-code schemes that can be used

to mitigate pollution attacks on network codes. Unlike prior works on computationally secure

homomorphic signatures and MACs for network coding, our MRHA-codes achieve unconditional

security.

*18:17* [Pub][ePrint]
Differential Privacy with Imperfect Randomness, by Yevgeniy Dodis and Adriana Lopez-Alt and Ilya Mironov and Salil Vadhan
In this work we revisit the question of basing cryptography on imperfect randomness. Bosley and Dodis (TCC\'07) showed that if a source of randomness R is \"good enough\" to generate a secret key capable of encrypting k bits, then one can deterministically extract nearly k almost uniform bits from R, suggesting that traditional privacy notions (namely, indistinguishability of encryption) requires an \"extractable\" source of randomness. Other, even stronger impossibility results are known for achieving privacy under specific \"non-extractable\" sources of randomness, such as the gamma-Santha-Vazirani (SV) source, where each next bit has fresh entropy, but is allowed to have a small bias gamma< 1$ (possibly depending on prior bits).We ask whether similar negative results also hold for a more recent notion of privacy called differential privacy (Dwork et al., TCC\'06), concentrating, in particular, on achieving differential privacy with the Santha-Vazirani source. We show that the answer is no. Specifically, we give a differentially private mechanism for approximating arbitrary \"low sensitivity\" functions that works even with randomness coming from a gamma-Santha-Vazirani source, for any gamma

*18:17* [Pub][ePrint]
Secure Database Commitments and Universal Arguments of Quasi Knowledge, by Melissa Chase and Ivan Visconti
In this work we focus on a simple database commitment functionality where besides the standard security properties, one would like to hide the size of the input of the sender. Hiding the size of the input of a player is a critical requirement in some applications, and relatively few works have considered it. Notable exceptions are the work on zero-knowledge sets introduced in~\\cite{MRK03}, and recent work on size-hiding private set intersection~\\cite{ADT11}. However, neither of these achieves a secure computation (i.e., a reduction of a real-world attack of a malicious adversary into an ideal-world attack) of the proposed functionality.The first result of this submission consists in defining ``secure\'\' database commitment and in observing that previous constructions do not satisfy this definition. This leaves open the question of whether there is any way this functionality can be achieved.

We then provide an affirmative answer to this question by using new techniques that combined together achieve ``secure\'\' database commitment. Our construction is in particular optimized to require only a constant number of rounds, to provide non-interactive proofs on the content of the database, and to rely only on the existence of a family of CRHFs. This is the first result where input-size hiding secure computation is achieved for an interesting functionality and moreover we obtain this result with standard security (i.e., simulation in expected polynomial time against fully malicious adversaries, without random oracles, non-black-box extraction assumptions, hardness assumptions against super-polynomial time adversaries, or other controversial/strong assumptions).

A key building block in our construction is a universal argument enjoying an improved proof of knowledge property, that we call quasi-knowledge. This property is significantly closer to the standard proof of knowledge property than the weak proof of knowledge property satisfied by previous constructions.