International Association for Cryptologic Research

IACR News Central

Get an update on changes of the IACR web-page here. For questions, contact newsletter (at) You can also get this service via

To receive your credentials via mail again, please click here.

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

18:17 [Pub][ePrint] RKA Security beyond the Linear Barrier, by Mihir Bellare and Kenneth G. Paterson and Susan Thomson

  We provide a framework enabling the construction of IBE schemes that are secure under related-key attacks (RKAs). Specific instantiations of the framework yield RKA-secure IBE schemes for sets of related key derivation functions that are non-linear, thus overcoming a current barrier in RKA security. In particular, we obtain efficient IBE schemes that are RKA secure for sets consisting of all affine functions and all polynomial functions of bounded degree. These results are in the standard model and hold under reasonable hardness assumptions. Applying results of Bellare, Cash and Miller to these IBE schemes, we obtain the first constructions of public-key encryption and signature schemes secure against related key attacks for sets of non-linear related key derivation functions, both in the standard model under reasonable hardness assumptions. As a corollary, we provide the first jointly secure combined signature and encryption schemes for the RKA setting. We also describe a specific and highly efficient RKA-secure CCA-PKE scheme for affine related key derivation functions based on the KEM of Boyen, Mei and Waters. Finally, we explain how to obtain RKA-secure SE-CCA from strong RKA-secure IBE and give instantiations for sets of related key derivation functions that are non-linear.

18:17 [Pub][ePrint] Semantically-Secure Functional Encryption: Possibility Results, Impossibility Results and the Quest for a General Definition, by Mihir Bellare and Adam O\'Neill

  This paper explains that SS1-secure functional encryption (FE) as defined by Boneh, Sahai and Waters implicitly incorporates security under key-revealing selective opening attacks (SOA-K). This connection helps intuitively explain their impossibility results and also allows us to prove stronger ones. To fill this gap and move us closer to the (laudable) goal of a general and achievable notion of FE security, we seek and provide two ``sans SOA-K\'\' definitions of FE security that we call SS2 and SS3. We prove various possibility results about these definitions. We view our work as a first step towards the challenging goal of a general, meaningful and achievable notion of FE security.

18:17 [Pub][ePrint] Garbling XOR Gates ``For Free\'\' in the Standard Model, by Benny Applebaum

  Yao\'s Garbled Circuit (GC) technique is a powerful cryptographic tool which allows to ``encrypt\'\' a circuit $C$ by another circuit $\\hC$ in a way that hides all information except for the final output. Yao\'s original construction incurs a constant overhead in both computation and communication per gate of the circuit $C$ (proportional to the complexity of symmetric encryption). Kolesnikov and Schneider (ICALP 2008) introduced an optimized variant that garbles XOR gates ``for free\'\' in a way that involves no cryptographic operations and no communication. This variant has become very popular and has been employed in several practical implementations leading to notable performance improvements.

The security of the free-XOR optimization was originally proven in the random oracle model. In the same paper, Kolesnikov and Schneider also addressed the question of replacing the random oracle with a standard cryptographic assumption and suggested to use a hash function which achieves some form of security under correlated inputs. This claim was revisited by Choi et al. (TCC 2012) who showed that a stronger form of security is required, and proved that the free-XOR optimization can be realized based on a new primitive called \\emph{circular 2-correlation hash function}. Unfortunately, it is currently unknown how to implement this primitive based on standard assumptions, and so the feasibility of realizing the free-XOR optimization in the standard model remains an open question.

We resolve this question by showing that the free-XOR approach can be realized in the standard model under the \\emph{learning parity with noise} (LPN) assumption. Our result is obtained in two steps: (1) We show that the hash function can be replaced with a symmetric encryption which remains secure under a combined form of related-key and key-dependent attacks; and (2) We show that such a symmetric encryption can be constructed based on the LPN assumption.

18:17 [Pub][ePrint] Unconditionally Secure Asynchronous Multiparty Computation with Linear Communication Complexity, by Ashish Choudhury and Martin Hirt and Arpita Patra

  We present two unconditionally secure asynchronous multiparty computation (AMPC) protocols among n parties with an amortized communication complexity of O(n) field elements per multiplication gate and which can tolerate a computationally unbounded active adversary corrupting t< n /4 parties. These are the first AMPC protocols with linear communication complexity per multiplication gate. Our first protocol is statistically secure in a completely asynchronous setting and improves on the previous best AMPC protocol in the same setting by a factor of \\Theta(n). Our second protocol is perfectly secure in a hybrid setting, where one round of communication

is assumed to be synchronous and improves on the previous best AMPC protocol in the hybrid setting by a factor of \\Theta(n^2).

The central contribution common to both the protocols is a new, simple and communication efficient, albeit natural framework for the preprocessing (offline) phase that is used to generate sharings of random multiplication triples, to be used later for the circuit evaluation. The framework is built on two new components, both of which are instantiated robustly: the first component allows the parties to verifiably share random multiplication triples. The second component allows the parties to securely extract sharings of random multiplication triples from a set of sharings of multiplication triples, verifiably shared by individual parties. Our framework is simple and does not involve either of the existing somewhat complex, but popular techniques, namely player elimination and dispute control, used in the preprocessing phase of most of the existing protocols. The framework is of independent interest and can be adapted to other MPC scenarios to improve the overall round complexity.

18:17 [Pub][ePrint] Sequential Aggregate Signatures with Short Public Keys: Design, Analysis and Implementation Studies, by Kwangsu Lee and Dong Hoon Lee and Moti Yung

  The notion of aggregate signature has been motivated by applications and it enables any user to compress different signatures signed by different signers on different messages into a short signature. Sequential aggregate signature, in turn, is a special kind of aggregate signature that only allows a signer to add his signature into an aggregate signature in sequential order. This latter scheme has applications in diversified settings, such as in reducing bandwidth of a certificate chains, and in secure routing protocols. Lu, Ostrovsky, Sahai, Shacham, and Waters presented the first sequential aggregate signature scheme in the standard (non idealized ROM) model. The size of their public key, however, is quite large (i.e., the number of group elements is proportional to the security parameter), and therefore they suggested as an open problem the construction of such a scheme with short keys. Schr\\\"oder recently proposed a sequential aggregate signature (SAS) with short public keys using the Camenisch-Lysyanskaya signature scheme, but the security is only proven under an interactive assumption (which is considered a relaxed notion of security).

In this paper, we propose the first sequential aggregate signature scheme with short public keys (i.e., a constant number of group elements) in prime order (asymmetric) bilinear groups which is secure under static assumptions in the standard model. Further, our scheme employs constant number of pairing operation per message signing and message verification operation. Technically, we start with a public key signature scheme based on the recent dual system encryption technique of Lewko and Waters. This technique cannot give directly an aggregate signature scheme since, as we observed, additional elements should be published in the public key to support aggregation (and these may, in fact, invalidate the security arguments). Thus, our construction is a careful augmentation technique for the dual system technique to allow it to support a sequential aggregate signature scheme via randomized verification. We further implemented our scheme and conducted a performance study and implementation optimization.

18:17 [Pub][ePrint] Faster implementation of scalar multiplication on Koblitz curves, by Diego F. Aranha and Armando Faz-Hernández and Julio López and Francisco Rodríguez-Henríquez

  We design a state-of-the-art software implementation of field and elliptic curve arithmetic in standard Koblitz curves at the 128-bit security level. Field arithmetic is carefully crafted by using the best formulae and implementation strategies available, and the increasingly common native support to binary field arithmetic in modern desktop computing platforms. The i-th power of the Frobenius automorphism on Koblitz curves is exploited to obtain new and faster interleaved versions of the well-known $\\tau$NAF scalar multiplication algorithm. The usage of the $\\tau^{\\lfloor m/3 \\rfloor}$ and

$\\tau^{\\lfloor m/4 \\rfloor}$ maps are employed to create analogues of the 3-and 4-dimensional GLV decompositions and in general, the $\\lfloor m/s \\rfloor$-th power of the Frobenius automorphism is applied as an analogue of an $s$-dimensional GLV decomposition. The effectiveness of these techniques is illustrated by timing the scalar multiplication operation for fixed, random and multiple points. To our knowledge, our library was the first to compute a random point scalar multiplication in less than 10^5 clock cycles among all curves with or without endomorphisms defined over binary or prime fields. The results of our optimized implementation suggest a trade-off between speed, compliance with the published standards and side-channel protection. Finally, we estimate the performance of curve-based cryptographic protocols instantiated using the proposed techniques and compare our results to related work.

06:10 [Job][New] Research Scientist / Senior Research Scientist, Palo Alto Research Center (PARC, a Xerox Company)

  We invite applications for outstanding researchers to strengthen and broaden our research activities in security research. Our expertise ranges from applied cryptography and privacy to network, system, and usable security. Both recent Ph.D. graduates and well-established scientists are encouraged to apply.

A premier center for commercial innovation, PARC, a Xerox company, is in the business of breakthroughs. We work closely with global enterprises, entrepreneurs, government agencies and partners, and other clients to invent, co-develop, and bring to market game-changing innovations by combining imagination, investigation, and return on investment for our clients. For 40 years, we have lived at the leading edge of innovation, merging inquiry and strategy to pioneer technological change. PARC was incorporated in 2002 as a wholly owned independent subsidiary of Xerox Corporation – enabling us to continue pioneering technological change but across a broader set of industries and clients today.

Depending on seniority, the successful candidate will be responsible for one or more of the following roles:

. Formulating research problems based on real-world needs and independently conducting high-quality research

. Working with existing research and development staff on a broad range of research topics

. Working with business development team in identifying important business opportunities with industry and government agencies.

. Identifying new promising research directions and contributing them to the group’s long-term research agenda.

Candidates in all areas of cyber security will be considered, however, the following areas are of particular interest:

. Systems & network security

. Security in cloud computing

. Data mining and machine learning applied to security and privacy

. Security and privacy in ubiquitous and mobile computing environments

06:10 [Job][New] Lecturer or Senior Lecturer, University of Cape Town, South Africa

  Applications are sought for a position at the level of Lecturer or Senior Lecturer in the Department of Mathematics and Applied Mathematics at the University of Cape Town. This is a large, dynamic department and a leading research centre in mathematical sciences in the country. It has over thirty faculty members, ten administrative staff members and more than 50 postgraduate students.

Candidates must be in possession of a PhD in the Mathematical Sciences and are expected to have a research track record, which must show some evidence of independence for Senior Lecturer level.

Applications in all areas in Mathematics and Applied Mathematics will be considered. We are particularly seeking active researchers whose research field complements or strengthens existing research areas in our department. For further details on the Department please see our website at

The successful applicants would be expected to teach not only in their areas of research, but also service courses offered to other Faculties such as Engineering and Commerce, to contribute to the administration of the department and its courses, and to supervise students.

Candidates should indicate for which level of position they are applying and the level of appointment will be commensurate with experience and standing of applicants.

The annual remuneration packages, including benefits, for the following levels are:

· Senior Lecturer : R526 873

· Lecturer : R427 311

00:07 [News] Videos from Crypto 2012

  Videos from Crypto 2012 are now online at YouTube and cryptodb.

15:17 [Pub][ePrint] Desynchronization Attack on RAPP Ultralightweight Authentication Protocol, by Zahra Ahmadian, Mahmoud Salmasizadeh, and Mohammad Reza Aref

  RAPP (RFID Authentication Protocol with Permutation) is a recently proposed efficient ultralightweight authentication protocol. The operation used in this protocol is totally different from the other existing ultralightweight protocols due to the use of new introduced data dependent permutations and avoidances of modular arithmetic operations and biased logical operations such as AND and OR. The designers of RAPP claimed that this protocol resists against desynchronization attacks since the last messages of the protocol is sent by the reader and not by the tag. This letter challenges this assumption and shows that RAPP is vulnerable against desynchronization attack. This attack has a remarkable probability of success and is effective whether Hamming weight-based or modular-based rotations are used by the protocol.

15:17 [Pub][ePrint] On the Multiple Fault Attack on RSA Signatures with LSBs of Messages Unknown, by Lidong Han and Wei Wei and Mingjie Liu

  In CHES 2009, Coron, Joux, Kizhvatov, Naccache and

Paillier(CJKNP) introduced a fault attack on

RSA signatures with partially unknown messages. They

factored RSA modulus $N$ using a single faulty signature and

increased the bound of unknown messages by multiple fault attack,

however, the complexity multiple fault attack is exponential in the

number of faulty signatures. At RSA 2010, it was improved which run

in polynomial time in number of faults.

Both previous multiple fault attacks deal with the general case that

the unknown part of message is in the middle. This paper handles a

special situation that some least significant bits of messages are

unknown. First, we describe a sample attack by utilizing the

technique of solving simultaneous diophantine approximation problem,

and the bound of unknown message is $N^{\\frac1{2}-\\frac1{2\\ell}}$

where $\\ell$ is the number of faulty signatures. Our attacks are

heuristic but very efficient in practice. Furthermore, the new bound

can be extended up to $N^{\\frac1{2}^{1+\\frac1{\\ell}}}$ by the

Cohn-Heninger technique. Comparison between previous attacks and new

attacks with LSBs of message unknown will be given by simulation