International Association for Cryptologic Research

IACR News Central

Get an update on changes of the IACR web-page here. For questions, contact newsletter (at) iacr.org. You can also get this service via

To receive your credentials via mail again, please click here.

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

2013-05-28
05:22 [Pub][ePrint] Fully Homomorphic Encryption for Mathematicians, by Alice Silverberg

  We give an introduction to Fully Homomorphic Encryption for mathematicians. Fully Homomorphic Encryption allows untrusted parties to take encrypted data Enc(m_1),...,Enc(m_t) and any efficiently computable function f, and compute an encryption of f(m_1,...,m_t), without knowing or learning the decryption key or the raw data m_1,...,m_t. The problem of how to do this was recently solved by Craig Gentry, using ideas from algebraic number theory and the geometry of numbers. In this paper we discuss some of the history and background, give examples of Fully Homomorphic Encryption schemes, and discuss the hard mathematical problems on which the cryptographic security is based.



05:22 [Pub][ePrint] Towards Adoption of DNSSEC: Availability and Security Challenges, by Amir Herzberg and Haya Shulman

  DNSSEC deployment is long overdue; however, it

seems to be finally taking off. Recent cache poisoning attacks

motivate protecting DNS, with strong cryptography, rather than

with challenge-response \'defenses\'.

Our goal is to motivate and help correct DNSSEC deployment.

We discuss the state of DNSSEC deployment, obstacles to

adoption and potential ways to increase adoption. We then

present a comprehensive overview of challenges and potential

pitfalls of DNSSEC, well known and less known, including:DNSSEC deployment is long overdue; however, it

seems to be finally taking off. Recent cache poisoning attacks

motivate protecting DNS, with strong cryptography, rather than

with challenge-response \'defenses\'.

Our goal is to motivate and help correct DNSSEC deployment.

We discuss the state of DNSSEC deployment, obstacles to

adoption and potential ways to increase adoption. We then

present a comprehensive overview of challenges and potential

pitfalls of DNSSEC, well known and less known, including:

Vulnerable configurations: we present several DNSSEC configurations,

which are natural and, based on the limited

deployment so far, expected to be popular, yet are vulnerable

to attack. This includes NSEC3 opt-out records and interdomain

referrals (in NS, MX and CNAME records).

Incremental Deployment: we discuss potential for increased

vulnerability due to popular practices of incremental deployment,

and recommend secure practice.

Super-sized Response Challenges: DNSSEC responses include

cryptographic keys and hence are relatively long; we

explain how this extra-long responses cause interoperability

challenges, and can be abused for DoS and even DNS

poisoning. We discuss potential solutions.

Vulnerable configurations: we present several DNSSEC configurations,

which are natural and, based on the limited

deployment so far, expected to be popular, yet are vulnerable

to attack. This includes NSEC3 opt-out records and interdomain

referrals (in NS, MX and CNAME records).

Incremental Deployment: we discuss potential for increased

vulnerability due to popular practices of incremental deployment,

and recommend secure practice.

Super-sized Response Challenges: DNSSEC responses include

cryptographic keys and hence are relatively long; we

explain how this extra-long responses cause interoperability

challenges, and can be abused for DoS and even DNS

poisoning. We discuss potential solutions.



05:22 [Pub][ePrint] Private Interactive Communication Across an Adversarial Channel, by Ran Gelles and Amit Sahai and Akshay Wadia

  Consider two parties Alice and Bob, who hold private inputs x and y, and wish to compute a function f(x,y) privately in the information theoretic sense; that is, each party should learn nothing beyond f(x,y). However, the communication channel available to them is noisy. This means that the channel can introduce errors in the transmission between the two parties. Moreover, the channel is adversarial in the sense that it knows the protocol that Alice and Bob are running, and maliciously introduces errors to disrupt the communication, subject to some bound on the total number of errors. A fundamental question in this setting is to design a protocol that remains private in the presence of large number of errors.

If Alice and Bob are only interested in computing f(x,y) correctly, and not privately, then quite robust protocols are known that can tolerate a constant fraction of errors. However, none of these solutions is applicable in the setting of privacy, as they inherently leak information about the parties\' inputs. This leads to the question whether we can simultaneously achieve privacy and error-resilience against a constant fraction of errors.

We show that privacy and error-resilience are contradictory goals. In particular, we show that for every constant c > 0, there exists a function f which is privately computable in the error-less setting, but for which no private and correct protocol is resilient against a c-fraction of errors.



05:22 [Pub][ePrint] From Weak to Strong Zero-Knowledge and Applications, by Kai-Min Chung and Edward Lui and Rafael Pass

  The notion of \\emph{zero-knowledge} \\cite{GMR85} is formalized by requiring that for every malicious efficient verifier $V^*$, there exists an efficient simulator $S$ that can reconstruct the view of $V^*$ in a true interaction with the prover, in a way that is indistinguishable to \\emph{every} polynomial-time distinguisher. \\emph{Weak zero-knowledge} weakens this notions by switching the order of the quantifiers and only requires that for every distinguisher $D$, there exists a (potentially different) simulator $S_D$.

In this paper we consider various notions of zero-knowledge, and investigate whether their weak variants are equivalent to their strong variants. Although we show (under complexity assumption) that for the standard notion of zero-knowledge, its weak and strong counterparts are not equivalent, for meaningful variants of the standard notion, the weak and strong counterparts are indeed equivalent. Towards showing these equivalences, we introduce new non-black-box simulation techniques permitting us, for instance, to demonstrate that the classical 2-round graph non-isomorphism protocol of Goldreich-Micali-Wigderson \\cite{GMW91} satisfies a ``distributional\'\' variant of zero-knowledge.

Our equivalence theorem has other applications beyond the notion of zero-knowledge. For instance, it directly implies the \\emph{dense model theorem} of Reingold et al (STOC \'08), and the leakage lemma of Gentry-Wichs (STOC \'11), and provides a modular and arguably simpler proof of these results (while at the same time recasting these result in the language of zero-knowledge).



05:22 [Pub][ePrint] Secure information transmission based on physical principles, by Dima Grigoriev and Vladimir Shpilrain

  We employ physical properties of the real world to design a protocol for secure information transmission where one of the parties is able

to transmit secret information to another party over an insecure channel, without any prior secret arrangements between the parties.

The distinctive feature of this protocol, compared to all known

public-key cryptographic protocols, is that neither party uses a

one-way function. In particular, our protocol is secure against (passive) computationally unbounded adversary.



05:22 [Pub][ePrint] An efficient FHE based on the hardness of solving systems of non-linear multivariate equations, by GĂ©rald Gavin

  We propose a general framework to develop fully homomorphic encryption schemes (FHE) without using the Gentry\'s technique. The security relies on the difficulty of solving systems of non-linear equations (which is a $\\mathcal{NP}$-complete problem). While the security of our scheme has not been reduced to a provably hard instance of this problem,

security is globally investigated.



05:22 [Pub][ePrint] Speeding up QUAD, by Albrecht Petzoldt

  QUAD is a provable secure stream cipher based on multivariate polynomials which was proposed in 2006 by Berbain, Gilbert and Patarin \\cite{BG06}. In this paper we show how to speed up QUAD over GF(256) by a factor of up to 5.8. We get this by using structured systems of polynomials, in particular partially circulant polynomials and polynomials generated by a linear recurring sequence (LRS), instead of random ones. By using this strategy, we can also reduce the system parameter of QUAD by about 99 \\verb!%!. We furthermore present experiments, which seem to show that using structured polynomials of this special choice does not influence the security of QUAD.



05:22 [Pub][ePrint] Encrypted Secret Sharing and Analysis by Plaintext Randomization, by Stephen R. Tate and Roopa Vishwanathan and Scott Weeks

  In this paper we consider the problem of secret sharing where shares

are encrypted using a public-key encryption (PKE) scheme and

ciphertexts are publicly available. While intuition tells us that the

secret should be protected if the PKE is secure against

chosen-ciphertext attacks (i.e., CCA-secure), formally proving this

reveals some subtle and non-trivial challenges. We isolate the

problems that this raises, and devise a new analysis technique called

``plaintext randomization\'\' that can successfully overcome these

challenges, resulting in the desired proof. The encryption of

different shares can use one key or multiple keys, with natural

applications in both scenarios.



05:22 [Pub][ePrint] Attribute-Based Encryption with Fast Decryption, by Susan Hohenberger and Brent Waters

  Attribute-based encryption (ABE) is a vision of public key encryption that allows users to encrypt and decrypt messages based on user attributes. This functionality comes at a cost. In a typical implementation, the size of the ciphertext is proportional to the number of attributes associated with it and the decryption time is proportional to the number of attributes used during decryption. Specifically, many practical ABE implementations require one pairing operation per attribute used during decryption.

This work focuses on designing ABE schemes with fast decryption algorithms. We restrict our attention to expressive systems without system-wide bounds or limitations, such as placing a limit on the number of attributes used in a ciphertext or a private key. In this setting, we present the first key-policy ABE system where ciphertexts can be decrypted with a constant number of pairings. We show that GPSW ciphertexts can be decrypted with only 2 pairings by increasing the private key size by a factor of X, where X is the set of distinct attributes that appear in the private key. We then present a generalized construction that allows each system user to independently tune various efficiency tradeoffs to their liking on a spectrum where the extremes are GPSW on one end and our very fast scheme on the other. This tuning requires no changes to the public parameters or the encryption algorithm. Strategies for choosing an individualized user optimization plan are discussed. Finally, we discuss how these ideas can be translated into the ciphertext-policy ABE setting at a higher cost.



05:22 [Pub][ePrint] L-P States of RC4 Stream Cipher , by Jing Lv and Dongdai Lin

  The stream cipher RC4 was designed by R.Rivest in $1987$, and it is a widely deployed cipher. Many predictive states of RC4 for some special indices $i$ were presented in the last $20$ years. In this paper, we present several long term predictive states. These states increase the probability to guess part of the internal state in a known plaintext attack and present a cryptanalytic weakness of RC4. This paper also analyzes possible long term bias in the keystream and further propose a search method for the long term predictive states.



05:22 [Pub][ePrint] Multi-Party Computation of Polynomials and Branching Programs without Simultaneous Interaction, by S. Dov Gordon and Tal Malkin and Mike Rosulek and Hoeteck Wee

  Halevi, Lindell, and Pinkas (CRYPTO 2011) recently proposed a model for secure computation that captures communication patterns that arise

in many practical settings, such as secure computation on the web. In their model, each party interacts only once, with a single centralized server. Parties do not interact with each other; in fact, the parties need not even be online simultaneously.

In this work we present a suite of new, simple and efficient protocols for secure computation in this \"one-pass\" model. We give protocols that obtain optimal privacy for the following general tasks:

-- Evaluating any multivariate polynomial $F(x_1, \\ldots ,x_n)$ (modulo a large RSA modulus N), where the parties each hold an input $x_i$.

-- Evaluating any read once branching program over the parties\' inputs.

As a special case, these function classes include all previous functions for which an optimally private, one-pass computation was known, as well as many new functions, including variance and other statistical functions, string matching, second-price auctions, classification algorithms and some classes of finite automata

and decision trees.