*19:17* [Pub][ePrint]
Bounded-Collusion Identity-Based Encryption from Semantically-Secure Public-Key Encryption: Generic Constructions with Short Ciphertexts, by Stefano Tessaro and David A. Wilson
Identity-based encryption (IBE) is a special case of public-key encryption where user identities replace public keys. Every user is given a corresponding secret key for decryp- tion, and encryptions for his or her identity must remain confidential even to attackers who learn the secret keys associated with other identities. Several IBE constructions are known to date, but their security relies on specific assumptions, such as quadratic residuosity, as well as different pairing-based and lattice-based assumptions.To circumvent the lack of generic constructions, Dodis et al. (EUROCRYPT \'02) introduced the notion of bounded-collusion IBE (BC-IBE), where attackers only learn secret keys of an a-priori bounded number t of identities. They provided a generic BC-IBE construction from any semantically-secure encryption scheme which, however, suffers from a ω(t) blow-up in ciphertext size. Goldwasser et al. (TCC 2012) recently presented a generic construction with no ciphertext-length blow-up. Their construction requires an underlying public-key scheme with a key homomorphism, as well as a hash-proof-style security definition that is strictly stronger than semantic security. This latter requirement in particular reduces the applicability of their construction to existing schemes.

In this paper, we present the first generic constructions of BC-IBE from semantically-secure encryption schemes with no ciphertext-length blow-up. Our constructions require different degrees of key-homomorphism and malleability properties that are usually easy to verify. We provide concrete instantiations based on the DDH, QR, NTRU, and LWE assumptions. For all of these assumptions, our schemes present the smallest BC-IBE ciphertext size known to date. Our NTRU-based construction is particularly interesting, due to the lack of NTRU- based IBE constructions as well as the fact that it supports fully-homomorphic evaluation. Our results also yield new constructions of bounded CCA-secure cryptosystems.

*19:17* [Pub][ePrint]
A Comparison of the Homomorphic Encryption Schemes FV and YASHE, by Tancrède Lepoint and Michael Naehrig
We conduct a theoretical and practical comparison of two Ring-LWE-based, scale-invariant, leveled homomorphic encryption schemes -- Fan and Vercauteren\'s adaptation of BGV and the YASHE scheme proposed by Bos, Lauter, Loftus and Naehrig. In particular, we explain how to choose parameters to ensure correctness and security against lattice attacks. Our parameter selection improves the approach of van de Pol and Smart to choose parameters for schemes based on the Ring-LWE problem by using the BKZ-2.0 simulation algorithm.We implemented both schemes in C++, using the arithmetic library FLINT, and compared them in practice to assess their respective strengths and weaknesses. In particular, we performed a homomorphic evaluation of the lightweight block cipher SIMON. Combining block ciphers with homomorphic encryption allows to solve the gargantuan ciphertext expansion in cloud applications.

*04:47* [PhD][Update]
Constantin Catalin Dragan: Security of CRT-based Secret Sharing Schemes
Name: Constantin Catalin Dragan

Topic: Security of CRT-based Secret Sharing Schemes

Category:(no category)

Description: The Chinese Remainder Theorem (CRT) is a very useful tool in many areas of theoretical and practical cryptography. One of these areas is the theory of threshold secret sharing schemes. A *(t+1,n)*-threshold secret sharing scheme is a method of partitioning a secret among *n* users by providing each user with a share of the secret such that any *t+1* users can uniquely reconstruct the secret by pulling together their shares. Several threshold schemes based on CRT are known. These schemes use sequences of pairwise co-prime positive integers with special properties. The shares are obtained by dividing the secret or a secret-dependent quantity by the numbers in the sequence and collecting the remainders. The secret can be reconstructed by some sufficient number of shares by using CRT. It is well-known that the CRT-based threshold secret sharing schemes are not perfect (and, therefore, not ideal) but some of them are asymptotically perfect and asymptotically ideal and perfect zero-knowledge if sequences of consecutive primes are used for defining them.

In this thesis we introduce *(k-)compact sequences of co-primes* and their applications to the security of CRT-based threshold secret sharing schemes is thorough investigated. Compact sequences of co-primes may be significantly denser than sequences of consecutive primes of the same length, and their use in the construction of CRT-based threshold secret sharing schemes may lead to better security properties. Concerning the asymptotic idealness property for CRT-based threshold schemes, we have shown there exists a necessary and sufficient condition for the Goldreich-Ron-Sudan (GRS) scheme and Asmuth-Bloom scheme if and only if *(1-)compact sequences of co-primes* are used. Moreover, the GRS and Asmuth-Bloom schemes based on *k*-compact sequences of co-primes are asymptotically perfect and perfect zero-knowledge. The Mignotte scheme is far from being asymptotically perfect and pe[...]

*14:48* [Job][New]
Postdoc in Cryptology, *Technical University of Denmark, DTU*
Department of Applied Mathematics and Computer Science, Technical University of Denmark, would like to invite applications for a Postdoc position of 18 months, starting 1 April 2014 or soon thereafter. The topic of the project is lightweight cryptology, which regards scenarios involving strongly resource-constrained devices.Candidates for the position should have a solid background in hardware design and automation and be able to work on the physical constraints and optimization of the hardware implementations or, alternatively, we will consider candidates with a strong cryptanalytic and mathematical background who are able to analyse the security of ciphers to be designed.

*14:44* [Job][New]
Post-Doc in Applied Cryptography, *University of Trier, Germany*
The Chair for Information Security and Cryptography at the University of Trier, Germany, offersa full-time position for a postdoctoral researcher

in a project funded by the German Research Foundation (DFG). The goal of the project is to develop methods for the modular analysis of real-world cryptographic protocols, such as TLS, SSH, WPA2, etc., based on the approach of universal composability, and to apply the developed methods to such protocols.

The position is available immediately, with an internationally competitive salary. The starting date is negotiable. Contracts can initially be offered for up to three years, with the perspective of an extension.

There are no teaching obligations.

The successful candidate must have a Master`s degree (or an equivalent degree) in Computer Science, Mathematics, or a related discipline, and have completed, or be near completion of a PhD degree relevant to the research area of the project. You should have a proven high level of analytical capability and mathematical skills. Good English skills are expected; knowledge of German is not required.

Applications will be considered until the position is filled.

*10:17* [Pub][ePrint]
Cryptanalysis of FIDES, by Itai Dinur and Jérémy Jean
FIDES is a lightweight authenticated cipher, presented at CHES 2013.The cipher has two version, providing either 80-bit or 96-bit

security. In this paper, we describe internal state-recovery attacks

on both versions of FIDES, and show that once we recover the internal

state, we can use it to immediately forge any message. Our attacks are

based on a guess-and-determine algorithm, exploiting the slow

diffusion of the internal linear transformation of FIDES. Our most

basic attacks have time complexities of 2^{75} and 2^{90} for FIDES-80

and FIDES-96, respectively, use a very small amount of memory, and

their most distinctive feature is their very low data complexity: the

attacks require at most 24 bytes of an arbitrary plaintext and its

corresponding ciphertext, in order to break the cipher with

probability 1. In addition to the basic attacks, we describe optimized

attacks which exploit additional data in order to reduce the time

complexities to 2^{73} and 2^{88} for FIDES-80 and FIDES-96,

respectively.