International Association for Cryptologic Research

IACR News Central

Get an update on changes of the IACR web-page here. For questions, contact newsletter (at) iacr.org. You can also get this service via

To receive your credentials via mail again, please click here.

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

2013-08-14
15:17 [Pub][ePrint] Efficient Multiparty Protocols via Log-Depth Threshold Formulae, by Gil Cohen, Ivan Bjerre Damg{\\aa}rd, Yuval Ishai, Jonas K\\\"{o}lker, Peter Bro Miltersen, Ran Raz and Ron D. Rothblum

  We put forward a new approach for the design of efficient multiparty protocols:

1. Design a protocol for a small number of parties (say, 3 or 4)

which achieves security against a single corrupted party. Such

protocols are typically easy to construct as they may employ

techniques that do not scale well with the number of corrupted

parties.

2. Recursively compose with itself to obtain an efficient n-party

protocol which achieves security against a constant fraction of

corrupted parties.

The second step of our approach combines the player emulation

technique of Hirt and Maurer (J. Cryptology, 2000) with

constructions of logarithmic-depth formulae which compute

threshold functions using only constant fan-in threshold gates.

Using this approach, we simplify and improve on previous results

in cryptography and distributed computing. In particular:

- We provide conceptually simple constructions of efficient

protocols for Secure Multiparty Computation (MPC) in the

presence of an honest majority, as well as broadcast protocols

from point-to-point channels and a 2-cast primitive.

- We obtain new results on MPC over blackbox groups and other

algebraic structures.

The above results rely on the following complexity-theoretic

contributions, which may be of independent interest:

- We show that for every integers j,k such that m = (k-1)/(j-1)

is an integer, there is an explicit (poly(n)-time) construction

of a logarithmic-depth formula which computes a good

approximation of an (n/m)-out-of-n threshold function using only

j-out-of-k threshold gates and no constants.

- For the special case of n-bit majority from 3-bit majority

gates, a non-explicit construction follows from the work of

Valiant (J. Algorithms, 1984). For this special case, we provide

an explicit construction with a better approximation than for the

general threshold case, and also an exact explicit construction

based on standard complexity-theoretic or cryptographic

assumptions.



15:17 [Pub][ePrint] Cryptanalysis of the Huang-Liu-Yang Cryptosystem from PKC 2012, by Yosuke Todo and Keita Xagawa

  This short note describes a key-recovery attack against a multivariate quadratic cryptosystem proposed by Huang, Liu, and Yang (PKC 2012). Our attack is running lattice-basis reduction algorithms on a lattice constructed from the keys in the cryptosystem. The attack takes less than 20 minutes for the proposed parameter sets which are expected to be 80-bit and 128-bit security.



15:17 [Pub][ePrint] Bounds in Shallows and in Miseries, by Céline Blondeau and Andrey Bogdanov and Gregor Leander

  Proving bounds on the expected differential probability (EDP) of a characteristic over all keys has been a popular technique of arguing security for both block ciphers and hash functions. In fact, to a large extent, it was the clear formulation and elegant deployment of this very principle that helped Rijndael win the AES competition. Moreover, most SHA-3 finalists have come with explicit upper bounds on the EDP of a characteristic as a major part of their design rationale. However, despite the pervasiveness of this design approach, there is no understanding of what such bounds actually mean for the security of a primitive once a key is fixed --- an essential security question in practice.

In this paper, we aim to bridge this fundamental gap. Our main result is a quantitative connection between a bound on the EDP of differential characteristics and the highest

number of input pairs that actually satisfy a characteristic for a fixed key. This is particularly important for the design of permutation-based hash functions such as sponge functions, where the EDP value itself is not informative for the absence of rekeying. We apply our theoretical result to revisit the security arguments of some prominent recent block ciphers and hash functions. For most of those, we have good news: a characteristic is followed by a small number of pairs only. For Keccak, though, currently much more rounds would be needed for our technique to guarantee any reasonable maximum number of pairs.

Thus, our work --- for the first time --- sheds light on the fixed-key differential behaviour of block ciphers in general and substitution-permutation networks in particular which has been a long-standing fundamental problem in symmetric-key cryptography.



15:17 [Pub][ePrint] A Variant of Coppersmith\'s Algorithm with Improved Complexity and Efficient Exhaustive Search, by Jean-Sébastien Coron and Jean-Charles Faugère and Guénaël Renault and Rina Zeitoun

  Coppersmith described at Eurocrypt 96 a polynomial-time algorithm for finding small roots of univariate modular equations, based on lattice reduction. In this paper we describe the first improvement of the asymptotic complexity of Coppersmith\'s algorithm. Our method consists in taking advantage of Coppersmith\'s matrix structure, in order to apply LLL algorithm on a matrix whose elements are smaller than those of Coppersmith\'s original matrix. Using the $L^2$ algorithm, the asymptotic complexity of our method is $O(\\log^{6+\\epsilon} N)$ for any $\\epsilon > 0$, instead of $O(\\log^{8+\\epsilon} N)$ previously. Furthermore, we devise a method that allows to speed up the exhaustive search which is usually performed to reach Coppersmith\'s theoretical bound. Our approach takes advantage of the LLL performed to test one guess, to reduce complexity of the LLL performed for the next guess. Experimental results confirm that it leads to a considerable performance improvement.



15:17 [Pub][ePrint] Efficient Public Integrity Checking for Cloud Data Sharing with Multi-User Modification, by Jiawei Yuan and Shucheng Yu

  In past years a body of data integrity checking techniques have been proposed for securing cloud data services. Most of these work assume that only the data owner can modify cloud-stored data. Recently a few attempts started considering more realistic scenarios by allowing multiple cloud users to modify data with integrity assurance. However, these attempts are still far from practical due to the tremendous computational cost on cloud users. Moreover, collusion between misbehaving cloud servers and revoked users is not considered. This paper proposes a novel data integrity checking scheme characterized by multi-user modification, collusion resistance and a constant computational cost of integrity checking for cloud users, thanks to our novel design of polynomial-based authentication tags and proxy tag update techniques. Our scheme also supports public checking and efficient user revocation and is provably secure. Numerical analysis and extensive experimental results show the efficiency and scalability of our proposed scheme.



15:17 [Pub][ePrint] A New Object Searching Protocol for Multi-tag RFID, by Subhasish Dhal and Indranil Sengupta

  Searching an object from a large set is a tedious task. Radio Frequency IDentification (RFID) technology helps us to search the desired object efficiently. In this technology, a small chip called RFID tag, that contains the identification information about an object is attached to the same object. In general, a set of objects are attached with RFID tags. To find out a particular object preserving the possible security requirements, the RFID reader requests the tag in desired object to respond with its encrypted identification information. Since there is a response only from the tag in desired object the adversary gets the knowledge of existence of the desired object. Fake response from tag in undesired objects may fool the adversary. However, computation for fake responses is

an overhead. In this paper, we propose a search technique which has a negligible amount of computation for fake responses. Multiple tags in the same object increases the detection probability and also the probability of success in search process. Our aim is to search a particular object efficiently preserving the possible security requirements amid various resource limitations in low-cost RFID tag.



15:17 [Pub][ePrint] Handling Authentication and Detection Probability in Multi-tag RFID Environment, by Subhasish Dhal and Indranil Sengupta

  In Radio Frequency Identification (RFID) technology, an adversary

may access classified information about an object tagged with RFID tag. Therefore, authentication is a necessary requirement. Use of multiple tags in an object increases the detection probability and simultaneously ensures availability of multiple resources in the form of memory and computability. Authentication process in multi-tag arrangement may increase the traffic between reader and object and/or decrease the detection probability. Therefore the challenge is to keep intact the detection probability without increasing the traffic. Existence of multiple number of tags helps to distribute the authentication responsibility for an object among multiple number of tags. In this paper, we assume that an object is attached with multiple number of active tags and in each session a randomly selected tag is responsible for authentication process. The detection probability is intact since an active tag within the range of reader can be an inter-mediator.



15:17 [Pub][ePrint] Classification of Elliptic/hyperelliptic Curves with Weak Coverings against GHS Attack under an Isogeny Condition, by Tsutomu Iijima and Fumiyuki Momose and Jinhui Chao

  The GHS attack is known as a method to map the discrete logarithm problem(DLP) in the Jacobian of a curve C_{0} defined over the d degree extension k_{d} of a finite field k to the DLP in the Jacobian of a new curve C over k which is a covering curve of C_{0}. Such curves C_{0}/k_{d} can be attacked by the GHS attack and index calculus algorithms. In this paper, we will classify all elliptic curves and hyperelliptic curves C_{0}/k_{d} of genus 2, 3 which possess (2,...,2) covering C/k of \\Bbb{P}^1 under the isogeny condition (i.e. g(C)=d \\cdot g(C_{0})) in odd characteristic case. Our main approach is analysis of ramification points and representation of the extension of Gal(k_{d}/k) acting on the covering group cov(C/\\Bbb{P}^1). Consequently, all explicit defining equations of such curves C_0/k_d and existential conditions of a model of C over k are provided.





2013-08-12
11:28 [Event][New] SSPA2013: Smart Sensor Protocols and Algorithms 2013

  Submission: 31 August 2013
Notification: 12 October 2013
From December 11 to December 13
Location: Dalian, China
More Information: http://jlloret.webs.upv.es/sspa2013/index.html




2013-08-10
18:27 [Event][New] Congress on privacy and surveillance

  Submission: 30 September 2013
From September 30 to September 30
Location: Lausanne, Switzerland
More Information: http://ic.epfl.ch/privacy-surveillance